From nobody Wed Jul 1 00:59:21 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D371E3A09DB for ; Wed, 1 Jul 2020 00:59:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q34QsCFsIi_V for ; Wed, 1 Jul 2020 00:59:18 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BEA563A09D9 for ; Wed, 1 Jul 2020 00:59:18 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-166.access.rits.tisf.net [24.104.150.166]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 86252B0588; Wed, 1 Jul 2020 07:59:14 +0000 (UTC) From: Paul Vixie To: Ted Lemon Cc: add@ietf.org Date: Wed, 01 Jul 2020 07:54:26 +0000 Message-ID: <4703088.fjZbX7tNNj@linux-9daj> Organization: none In-Reply-To: References: <2560148.jvFFTcX3xC@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 07:59:20 -0000 On Wednesday, 1 July 2020 05:59:51 UTC Ted Lemon wrote: > On Jul 1, 2020, at 1:34 AM, Paul Vixie wrote: > > as i wrote, there are other network configuration parameters which are > > also valuable targets, such as outbound proxy settings. >=20 > Who configures those with DHCP? That would be insane. my IoT devices hate me, because i won't let them speak directly to their=20 motherships, and lacking keyboards or ssh listeners, i have no way to tell= =20 them what proxy they would have to use to be successful. if you want me to= =20 agree that IoT is insane, i probably will. but it's our world. > It sounds like a validating stub resolver will fail to work with your > product. well, yes and no. i want certain resolutions to fail. these fail. exactly h= ow=20 that failure is obtained matters less to me than the failure itself. > > i think i should have paid more attention at that time, and i apologize. > > DHCP was always the wrong thing to build, like BOOTP before it, and IPv6 > > address assignment after it. secure hosting networks have to use /30 and > > later /31 netmasks (one customer per vlan) in order to trust any of thi= s. >=20 > I don=E2=80=99t know what a =E2=80=9Csecure hosting network=E2=80=9D is. = Is that an IETF thing? definitely not an IETF thing. rather, it's the real world. =2D-=20 Paul From nobody Wed Jul 1 04:11:16 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 669A23A0E3D for ; Wed, 1 Jul 2020 04:11:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id okvN9GMjnjQx for ; Wed, 1 Jul 2020 04:11:14 -0700 (PDT) Received: from mail-il1-x129.google.com (mail-il1-x129.google.com [IPv6:2607:f8b0:4864:20::129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 075653A0E3B for ; Wed, 1 Jul 2020 04:11:14 -0700 (PDT) Received: by mail-il1-x129.google.com with SMTP id i18so20678778ilk.10 for ; Wed, 01 Jul 2020 04:11:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=EnSIATaKBRuHsQvfh4BBBhPFfL/ac6gnLfX9fAZ+7n4=; b=T0y0Sd/JLQXATaDJ1prgCxexntgXHFOuX+oOKtqJ7kt4KhbzGNoEwBeDFUhqxKnibC ZCVKg7ZAnQmTxrbKsmBndxmzLn1TwRK9fWlhJA9OvilZwmSnMst6CyPmDHa+GoowjqOh IYzjJbT7hRDI+2Z8pvIwXmt2p+PcPY+GzL5EHltBL1uR319kIAgd7FErN7NzvnkCfHB6 L4Xkdrm6o2bwL0LEunKsXdu4RmxYOtHYDzi3vI7JuDp8HBlrIDKtRt+oGJlqD1yqX65M VhuJOrq5EWCbE76KQGHgp2J6OCnjX5LElYtFhLLqgFk1BGJBEEwNqQ3QrOsF0CNNK6x6 maow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=EnSIATaKBRuHsQvfh4BBBhPFfL/ac6gnLfX9fAZ+7n4=; b=FydHsvQnfw94zuQth7oxOCJmyV129nK1GwG9xyE6Owjh6/cMNgCT2G6E1dGsqBziRO nayNf2i24DNkcO25VvydAN9LjI2BtR1JC2NXVqRyRX4tFdrJN8QbHBsMNh4K5FJrjqI+ rXijq4CKyPCkevzsmawWIXkqDgq4iokDPLs6MfgVWuA8UxT/krWg0T07naij1C1fzzE8 1vUjj7iERRZAk2fis8S2gc05xCoYatZ3jUtYs2gL4lBR5oq+TX9IM8094DeYRvkzySb9 8KP0z4X6rHWzHy1EXs8VMj7TwecOfPr2TJW3kBPfuu1Uc9JjbwPTiCNkktRw2tn1PaoF bJjA== X-Gm-Message-State: AOAM530jJZa4Xx67HWg6lqAw5WDLuFySRLOQWpVuYzWSzWGZugq7IHrd hByHuj0JaA6gWsel5U8XA81Gv6S3qih8cbXkWTC3IL/0wq4= X-Google-Smtp-Source: ABdhPJzBefbR++EeVcPJgnO0wJpTaXCXwXrEC/6aUNXuAzPj8CBG+K/OtlQVW6eqqp8KmFcYi0hiYRLPa0d1fD2P+hs= X-Received: by 2002:a05:6e02:1313:: with SMTP id g19mr6813612ilr.123.1593601873097; Wed, 01 Jul 2020 04:11:13 -0700 (PDT) MIME-Version: 1.0 References: <2560148.jvFFTcX3xC@linux-9daj> <4703088.fjZbX7tNNj@linux-9daj> In-Reply-To: <4703088.fjZbX7tNNj@linux-9daj> From: tirumal reddy Date: Wed, 1 Jul 2020 16:41:01 +0530 Message-ID: To: Paul Vixie Cc: Ted Lemon , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000008f39bc05a95f5987" Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 11:11:15 -0000 --0000000000008f39bc05a95f5987 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 1 Jul 2020 at 13:29, Paul Vixie wrote: > On Wednesday, 1 July 2020 05:59:51 UTC Ted Lemon wrote: > > On Jul 1, 2020, at 1:34 AM, Paul Vixie wrote: > > > as i wrote, there are other network configuration parameters which ar= e > > > also valuable targets, such as outbound proxy settings. > > > > Who configures those with DHCP? That would be insane. > > my IoT devices hate me, because i won't let them speak directly to their > motherships, and lacking keyboards or ssh listeners, i have no way to tel= l > them what proxy they would have to use to be successful. if you want me t= o > agree that IoT is insane, i probably will. but it's our world. > Secure bootstrapping methods for IoT devices are discussed both inside (e.g., BRSKI) and outside of IETF (DPP, OCF, OMA). > > > It sounds like a validating stub resolver will fail to work with your > > product. > > well, yes and no. i want certain resolutions to fail. these fail. exactly > how > that failure is obtained matters less to me than the failure itself. > > > > i think i should have paid more attention at that time, and i > apologize. > > > DHCP was always the wrong thing to build, like BOOTP before it, and > IPv6 > > > address assignment after it. secure hosting networks have to use /30 > and > > > later /31 netmasks (one customer per vlan) in order to trust any of > this. > > > > I don=E2=80=99t know what a =E2=80=9Csecure hosting network=E2=80=9D is= . Is that an IETF thing? > > definitely not an IETF thing. rather, it's the real world. > > -- > Paul > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000008f39bc05a95f5987 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Wed, 1 Jul 2020 at 13:29, Paul Vixie &= lt;paul@redbarn.org> wrote:
<= /div>
On Wednesday, 1 July= 2020 05:59:51 UTC Ted Lemon wrote:
> On Jul 1, 2020, at 1:34 AM, Paul Vixie <paul@redbarn.org> wrote:
> > as i wrote, there are other network configuration parameters whic= h are
> > also valuable targets, such as outbound proxy settings.
>
> Who configures those with DHCP? That would be insane.

my IoT devices hate me, because i won't let them speak directly to thei= r
motherships, and lacking keyboards or ssh listeners, i have no way to tell =
them what proxy they would have to use to be successful. if you want me to =
agree that IoT is insane, i probably will. but it's our world.

Secure bootstrapping methods for IoT devices ar= e discussed both inside (e.g., BRSKI) and outside of IETF (DPP, OCF, OMA).<= /div>
=C2=A0

> It sounds like a validating stub resolver will fail to work with your<= br> > product.

well, yes and no. i want certain resolutions to fail. these fail. exactly h= ow
that failure is obtained matters less to me than the failure itself.

> > i think i should have paid more attention at that time, and i apo= logize.
> > DHCP was always the wrong thing to build, like BOOTP before it, a= nd IPv6
> > address assignment after it. secure hosting networks have to use = /30 and
> > later /31 netmasks (one customer per vlan) in order to trust any = of this.
>
> I don=E2=80=99t know what a =E2=80=9Csecure hosting network=E2=80=9D i= s. Is that an IETF thing?

definitely not an IETF thing. rather, it's the real world.

--
Paul


--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000008f39bc05a95f5987-- From nobody Wed Jul 1 07:18:58 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89FC33A0BC9 for ; Wed, 1 Jul 2020 07:18:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F_2WbCSIehQP for ; Wed, 1 Jul 2020 07:18:55 -0700 (PDT) Received: from mail-qt1-x836.google.com (mail-qt1-x836.google.com [IPv6:2607:f8b0:4864:20::836]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 060A83A0BC7 for ; Wed, 1 Jul 2020 07:18:54 -0700 (PDT) Received: by mail-qt1-x836.google.com with SMTP id z2so18515597qts.5 for ; Wed, 01 Jul 2020 07:18:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=lBuN1IC+0wcb9N6hOpAR+rMEFVOodCFNgyG/IXrTREc=; b=lA+QdfYvrgCQNlJqqJ1CJGGtio72FbtbaHX2enSzhLbn99krwVE6U1e+25GldePc1f DSu3/CvMVyMYpSz7Pbp2boQ2TmcDf+5JsW7wOs9aaUegSRPJDovQtG02L5SICmeXjKBQ M1bX8c4WaEPPxGnhUjjKHVCyKchElvoOv59YCVWLEKeUvv6/038ErGIulKEHI/3OyWyJ A2cHTZwKUvq7PstiM+iOzApS3yT/vSC/zNCnvFHHPToq43xQqdcyoPQ8R006KmGWnaV1 jjIk8EzaM268qAA4fHu3T3pr+doWhWVUcQEfEIiYfYoAWh0Eo0bJ8eO5gEu7731+yyTQ W5Hw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=lBuN1IC+0wcb9N6hOpAR+rMEFVOodCFNgyG/IXrTREc=; b=kh/8d+kLG61v9adXBbZKuecJEp7XzOqrkKGhYuf3BTDymhHfOkbxFcAqhetKw/Zq93 rjmccf5VakdtA5TWDODO38x7scMqyky3zE/LkDr936FNZPp2ZQKfRHPWs4GcIu9c8WBN cIWjRD//e+4HvISwk4kL8ESRNUXTnmFYu5Z0K+AsucjNDuXW/cbZzU4VjZHihQ1icSnE m69VE16V9D/+yKDnNgLN2fVShe7qoampCueG+9I8w+c5veUQ0L78tPPjy9Jo2QOW2aH+ /pGsXTFnSQifO/nCNrpoHpC73w7m/UzpFugxQteYm+Sph3SAEC1Cq1SLCTflFa7Ei6ZA FfeA== X-Gm-Message-State: AOAM530Gn40Aka98akPBjRegetXZY1DdB3ItpCqT22RKDBvWGL3IuFGe FiKCZr2KYuZHoLP4/4PFYlbuQzPJEv8= X-Google-Smtp-Source: ABdhPJzqj+Dmp6rSU/lFrxzNb6McnJXnBibG58IOzDy6Ql2qcU+HhkggzeZktudO9vuem0sRgVYv4g== X-Received: by 2002:ac8:1ac4:: with SMTP id h4mr27151222qtk.249.1593613133594; Wed, 01 Jul 2020 07:18:53 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:f5b5:a81b:f23f:5f9d? ([2601:18b:300:36ee:f5b5:a81b:f23f:5f9d]) by smtp.gmail.com with ESMTPSA id x197sm5825256qka.74.2020.07.01.07.18.52 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 01 Jul 2020 07:18:52 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Wed, 1 Jul 2020 10:18:51 -0400 Message-Id: References: Cc: Paul Vixie , ADD Mailing list In-Reply-To: To: tirumal reddy X-Mailer: iPhone Mail (18A5301v) Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 14:18:57 -0000 On Jul 1, 2020, at 07:11, tirumal reddy wrote: > Secure bootstrapping methods for IoT devices are discussed both inside (e.= g., BRSKI) and outside of IETF (DPP, OCF, OMA). Indeed, there is a lot of interesting work going on in this space. The idea t= hat devices can=E2=80=99t be trusted is accepted by everybody except the peo= ple whose business models rely on snooping, and I expect the state of the ar= t to improve continuously.=20 That said, commissioning protocols are ways of making link security (e.g. 80= 2.1x) more usable, and have nothing much to do with DHCP. They are generally= one-time unless something goes wrong.=20= From nobody Wed Jul 1 08:39:13 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5EA513A101E for ; Wed, 1 Jul 2020 08:39:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jCuk88cuuDgi for ; Wed, 1 Jul 2020 08:39:08 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B53B03A0F55 for ; Wed, 1 Jul 2020 08:39:07 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id E4F3B389C2; Wed, 1 Jul 2020 11:36:18 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id uWNjq7OvEsir; Wed, 1 Jul 2020 11:36:18 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 3F5F2389BE; Wed, 1 Jul 2020 11:36:18 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id E01AB3DE; Wed, 1 Jul 2020 11:39:05 -0400 (EDT) From: Michael Richardson To: Ted Lemon , tirumal reddy , ADD Mailing list , Paul Vixie In-Reply-To: References: X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 15:39:12 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Ted Lemon wrote: > On Jul 1, 2020, at 07:11, tirumal reddy wrote: >> Secure bootstrapping methods for IoT devices are discussed both insi= de >> (e.g., BRSKI) and outside of IETF (DPP, OCF, OMA). > Indeed, there is a lot of interesting work going on in this space. The > idea that devices can=E2=80=99t be trusted is accepted by everybody e= xcept the > people whose business models rely on snooping, and I expect the state > of the art to improve continuously. > That said, commissioning protocols are ways of making link security > (e.g. 802.1x) more usable, and have nothing much to do with DHCP. They > are generally one-time unless something goes wrong. While what you say is true, it misses an important point. Those mechanisms that result in the device having a) an identity b) a trust anchor to validate local resources mean that other management protocols (such as DHCP!) can be done securely. We never could get DHCP security to work, because device never had identiti= es we could leverage. This is far afield from whether a *browser* should use a CNAME rather than a new RR-type for discovery. It feels to me DNS is being used as a hammer because browsers don't have access to DHCP. The same might not be true for more integrated devices, so it would be nice to have more network focused solutions, and I think that this WG is going in the right direction there. I would prefer that OSes took on that mechani= sm too, and revealed those choices more clearly to things like browsers. (that would make me more tolerant of this pragmatic CNAME hack, if I saw a way in which it could go away) =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl78rhkACgkQgItw+93Q 3WXwgAf+ICKt+oKoONHMb5OgONLyaFab2g61eF34IGa60185C5iiklsZdwy5bbG+ ksEqBqYYcvonBjX+zvXe8l6sz/f13HV/VIzaizOsdQO0a6uysrEEIvB1a9gfTWpj R1pdHVzb3UOUPzU48/pBho7VnnlLzeYkfYQL+MQp2Xv0PXTj8TH8V0laLbrqqcJF 5fKEhS6O9VaaIhwM5GALStP9PaNIstSaTUuu4vbDcVSVOkV7C2A2G48CrF99MzZb y+loibOpRD+Mp2YRy+6oa9LVDoZywCYxe+y4G6KCUqmdvjnLF01Wfy6Da1npyWOs Hh1f+kGe2wKOM6nTxpdKLbDh+bxDUQ== =urQ0 -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Jul 1 08:45:31 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D0AF3A1144 for ; Wed, 1 Jul 2020 08:45:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SRqDbcokgl0V for ; Wed, 1 Jul 2020 08:45:28 -0700 (PDT) Received: from mail-qv1-xf35.google.com (mail-qv1-xf35.google.com [IPv6:2607:f8b0:4864:20::f35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F3B483A10F1 for ; Wed, 1 Jul 2020 08:45:27 -0700 (PDT) Received: by mail-qv1-xf35.google.com with SMTP id e3so4869176qvo.10 for ; Wed, 01 Jul 2020 08:45:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=a5KfryZH1dKU2gXO7cM14Hwdn995+suGXlt5xEUxqFM=; b=fsUvFO6AdlMbERi7CXqW3nINc8E9lvJCOu6H9djPHXIKuqHJa+1yl6v1mIYtSE7b0V AgOkuUWBnBPisiWrlQF40Mi2JQdC8sAhRfVihcrlizXGIModpS7yi8RBkdblg82XREgm VpmMqIt6Rz/x1y6VXb3K+cJy22wRagN7TjB5pfYNRAMLyn8VkaBAGCjgqQHagefQwlVn NP1qN/2GRjDDeI3HVU7EKbGdkM7+Dkh7FDychbVzqc4xMSQdGk6vwuCqQY6q7drk7D35 isJAFY/H+2+KylTrmiWZb3F86DVo4q7JGb02oQT+EmN5CJC7FA/vgPMRQgwiO3oHRIGZ dKwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=a5KfryZH1dKU2gXO7cM14Hwdn995+suGXlt5xEUxqFM=; b=SCwXZM2YiUZYDR1Rn2r9RyzymzCOahaa4k2f/6LO1feg6OoOgSqJaMs0S7GlIXBFpt sLZ/EyAEhoGRf8DrAnTRn8Z+hAaYIzRUprAfP/qFTwDa0tl80iZ7+Gzc+wRN0tanuIm/ pV2+MSxQIZEC1Q3LeQ6D8UwG4hxjakaOxuC7vqOljfJvNpBS68pQkgHyOcHJd9tpQ8m3 IkqU952bm5jLmgZ6a5WoWHZK16lFwrsAAzZb+YE6S0m/6XnzaNhTr76l7dlMWbV/XTMm T9ufMojVXpNWx7OigL1vuqjWf8pIHCRbckHYzzlHuxPCLoG4Fqc0wTR0yZS4Hoo5Ef7B AEfg== X-Gm-Message-State: AOAM532lToZ8e/g76pMlpRBNJnD7rAWle4/j2RdcoWoFIDW5RgiUAZvl Vd72XeyQ3VRzZEyM4kN++sYrkA== X-Google-Smtp-Source: ABdhPJwKpDI9TrQsoOt6XR7uZ/QZ/jJ2f8UgbMeW6oXGTvXhgkR7ZInEnXqFE8CYQf1CBNuxVp2IAA== X-Received: by 2002:ad4:5307:: with SMTP id y7mr26045295qvr.63.1593618326996; Wed, 01 Jul 2020 08:45:26 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:7591:cd25:b0c:85a5? ([2601:18b:300:36ee:7591:cd25:b0c:85a5]) by smtp.gmail.com with ESMTPSA id t65sm3188568qkf.119.2020.07.01.08.45.26 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 01 Jul 2020 08:45:26 -0700 (PDT) From: Ted Lemon Message-Id: <5BB39EF3-6C04-4531-9B22-F3B82563D288@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_CFAA28D3-3554-4DD0-8AA8-8E5D218E3A4B" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Wed, 1 Jul 2020 11:45:24 -0400 In-Reply-To: <2033.1593617945@localhost> Cc: tirumal reddy , ADD Mailing list , Paul Vixie To: Michael Richardson References: <2033.1593617945@localhost> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 15:45:29 -0000 --Apple-Mail=_CFAA28D3-3554-4DD0-8AA8-8E5D218E3A4B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 1, 2020, at 11:39 AM, Michael Richardson = wrote: > mean that other management protocols (such as DHCP!) can be done = securely. > We never could get DHCP security to work, because device never had = identities > we could leverage. That=E2=80=99s sort of maybe a fair point, but is authenticating DHCP = when you=E2=80=99ve already authenticated layer two adding any real = value? > This is far afield from whether a *browser* should use a CNAME rather = than a > new RR-type for discovery. It feels to me DNS is being used as a = hammer > because browsers don't have access to DHCP. This is _precisely_ the sort of thing that RFC6763 does well. DHCP = isn=E2=80=99t a particularly good way of solving this problem. If you = want trustworthy information about network services, why not use a = service discovery protocol? --Apple-Mail=_CFAA28D3-3554-4DD0-8AA8-8E5D218E3A4B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 1, 2020, at 11:39 AM, Michael Richardson <mcr+ietf@sandelman.ca> wrote:
mean that other management protocols (such as DHCP!) can be = done securely.
We never could get DHCP security to work, because device = never had identities
we could leverage.

That=E2=80=99s sort of maybe a fair point, = but is authenticating DHCP when you=E2=80=99ve already authenticated = layer two adding any real value?

This = is far afield from whether a *browser* should use a CNAME rather than = a
new RR-type for = discovery.  It feels to me DNS is being used as a hammer
because browsers don't = have access to DHCP.

This is _precisely_ the sort of thing that RFC6763 does well. =  DHCP isn=E2=80=99t a particularly good way of solving this = problem. If you want trustworthy information about network services, why = not use a service discovery protocol?

= --Apple-Mail=_CFAA28D3-3554-4DD0-8AA8-8E5D218E3A4B-- From nobody Wed Jul 1 09:46:21 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 016413A12F8 for ; Wed, 1 Jul 2020 09:46:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SRO2A68XnenB for ; Wed, 1 Jul 2020 09:46:18 -0700 (PDT) Received: from mail-lj1-x244.google.com (mail-lj1-x244.google.com [IPv6:2a00:1450:4864:20::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6092E3A12F5 for ; Wed, 1 Jul 2020 09:46:18 -0700 (PDT) Received: by mail-lj1-x244.google.com with SMTP id t25so23371592lji.12 for ; Wed, 01 Jul 2020 09:46:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=iSBG87bsr2OTSihRW/ZCckEoWgvmQoCDGG2/Lmt/O34=; b=syy0LnmPlhofKMYWcut7nzASgouV3whzmPUYK+jLozzsC60JcZiauOlJeMznVEl+07 3pd2+x6XYZyiGldLAxGIA8NMEoiRxM/QAV5liuXKjBE5qsj8tH/hSXgSqBZUgSg3VSA+ /KL7wkHyuB1XPu+Kec/ejGdIEPFs4pBH5QsdRY/I+7S4bkKAw6hBBI335mYiDFugSnJj 8rKPzUFRHUeAXW1AM80v+ebKjZwRfbYKMK0myv0LXAyLchr42/XcSj+IaGVW5m8RgwCp 9BEll+WVeyKpLZaAXMdGMf8V0AG1bv0vybnPYyLyJLNbb80HUOePXMoUup8Tjr+ZgxGT reRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=iSBG87bsr2OTSihRW/ZCckEoWgvmQoCDGG2/Lmt/O34=; b=r5WESlKJgN2o3ZceSmcmWbHW+8+yQnVwM0v1ib5UfXC6jahdvf9E5pCtc0+MucRYPw sOjA7sxsFOWmATgXPErRBj0PhHHuxv3n4dpAHvuT9BzUguThWNN7hIYlg8HEkA6Wgr6k Cuy7751LQSbd+wXGEhvTE5ChcX9TC+6P0W603H+6PUf9vX5325By6ye741q4IwqQysh4 YBt3jQFX7+e/EP0gyf409uerpLEAywJQL4m3cQYPIwKduxK0v2yvS1xvK8BGlG09lwtf 0LhVatq03T/tQrDq2+93qwsKS5MdN2dxs/xRaRGQ4xuQgZpp605W7bv1pOUzYwMm/b/4 uNKg== X-Gm-Message-State: AOAM532xRUSVSIhpECEtENVFZed75GXWcdqEpXWj3I28I1rBncf5Fwf7 uFzSLDo2smVWJW+uOTPJtN3jaaCiEcVpdbeYw4bosw== X-Google-Smtp-Source: ABdhPJytuQ5rsoBJIGnfOXJ7LwCWIzTB4vtIgEna3vSXDZ0kGLSxVyv1FMxAuBGnjtuReBD4D9hhWCzxqPZyZvw4grI= X-Received: by 2002:a2e:9510:: with SMTP id f16mr14228334ljh.199.1593621976662; Wed, 01 Jul 2020 09:46:16 -0700 (PDT) MIME-Version: 1.0 References: <2033.1593617945@localhost> In-Reply-To: <2033.1593617945@localhost> From: Eric Rescorla Date: Wed, 1 Jul 2020 09:45:40 -0700 Message-ID: To: Michael Richardson Cc: Ted Lemon , tirumal reddy , ADD Mailing list , Paul Vixie Content-Type: multipart/alternative; boundary="000000000000d358a705a9640736" Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 16:46:20 -0000 --000000000000d358a705a9640736 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 1, 2020 at 8:39 AM Michael Richardson wrote: > > Ted Lemon wrote: > > On Jul 1, 2020, at 07:11, tirumal reddy wrote: > >> Secure bootstrapping methods for IoT devices are discussed both > inside > >> (e.g., BRSKI) and outside of IETF (DPP, OCF, OMA). > > > Indeed, there is a lot of interesting work going on in this space. > The > > idea that devices can=E2=80=99t be trusted is accepted by everybody= except > the > > people whose business models rely on snooping, and I expect the sta= te > > of the art to improve continuously. > > > That said, commissioning protocols are ways of making link security > > (e.g. 802.1x) more usable, and have nothing much to do with DHCP. > They > > are generally one-time unless something goes wrong. > > While what you say is true, it misses an important point. > Those mechanisms that result in the device having > a) an identity > b) a trust anchor to validate local resources > > mean that other management protocols (such as DHCP!) can be done securely= . > We never could get DHCP security to work, because device never had > identities > we could leverage. > > This is far afield from whether a *browser* should use a CNAME rather tha= n > a > new RR-type for discovery. It feels to me DNS is being used as a hammer > because browsers don't have access to DHCP Hmm... Sort of. CNAME is being used rather than another RRType for engineering convenience reasons. It's *also* inconvenient to do DHCP, but the real concern there is whether the local middleboxes etc. will propagate whatever DHCP information is needed. Consider the case where we have a DHCP option that says 'here is a DoH server' and the router provided CPE provides that. But if I have a third party WiFi router, it consumes that option. Does it then propagate that to the clients? If not, then the DHCP thing is not going to work super well. -Ekr --000000000000d358a705a9640736 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 1, 2020 at 8:39 AM Michae= l Richardson <mcr+ietf@sandel= man.ca> wrote:

Ted Lemon <mellon@= fugue.com> wrote:
=C2=A0 =C2=A0 > On Jul 1, 2020, at 07:11, tirumal reddy <kondtir@gmail.com> wrote:=
=C2=A0 =C2=A0 >> Secure bootstrapping methods for IoT devices are dis= cussed both inside
=C2=A0 =C2=A0 >> (e.g., BRSKI) and outside of IETF (DPP, OCF, OMA).
=C2=A0 =C2=A0 > Indeed, there is a lot of interesting work going on in t= his space. The
=C2=A0 =C2=A0 > idea that devices can=E2=80=99t be trusted is accepted b= y everybody except the
=C2=A0 =C2=A0 > people whose business models rely on snooping, and I exp= ect the state
=C2=A0 =C2=A0 > of the art to improve continuously.

=C2=A0 =C2=A0 > That said, commissioning protocols are ways of making li= nk security
=C2=A0 =C2=A0 > (e.g. 802.1x) more usable, and have nothing much to do w= ith DHCP. They
=C2=A0 =C2=A0 > are generally one-time unless something goes wrong.

While what you say is true, it misses an important point.
Those mechanisms that result in the device having
=C2=A0 a) an identity
=C2=A0 b) a trust anchor to validate local resources

mean that other management protocols (such as DHCP!) can be done securely.<= br> We never could get DHCP security to work, because device never had identiti= es
we could leverage.

This is far afield from whether a *browser* should use a CNAME rather than = a
new RR-type for discovery.=C2=A0 It feels to me DNS is being used as a hamm= er
because browsers don't have access to DHCP

<= div>Hmm... Sort of. CNAME is being used rather than another RRType for engi= neering convenience reasons.

It's *also* = inconvenient to do DHCP, but the real concern there is whether the local mi= ddleboxes etc. will propagate whatever DHCP information is needed. Consider= the case where we have a DHCP option that says 'here is a DoH server&#= 39; and the router provided CPE provides that. But if I have a third party = WiFi router, it consumes that option. Does it then propagate that to the cl= ients? If not, then the DHCP thing is not going to work super well.

-Ekr




--000000000000d358a705a9640736-- From nobody Wed Jul 1 09:51:11 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A95D3A1160 for ; Wed, 1 Jul 2020 09:51:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kJjRjlqRgrue for ; Wed, 1 Jul 2020 09:51:06 -0700 (PDT) Received: from mail-qt1-x82f.google.com (mail-qt1-x82f.google.com [IPv6:2607:f8b0:4864:20::82f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 470703A1310 for ; Wed, 1 Jul 2020 09:51:06 -0700 (PDT) Received: by mail-qt1-x82f.google.com with SMTP id h23so19009695qtr.0 for ; Wed, 01 Jul 2020 09:51:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=EzZKy8Q1+35qRrsmJt9QmUS0XFbGRwnYBnFGijWzhnw=; b=gVtNSdHBiXj5QMcr6gOiNTv9uHrjbFVnBJaT5gPmFjpZQKEMjTWDxxIBHTG52zsnxf A5Dxv6oKaqVgHpvntHruJOT78MLCrAKFwVx9TweoujbR4/fOwDuk1IG7p3uncG82ONuP XzvCnYKUY+dPEv0UJXwJF+MuqhoL8DSLx283RZstPQs5HtPunEFLNzPmFG7QOLDfEGel T5WpdhHSoNnwAHStkfW6UFPO3VUTDrCqHUiX8KNJFMp7DM8R1VM9BSJQDMXij86VvTMm AoENswhpreQdgBAM3H5Diiu/s9Oe8JR4zxBt/20MBmI/nVkb6llqLCtloHAAPdv6gPdP NBEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=EzZKy8Q1+35qRrsmJt9QmUS0XFbGRwnYBnFGijWzhnw=; b=iO7DWPY09bNT+viS/3i7utCOkQjg1a88XjftyERprIYSH66EAWUFhwTG0LouSpg/bs LSiVCvrRncNZaQfVhx4ll7fe/YyBzAKam140bmXDmJb5/QSwACm5qVsMRCMFgN1P9BnA Gng+YKmXplCFxlI+Z0+aLuFtG9y9R3EQPdsT5lFnCFW9i26Q2a5Mf5ayeqT070AH2zZX svcQPI6c5ra0Dq8aPLg0DGhkzUsaduEkvnndg6kEEpsplrUXUR7H8zHb9pcnJKDCMdYH 6e6m7MjSo886empGsV6YGJFz9qGvJ82GMqP4kwKzeonpiXkv/DI7R7nPSvC+7YmPDRBx CHkA== X-Gm-Message-State: AOAM530vqE2VMR1kPPKSQOR11dEy6Wds2evt9eThhzcgmSFrPrLqkRky Zh/JwTrv7orjNj5R4W07ncNB5Q== X-Google-Smtp-Source: ABdhPJzIEbQjctgLuPIDZ+FatXVETXR+npMQFaoMKTmxYcr+bFursiErvY81xC+k9a0TidIABaZgrA== X-Received: by 2002:ac8:fec:: with SMTP id f41mr25213427qtk.212.1593622265234; Wed, 01 Jul 2020 09:51:05 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:7591:cd25:b0c:85a5? ([2601:18b:300:36ee:7591:cd25:b0c:85a5]) by smtp.gmail.com with ESMTPSA id q5sm7010294qtf.12.2020.07.01.09.51.03 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 01 Jul 2020 09:51:04 -0700 (PDT) From: Ted Lemon Message-Id: <83AD693E-504B-42F2-A217-836AF2283AEF@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_9A1358F1-AFE3-4523-B0CB-5F5ED2CEF9E1" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Wed, 1 Jul 2020 12:51:03 -0400 In-Reply-To: Cc: Michael Richardson , tirumal reddy , ADD Mailing list , Paul Vixie To: Eric Rescorla References: <2033.1593617945@localhost> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 16:51:09 -0000 --Apple-Mail=_9A1358F1-AFE3-4523-B0CB-5F5ED2CEF9E1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 1, 2020, at 12:45 PM, Eric Rescorla wrote: > It's *also* inconvenient to do DHCP, but the real concern there is = whether the local middleboxes etc. will propagate whatever DHCP = information is needed. Consider the case where we have a DHCP option = that says 'here is a DoH server' and the router provided CPE provides = that. But if I have a third party WiFi router, it consumes that option. = Does it then propagate that to the clients? If not, then the DHCP thing = is not going to work super well. Here again DNS Service Discovery would address this problem=E2=80=94the = browsing domain discovery process could readily discover a static DNSSD = configuration at the ISP. There are even APIs for this on e.g. Windows, = Android, Linux and Mac, so you don=E2=80=99t have to use the limited = getaddrinfo API. --Apple-Mail=_9A1358F1-AFE3-4523-B0CB-5F5ED2CEF9E1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 1, 2020, at 12:45 PM, Eric Rescorla <ekr@rtfm.com> = wrote:
It's = *also* inconvenient to do DHCP, but the real concern there is whether = the local middleboxes etc. will propagate whatever DHCP information is = needed. Consider the case where we have a DHCP option that says 'here is = a DoH server' and the router provided CPE provides that. But if I have a = third party WiFi router, it consumes that option. Does it then propagate = that to the clients? If not, then the DHCP thing is not going to work = super well.

Here again = DNS Service Discovery would address this problem=E2=80=94the browsing = domain discovery process could readily discover a static DNSSD = configuration at the ISP.  There are even APIs for this on e.g. = Windows, Android, Linux and Mac, so you don=E2=80=99t have to use the = limited getaddrinfo API.


= --Apple-Mail=_9A1358F1-AFE3-4523-B0CB-5F5ED2CEF9E1-- From nobody Wed Jul 1 12:26:32 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A51D53A0C50 for ; Wed, 1 Jul 2020 12:26:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R2MsBsXOBeWB for ; Wed, 1 Jul 2020 12:26:29 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 285373A0C4D for ; Wed, 1 Jul 2020 12:26:29 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-166.access.rits.tisf.net [24.104.150.166]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id CA7A0B0588 for ; Wed, 1 Jul 2020 19:26:28 +0000 (UTC) From: Paul Vixie To: ADD Mailing list Date: Wed, 01 Jul 2020 19:26:28 +0000 Message-ID: <7554989.GgB1jQp9Bc@linux-9daj> Organization: none In-Reply-To: References: <4703088.fjZbX7tNNj@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 19:26:31 -0000 On Wednesday, 1 July 2020 11:11:01 UTC tirumal reddy wrote: > On Wed, 1 Jul 2020 at 13:29, Paul Vixie wrote: > > On Wednesday, 1 July 2020 05:59:51 UTC Ted Lemon wrote: > > > On Jul 1, 2020, at 1:34 AM, Paul Vixie wrote: > > > > as i wrote, there are other network configuration parameters which are > > > > also valuable targets, such as outbound proxy settings. > > > > > > Who configures those with DHCP? That would be insane. > > > > my IoT devices hate me, because i won't let them speak directly to their > > motherships, and lacking keyboards or ssh listeners, i have no way to tell > > them what proxy they would have to use to be successful. if you want me to > > agree that IoT is insane, i probably will. but it's our world. > > Secure bootstrapping methods for IoT devices are discussed both inside > (e.g., BRSKI) and outside of IETF (DPP, OCF, OMA). do you see that problem as specific to IoT, or disjoint from RDNS settings? (i do not.) -- Paul From nobody Wed Jul 1 14:47:37 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE2A73A0E0D for ; Wed, 1 Jul 2020 14:47:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bx12cLxYZ7SZ for ; Wed, 1 Jul 2020 14:47:31 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF7B03A0E12 for ; Wed, 1 Jul 2020 14:47:30 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id EE05F389CC; Wed, 1 Jul 2020 17:44:41 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id NyqLHS-tBVCh; Wed, 1 Jul 2020 17:44:41 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 285EC389CB; Wed, 1 Jul 2020 17:44:41 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 107A462C; Wed, 1 Jul 2020 17:47:29 -0400 (EDT) From: Michael Richardson To: Ted Lemon , tirumal reddy , ADD Mailing list , Paul Vixie In-Reply-To: <5BB39EF3-6C04-4531-9B22-F3B82563D288@fugue.com> References: <2033.1593617945@localhost> <5BB39EF3-6C04-4531-9B22-F3B82563D288@fugue.com> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 21:47:33 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Ted Lemon wrote: > On Jul 1, 2020, at 11:39 AM, Michael Richardson wrote: >> mean that other management protocols (such as DHCP!) can be done sec= urely. >> We never could get DHCP security to work, because device never had i= dentities >> we could leverage. > That=E2=80=99s sort of maybe a fair point, but is authenticating DHCP= when > you=E2=80=99ve already authenticated layer two adding any real value? Yes. We had an entire WG, SEND, that also fell on that sword. Identities we= re too hard a decade ago. The difficulty in binding layer-2 addresses and layer-3 addresses has been both a blessing to IP and a problem. The presence of that grease has permitted all sorts of stupid L2 solutions = to what were really L3 problems. This has permitted all sorts of innovation to solve what are often real local problems, usually in the form of middle box= es. It's hard to fix many L3 end-to-end because the other peer is not under loc= al control. But, L2, by it's nature of being local and under the local admins control, can be persuaded to do lots of things. It's a problem of course, because every single wired network permits pretty much every single node to impersonate any other node at the L3 layer. Many WiFi systems do not put a strong connection between L3 and L2 address either. Some do. Some of the problems that we have from this lack of binding include all of the defenses we have against rogue DHCP servers, RA-Guard, etc. All things we invented because of the inability validate the binding. >> This is far afield from whether a *browser* should use a CNAME rathe= r than a >> new RR-type for discovery. It feels to me DNS is being used as a ha= mmer >> because browsers don't have access to DHCP. > This is _precisely_ the sort of thing that RFC6763 does well. DHCP > isn=E2=80=99t a particularly good way of solving this problem. If you= want > trustworthy information about network services, why not use a service > discovery protocol? That's a good point. And browsers ought to be able to do service discovery. =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl79BHAACgkQgItw+93Q 3WX++gf+KaEdgFfz8h4Ks/mgJwoGyA5UPGZ5Pqv37zXJfcogzyshjS1JlAQZtGuf /aW99chtsP1XkBbKJ1Mbqddkj7WUnxeVwrGpwGMKm+vFD5HCJXxXUzIfkjHM48Xq speDXmgVu+tK1Sr+63pnOwP/caIwIR+vaHbdlfPKo08iReweEeLGwHY3C556FaS5 zV5UMOk9CcWujYrCQKwg6jQVuMhKp0A7MmSd4xPec/kZumYOoO03TwTiwjvDvXf2 q4mljzqr3ocg7vgG/RrwWbbBsHbJv8mVj9SnEEe0U3vNBQnVu8vOPE5CZpjfSFAL Fs6soCjp02O1ZdYyK3qWRYEuk0VYnA== =3qoJ -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Jul 1 15:09:08 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 433633A0E4F for ; Wed, 1 Jul 2020 15:09:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id grJ0z26xn2IW for ; Wed, 1 Jul 2020 15:09:05 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AFAF3A0E3D for ; Wed, 1 Jul 2020 15:09:05 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 16D56389CC; Wed, 1 Jul 2020 18:06:16 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 7G4rIOWHinnB; Wed, 1 Jul 2020 18:06:14 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id B0B5C389BC; Wed, 1 Jul 2020 18:06:14 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 994BC62C; Wed, 1 Jul 2020 18:09:02 -0400 (EDT) From: Michael Richardson To: Paul Vixie , ADD Mailing list In-Reply-To: <7554989.GgB1jQp9Bc@linux-9daj> References: <4703088.fjZbX7tNNj@linux-9daj> <7554989.GgB1jQp9Bc@linux-9daj> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 22:09:07 -0000 --=-=-= Content-Type: text/plain Paul Vixie wrote: >> > my IoT devices hate me, because i won't let them speak directly to their >> > motherships, and lacking keyboards or ssh listeners, i have no way to tell >> > them what proxy they would have to use to be successful. if you want me to >> > agree that IoT is insane, i probably will. but it's our world. >> >> Secure bootstrapping methods for IoT devices are discussed both inside >> (e.g., BRSKI) and outside of IETF (DPP, OCF, OMA). > do you see that problem as specific to IoT, or disjoint from RDNS settings? > (i do not.) In the IoT case, we need a good, autonomic mechanism to deploy network configuration to devices in ways that they really understand. (Such as your proxy-HTTP setting, which I entirely approve of). Getting the wrong RDNS settings on an IoT device means that it probably does not function well (or maybe at all), and it becomes very difficult to do RFC8520. (see my draft-richardson-opsawg-mud-iot-dns-considerations-02 ) Getting the wrong RDNS settings on a *desktop* browser is a qualitatively different thing in my opinion. It probably operates, but for some uses/users it may be a problem, either because of the click-trail it leaves, or because of the censorship that the user experiences. I think that this is particularly acute for *desktop* browsers, as they do not in general have the luxury of just picking a different coffee shop. The people who use them are generally vulnerable in a variety of different ways. It is *important* for the browser to be able to clearly indicate what level of privacy is being experienced. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl79CX4ACgkQgItw+93Q 3WVJEwf6AouoFQ9qWfRV1BYCvTHOGu1vMoV90OnFvtOctHj2/0W/Xmyn9N62+rgv MY+f4r8QDWeLuzsOD7DTiW0xFe+J2T0n3IyQwtuC/AT+31nf+kl3/ZpfIBsLX+uy DiOLOvwlDDegCgf2wZUkMZB1elJqfrZyZgyuPX5T9knle/MhYkq6B3iIiHktjNmV 5yw8A9whSs9IU4mKDr2iADvdUjgc6z8JMskz9y41QwbYS9M5OQRHNFKB5PZPqyMn kfBqtpH77UmJo0ayYi1cjirXiWcx6v9UzwnemuKkCWLdOP0s1h0v0WyMmfLB9rAr JrQ9FR2IrS7sNv3g+8PUN+CQwvkB4g== =ie6C -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Jul 1 15:30:00 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D71E3A096E for ; Wed, 1 Jul 2020 15:29:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EsJBHh5CG4OC for ; Wed, 1 Jul 2020 15:29:57 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB9EB3A0898 for ; Wed, 1 Jul 2020 15:29:57 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-166.access.rits.tisf.net [24.104.150.166]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id C35C5B0588 for ; Wed, 1 Jul 2020 22:29:56 +0000 (UTC) From: Paul Vixie To: ADD Mailing list Date: Wed, 01 Jul 2020 22:29:55 +0000 Message-ID: <10843339.pZq1X2qCAG@linux-9daj> Organization: none In-Reply-To: <1518.1593641342@localhost> References: <7554989.GgB1jQp9Bc@linux-9daj> <1518.1593641342@localhost> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 22:29:59 -0000 On Wednesday, 1 July 2020 22:09:02 UTC Michael Richardson wrote: > Paul Vixie wrote: > > do you see that problem as specific to IoT, or disjoint from RDNS > > settings? (i do not.) > > In the IoT case, we need a good, autonomic mechanism to deploy network > configuration to devices in ways that they really understand. > (Such as your proxy-HTTP setting, which I entirely approve of). > > Getting the wrong RDNS settings on an IoT device means that it probably does > not function well (or maybe at all), and it becomes very difficult to do > RFC8520. (see my draft-richardson-opsawg-mud-iot-dns-considerations-02 ) speaking as someone who had to create a local responder for 8.8.8.8 in order to get my chromecast to believe it had internet connectivity, i think we should consider that in the IoT world, there will never be profit from the delivery and sale of these devices, only from the services they can offer, and the phone-home telemetry they can monetize. google's chromecast already ignores the RDNS settings it gets from my DHCP service. therefore, "wrong" is in the eye of the beholder, and the interests of IoT buyers are unaligned with the interests of IoT sellers. we should consider this negotiation a "hostile" one. > Getting the wrong RDNS settings on a *desktop* browser is a qualitatively > different thing in my opinion. It probably operates, but for some > uses/users it may be a problem, either because of the click-trail it > leaves, or because of the censorship that the user experiences. > > I think that this is particularly acute for *desktop* browsers, as they do > not in general have the luxury of just picking a different coffee shop. > The people who use them are generally vulnerable in a variety of different > ways. at the moment, i challenge your specificity here. laptops and smartphones and datapads all behave the way you're describing for desktops here. in the future, i will challenge any specificity on this topic, since all nodes whether embedded or operated will have the same capabilities and constraints. > It is *important* for the browser to be able to clearly indicate what level > of privacy is being experienced. i expect that you can get universal agreement on that point. in any case, +1. -- Paul From nobody Wed Jul 1 15:46:55 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 245773A0EFF for ; Wed, 1 Jul 2020 15:46:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fzK5SdU_nq8T for ; Wed, 1 Jul 2020 15:46:43 -0700 (PDT) Received: from mail-ot1-x330.google.com (mail-ot1-x330.google.com [IPv6:2607:f8b0:4864:20::330]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AEFDE3A0F20 for ; Wed, 1 Jul 2020 15:46:43 -0700 (PDT) Received: by mail-ot1-x330.google.com with SMTP id 18so22687148otv.6 for ; Wed, 01 Jul 2020 15:46:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=0gnnu/A0TJJnuFHBD4J0neLEkepbUI3AEJcfSBfEmYo=; b=or/+7dsXrlqf65fcdq5mnx0xRgzBGHmq+LaDc9HI99eM+exYfHpDFQLnDj9+3bHP4c RVb3YTyc12fut0GtPp9jAnGqok8ue2bzpolaUgbWWlKm15065SC7TL9hzj8C5Z5Erkv6 H4r6giR52TdPDt/iuu8RMFaxOCMw0VS4cvoOU2V2rP5YzlvA71z2ZrStatl7jMshiXmN y8yyu+C/pfZOau+MjeJ1ffDumFuj7pdBiLj3EM+dQKSO1DkJdhNS7vWroYZlXPd825Eo MvhCc4uwtxhPkejYMD/9BTNfyz56zy0FvzSVb5mgj+0YFjMt65ubyvfwxz6F1RCBU/45 w/Hw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=0gnnu/A0TJJnuFHBD4J0neLEkepbUI3AEJcfSBfEmYo=; b=W/7U+hOLFcpTBzTs0TVPHaFMNfbTnMK8FV6reO4wnRbgfD3ywp3pYzuVPIkv+DMQuJ d/Izk9WqnHB0pfTU197BJzfL91sLNBolcGdNK40CtVV6JJGpWH4p4yKJ+KsCK/rHlrXi yErDmekwDeAg1UJE5tqBal1cc2+a9LVoFYfzBAxQA4088eNWWTVijjD4sqw0tiQpIZfD gLwsNkZIOa0mtryrQRXgS5ytp6UppRN/vb3HwtQkyy67zMT5nTy3RV+SZRbq37UGf0YN 93SiG/3BzRhW9nRYO8xS/6kho8NJ9fgAG2TVVf8J3zEHeZLesdXcz+eSJOVRIt525/JH vo7A== X-Gm-Message-State: AOAM533cMIDQutUmIFoJALmWbspKTsyfTPFauy2TzCT67XNSuLa3SdZA Ld5d4L+v/iNSP3LT6tYPkpJsLJI4kmmGJYgNBdnYLbxb X-Google-Smtp-Source: ABdhPJwzJeq8qTDS9Fpj5yIGHhaCK7xOlyeRQFzOofN6mwjBs0vaSdCzs4tyRCJ/Nco1+rOlLLW6Bh0muvARvjNjNR8= X-Received: by 2002:a05:6830:3109:: with SMTP id b9mr23736705ots.41.1593643602926; Wed, 01 Jul 2020 15:46:42 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Tim Wicinski Date: Wed, 1 Jul 2020 18:46:32 -0400 Message-ID: To: Paul Hoffman Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000d9e13205a9691055" Archived-At: Subject: Re: [Add] New (-02) versions of draft-pp-add-stub-upgrade and draft-pp-add-resinfo X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 22:46:54 -0000 --000000000000d9e13205a9691055 Content-Type: text/plain; charset="UTF-8" DNSOP chairs are also interested, as DNSOP initially adopted an earlier variation: https://datatracker.ietf.org/doc/draft-ietf-dnsop-resolver-information/ If ADD adopts the newer version, we can deprecate this work. We have reached out to the chairs separately. tim (for Benno/Suzanne) On Tue, Jun 30, 2020 at 2:03 PM Paul Hoffman wrote: > Greetings again. Puneet and I have made a bunch of changes to > draft-pp-add-stub-upgrade and draft-pp-add-resinfo based on the traffic > from the WG, mostly from Ben Schwartz. There are many direct changes, and > some notes for future areas of discussion if these become WG drafts. The > new drafts are at: > > https://www.ietf.org/internet-drafts/draft-pp-add-stub-upgrade-02.txt > https://www.ietf.org/internet-drafts/draft-pp-add-resinfo-02.txt > > We would like the WG chairs to determine if these drafts are useful for WG > adoption, possibly before the meeting in a few weeks. We know they are > incomplete (particularly noting Ekr's comments earlier today about threat > models), but we have heard enough interest in the data model and transport > where we think the WG can start with them as work items. > > --Paul Hoffman-- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000d9e13205a9691055 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

D= NSOP chairs are also=C2=A0interested, as DNSOP initially adopted an earlier= variation:

<= a href=3D"https://datatracker.ietf.org/doc/draft-ietf-dnsop-resolver-inform= ation/" target=3D"_blank">https://datatracker.ietf.org/doc/draft-ietf-dnsop= -resolver-information/

If ADD adopts the newer version, we can deprecate this wo= rk.

<= /div>
We have r= eached out to the chairs separately.

tim
(for Benno/Suzanne)


On Tue, Jun 30, 2020 at 2:03 PM Pau= l Hoffman <p= aul.hoffman@icann.org> wrote:
Greetings again. Puneet and I have made a bunch of cha= nges to draft-pp-add-stub-upgrade and draft-pp-add-resinfo based on the tra= ffic from the WG, mostly from Ben Schwartz. There are many direct changes, = and some notes for future areas of discussion if these become WG drafts. Th= e new drafts are at:

https://www.ietf.org/internet-d= rafts/draft-pp-add-stub-upgrade-02.txt
https://www.ietf.org/internet-drafts= /draft-pp-add-resinfo-02.txt

We would like the WG chairs to determine if these drafts are useful for WG = adoption, possibly before the meeting in a few weeks. We know they are inco= mplete (particularly noting Ekr's comments earlier today about threat m= odels), but we have heard enough interest in the data model and transport w= here we think the WG can start with them as work items.

--Paul Hoffman--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000d9e13205a9691055-- From nobody Wed Jul 1 15:51:09 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E0C3A3A0F0B for ; Wed, 1 Jul 2020 15:51:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sQekpSUwD7B6 for ; Wed, 1 Jul 2020 15:51:05 -0700 (PDT) Received: from mail-qk1-x731.google.com (mail-qk1-x731.google.com [IPv6:2607:f8b0:4864:20::731]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A20C73A0EFF for ; Wed, 1 Jul 2020 15:51:05 -0700 (PDT) Received: by mail-qk1-x731.google.com with SMTP id c139so23854478qkg.12 for ; Wed, 01 Jul 2020 15:51:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=QmuH448GVHbk0h4cKcUD4Hb3JzSdTKkxLp+lGmEpNII=; b=jrOtlpbRqQbJkIEZtUKtdrNzq6fCafZmmUODUqB29bjL4EY5TiOUwr/dGKrPs3EeCn pvMGZhg2AfGRqbVqFNl5Jx8MYc99wm8DIvVelgmYS54qbY4UjMQOEHojT4l+qBSMwkqf sk/z/rP7SGCOZgiRRSVIJh0CZEhb3WBKEK60eAeK0mHk3mT/pj3tIVhimVevwHjWPFuy q32aGVTEAdG4qDDssXLrc/XuWGd3QB5wMOESmdR0EP9Bcv6sk6nSz+OJKBXLF/WlQYPX Pg49UxvouaMi1HJUOPDgO/LQQ8xJAg2ZowGTiWXIcGLoHGcwPifrgBkf3g98F2admtxp VVXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=QmuH448GVHbk0h4cKcUD4Hb3JzSdTKkxLp+lGmEpNII=; b=lQ+5XgvWbZ6N8Tj7JJ4PuFjGz+vESSNoBNBP3sehJTyKLPsfYjvsOgUQh6YzxXkthN qfs2HXs57Ar80qqZdMYcHCY+IBZr4bcHjGi8dZ+am+596Iw2k+wyBgRvHDCQRxTWAZmI 1iAwB005wEaNdU4g9hdy5MgI0NPzhuaO4VS9lbB8nPwcHfAohDGLpiAG+iV9ef5Bh2qv 2XQIEXXftktsDGU9WpRPUXn1sOp3uYlCbNlWzy0IV8njGYXRxCWhGNc8M0Wpp0jkqwG4 40MGJCr5yIUFjZanW8Pv5SRqMfJKTb/SvJfVbmiM0Aeyh/L5z2/ZvRBqQWj6LXrPQESr 9r6g== X-Gm-Message-State: AOAM532WK3lAqjT30bOf+xc6kKueaAh9/+We+ejDuc1Gl5ny1icW4307 lRAMSvt/K0fLKgfzpHP7OwFxelRQVGY= X-Google-Smtp-Source: ABdhPJwBGjk6o+fjZ63o+z4OGfa4IX7+23fQNrMXwSxQiIfH9TtcBAQJb054KzgedVol8ZSlI7korg== X-Received: by 2002:a37:a347:: with SMTP id m68mr9569380qke.244.1593643864640; Wed, 01 Jul 2020 15:51:04 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:7591:cd25:b0c:85a5? ([2601:18b:300:36ee:7591:cd25:b0c:85a5]) by smtp.gmail.com with ESMTPSA id p125sm6508763qke.78.2020.07.01.15.51.03 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 01 Jul 2020 15:51:03 -0700 (PDT) From: Ted Lemon Message-Id: <3477110E-E456-430F-8E47-0B0217FBF2B9@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_EEB2D71F-D850-4C55-940A-6A1883A6B494" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Wed, 1 Jul 2020 18:51:03 -0400 In-Reply-To: <10843339.pZq1X2qCAG@linux-9daj> Cc: ADD Mailing list To: Paul Vixie References: <7554989.GgB1jQp9Bc@linux-9daj> <1518.1593641342@localhost> <10843339.pZq1X2qCAG@linux-9daj> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 22:51:08 -0000 --Apple-Mail=_EEB2D71F-D850-4C55-940A-6A1883A6B494 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 1, 2020, at 6:29 PM, Paul Vixie wrote: > i think we=20 > should consider that in the IoT world, there will never be profit from = the=20 > delivery and sale of these devices, only from the services they can = offer, and=20 > the phone-home telemetry they can monetize. I think that point is far from clear. Did the company that sold you your = incandescent light bulb need to snoop on your network to make a profit? = No. They=E2=80=99re doing the cloud thing because it=E2=80=99s easy. = Doing it right is _hard_. Of course, since they have the cloud setup, = then they want your data, because why not, but the main reason to use = the cloud is simply that the one thing we know always works on a network = is reachability to the cloud. If we want something better than that, we = have to do better. This is of course way off-topic for ADD=E2=80=A6 :) --Apple-Mail=_EEB2D71F-D850-4C55-940A-6A1883A6B494 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 1, 2020, at 6:29 PM, Paul Vixie <paul@redbarn.org> = wrote:
i think = we 
should = consider that in the IoT world, there will never be profit from the 
delivery and = sale of these devices, only from the services they can offer, and 
the = phone-home telemetry they can = monetize.

I = think that point is far from clear. Did the company that sold you your = incandescent light bulb need to snoop on your network to make a profit? = No. They=E2=80=99re doing the cloud thing because it=E2=80=99s easy. = Doing it right is _hard_.  Of course, since they have the cloud = setup, then they want your data, because why not, but the main reason to = use the cloud is simply that the one thing we know always works on a = network is reachability to the cloud.  If we want something better = than that, we have to do better. This is of course way off-topic for = ADD=E2=80=A6 :)

= --Apple-Mail=_EEB2D71F-D850-4C55-940A-6A1883A6B494-- From nobody Wed Jul 1 15:56:27 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64F4B3A0F1C for ; Wed, 1 Jul 2020 15:56:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xGFrPdVlYXBQ for ; Wed, 1 Jul 2020 15:56:23 -0700 (PDT) Received: from mail-qt1-x830.google.com (mail-qt1-x830.google.com [IPv6:2607:f8b0:4864:20::830]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ACEAB3A0F1A for ; Wed, 1 Jul 2020 15:56:23 -0700 (PDT) Received: by mail-qt1-x830.google.com with SMTP id u17so19848106qtq.1 for ; Wed, 01 Jul 2020 15:56:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding:content-language; bh=rxFoAmS2jx9kbpdr0+4P1p2lonkuCFaS1IMYxVLH+Bw=; b=Er45oCn7fECG72pI6YnK+XphStXJwETNZolsYgnZM2Ub4JQeI++X7IUIE3hAAS5+pZ G6vfUnO71BsGS8QR7v6j11HXyBzsC9UITLW4pW2SjIH8isLzjrC7AAzBOyREfSer+V0D WH4wVdi0YWNSd3xZimSIb0xXzMBocyJY0rr61SW1W771k5k8V4UZ43Nf7NryHCtL8LiI xd66hi15sJZ9VOfaDLCsIfNSJZ4Ns03gcbfKcecfaog5ukfxBk2f52FVPDzkMhFMzE73 YOlhM0JXqNlGdJnFacV9YdgjnCpZfQ3bGsIa1MgD/s6rqs523oNpEp6iGbIKdLCF6TUY 5yVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding :content-language; bh=rxFoAmS2jx9kbpdr0+4P1p2lonkuCFaS1IMYxVLH+Bw=; b=qCx4roEdwSbnoeX8oF/z7D+64v+Oi2ILKnsNzVY4ukg0L+pMr56tXVt+H2hqD58IDp 24LwIkO2b9Z2g+xlSm1gBbx7EEHqdS1XErRC1FC/s94c59Co/SyHz6q/7O4sS4cEo/jX jg7LeaqDCZcT06QKyYFMlj/Qm8J8e2jol9KNAOqHudYqMki1v4TeMWx8u2JTDLT++B9m fZGB696wWXS55HcyAakAmCadZ/l7HVQ0rNunutxBY4P/oNnTalOjsWJ6edJjI4hQ8OqX s0R0BxsmryQi/iInFjnMcAHH5Ll+zoqTueQlq5TU+GPUB6vHjOc85nkhw9nABD87HL1o mV3Q== X-Gm-Message-State: AOAM531ZHRv6sJkgMMIcsHh2Dnyav8/enZoXVIonE2NEHrx9zZ8hFnPX C0NiLdPQOaU8X3plR6OodBBInOScMd4= X-Google-Smtp-Source: ABdhPJw9mEsmoq83QfAyuMCjVx8lt30wAQvvQlvVYT0T4MsZ4UT6ZUzbJ9h9Ip+46pp0PoVzJlzdew== X-Received: by 2002:aed:247a:: with SMTP id s55mr3917079qtc.247.1593644182549; Wed, 01 Jul 2020 15:56:22 -0700 (PDT) Received: from [192.168.1.249] (pool-70-106-222-98.clppva.fios.verizon.net. [70.106.222.98]) by smtp.gmail.com with ESMTPSA id t35sm7135145qth.79.2020.07.01.15.56.22 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 01 Jul 2020 15:56:22 -0700 (PDT) To: Paul Vixie , ADD Mailing list References: <7554989.GgB1jQp9Bc@linux-9daj> <1518.1593641342@localhost> <10843339.pZq1X2qCAG@linux-9daj> From: Tony Rutkowski Message-ID: Date: Wed, 1 Jul 2020 18:56:22 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: <10843339.pZq1X2qCAG@linux-9daj> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 22:56:25 -0000 Hi Paul, Any view on a matter raised at the recent IAB session - to what extent are the behaviors here anticompetitive? --amr On 7/1/2020 6:29 PM, Paul Vixie wrote: > On Wednesday, 1 July 2020 22:09:02 UTC Michael Richardson wrote: >> Paul Vixie wrote: >> > do you see that problem as specific to IoT, or disjoint from RDNS >> > settings? (i do not.) >> >> In the IoT case, we need a good, autonomic mechanism to deploy network >> configuration to devices in ways that they really understand. >> (Such as your proxy-HTTP setting, which I entirely approve of). >> >> Getting the wrong RDNS settings on an IoT device means that it probably does >> not function well (or maybe at all), and it becomes very difficult to do >> RFC8520. (see my draft-richardson-opsawg-mud-iot-dns-considerations-02 ) > speaking as someone who had to create a local responder for 8.8.8.8 in order > to get my chromecast to believe it had internet connectivity, i think we > should consider that in the IoT world, there will never be profit from the > delivery and sale of these devices, only from the services they can offer, and > the phone-home telemetry they can monetize. google's chromecast already > ignores the RDNS settings it gets from my DHCP service. therefore, "wrong" is > in the eye of the beholder, and the interests of IoT buyers are unaligned with > the interests of IoT sellers. we should consider this negotiation a "hostile" > one. > >> Getting the wrong RDNS settings on a *desktop* browser is a qualitatively >> different thing in my opinion. It probably operates, but for some >> uses/users it may be a problem, either because of the click-trail it >> leaves, or because of the censorship that the user experiences. >> >> I think that this is particularly acute for *desktop* browsers, as they do >> not in general have the luxury of just picking a different coffee shop. >> The people who use them are generally vulnerable in a variety of different >> ways. > at the moment, i challenge your specificity here. laptops and smartphones and > datapads all behave the way you're describing for desktops here. > > in the future, i will challenge any specificity on this topic, since all nodes > whether embedded or operated will have the same capabilities and constraints. > >> It is *important* for the browser to be able to clearly indicate what level >> of privacy is being experienced. > i expect that you can get universal agreement on that point. in any case, +1. > From nobody Wed Jul 1 16:03:56 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 496EA3A0F33 for ; Wed, 1 Jul 2020 16:03:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6Poi6w6XxgtS for ; Wed, 1 Jul 2020 16:03:53 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5122E3A0F31 for ; Wed, 1 Jul 2020 16:03:53 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-166.access.rits.tisf.net [24.104.150.166]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id E5BACB0588; Wed, 1 Jul 2020 23:03:50 +0000 (UTC) From: Paul Vixie To: ADD Mailing list , Tony Rutkowski Date: Wed, 01 Jul 2020 23:03:50 +0000 Message-ID: <1648560.kg0s9LhFLv@linux-9daj> Organization: none In-Reply-To: References: <10843339.pZq1X2qCAG@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 23:03:54 -0000 On Wednesday, 1 July 2020 22:56:22 UTC Tony Rutkowski wrote: > Hi Paul, > > Any view on a matter raised at the recent IAB session - to what extent > are the behaviors here anticompetitive? > > --amr i am not a lawyer, but i am a lay expert on antitrust law, from personal experience. if you can share the URI of the document or transcript, i'll be happy to tell you what i think. (i wasn't present at that session.) -- Paul From nobody Wed Jul 1 16:26:01 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 510CB3A11C7 for ; Wed, 1 Jul 2020 16:25:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Duz38TNV419y for ; Wed, 1 Jul 2020 16:25:58 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 605193A11C5 for ; Wed, 1 Jul 2020 16:25:58 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-166.access.rits.tisf.net [24.104.150.166]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 39617B0589; Wed, 1 Jul 2020 23:25:58 +0000 (UTC) From: Paul Vixie To: Ted Lemon Cc: ADD Mailing list Date: Wed, 01 Jul 2020 23:02:22 +0000 Message-ID: <1593646775.dG1Bvp8sRD@linux-9daj> Organization: none In-Reply-To: <3477110E-E456-430F-8E47-0B0217FBF2B9@fugue.com> References: <10843339.pZq1X2qCAG@linux-9daj> <3477110E-E456-430F-8E47-0B0217FBF2B9@fugue.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 23:25:59 -0000 On Wednesday, 1 July 2020 22:51:03 UTC Ted Lemon wrote: > ... Did the company that sold you your > incandescent light bulb need to snoop on your network to make a profit? yes. > No. it's good to know the bailiwick of our disagreement. > ... This is of course way off-topic for ADD=E2=80=A6 :) i won't pursue this point further, then. =2D-=20 Paul From nobody Wed Jul 1 16:29:49 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12F0C3A11C7 for ; Wed, 1 Jul 2020 16:29:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FSeht1K42MJQ for ; Wed, 1 Jul 2020 16:29:45 -0700 (PDT) Received: from mail-qk1-x72a.google.com (mail-qk1-x72a.google.com [IPv6:2607:f8b0:4864:20::72a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 972053A11C5 for ; Wed, 1 Jul 2020 16:29:45 -0700 (PDT) Received: by mail-qk1-x72a.google.com with SMTP id k18so23962292qke.4 for ; Wed, 01 Jul 2020 16:29:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=vYFZDARWYC0JGJiBa4vhJsCsJASlecc+VrGRBy4sxWM=; b=wgswSi2QrzXCK6I4Lf0qqptEXiDJAOWBC1uNtiy7Z23oH2TkdXFNX/769Osj1XGyXq rbyji9W3OIOxYRvEJR2Nvng3bvDy0UkqyG4Fe17CFussb74ycu/T28t1x49/JIBT0Rxo YGRCuc0Gr8KJmd2l5qafKiVI8VfPoVfd3WoEN+GRFsRUqst7LQhdWGfHwnJw2+RmU10G NQlmAiJDhNa6ypFpXt9LgDE/PFgJFZbwFgg2JIrNZtND7enuzzer8ufOegMnrwH/vMl8 Ul0pih2Z33/VTALoX81oLuqcgrZjBrDX+DUV5GQuKj3uY0r6SnT4wDVYDKjx1XTWYx/K cbAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=vYFZDARWYC0JGJiBa4vhJsCsJASlecc+VrGRBy4sxWM=; b=HT+BVPMmYH+aGySNaEfW98rHb4kJ/CSpNO9AjEm2PAH8oJ8aMz+x4JMV6xsAJo6aCt hZDBA/mL6GOcs8lmRvyXHOqs3KdgOVKV+u5ogjxiAf9s/zRQq1gfWPiV04u1lxvyYWZQ EohHBCY1SGnzNVUpj1sPGyjJGxpaeydKgEBLcw4xqr/08UAxdtlrkYBnWqrMaqCqL2md qyc/Jbnk3eeZHgPf3dJGaX3pxe22DVZVa/CSTvXfMa5+VWorTpaiXBVHByPiiYJRNXvS TADqQyt4yu6jNv/SPFUovfVDv5p3mhDVlfuU9xk+Ty2OkvX+nnrfXd36Vmpg04TmDEyz 6/eQ== X-Gm-Message-State: AOAM532oKiMed6IxvdB9++AiM5n/HUC5x1IpXYwILgh7PWp9IXo0J8Y2 oPYmBVqygrpHe0ntUyuVRKRIClKDz1g= X-Google-Smtp-Source: ABdhPJwVHnKz90xe33DQOf1YyH2AXdr59NokOGx8f02J59dXDSdxQuNqeS3bTSQaJwEARFpw0KRlyg== X-Received: by 2002:a37:51c6:: with SMTP id f189mr27901450qkb.339.1593646184460; Wed, 01 Jul 2020 16:29:44 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:7591:cd25:b0c:85a5? ([2601:18b:300:36ee:7591:cd25:b0c:85a5]) by smtp.gmail.com with ESMTPSA id c189sm6980989qkb.8.2020.07.01.16.29.43 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 01 Jul 2020 16:29:43 -0700 (PDT) From: Ted Lemon Message-Id: <0B017DC6-A623-40C2-A964-A2A50146F2FF@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_1102D616-EC99-43CD-8647-C91EB5AE49E6" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Wed, 1 Jul 2020 19:29:42 -0400 In-Reply-To: <1593646775.dG1Bvp8sRD@linux-9daj> Cc: ADD Mailing list To: Paul Vixie References: <10843339.pZq1X2qCAG@linux-9daj> <3477110E-E456-430F-8E47-0B0217FBF2B9@fugue.com> <1593646775.dG1Bvp8sRD@linux-9daj> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2020 23:29:47 -0000 --Apple-Mail=_1102D616-EC99-43CD-8647-C91EB5AE49E6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 1, 2020, at 7:02 PM, Paul Vixie wrote: > On Wednesday, 1 July 2020 22:51:03 UTC Ted Lemon wrote: >> ... Did the company that sold you your >> incandescent light bulb need to snoop on your network to make a = profit? >=20 > yes. I=E2=80=99m confused. Your _incandescent_ light bulb? >> No. >=20 > it's good to know the bailiwick of our disagreement. FWIW, I don=E2=80=99t think we disagree: if you have IoT devices that = reach out to the cloud to work, I think blocking their access to the = cloud makes perfect sense. However, if all you block is their DNS, = that=E2=80=99s not going to go very far toward restricting their access = to the cloud. It=E2=80=99ll work great for devices made by companies = who are reasonably trustworthy, but not for devices that are made by = companies that are crooked, nor compromised devices. --Apple-Mail=_1102D616-EC99-43CD-8647-C91EB5AE49E6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 1, 2020, at 7:02 PM, Paul Vixie <paul@redbarn.org> = wrote:
On Wednesday, = 1 July 2020 22:51:03 UTC Ted Lemon wrote:
... Did the company that sold you = your
incandescent light bulb need to snoop on your network = to make a profit?

yes.

I=E2=80=99m confused. Your _incandescent_ light = bulb?

No.

it's good to know the bailiwick of our = disagreement.

FWIW, I don=E2=80=99t think we disagree: if you have IoT = devices that reach out to the cloud to work, I think blocking their = access to the cloud makes perfect sense.  However, if all you block = is their DNS, that=E2=80=99s not going to go very far toward restricting = their access to the cloud.  It=E2=80=99ll work great for devices = made by companies who are reasonably trustworthy, but not for devices = that are made by companies that are crooked, nor compromised = devices.

= --Apple-Mail=_1102D616-EC99-43CD-8647-C91EB5AE49E6-- From nobody Thu Jul 2 17:22:52 2020 Return-Path: X-Original-To: add@ietf.org Delivered-To: add@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B2383A096E; Thu, 2 Jul 2020 17:20:37 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: add@ietf.org, barryleiba@computer.org X-Test-IDTracker: no X-IETF-IDTracker: 7.7.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159373563715.30173.12157040061933907010@ietfa.amsl.com> Date: Thu, 02 Jul 2020 17:20:37 -0700 Archived-At: Subject: [Add] add - Requested session has been scheduled for IETF 108 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2020 00:20:49 -0000 Dear Glenn Deen, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. add Session 1 (1:40 requested) Thursday, 30 July 2020, Session III 1410-1550 Room Name: Room 2 size: 2 --------------------------------------------- iCalendar: https://datatracker.ietf.org/meeting/108/sessions/add.ics Request Information: --------------------------------------------------------- Working Group Name: Adaptive DNS Discovery Area Name: Internet Area Session Requester: Glenn Deen Number of Sessions: 1 Length of Session(s): 100 Minutes Number of Attendees: 200 Conflicts to Avoid: Chair Conflict: mops tsvwg mboned Technology Overlap: capport dhc dnsop dprive opsawg wpack Key Participant Conflict: httpbis tls quic People who must be present: Barry Leiba Glenn Deen David C Lawrence Resources Requested: Special Requests: --------------------------------------------------------- From nobody Thu Jul 2 22:23:06 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B7753A0CC4 for ; Thu, 2 Jul 2020 22:23:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eZWLD7dpqxbY for ; Thu, 2 Jul 2020 22:23:04 -0700 (PDT) Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 19C5D3A0CC3 for ; Thu, 2 Jul 2020 22:23:03 -0700 (PDT) Received: by mail-io1-xd2e.google.com with SMTP id c16so31292786ioi.9 for ; Thu, 02 Jul 2020 22:23:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=btMEZMEahL7lPN41JygVOdGjf2wt+39W6M88PEh3TUE=; b=eHCRjcYKFCO1cGG+MxPXUnQ1RPjv7M/QTGPuI7fjuLMkoEKyYTaUVzkXwfMowjTAJn ZhMbV/9h+kj51jIBskotX4R1/kpPrBBwaPTO6bojwhEPMfl6NaLIRaA1kIoQJ2EenUEL TuU8nI5l/eZPpYbCpmtUdMdAOTzBtzZQkxA4WUMndlY86oTHivoK8wrko1C8448GsDVG RvOc0VeiOQLz+UAs94owMvkXBtkB5Csksov0yTWmL/BcDZrKaoGO41LMSN8RVU6Ho0a9 nO1V+SEdJL0KhGSeapi8HsAKI+FzSQXYoVjQyCOn2bWZ+Bh0mPBBQD9mcajkvtAI5lwF KDCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=btMEZMEahL7lPN41JygVOdGjf2wt+39W6M88PEh3TUE=; b=uEAUeNIa8luJyzeQBnxfivDzlxY+TZNgaJKsDU8zFUgPGKjGUP9m/1oNCY265Bed1/ aoZT+CUS4c/1MX+liC578z10XdW5Zk0rQf2u5cqD15Z4XKjyA1YS3VuZryS4afXr1Ek5 5BXC16QWb2oHTVJqIjyOHcKB8BNBM3/pwhQpfqjdzyMUoYnDha6nEU7kYV71jynVgzNm Pp7hdYttgbZPMm3VKx5A3/CrWUpJ1lbZsrWFWqAXcz5JQAZH8SbPYRKxy92oe3qJMG3L ak9YQ+Hf9cVgG+H61JVE043q5X2pcE25f8M7WeI0secvZ7dpo2QBFhOnKUpJPkQ9C93I jLew== X-Gm-Message-State: AOAM531SCA5bYT6QJDWLzizlpyByZnNxHCUmopjGu2ScCOwcrfv1Fzay 3hiiRSBl9vbxiHR54+4jvC2DFvAw4caF8fdQX2w= X-Google-Smtp-Source: ABdhPJxH0eMPJJmf86tfnXDhmUC1PAzxLHOvNr4bBhnO0PihLbC5sqRqucQ14Lf2SpDLzgPBDgzkn9f070aR94N3kOg= X-Received: by 2002:a02:1784:: with SMTP id 126mr38640499jah.53.1593753782937; Thu, 02 Jul 2020 22:23:02 -0700 (PDT) MIME-Version: 1.0 References: <10843339.pZq1X2qCAG@linux-9daj> <1648560.kg0s9LhFLv@linux-9daj> In-Reply-To: <1648560.kg0s9LhFLv@linux-9daj> From: Rob Sayre Date: Thu, 2 Jul 2020 22:22:51 -0700 Message-ID: To: Paul Vixie Cc: ADD Mailing list , Tony Rutkowski Content-Type: multipart/alternative; boundary="000000000000176d1e05a982b86b" Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2020 05:23:05 -0000 --000000000000176d1e05a982b86b Content-Type: text/plain; charset="UTF-8" On Wed, Jul 1, 2020 at 4:04 PM Paul Vixie wrote: > On Wednesday, 1 July 2020 22:56:22 UTC Tony Rutkowski wrote: > > Hi Paul, > > > > Any view on a matter raised at the recent IAB session - to what extent > > are the behaviors here anticompetitive? > > > > --amr > > i am not a lawyer, but i am a lay expert on antitrust law... > This sounds very interesting. I'd love to hear the followup on this one. :) cheers, Rob --000000000000176d1e05a982b86b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 1, 2020 at 4:04 PM Paul Vixie= <paul@redbarn.org> wrote:
On Wednesday, 1 July 2020 22:56:22 UTC Tony Rutkowski wrote:
> Hi Paul,
>
> Any view on a matter raised at the recent IAB session - to what extent=
> are the behaviors here anticompetitive?
>
> --amr

i am not a lawyer, but i am a lay expert on antitrust law...

This sounds very interesting. I'd love to hear th= e followup on this one. :)

cheers,
Rob

--000000000000176d1e05a982b86b-- From nobody Fri Jul 3 03:12:33 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 874CD3A0BCD for ; Fri, 3 Jul 2020 03:12:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B3xg_APr-2So for ; Fri, 3 Jul 2020 03:12:30 -0700 (PDT) Received: from mail-qt1-x829.google.com (mail-qt1-x829.google.com [IPv6:2607:f8b0:4864:20::829]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A2873A0B57 for ; Fri, 3 Jul 2020 03:12:30 -0700 (PDT) Received: by mail-qt1-x829.google.com with SMTP id x62so23488181qtd.3 for ; Fri, 03 Jul 2020 03:12:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=f8/gxL7z5daan5T+va9Ad3cY+25knQp0uU0AwtA83NY=; b=RD9fAWDSpOQ1yxa+nygmd8D6aIErI04gtGpKFnf2q8J/Ua25UfJuOSFrpCXlBZBi+9 zaxzZY8tY/0XpRhuPqukdorUijIrD+3XW5n7QX8KHvD9IwtMh6rZwebMCLgMIau2A8iV fzYCT89KFWaVHdm2+iUXmnETsmKFbOPpT6jiznLbeufSI7Y96jBHuTHHuBVt9zlLRs0G nkt8hhgQc1JrtV4JwDV8AX6AmYjcufc1NbRrELuFIy2vcpP3EkxDuP3HDZzX1CWF+3gz 1zEEktpab9JZHOaodAssefrYDQBFYl6jwjS2hIEFhuHqwwQGiG8jN9tbgJFaBFaRoPsr MBMQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=f8/gxL7z5daan5T+va9Ad3cY+25knQp0uU0AwtA83NY=; b=RQ2ShfnUsTJGL+6HqIw5TfktLs4KTiHYYQ8OKyDPxQJ4rd77MGmfHz/C9KfvJJfNnu 1u3ZMgiafi8F5GaZS6ivqdcccpobC/18PV7IibwQSBAbsta+qpwDMg9gs+SUWXZHGfBH pPs79R3cZNhd8QMX748REMHQW/R9LV0glljpo5maJkVKZCsXFnPYLHyye/g0Y+lHMABJ 9PBBc9E+hsWZ2OPcuuKE7/NeTSpFZkDfLbmAzHQvf8Lr/rDdKx8nSIE68kAslw9/kD1d y0+K/aa4IEigLcdffs+JoP+I0ot3rlMDUeyC/YMvEYSqZSy5p+tJE9Atdse+lO3U1A67 uZOQ== X-Gm-Message-State: AOAM5336n4Ex3+kqqTKmvy/0/XNTwGD7dzeIYsKaGB2wuhfuH6hZY8Lm hb4n3ShpXkD/F9m17SXP6+m5El/WP0TqFTRBcoT7i85N9OI= X-Google-Smtp-Source: ABdhPJxIEipK6TOIxXKLVypSPa+TRtF7OBDO/Nzzz9JplczjVRpP7eUGiX3zHBfKhVkizeEj4875Yg0mog9MeXa5qWQ= X-Received: by 2002:aed:3048:: with SMTP id 66mr33889687qte.326.1593771148877; Fri, 03 Jul 2020 03:12:28 -0700 (PDT) MIME-Version: 1.0 From: Alec Muffett Date: Fri, 3 Jul 2020 11:11:53 +0100 Message-ID: To: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000002ea69c05a986c34c" Archived-At: Subject: [Add] DoHoT - making & measuring practical use of DNS over HTTPS over Tor X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2020 10:12:32 -0000 --0000000000002ea69c05a986c34c Content-Type: text/plain; charset="UTF-8" A little project of mine which may be of slight interest to folks here: - https://twitter.com/AlecMuffett/status/1278990840485097472 - https://github.com/alecmuffett/dohot - https://medium.com/@alecmuffett/dohot-making-practical-use-of-dns-over-https-over-tor-ef58d04ca06a. - alec :-) -- http://dropsafe.crypticide.com/aboutalecm --0000000000002ea69c05a986c34c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable --0000000000002ea69c05a986c34c-- From nobody Fri Jul 3 07:25:51 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75B4B3A07E0 for ; Fri, 3 Jul 2020 07:25:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SyX00Iv2zsST for ; Fri, 3 Jul 2020 07:25:48 -0700 (PDT) Received: from mail-qt1-x82c.google.com (mail-qt1-x82c.google.com [IPv6:2607:f8b0:4864:20::82c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 166673A07F7 for ; Fri, 3 Jul 2020 07:25:48 -0700 (PDT) Received: by mail-qt1-x82c.google.com with SMTP id d27so23999258qtg.4 for ; Fri, 03 Jul 2020 07:25:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language; bh=kb8M6WOQA9vzlJkDvXEqCmLlNUZgYOPHiSWvP1vM2mI=; b=XuJurZv7Cqm7kR5NAf5zuRzZKEk/MQZJkIfip0b2kAW8YSV5KS6mNtmOvj10LVkZnj f6GXnKafIUEhV5hX1isIAbJvNZBuZTQhXMaFJnAGex/qGybdu5I1aQT150niR/HL5h5Z NbolYc84GujSrLkNrkyr2q0QOOx2fJg7JGO47rk7Y5N1A2b7yNbvKqjYYB6ldjfwc/3p SCjKLeHeut6ipAMGvY47rDRKJeeZcPHLebI8TX626AwOW73uwJ68gerLQ/Sq7MQMwaSb n0Qu0LBVoQj6ItkcPNx6H0Q4SQNtmAfk8Lg1767rBubf1bgdif4SzUwL9dpF9rpQidrR YyFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language; bh=kb8M6WOQA9vzlJkDvXEqCmLlNUZgYOPHiSWvP1vM2mI=; b=NjgVeoW/sax37L3pJKjHCka5DDIRa7d59NlHLzepPhtRun72eGFnJSVKmk306VTCO8 R6KknGe0hUfEabCTe7k3Wa2NRA37pswT5Y6q7KpJcgPFlqoqOMTKN1o8DfCpVoTMwAEp 6/QJvTwHCdv46M2DhxVtVr0T0t5AaYRhy82/h1sKX3croCDHPAcUNopXVAdK5RQYPPCz 7bNrQO+lrLMYGLAZXzt/mO9QjEZ3A9AGY81oYOp+H2d8/KyzRFSeKhBlVgPhg6z1DtUL K+W2qndZ2tX4ADVQEFrv0D+uqMtr+wPR/5+oIfAq+vjg0zecowHb5DOhitVsCooLHUdv cMSA== X-Gm-Message-State: AOAM530MUZKAUq4Q4pcIQBd2kGAKc/HPdE+Rebeg2+lgTuzsyeusllr4 zHmTfAHTNwgNA+16f6kg/hyS96uG8rg= X-Google-Smtp-Source: ABdhPJykKK7KSsjwKOgj26XYHJf27AQKHf8UZe5Ilu9P04X+XaC28aoglVhJvB8DUuuHHP3fBlmrFQ== X-Received: by 2002:ac8:5048:: with SMTP id h8mr35659244qtm.81.1593786346813; Fri, 03 Jul 2020 07:25:46 -0700 (PDT) Received: from [192.168.1.249] (pool-70-106-222-98.clppva.fios.verizon.net. [70.106.222.98]) by smtp.gmail.com with ESMTPSA id k194sm10499307qke.100.2020.07.03.07.25.45 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 03 Jul 2020 07:25:46 -0700 (PDT) To: Rob Sayre , Paul Vixie Cc: ADD Mailing list References: <10843339.pZq1X2qCAG@linux-9daj> <1648560.kg0s9LhFLv@linux-9daj> From: Tony Rutkowski Message-ID: Date: Fri, 3 Jul 2020 10:25:46 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------8379593025C13F260000191C" Content-Language: en-US Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2020 14:25:50 -0000 This is a multi-part message in MIME format. --------------8379593025C13F260000191C Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Hi Rob et al., The concern was raised on open mike at the #107 IETF Plenary. All standards bodies have antitrust exposure.  Most recognize that exposure and have explicit practices and programs dedicated to reducing it.  Standards making by definition is an antitrust conspiracy. The "followup" usually occurs through actions by competition authorities and judicial litigation.  The IETF's exposure over the years has been significant, but ignored and mollified by insurance coverage and a "fuzzied" organization, coupled with circumspect affiliations of actors, and non-profit devises.  As the anticompetitive behaviour has increased in recent years, and judging by recent actions underway, the IETF antitrust "free pass" is probably coming to an end, and the new IETF Trust LLC should be demonstrating due diligence.  Organizations, companies, and individual are potentially culpable. Yes, the followup should be interesting indeed. --tony On 7/3/2020 1:22 AM, Rob Sayre wrote: > On Wed, Jul 1, 2020 at 4:04 PM Paul Vixie > wrote: > > On Wednesday, 1 July 2020 22:56:22 UTC Tony Rutkowski wrote: > > Hi Paul, > > > > Any view on a matter raised at the recent IAB session - to what > extent > > are the behaviors here anticompetitive? > > > > --amr > > i am not a lawyer, but i am a lay expert on antitrust law... > > > This sounds very interesting. I'd love to hear the followup on this > one. :) > > cheers, > Rob > --------------8379593025C13F260000191C Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

Hi Rob et al.,

The concern was raised on open mike at the #107 IETF Plenary.  All standards bodies have antitrust exposure.  Most recognize that exposure and have explicit practices and programs dedicated to reducing it.  Standards making by definition is an antitrust conspiracy.

The "followup" usually occurs through actions by competition authorities and judicial litigation.  The IETF's exposure over the years has been significant, but ignored and mollified by insurance coverage and a "fuzzied" organization, coupled with circumspect affiliations of actors, and non-profit devises.  As the anticompetitive behaviour has increased in recent years, and judging by recent actions underway, the IETF antitrust "free pass" is probably coming to an end, and the new IETF Trust LLC should be demonstrating due diligence.  Organizations, companies, and individual are potentially culpable.

Yes, the followup should be interesting indeed.

--tony

On 7/3/2020 1:22 AM, Rob Sayre wrote:
On Wed, Jul 1, 2020 at 4:04 PM Paul Vixie <paul@redbarn.org> wrote:
On Wednesday, 1 July 2020 22:56:22 UTC Tony Rutkowski wrote:
> Hi Paul,
>
> Any view on a matter raised at the recent IAB session - to what extent
> are the behaviors here anticompetitive?
>
> --amr

i am not a lawyer, but i am a lay expert on antitrust law...

This sounds very interesting. I'd love to hear the followup on this one. :)

cheers,
Rob

--------------8379593025C13F260000191C-- From nobody Fri Jul 3 16:17:54 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 008A63A0AB1 for ; Fri, 3 Jul 2020 16:17:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T43Uhk4B6Duu for ; Fri, 3 Jul 2020 16:17:51 -0700 (PDT) Received: from mail-il1-x12b.google.com (mail-il1-x12b.google.com [IPv6:2607:f8b0:4864:20::12b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A1CC3A0AB3 for ; Fri, 3 Jul 2020 16:17:51 -0700 (PDT) Received: by mail-il1-x12b.google.com with SMTP id t4so15268739iln.1 for ; Fri, 03 Jul 2020 16:17:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=FhB1uxNOjsZABPSAry46NtKwMMyCf3+z9wPfcCk2AbA=; b=g1/SE1a1UfAY6VcLCER+fxMjCNiULmmbHnEKN4hgzotoBOH9nzCQRGme0VnlzX0EHe uFAbcFn7f5LhdBtZNUikSNMKyLwsdgkbZh+rDgyjVpxlcndKaufdWBkCTzoKhGWct1/c NRyFmsOFEKON71fOK8ohKNxD6W95yARi6pqMN2AnNCf0GscC7lXD/U2JA64aQqdV4xBe Qwpd103LILK5y/kop3Nfi6C5mqNZAuwKjzkwx/KWDkz2aRbszuLjj75sHhYo9eLc73D4 Sxm1jT7MpG0sI+CfThdlg/RbI/B+IXfDJycwQVZq7zWYz9PbURm5P+A3tnSRcNSAoxAZ d49A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=FhB1uxNOjsZABPSAry46NtKwMMyCf3+z9wPfcCk2AbA=; b=PcxCiHMfZZl36+K2uhuiNjSNwP84qkaQ4Rzkf1hh4AmMfKZc1x/4h8P+rcvbIY2OYd OhPiOmv2LgNyjIf6gGD7THACWdyr7DeWaPigYZwfrcnYvD+9jN9A++PJ0CstK4AO7mnD m5ybMMVGREpbCL1BsCD+UQxO5bxX+JlQ4EwNyUEMgd1QX3NSeiA9sEk9WflEQ5X/KUeF l6nla9me1XGcJGv7AAML/po2zAVmHx8XznPd/OxVj5dXRpDgAFKi9BH3GMCPx5blai4d nrZS2GObzX9liyF0PbJKyF/PmJhGr5N3+3mwHY/joEdr2/KjwSqSE0TmSFyPmOoMX/y6 BT4w== X-Gm-Message-State: AOAM533JW51Hfbv4gcxsp91rPAbUv5IsYemrcAFt6fXP0+wagSTWmTCP RM56a+C61t5mRxRCFPdcrEar+wMDUZa6A32QVq8Yg0QjLjY= X-Google-Smtp-Source: ABdhPJzCuvwbT4xa9GqyFSiZnq0Jva9wfz9Mpg2XlQr7qi19qBDETBBR1aLtZPtUPFnYIMqhdEWewC/t7cWDtAnQWdw= X-Received: by 2002:a92:5207:: with SMTP id g7mr20237131ilb.49.1593818270274; Fri, 03 Jul 2020 16:17:50 -0700 (PDT) MIME-Version: 1.0 References: <10843339.pZq1X2qCAG@linux-9daj> <1648560.kg0s9LhFLv@linux-9daj> In-Reply-To: From: Rob Sayre Date: Fri, 3 Jul 2020 16:17:39 -0700 Message-ID: To: Tony Rutkowski Cc: Paul Vixie , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000d6196905a991bb4c" Archived-At: Subject: Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2020 23:17:53 -0000 --000000000000d6196905a991bb4c Content-Type: text/plain; charset="UTF-8" On Fri, Jul 3, 2020 at 7:25 AM Tony Rutkowski wrote: > The concern was raised on open mike at the #107 IETF Plenary. > Hi, It's unclear what you're referring to. You referenced a "recent IAB session", in addition to the IETF 107 plenary. Both of those should have links, so it might clarify your point if you provided them. Also, I think you mean "open mic". Without more context, I feel these messages are off-topic for this list. thanks, Rob --000000000000d6196905a991bb4c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Jul 3, 2020 at 7:25 AM Tony R= utkowski <rutkowski.tony@gma= il.com> wrote:
Subject: Re: [Add] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Jul 2020 00:39:26 -0000 On Fri, Jun 26, 2020 at 8:48 PM Eric Rescorla wrote: > > > > On Fri, Jun 26, 2020 at 5:04 PM Paul Vixie wrote: >> >> On Friday, 26 June 2020 22:08:05 UTC Eric Rescorla wrote: >> > ... Other than inelegance, what's problematic about the CNAME approach? >> >> inelegance is permanent, accretive, and earns compound interest. we ought not >> dismiss inelegance as the basis for reluctance. inelegance is not inevitable >> nor is it automatically acceptable. >> >> > ... >> > >> > The scenario you seem to be interested in is one in which the user joins >> > the network and then learns that the associated Do53 resolver supports DoH >> > and then connects to it with whatever coordinates that resolver (or DHCP or >> > whatever) provides. That clearly is not useful in the 3552 threat model >> > which assumes that the attacker entirely controls the network because the >> > attacker can just send their own resolver coordinates. That isn't to say >> > that there aren't more limited but still realistic threat models where this >> > would be useful, but I think you should start by describing those. >> >> as we describe them, we should also describe their scale, their age, and their >> likely lifespan. the 3552 threat model, while it does use the term >> 'pervasive', is nowhere near as common as the SASE (secure access service >> edge) operations model, nor will it ever be. if apps who want to do their own >> DNS treat any DoH failure as an attack, and start an arms race of spy-vs-spy >> bypass along the lines of Tor, that's going to feel problematic to any of us >> whose privately owned securely operated edge networks have a local-only DNS >> policy. >> >> RESINFO could probably get better results by using TXT, because of long tail >> problems. but ultimately we have to pick a default assumption that we can act >> on when secure resolver discovery fails. "OMG it's a 3552 attack" is not the >> only interpretation we could think of for this. it's entirely possible that >> the most engineering solution to the discovery problem is to fail hard when >> the middlebox prevents authenticated policy negotiation, to force middlebox >> upgrades. i know that "tough love" is a hard sell, but "assume 3552 attack" is >> also a form of tough love. > > > Hi Paul, > > I think this response perhaps conflates two somewhat different issues, > namely CNAME versus authenticated policy propagation. > > Ignoring the question of CNAME for the moment, if a device joins a > network and gets its configuration from that network (e.g., via DHCP), > then it is trusting that network to provide the configuration. So, the > question then becomes what benefit is obtained if that network > supplies a Do[TH] server rather than a Do53 server. In the 3552 model, > we assume the attacker has complete control of the network and can > therefore supply its own server, so it's not clear what the security > benefit is. Conversely, if the network is totally secure and trusted, > then it's *also* not clear what the security benefit is. > > So, if we are to have unauthenticated discovery of Do[TH] servers, > then we must have some other threat model. For instance we might > think that the attacker can read all packets but for some reason > can't impersonate the DHCP server. What I'm saying is that we should > start by laying out what that threat model is and then we can define > what, if any, technical measures add security benefit in that threat > model. That would be true even if we knew that there weren't > middleboxes which tampered with new record types. >From RFC 3552, the threat model for unauthenticated discovery would be passive attacks described in section 3.2. There is benefit to upgrading from Do53 to Do[TH] even if the network between the client and the DHCP server is secure - specifically when the DNS resolver is further away on the network. This could be because the network operator is running the DNS resolver further away (e.g. DHCP could be on the home router for a typical home user) or the DNS resolver specified by the ISP is operated by a third-party on a different network. -Puneet > > > Two more points, if I may: > > 1. Where this interfaces with the question of CNAME versus RESINFO > is that RESINFO is much more flexible, but (as above) it's not > clear we can securely make use of this flexibility. > > 2. It's worth nothing that there are scenarios where the device > can get authenticated network configuration (for instance, if > the device is managed and has had some sort of authentication key > installed). The comments above do not apply to this scenario > but rather to the scenario where you have a naive device joining > a network. > > -Ekr > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Fri Jul 3 17:44:55 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6946D3A0962 for ; Fri, 3 Jul 2020 17:44:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5-P7_M0UhLXA for ; Fri, 3 Jul 2020 17:44:52 -0700 (PDT) Received: from mail-lj1-x232.google.com (mail-lj1-x232.google.com [IPv6:2a00:1450:4864:20::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D38E13A0953 for ; Fri, 3 Jul 2020 17:44:51 -0700 (PDT) Received: by mail-lj1-x232.google.com with SMTP id f5so23001714ljj.10 for ; Fri, 03 Jul 2020 17:44:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=VUk44YrgKMmT7LFJA5sn8aYBB1I2nICa9rBQJhKas3Q=; b=U2+VXiEJO0Bnk9VeQfppCaccZmAuMGITDZb3cnKxrCh5QXnstajYgmW11SJbA2H/4G C5eLKm3h6xmiDL/dqWhr+HJQFqyTkrle/m/pJmHZPqyz+K209aOYYZZzJPtY6zM+B9dD ClMy6FhlZhaoP90zvkDKl6B5j5S6pPOFVncpF1uySZ7kwkWSYYyqGVGoVa6Nby5FJZl7 4MCzS4Su3qX3cd/2vIbu7QBR4w+xuG9hZEZXl9PvpiU8sp8FTf6J4sFOLHyriMOFswgO zOJqtPlc8kVnRdp+VqRcvB38v++zT1Lh1gd05PDD1jWJeQFUBOYFfrWs2ixNH+v1gJ0a qLbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=VUk44YrgKMmT7LFJA5sn8aYBB1I2nICa9rBQJhKas3Q=; b=IfCRfV8wUCuv05aDoiU2y5wQ+/1u2rm2rla97mvG1yGwM8zGIdoIU4hNnG0YlGo+gS xTiYRy7GiD6o5h8GI5VZ8rGuA2Yz6x/7A0MOHFZIs9kGFHzJGyqJySDavU+l0ILxouSm OMX3U4xSt43EPF1LwrMVTejIVGgtkBHYK3lpFInV58trelME+9sT/q/LiddPih19gAW3 +5lVijShUoHwYv8I1weYPpXa0QbJgb8PKyozR1r6dM3MejSGJWu5/N4/TphLmKL3Rfhu Sxmw0HGqafkSyLTAnr4rezH6h0bS2uMee/cIELZG4QejeDCTw0YxZH4Cqc7BstvMKt3G VGDQ== X-Gm-Message-State: AOAM533Qb9WPXDwFb0XyZVFv+qfyLWjoMPIeah1K4QTCH5tPzUKB2iyr 5z1Vk2pdE2h+DlP0UDKPKPPu4AZFlmERJrcUZgIfqg== X-Google-Smtp-Source: ABdhPJz+YnkOmohTosn4c3j2QNhyKfx5P0ZSFpglhJtYTay47p386kwwsPt0Uml7egsTSUMzcgoML0LKkh1VqNDjm/U= X-Received: by 2002:a05:651c:1044:: with SMTP id x4mr20276686ljm.409.1593823489939; Fri, 03 Jul 2020 17:44:49 -0700 (PDT) MIME-Version: 1.0 References: <1AB2782B-87C0-4991-8703-AE2C98411AFC@apple.com> <2013869.BjYadG0qc2@linux-9daj> In-Reply-To: From: Eric Rescorla Date: Fri, 3 Jul 2020 17:44:13 -0700 Message-ID: To: Puneet Sood Cc: Paul Vixie , ADD Mailing list , Tommy Pauly Content-Type: multipart/alternative; boundary="000000000000f3f0c805a992f2f1" Archived-At: Subject: Re: [Add] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Jul 2020 00:44:53 -0000 --000000000000f3f0c805a992f2f1 Content-Type: text/plain; charset="UTF-8" On Fri, Jul 3, 2020 at 5:39 PM Puneet Sood wrote: > > So, if we are to have unauthenticated discovery of Do[TH] servers, > > then we must have some other threat model. For instance we might > > think that the attacker can read all packets but for some reason > > can't impersonate the DHCP server. What I'm saying is that we should > > start by laying out what that threat model is and then we can define > > what, if any, technical measures add security benefit in that threat > > model. That would be true even if we knew that there weren't > > middleboxes which tampered with new record types. > > From RFC 3552, the threat model for unauthenticated discovery would be > passive attacks described in section 3.2. There is benefit to > upgrading from Do53 to Do[TH] even if the network between the client > and the DHCP server is secure - specifically when the DNS resolver is > further away on the network. This could be because the network > operator is running the DNS resolver further away (e.g. DHCP could be > on the home router for a typical home user) or the DNS resolver > specified by the ISP is operated by a third-party on a different > network. > Puneet, Thanks for your response. This certainly seems like a reasonable threat model. However, if this *is* your threat model, then it seems like it would be rather easier to just have the gateway router just proxy to the actual resolver over a secure channel. This would have several advantages: 1. It would not require defining any new discovery protocol. 2. It would work with any client, even older, non-upgradeable ones. 3. It would allow the gateway router to inspect the traffic and perhaps do filtering/monitoring/etc. (This last one seems like it's arguably not an advantage but given that that device can insert itself in the middle anyway....) -Ekr --000000000000f3f0c805a992f2f1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Jul 3, 2020 at 5:39 PM Puneet= Sood <puneets@google.com> = wrote:
> So, if we are to have unauthenticated discovery of Do[TH] servers,
> then we must have some other threat model. For instance we might
> think that the attacker can read all packets but for some reason
> can't impersonate the DHCP server. What I'm saying is that we = should
> start by laying out what that threat model is and then we can define > what, if any, technical measures add security benefit in that threat > model. That would be true even if we knew that there weren't
> middleboxes which tampered with new record types.

>From RFC 3552, the threat model for unauthenticated discovery would be
passive attacks described in section 3.2. There is benefit to
upgrading from Do53 to Do[TH] even if the network between the client
and the DHCP server is secure - specifically when the DNS resolver is
further away on the network. This could be because the network
operator is running the DNS resolver further away (e.g. DHCP could be
on the home router for a typical home user) or the DNS resolver
specified by the ISP is operated by a third-party on a different
network.

Puneet,

Thanks for your response.

This certainly seems = like a reasonable threat model. However, if this *is* your threat model,
then it seems like it would be rather easier to just have the gatew= ay router just proxy
to the actual resolver over a secure channel= . This would have several advantages:

1. It would = not require defining any new discovery protocol.
2. It would work= with any client, even older, non-upgradeable ones.
3. It would a= llow the gateway router to inspect the traffic and perhaps do filtering/mon= itoring/etc.
(This last one seems like it's arguably not an a= dvantage but given that that device can insert
itself in the midd= le anyway....)

-Ekr

=
--000000000000f3f0c805a992f2f1-- From nobody Mon Jul 6 05:18:25 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B32C3A13E7 for ; Mon, 6 Jul 2020 05:18:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WA4HWLQQD_6g for ; Mon, 6 Jul 2020 05:18:20 -0700 (PDT) Received: from mail-io1-xd29.google.com (mail-io1-xd29.google.com [IPv6:2607:f8b0:4864:20::d29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B0B143A13E3 for ; Mon, 6 Jul 2020 05:18:20 -0700 (PDT) Received: by mail-io1-xd29.google.com with SMTP id o5so38963548iow.8 for ; Mon, 06 Jul 2020 05:18:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=bZyaUZ7fhsxcbXNVtXgcO7XryW9i2QssXg48dwnQ86U=; b=ckgs1Th+48Tr03iBF5nmYcBvxIICo5R5L2H+PdW/nzDJbHAISZ3gO6Mr3riknT1yNC 58ogeF6hNW6m3zPXvZRRtLLjf4pUB9Y3PYMRsTY9p8947gQR4SiqQ8mLynknY8yX1VCm S//HI4Y062K/KPbFbNuBjPDkaiHiB9/n2gFv4tKOjUXxsNN8wbR282H3m9cMwVs52IOn l5ihXUzZ+KlDu6l2Po+DlcbFWtfETa2ekaa6iuExKmY8jTGqM1rt6y6R1GtDQ/NR0Zho /44m4SoLPcse/I398Lv+ykhZWJRhjCqh/lkm5PeHFS4FRSijTGjA4hpGwwy3T/Rh7yWy mpjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=bZyaUZ7fhsxcbXNVtXgcO7XryW9i2QssXg48dwnQ86U=; b=oibdpeuwRPUmm4SC8XOzrE9lSSUS5NVpr0w7bTHCAyANayH9V2wKmPvPKX5NHcHDsb d+NaAVwAK+fmgzsrKJzIzLnbMmqwIduDD0pz0OkIyd3CkXQ7civQhtY9VDwU4a6wXXQL qXHIahWiRd5RqhHdihSre0XRNY9Mhm4/du+nWVpHpBogHUwaPWIucTOKE67Nl6JknJiw 9+DRxaZhnYcogLEgSLfX/ZIcN+Kuai2ijM0HPC0qRid5vpY5kb7RbBp2tSNgWT4opDzC 1cOx/N3BNaXl9m7nDTXiDddwKrMKfAmZE3SViNwFgXoMqPelBSWeEvJc7sK29C6FyRXB KtkQ== X-Gm-Message-State: AOAM533JjUQRCWJFBgcXTs+tBEp8xrvc3oq2vzIokpqldfO5nSKBqjMb pDHAJ5m2TOfJT9BVFnR3TxfORKMhHzqvE6qGYMle7ytR X-Google-Smtp-Source: ABdhPJzptm554pU12MHAe1uoZfg3lv8Afo6nTc+AUL9s3bl4D71mEv10VJO8Xh09hyYMljq/8pag1VNMP1l6qHpXNjs= X-Received: by 2002:a02:5443:: with SMTP id t64mr53433200jaa.100.1594037899856; Mon, 06 Jul 2020 05:18:19 -0700 (PDT) MIME-Version: 1.0 References: <1AB2782B-87C0-4991-8703-AE2C98411AFC@apple.com> <2013869.BjYadG0qc2@linux-9daj> In-Reply-To: From: tirumal reddy Date: Mon, 6 Jul 2020 17:48:07 +0530 Message-ID: To: Puneet Sood Cc: Eric Rescorla , ADD Mailing list , Paul Vixie , Tommy Pauly Content-Type: multipart/alternative; boundary="000000000000c7910e05a9c4def5" Archived-At: Subject: Re: [Add] Draft Posting: CNAME Discovery of Local DoH Resolvers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2020 12:18:24 -0000 --000000000000c7910e05a9c4def5 Content-Type: text/plain; charset="UTF-8" On Sat, 4 Jul 2020 at 06:09, Puneet Sood wrote: > On Fri, Jun 26, 2020 at 8:48 PM Eric Rescorla wrote: > > > > > > > > On Fri, Jun 26, 2020 at 5:04 PM Paul Vixie wrote: > >> > >> On Friday, 26 June 2020 22:08:05 UTC Eric Rescorla wrote: > >> > ... Other than inelegance, what's problematic about the CNAME > approach? > >> > >> inelegance is permanent, accretive, and earns compound interest. we > ought not > >> dismiss inelegance as the basis for reluctance. inelegance is not > inevitable > >> nor is it automatically acceptable. > >> > >> > ... > >> > > >> > The scenario you seem to be interested in is one in which the user > joins > >> > the network and then learns that the associated Do53 resolver > supports DoH > >> > and then connects to it with whatever coordinates that resolver (or > DHCP or > >> > whatever) provides. That clearly is not useful in the 3552 threat > model > >> > which assumes that the attacker entirely controls the network because > the > >> > attacker can just send their own resolver coordinates. That isn't to > say > >> > that there aren't more limited but still realistic threat models > where this > >> > would be useful, but I think you should start by describing those. > >> > >> as we describe them, we should also describe their scale, their age, > and their > >> likely lifespan. the 3552 threat model, while it does use the term > >> 'pervasive', is nowhere near as common as the SASE (secure access > service > >> edge) operations model, nor will it ever be. if apps who want to do > their own > >> DNS treat any DoH failure as an attack, and start an arms race of > spy-vs-spy > >> bypass along the lines of Tor, that's going to feel problematic to any > of us > >> whose privately owned securely operated edge networks have a local-only > DNS > >> policy. > >> > >> RESINFO could probably get better results by using TXT, because of long > tail > >> problems. but ultimately we have to pick a default assumption that we > can act > >> on when secure resolver discovery fails. "OMG it's a 3552 attack" is > not the > >> only interpretation we could think of for this. it's entirely possible > that > >> the most engineering solution to the discovery problem is to fail hard > when > >> the middlebox prevents authenticated policy negotiation, to force > middlebox > >> upgrades. i know that "tough love" is a hard sell, but "assume 3552 > attack" is > >> also a form of tough love. > > > > > > Hi Paul, > > > > I think this response perhaps conflates two somewhat different issues, > > namely CNAME versus authenticated policy propagation. > > > > Ignoring the question of CNAME for the moment, if a device joins a > > network and gets its configuration from that network (e.g., via DHCP), > > then it is trusting that network to provide the configuration. So, the > > question then becomes what benefit is obtained if that network > > supplies a Do[TH] server rather than a Do53 server. In the 3552 model, > > we assume the attacker has complete control of the network and can > > therefore supply its own server, so it's not clear what the security > > benefit is. Conversely, if the network is totally secure and trusted, > > then it's *also* not clear what the security benefit is. > > > > So, if we are to have unauthenticated discovery of Do[TH] servers, > > then we must have some other threat model. For instance we might > > think that the attacker can read all packets but for some reason > > can't impersonate the DHCP server. What I'm saying is that we should > > start by laying out what that threat model is and then we can define > > what, if any, technical measures add security benefit in that threat > > model. That would be true even if we knew that there weren't > > middleboxes which tampered with new record types. > > >From RFC 3552, the threat model for unauthenticated discovery would be > passive attacks described in section 3.2. There is benefit to > upgrading from Do53 to Do[TH] even if the network between the client > and the DHCP server is secure - specifically when the DNS resolver is > further away on the network. This could be because the network > operator is running the DNS resolver further away (e.g. DHCP could be > on the home router for a typical home user) or the DNS resolver > specified by the ISP is operated by a third-party on a different > network. > Home networks are susceptible to both internal (ARP spoofing/poisoning) and external attacks (Evil twin, Dragonblood, Krack). Unfortunately typical home networks use shared WPA-PSK and both WPA2/WPA3 are susceptible to attacks. The attacker can be active or passive. -Tiru > > -Puneet > > > > > > > Two more points, if I may: > > > > 1. Where this interfaces with the question of CNAME versus RESINFO > > is that RESINFO is much more flexible, but (as above) it's not > > clear we can securely make use of this flexibility. > > > > 2. It's worth nothing that there are scenarios where the device > > can get authenticated network configuration (for instance, if > > the device is managed and has had some sort of authentication key > > installed). The comments above do not apply to this scenario > > but rather to the scenario where you have a naive device joining > > a network. > > > > -Ekr > > -- > > Add mailing list > > Add@ietf.org > > https://www.ietf.org/mailman/listinfo/add > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000c7910e05a9c4def5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sat, 4 Jul 2020 at 06:09, Puneet Sood = <puneets=3D40google.com@d= marc.ietf.org> wrote:
On Fri, Jun 26, 2020 at 8:48 PM Eri= c Rescorla <ekr@rtfm.c= om> wrote:
>
>
>
> On Fri, Jun 26, 2020 at 5:04 PM Paul Vixie <paul@redbarn.org> wrote:
>>
>> On Friday, 26 June 2020 22:08:05 UTC Eric Rescorla wrote:
>> > ... Other than inelegance, what's problematic about the C= NAME approach?
>>
>> inelegance is permanent, accretive, and earns compound interest. w= e ought not
>> dismiss inelegance as the basis for reluctance. inelegance is not = inevitable
>> nor is it automatically acceptable.
>>
>> > ...
>> >
>> > The scenario you seem to be interested in is one in which the= user joins
>> > the network and then learns that the associated Do53 resolver= supports DoH
>> > and then connects to it with whatever coordinates that resolv= er (or DHCP or
>> > whatever) provides. That clearly is not useful in the 3552 th= reat model
>> > which assumes that the attacker entirely controls the network= because the
>> > attacker can just send their own resolver coordinates. That i= sn't to say
>> > that there aren't more limited but still realistic threat= models where this
>> > would be useful, but I think you should start by describing t= hose.
>>
>> as we describe them, we should also describe their scale, their ag= e, and their
>> likely lifespan. the 3552 threat model, while it does use the term=
>> 'pervasive', is nowhere near as common as the SASE (secure= access service
>> edge) operations model, nor will it ever be. if apps who want to d= o their own
>> DNS treat any DoH failure as an attack, and start an arms race of = spy-vs-spy
>> bypass along the lines of Tor, that's going to feel problemati= c to any of us
>> whose privately owned securely operated edge networks have a local= -only DNS
>> policy.
>>
>> RESINFO could probably get better results by using TXT, because of= long tail
>> problems. but ultimately we have to pick a default assumption that= we can act
>> on when secure resolver discovery fails. "OMG it's a 3552= attack" is not the
>> only interpretation we could think of for this. it's entirely = possible that
>> the most engineering solution to the discovery problem is to fail = hard when
>> the middlebox prevents authenticated policy negotiation, to force = middlebox
>> upgrades. i know that "tough love" is a hard sell, but &= quot;assume 3552 attack" is
>> also a form of tough love.
>
>
> Hi Paul,
>
> I think this response perhaps conflates two somewhat different issues,=
> namely CNAME versus authenticated policy propagation.
>
> Ignoring the question of CNAME for the moment, if a device joins a
> network and gets its configuration from that network (e.g., via DHCP),=
> then it is trusting that network to provide the configuration. So, the=
> question then becomes what benefit is obtained if that network
> supplies a Do[TH] server rather than a Do53 server. In the 3552 model,=
> we assume the attacker has complete control of the network and can
> therefore supply its own server, so it's not clear what the securi= ty
> benefit is. Conversely, if the network is totally secure and trusted,<= br> > then it's *also* not clear what the security benefit is.
>
> So, if we are to have unauthenticated discovery of Do[TH] servers,
> then we must have some other threat model. For instance we might
> think that the attacker can read all packets but for some reason
> can't impersonate the DHCP server. What I'm saying is that we = should
> start by laying out what that threat model is and then we can define > what, if any, technical measures add security benefit in that threat > model. That would be true even if we knew that there weren't
> middleboxes which tampered with new record types.

>From RFC 3552, the threat model for unauthenticated discovery would be<= br> passive attacks described in section 3.2. There is benefit to
upgrading from Do53 to Do[TH] even if the network between the client
and the DHCP server is secure - specifically when the DNS resolver is
further away on the network. This could be because the network
operator is running the DNS resolver further away (e.g. DHCP could be
on the home router for a typical home user) or the DNS resolver
specified by the ISP is operated by a third-party on a different
network.

Home networks are susceptible = to both internal (ARP spoofing/poisoning) and external attacks (Evil twin,= =C2=A0Dragonblood, Krack). Unfortunately typical=C2=A0home = networks use shared WPA-PSK and both WPA2/WPA3 are susceptible to attacks. = The attacker can be active or passive.=C2=A0

-Tiru=
=C2=A0

-Puneet

>
>
> Two more points, if I may:
>
> 1. Where this interfaces with the question of CNAME versus RESINFO
> is that RESINFO is much more flexible, but (as above) it's not
> clear we can securely make use of this flexibility.
>
> 2. It's worth nothing that there are scenarios where the device > can get authenticated network configuration (for instance, if
> the device is managed and has had some sort of authentication key
> installed). The comments above do not apply to this scenario
> but rather to the scenario where you have a naive device joining
> a network.
>
> -Ekr
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000c7910e05a9c4def5-- From nobody Mon Jul 13 13:26:18 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 219633A09D6 for ; Mon, 13 Jul 2020 13:26:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O6bL2s8aCuKw for ; Mon, 13 Jul 2020 13:26:11 -0700 (PDT) Received: from mail-vk1-xa29.google.com (mail-vk1-xa29.google.com [IPv6:2607:f8b0:4864:20::a29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF4DB3A099E for ; Mon, 13 Jul 2020 13:26:10 -0700 (PDT) Received: by mail-vk1-xa29.google.com with SMTP id m21so3143171vkp.1 for ; Mon, 13 Jul 2020 13:26:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=LYx5Ep0I/gPF/AsDZQTfDP+8Z5l3CD5bxjHpMBgZ61k=; b=WwdFrtd8hT99Su4yEiZe3YNIpFDwDZA+enV4wzEbC3+HON7xPCuwbEfeCpLOYVATNA gyVyelTQs3xHBTjY9DdR55p6cpXr4RbR7RmNnR8U3qth5VBvoC54+CVsvE69e+aFVTix 8pVeTspd7UMAJI670JlBgPiiNqBa/BbrRiMps= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=LYx5Ep0I/gPF/AsDZQTfDP+8Z5l3CD5bxjHpMBgZ61k=; b=lbsQYTRS8SFNiIDHmYTAIiI9ijQQr3BimvEiFnsFvv9u7b5TTaiLmhhByJwWwFwOGE YoVHyXlSLrCUyO52FuP80GPvoWRVnmVUUs00DvyDuWjh84U6XD36GTIj0mJw7qK6xONm jxtN3iqRpKDVfzYo8YyjCtwSFNRIT8O0BmADpNSvKNBeamQlVjCFwvQ80QcjfzfDxiGU J+puT7J6/c0w9WxyqBGO3CDCHm0iVfLl1ZJxWdvYH9hattrC82hkoGTjYZxYj203pNsX dmkRaoPv5Fnwi1pE6j+8qD4IL1Oh8qP+Z+8sklhgvl2XtbS2a1yuMo/ebctC+g1GtYeR u9Eg== X-Gm-Message-State: AOAM532xI7FqTjx2BVZ+cK+DgsbCdkk8GHzTJhRpwHndYu1sWcWIk3MG n200EYkQ1l9/FMmYe4599Gn7M31x7yd6CAhuPCo1SgEvPqHf/A== X-Google-Smtp-Source: ABdhPJyHoqlMYck97F4aI4uV5wO/hfm9+XPn1Y1EcQFne1h16CgJC12znL7RKaC4ga89PfKtnaov/4z3KB6mlkNeuZo= X-Received: by 2002:a1f:5f49:: with SMTP id t70mr1278175vkb.19.1594671969293; Mon, 13 Jul 2020 13:26:09 -0700 (PDT) MIME-Version: 1.0 References: <159466897500.14799.423774862197475126@ietfa.amsl.com> In-Reply-To: <159466897500.14799.423774862197475126@ietfa.amsl.com> From: Nick Sullivan Date: Mon, 13 Jul 2020 13:25:53 -0700 Message-ID: To: add@ietf.org Cc: Jesse Kipp , David Schinazi Content-Type: multipart/alternative; boundary="00000000000043809205aa588045" Archived-At: Subject: [Add] Fwd: New Version Notification for draft-schinazi-httpbis-doh-preference-hints-02.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 20:26:17 -0000 --00000000000043809205aa588045 Content-Type: text/plain; charset="UTF-8" ADD Working Group, This is to inform you of a new submission of the doh-preference-hints document. This document was originally intended for the HTTPbis working group, but we were directed to the ADD group as a more appropriate venue to discuss it. Our intention is to put this document up for consideration to be adopted as a working group item. Nick, David, Jesse ---------- Forwarded message --------- From: Date: Mon, Jul 13, 2020 at 12:36 PM Subject: New Version Notification for draft-schinazi-httpbis-doh-preference-hints-02.txt To: Jesse Kipp , Nick Sullivan , David Schinazi A new version of I-D, draft-schinazi-httpbis-doh-preference-hints-02.txt has been successfully submitted by David Schinazi and posted to the IETF repository. Name: draft-schinazi-httpbis-doh-preference-hints Revision: 02 Title: DoH Preference Hints for HTTP Document date: 2020-07-13 Group: Individual Submission Pages: 8 URL: https://www.ietf.org/internet-drafts/draft-schinazi-httpbis-doh-preference-hints-02.txt Status: https://datatracker.ietf.org/doc/draft-schinazi-httpbis-doh-preference-hints/ Htmlized: https://tools.ietf.org/html/draft-schinazi-httpbis-doh-preference-hints-02 Htmlized: https://datatracker.ietf.org/doc/html/draft-schinazi-httpbis-doh-preference-hints Diff: https://www.ietf.org/rfcdiff?url2=draft-schinazi-httpbis-doh-preference-hints-02 Abstract: When using a publicly available DNS-over-HTTPS (DoH) server, some clients may suffer poor performance when the authoritative DNS server is located far from the DoH server. For example, a publicly available DoH server provided by a Content Delivery Network (CDN) should be able to resolve names hosted by that CDN with good performance but might take longer to resolve names provided by other CDNs, or might provide suboptimal results if that CDN is using DNS- based load balancing and returns different address records depending or where the DNS query originated from. This document attempts to lessen these issues by allowing the web server to indicate to the client which DoH server can best resolve its addresses. This document defines an HTTP header field that enables web host operators to inform user agents of the preferred DoH servers to use for subsequent DNS lookups for the host's domain. Discussion of this work is encouraged to happen on the ADD IETF mailing list add@ietf.org or on the GitHub repository which contains the draft: https://github.com/DavidSchinazi/draft-httpbis-doh- preference-hints. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --00000000000043809205aa588045 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
ADD Working Group,

This is to inform yo= u of a new submission of the=C2=A0doh-preference-hints document. This docum= ent was originally=C2=A0intended for the HTTPbis working group, but we were= directed to the ADD group as a more appropriate venue to discuss it. Our i= ntention is to put=C2=A0this document up for consideration to be adopted as= a working group item.

Nick, David, Jesse
=
------= ---- Forwarded message ---------
From: <internet-drafts@ietf.org>Date: Mon, Jul 13, 2020 at 12:36 PM
Subject: New Version Notification = for draft-schinazi-httpbis-doh-preference-hints-02.txt
To: Jesse Kipp &l= t;jkipp@cloudflare.com>, Nic= k Sullivan <nick@cloudflare.com>, David Schinazi <dsch= inazi.ietf@gmail.com>



A new version of I-D, draft-schinazi-httpbis-doh-preference-hints-02.txt has been successfully submitted by David Schinazi and posted to the
IETF repository.

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-schinazi-httpbis-doh-pr= eference-hints
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A002
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 DoH Preference Hints for HTTP
Document date:=C2=A0 2020-07-13
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 8
URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 https://www.ietf.org/internet-drafts/draf= t-schinazi-httpbis-doh-preference-hints-02.txt
Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/draft-schinazi-httpbis-d= oh-preference-hints/
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://tools.ietf.org/html/draft-schinazi-httpbis-doh-preferen= ce-hints-02
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/html/draft-schinazi-httpb= is-doh-preference-hints
Diff:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://www.ietf.org/rfcdiff?url2=3Ddraft-schin= azi-httpbis-doh-preference-hints-02

Abstract:
=C2=A0 =C2=A0When using a publicly available DNS-over-HTTPS (DoH) server, s= ome
=C2=A0 =C2=A0clients may suffer poor performance when the authoritative DNS= server
=C2=A0 =C2=A0is located far from the DoH server.=C2=A0 For example, a publi= cly
=C2=A0 =C2=A0available DoH server provided by a Content Delivery Network (C= DN)
=C2=A0 =C2=A0should be able to resolve names hosted by that CDN with good =C2=A0 =C2=A0performance but might take longer to resolve names provided by= other
=C2=A0 =C2=A0CDNs, or might provide suboptimal results if that CDN is using= DNS-
=C2=A0 =C2=A0based load balancing and returns different address records dep= ending
=C2=A0 =C2=A0or where the DNS query originated from.=C2=A0 This document at= tempts to
=C2=A0 =C2=A0lessen these issues by allowing the web server to indicate to = the
=C2=A0 =C2=A0client which DoH server can best resolve its addresses.=C2=A0 = This
=C2=A0 =C2=A0document defines an HTTP header field that enables web host op= erators
=C2=A0 =C2=A0to inform user agents of the preferred DoH servers to use for<= br> =C2=A0 =C2=A0subsequent DNS lookups for the host's domain.

=C2=A0 =C2=A0Discussion of this work is encouraged to happen on the ADD IET= F
=C2=A0 =C2=A0mailing list add@ietf.org or on the GitHub repository which contains
=C2=A0 =C2=A0the draft: https://github.com/DavidS= chinazi/draft-httpbis-doh-
=C2=A0 =C2=A0preference-hints.




Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat


--00000000000043809205aa588045-- From nobody Mon Jul 13 14:14:01 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 934E93A0DFA for ; Mon, 13 Jul 2020 14:13:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.12 X-Spam-Level: X-Spam-Status: No, score=-2.12 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=apple.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LKYLt4cK6Zxi for ; Mon, 13 Jul 2020 14:13:53 -0700 (PDT) Received: from ma1-aaemail-dr-lapp02.apple.com (ma1-aaemail-dr-lapp02.apple.com [17.171.2.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 705F43A1014 for ; Mon, 13 Jul 2020 14:13:11 -0700 (PDT) Received: from pps.filterd (ma1-aaemail-dr-lapp02.apple.com [127.0.0.1]) by ma1-aaemail-dr-lapp02.apple.com (8.16.0.42/8.16.0.42) with SMTP id 06DL8fGT059646 for ; Mon, 13 Jul 2020 14:13:10 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apple.com; h=from : content-type : mime-version : subject : message-id : references : to : date; s=20180706; bh=rGKPjFTDlRpOgY7VIf9YXRQVExYyRANf9oXRLwV17tw=; b=K4mZ/jdthTsTX4N5Dw9uNq9MLppOGeK/VAfQaRK30FOHJ1oC/nxTC1wguZ/Nth3BHjEH JXcG2nW9gdvgwF+bUzg3qE4rlOXvgtThEMrEmmYfGioxBjIvxWHrkqwHb1ahcfQOuAUq sUaDrV04aOoR/8fbzgWZ23pIkyfjzD/ixSYiTFFAtoHsxo/F6gM4wm7xn333PTR1wx9g HbvhzXeG9cErhx2P1OVNBN9awcmbDCw2N9Mfb997D6PeTShaqBeU7YiQ6PWccYb8y7Rx n6YhMCWGCDYTMjQJuz+lBxSiIvkYbZtefO8ub9lhgtzFgDOx/lwaba1CdfEb7FusTvJV 8g== Received: from rn-mailsvcp-mta-lapp03.rno.apple.com (rn-mailsvcp-mta-lapp03.rno.apple.com [10.225.203.151]) by ma1-aaemail-dr-lapp02.apple.com with ESMTP id 328xhvrqtm-18 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO) for ; Mon, 13 Jul 2020 14:13:10 -0700 Received: from rn-mailsvcp-mmp-lapp02.rno.apple.com (rn-mailsvcp-mmp-lapp02.rno.apple.com [17.179.253.15]) by rn-mailsvcp-mta-lapp03.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPS id <0QDF00LWNEXW2KM0@rn-mailsvcp-mta-lapp03.rno.apple.com> for add@ietf.org; Mon, 13 Jul 2020 14:13:08 -0700 (PDT) Received: from process_milters-daemon.rn-mailsvcp-mmp-lapp02.rno.apple.com by rn-mailsvcp-mmp-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) id <0QDF00Z00E50X800@rn-mailsvcp-mmp-lapp02.rno.apple.com> for add@ietf.org; Mon, 13 Jul 2020 14:13:08 -0700 (PDT) X-Va-A: X-Va-T-CD: 5daaeb935bbe0e8d25090cf6b04f92b4 X-Va-E-CD: 268537a7c2a7d64975c1c36d84736c64 X-Va-R-CD: f3bd3991f080ec4f33965454a685ecd1 X-Va-CD: 0 X-Va-ID: 4a19f92c-c9ac-4dd3-b7c3-4100ec34f000 X-V-A: X-V-T-CD: 5daaeb935bbe0e8d25090cf6b04f92b4 X-V-E-CD: 268537a7c2a7d64975c1c36d84736c64 X-V-R-CD: f3bd3991f080ec4f33965454a685ecd1 X-V-CD: 0 X-V-ID: 411d632d-a164-499c-8005-d8024cf18e63 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-13_17:2020-07-13, 2020-07-13 signatures=0 Received: from [17.234.17.151] (unknown [17.234.17.151]) by rn-mailsvcp-mmp-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPSA id <0QDF009MGEXU4X00@rn-mailsvcp-mmp-lapp02.rno.apple.com> for add@ietf.org; Mon, 13 Jul 2020 14:13:06 -0700 (PDT) From: Tommy Pauly Content-type: multipart/alternative; boundary="Apple-Mail=_A96AC239-1116-46E7-B7AC-3608956A9BD9" MIME-version: 1.0 (Mac OS X Mail 13.4 \(3608.80.7.2.3\)) Message-id: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> To: ADD Mailing list Date: Mon, 13 Jul 2020 14:13:06 -0700 X-Mailer: Apple Mail (2.3608.80.7.2.3) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-13_17:2020-07-13, 2020-07-13 signatures=0 Archived-At: Subject: [Add] Fwd: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 21:13:58 -0000 --Apple-Mail=_A96AC239-1116-46E7-B7AC-3608956A9BD9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hello ADD, We=E2=80=99ve published a revision of = draft-pauly-add-resolver-discovery. This revision incorporates various = pieces of feedback we=E2=80=99ve received. Specifically, the changes = include: - Aligning with the current version of SCVB/HTTPS records - Improvements to how to upgrade a local resolver to a DoH resolver=20 - Clarification of expiration and TTL of resolver designation - An appendix describing the choice of using SVCB records for = designation, as opposed to other record types or approaches that only = provide hints in HTTP responses We can share details on these changes at the upcoming IETF 108 meeting. = We=E2=80=99d like to also start considering how this work can progress = as an item for the working group. Best, Tommy > Begin forwarded message: >=20 > From: internet-drafts@ietf.org > Subject: New Version Notification for = draft-pauly-add-resolver-discovery-01.txt > Date: July 13, 2020 at 1:21:32 PM PDT > To: "Christopher A. Wood" , Christopher Wood = , Tommy Jensen , Tommy Pauly = , Eric Kinnear , Patrick McManus = >=20 >=20 > A new version of I-D, draft-pauly-add-resolver-discovery-01.txt > has been successfully submitted by Tommy Pauly and posted to the > IETF repository. >=20 > Name: draft-pauly-add-resolver-discovery > Revision: 01 > Title: Adaptive DNS Resolver Discovery > Document date: 2020-07-13 > Group: Individual Submission > Pages: 17 > URL: = https://www.ietf.org/internet-drafts/draft-pauly-add-resolver-discovery-01= .txt > Status: = https://datatracker.ietf.org/doc/draft-pauly-add-resolver-discovery/ > Htmlized: = https://tools.ietf.org/html/draft-pauly-add-resolver-discovery-01 > Htmlized: = https://datatracker.ietf.org/doc/html/draft-pauly-add-resolver-discovery > Diff: = https://www.ietf.org/rfcdiff?url2=3Ddraft-pauly-add-resolver-discovery-01 >=20 > Abstract: > This document defines a method for dynamically discovering resolvers > that support encrypted transports, and introduces the concept of > designating a resolver to be used for a subset of client queries > based on domain. This method is intended to work both for locally- > hosted resolvers and resolvers accessible over the broader Internet. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > The IETF Secretariat >=20 >=20 --Apple-Mail=_A96AC239-1116-46E7-B7AC-3608956A9BD9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hello= ADD,

We=E2=80=99ve = published a revision of draft-pauly-add-resolver-discovery. This = revision incorporates various pieces of feedback we=E2=80=99ve received. = Specifically, the changes include:

- Aligning with the current version of = SCVB/HTTPS records
- Improvements to how to upgrade = a local resolver to a DoH resolver 
- = Clarification of expiration and TTL of resolver designation
- An appendix describing the choice of using SVCB records for = designation, as opposed to other record types or approaches that only = provide hints in HTTP responses

We can share details on these changes = at the upcoming IETF 108 meeting. We=E2=80=99d like to also start = considering how this work can progress as an item for the working = group.

Best,
Tommy


Begin forwarded message:

From: = internet-drafts@ietf.org
Subject: = New Version = Notification for draft-pauly-add-resolver-discovery-01.txt
Date: = July 13, 2020 at 1:21:32 PM = PDT
To: = "Christopher A. Wood" <caw@heapingbits.net>, Christopher Wood <caw@heapingbits.net>, Tommy Jensen <tojens@microsoft.com>, Tommy Pauly <tpauly@apple.com>, = Eric Kinnear <ekinnear@apple.com>, Patrick McManus <mcmanus@ducksong.com>


A new version = of I-D, draft-pauly-add-resolver-discovery-01.txt
has been = successfully submitted by Tommy Pauly and posted to the
IETF= repository.

Name: = draft-pauly-add-resolver-discovery
Revision: 01
Title:= = Adaptive DNS Resolver Discovery
Document date: = 2020-07-13
Group: Individual Submission
Pages:= = 17
URL: =            https://www.ietf.org/internet-drafts/draft-pauly-add-resolver-d= iscovery-01.txt
Status: =         https://datatracker.ietf.org/doc/draft-pauly-add-resolver-disco= very/
Htmlized:       https://tools.ietf.org/html/draft-pauly-add-resolver-discovery-= 01
Htmlized:       https://datatracker.ietf.org/doc/html/draft-pauly-add-resolver-= discovery
Diff: =           https://www.ietf.org/rfcdiff?url2=3Ddraft-pauly-add-resolver-di= scovery-01

Abstract:
=   This document defines a method for dynamically discovering = resolvers
  that support encrypted transports, = and introduces the concept of
  designating a = resolver to be used for a subset of client queries
=   based on domain.  This method is intended to work both = for locally-
  hosted resolvers and resolvers = accessible over the broader Internet.




Please note that it may take a = couple of minutes from the time of submission
until the = htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat



= --Apple-Mail=_A96AC239-1116-46E7-B7AC-3608956A9BD9-- From nobody Wed Jul 15 05:12:35 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1DEC33A0CB3; Wed, 15 Jul 2020 05:12:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.118 X-Spam-Level: X-Spam-Status: No, score=-2.118 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=orange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QulceUjLmz0z; Wed, 15 Jul 2020 05:12:31 -0700 (PDT) Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.70.35]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AD533A0CB1; Wed, 15 Jul 2020 05:12:31 -0700 (PDT) Received: from opfednr04.francetelecom.fr (unknown [xx.xx.xx.68]) by opfednr26.francetelecom.fr (ESMTP service) with ESMTP id 4B6GV52RJ0z10Bf; Wed, 15 Jul 2020 14:12:29 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.com; s=ORANGE001; t=1594815149; bh=gMSQzGlFyNKePjps3QP+0cBY1Yk2BTfb4iQos5wYYFQ=; h=From:To:Subject:Date:Message-ID:Content-Type: Content-Transfer-Encoding:MIME-Version; b=DZDRCqeo6Zzd2HYdKqI1Fb20SqT0fm6zGDLSqyJ2DNNfqElqYm9fVfdMFvhxnqP2k rn2nERQEd/oTEhkQCeWgOIdG0c8Y9iYrAQ+xyqelJiAvXo8N2WjtvZh+P88dpLv53L QIFbR4I2rp5PAOBj6U4mtshTybZr1WESSHfBfikRUuBj7UvyqhEDhIo1f+wIivEaah rUgm4PfKEeX+WFschD6DL1h+BADFcj7bE1i53zYi0Bi/tKEwYtsYalLgZNJiqsERZ2 tE/mXM9Z7t7jFa9dirHNp/+hAzeXk21/K9BWNJMJ5q2Ws1whIYgQfQywV3KLjPndNo coCfBiSg/Oaug== Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.35]) by opfednr04.francetelecom.fr (ESMTP service) with ESMTP id 4B6GV51cMGz1xpQ; Wed, 15 Jul 2020 14:12:29 +0200 (CEST) From: To: "ADD Mailing list (add@ietf.org)" CC: "draft-btw-add-home@ietf.org" Thread-Topic: I-D Action: draft-btw-add-home-07.txt Thread-Index: AQHWVsI76EVwG9FOH0ya/1cJMf8QgakIk6MQ Date: Wed, 15 Jul 2020 12:12:28 +0000 Message-ID: <23877_1594815149_5F0EF2AD_23877_384_1_787AE7BB302AE849A7480A190F8B9330314F9783@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> References: <159438950508.10283.6338787113671554159@ietfa.amsl.com> In-Reply-To: <159438950508.10283.6338787113671554159@ietfa.amsl.com> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.114.13.247] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Add] TR: I-D Action: draft-btw-add-home-07.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2020 12:12:34 -0000 Hi all,=20 We submitted an updated version of this spec with the following main change= s: * use the well-known URI to learn the supported services from the DHCP/RA d= iscovered servers.=20 * clarify that DHCP/RA discovered ADN takes precedence over special-use dom= ain name. * add a discussion to the Security Considerations section to cover some int= ernal attacks.=20 Cheers, Med -----Message d'origine----- De=A0: I-D-Announce [mailto:i-d-announce-bounces@ietf.org] De la part de in= ternet-drafts@ietf.org Envoy=E9=A0: vendredi 10 juillet 2020 15:58 =C0=A0: i-d-announce@ietf.org Objet=A0: I-D Action: draft-btw-add-home-07.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. Title : Encrypted DNS Discovery and Deployment Considerat= ions for Home Networks Authors : Mohamed Boucadair Tirumaleswar Reddy Dan Wing Neil Cook Filename : draft-btw-add-home-07.txt Pages : 25 Date : 2020-07-10 Abstract: This document discusses DoT/DoH deployment considerations for home networks. It particularly sketches the required steps to use DoT/DoH capabilities provided by local networks. The document specifies new DHCP and Router Advertisement Options to convey a DNS Authentication Domain Name. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-btw-add-home/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-btw-add-home-07 https://datatracker.ietf.org/doc/html/draft-btw-add-home-07 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=3Ddraft-btw-add-home-07 Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ I-D-Announce mailing list I-D-Announce@ietf.org https://www.ietf.org/mailman/listinfo/i-d-announce Internet-Draft directories: http://www.ietf.org/shadow.html or ftp://ftp.ie= tf.org/ietf/1shadow-sites.txt ___________________________________________________________________________= ______________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confiden= tielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu= ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages el= ectroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou = falsifie. Merci. This message and its attachments may contain confidential or privileged inf= ormation that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and dele= te this message and its attachments. As emails may be altered, Orange is not liable for messages that have been = modified, changed or falsified. Thank you. From nobody Wed Jul 15 10:01:02 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 48FD83A0D06 for ; Wed, 15 Jul 2020 10:01:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SPFR9OEUqZNM for ; Wed, 15 Jul 2020 10:00:58 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100056.outbound.protection.outlook.com [40.107.10.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2BF013A0D34 for ; Wed, 15 Jul 2020 10:00:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kwFzCc0kIqjIgK/ic+IKHhURtvJDhBsuwcP0FcSGSVUoOk2XKI//eCqN9q8EIeO0tm79ziZE0RliJVpAUjTZMzKsS2YgR7qDJ/2OaJ2xqJBlRBCbZLICTJppUauQQIG5cJjZOwsu4/G0WzOjMvqLtmMGvqMg6QvAkXv7yadK48yUZMif3h4L+D7caFW4yyGz4PvXugydZbJijIZFkahYB9S9dp+aFQ+WuYjtjNYoSQ+oATQMy1/cigmswAZsgoEwXFbG/Q2sKYQWIOdIP6H+ULKAXpS9GRtDGsNlSrb4qgJVoQifw4WMZSzzRWLWEZEUwp3K2Ko6nLqa6oT9tkTEYw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=AoAGUN4zJQ8d+aTUVG88+nIR9Bousea9dz0uUcuNDA4=; b=SbQC5U4DzfOMGZK9GJjG5MCzeYrTfVqj2LLfDgWrKf3L3mT/GYr59my8zZQR/qVN3ZD7tOkf6x1i4lEKu9N07zhHQlXpJTALrPkdDGrQhO618PuZU1TRYwAgAVOi9czPEl+lEfS67QQv9blbag1G1A9re1PAZrty4GQ5DUZyRLjpKX9nPVbGh7gKkc+pFQuOfPDYndDpTwYMgCIoY23ZAmuOvtnQt6cWPBtFO8LnKPTT9CQ6OfIqMC/Bl5bhpOM3oxxkkBvENVEx/b4P7auc6uBbekaH1lhEgPSwrpkpTYlLCE85Xaojg9HvUBEOc3U+qJRfnY/SvqCCgrDUlRC0Tg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=AoAGUN4zJQ8d+aTUVG88+nIR9Bousea9dz0uUcuNDA4=; b=dEHNME6dAxLHGf/odUxldsYyXeNnMq9uwKmmQsAbppRyKLztpA70EZG/NHyHFBfIpqou7IdfTUVP8Ug2Qt3sPJgjJTLoFksUvo75NzVd8OuIe3ju1TQ+tHphz1wG7DHWtM7U8vpBI6sPYZKqq2yu8lx1SXIQIlMx4dWVQk+YOKE= Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:71::15) by LOYP265MB1823.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:ec::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3174.22; Wed, 15 Jul 2020 16:59:57 +0000 Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6]) by LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6%6]) with mapi id 15.20.3174.026; Wed, 15 Jul 2020 16:59:57 +0000 From: Andrew Campling To: ADD Mailing list , "ENCRYPTED-DNS@LISTS.ENCRYPTED-DNS.ORG" CC: Normen Kowalewski , "Scalone, Gianpaolo Angelo, Vodafone Italy" , "Box,C,Chris,TLW1 R" , "Winfield, Alister" Thread-Topic: Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AdZaxbCvio8C5rmPSDClDuXJa16fuA== Date: Wed, 15 Jul 2020 16:59:57 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:3d80:bdc3:2331:99bf] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 62f5a082-d1ce-4f9d-b768-08d828e0811b x-ms-traffictypediagnostic: LOYP265MB1823: x-ld-processed: 9c2ced3e-7522-4755-87dc-f983abc66ec3,ExtAddr x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:5516; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: ndaVzEWqB+j+eLcwEhLGuRcxPrX+gx62zQWg7CIEE3L0PwOlt3zSTwpM2tcm84YwDllnOUIYeCJbHgsY0eJH/d/pBbIN0F3GkH/aFpdA6/TfWOdOJ4wMjPktJUkAUpqlbckGI3vk7SGeZe8tWlNQuTS4o+SoaMLun2zL9yYofrCZnISmhJX2QkZfVkRKrW+x0C6Fi6DMIj57fT4UjI1BGbO3lV8JsnJSLLZhGx/u9sUM87hGqgEnmfUgVONEXfNYkWVADfWRkuTtN6Pv2vAGw5OiKYTfSppaayb6sxSW9iU4kG0ix0T4yFsjxqHZF8YFTziEmEUYqWyFkYrs0F1XTrj7yrN3KUDN3nbhYQLYgx5AJuan9WFGLbUOcLxZhVso x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFTY:; SFS:(136003)(396003)(346002)(39830400003)(366004)(376002)(316002)(110136005)(83380400001)(54906003)(66574015)(52536014)(5660300002)(2906002)(66556008)(7696005)(186003)(76116006)(66946007)(66476007)(64756008)(33656002)(71200400001)(6506007)(8936002)(966005)(4326008)(66446008)(8676002)(86362001)(508600001)(30864003)(55016002)(9686003)(44832011)(46492007); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: 80YdRwczvTkvmg8cXi7L3J9JvcXK7Nf4SoyIewyx9RsX4LaKXy/8HFhIOU4qbqLnJmUtMM/vXR4yVi/y/17SMEav7GJJj2meNWMQXag/LymIxL0uTKy/rPbKg6vDu7fQVQDJGP8OqKmPpHBniDw3wKiCiTA8NCbflqtL8xfRQdqoDw/mLXc2hFC7CNgz9sP67hyen9Zc0TSkEm3pwzxQ1r201wGmWnd3t9l+Hyg8XlsEmi+ebhy9GMMbRDcL3y45Sy/fIYdn+9t046VcS590tiWNnQWMJLPunYlf5088QDCZsDn/I8SzH+mP5cLatqsK7QMCCCHk5Ro3cBgDEDAyETz5RUwfhUYKlzG7IODolIYSAQv1w/USzQlspnbIR2cLPmUtbiKitIOaUXgWqff7YbT2LMV5S4EJbntrpepRvm6+D7DVPON+axo4sE7n2rgRFfjFNnmvemQSABIUeDwma6smn+TRiRdO5P6ou9eSA/Md7YJi5F77kqXBTMXY5HH9LlJ6Goz+Yo767CURiWCvpSMxOpeXWGlKhKuMVwSxyDQ= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_LO2P265MB0573E407D5384A82FA96D094C27E0LO2P265MB0573GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 62f5a082-d1ce-4f9d-b768-08d828e0811b X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Jul 2020 16:59:57.6198 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: V96DCxpKqGkHaQPnpGurjmnqIHNsHVLOUhxix1bFdg99xS99N0QIag88uzJ/vPk6CNmkqdeReJq59BcCLAHpsg8NEKDzKz8G93ugKKZkPo8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LOYP265MB1823 Archived-At: Subject: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2020 17:01:01 -0000 --_000_LO2P265MB0573E407D5384A82FA96D094C27E0LO2P265MB0573GBRP_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable ADD and EDDI Groups This is to let you know that a new I-D has been submitted for consideration= by the ADD WG that includes observations regarding a variety of implementa= tions of recursive DNS capabilities that are important to network operators= in terms of delivering DNS services to their customers. The document defi= nes problems that need technical solutions to allow the deployment of encry= pted DNS by the largest number of operators to the largest number of users = in the shortest possible timeframe with little or no disruption to the user= experience, ideally by clients using the "same provider auto-upgrade" appr= oach wherever possible. Name: draft-campling-operator-observations Revision: 00 Title: Practical Observations from Encrypted DNS Deploymen= ts by Network Operators Document date: 2020-07-13 Group: Individual Submission Pages: 9 URL: https://www.ietf.org/internet-drafts/draft-campling= -operator-observations-00.txt Status: https://datatracker.ietf.org/doc/draft-campling-ope= rator-observations/ Htmlized: https://tools.ietf.org/html/draft-campling-operator= -observations-00 Htmlized: https://datatracker.ietf.org/doc/html/draft-camplin= g-operator-observations We hope that the details in this document will aid the development of disco= very mechanisms for DNS resolvers including those using DoH. Discussion of= its content is encouraged on the IETF ADD mailing list add@ietf.org, especially concerning any contributions from additional net= work operators to make the content as fully representative as possible of t= he significant use cases globally. Andrew, Normen, Gianpaolo, Chris, Alister --_000_LO2P265MB0573E407D5384A82FA96D094C27E0LO2P265MB0573GBRP_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
ADD and EDDI Groups
This is to let you know that a new I-D has been submitted for consider= ation by the ADD WG that includes observations regarding a variety of imple= mentations of recursive DNS capabilities that are important to network oper= ators in terms of delivering DNS services to their customers.  The document defines problems that need = technical solutions to allow the deployment of encrypted DNS by the largest= number of operators to the largest number of users in the shortest possibl= e timeframe with little or no disruption to the user experience, ideally by clients using the “same provider a= uto-upgrade” approach wherever possible.
 <= /div>
Name:  &= nbsp;        draft-campling-operator-obs= ervations
Revision: &nb= sp;     00
Title:  =         Practical Observations from Encr= ypted DNS Deployments by Network Operators
Document date:&nbs= p; 2020-07-13
Group:  =         Individual Submission
Pages:  =         9
 <= /div>
We hope that the details in this document will aid the development of = discovery mechanisms for DNS resolvers including those using DoH.  Dis= cussion of its content is encouraged on the IETF ADD mailing list add@ietf.org= , especially concerning any contributions from additional network operators t= o make the content as fully representative as possible of the significant u= se cases globally. 
 <= /div>
 <= /div>
Andrew, Normen, Gianpaolo, Chris, Alister
 <= /div>
 <= /div>
 <= /div> --_000_LO2P265MB0573E407D5384A82FA96D094C27E0LO2P265MB0573GBRP_-- From nobody Wed Jul 15 15:24:16 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7876B3A0E8A for ; Wed, 15 Jul 2020 15:24:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WhryM7v8ywqn for ; Wed, 15 Jul 2020 15:24:12 -0700 (PDT) Received: from mail-wr1-x430.google.com (mail-wr1-x430.google.com [IPv6:2a00:1450:4864:20::430]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4AF663A0E79 for ; Wed, 15 Jul 2020 15:24:12 -0700 (PDT) Received: by mail-wr1-x430.google.com with SMTP id f7so4663493wrw.1 for ; Wed, 15 Jul 2020 15:24:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=CHDF0kPlZpHHBmX8GK1dWNOT8m6b2lqdYxz9cFFzRO4=; b=dRbtFZK0RG7xOgZJMhYXTyornGpjoUP2jvHD7gv/S9Q0Ov+ulXPruBz3/V2mZwloPN xY0e03SMTU1XU7jqSJd1twbKexl7Aq3Pz5zo6yJvmUKfwkpF9ishrDNnG42qhVKP4Ncg uIvRDeZvSbkI0/gJtVn8m0RH332jeER0lpcgWuP/oZ74PWYpXmoBnQ0DqwG9oI8OWpwi hkxG0DW+OVEI/NyF6lY3ttLNd+1PFQAsocmY5OlDHZGZ8L2TFypdrK6MRxGSUcEM29BO R+/9UgqYHuui8CTFlUpY6MEjSl92a0g8GmEf2LHzxMQCugNtL2VJ22arIt6P//D+RqFy wbpw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=CHDF0kPlZpHHBmX8GK1dWNOT8m6b2lqdYxz9cFFzRO4=; b=UUxD0r6Ieybvc2dzsyS5DxiYFzvWd+GpO+4cRFkg994hyCSW3th5giC3SEAycYht1r lRdFISAi5eTL7nOi2DGIqJZvxOd5/1ZsfomLg21xnyHbm7xNzPYxx3ziLqMdMdWAB4lg UX1YlPKSo/B+jjDKxO9YfFR2691FGrIPRipRM3mK1C0tnEF1UKoqBJ3l6Y+5Jbd2aQoX z6yRAisHsMuXESpoj3SAM4mDnEQ0R9TBVIOq9vnmyk48AzqbU6cLYpgSMQEGkkUYj50A y2Xx9r+bca42MfOjeYCcZ+0RpldHc/Q8laeH2LqQsqLGQCvyPIGccK2S3EegFgt+/8Q0 KJ3w== X-Gm-Message-State: AOAM533PgxSqSG/AyS8tLkDVys6jQksNdZFSkt/whWmyBGecmjOiHIQ+ xArThWmpnW1dtJIz/uUlkaC1Neq/qDDsrjZkGVnymA== X-Google-Smtp-Source: ABdhPJyQJuRGctf5YX4j9f7GKuOx5oOkWKmfZTB4lL4herU/NhXpPG8bGIO3pgW/07hU4fgqyEb+jHuvNTRfXIforfQ= X-Received: by 2002:a5d:6786:: with SMTP id v6mr1774880wru.258.1594851850282; Wed, 15 Jul 2020 15:24:10 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> In-Reply-To: From: Ben Schwartz Date: Wed, 15 Jul 2020 18:23:58 -0400 Message-ID: To: Tommy Pauly Cc: ADD Mailing list Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="00000000000009de7605aa826251" Archived-At: Subject: Re: [Add] Fwd: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2020 22:24:15 -0000 --00000000000009de7605aa826251 Content-Type: multipart/alternative; boundary="00000000000001c49505aa8262b8" --00000000000001c49505aa8262b8 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I don't claim to have understood this proposal in full (for starters, I'm not familiar with PvD), but it seems like a plausible direction to me. One small, but perhaps consequential suggestion: Instead of placing a "dohuri" SvcParamKey in the HTTPS record (Section 3.1), I think it would be better to put a domain name there (e.g. "resolver= =3D doh.example.net"). Then the client would do a SVCB query for "_ dns.doh.example.net", retrieving a SVCB record containing the DoH URI (as in Section 5). This adds a roundtrip, but I think it maintains better separation of concerns (e.g. server choice vs. protocol choice). If lookup latency is a problem, I think we could find an optional optimization to collapse this roundtrip (perhaps with a design much like the current draft)= . More generally, any use of SVCB requires a mapping document for the scheme. I'd be happy to help write a mapping document for dns:// -> _dns, if we decide to go in that direction. On Mon, Jul 13, 2020 at 5:16 PM Tommy Pauly wrote: > Hello ADD, > > We=E2=80=99ve published a revision of draft-pauly-add-resolver-discovery.= This > revision incorporates various pieces of feedback we=E2=80=99ve received. > Specifically, the changes include: > > - Aligning with the current version of SCVB/HTTPS records > - Improvements to how to upgrade a local resolver to a DoH resolver > - Clarification of expiration and TTL of resolver designation > - An appendix describing the choice of using SVCB records for designation= , > as opposed to other record types or approaches that only provide hints in > HTTP responses > > We can share details on these changes at the upcoming IETF 108 meeting. > We=E2=80=99d like to also start considering how this work can progress as= an item > for the working group. > > Best, > Tommy > > > Begin forwarded message: > > *From: *internet-drafts@ietf.org > *Subject: **New Version Notification for > draft-pauly-add-resolver-discovery-01.txt* > *Date: *July 13, 2020 at 1:21:32 PM PDT > *To: *"Christopher A. Wood" , Christopher Wood < > caw@heapingbits.net>, Tommy Jensen , Tommy Pauly < > tpauly@apple.com>, Eric Kinnear , Patrick McManus < > mcmanus@ducksong.com> > > > A new version of I-D, draft-pauly-add-resolver-discovery-01.txt > has been successfully submitted by Tommy Pauly and posted to the > IETF repository. > > Name: draft-pauly-add-resolver-discovery > Revision: 01 > Title: Adaptive DNS Resolver Discovery > Document date: 2020-07-13 > Group: Individual Submission > Pages: 17 > URL: > https://www.ietf.org/internet-drafts/draft-pauly-add-resolver-discovery-0= 1.txt > Status: > https://datatracker.ietf.org/doc/draft-pauly-add-resolver-discovery/ > Htmlized: > https://tools.ietf.org/html/draft-pauly-add-resolver-discovery-01 > Htmlized: > https://datatracker.ietf.org/doc/html/draft-pauly-add-resolver-discovery > Diff: > https://www.ietf.org/rfcdiff?url2=3Ddraft-pauly-add-resolver-discovery-01 > > Abstract: > This document defines a method for dynamically discovering resolvers > that support encrypted transports, and introduces the concept of > designating a resolver to be used for a subset of client queries > based on domain. This method is intended to work both for locally- > hosted resolvers and resolvers accessible over the broader Internet. > > > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > The IETF Secretariat > > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --00000000000001c49505aa8262b8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I don't claim to have understood this proposal in full= (for starters, I'm not familiar with PvD), but it seems like a plausib= le direction to me.=C2=A0 One small, but perhaps consequential suggestion:<= div>
Instead of placing a "dohuri" SvcParamKey in t= he HTTPS record (Section 3.1), I think it would be better to put a domain n= ame there (e.g. "resolver=3Ddoh.exa= mple.net").=C2=A0 Then the client would do a SVCB query for "= _dns.doh.example.net", retr= ieving a SVCB record containing the DoH URI (as in Section 5).=C2=A0 This a= dds a roundtrip, but I think it maintains better separation of concerns (e.= g. server choice vs. protocol choice).=C2=A0 If lookup latency is a problem= , I think we could find an optional optimization to collapse this roundtrip= (perhaps with a design much like the current draft).

<= div>More generally, any use of SVCB requires a mapping document for the sch= eme.=C2=A0 I'd be happy to help write a mapping document for dns:// -&g= t; _dns, if we decide to go in that direction.

On Mon, Jul 13, 2020 at= 5:16 PM Tommy Pauly <tpauly=3D40apple.com@dmarc.ietf.org> wrote:
= Hello ADD,

We=E2=80=99ve published a revision of=C2=A0dr= aft-pauly-add-resolver-discovery. This revision incorporates various pieces= of feedback we=E2=80=99ve received. Specifically, the changes include:

- Aligning with the current version of SCVB/HTTPS rec= ords
- Improvements to how to upgrade a local resolver to a DoH r= esolver=C2=A0
- Clarification of expiration and TTL of resolver d= esignation
- An appendix describing the choice of using SVCB reco= rds for designation, as opposed to other record types or approaches that on= ly provide hints in HTTP responses

We can share de= tails on these changes at the upcoming IETF 108 meeting. We=E2=80=99d like = to also start considering how this work can progress as an item for the wor= king group.

Best,
Tommy


Begin forwarded message:
Subject: New Version Notification for draft-pauly-add-reso= lver-discovery-01.txt
Date: Jul= y 13, 2020 at 1:21:32 PM PDT
To: &q= uot;Christopher A. Wood" <caw@heapingbits.net>, Christopher Wood <caw@heapingbits.net&g= t;, Tommy Jensen <tojens@microsoft.com>, Tommy Pauly <tpauly@apple.com>, Eric Kinnear <ekinnear@apple.com= >, Patrick McManus <mcmanus@ducksong.com>


A n= ew version of I-D, draft-pauly-add-resolver-discovery-01.txt
has been su= ccessfully submitted by Tommy Pauly and posted to the
IETF repository.
Name: draft-pauly-add-resolver-discovery
Revision: 01
Title: Adapt= ive DNS Resolver Discovery
Document date: 2020-07-13
Group: Individual Submission
P= ages: 17
URL: =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0https://www.ietf.= org/internet-drafts/draft-pauly-add-resolver-discovery-01.txt
Status= : =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0h= ttps://datatracker.ietf.org/doc/draft-pauly-add-resolver-discovery/
= Htmlized: =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://= tools.ietf.org/html/draft-pauly-add-resolver-discovery-01
Htmlized: = =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://dat= atracker.ietf.org/doc/html/draft-pauly-add-resolver-discovery
Diff: = =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://www.ietf.org/rfcdiff?url2=3Ddraft-pauly-add-resolver-= discovery-01

Abstract:
=C2=A0=C2=A0This document defines a m= ethod for dynamically discovering resolvers
=C2=A0=C2=A0that support en= crypted transports, and introduces the concept of
=C2=A0=C2=A0designati= ng a resolver to be used for a subset of client queries
=C2=A0=C2=A0bas= ed on domain.=C2=A0 This method is intended to work both for locally-
= =C2=A0=C2=A0hosted resolvers and resolvers accessible over the broader Inte= rnet.




Please note that it may take a couple of minutes f= rom the time of submission
until the htmlized version and diff are avail= able at tools.ietf.org<= /a>.

The IETF Secretariat


=
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--00000000000001c49505aa8262b8-- --00000000000009de7605aa826251 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIPBgYJKoZIhvcNAQcCoIIO9zCCDvMCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ggxpMIIEkjCCA3qgAwIBAgINAewckktV4F6Q7sAtGDANBgkqhkiG9w0BAQsFADBMMSAwHgYDVQQL ExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMK R2xvYmFsU2lnbjAeFw0xODA2MjAwMDAwMDBaFw0yODA2MjAwMDAwMDBaMEsxCzAJBgNVBAYTAkJF MRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSEwHwYDVQQDExhHbG9iYWxTaWduIFNNSU1FIENB IDIwMTgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUeobu8FdB5oJg6Fz6SFf8YsPI dNcq4rBSiSDAwqMNYbeTpRrINMBdWuPqVWaBX7WHYMsKQwCOvAF1b7rkD+ROo+CCTJo76EAY25Pp jt7TYP/PxoLesLQ+Ld088+BeyZg9pQaf0VK4tn23fOCWbFWoM8hdnF86Mqn6xB6nLsxJcz4CUGJG qAhC3iedFiCfZfsIp2RNyiUhzPAqalkrtD0bZQvCgi5aSNJseNyCysS1yA58OuxEyn2e9itZJE+O sUeD8VFgz+nAYI5r/dmFEXu5d9npLvTTrSJjrEmw2/ynKn6r6ONueZnCfo6uLmP1SSglhI/SN7dy L1rKUCU7R1MjAgMBAAGjggFyMIIBbjAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUH AwIGCCsGAQUFBwMEBggrBgEFBQcDCTASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRMtwWJ 1lPNI0Ci6A94GuRtXEzs0jAfBgNVHSMEGDAWgBSP8Et/qC5FJK5NUPpjmove4t0bvDA+BggrBgEF BQcBAQQyMDAwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjMw NgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9yb290LXIzLmNybDBn BgNVHSAEYDBeMAsGCSsGAQQBoDIBKDAMBgorBgEEAaAyASgKMEEGCSsGAQQBoDIBXzA0MDIGCCsG AQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG9w0B AQsFAAOCAQEAwREs1zjtnFIIWorsx5XejqZtqaq5pomEvpjM98ebexngUmd7hju2FpYvDvzcnoGu tjm0N3Sqj5vvwEgvDGB5CxDOBkDlmUT+ObRpKbP7eTafq0+BAhEd3z2tHFm3sKE15o9+KjY6O5bb M30BLgvKlLbLrDDyh8xigCPZDwVI7JVuWMeemVmNca/fidKqOVg7a16ptQUyT5hszqpj18MwD9U0 KHRcR1CfVa+3yjK0ELDS+UvTufoB9wp2BoozsqD0yc2VOcZ7SzcwOzomSFfqv7Vdj88EznDbdy4s fq6QvuNiUs8yW0Vb0foCVRNnSlb9T8//uJqQLHxrxy2j03cvtTCCA18wggJHoAMCAQICCwQAAAAA ASFYUwiiMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIz MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTA5MDMxODEwMDAw MFoXDTI5MDMxODEwMDAwMFowTDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzAR BgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDMJXaQeQZ4Ihb1wIO2hMoonv0FdhHFrYhy/EYCQ8eyip0EXyTLLkvhYIJG 4VKrDIFHcGzdZNHr9SyjD4I9DCuul9e2FIYQebs7E4B3jAjhSdJqYi8fXvqWaN+JJ5U4nwbXPsnL JlkNc96wyOkmDoMVxu9bi9IEYMpJpij2aTv2y8gokeWdimFXN6x0FNx04Druci8unPvQu7/1PQDh BjPogiuuU6Y6FnOM3UEOIDrAtKeh6bJPkC4yYOlXy7kEkmho5TgmYHWyn3f/kRTvriBJ/K1AFUjR AjFhGV64l++td7dkmnq/X8ET75ti+w1s4FRpFqkD2m7pg5NxdsZphYIXAgMBAAGjQjBAMA4GA1Ud DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSP8Et/qC5FJK5NUPpjmove4t0b vDANBgkqhkiG9w0BAQsFAAOCAQEAS0DbwFCq/sgM7/eWVEVJu5YACUGssxOGhigHM8pr5nS5ugAt rqQK0/Xx8Q+Kv3NnSoPHRHt44K9ubG8DKY4zOUXDjuS5V2yq/BKW7FPGLeQkbLmUY/vcU2hnVj6D uM81IcPJaP7O2sJTqsyQiunwXUaMld16WCgaLx3ezQA3QY/tRG3XUyiXfvNnBB4V14qWtNPeTCek TBtzc3b0F5nCH3oO4y0IrQocLP88q1UOD5F+NuvDV0m+4S4tfGCLw0FREyOdzvcya5QBqJnnLDMf Ojsl0oZAzjsshnjJYS8Uuu7bVW/fhO4FCU29KNhyztNiUGUe65KXgzHZs7XKR1g/XzCCBGwwggNU oAMCAQICEAH8qNflD4Mi9yKttXfRdHcwDQYJKoZIhvcNAQELBQAwSzELMAkGA1UEBhMCQkUxGTAX BgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExITAfBgNVBAMTGEdsb2JhbFNpZ24gU01JTUUgQ0EgMjAx ODAeFw0yMDA2MDUwODIyMjhaFw0yMDEyMDIwODIyMjhaMCIxIDAeBgkqhkiG9w0BCQEWEWJlbWFz Y0Bnb29nbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2kbyV9S0YLplF3kV 6t3GgD7IyHe8L29pJ7l+UR0Sj31uPgXOFdSSdTVwhPfQvxmB2OUDXWDgDtZdL2xu4DgHhrDyyOXT 8uDJqUCPw004ZSuUfUor1vz5u6+oYNfx2OTPTb81vtsQO2/khni3iAeQlKgO/rUI1c9+zvT6k3mR SZUypAlk/rCyG6NV7NMJMmOaU20/kPBXG297iP8+/F9w4xs+lyb3IkcSfoSUr3fVz7mYqESFato5 JnjRQGT2/f/ehxkc09jATqVGj9nyQMoD2GNPjiNnYyTVBwK5Ol/s9+E2VSL4TSLrgS2R07kY9zPi VOM3lhDDRnceboNSaqnfMwIDAQABo4IBczCCAW8wHAYDVR0RBBUwE4ERYmVtYXNjQGdvb2dsZS5j b20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNVHQ4E FgQUwJS1fB3cBxoLgZFatdIO9Vp5wOcwTAYDVR0gBEUwQzBBBgkrBgEEAaAyASgwNDAyBggrBgEF BQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wUQYIKwYBBQUHAQEE RTBDMEEGCCsGAQUFBzAChjVodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc3Nt aW1lY2EyMDE4LmNydDAfBgNVHSMEGDAWgBRMtwWJ1lPNI0Ci6A94GuRtXEzs0jA/BgNVHR8EODA2 MDSgMqAwhi5odHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2NhL2dzc21pbWVjYTIwMTguY3JsMA0G CSqGSIb3DQEBCwUAA4IBAQCC91PBn9rMxo8kSo1zNY2mxkTQDTVc0oyYk8s3y72y21IEp/d/+h1H VTCD2FR30aFUv8hTJkebJ5Z1/zue2L7sx/lLEOIHm9uYxyTkTWbKup3+XrE1vhODTHVx+ktMuOTY z447/fwjy4praSaFrQsOjTPbAoU6xuC8S2j2K2Yg6XQsctcKHKeAJjN6evZYChDaTBLmtYq9LTSH KVv3Et795vNK3gWKjhEkJtaBu4FfKLoopb1PENJ/zK6p/3edCLFgCRMSlbQ0SGtdVESSJcgezSwW WK2VB1Zcj2kyVzcL1pmV8m1xQuz2aBgUMn7peoVxKxYKP12gMtzeMvkzltYBMYICYTCCAl0CAQEw XzBLMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEhMB8GA1UEAxMYR2xv YmFsU2lnbiBTTUlNRSBDQSAyMDE4AhAB/KjX5Q+DIvcirbV30XR3MA0GCWCGSAFlAwQCAQUAoIHU MC8GCSqGSIb3DQEJBDEiBCDc3CSnti573iqfDATF1xBuDVO8XMJ6qZabqGo+3zIfhjAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA3MTUyMjI0MTBaMGkGCSqGSIb3 DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglghkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAE ggEAk/NlEKIkPLqBzZJyLO+6wNns6np9m12NwInKPhnzgadn6Pds/A+2k4ixsHkqOMQByD/O4hEk CNEXdm3S03gv/AyZ0w9LmJtlRNfATxxQ33Cgn+iYaB7dQ9ycD2bCT2glvu9RkvEImqJrVtPJ0HuO cEW//pbQbKzNWxx0Ugq2cNtnWR7celXkke/eqPnlzE5H/fPwA278z7Ir0qcK7JllE2qdOqc8xxBn DT4y5uO7LtlrGRl2nc/6/20DVyDyhK9HWUXUHkJ/sZxbJf5jep3R1zvMcxcMwBq/XOufySHy85Ss F8ohKTxW068B/NaaYnDcvrCKbiJgWFx2fD+f3GCRzQ== --00000000000009de7605aa826251-- From nobody Wed Jul 15 16:12:42 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A5A393A0B3E for ; Wed, 15 Jul 2020 16:12:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.12 X-Spam-Level: X-Spam-Status: No, score=-2.12 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=AdqjF2jT; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=Ouq06V2b Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pDnfY6cWg9Rh for ; Wed, 15 Jul 2020 16:12:40 -0700 (PDT) Received: from wout2-smtp.messagingengine.com (wout2-smtp.messagingengine.com [64.147.123.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 305033A0B3A for ; Wed, 15 Jul 2020 16:12:40 -0700 (PDT) Received: from compute2.internal (compute2.nyi.internal [10.202.2.42]) by mailout.west.internal (Postfix) with ESMTP id 52F4AAA4 for ; Wed, 15 Jul 2020 19:12:39 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute2.internal (MEProxy); Wed, 15 Jul 2020 19:12:39 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type:content-transfer-encoding; s=fm2; bh=vy8lL DRBDZJnt5clxT24Ym8hPZZHpd4LLrCYRauER24=; b=AdqjF2jTXSaQDhmQQ/tmU xvCW/1Z8qaHI9GYtp2GiJE96Pkln6YrLAXy5knu4Wu/lFvFctxb5eUVr0KNgpEHP Mnj3xkBjlmmgLRjgCVQAumNi72Xt6hRTCK8Lm0xteeVt8/NWN6wHeEu36rxg0i4q CuVvAblgc/4lghmEzth3lIOvOsWwNYRGHVDaE1uh1mIOlKIXTC69GHe5w/8wn18A KiZwcn6Ey2HGkNCU9v0Wxj3oXC5l3ipkQVa8ECZzn2kTdQTWOI72cTkkadY5/OkB LlCusBLOGjqRwuFJ/qpbXhVOXekkXq8OLwcYEHjpMan74EBtZh430xaUJFw1oZVg w== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm3; bh=vy8lLDRBDZJnt5clxT24Ym8hPZZHpd4LLrCYRauER 24=; b=Ouq06V2bE8gLs3DBcLUg0rkc/xTMNgUhooSIJQLozVd93KFSIAHw6/HDf U8TjLpnq86TvY0BgGtyEi+jCl2Wh0uvgyyBUJqvn6NAMrbLeZCGm7wG05sYbKyrs np/A2JIVheUcR7VaKs4ww2shBGBGqXFd/DsaGTjs3o/exLsYuqUoijGOliQY7NmW 3lQMQTLleirej+omublkZaOr776EWypdsw+/iNsNkUwhbPMvPReF8/rQ9z55zL/6 W2PV5Mcd2wd+UMlbxmI3xZ+WonOnb2OqZV+yKS7/9IgjsDUezOpEHq9Whx5XMWI6 pgOiA0uqnpnMGE5iqcDeqSne7ZJig== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduiedrfeefgddukecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgfgsehtqh ertderreejnecuhfhrohhmpedfofgrrhhtihhnucfvhhhomhhsohhnfdcuoehmtheslhho figvnhhtrhhophihrdhnvghtqeenucggtffrrghtthgvrhhnpefftefgvedvhfdtffehje dufefhhfevhedufefhgfelleetieefgeefgffgleehgfenucffohhmrghinhepihgvthhf rdhorhhgnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomh epmhhtsehlohifvghnthhrohhphidrnhgvth X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 86194E00DF; Wed, 15 Jul 2020 19:12:38 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.3.0-dev0-613-g8a73ad6-fm-20200709.001-g8a73ad6e Mime-Version: 1.0 Message-Id: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: References: Date: Thu, 16 Jul 2020 09:12:19 +1000 From: "Martin Thomson" To: add@ietf.org Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Add] =?utf-8?q?Practical_Observations_from_Encrypted_DNS_Deploy?= =?utf-8?q?ments_by_Network_Operators?= X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2020 23:12:42 -0000 Hi Andrew, Your draft seems to be making a case for supporting forwarders, but I'm = not clear on what supporting forwarders looks like. I understand that y= ou might not have specific ideas about what this support might look like= , but I don't see any real requirements here either. It would really help if the draft would clearly articulate what your des= ired outcome is. I note that SPAU - as described - only really operates when the forwarde= r has been cut out already. I don't believe that there are many CPE dev= ices that intercept traffic on UDP port 53 to do their work, but it isn'= t unthinkable. If there are, those are the only ones truly affected by = the described upgrade to encrypted transport. There is a SPAU upgrade path that might concern you more: Query using the default resolver for a name where the LHS labels are uni= que (and therefore unlikely to be cached anywhere) and the RHS labels id= entifies a zone under the control of the entity making the probe. The a= uthoritative puts the IP of the resolver that made the call in the answe= r. This probably won't be a recognizable address for the resolver, and = it almost certainly won't be a quad-N anycast address, but it will ident= ify the true resolver with fair accuracy. The client can then do a look= up and upgrade, cutting out any forwarder. (A variation on this has the= authoritative perform the lookup, which might be superior from a deploy= ment perspective as it centralizes the lookup tables.) Cheers, Martin On Thu, Jul 16, 2020, at 02:59, Andrew Campling wrote: > =20 > *ADD **and EDDI **Group**s* > This is to let you know that a new I-D has been submitted for=20 > consideration by the ADD WG that includes observations regarding a=20 > variety of implementations of recursive DNS capabilities that are=20 > important to network operators in terms of delivering DNS services to=20= > their customers. The document defines problems that need technical=20= > solutions to allow the deployment of encrypted DNS by the largest=20 > number of operators to the largest number of users in the shortest=20 > possible timeframe with little or no disruption to the user experience= ,=20 > ideally by clients using the =E2=80=9Csame provider auto-upgrade=E2=80= =9D approach=20 > wherever possible. > =20 > Name: draft-campling-operator-observations > Revision: 00 > Title: Practical Observations from Encrypted DNS Deployments=20= > by Network Operators > Document date: 2020-07-13 > Group: Individual Submission > Pages: 9 > URL: =20 > _https://www.ietf.org/internet-drafts/draft-campling-operator-observat= ions-00.txt_ > Status: =20 > _https://datatracker.ietf.org/doc/draft-campling-operator-observations= /_ > Htmlized: =20 > _https://tools.ietf.org/html/draft-campling-operator-observations-00_ > Htmlized: =20 > _https://datatracker.ietf.org/doc/html/draft-campling-operator-observa= tions_ > =20 > We hope that the details in this document will aid the development of=20= > discovery mechanisms for DNS resolvers including those using DoH. =20 > Discussion of its content is encouraged on the IETF ADD mailing list=20= > _add@ietf.org_, especially concerning any contributions from additiona= l=20 > network operators to make the content as fully representative as=20 > possible of the significant use cases globally. =20 > =20 > =20 > *Andrew**, Normen, G**ianpaolo, Chris, Alister * > =20 > =20 > =20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > From nobody Fri Jul 17 01:38:00 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EEE9F3A1571 for ; Fri, 17 Jul 2020 01:37:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YZLDIn8Wplka for ; Fri, 17 Jul 2020 01:37:57 -0700 (PDT) Received: from mx3.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 257DB3A156F for ; Fri, 17 Jul 2020 01:37:56 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx3.open-xchange.com (Postfix) with ESMTPS id 22B646A305; Fri, 17 Jul 2020 10:37:54 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1594975074; bh=htuqggdyidOFtbQKNEVZiOnqu55Hm/3y8HB3HqwCVgo=; h=Date:From:To:In-Reply-To:References:Subject:From; b=1DTN19qvGfxr3LfBt/Zp5mhfkBnRNc1GDnH2nwOjZFndguqDM6BmdLs9szW7JENbA +tF3yCfOZ8Rw3D8IbeueQFEbIu9OUzjEN/oR5hk8dcm/HddH/vLoxEmJcVuN6nMY1o crL1UowJMmZUI0mzk+QVkn5rg18AGtbqPNs4+Mf2KuEtvWr0KifRhEfj34HprGPQQn 7knCDQ8oX3QGewUPfqPsftUJFQ5DclC1+l26tR1JCWGCgR20yeA6biNp/r6uWzrPJD VOvzQsO7RJ8KSYqcc1Jwd9ZJqL7HtVa2rryeDfDuJKuDwxdv5O/k6x+mYQ2ZEJ+Z0m Frzx/1miqEeaQ== Received: from appsuite-gw2.open-xchange.com (appsuite-gw2.open-xchange.com [10.20.28.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 142663C0182; Fri, 17 Jul 2020 10:37:54 +0200 (CEST) Date: Fri, 17 Jul 2020 10:37:53 +0200 (CEST) From: Vittorio Bertola To: Martin Thomson , add@ietf.org Message-ID: <258496870.7542.1594975073986@appsuite-gw2.open-xchange.com> In-Reply-To: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev17 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jul 2020 08:37:59 -0000 > Il 16/07/2020 01:12 Martin Thomson ha scritto: > > > Hi Andrew, > > Your draft seems to be making a case for supporting forwarders, but I'm not clear on what supporting forwarders looks like. Possibly you should have a look at the companion draft: https://datatracker.ietf.org/doc/draft-cook-doh-discovery-trial/?include_text=1 It is a report about a possible trial that a set of ISPs would like to do. The mechanism is not so different from draft-resinfo (and could be brought in line with it) but it builds on the idea of pre-vetted lists of resolvers in browsers for additional security. It is meant to be immediately deployable as an opportunistic gain in security for ISP customers in Europe, and as an incentive for ISPs to deploy DoH, while something more general gets developed here. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Fri Jul 17 03:16:03 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 110613A0914 for ; Fri, 17 Jul 2020 03:15:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.82 X-Spam-Level: X-Spam-Status: No, score=-2.82 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9HY7dLGpbCbw for ; Fri, 17 Jul 2020 03:15:53 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D53A23A0893 for ; Fri, 17 Jul 2020 03:15:46 -0700 (PDT) Received: from capuchin.riseup.net (capuchin-pn.riseup.net [10.0.1.176]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "Sectigo RSA Domain Validation Secure Server CA" (not verified)) by mx1.riseup.net (Postfix) with ESMTPS id 4B7RpV1pLLzFdwN; Fri, 17 Jul 2020 03:15:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1594980946; bh=usg9pXGhXgDmJmKDqhdr79QdqviDkM6uAINfCjiy+ZY=; h=To:References:From:Cc:Subject:Date:In-Reply-To:From; b=RjIx7sP+cQ12NT+nvWua085lI9BX0c3Y24CiQ6QsCNtZvuxDY2XP5hFsQeDoDda0W 56Pls0hBhnRlyGXZ6093D7Lh84cdPmWtC7WBl+eV81GBYKCBc2WCLmCZD2BkWIJE3D K7UfxVVQA605dqffZerDvyIXV49X3I6QF1nMCR1k= X-Riseup-User-ID: CE92D6C54C0D28BE2BAD1AF2786EC8D62071A42894E2FABFBC7F22E7DBB481B1 Received: from [127.0.0.1] (localhost [127.0.0.1]) by capuchin.riseup.net (Postfix) with ESMTPSA id 4B7RpS626qz8sb3; Fri, 17 Jul 2020 03:15:42 -0700 (PDT) To: Alec Muffett References: From: nusenu Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= mQINBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABtCBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PokCVAQTAQgAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIe AQIXgBYhBJaQzx+7tCmFlU3yu61hOMJFzUJ+BQJevydnBQkGspdiAAoJEK1hOMJFzUJ+oh4P /R+cSCszon9qrG2JaUSEaDVOTTJ8idR7Q2QEzumD9QCmvBxxZaSd/l53Koebm6Y6DQ3/bw3D +SSy6vwvpWBpBMBI0MGDvNLUUUgW8FlPxOXYkPItdvjbLYcEjYCyOOXB63b2OUx3KAdPScwI FIvm2QAwILQf2BwrNglWoDVH9HKBGp8nkQg2co08/HxkJ/19CkXpEa3CGCV7yo059bIJr7+S OLxKlLiyzDRK7dyIN/wL+ZJwBORzQ7F8JiHGzIK5XAMeDe4ehnLDd1AaTvTDPGlaUlrFxvQd FjPCZXVWH1QFCWLveZI2cCkPW2Nbv0FtuqWhSyFpNX+Fyo46JDw2VqIdNmLdm1lxYnxNBLzp aefgzU6yYyPy1u5mAjm5llqzNpNmxbVyGSeBRbxXiR7RmP2PKiiQds2OmXhMa/fcEc2l4i63 lEOquOfnBbTmw5p8fdTeE4aIgv6eVR1O1sL+ZWQaqxR8ssfYIehYoxzMkLwDPyWfjLEK2rg9 ujH+3rHAraHYggcDgvsPNRQ7tM0iLtFB+/g5GbPQsRutZR4oxTujwglp+4BdFZZQZmR2ONSk g/k01IMToD/mDWP9KQQ5qqAO+97rsBoJAES40JxEV6PtHA55kUglGYdLV39CV0Iq6B9OF7jC dezf7e+LVK9NHpmxkQ1cxGv1KE2ElLTBLHfFuQINBFj53gUBEADAlnpTtRPy4HVYJ8srcA5H VZr1vM4CCGVNHhZdscHhqNAobv8XO5331ufAPRXf8A5XP9JsYPId77scy93UDQuXg2DIfo6n FjvA7AJcBhMBtxcukzt4pOOOxv0D1cbcVwga+NzLvo6Rp7CqGIAFpKGVK0Rhw+RG6wdm55xe 0Kd8KMkqKFT+SKdakE72BjpKsXYoULBp5LivftutdD3Ly7LeBnXrxAW4hrkAp8vSvlg3eThK 01IDanln+m59Zcw3cHTdAL7d+Kt6LPd2KeUcrpeNRbyhZJ03EmF7FP+VTD56mKw25ZNCu7Ls 8P4d6iFgZeqOCCY9SJZzXvVJ7BvZ/wcIdWIcx57xBeqj8tJGRhWu2zHQdRIwqxVA6Zr+7YHL Te5yugiRAlBB+pfdikrWLcSlQ7YvT+YTxSkG9SbW+uy3ngQXKbi1g0lOP2t5V98UqHZxzOY9 U3mjy/dGt1MX3qYa1xv0QlsZXjbvtkQupSym+IQFfKepTfJnjwmEhYePbb+FrpN4GlqlhkM4 nyV4953wTfgn8ZgTZheXrkuGlcAq9bM7cqIHIYzKxv0uLrOpn38FhC2DkIDpDw6jukHEriKI MfcZfZa/KaYuho4Gk5ohh28qvf19qMSbN9uDtN1kpfGqnYoOtvDu9QksPKuY9anEfKEoci3O iLVjn3DNhKreHQARAQABiQI8BBgBCAAmAhsMFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAl6/ J2sFCQayl2YACgkQrWE4wkXNQn5+RhAAkdSze4EXa+GHsdKqv+JSIgpflI0uT5SDxycGUyL2 p76AuHl7+P/tQK+4gzV0eRpdCuDfYI8BTDmaBXSA+acNofrhWtYC4VcgsxeqNjTzBJXCTgb+ /Y8ba0Z0ggDEfsH4TSOnt6yYLheVxy6OYddghg/woPnCiImz/Y7fhSiCRugG1N/+5euCevuy wWSmMLUuqGAxN9MHE2NUsWJMFdFRFT2jdFMusk+T+rwr2OB2bu7Vma0uweu2nG2lHB1QYUu5 llQXbkUPy9z5SUXvTWZQkMbeQigrAXpfO7Jov++TAelNAPY0hZQQ9Ou8wrLvZA7fLNB6Apgu Pdi2l9OkRMROsMNYuh0h2oQ6KCXx50HQ5sbaceFRkzk8g0KphPrLOsL2jZEk4nNdZxoL3nW9 2zWJfRbq8LfJktO4UP1MwIBrnoM9aj2ooBf8Vn0VKaacfJrd2iWjktDDOJigWIUEBCvJoxkF x5IFj8igcHVQgZumYqgg1FOF3vSozDAskASuqdb8Cv5mkfd+3KXYGEAHgW7hOJhJwBWwx0UC v+bXsPEQJsJ+atq5k4/Dox7sNdUxoaGSv3NmK+4uvmEdbIT/zGl1rTtHnfot8yEULF7Em2ia /qG+Sp2fbPeSxeHUqhLTu1jComXEZv59HnNhlcJeAxKFXoiAFCFV4XbKdVG2bKh434c= Cc: add@ietf.org Message-ID: Date: Fri, 17 Jul 2020 12:15:29 +0200 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="hHGzrrUgiCHxDc77LEv1v5gx5ov7sbKrf" Archived-At: Subject: Re: [Add] DoHoT - making & measuring practical use of DNS over HTTPS over Tor X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jul 2020 10:16:02 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --hHGzrrUgiCHxDc77LEv1v5gx5ov7sbKrf Content-Type: multipart/mixed; boundary="BaYLDqZ1DQu5z1fbU5Lbetb3wQ2TUzJUP"; protected-headers="v1" From: nusenu To: Alec Muffett Cc: add@ietf.org Message-ID: Subject: Re: [Add] DoHoT - making & measuring practical use of DNS over HTTPS over Tor References: In-Reply-To: --BaYLDqZ1DQu5z1fbU5Lbetb3wQ2TUzJUP Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Alec Muffett: > A little project of mine which may be of slight interest to folks here:= >=20 > - https://twitter.com/AlecMuffett/status/1278990840485097472 > - https://github.com/alecmuffett/dohot > - > https://medium.com/@alecmuffett/dohot-making-practical-use-of-dns-over-= https-over-tor-ef58d04ca06a. Thanks for sharing. I was eager to see DoH support in Tor Browser, unfortunately they are not planing to support it mainly due to latency concerns. [1] https://lists.torproject.org/pipermail/tor-dev/2020-July/014388.html and related to the thread "Support for full DNS resolution and DNSSEC val= idation" https://lists.torproject.org/pipermail/tor-dev/2020-May/thread.html https://lists.torproject.org/pipermail/tor-dev/2020-June/thread.html Nonetheless they are interested to see measurements in a Tor Browser setup (no caching across tabs to different domains to ma= intain first party isolation). as mentioned in [1] (at the bottom). http://qrmfuxwgyzk5jdjz.onion/projects/torbrowser/design/index.html.en#id= entifier-linkability so if you are interested to contributed that, that would be highly apprec= iated. --BaYLDqZ1DQu5z1fbU5Lbetb3wQ2TUzJUP-- --hHGzrrUgiCHxDc77LEv1v5gx5ov7sbKrf Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAl8RekQACgkQrWE4wkXN Qn4A/xAAjtCiV+iwoFUHjyZWYm7EeLK2ld0fDgfpodPCtbFLBlnO5+Mk1G0uDwJA eUBDWfIS2YL0tcvcrbMbMP/9pgOrbdKo8EditHRJKS508yInhHJRiV13987l3Sef CgYGAj2064ol+YmreO+Pr1iqHXim1fNcUETVzwkfpEhGB96Ix1jUVHxlxcAM8Fs3 C6nMwg0Xd60CpV4GBAkf3slerdVRUcW+LnBjEhvYUoD7axkcP65SJ/3KfKjikJcB 559H60UbUUw0wEUfk9Kw+NLy7LCxXXX3EFlGboK6S4QcVO1L3lSpHKAG37sF4epV or3MTRm5p1vhLtr6Vn+BLLHKyfZ3b2B/GFkcGQXMylXj4HgDPdtpLsAXnxvdqi23 oAwihKDxjwOF8a+a/8GxUooloWXv6EPN512jhqfR5r2gQDaBFEv/0OAgOf9o1f+D th7iC7ZZm9K2319NZAAnH+4UB0kTS8x35fYgwdibhj1bx2wZEb2ier7f5uNl2cas 3ZiihRXNqh6uBjX9BY+xe9mOWKuxaViGn2Sy9vYvZDCMNB3SYrlWXgMHJQll6xaw +nf4/BR0y50hLw1FCMfMMrG7Vtftr5U0Wbrxq3iIgwgR8MbdfCNlzQfLiK8QuMf5 a+IV+vHtFLVxp215TKvm60ECCWHpwDab82u1Q1EIpeIBe91XIt8= =FoHM -----END PGP SIGNATURE----- --hHGzrrUgiCHxDc77LEv1v5gx5ov7sbKrf-- From nobody Fri Jul 17 07:53:54 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B92C3A0C1C for ; Fri, 17 Jul 2020 07:53:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kg0_xrlibWKR for ; Fri, 17 Jul 2020 07:53:51 -0700 (PDT) Received: from mail-il1-x12a.google.com (mail-il1-x12a.google.com [IPv6:2607:f8b0:4864:20::12a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0ADFB3A0C1B for ; Fri, 17 Jul 2020 07:53:51 -0700 (PDT) Received: by mail-il1-x12a.google.com with SMTP id r12so7570324ilh.4 for ; Fri, 17 Jul 2020 07:53:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=nWUCfg0VMZICxcW3c1uZtUkJLExzSYQYIgv9GpziQBQ=; b=Yk+naYVjAx6UATD/dicwDo3bII7Wfw+VjDeuO28/bxCqh5yEmXExk4xvR7/tZve1H5 vtmYIVdnvOWB2OPhmoNQHSJJsdHOpzKevwC94G3MV0B2aiCJECChd2f5gM03zhgQi2Av mqbCFdqio4wmXbO7kg92ckaCin6qo0oPxzmJZ342pQ+LBfi1a7Q+xCggVffhtJ5HCPVf wMTHWTxTvxwrP26w0S884opXTV8lV885pBn71SXQa15ouQqZdRpD838EFj4KgHuPk/ZP idjqWEKmb6pk5Rgcdjzu3CL0w6QAARIlanc9gcnFD5hhkAK8qiL8PXWvMoD4yG6ADFvX WE1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=nWUCfg0VMZICxcW3c1uZtUkJLExzSYQYIgv9GpziQBQ=; b=Htxh45CjnO8eSH1lv8B5PmN0F51PoKXKB3o5mWwScFWHlHPcN1oPCmpyc7pJOGjuVS FIeuLeju2nHabJKCLOAKOiCjJGvJw9fsKPaGvvwiW8DPDRwLWGu8hmt3FguirCu3TMM+ gMvJNUdnt9IDpbx7rI6b4hdPxJ+nPyH1YaK/IKE1DAI3Et5Kfjboxc/2obyPDDeOt2Fi pKpfFYqXznrLWZhDBz8BkYaROvE7WfSl47aBKNpl8pKRZcKHusGkwOe9o/+MZYyX74qB WVVcA95NcpxZhytznpXORoNVZ54Mteb1+jdpG81zWzmmEHPJGYs1xncpfTk0Q95hgJp9 bkBg== X-Gm-Message-State: AOAM530j4qMrDlJ1R5WkPz+3gq00P3vt/KUFQTqaD0IeIofmoTjrqysX nWp9t/BDHDcaA7OgyI/Zc8gLB20cYGd8bPwy4lwvrN7y X-Google-Smtp-Source: ABdhPJzGHuojdXoYiASiN/2vmu+WtB6dwHUE/ZbJDSHyIwdiy0Ah+yE8iYYtbzt6uhpsHMx3+NakuqmXRRZE8f10OaE= X-Received: by 2002:a92:9fcb:: with SMTP id z72mr10188059ilk.195.1594997630183; Fri, 17 Jul 2020 07:53:50 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> From: tirumal reddy Date: Fri, 17 Jul 2020 20:23:39 +0530 Message-ID: To: Martin Thomson Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000002a393d05aaa4535c" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jul 2020 14:53:53 -0000 --0000000000002a393d05aaa4535c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Martin, Nowadays home routers are capable of running network security services. For example, DNS filtering to enforce MUD (https://tools.ietf.org/html/rfc8520) rules for IoT devices, blocking malware/phishing sites, parental control, anomaly detection etc. SPAU allows the ISP DoH/DoT resolver to enforce DNS filtering for the entire home but cannot enforce device level filtering, isolate infected devices, identify local attacks etc. Cheers, -Tiru On Thu, 16 Jul 2020 at 04:42, Martin Thomson wrote: > Hi Andrew, > > Your draft seems to be making a case for supporting forwarders, but I'm > not clear on what supporting forwarders looks like. I understand that yo= u > might not have specific ideas about what this support might look like, bu= t > I don't see any real requirements here either. > > It would really help if the draft would clearly articulate what your > desired outcome is. > > I note that SPAU - as described - only really operates when the forwarder > has been cut out already. I don't believe that there are many CPE device= s > that intercept traffic on UDP port 53 to do their work, but it isn't > unthinkable. If there are, those are the only ones truly affected by the > described upgrade to encrypted transport. > > There is a SPAU upgrade path that might concern you more: > > Query using the default resolver for a name where the LHS labels are > unique (and therefore unlikely to be cached anywhere) and the RHS labels > identifies a zone under the control of the entity making the probe. The > authoritative puts the IP of the resolver that made the call in the > answer. This probably won't be a recognizable address for the resolver, > and it almost certainly won't be a quad-N anycast address, but it will > identify the true resolver with fair accuracy. The client can then do a > lookup and upgrade, cutting out any forwarder. (A variation on this has > the authoritative perform the lookup, which might be superior from a > deployment perspective as it centralizes the lookup tables.) > > Cheers, > Martin > > > On Thu, Jul 16, 2020, at 02:59, Andrew Campling wrote: > > > > *ADD **and EDDI **Group**s* > > This is to let you know that a new I-D has been submitted for > > consideration by the ADD WG that includes observations regarding a > > variety of implementations of recursive DNS capabilities that are > > important to network operators in terms of delivering DNS services to > > their customers. The document defines problems that need technical > > solutions to allow the deployment of encrypted DNS by the largest > > number of operators to the largest number of users in the shortest > > possible timeframe with little or no disruption to the user experience, > > ideally by clients using the =E2=80=9Csame provider auto-upgrade=E2=80= =9D approach > > wherever possible. > > > > Name: draft-campling-operator-observations > > Revision: 00 > > Title: Practical Observations from Encrypted DNS Deployments > > by Network Operators > > Document date: 2020-07-13 > > Group: Individual Submission > > Pages: 9 > > URL: > > _ > https://www.ietf.org/internet-drafts/draft-campling-operator-observations= -00.txt_ > > Status: > > _https://datatracker.ietf.org/doc/draft-campling-operator-observations/= _ > > Htmlized: > > _https://tools.ietf.org/html/draft-campling-operator-observations-00_ > > Htmlized: > > _ > https://datatracker.ietf.org/doc/html/draft-campling-operator-observation= s_ > > > > We hope that the details in this document will aid the development of > > discovery mechanisms for DNS resolvers including those using DoH. > > Discussion of its content is encouraged on the IETF ADD mailing list > > _add@ietf.org_, especially concerning any contributions from additional > > network operators to make the content as fully representative as > > possible of the significant use cases globally. > > > > > > *Andrew**, Normen, G**ianpaolo, Chris, Alister * > > > > > > > > -- > > Add mailing list > > Add@ietf.org > > https://www.ietf.org/mailman/listinfo/add > > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000002a393d05aaa4535c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Martin,

Nowadays home rou= ters are capable of running network security services. For example, DNS fil= tering to enforce MUD (http= s://tools.ietf.org/html/rfc8520)=C2=A0rules for IoT devices,=20 blocking malware/phishing sites, parental control, anomaly detection etc.
=
SPAU allows the ISP DoH/DoT resolver to enforce DNS filterin= g for the entire home but cannot enforce device level filtering,=C2=A0isola= te infected devices, identify local attacks etc.

C= heers,
-Tiru

<= div dir=3D"ltr" class=3D"gmail_attr">On Thu, 16 Jul 2020 at 04:42, Martin T= homson <mt@lowentropy.net> w= rote:
Hi Andrew,=

Your draft seems to be making a case for supporting forwarders, but I'm= not clear on what supporting forwarders looks like.=C2=A0 I understand tha= t you might not have specific ideas about what this support might look like= , but I don't see any real requirements here either.

It would really help if the draft would clearly articulate what your desire= d outcome is.

I note that SPAU - as described - only really operates when the forwarder h= as been cut out already.=C2=A0 I don't believe that there are many CPE = devices that intercept traffic on UDP port 53 to do their work, but it isn&= #39;t unthinkable.=C2=A0 If there are, those are the only ones truly affect= ed by the described upgrade to encrypted transport.

There is a SPAU upgrade path that might concern you more:

Query using the default resolver for a name where the LHS labels are unique= (and therefore unlikely to be cached anywhere) and the RHS labels identifi= es a zone under the control of the entity making the probe.=C2=A0 The autho= ritative puts the IP of the resolver that made the call in the answer.=C2= =A0 This probably won't be a recognizable address for the resolver, and= it almost certainly won't be a quad-N anycast address, but it will ide= ntify the true resolver with fair accuracy.=C2=A0 The client can then do a = lookup and upgrade, cutting out any forwarder.=C2=A0 (A variation on this h= as the authoritative perform the lookup, which might be superior from a dep= loyment perspective as it centralizes the lookup tables.)

Cheers,
Martin


On Thu, Jul 16, 2020, at 02:59, Andrew Campling wrote:
>=C2=A0
> *ADD **and EDDI **Group**s*
> This is to let you know that a new I-D has been submitted for
> consideration by the ADD WG that includes observations regarding a > variety of implementations of recursive DNS capabilities that are
> important to network operators in terms of delivering DNS services to =
> their customers.=C2=A0 The document defines problems that need technic= al
> solutions to allow the deployment of encrypted DNS by the largest
> number of operators to the largest number of users in the shortest > possible timeframe with little or no disruption to the user experience= ,
> ideally by clients using the =E2=80=9Csame provider auto-upgrade=E2=80= =9D approach
> wherever possible.
>=C2=A0
> Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-campling-operator-= observations
> Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
> Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Practical Observations from E= ncrypted DNS Deployments
> by Network Operators
> Document date:=C2=A0 2020-07-13
> Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
> Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 9
> URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://www.i= etf.org/internet-drafts/draft-campling-operator-observations-00.txt_ > Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://datatracker.iet= f.org/doc/draft-campling-operator-observations/_
> Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://tools.ietf.org/htm= l/draft-campling-operator-observations-00_
> Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://datatracker= .ietf.org/doc/html/draft-campling-operator-observations_
>=C2=A0
> We hope that the details in this document will aid the development of =
> discovery mechanisms for DNS resolvers including those using DoH.=C2= =A0
> Discussion of its content is encouraged on the IETF ADD mailing list <= br> > _add@ietf.org_, especially concerning any contributions from additiona= l
> network operators to make the content as fully representative as
> possible of the significant use cases globally.=C2=A0
>=C2=A0
>=C2=A0
> *Andrew**, Normen, G**ianpaolo, Chris, Alister *
>=C2=A0
>=C2=A0
>=C2=A0
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
>

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000002a393d05aaa4535c-- From nobody Sun Jul 19 17:27:14 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E8333A0BF8 for ; Sun, 19 Jul 2020 17:27:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UvLOduNz0fDG for ; Sun, 19 Jul 2020 17:27:08 -0700 (PDT) Received: from mail-ot1-x32e.google.com (mail-ot1-x32e.google.com [IPv6:2607:f8b0:4864:20::32e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D40553A0BF3 for ; Sun, 19 Jul 2020 17:27:07 -0700 (PDT) Received: by mail-ot1-x32e.google.com with SMTP id 72so10904524otc.3 for ; Sun, 19 Jul 2020 17:27:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=3F2dBxvh3l1r2JrT2nPVzoo1PHtP/+M2qhw4zLbv4/g=; b=okCiQHajo7Ou7/4f6/a4utT6jAxVp4PrcQcj9o9y9E3nR1xSxUfZTiyh7HlInilGiS H8vaP32/KtkrPvzEzxp06fOKxMadn0vRk9PnXlb2sfBASuii7xkDiinqPAZ+TfyRNWJ/ 8zJ0LFGc9Fl4YIaH8JJO4npID1Y7wvdXpS7cBzYEqi6eEUjtO1WY3g9EdAv+9vUCT54M XZ2z046SpL672DHyXFJB9yYZmBjAwWplKK43V9WXPknPpAJAJoLVOuo5PkVFma5pE0oz B6uSvHuFtaAUfvSUoJBkSViDl4utLV+hU6Qu8PkNIPv7K1lRY05wiS7qODKpEzps2Gba TisQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=3F2dBxvh3l1r2JrT2nPVzoo1PHtP/+M2qhw4zLbv4/g=; b=qZZ7CvPNzD1VAgTvORjUfd5fbDs6HgcIKLqOdlLMMt6hjYY5YKu4Fpe+TTz4W/lnuF 2fZK5/azVrrCh9B5prHrtqvI/hV/PPwu3qEWHd0VS1wKCodjk+Wcug0Zwvuo3aFaC+9x CcuhcMBi/9/nJC99aLUVbYwO0W1Ozjcsmjta7mjaYTMEy9oJiXAWIO6nCnQ91btKKJgR pp5+fvnAgLHDUmtovaAmQcahs2DOGAyKfcs9JX2IMKCFgumTh4RT7bzP4wsVLmkEWhKQ wRnyLmr4ZtG7IZ9qrGpSmB2aXLbZg6WOP3v4AElkcZLp0t7V6JyQBIXkml55fWUaxvcw 3RkQ== X-Gm-Message-State: AOAM532KwGpiZ8NvCMZEl8iYSEsSuC+P3I2oRLHvWPJ0uXP0x1EIncBK nCBz1UALAyc22o09leqfWM2aMjWiuW+lcKlBHl2Pog== X-Google-Smtp-Source: ABdhPJxcw1QKS/CfgRHrTK0jBR2NqS/EllRz03ONCgWWNEWSRE7C+j24Be9hnZUzL+0f3H9SM1Pw4hG8NW9dYwWcGZM= X-Received: by 2002:a9d:bb4:: with SMTP id 49mr17489711oth.236.1595204825796; Sun, 19 Jul 2020 17:27:05 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: From: Kenji Baheux Date: Mon, 20 Jul 2020 09:26:54 +0900 Message-ID: To: tirumal reddy Cc: Martin Thomson , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000fcae6b05aad49077" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 00:27:13 -0000 --000000000000fcae6b05aad49077 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I'd like to get a clear picture of how per-device family-safe filtering is typically configured in a plain ISP setup. I imagine that the ISP provided router offers a UI through which a parent (logged in user) could add/remove specific devices to the "family-safe: enabled" list. Which information is being used to dissociate the devices? What does the router do differently from there on? Where does the filtering actually occur, on the upstream resolver (different one?)? Thanks. On Fri, Jul 17, 2020 at 11:54 PM tirumal reddy wrote: > Hi Martin, > > Nowadays home routers are capable of running network security services. > For example, DNS filtering to enforce MUD ( > https://tools.ietf.org/html/rfc8520) rules for IoT devices, blocking > malware/phishing sites, parental control, anomaly detection etc. > > SPAU allows the ISP DoH/DoT resolver to enforce DNS filtering for the > entire home but cannot enforce device level filtering, isolate infected > devices, identify local attacks etc. > > Cheers, > -Tiru > > On Thu, 16 Jul 2020 at 04:42, Martin Thomson wrote: > >> Hi Andrew, >> >> Your draft seems to be making a case for supporting forwarders, but I'm >> not clear on what supporting forwarders looks like. I understand that y= ou >> might not have specific ideas about what this support might look like, b= ut >> I don't see any real requirements here either. >> >> It would really help if the draft would clearly articulate what your >> desired outcome is. >> >> I note that SPAU - as described - only really operates when the forwarde= r >> has been cut out already. I don't believe that there are many CPE devic= es >> that intercept traffic on UDP port 53 to do their work, but it isn't >> unthinkable. If there are, those are the only ones truly affected by th= e >> described upgrade to encrypted transport. >> >> There is a SPAU upgrade path that might concern you more: >> >> Query using the default resolver for a name where the LHS labels are >> unique (and therefore unlikely to be cached anywhere) and the RHS labels >> identifies a zone under the control of the entity making the probe. The >> authoritative puts the IP of the resolver that made the call in the >> answer. This probably won't be a recognizable address for the resolver, >> and it almost certainly won't be a quad-N anycast address, but it will >> identify the true resolver with fair accuracy. The client can then do a >> lookup and upgrade, cutting out any forwarder. (A variation on this has >> the authoritative perform the lookup, which might be superior from a >> deployment perspective as it centralizes the lookup tables.) >> >> Cheers, >> Martin >> >> >> On Thu, Jul 16, 2020, at 02:59, Andrew Campling wrote: >> > >> > *ADD **and EDDI **Group**s* >> > This is to let you know that a new I-D has been submitted for >> > consideration by the ADD WG that includes observations regarding a >> > variety of implementations of recursive DNS capabilities that are >> > important to network operators in terms of delivering DNS services to >> > their customers. The document defines problems that need technical >> > solutions to allow the deployment of encrypted DNS by the largest >> > number of operators to the largest number of users in the shortest >> > possible timeframe with little or no disruption to the user experience= , >> > ideally by clients using the =E2=80=9Csame provider auto-upgrade=E2=80= =9D approach >> > wherever possible. >> > >> > Name: draft-campling-operator-observations >> > Revision: 00 >> > Title: Practical Observations from Encrypted DNS Deployments >> > by Network Operators >> > Document date: 2020-07-13 >> > Group: Individual Submission >> > Pages: 9 >> > URL: >> > _ >> https://www.ietf.org/internet-drafts/draft-campling-operator-observation= s-00.txt_ >> > Status: >> > _ >> https://datatracker.ietf.org/doc/draft-campling-operator-observations/_ >> > Htmlized: >> > _https://tools.ietf.org/html/draft-campling-operator-observations-00_ >> > Htmlized: >> > _ >> https://datatracker..ietf.org/doc/html/draft-campling-operator-observati= ons_ >> >> > >> > We hope that the details in this document will aid the development of >> > discovery mechanisms for DNS resolvers including those using DoH. >> > Discussion of its content is encouraged on the IETF ADD mailing list >> > _add@ietf.org_, especially concerning any contributions from >> additional >> > network operators to make the content as fully representative as >> > possible of the significant use cases globally. >> > >> > >> > *Andrew**, Normen, G**ianpaolo, Chris, Alister * >> > >> > >> > >> > -- >> > Add mailing list >> > Add@ietf.org >> > https://www.ietf.org/mailman/listinfo/add >> > >> >> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --=20 Kenji BAHEUX Product Manager - Chrome Google Japan --000000000000fcae6b05aad49077 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I'd like to get a clear picture of how per-device fami= ly-safe filtering is typically configured in a plain ISP setup.

I imagine that the ISP provided router offers a UI through which a = parent (logged in user) could add/remove specific devices to the "fami= ly-safe: enabled" list.

Which information is = being used to dissociate the=C2=A0 devices?
What does the router = do differently from there on? Where does the filtering actually occur, on t= he upstream resolver (different one?)?

Thanks.

On Fri, Jul 17, 2020 at 11:54 PM tirumal reddy <kondtir@gmail.com> wrote:
Hi Martin,

Nowadays home routers are capable of running network securi= ty services. For example, DNS filtering to enforce MUD (https://tools.ietf.org/html/= rfc8520)=C2=A0rules for IoT devices,=20 blocking malware/phishing sites, parental control, anomaly detection etc.
=
SPAU allows the ISP DoH/DoT resolver to enforce DNS filterin= g for the entire home but cannot enforce device level filtering,=C2=A0isola= te infected devices, identify local attacks etc.

C= heers,
-Tiru

<= div dir=3D"ltr" class=3D"gmail_attr">On Thu, 16 Jul 2020 at 04:42, Martin T= homson <mt@lowent= ropy.net> wrote:
Hi Andrew,

Your draft seems to be making a case for supporting forwarders, but I'm= not clear on what supporting forwarders looks like.=C2=A0 I understand tha= t you might not have specific ideas about what this support might look like= , but I don't see any real requirements here either.

It would really help if the draft would clearly articulate what your desire= d outcome is.

I note that SPAU - as described - only really operates when the forwarder h= as been cut out already.=C2=A0 I don't believe that there are many CPE = devices that intercept traffic on UDP port 53 to do their work, but it isn&= #39;t unthinkable.=C2=A0 If there are, those are the only ones truly affect= ed by the described upgrade to encrypted transport.

There is a SPAU upgrade path that might concern you more:

Query using the default resolver for a name where the LHS labels are unique= (and therefore unlikely to be cached anywhere) and the RHS labels identifi= es a zone under the control of the entity making the probe.=C2=A0 The autho= ritative puts the IP of the resolver that made the call in the answer.=C2= =A0 This probably won't be a recognizable address for the resolver, and= it almost certainly won't be a quad-N anycast address, but it will ide= ntify the true resolver with fair accuracy.=C2=A0 The client can then do a = lookup and upgrade, cutting out any forwarder.=C2=A0 (A variation on this h= as the authoritative perform the lookup, which might be superior from a dep= loyment perspective as it centralizes the lookup tables.)

Cheers,
Martin


On Thu, Jul 16, 2020, at 02:59, Andrew Campling wrote:
>=C2=A0
> *ADD **and EDDI **Group**s*
> This is to let you know that a new I-D has been submitted for
> consideration by the ADD WG that includes observations regarding a > variety of implementations of recursive DNS capabilities that are
> important to network operators in terms of delivering DNS services to =
> their customers.=C2=A0 The document defines problems that need technic= al
> solutions to allow the deployment of encrypted DNS by the largest
> number of operators to the largest number of users in the shortest > possible timeframe with little or no disruption to the user experience= ,
> ideally by clients using the =E2=80=9Csame provider auto-upgrade=E2=80= =9D approach
> wherever possible.
>=C2=A0
> Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-campling-operator-= observations
> Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
> Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Practical Observations from E= ncrypted DNS Deployments
> by Network Operators
> Document date:=C2=A0 2020-07-13
> Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
> Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 9
> URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://www.i= etf.org/internet-drafts/draft-campling-operator-observations-00.txt_ > Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://datatracker.iet= f.org/doc/draft-campling-operator-observations/_
> Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://tools.ietf.org/htm= l/draft-campling-operator-observations-00_
> Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://datatracker= ..ietf.org/doc/html/draft-campling-operator-observations_
>=C2=A0
> We hope that the details in this document will aid the development of =
> discovery mechanisms for DNS resolvers including those using DoH.=C2= =A0
> Discussion of its content is encouraged on the IETF ADD mailing list <= br> > _add@ietf.org_, especially concerning any contributions from additiona= l
> network operators to make the content as fully representative as
> possible of the significant use cases globally.=C2=A0
>=C2=A0
>=C2=A0
> *Andrew**, Normen, G**ianpaolo, Chris, Alister *
>=C2=A0
>=C2=A0
>=C2=A0
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
>

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add


--
Kenji BAHEUX
= Product Manager - Chrome
Google Japan
--000000000000fcae6b05aad49077-- From nobody Sun Jul 19 17:33:14 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC7603A0C15 for ; Sun, 19 Jul 2020 17:33:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.12 X-Spam-Level: X-Spam-Status: No, score=-2.12 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=KHorvYx5; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=ffFdKLcF Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tiZ_z5ypXVME for ; Sun, 19 Jul 2020 17:33:11 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 45C2F3A0C11 for ; Sun, 19 Jul 2020 17:33:11 -0700 (PDT) Received: from compute2.internal (compute2.nyi.internal [10.202.2.42]) by mailout.nyi.internal (Postfix) with ESMTP id 7EBFC5C00D8 for ; Sun, 19 Jul 2020 20:33:10 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute2.internal (MEProxy); Sun, 19 Jul 2020 20:33:10 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm2; bh=ZGoSrwYfUSdkaEmOa5qoq2xDTUlJbn3 ywj/z5rSiiYk=; b=KHorvYx5fNgfoOfvWw0hVxtP801h5Ht7qL9VxpzdvNdgs3c msDM19+NfgiV/6C6U8X1t8mg/+RABBze2p+v5RnrcaA6cZBrKmnHs9mTfjLRBkNz Wd0sNXnM+MrypgerBuGZeWikx8NIWAEOSo7x9FkN9RTW1ZKtxljVKj4O9bJyFqMB 0AiS2bcrzXeEw/byol41Pqdc5lzSgXUBJjX5Ok4MU7XAmKz4I6Hf5ozcrWNeh5xH P1iCUq0AupjO2JhrbHX+Yps59f7G/OszpgME2kiP6NJ8/OBZVzIKWB36568ZUJJ9 F+94l0BTw3QomKTm4cB6bvYf4M4w67SCx2oLlQQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=ZGoSrw YfUSdkaEmOa5qoq2xDTUlJbn3ywj/z5rSiiYk=; b=ffFdKLcFTcycwsJjGph3uF /45PYhuGdXdJIj3VLB99BwyAsXe3o62n08l7dufpxEk/DcNjc57aNk7Y82d4f0y+ 5bWd/xJTm8OEykmOrb8MhpLpDYdtdrc/C6s9m3dApDEnZmZ+x0UQf780+P9yLKbg KYEop4djjr0xZTf6LyhhNcZzOeH+WhA5I7Zy4O09IG1xkCXvOPdQ2ZfME4Om+ao5 xRXGrXkbz5+yVsuLo6UMi3GXa4RFoUnazdevYcdRgs/ADKDY+vAe00vCRzwHKFlF yRyp9DQqOoOqucduUvLAKPP/TwiXVOHaRrFv3wdGruoInWxlZMdu0Uzvwm/NtTjQ == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduiedrgedvgdefjecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreerjeenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecuggftrfgrthhtvghrnhepleefudfgleegiefgueevle dujeejuedtleegvdetheeuvefhvdehgfegueffiedvnecuffhomhgrihhnpehivghtfhdr ohhrghenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpe hmtheslhhofigvnhhtrhhophihrdhnvght X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 20B3DE00A8; Sun, 19 Jul 2020 20:33:10 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.3.0-52-g083df19-fm-idx2020-20200715.003-g083df194 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> Date: Mon, 20 Jul 2020 10:32:50 +1000 From: "Martin Thomson" To: add@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Add] =?utf-8?q?Practical_Observations_from_Encrypted_DNS_Deploy?= =?utf-8?q?ments_by_Network_Operators?= X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 00:33:13 -0000 Hi Tiru, I should remind you of the difference between describing a mechanism (as Vittorio did) and advocating for a particular policy regime. This message appears to be the latter and therefore out of scope for this group. If you want to continue that discussion, we're discussing https://tools.ietf.org/html/draft-thomson-tmi-00 on the model-t@iab.org list. On Sat, Jul 18, 2020, at 00:53, tirumal reddy wrote: > Nowadays home routers are capable of running network security services. > For example, DNS filtering to enforce MUD > (https://tools.ietf.org/html/rfc8520) rules for IoT devices, blocking > malware/phishing sites, parental control, anomaly detection etc. > > SPAU allows the ISP DoH/DoT resolver to enforce DNS filtering for the > entire home but cannot enforce device level filtering, isolate infected > devices, identify local attacks etc. From nobody Mon Jul 20 01:18:25 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9338F3A079A for ; Mon, 20 Jul 2020 01:18:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V0yWc1qXODxE for ; Mon, 20 Jul 2020 01:18:21 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 59FC03A0788 for ; Mon, 20 Jul 2020 01:18:21 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id q74so16709118iod.1 for ; Mon, 20 Jul 2020 01:18:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=qupwXh0gZ9bxr2vNVojQsoDvrGoB00r4JK8prwbZUrw=; b=G9lDONWcwPKdE914IywN809QnaPYDO5DVJX4/HwBgEWXBWNaEa2isYAUnfNBiRR3w7 RJgHW4nxLqvOuu3U2mIgwyfd7W04eCyaVuw7Bxo3ius+TcVFvOkoimwiJSjwpyQWQmlX qavCnuiSRr8OZeAc0Z49Xx87mQUOu2m85IRsz+4/hmV12f10gG6tC94S4efr4JXKwPDG dO2j0H/8akaVROV8jR+Z/ie08glPSmVPWN/1xsUezczLIgvHd0BS3gHYs2JKV1HSO4Cs ux76PQGZ4YB1tmsZTNcnVYINIqQEM1IFQXWDTeiuluJDXsSYirn0kUj3LPTQcjKVf4dV w8dw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=qupwXh0gZ9bxr2vNVojQsoDvrGoB00r4JK8prwbZUrw=; b=GAv+GaT4l6DskJ1AHwykBAytLlxwwOEuKAoFLRo/p8Q+FtArxoU+h4P/1uOkhibnnT +1VzmLwH0yh1dRYs9SEgn5bwunP0TqMOkAlG/b5ZCmg8gU3S6Lk6CBLoRNHibv3N1fe8 juko+ZmUuOk8tylIl4ZM5hLzZjLoixJmByp/CnD3s3fZVRiPlxfLwkoCIWjzC849778d BJKXKUx+8WtnFTlSu7bci9fTZGWssfjTqtDFl0dWlPI2VP4RB4bkYVzaFA9gFIYWO2hE oD0dr+XMK2oAhXWuDuMawTJOLmtdcuspRw0NA0rhyGLykgmK4U1CnxI86R/VNROwNMjM SfDw== X-Gm-Message-State: AOAM533k/n4Jm2hNptvUyOSDrmDjHmdlg906TSkyvd5xYTtrGVU0F2oc AZi94wYAJD3NUly+RUiV/8oKog/xrWgthVyv3js= X-Google-Smtp-Source: ABdhPJxmf3WPhlzDOZ7ZNfsL2mPSlr5WNRZvLymU8yUQsLnmLIg1s22H1nKUigOz0zPH4faQju4QE0ZmiA2/U4JynZ8= X-Received: by 2002:a6b:ba8b:: with SMTP id k133mr22012083iof.204.1595233100360; Mon, 20 Jul 2020 01:18:20 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: From: tirumal reddy Date: Mon, 20 Jul 2020 13:48:08 +0530 Message-ID: To: Kenji Baheux Cc: Martin Thomson , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000047ef6005aadb2609" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 08:18:24 -0000 --00000000000047ef6005aadb2609 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, 20 Jul 2020 at 05:57, Kenji Baheux wrote: > I'd like to get a clear picture of how per-device family-safe filtering i= s > typically configured in a plain ISP setup. > > I imagine that the ISP provided router offers a UI through which a parent > (logged in user) could add/remove specific devices to the "family-safe: > enabled" list. > Yes. > > Which information is being used to dissociate the devices? > The UI typically displays the device type, make, model, MAC address and IP addresses. The per-device specific policy is enforced using the MAC address= . > What does the router do differently from there on? Where does the > filtering actually occur, on the upstream resolver (different one?)? > The DNS filtering can either happen in the DNS forwarder in the home router or enforced by the ISP DNS recursive server. Cheers, -Tiru > > Thanks. > > On Fri, Jul 17, 2020 at 11:54 PM tirumal reddy wrote: > >> Hi Martin, >> >> Nowadays home routers are capable of running network security services. >> For example, DNS filtering to enforce MUD ( >> https://tools.ietf.org/html/rfc8520) rules for IoT devices, blocking >> malware/phishing sites, parental control, anomaly detection etc. >> >> SPAU allows the ISP DoH/DoT resolver to enforce DNS filtering for the >> entire home but cannot enforce device level filtering, isolate infected >> devices, identify local attacks etc. >> >> Cheers, >> -Tiru >> >> On Thu, 16 Jul 2020 at 04:42, Martin Thomson wrote: >> >>> Hi Andrew, >>> >>> Your draft seems to be making a case for supporting forwarders, but I'm >>> not clear on what supporting forwarders looks like. I understand that = you >>> might not have specific ideas about what this support might look like, = but >>> I don't see any real requirements here either. >>> >>> It would really help if the draft would clearly articulate what your >>> desired outcome is. >>> >>> I note that SPAU - as described - only really operates when the >>> forwarder has been cut out already. I don't believe that there are man= y >>> CPE devices that intercept traffic on UDP port 53 to do their work, but= it >>> isn't unthinkable. If there are, those are the only ones truly affecte= d by >>> the described upgrade to encrypted transport. >>> >>> There is a SPAU upgrade path that might concern you more: >>> >>> Query using the default resolver for a name where the LHS labels are >>> unique (and therefore unlikely to be cached anywhere) and the RHS label= s >>> identifies a zone under the control of the entity making the probe. Th= e >>> authoritative puts the IP of the resolver that made the call in the >>> answer. This probably won't be a recognizable address for the resolver= , >>> and it almost certainly won't be a quad-N anycast address, but it will >>> identify the true resolver with fair accuracy. The client can then do = a >>> lookup and upgrade, cutting out any forwarder. (A variation on this ha= s >>> the authoritative perform the lookup, which might be superior from a >>> deployment perspective as it centralizes the lookup tables.) >>> >>> Cheers, >>> Martin >>> >>> >>> On Thu, Jul 16, 2020, at 02:59, Andrew Campling wrote: >>> > >>> > *ADD **and EDDI **Group**s* >>> > This is to let you know that a new I-D has been submitted for >>> > consideration by the ADD WG that includes observations regarding a >>> > variety of implementations of recursive DNS capabilities that are >>> > important to network operators in terms of delivering DNS services to >>> > their customers. The document defines problems that need technical >>> > solutions to allow the deployment of encrypted DNS by the largest >>> > number of operators to the largest number of users in the shortest >>> > possible timeframe with little or no disruption to the user >>> experience, >>> > ideally by clients using the =E2=80=9Csame provider auto-upgrade=E2= =80=9D approach >>> > wherever possible. >>> > >>> > Name: draft-campling-operator-observations >>> > Revision: 00 >>> > Title: Practical Observations from Encrypted DNS Deployments >>> > by Network Operators >>> > Document date: 2020-07-13 >>> > Group: Individual Submission >>> > Pages: 9 >>> > URL: >>> > _ >>> https://www.ietf.org/internet-drafts/draft-campling-operator-observatio= ns-00.txt_ >>> > Status: >>> > _ >>> https://datatracker.ietf.org/doc/draft-campling-operator-observations/_ >>> > Htmlized: >>> > _https://tools.ietf.org/html/draft-campling-operator-observations-00_ >>> > Htmlized: >>> > _ >>> https://datatracker..ietf.org/doc/html/draft-campling-operator-observat= ions_ >>> >>> > >>> > We hope that the details in this document will aid the development of >>> > discovery mechanisms for DNS resolvers including those using DoH. >>> > Discussion of its content is encouraged on the IETF ADD mailing list >>> > _add@ietf.org_, especially concerning any contributions from >>> additional >>> > network operators to make the content as fully representative as >>> > possible of the significant use cases globally. >>> > >>> > >>> > *Andrew**, Normen, G**ianpaolo, Chris, Alister * >>> > >>> > >>> > >>> > -- >>> > Add mailing list >>> > Add@ietf.org >>> > https://www.ietf.org/mailman/listinfo/add >>> > >>> >>> -- >>> Add mailing list >>> Add@ietf.org >>> https://www.ietf.org/mailman/listinfo/add >>> >> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> > > > -- > Kenji BAHEUX > Product Manager - Chrome > Google Japan > --00000000000047ef6005aadb2609 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, 20 Jul 2020 at 05:57, Kenji Baheu= x <kenjibaheux@google.com&= gt; wrote:
I'd like to get a clear picture = of how per-device family-safe filtering is typically configured in a plain = ISP setup.

I imagine that the ISP provided router offers= a UI through which a parent (logged in user) could add/remove specific dev= ices to the "family-safe: enabled" list.
=

Yes.
=C2=A0

Which informatio= n is being used to dissociate the=C2=A0 devices?

The UI typically displays the device type, make, model, M= AC address and IP addresses. The per-device specific policy is enforced usi= ng the MAC address.
=C2=A0
What does the router do differently = from there on? Where does the filtering actually occur, on the upstream res= olver (different one?)?

The DNS= filtering can either happen in the DNS forwarder in the home router or enf= orced by the ISP DNS recursive server.=C2=A0

Cheer= s,
-Tiru
=C2=A0

Thanks.
On Fri, J= ul 17, 2020 at 11:54 PM tirumal reddy <kondtir@gmail.com> wrote:
Hi Martin,

Nowadays home routers are capable of running network = security services. For example, DNS filtering to enforce MUD (https://tools.ietf.org= /html/rfc8520)=C2=A0rules for IoT devices,=20 blocking malware/phishing sites, parental control, anomaly detection etc.
=
SPAU allows the ISP DoH/DoT resolver to enforce DNS filterin= g for the entire home but cannot enforce device level filtering,=C2=A0isola= te infected devices, identify local attacks etc.

C= heers,
-Tiru

<= div dir=3D"ltr" class=3D"gmail_attr">On Thu, 16 Jul 2020 at 04:42, Martin T= homson <mt@lowent= ropy.net> wrote:
Hi Andrew,

Your draft seems to be making a case for supporting forwarders, but I'm= not clear on what supporting forwarders looks like.=C2=A0 I understand tha= t you might not have specific ideas about what this support might look like= , but I don't see any real requirements here either.

It would really help if the draft would clearly articulate what your desire= d outcome is.

I note that SPAU - as described - only really operates when the forwarder h= as been cut out already.=C2=A0 I don't believe that there are many CPE = devices that intercept traffic on UDP port 53 to do their work, but it isn&= #39;t unthinkable.=C2=A0 If there are, those are the only ones truly affect= ed by the described upgrade to encrypted transport.

There is a SPAU upgrade path that might concern you more:

Query using the default resolver for a name where the LHS labels are unique= (and therefore unlikely to be cached anywhere) and the RHS labels identifi= es a zone under the control of the entity making the probe.=C2=A0 The autho= ritative puts the IP of the resolver that made the call in the answer.=C2= =A0 This probably won't be a recognizable address for the resolver, and= it almost certainly won't be a quad-N anycast address, but it will ide= ntify the true resolver with fair accuracy.=C2=A0 The client can then do a = lookup and upgrade, cutting out any forwarder.=C2=A0 (A variation on this h= as the authoritative perform the lookup, which might be superior from a dep= loyment perspective as it centralizes the lookup tables.)

Cheers,
Martin


On Thu, Jul 16, 2020, at 02:59, Andrew Campling wrote:
>=C2=A0
> *ADD **and EDDI **Group**s*
> This is to let you know that a new I-D has been submitted for
> consideration by the ADD WG that includes observations regarding a > variety of implementations of recursive DNS capabilities that are
> important to network operators in terms of delivering DNS services to =
> their customers.=C2=A0 The document defines problems that need technic= al
> solutions to allow the deployment of encrypted DNS by the largest
> number of operators to the largest number of users in the shortest > possible timeframe with little or no disruption to the user experience= ,
> ideally by clients using the =E2=80=9Csame provider auto-upgrade=E2=80= =9D approach
> wherever possible.
>=C2=A0
> Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-campling-operator-= observations
> Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
> Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Practical Observations from E= ncrypted DNS Deployments
> by Network Operators
> Document date:=C2=A0 2020-07-13
> Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
> Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 9
> URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://www.i= etf.org/internet-drafts/draft-campling-operator-observations-00.txt_ > Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://datatracker.iet= f.org/doc/draft-campling-operator-observations/_
> Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://tools.ietf.org/htm= l/draft-campling-operator-observations-00_
> Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://datatracker= ..ietf.org/doc/html/draft-campling-operator-observations_
>=C2=A0
> We hope that the details in this document will aid the development of =
> discovery mechanisms for DNS resolvers including those using DoH.=C2= =A0
> Discussion of its content is encouraged on the IETF ADD mailing list <= br> > _add@ietf.org_, especially concerning any contributions from additiona= l
> network operators to make the content as fully representative as
> possible of the significant use cases globally.=C2=A0
>=C2=A0
>=C2=A0
> *Andrew**, Normen, G**ianpaolo, Chris, Alister *
>=C2=A0
>=C2=A0
>=C2=A0
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
>

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add


--
Kenji BAHEUX
Pr= oduct Manager - Chrome
Google Japa= n
--00000000000047ef6005aadb2609-- From nobody Mon Jul 20 01:54:01 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C6E43A0915 for ; Mon, 20 Jul 2020 01:53:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z6e7gAtWZTnF for ; Mon, 20 Jul 2020 01:53:58 -0700 (PDT) Received: from mx3.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E0F153A0913 for ; Mon, 20 Jul 2020 01:53:57 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx3.open-xchange.com (Postfix) with ESMTPS id 4BB416A256; Mon, 20 Jul 2020 10:53:54 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1595235234; bh=RT+9dmTWcZuWxiGp1phxAv097ZiPTN+ix+zWVCv1gJo=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=x2fozd5r88wC5ZfOvbBvCgqGFMHgCon2COogaBNWh9ENlNeZIP7djyecUGNe9Ktyn btFhwi83j9EJDdOSQUIEyKsVHT0CJiZCxysJWgaxfOaIf4U5GtNdtslbex0mGFIK+k 9TpllYUj62FVc+4IXgWZ1TY5tetJeOCjtJWfCJYqeNTg7P2Pe5VvIwcp6otF7qiSr2 E3J7qAKM+KgTPuDQZ/Q+6iiB9qZ5IsExvAKaX+KLv9e6mbhhS4O4MDkc/HB1KKTZcK YQX9jHfKCvck4k5sTJEdLp5r/AcLNA+xDvNYRFbCBqSCMA/PEt6ymZBGEdUvHTy85A ZfTmxOSg1PFqQ== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 3D5763C04FE; Mon, 20 Jul 2020 10:53:54 +0200 (CEST) Date: Mon, 20 Jul 2020 10:53:54 +0200 (CEST) From: Vittorio Bertola To: Kenji Baheux Cc: ADD Mailing list Message-ID: <1646663239.1256.1595235234146@appsuite-gw1.open-xchange.com> In-Reply-To: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_1254_2110851262.1595235234134" X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev17 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 08:54:00 -0000 ------=_Part_1254_2110851262.1595235234134 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit > Il 20/07/2020 02:26 Kenji Baheux ha scritto: > > > I'd like to get a clear picture of how per-device family-safe filtering is typically configured in a plain ISP setup. > > I imagine that the ISP provided router offers a UI through which a parent (logged in user) could add/remove specific devices to the "family-safe: enabled" list. > It depends on the implementation. In other cases, the filtering engine and the UI reside on the ISP's central resolver platform, and the CPE only adds an identifier (which can be generated locally and opaque) that allows the platform to tell which device is sending the query. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com mailto:vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy ------=_Part_1254_2110851262.1595235234134 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit
 
Il 20/07/2020 02:26 Kenji Baheux <kenjibaheux=40google.com@dmarc.ietf.org> ha scritto:
 
 
I'd like to get a clear picture of how per-device family-safe filtering is typically configured in a plain ISP setup.
 
I imagine that the ISP provided router offers a UI through which a parent (logged in user) could add/remove specific devices to the "family-safe: enabled" list.
It depends on the implementation. In other cases, the filtering engine and the UI reside on the ISP's central resolver platform, and the CPE only adds an identifier (which can be generated locally and opaque) that allows the platform to tell which device is sending the query.

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
------=_Part_1254_2110851262.1595235234134-- From nobody Mon Jul 20 02:41:49 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40F453A07A9 for ; Mon, 20 Jul 2020 02:41:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BPBlNsq0uzHB for ; Mon, 20 Jul 2020 02:41:42 -0700 (PDT) Received: from mail-il1-x131.google.com (mail-il1-x131.google.com [IPv6:2607:f8b0:4864:20::131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B32133A07AF for ; Mon, 20 Jul 2020 02:41:42 -0700 (PDT) Received: by mail-il1-x131.google.com with SMTP id t27so12660825ill.9 for ; Mon, 20 Jul 2020 02:41:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=TWcGZ6924aCOA7KKExxOOpy2tIM6Hv2wfvnuSjHqtgM=; b=bwHpv82aStCJEIemvmnXcpqIOnxosoepxKHZsvvWnGtncQwUEBMD/AQJXfL9zQtCnE AT7pHRwxBX9qwXYp3czBmb6CW2fNNyB1jXwsJcJVtI2KFGnoCPJHVXQgcJ1Lqk17Ba9/ x8KBFLXEOc8VDaXfH/4zbUQyvLXJjyd6S8DwhPa5O/kRgwgS9paCgGMYnyLPvE7mJOJ+ /q7XTb+FIyZRQV9hTz27SuapOW8r8aExoTFgck0UOb1vtUblEEJBVSESnOsIVsFr6zm0 Q83Hj8UQ3ZvSizolLEVY6MigS57/9dx53JOR57vjkSj5FmKq7Y+cuvneXfO4xIT6Cbsn POgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=TWcGZ6924aCOA7KKExxOOpy2tIM6Hv2wfvnuSjHqtgM=; b=fVevcJmea7wrSgyogAixiRJ0dfosyKVBvojvZUs99koHowMb4sls0Wc9mqhzA6K9Bu udMGSxfU/2tMR4oxXc4gm6ZPiArhA6e0Cz9G+JsUO+l2FuPHoNdIWgqgL7kdBLZNHhDG twNe+6wJdhf2aHBYhJvH7sjOGYe73Facv//yvZkhzYsAztwAkrUDuckrBdU/2lD7VYik b/Ba7UiA0KlTgxJGGmHD4Rk3RwVP5SN1F8LdtXZwlPVc5ZvjJBghxTgUl7oU5kTDHdFR 5WscLJz9Xe04dPlXQnW8jyZSRUMyI4YVsd1ea63JcfJF8tkl+B0Zkpum8ZxFiuC5ZXO4 i/3A== X-Gm-Message-State: AOAM533dXxOgM0j0EzdkvknB/JhRwI8WHcuz3uJgSIGRnexWuQ0kQUOt jjj2U+HBk/0+ZEFhM5LwUpHL+WG+B3iCCXx+uas6Wl/P X-Google-Smtp-Source: ABdhPJw5E6FFHabAbokYndIGnjYOiuDmxoAXtbH64GnXwjs0DvJMk47W2BiDESYtGN/NJNzzJfSZ5hhGLdH15eSvRBg= X-Received: by 2002:a05:6e02:1313:: with SMTP id g19mr20674210ilr.123.1595238101755; Mon, 20 Jul 2020 02:41:41 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: From: tirumal reddy Date: Mon, 20 Jul 2020 15:11:30 +0530 Message-ID: To: Martin Thomson Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000632cbd05aadc507f" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 09:41:44 -0000 --000000000000632cbd05aadc507f Content-Type: text/plain; charset="UTF-8" Hi Martin, Thanks for the pointer. My intent is to say nowadays home routers are capable of running network security services and can easily be upgraded with new firmware and configuration. These home routers can run DoH/DoT forwarder. https://tools.ietf.org/html/draft-btw-add-home-07#section- 7 discusses hosting the DoH/DoT forwarder on the home router and how the client can discover the local DoH/DoT server (with and without SPAU). Legacy routers that cannot be upgraded are also possible in ISP deployments and in those cases hosts will discover the DoH/DoT server hosted by the ISP. Cheers, -Tiru On Mon, 20 Jul 2020 at 06:03, Martin Thomson wrote: > Hi Tiru, > > I should remind you of the difference between describing a mechanism (as > Vittorio did) and advocating for a particular policy regime. This message > appears to be the latter and therefore out of scope for this group. If you > want to continue that discussion, we're discussing > https://tools.ietf.org/html/draft-thomson-tmi-00 on the model-t@iab.org > list. > > On Sat, Jul 18, 2020, at 00:53, tirumal reddy wrote: > > Nowadays home routers are capable of running network security services. > > For example, DNS filtering to enforce MUD > > (https://tools.ietf.org/html/rfc8520) rules for IoT devices, blocking > > malware/phishing sites, parental control, anomaly detection etc. > > > > SPAU allows the ISP DoH/DoT resolver to enforce DNS filtering for the > > entire home but cannot enforce device level filtering, isolate infected > > devices, identify local attacks etc. > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000632cbd05aadc507f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Martin,

Thanks for = the pointer. My intent is to say nowadays home routers are capable of runni= ng network security services and can easily be upgraded with new firmware a= nd configuration. These home routers can run DoH/DoT forwarder.=C2=A0https://tools.ietf.org/html/draft-btw-add-home-07#section-7 di= scusses hosting the DoH/DoT forwarder on the home router and how the client= can discover the local DoH/DoT server (with and without SPAU).
<= br>
Legacy routers that cannot be upgraded are also possible in I= SP deployments and in those cases hosts will discover=C2=A0the DoH/DoT server hosted by the ISP.<= /span>

Cheers,
-Tiru

<= /div>
On Mon, 20 Jul 2020 at 06:03, Martin Thomson <mt@lowentropy.net> wrote:
Hi Tiru,

I should remind you of the difference between describing a mechanism (as Vi= ttorio did) and advocating for a particular policy regime.=C2=A0 This messa= ge appears to be the latter and therefore out of scope for this group.=C2= =A0 If you want to continue that discussion, we're discussing https://tools.ietf.org/html/draft-thomson-tmi-00 on the= model-t@iab.org l= ist.

On Sat, Jul 18, 2020, at 00:53, tirumal reddy wrote:
> Nowadays home routers are capable of running network security services= .
> For example, DNS filtering to enforce MUD
> (https://tools.ietf.org/html/rfc8520) rules for IoT devi= ces, blocking
> malware/phishing sites, parental control, anomaly detection etc.
>
> SPAU allows the ISP DoH/DoT resolver to enforce DNS filtering for the =
> entire home but cannot enforce device level filtering, isolate infecte= d
> devices, identify local attacks etc.

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000632cbd05aadc507f-- From nobody Mon Jul 20 02:55:05 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8DA13A07F8 for ; Mon, 20 Jul 2020 02:55:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LxD9Poo-WC5v for ; Mon, 20 Jul 2020 02:55:02 -0700 (PDT) Received: from mail-il1-x134.google.com (mail-il1-x134.google.com [IPv6:2607:f8b0:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50AB63A0033 for ; Mon, 20 Jul 2020 02:55:02 -0700 (PDT) Received: by mail-il1-x134.google.com with SMTP id h16so12695067ilj.11 for ; Mon, 20 Jul 2020 02:55:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=yPMbCgORUTVGb6PZ6O29VUCB40x+PW/9D2uCx0PktQI=; b=av2Twi5p/eU5uol4OBPDdjMzULkXF3uKKYDBhbuZy5nWGLRd9gTRf8Pmtf2bf10rvf P/EfNptblPHPa+/IKJW6olEbAoyiM/NN7uRIFeMy53K6A/ydYtCBAW/A5Klzy0LwM+i4 EodTFv4C1CIFDQvmWRL8h9NKxiG6UDvmzPniJ2tMEB7IZy6GyF7jT2cRC0l3IkqtiKGo fl0L94IQjVxKpdrMLW+N8dENLxuCqRTLjtPod9eydHQU3KAtyQgveAx9sDj5U7zyCtpF Oa+MNPCnkXoVSRIgNTJv/ldv56hmZ/8MxZdhusaw22f/KFBNGw8T8UpRcTiJ0CFrJLsJ MCrw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=yPMbCgORUTVGb6PZ6O29VUCB40x+PW/9D2uCx0PktQI=; b=XJ1v6JxOjtcJkkdZsK7ZHHmgTExxwa0K+C4vUStWn5kF28qCi9uQANs/2Qjh+a0tvQ NfHehbTcQxZcbE8WgAdNjumv4o3wGVaVRUc++eqcsKeb1Pog8B79TcjZ2Y5XmBnBHNjf ueOMV3MK8391KEntIphj3Xzj+k8b816HyBWyu/Pdx9SG4B06320Ja04zi2hRi4hzW14m +XJ2VGHmWZc1R90J9Z98NxnQVOHMvgr/H5VR+32kgcSUh0cX/T42lfcibea1OUlKy8ed 2mhVnARU9wR3lo+ISwLp8AqxOk4QobIQou/yfa7pgE7gUsByUoYevsq1bUPyUUOK0CD5 ZrLQ== X-Gm-Message-State: AOAM530ENNk4CgKBbGS/zj/eLZb+6NK3PuXIV/8y3BSEtIF3yKQTRplw RXH9PYUv3daa+a3rYNuF/+wtj2ho/gYeD3SlOgNIgg== X-Google-Smtp-Source: ABdhPJzPel4EACMtCwRpuy3eRv/7LlYDgayChx5oeBLgK6VkMfsC8MXb5CjsFuaxkk9119QvWS5UyGOaRcM97CAVUaU= X-Received: by 2002:a92:4049:: with SMTP id n70mr22414776ila.161.1595238901660; Mon, 20 Jul 2020 02:55:01 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <1646663239.1256.1595235234146@appsuite-gw1.open-xchange.com> In-Reply-To: <1646663239.1256.1595235234146@appsuite-gw1.open-xchange.com> From: tirumal reddy Date: Mon, 20 Jul 2020 15:24:50 +0530 Message-ID: To: Vittorio Bertola Cc: Kenji Baheux , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000010c22405aadc809a" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 09:55:04 -0000 --00000000000010c22405aadc809a Content-Type: text/plain; charset="UTF-8" On Mon, 20 Jul 2020 at 14:24, Vittorio Bertola wrote: > > > Il 20/07/2020 02:26 Kenji Baheux > ha scritto: > > > I'd like to get a clear picture of how per-device family-safe filtering is > typically configured in a plain ISP setup. > > I imagine that the ISP provided router offers a UI through which a parent > (logged in user) could add/remove specific devices to the "family-safe: > enabled" list. > > It depends on the implementation. In other cases, the filtering engine and > the UI reside on the ISP's central resolver platform, and the CPE only adds > an identifier (which can be generated locally and opaque) that allows the > platform to tell which device is sending the query. > If the client uses DoH/DoT, the unique identifier can longer be sent in the DNS request. -Tiru > -- > > Vittorio Bertola | Head of Policy & Innovation, Open-Xchange > vittorio.bertola@open-xchange.com > Office @ Via Treviso 12, 10144 Torino, Italy > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --00000000000010c22405aadc809a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, 20 Jul 2020 at 14:24, Vittorio Be= rtola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:
=20 =20 =20


--00000000000010c22405aadc809a-- From nobody Mon Jul 20 07:16:46 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3FDF3A0B06 for ; Mon, 20 Jul 2020 07:16:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.305 X-Spam-Level: X-Spam-Status: No, score=-1.305 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RDNS_NONE=0.793, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=noware.co.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yeXvLOsF6ALe for ; Mon, 20 Jul 2020 07:16:43 -0700 (PDT) Received: from mail.noware.co.uk (unknown [IPv6:2604:a880:0:1010::add:2001]) by ietfa.amsl.com (Postfix) with ESMTP id 5E3093A0B04 for ; Mon, 20 Jul 2020 07:16:43 -0700 (PDT) Received: from [192.168.1.170] (unknown [81.156.224.99]) by mail.noware.co.uk (Postfix) with ESMTPSA id 2B8051DC892; Mon, 20 Jul 2020 14:15:33 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.noware.co.uk 2B8051DC892 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=noware.co.uk; s=default; t=1595254533; bh=52bto4JRXhZ+1umHuMC5x+gtXoKIbOZh9AeG4/WZRrI=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=ZJmsf5Z/nzO5JWHnG4HyPUSXLYKm9Qyd5kdgiZMFWlWWC1yjpUYxVLq3Z50TbUyhO GrZu+ToQFv6HTXoK3tounXtQQRguR6bdflV5Motgpsmx8nnTIMcFw08Yj/yvL3Sqp4 5kf9/1a9hiKjEIwQYigoDKNtDjZQT7yTWlpzXnx0= From: Neil Cook Message-Id: <1F504D1C-449F-41AA-BB76-A36ECD0A6BE2@noware.co.uk> Content-Type: multipart/alternative; boundary="Apple-Mail=_D5068479-FCDB-4F2F-BCDD-C9B5D5270CAF" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Date: Mon, 20 Jul 2020 15:16:39 +0100 In-Reply-To: Cc: Vittorio Bertola , Kenji Baheux , ADD Mailing list To: tirumal reddy References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <1646663239.1256.1595235234146@appsuite-gw1.open-xchange.com> X-Mailer: Apple Mail (2.3608.80.23.2.2) X-VADE-SPAMSTATE: clean X-VADE-SPAMSCORE: 0 X-VADE-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgeduiedrgeeggdehtdcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfpgffknfevqffqmfenuceurghilhhouhhtmecufedttdenucenucfjughrpefhkfgtggfuffgjvfhfofesrgdtmherhhdtvdenucfhrhhomheppfgvihhlucevohhokhcuoehnvghilhdrtghoohhksehnohifrghrvgdrtghordhukheqnecuggftrfgrthhtvghrnhepheevfedtjeejgfegjeelgeehheevheevieeftefghfetjeetjeettefhudfgueevnecuffhomhgrihhnpehivghtfhdrohhrghenucfkphepkedurdduheeirddvvdegrdelleenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpeekuddrudehiedrvddvgedrleelpdhhvghloheplgduledvrdduieekrddurddujedtngdpmhgrihhlfhhrohhmpefpvghilhcuvehoohhkuceonhgvihhlrdgtohhokhesnhhofigrrhgvrdgtohdruhhkqedprhgtphhtthhopehkohhnughtihhrsehgmhgrihhlrdgtohhmpdhrtghpthhtohepvhhithhtohhrihhordgsvghrthholhgrpeegtdhophgvnhdqgigthhgrnhhgvgdrtghomhesughmrghrtgdrihgvthhfrdhorhhgpdhrtghpthhtohepkhgvnhhjihgsrghhvghugiepgedtghhoohhglhgvrdgtohhmsegumhgrrhgtrdhivghtfhdrohhrghdprhgtphhtthhopegruggusehivghtfhdrohhrgh Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 14:16:45 -0000 --Apple-Mail=_D5068479-FCDB-4F2F-BCDD-C9B5D5270CAF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi Tiru, > On 20 Jul 2020, at 10:54, tirumal reddy wrote: >=20 > On Mon, 20 Jul 2020 at 14:24, Vittorio Bertola = > wrote: > =20 >> Il 20/07/2020 02:26 Kenji Baheux = > ha scritto: >> =20 >> =20 >> I'd like to get a clear picture of how per-device family-safe = filtering is typically configured in a plain ISP setup. >> =20 >> I imagine that the ISP provided router offers a UI through which a = parent (logged in user) could add/remove specific devices to the = "family-safe: enabled" list. > It depends on the implementation. In other cases, the filtering engine = and the UI reside on the ISP's central resolver platform, and the CPE = only adds an identifier (which can be generated locally and opaque) that = allows the platform to tell which device is sending the query. >=20 > If the client uses DoH/DoT, the unique identifier can longer be sent = in the DNS request. >=20 If the forwarder supports DoH/DoT as described in = https://tools.ietf.org/html/draft-btw-add-home-07#section = -7 then it = can send any identifier it likes, Neil > -Tiru > -- >=20 > Vittorio Bertola | Head of Policy & Innovation, Open-Xchange > vittorio.bertola@open-xchange.com = =20 > Office @ Via Treviso 12, 10144 Torino, Italy > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add = --Apple-Mail=_D5068479-FCDB-4F2F-BCDD-C9B5D5270CAF Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Hi = Tiru,

On 20 Jul 2020, at 10:54, tirumal reddy = <kondtir@gmail.com> wrote:

On Mon, 20 Jul 2020 at 14:24, = Vittorio Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:
=20 =20 =20
 
=20
=20
Il 20/07/2020 02:26 Kenji Baheux <kenjibaheux=3D40google.com@dmarc.ietf.org> ha scritto:
=20
 
=20
 
=20
I'd like to get a clear picture of how per-device family-safe = filtering is typically configured in a plain ISP setup.=20
 
=20
I imagine that the ISP provided router offers a UI through which a = parent (logged in user) could add/remove specific devices to the = "family-safe: enabled" list.
=20
=20
=20
It depends on the implementation. In other cases, the filtering = engine and the UI reside on the ISP's central resolver platform, and the = CPE only adds an identifier (which can be generated locally and opaque) = that allows the platform to tell which device is sending the = query.

If the client uses DoH/DoT, the unique identifier can longer = be sent in the DNS request.


If the forwarder supports DoH/DoT as described = in https://tools.ietf.org/html/draft-btw-add-home-07#section-7=  then it can send any identifier it likes,

Neil

-Tiru

--

=20 
Vittorio Bertola | Head of Policy & Innovation, =
Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ =
Via Treviso 12, 10144 Torino, Italy
=20
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_D5068479-FCDB-4F2F-BCDD-C9B5D5270CAF-- From nobody Mon Jul 20 07:24:34 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 013353A0B33 for ; Mon, 20 Jul 2020 07:24:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.4 X-Spam-Level: X-Spam-Status: No, score=-0.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_WEB=1.5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F1wERFXpfXg8 for ; Mon, 20 Jul 2020 07:24:31 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110084.outbound.protection.outlook.com [40.107.11.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 881A63A0B25 for ; Mon, 20 Jul 2020 07:24:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=U0rCmZqjlCugar8IPtlgT9WQ4JNUA1OZzZIl16dxVPzInY5ogTL2omZGU4cCDNRLjU2cIuuR43CXdlQ2nQcxjltFlLW9axyDVwBA+hA/IX8z/wkz+FV33NzcHRtidQHdLdJZAOAvusrv30ZJgvS/ej1fpHLf/PGwqA7QSCp8WsfV7mEO6WfzCcQyQrU0ZO3KZ3tenqhISb+F4Q7s0Y9iESiVbwa31QfvZgukuqtv2nk4F1Fw84ENZtmgHpqGaY+1MQU0NtxyevUdqys9pY6KurDgWSViZE3S0zYBN36RoEHcaViSuTg0xaeYUXezaonQhcwrZDHxq66oG4wx7fZAHA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jna2Vu2LtAghE+fl9xVg7delw2fgaZRJEE6SiHF5HPs=; b=oUHoe3WIgyIAL5pJjCyshcMVnw8Ks4bL881Sw9VhepTkP2Q283kASzAr04hZP4aC8B1CWOFj9Hz084R8Yp1eNGzvJAN2SAC16K1k+2yjh1XdwtVr/JazUfarPSLPLL3vDw7r6uB9BxZIM9a6aLpXv6i8/sxca1bM5bqjo4ixL7oeFoYdRoVzkeSXVWI/gVX9DeNyx6UoxA2a2EksSedQJQqPIJOS8Zhxv8a3/oN7E8f6YHTCshky5DO5o4Y0C0rgH4Oc8GWPRFInMWxcbJW/fULSGWqePomd5IN+j5J9Is1Z0tB0iPQxsCB1hDM0Dbg+UTLo3vEix/t2ZUyu5yRC2w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jna2Vu2LtAghE+fl9xVg7delw2fgaZRJEE6SiHF5HPs=; b=DiR+DLjmJEPnC+3y5FfqnrhrMK4dxsE26SOQTB6XtgNr4IgPdKRNp9DqFKz0RCWsgEwH3sNDp8z6Pm1YJVywyZduvClG670Q3JnqAvZwmv29Pah88QfRUfaawzOEFVJy8ULkzo39jE2Jlt9MvQ63PgNbBnvlEWWcXDKYRpDV/3g= Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:71::15) by LNXP265MB0139.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:5f::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.24; Mon, 20 Jul 2020 14:24:28 +0000 Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6]) by LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6%6]) with mapi id 15.20.3195.025; Mon, 20 Jul 2020 14:24:27 +0000 From: Andrew Campling To: Kenji Baheux , tirumal reddy CC: Martin Thomson , ADD Mailing list , Normen Kowalewski , "Winfield, Alister" , "Box, C, Chris, TLW1 R" , "Scalone, Gianpaolo Angelo, Vodafone Italy" Thread-Topic: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AdZaxbCvio8C5rmPSDClDuXJa16fuKkQhEDA Date: Mon, 20 Jul 2020 14:24:27 +0000 Message-ID: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=none action=none header.from=419.consulting; x-originating-ip: [86.144.98.129] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 60f9b80d-50ab-46a1-883b-08d82cb89c3c x-ms-traffictypediagnostic: LNXP265MB0139: x-ld-processed: 9c2ced3e-7522-4755-87dc-f983abc66ec3,ExtAddr x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: e1dN0Zw270P83kVzpyF0I7rCiOq3IsenMOkczEzc4oKkJzwycLxnLC+buMH7hyFU08EmaTdNp0E/evIIbTj4LYCHWaFP4H+Lxkvh4RXHDirf85myprMKlfOovtt/fLwvu4WkdzPeiLab4JfMJ49FFD7Z3VcGHVjyUz6Ph8oIFu4fOueB3iEV11zZvLOfSPhkireG2qIvyuHgunMFKaQQ8l8MEVrFzxSAzq5LS1Cch5Nrz+sC7iJIXU7YUudcHqEj7b1PAkrevH0/OV8G3NJJPStJXm5ObHZ9M4e45TcFvGvgCrwPGYLvQ1l+CNxG3zjNf1H1db8RK4vdXejWR2WJ2RGNFS46AMlv5Lyf2wJjGQ4ulJMF8kWmBbno/TNnj8UqfFseSvzeBc8ioSyHvCs/sdlJ5/1NlhpEWVL6bkvv3SzUF5NUP7QT68Dq5qdP4Lk1qNvAvvz7Ro+rJ46iOoDnzg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFTY:; SFS:(396003)(39830400003)(376002)(346002)(366004)(136003)(66574015)(83380400001)(7696005)(4326008)(166002)(9686003)(71200400001)(55016002)(8936002)(66946007)(508600001)(33656002)(66556008)(66446008)(76116006)(86362001)(2906002)(5660300002)(316002)(8676002)(186003)(6506007)(966005)(54906003)(44832011)(52536014)(53546011)(64756008)(66476007)(26005)(110136005)(46492007); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: vFzZYMVOUXd9bV2hxlQNHDdz6Sd5270yIveWjrrD7Z9xRI3XL+Q7btT8RsE5xLdwowT7617c+8WntX0HBGeFwxg9MjICwqF5q9PALRd+wTvsEqj8Xrajic50TTzEVJamXlnPlFlfmpySoPF//peUiJI0CHc4p43zaJ5vh6NsXBfneWW2FEOnhj9dDNUG8/oA0N1jZnT9jdJuil19fry301u7xjw0T71NxR62MsxwpzWY0MbxypX5HdBHT+uWADsM2Baw4urGhl28pS6fUCmLPUG0bOMZ2Ll4WAic8yqvT2SAtTQAOoWlEUQczYmVLaR4zC9iOIMVdHkUhvzGSE7k+d9E23duM1fHgfOG+l7kdRLCoPEOfGcxvjnsb2X6LmBGZnZgFTMfP5ojlLSCx7W8sNPixuESrH4ZqQYqjJaQgW1eRU1UdF0BFoylIYWlBeToE+k7wlN5DtKYzVwC62pWoB9yHO3evcuCbTfd4obsPW8= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_LO2P265MB0573719257177D4827C5DCA9C27B0LO2P265MB0573GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 60f9b80d-50ab-46a1-883b-08d82cb89c3c X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jul 2020 14:24:27.8483 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: E41OctVGt1wIpwMM5r6GTod+p4QRgB8UogVkY2/YzHXWgofEOgXZDHZQHHGc4YDjAr4dZvPVZqR/nEbDR2Upni9DtGNgSscbQn54H9bMLis= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LNXP265MB0139 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 14:24:33 -0000 --_000_LO2P265MB0573719257177D4827C5DCA9C27B0LO2P265MB0573GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 S2VuamkNClNvbWUgSVNQcyB1c2UgaWRlbnRpZmllcnMgc3VjaCBhcyB0aGUgZGV2aWNlIE1BQyBh ZGRyZXNzIGZvciBwYXJlbnRhbCBjb250cm9scywgb3RoZXJzIGltcGxlbWVudCB0aGUgY29udHJv bHMgZm9yIHRoZSBhY2NvdW50IHJhdGhlciB0aGFuIGJlaW5nIGRldmljZSBzcGVjaWZpYyBzbyBj b3ZlciBhbGwgZGV2aWNlcyBjb25uZWN0ZWQgdG8gdGhlIGxpbmUuICBUaGUgZmlsdGVyaW5nIGl0 c2VsZiBpcyBvZnRlbiByZXF1ZXN0ZWQgZHVyaW5nIGFjY291bnQgYXBwbGljYXRpb24gKGllIGF0 IGN1c3RvbWVyIHNpZ24tdXApLCB3aXRoIHNvbWUgSVNQcyBvZmZlcmluZyBzZXZlcmFsIGZpeGVk IGxldmVscyBvZiBmaWx0ZXJpbmcgKGVnIGhpZ2gsIG1lZGl1bSwgbG93IOKAkyB3aXRoIGxvdyBv ZnRlbiBiZWluZyB0aGUgZGVmYXVsdCksIG90aGVycyBkbyB0aGlzIGFuZCBhbHNvIG9mZmVyIGN1 c3RvbWlzYXRpb24gYXQgYWNjb3VudCBsZXZlbC4gIEFuZCBvZiBjb3Vyc2UgdGhlIGZpbHRlcmlu ZyBjYW4gYmUgc3dpdGNoZWQgb24gb3Igb2ZmIGF0IGFueSBwb2ludCBieSB0aGUgYWNjb3VudCBo b2xkZXIuDQoNCknigJl2ZSBjb3BpZWQgbXkgY28tYXV0aG9ycyBpbiBjYXNlIHRoZXkgd2lzaCB0 byBhZGQgYW55IGRldGFpbHMgb24gdGhlaXIgb3duIGltcGxlbWVudGF0aW9ucyBhcyB0aGVyZSB3 aWxsIGJlIHZhcmlhdGlvbiBiZXR3ZWVuIHRoZW0uDQoNCg0KQW5kcmV3DQoNCkZyb206IEtlbmpp IEJhaGV1eCA8a2VuamliYWhldXhAZ29vZ2xlLmNvbT4NClNlbnQ6IDIwIEp1bHkgMjAyMCAwMToy Nw0KVG86IHRpcnVtYWwgcmVkZHkgPGtvbmR0aXJAZ21haWwuY29tPg0KQ2M6IE1hcnRpbiBUaG9t c29uIDxtdEBsb3dlbnRyb3B5Lm5ldD47IEFERCBNYWlsaW5nIGxpc3QgPGFkZEBpZXRmLm9yZz4N ClN1YmplY3Q6IFJlOiBbQWRkXSBQcmFjdGljYWwgT2JzZXJ2YXRpb25zIGZyb20gRW5jcnlwdGVk IEROUyBEZXBsb3ltZW50cyBieSBOZXR3b3JrIE9wZXJhdG9ycw0KDQpJJ2QgbGlrZSB0byBnZXQg YSBjbGVhciBwaWN0dXJlIG9mIGhvdyBwZXItZGV2aWNlIGZhbWlseS1zYWZlIGZpbHRlcmluZyBp cyB0eXBpY2FsbHkgY29uZmlndXJlZCBpbiBhIHBsYWluIElTUCBzZXR1cC4NCg0KSSBpbWFnaW5l IHRoYXQgdGhlIElTUCBwcm92aWRlZCByb3V0ZXIgb2ZmZXJzIGEgVUkgdGhyb3VnaCB3aGljaCBh IHBhcmVudCAobG9nZ2VkIGluIHVzZXIpIGNvdWxkIGFkZC9yZW1vdmUgc3BlY2lmaWMgZGV2aWNl cyB0byB0aGUgImZhbWlseS1zYWZlOiBlbmFibGVkIiBsaXN0Lg0KDQpXaGljaCBpbmZvcm1hdGlv biBpcyBiZWluZyB1c2VkIHRvIGRpc3NvY2lhdGUgdGhlICBkZXZpY2VzPw0KV2hhdCBkb2VzIHRo ZSByb3V0ZXIgZG8gZGlmZmVyZW50bHkgZnJvbSB0aGVyZSBvbj8gV2hlcmUgZG9lcyB0aGUgZmls dGVyaW5nIGFjdHVhbGx5IG9jY3VyLCBvbiB0aGUgdXBzdHJlYW0gcmVzb2x2ZXIgKGRpZmZlcmVu dCBvbmU/KT8NCg0KVGhhbmtzLg0KDQpPbiBGcmksIEp1bCAxNywgMjAyMCBhdCAxMTo1NCBQTSB0 aXJ1bWFsIHJlZGR5IDxrb25kdGlyQGdtYWlsLmNvbTxtYWlsdG86a29uZHRpckBnbWFpbC5jb20+ PiB3cm90ZToNCkhpIE1hcnRpbiwNCg0KTm93YWRheXMgaG9tZSByb3V0ZXJzIGFyZSBjYXBhYmxl IG9mIHJ1bm5pbmcgbmV0d29yayBzZWN1cml0eSBzZXJ2aWNlcy4gRm9yIGV4YW1wbGUsIEROUyBm aWx0ZXJpbmcgdG8gZW5mb3JjZSBNVUQgKGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM4 NTIwKSBydWxlcyBmb3IgSW9UIGRldmljZXMsIGJsb2NraW5nIG1hbHdhcmUvcGhpc2hpbmcgc2l0 ZXMsIHBhcmVudGFsIGNvbnRyb2wsIGFub21hbHkgZGV0ZWN0aW9uIGV0Yy4NCg0KU1BBVSBhbGxv d3MgdGhlIElTUCBEb0gvRG9UIHJlc29sdmVyIHRvIGVuZm9yY2UgRE5TIGZpbHRlcmluZyBmb3Ig dGhlIGVudGlyZSBob21lIGJ1dCBjYW5ub3QgZW5mb3JjZSBkZXZpY2UgbGV2ZWwgZmlsdGVyaW5n LCBpc29sYXRlIGluZmVjdGVkIGRldmljZXMsIGlkZW50aWZ5IGxvY2FsIGF0dGFja3MgZXRjLg0K DQpDaGVlcnMsDQotVGlydQ0KDQpPbiBUaHUsIDE2IEp1bCAyMDIwIGF0IDA0OjQyLCBNYXJ0aW4g VGhvbXNvbiA8bXRAbG93ZW50cm9weS5uZXQ8bWFpbHRvOm10QGxvd2VudHJvcHkubmV0Pj4gd3Jv dGU6DQpIaSBBbmRyZXcsDQoNCllvdXIgZHJhZnQgc2VlbXMgdG8gYmUgbWFraW5nIGEgY2FzZSBm b3Igc3VwcG9ydGluZyBmb3J3YXJkZXJzLCBidXQgSSdtIG5vdCBjbGVhciBvbiB3aGF0IHN1cHBv cnRpbmcgZm9yd2FyZGVycyBsb29rcyBsaWtlLiAgSSB1bmRlcnN0YW5kIHRoYXQgeW91IG1pZ2h0 IG5vdCBoYXZlIHNwZWNpZmljIGlkZWFzIGFib3V0IHdoYXQgdGhpcyBzdXBwb3J0IG1pZ2h0IGxv b2sgbGlrZSwgYnV0IEkgZG9uJ3Qgc2VlIGFueSByZWFsIHJlcXVpcmVtZW50cyBoZXJlIGVpdGhl ci4NCg0KSXQgd291bGQgcmVhbGx5IGhlbHAgaWYgdGhlIGRyYWZ0IHdvdWxkIGNsZWFybHkgYXJ0 aWN1bGF0ZSB3aGF0IHlvdXIgZGVzaXJlZCBvdXRjb21lIGlzLg0KDQpJIG5vdGUgdGhhdCBTUEFV IC0gYXMgZGVzY3JpYmVkIC0gb25seSByZWFsbHkgb3BlcmF0ZXMgd2hlbiB0aGUgZm9yd2FyZGVy IGhhcyBiZWVuIGN1dCBvdXQgYWxyZWFkeS4gIEkgZG9uJ3QgYmVsaWV2ZSB0aGF0IHRoZXJlIGFy ZSBtYW55IENQRSBkZXZpY2VzIHRoYXQgaW50ZXJjZXB0IHRyYWZmaWMgb24gVURQIHBvcnQgNTMg dG8gZG8gdGhlaXIgd29yaywgYnV0IGl0IGlzbid0IHVudGhpbmthYmxlLiAgSWYgdGhlcmUgYXJl LCB0aG9zZSBhcmUgdGhlIG9ubHkgb25lcyB0cnVseSBhZmZlY3RlZCBieSB0aGUgZGVzY3JpYmVk IHVwZ3JhZGUgdG8gZW5jcnlwdGVkIHRyYW5zcG9ydC4NCg0KVGhlcmUgaXMgYSBTUEFVIHVwZ3Jh ZGUgcGF0aCB0aGF0IG1pZ2h0IGNvbmNlcm4geW91IG1vcmU6DQoNClF1ZXJ5IHVzaW5nIHRoZSBk ZWZhdWx0IHJlc29sdmVyIGZvciBhIG5hbWUgd2hlcmUgdGhlIExIUyBsYWJlbHMgYXJlIHVuaXF1 ZSAoYW5kIHRoZXJlZm9yZSB1bmxpa2VseSB0byBiZSBjYWNoZWQgYW55d2hlcmUpIGFuZCB0aGUg UkhTIGxhYmVscyBpZGVudGlmaWVzIGEgem9uZSB1bmRlciB0aGUgY29udHJvbCBvZiB0aGUgZW50 aXR5IG1ha2luZyB0aGUgcHJvYmUuICBUaGUgYXV0aG9yaXRhdGl2ZSBwdXRzIHRoZSBJUCBvZiB0 aGUgcmVzb2x2ZXIgdGhhdCBtYWRlIHRoZSBjYWxsIGluIHRoZSBhbnN3ZXIuICBUaGlzIHByb2Jh Ymx5IHdvbid0IGJlIGEgcmVjb2duaXphYmxlIGFkZHJlc3MgZm9yIHRoZSByZXNvbHZlciwgYW5k IGl0IGFsbW9zdCBjZXJ0YWlubHkgd29uJ3QgYmUgYSBxdWFkLU4gYW55Y2FzdCBhZGRyZXNzLCBi dXQgaXQgd2lsbCBpZGVudGlmeSB0aGUgdHJ1ZSByZXNvbHZlciB3aXRoIGZhaXIgYWNjdXJhY3ku ICBUaGUgY2xpZW50IGNhbiB0aGVuIGRvIGEgbG9va3VwIGFuZCB1cGdyYWRlLCBjdXR0aW5nIG91 dCBhbnkgZm9yd2FyZGVyLiAgKEEgdmFyaWF0aW9uIG9uIHRoaXMgaGFzIHRoZSBhdXRob3JpdGF0 aXZlIHBlcmZvcm0gdGhlIGxvb2t1cCwgd2hpY2ggbWlnaHQgYmUgc3VwZXJpb3IgZnJvbSBhIGRl cGxveW1lbnQgcGVyc3BlY3RpdmUgYXMgaXQgY2VudHJhbGl6ZXMgdGhlIGxvb2t1cCB0YWJsZXMu KQ0KDQpDaGVlcnMsDQpNYXJ0aW4NCg0KDQpPbiBUaHUsIEp1bCAxNiwgMjAyMCwgYXQgMDI6NTks IEFuZHJldyBDYW1wbGluZyB3cm90ZToNCj4NCj4gKkFERCAqKmFuZCBFRERJICoqR3JvdXAqKnMq DQo+IFRoaXMgaXMgdG8gbGV0IHlvdSBrbm93IHRoYXQgYSBuZXcgSS1EIGhhcyBiZWVuIHN1Ym1p dHRlZCBmb3INCj4gY29uc2lkZXJhdGlvbiBieSB0aGUgQUREIFdHIHRoYXQgaW5jbHVkZXMgb2Jz ZXJ2YXRpb25zIHJlZ2FyZGluZyBhDQo+IHZhcmlldHkgb2YgaW1wbGVtZW50YXRpb25zIG9mIHJl Y3Vyc2l2ZSBETlMgY2FwYWJpbGl0aWVzIHRoYXQgYXJlDQo+IGltcG9ydGFudCB0byBuZXR3b3Jr IG9wZXJhdG9ycyBpbiB0ZXJtcyBvZiBkZWxpdmVyaW5nIEROUyBzZXJ2aWNlcyB0bw0KPiB0aGVp ciBjdXN0b21lcnMuICBUaGUgZG9jdW1lbnQgZGVmaW5lcyBwcm9ibGVtcyB0aGF0IG5lZWQgdGVj aG5pY2FsDQo+IHNvbHV0aW9ucyB0byBhbGxvdyB0aGUgZGVwbG95bWVudCBvZiBlbmNyeXB0ZWQg RE5TIGJ5IHRoZSBsYXJnZXN0DQo+IG51bWJlciBvZiBvcGVyYXRvcnMgdG8gdGhlIGxhcmdlc3Qg bnVtYmVyIG9mIHVzZXJzIGluIHRoZSBzaG9ydGVzdA0KPiBwb3NzaWJsZSB0aW1lZnJhbWUgd2l0 aCBsaXR0bGUgb3Igbm8gZGlzcnVwdGlvbiB0byB0aGUgdXNlciBleHBlcmllbmNlLA0KPiBpZGVh bGx5IGJ5IGNsaWVudHMgdXNpbmcgdGhlIOKAnHNhbWUgcHJvdmlkZXIgYXV0by11cGdyYWRl4oCd IGFwcHJvYWNoDQo+IHdoZXJldmVyIHBvc3NpYmxlLg0KPg0KPiBOYW1lOiAgICAgICAgICAgZHJh ZnQtY2FtcGxpbmctb3BlcmF0b3Itb2JzZXJ2YXRpb25zDQo+IFJldmlzaW9uOiAgICAgICAwMA0K PiBUaXRsZTogICAgICAgICAgUHJhY3RpY2FsIE9ic2VydmF0aW9ucyBmcm9tIEVuY3J5cHRlZCBE TlMgRGVwbG95bWVudHMNCj4gYnkgTmV0d29yayBPcGVyYXRvcnMNCj4gRG9jdW1lbnQgZGF0ZTog IDIwMjAtMDctMTMNCj4gR3JvdXA6ICAgICAgICAgIEluZGl2aWR1YWwgU3VibWlzc2lvbg0KPiBQ YWdlczogICAgICAgICAgOQ0KPiBVUkw6DQo+IF9odHRwczovL3d3dy5pZXRmLm9yZy9pbnRlcm5l dC1kcmFmdHMvZHJhZnQtY2FtcGxpbmctb3BlcmF0b3Itb2JzZXJ2YXRpb25zLTAwLnR4dF8NCj4g U3RhdHVzOg0KPiBfaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtY2FtcGxp bmctb3BlcmF0b3Itb2JzZXJ2YXRpb25zL18NCj4gSHRtbGl6ZWQ6DQo+IF9odHRwczovL3Rvb2xz LmlldGYub3JnL2h0bWwvZHJhZnQtY2FtcGxpbmctb3BlcmF0b3Itb2JzZXJ2YXRpb25zLTAwXw0K PiBIdG1saXplZDoNCj4gX2h0dHBzOi8vZGF0YXRyYWNrZXIuLi5pZXRmLm9yZy9kb2MvaHRtbC9k cmFmdC1jYW1wbGluZy1vcGVyYXRvci1vYnNlcnZhdGlvbnNfPGh0dHBzOi8vZGF0YXRyYWNrZXIu aWV0Zi5vcmcvZG9jL2h0bWwvZHJhZnQtY2FtcGxpbmctb3BlcmF0b3Itb2JzZXJ2YXRpb25zXz4N Cj4NCj4gV2UgaG9wZSB0aGF0IHRoZSBkZXRhaWxzIGluIHRoaXMgZG9jdW1lbnQgd2lsbCBhaWQg dGhlIGRldmVsb3BtZW50IG9mDQo+IGRpc2NvdmVyeSBtZWNoYW5pc21zIGZvciBETlMgcmVzb2x2 ZXJzIGluY2x1ZGluZyB0aG9zZSB1c2luZyBEb0guDQo+IERpc2N1c3Npb24gb2YgaXRzIGNvbnRl bnQgaXMgZW5jb3VyYWdlZCBvbiB0aGUgSUVURiBBREQgbWFpbGluZyBsaXN0DQo+IF9hZGRAaWV0 Zi5vcmdfPG1haWx0bzpfYWRkQGlldGYub3JnXz4sIGVzcGVjaWFsbHkgY29uY2VybmluZyBhbnkg Y29udHJpYnV0aW9ucyBmcm9tIGFkZGl0aW9uYWwNCj4gbmV0d29yayBvcGVyYXRvcnMgdG8gbWFr ZSB0aGUgY29udGVudCBhcyBmdWxseSByZXByZXNlbnRhdGl2ZSBhcw0KPiBwb3NzaWJsZSBvZiB0 aGUgc2lnbmlmaWNhbnQgdXNlIGNhc2VzIGdsb2JhbGx5Lg0KPg0KPg0KPiAqQW5kcmV3KiosIE5v cm1lbiwgRyoqaWFucGFvbG8sIENocmlzLCBBbGlzdGVyICoNCj4NCj4NCj4NCj4gLS0NCj4gQWRk IG1haWxpbmcgbGlzdA0KPiBBZGRAaWV0Zi5vcmc8bWFpbHRvOkFkZEBpZXRmLm9yZz4NCj4gaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hZGQNCj4NCg0KLS0NCkFkZCBtYWls aW5nIGxpc3QNCkFkZEBpZXRmLm9yZzxtYWlsdG86QWRkQGlldGYub3JnPg0KaHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hZGQNCi0tDQpBZGQgbWFpbGluZyBsaXN0DQpBZGRA aWV0Zi5vcmc8bWFpbHRvOkFkZEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vYWRkDQoNCg0KLS0NCktlbmppIEJBSEVVWA0KUHJvZHVjdCBNYW5hZ2VyIC0g Q2hyb21lDQpHb29nbGUgSmFwYW4NCg== --_000_LO2P265MB0573719257177D4827C5DCA9C27B0LO2P265MB0573GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28t c3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgltc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUzt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7 c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBw dDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+ PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBz cGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4 bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIg ZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4N Cjxib2R5IGxhbmc9IkVOLUdCIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xh c3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+S2Vuamk8bzpwPjwv bzpwPjwvc3Bhbj48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMi4wcHQ7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPlNvbWUgSVNQcyB1c2Ug aWRlbnRpZmllcnMgc3VjaCBhcyB0aGUgZGV2aWNlIE1BQyBhZGRyZXNzIGZvciBwYXJlbnRhbCBj b250cm9scywgb3RoZXJzIGltcGxlbWVudCB0aGUgY29udHJvbHMgZm9yIHRoZSBhY2NvdW50IHJh dGhlciB0aGFuIGJlaW5nIGRldmljZSBzcGVjaWZpYyBzbyBjb3ZlciBhbGwgZGV2aWNlcw0KIGNv bm5lY3RlZCB0byB0aGUgbGluZS4mbmJzcDsgVGhlIGZpbHRlcmluZyBpdHNlbGYgaXMgb2Z0ZW4g cmVxdWVzdGVkIGR1cmluZyBhY2NvdW50IGFwcGxpY2F0aW9uIChpZSBhdCBjdXN0b21lciBzaWdu LXVwKSwgd2l0aCBzb21lIElTUHMgb2ZmZXJpbmcgc2V2ZXJhbCBmaXhlZCBsZXZlbHMgb2YgZmls dGVyaW5nIChlZyBoaWdoLCBtZWRpdW0sIGxvdyDigJMgd2l0aCBsb3cgb2Z0ZW4gYmVpbmcgdGhl IGRlZmF1bHQpLCBvdGhlcnMgZG8gdGhpcyBhbmQgYWxzbw0KIG9mZmVyIGN1c3RvbWlzYXRpb24g YXQgYWNjb3VudCBsZXZlbC4mbmJzcDsgQW5kIG9mIGNvdXJzZSB0aGUgZmlsdGVyaW5nIGNhbiBi ZSBzd2l0Y2hlZCBvbiBvciBvZmYgYXQgYW55IHBvaW50IGJ5IHRoZSBhY2NvdW50IGhvbGRlci4m bmJzcDsNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+SeKAmXZlIGNv cGllZCBteSBjby1hdXRob3JzIGluIGNhc2UgdGhleSB3aXNoIHRvIGFkZCBhbnkgZGV0YWlscyBv biB0aGVpciBvd24gaW1wbGVtZW50YXRpb25zIGFzIHRoZXJlIHdpbGwgYmUgdmFyaWF0aW9uIGJl dHdlZW4gdGhlbS4mbmJzcDsNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0LWxhbmd1YWdl OkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDttc28tZmFyZWFzdC1sYW5ndWFnZTpF Ti1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0LWxhbmd1YWdl OkVOLVVTIj5BbmRyZXc8bzpwPjwvbzpwPjwvc3Bhbj48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6 RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20g MGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLVVTIj5Gcm9tOjwv c3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tVVMiPiBLZW5qaSBCYWhldXggJmx0O2tlbmppYmFoZXV4 QGdvb2dsZS5jb20mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gMjAgSnVseSAyMDIwIDAxOjI3PGJy Pg0KPGI+VG86PC9iPiB0aXJ1bWFsIHJlZGR5ICZsdDtrb25kdGlyQGdtYWlsLmNvbSZndDs8YnI+ DQo8Yj5DYzo8L2I+IE1hcnRpbiBUaG9tc29uICZsdDttdEBsb3dlbnRyb3B5Lm5ldCZndDs7IEFE RCBNYWlsaW5nIGxpc3QgJmx0O2FkZEBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4g UmU6IFtBZGRdIFByYWN0aWNhbCBPYnNlcnZhdGlvbnMgZnJvbSBFbmNyeXB0ZWQgRE5TIERlcGxv eW1lbnRzIGJ5IE5ldHdvcmsgT3BlcmF0b3JzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5JJ2QgbGlrZSB0byBnZXQgYSBjbGVhciBwaWN0dXJlIG9mIGhvdyBw ZXItZGV2aWNlIGZhbWlseS1zYWZlIGZpbHRlcmluZyBpcyB0eXBpY2FsbHkgY29uZmlndXJlZCBp biBhIHBsYWluIElTUCBzZXR1cC48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkkgaW1hZ2luZSB0aGF0IHRoZSBJU1AgcHJvdmlkZWQgcm91dGVyIG9mZmVycyBh IFVJIHRocm91Z2ggd2hpY2ggYSBwYXJlbnQgKGxvZ2dlZCBpbiB1c2VyKSBjb3VsZCBhZGQvcmVt b3ZlIHNwZWNpZmljIGRldmljZXMgdG8gdGhlICZxdW90O2ZhbWlseS1zYWZlOiBlbmFibGVkJnF1 b3Q7IGxpc3QuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPldoaWNoIGluZm9ybWF0aW9uIGlzIGJlaW5nIHVzZWQgdG8gZGlzc29jaWF0ZSB0aGUm bmJzcDsgZGV2aWNlcz88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPldoYXQgZG9lcyB0aGUgcm91dGVyIGRvIGRpZmZlcmVudGx5IGZyb20gdGhlcmUg b24/IFdoZXJlIGRvZXMgdGhlIGZpbHRlcmluZyBhY3R1YWxseSBvY2N1ciwgb24gdGhlIHVwc3Ry ZWFtIHJlc29sdmVyIChkaWZmZXJlbnQgb25lPyk/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYW5rcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gRnJpLCBKdWwgMTcsIDIwMjAgYXQg MTE6NTQgUE0gdGlydW1hbCByZWRkeSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmtvbmR0aXJAZ21haWwu Y29tIj5rb25kdGlyQGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0ND Q0NDQyAxLjBwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21h cmdpbi1yaWdodDowY20iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBN YXJ0aW4sPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPk5vd2FkYXlzIGhvbWUgcm91dGVycyBhcmUgY2FwYWJsZSBvZiBydW5uaW5nIG5ldHdvcmsg c2VjdXJpdHkgc2VydmljZXMuIEZvciBleGFtcGxlLCBETlMgZmlsdGVyaW5nIHRvIGVuZm9yY2Ug TVVEICg8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjODUyMCIgdGFyZ2V0 PSJfYmxhbmsiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM4NTIwPC9hPikmbmJzcDty dWxlcyBmb3IgSW9UIGRldmljZXMsDQogYmxvY2tpbmcgbWFsd2FyZS9waGlzaGluZyBzaXRlcywg cGFyZW50YWwgY29udHJvbCwgYW5vbWFseSBkZXRlY3Rpb24gZXRjLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TUEFVIGFsbG93cyB0aGUgSVNQ IERvSC9Eb1QgcmVzb2x2ZXIgdG8gZW5mb3JjZSBETlMgZmlsdGVyaW5nIGZvciB0aGUgZW50aXJl IGhvbWUgYnV0IGNhbm5vdCBlbmZvcmNlIGRldmljZSBsZXZlbCBmaWx0ZXJpbmcsJm5ic3A7aXNv bGF0ZSBpbmZlY3RlZCBkZXZpY2VzLCBpZGVudGlmeSBsb2NhbCBhdHRhY2tzIGV0Yy48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Q2hlZXJzLDxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LVRpcnU8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPk9uIFRodSwgMTYgSnVsIDIwMjAgYXQgMDQ6NDIsIE1hcnRpbiBUaG9tc29uICZsdDs8YSBo cmVmPSJtYWlsdG86bXRAbG93ZW50cm9weS5uZXQiIHRhcmdldD0iX2JsYW5rIj5tdEBsb3dlbnRy b3B5Lm5ldDwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90 ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRk aW5nOjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowY20i Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgQW5kcmV3LDxicj4NCjxicj4NCllvdXIgZHJhZnQg c2VlbXMgdG8gYmUgbWFraW5nIGEgY2FzZSBmb3Igc3VwcG9ydGluZyBmb3J3YXJkZXJzLCBidXQg SSdtIG5vdCBjbGVhciBvbiB3aGF0IHN1cHBvcnRpbmcgZm9yd2FyZGVycyBsb29rcyBsaWtlLiZu YnNwOyBJIHVuZGVyc3RhbmQgdGhhdCB5b3UgbWlnaHQgbm90IGhhdmUgc3BlY2lmaWMgaWRlYXMg YWJvdXQgd2hhdCB0aGlzIHN1cHBvcnQgbWlnaHQgbG9vayBsaWtlLCBidXQgSSBkb24ndCBzZWUg YW55IHJlYWwgcmVxdWlyZW1lbnRzIGhlcmUNCiBlaXRoZXIuPGJyPg0KPGJyPg0KSXQgd291bGQg cmVhbGx5IGhlbHAgaWYgdGhlIGRyYWZ0IHdvdWxkIGNsZWFybHkgYXJ0aWN1bGF0ZSB3aGF0IHlv dXIgZGVzaXJlZCBvdXRjb21lIGlzLjxicj4NCjxicj4NCkkgbm90ZSB0aGF0IFNQQVUgLSBhcyBk ZXNjcmliZWQgLSBvbmx5IHJlYWxseSBvcGVyYXRlcyB3aGVuIHRoZSBmb3J3YXJkZXIgaGFzIGJl ZW4gY3V0IG91dCBhbHJlYWR5LiZuYnNwOyBJIGRvbid0IGJlbGlldmUgdGhhdCB0aGVyZSBhcmUg bWFueSBDUEUgZGV2aWNlcyB0aGF0IGludGVyY2VwdCB0cmFmZmljIG9uIFVEUCBwb3J0IDUzIHRv IGRvIHRoZWlyIHdvcmssIGJ1dCBpdCBpc24ndCB1bnRoaW5rYWJsZS4mbmJzcDsgSWYgdGhlcmUg YXJlLCB0aG9zZSBhcmUgdGhlDQogb25seSBvbmVzIHRydWx5IGFmZmVjdGVkIGJ5IHRoZSBkZXNj cmliZWQgdXBncmFkZSB0byBlbmNyeXB0ZWQgdHJhbnNwb3J0Ljxicj4NCjxicj4NClRoZXJlIGlz IGEgU1BBVSB1cGdyYWRlIHBhdGggdGhhdCBtaWdodCBjb25jZXJuIHlvdSBtb3JlOjxicj4NCjxi cj4NClF1ZXJ5IHVzaW5nIHRoZSBkZWZhdWx0IHJlc29sdmVyIGZvciBhIG5hbWUgd2hlcmUgdGhl IExIUyBsYWJlbHMgYXJlIHVuaXF1ZSAoYW5kIHRoZXJlZm9yZSB1bmxpa2VseSB0byBiZSBjYWNo ZWQgYW55d2hlcmUpIGFuZCB0aGUgUkhTIGxhYmVscyBpZGVudGlmaWVzIGEgem9uZSB1bmRlciB0 aGUgY29udHJvbCBvZiB0aGUgZW50aXR5IG1ha2luZyB0aGUgcHJvYmUuJm5ic3A7IFRoZSBhdXRo b3JpdGF0aXZlIHB1dHMgdGhlIElQIG9mIHRoZSByZXNvbHZlcg0KIHRoYXQgbWFkZSB0aGUgY2Fs bCBpbiB0aGUgYW5zd2VyLiZuYnNwOyBUaGlzIHByb2JhYmx5IHdvbid0IGJlIGEgcmVjb2duaXph YmxlIGFkZHJlc3MgZm9yIHRoZSByZXNvbHZlciwgYW5kIGl0IGFsbW9zdCBjZXJ0YWlubHkgd29u J3QgYmUgYSBxdWFkLU4gYW55Y2FzdCBhZGRyZXNzLCBidXQgaXQgd2lsbCBpZGVudGlmeSB0aGUg dHJ1ZSByZXNvbHZlciB3aXRoIGZhaXIgYWNjdXJhY3kuJm5ic3A7IFRoZSBjbGllbnQgY2FuIHRo ZW4gZG8gYSBsb29rdXAgYW5kIHVwZ3JhZGUsDQogY3V0dGluZyBvdXQgYW55IGZvcndhcmRlci4m bmJzcDsgKEEgdmFyaWF0aW9uIG9uIHRoaXMgaGFzIHRoZSBhdXRob3JpdGF0aXZlIHBlcmZvcm0g dGhlIGxvb2t1cCwgd2hpY2ggbWlnaHQgYmUgc3VwZXJpb3IgZnJvbSBhIGRlcGxveW1lbnQgcGVy c3BlY3RpdmUgYXMgaXQgY2VudHJhbGl6ZXMgdGhlIGxvb2t1cCB0YWJsZXMuKTxicj4NCjxicj4N CkNoZWVycyw8YnI+DQpNYXJ0aW48YnI+DQo8YnI+DQo8YnI+DQpPbiBUaHUsIEp1bCAxNiwgMjAy MCwgYXQgMDI6NTksIEFuZHJldyBDYW1wbGluZyB3cm90ZTo8YnI+DQomZ3Q7Jm5ic3A7IDxicj4N CiZndDsgKkFERCAqKmFuZCBFRERJICoqR3JvdXAqKnMqPGJyPg0KJmd0OyBUaGlzIGlzIHRvIGxl dCB5b3Uga25vdyB0aGF0IGEgbmV3IEktRCBoYXMgYmVlbiBzdWJtaXR0ZWQgZm9yIDxicj4NCiZn dDsgY29uc2lkZXJhdGlvbiBieSB0aGUgQUREIFdHIHRoYXQgaW5jbHVkZXMgb2JzZXJ2YXRpb25z IHJlZ2FyZGluZyBhIDxicj4NCiZndDsgdmFyaWV0eSBvZiBpbXBsZW1lbnRhdGlvbnMgb2YgcmVj dXJzaXZlIEROUyBjYXBhYmlsaXRpZXMgdGhhdCBhcmUgPGJyPg0KJmd0OyBpbXBvcnRhbnQgdG8g bmV0d29yayBvcGVyYXRvcnMgaW4gdGVybXMgb2YgZGVsaXZlcmluZyBETlMgc2VydmljZXMgdG8g PGJyPg0KJmd0OyB0aGVpciBjdXN0b21lcnMuJm5ic3A7IFRoZSBkb2N1bWVudCBkZWZpbmVzIHBy b2JsZW1zIHRoYXQgbmVlZCB0ZWNobmljYWwgPGJyPg0KJmd0OyBzb2x1dGlvbnMgdG8gYWxsb3cg dGhlIGRlcGxveW1lbnQgb2YgZW5jcnlwdGVkIEROUyBieSB0aGUgbGFyZ2VzdCA8YnI+DQomZ3Q7 IG51bWJlciBvZiBvcGVyYXRvcnMgdG8gdGhlIGxhcmdlc3QgbnVtYmVyIG9mIHVzZXJzIGluIHRo ZSBzaG9ydGVzdCA8YnI+DQomZ3Q7IHBvc3NpYmxlIHRpbWVmcmFtZSB3aXRoIGxpdHRsZSBvciBu byBkaXNydXB0aW9uIHRvIHRoZSB1c2VyIGV4cGVyaWVuY2UsIDxicj4NCiZndDsgaWRlYWxseSBi eSBjbGllbnRzIHVzaW5nIHRoZSDigJxzYW1lIHByb3ZpZGVyIGF1dG8tdXBncmFkZeKAnSBhcHBy b2FjaCA8YnI+DQomZ3Q7IHdoZXJldmVyIHBvc3NpYmxlLjxicj4NCiZndDsmbmJzcDsgPGJyPg0K Jmd0OyBOYW1lOiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ZHJhZnQt Y2FtcGxpbmctb3BlcmF0b3Itb2JzZXJ2YXRpb25zPGJyPg0KJmd0OyBSZXZpc2lvbjombmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDswMDxicj4NCiZndDsgVGl0bGU6Jm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyBQcmFjdGljYWwgT2JzZXJ2YXRpb25zIGZyb20gRW5jcnlwdGVkIERO UyBEZXBsb3ltZW50cyA8YnI+DQomZ3Q7IGJ5IE5ldHdvcmsgT3BlcmF0b3JzPGJyPg0KJmd0OyBE b2N1bWVudCBkYXRlOiZuYnNwOyAyMDIwLTA3LTEzPGJyPg0KJmd0OyBHcm91cDombmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IEluZGl2aWR1YWwgU3VibWlzc2lvbjxicj4NCiZndDsg UGFnZXM6Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyA5PGJyPg0KJmd0OyBVUkw6 Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7PGJyPg0KJmd0 OyBfPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRzL2RyYWZ0LWNh bXBsaW5nLW9wZXJhdG9yLW9ic2VydmF0aW9ucy0wMC50eHRfIiB0YXJnZXQ9Il9ibGFuayI+aHR0 cHM6Ly93d3cuaWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRzL2RyYWZ0LWNhbXBsaW5nLW9wZXJhdG9y LW9ic2VydmF0aW9ucy0wMC50eHRfPC9hPjxicj4NCiZndDsgU3RhdHVzOiZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgPGJyPg0KJmd0OyBfPGEgaHJlZj0iaHR0cHM6Ly9kYXRhdHJh Y2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtY2FtcGxpbmctb3BlcmF0b3Itb2JzZXJ2YXRpb25zL18i IHRhcmdldD0iX2JsYW5rIj5odHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1j YW1wbGluZy1vcGVyYXRvci1vYnNlcnZhdGlvbnMvXzwvYT48YnI+DQomZ3Q7IEh0bWxpemVkOiZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyA8YnI+DQomZ3Q7IF88YSBocmVmPSJodHRwczovL3Rv b2xzLmlldGYub3JnL2h0bWwvZHJhZnQtY2FtcGxpbmctb3BlcmF0b3Itb2JzZXJ2YXRpb25zLTAw XyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1jYW1w bGluZy1vcGVyYXRvci1vYnNlcnZhdGlvbnMtMDBfPC9hPjxicj4NCiZndDsgSHRtbGl6ZWQ6Jm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IDxicj4NCiZndDsgXzxhIGhyZWY9Imh0dHBzOi8vZGF0 YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2h0bWwvZHJhZnQtY2FtcGxpbmctb3BlcmF0b3Itb2JzZXJ2 YXRpb25zXyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZGF0YXRyYWNrZXIuLi5pZXRmLm9yZy9k b2MvaHRtbC9kcmFmdC1jYW1wbGluZy1vcGVyYXRvci1vYnNlcnZhdGlvbnNfPC9hPjxicj4NCiZn dDsmbmJzcDsgPGJyPg0KJmd0OyBXZSBob3BlIHRoYXQgdGhlIGRldGFpbHMgaW4gdGhpcyBkb2N1 bWVudCB3aWxsIGFpZCB0aGUgZGV2ZWxvcG1lbnQgb2YgPGJyPg0KJmd0OyBkaXNjb3ZlcnkgbWVj aGFuaXNtcyBmb3IgRE5TIHJlc29sdmVycyBpbmNsdWRpbmcgdGhvc2UgdXNpbmcgRG9ILiZuYnNw OyA8YnI+DQomZ3Q7IERpc2N1c3Npb24gb2YgaXRzIGNvbnRlbnQgaXMgZW5jb3VyYWdlZCBvbiB0 aGUgSUVURiBBREQgbWFpbGluZyBsaXN0IDxicj4NCiZndDsgPGEgaHJlZj0ibWFpbHRvOl9hZGRA aWV0Zi5vcmdfIj5fYWRkQGlldGYub3JnXzwvYT4sIGVzcGVjaWFsbHkgY29uY2VybmluZyBhbnkg Y29udHJpYnV0aW9ucyBmcm9tIGFkZGl0aW9uYWwNCjxicj4NCiZndDsgbmV0d29yayBvcGVyYXRv cnMgdG8gbWFrZSB0aGUgY29udGVudCBhcyBmdWxseSByZXByZXNlbnRhdGl2ZSBhcyA8YnI+DQom Z3Q7IHBvc3NpYmxlIG9mIHRoZSBzaWduaWZpY2FudCB1c2UgY2FzZXMgZ2xvYmFsbHkuJm5ic3A7 IDxicj4NCiZndDsmbmJzcDsgPGJyPg0KJmd0OyZuYnNwOyA8YnI+DQomZ3Q7ICpBbmRyZXcqKiwg Tm9ybWVuLCBHKippYW5wYW9sbywgQ2hyaXMsIEFsaXN0ZXIgKjxicj4NCiZndDsmbmJzcDsgPGJy Pg0KJmd0OyZuYnNwOyA8YnI+DQomZ3Q7Jm5ic3A7IDxicj4NCiZndDsgLS0gPGJyPg0KJmd0OyBB ZGQgbWFpbGluZyBsaXN0PGJyPg0KJmd0OyA8YSBocmVmPSJtYWlsdG86QWRkQGlldGYub3JnIiB0 YXJnZXQ9Il9ibGFuayI+QWRkQGlldGYub3JnPC9hPjxicj4NCiZndDsgPGEgaHJlZj0iaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hZGQiIHRhcmdldD0iX2JsYW5rIj5odHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZDwvYT48YnI+DQomZ3Q7PGJyPg0K PGJyPg0KLS0gPGJyPg0KQWRkIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpBZGRA aWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5BZGRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0i aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hZGQiIHRhcmdldD0iX2JsYW5r Ij5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZDwvYT48bzpwPjwvbzpw PjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4tLSA8YnI+DQpBZGQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOkFkZEBpZXRm Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPkFkZEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZCIgdGFyZ2V0PSJfYmxhbmsiPmh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWRkPC9hPjxvOnA+PC9vOnA+PC9w Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnIgY2xlYXI9 ImFsbCI+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LS0gPG86cD48 L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9y OiM5OTk5OTkiPktlbmppIEJBSEVVWDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6Izk5OTk5OSI+UHJvZHVjdCBNYW5h Z2VyIC0gQ2hyb21lPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiM5OTk5OTkiPkdvb2dsZSBKYXBhbjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwv aHRtbD4NCg== --_000_LO2P265MB0573719257177D4827C5DCA9C27B0LO2P265MB0573GBRP_-- From nobody Mon Jul 20 07:47:39 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75D4E3A0B77 for ; Mon, 20 Jul 2020 07:47:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KC7ZGosWfXx3 for ; Mon, 20 Jul 2020 07:47:36 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100064.outbound.protection.outlook.com [40.107.10.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE0983A0B5B for ; Mon, 20 Jul 2020 07:47:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=e2LLcO4x5cdiyJ07rfGC3Dn5a9T4t6S1v/NtBVx8UbSnZfeYVU3DCL86sY3vxo33uMd2jyCWZlAdCTRUrj76p1RbdN3snL3VCVyq0Y01afe9Rm58dDTUaV744kWe3KABOULRfBpTHZ/Nl2RjbemTPZ5u0lrkq8QANsDQ9a/LF0EmMHAzkWwlBj3+KRQpKhzvoEMf9HzOQQpQc/txfPuQ5JsqwXU4422v++NdLLt99yIIVT0RxaF3mTeWL6P6/fMT7kmt5LAcI8qb7VCpYJuK4DLOzWQU8m5OCGcWUjc0bdHlLlOl2jzPq68xRTLMer9ckRZJtqa48MJQMOPumAVz4w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Uye9aH4xZx/sWoKREmTcG8+yYesxN6eHinBPo/t2S54=; b=K4wWuaJV5ZFBySzOULyvVbxT2af/IHuy79mP1VLK08OTwZ1hTn9DS5oeWiIRi9rfqDvtj9KE1+IxcbO0L+2DcspHtGYrIgeVLz4c9/CZ4+LonfJjpnhkRuJNdG+8f1mudVfNeScIYluRtDGsBmVTb5lV33QJFlW+tosZifWYiPqQlzED3fRzlLZG9yu0EKTHMcPyj97ZDH7tq418nCErylGAXGQox9TQhJtb32M67YoZI0PCOWSTHqsp9SW/TR9Dy5K4KnIJuU03C/ryeDoob1p4fkB7M2ZT4XaVfL0LYmLD8u/VLlELtA3SxCWY30NrvzyLQUQ16NGHCf+8zibhbw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Uye9aH4xZx/sWoKREmTcG8+yYesxN6eHinBPo/t2S54=; b=gyXTyJOwwFX7nIs+J/7hEdTYwIGmkmFywpRFv2eZL/mwLPR/bZFIsusxmwAakfUCDxNi97bPiQhDyOC58wW0hcak+EHmYonE3rU/SzfBfpy+YWUkpgxRnihCZ5+9wM2ASjhgwo3bSVg4L1Kdh1piOXVyxpxZDZEJ1MSB+vG5IAY= Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:71::15) by LO2P265MB0575.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:64::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.23; Mon, 20 Jul 2020 14:47:32 +0000 Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6]) by LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6%6]) with mapi id 15.20.3195.025; Mon, 20 Jul 2020 14:47:32 +0000 From: Andrew Campling To: Martin Thomson , "add@ietf.org" Thread-Topic: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AdZaxbCvio8C5rmPSDClDuXJa16fuKkQjZ6Q Date: Mon, 20 Jul 2020 14:47:32 +0000 Message-ID: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: lowentropy.net; dkim=none (message not signed) header.d=none;lowentropy.net; dmarc=none action=none header.from=419.consulting; x-originating-ip: [81.141.77.119] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 56c3fda0-7eb8-49fb-ae34-08d82cbbd550 x-ms-traffictypediagnostic: LO2P265MB0575: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 5S7W5dDVuqDQaDtV702HFdMGICWDRTTTunqK/AcGp2C/YDau3pGWRRxPHQtjbHMa4fpFtJXvHM5QXi6EtBuXv9VwUMc5tKQK7I5n+8aDu0IdSKR/yCAKA0lJFntGpX0zO4ML636kZHG+9stkC489/1m8KwECrK65M83pZ/nKvrr7hyea/iK1OrIlsyjbinV7ZheMiX3QGok/60UOSc5mQ0BhVNHu1HZd0Bhb6Amba1J+KSlE7fCu57JWin3DTjHj4zM0ssYTsh9jkgpaXk/+pVdWB9phxFjjEUPp06W1kCr3LMe+cXUcjKYSvTc/E0nEDnY91k68538PTBU+B0LAI8PNaRwtj9KjiF0r+2VDNfzQE7B3kdwHzukG7mhvHA5U x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFTY:; SFS:(136003)(376002)(396003)(346002)(39830400003)(366004)(6506007)(7696005)(26005)(44832011)(186003)(110136005)(508600001)(33656002)(55016002)(9686003)(66946007)(8676002)(2906002)(76116006)(66476007)(66556008)(316002)(64756008)(66446008)(52536014)(83380400001)(5660300002)(86362001)(71200400001)(8936002)(46492007); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: l9Vyj3Ad6Xn2LtvFZuTtusLfv4sVy+tXW5k/3KkYcXVIKNCuvFxkrohUh50X6eF5nnmpYhYkxB3KgjQev8IELxjZjXIfU5wPJw6N/lN6ELVRQDUDM57YsyFVKClo4Dkf6Ji2/jANEeVN58pcAM/wI5eRhChhPD6kVvhADpHYMG7UHw6BB/yGnGXWXPqLfJ5n3Qb1uqx0iHlVfjG2+eRW9ry4XogIzabRBvAtx07O3zF7gMSXs/4F27BnGe2SOVqgxLADDXs42jTD1BPtPKgPkKMU50SU3/1v9Nf/+MPdiiP/UxVJX+gZEjxMC4HTmB8RBmWFikP2nWQj1VTodK5o4jEQgKjWaKqYMg6esq3uubnKANXNjpYFxJdAc6UqO7uhp7BnDaNItA9wDGNtyxvCLlZF4vKYfpbAUEEI0mYW7XMkeqRiSG+BQOvH6ezgRdrqS5Dzb/nRzkvm6qfySJVEx7Mm3ulugU1lg77K2sIWouI= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 56c3fda0-7eb8-49fb-ae34-08d82cbbd550 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jul 2020 14:47:32.1196 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: XmGx00jFFfkPTODwd3SvWTQSCUQDVlM/y6fA+ds9ZjuDYIjUIIVrFiDyEWBltxj0vcPTz+BKTe7m+epFaXLXsnOHXDbGJLuoz9+ocMCbIbQ= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0575 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 14:47:38 -0000 T24gVGh1LCBKdWwgMTYsIDIwMjAsIGF0IDAwOjEyLCBNYXJ0aW4gVGhvbXNvbiA8bXRAbG93ZW50 cm9weS5uZXQ+IHdyb3RlOg0KDQo+IFlvdXIgZHJhZnQgc2VlbXMgdG8gYmUgbWFraW5nIGEgY2Fz ZSBmb3Igc3VwcG9ydGluZyBmb3J3YXJkZXJzLCBidXQgSSdtIG5vdCBjbGVhciBvbiB3aGF0IHN1 cHBvcnRpbmcgZm9yd2FyZGVycyBsb29rcyBsaWtlLiAgSSB1bmRlcnN0YW5kIHRoYXQgeW91IG1p Z2h0IG5vdCBoYXZlIHNwZWNpZmljIGlkZWFzIGFib3V0IHdoYXQgdGhpcyBzdXBwb3J0IG1pZ2h0 IGxvb2sgbGlrZSwgYnV0IEkgZG9uJ3Qgc2VlIGFueSByZWFsIHJlcXVpcmVtZW50cyBoZXJlIGVp dGhlci4NCj4gDQo+IEl0IHdvdWxkIHJlYWxseSBoZWxwIGlmIHRoZSBkcmFmdCB3b3VsZCBjbGVh cmx5IGFydGljdWxhdGUgd2hhdCB5b3VyIGRlc2lyZWQgb3V0Y29tZSBpcy4NCg0KU29ycnkgZm9y IHRoZSBsYWNrIG9mIGNsYXJpdHkuICBUaGUgcHJpbWFyeSBpbnRlbnQgb2YgdGhlIGRvY3VtZW50 IGlzIHRvIHByb3ZpZGUgaW5mb3JtYXRpb24gYXMgd2UgaGF2ZSB0aGUgaW1wcmVzc2lvbiB0aGF0 IGF0IGxlYXN0IHNvbWUgY2xpZW50IGRldmVsb3BlcnMgbWF5IG5vdCBoYXZlIGdvb2QgdmlzaWJp bGl0eSBvZiBjb21tb24gbmV0d29yayBvcGVyYXRvciBhcmNoaXRlY3R1cmVzIGFuZCBwcmFjdGlj ZXMgb3V0c2lkZSBvZiB0aGUgVVMuICBCeSBwcm92aWRpbmcgc3VjaCBjbGFyaXR5IHdlIGhvcGUg dG8gc2VlIGltcGxlbWVudGF0aW9ucyB0aGF0IGFyZSBzeW1wYXRoZXRpYyB0byB0aGUgZW52aXJv bm1lbnQgaW50byB3aGljaCB0aGV5IGFyZSBiZWluZyBkZXBsb3llZCBpbiBvcmRlciB0byBtYXhp bWlzZSB0aGUgY2hhbmNlcyBvZiB3b3JraW5nIGNvcnJlY3RseSwgaWRlYWxseSB2aWEgU1BBVSBh cyBtYW51YWwgY29uZmlndXJhdGlvbiBvZiBETlMgc2V0dGluZ3MgYnkgdGhlIG1ham9yaXR5IG9m IHVzZXJzIHNlZW1zIHVubGlrZWx5LiAgDQoNCkluIGEgbnV0IHNoZWxsLCBhbnkgQUREIHNvbHV0 aW9uIHNob3VsZCBtZWFzdXJlIGl0c2VsZiB0byBzZWUgd2hldGhlciBpdCBtZWV0cyB0aGUgdXNl IGNhc2UgZGVzY3JpYmVkIGluIHRoaXMgZG9jdW1lbnQsIGF0IGxlYXN0IG9uZSBpcyBuZWVkZWQg dGhhdCBkb2VzLiAgDQoNCg0KQW5kcmV3IA0KDQo= From nobody Mon Jul 20 08:03:21 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0BA6B3A0BDA for ; Mon, 20 Jul 2020 08:03:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jh4b3q_FyEMD for ; Mon, 20 Jul 2020 08:03:18 -0700 (PDT) Received: from mail-lj1-x233.google.com (mail-lj1-x233.google.com [IPv6:2a00:1450:4864:20::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A1E03A0BD9 for ; Mon, 20 Jul 2020 08:03:18 -0700 (PDT) Received: by mail-lj1-x233.google.com with SMTP id j11so20584666ljo.7 for ; Mon, 20 Jul 2020 08:03:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=fE9epBgWsSU39Sh78xk7Q/fO7/yRhI6o5zbXrq4vkgg=; b=mGQJiTqeBH2nmSD+hggzNaPVBRabW1zp6RPZgXtr/6OIPGAZn2LkcVykPcJRxDadSN vzh482yhCclh+SaIj7IjwRVDcXIbed/UWeHjHmUNKd0hyi8pptA/5a1QYj6tir+QH68y bipEfm3AMCuwVHu1eCaLqo06uPbRfTKC3BEB6B7oy8WbR3ixaTbslb5tp4Akw/reIk9P v9I1z6yYMtyWNiZaYnKdD1RDc90dO+bV0s+n1fZyRFGIYQeezMEQt+0S6vn3C2ZSMbe+ 1VYZG6nz3lTdYHlPo/27SYLyXvCUwLF4YPrbfAkdNEwC7YMc3M3MnQE4JUVtteQnO986 Os1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=fE9epBgWsSU39Sh78xk7Q/fO7/yRhI6o5zbXrq4vkgg=; b=OVLlz2ZiyzCzIVN7irWB7EmY0X25LNukbof7ohdhHEMYrqz7IimkomKlL1zb2oJlOf Akheb9rcI9M39a34vIy8ejo8mgeyoLMSwNc57RdCisVPqn+84w4lm5/HgE44IJ9JAGoq cAeMWw9J7U/cBgsTTGxiWlrKvUNRlWh1vVpjTWpyMM0OijQGpm+7AcxuNQUpOk23WT54 +D3GZ7YjLTlInV6R/0+nw2MEffloPm7XCfh825hOtv46WypGAFt3uNqtnApMAxmhUwrf T+UOO4e4xvtiUJaY493XhY/W59YpwM4bDikLGbogsvmg2VzAJVbHpIPHVopnuH+O1AtS IccA== X-Gm-Message-State: AOAM533XBv2tyDBsJh2kcAXIm0pbQssPrCyPRNz91C5rtNH2HD3b4Nto 5R8pD5Ln/PREQzfwZwGGBIqb9lQUFBE4RTPDtyG4g6efdj7vEg== X-Google-Smtp-Source: ABdhPJy5bwl87FtZksY2USsfqzwt8BgmIETkNd8JSZo1X6wsmC2PK4rP9cQgLyrdoMLnL/EH/JbnThum3pnFwvIQj5M= X-Received: by 2002:a2e:9dd6:: with SMTP id x22mr10865620ljj.199.1595257395947; Mon, 20 Jul 2020 08:03:15 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: From: Eric Rescorla Date: Mon, 20 Jul 2020 08:02:39 -0700 Message-ID: To: Andrew Campling Cc: Martin Thomson , "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000693f2605aae0ceed" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 15:03:20 -0000 --000000000000693f2605aae0ceed Content-Type: text/plain; charset="UTF-8" Hi Andrew, Ignoring the discovery question for a moment, I guess I'm not entirely clear on what your desired outcome in terms of network topology is. As described in your draft, at present the clients send DNS packets to the forwarder on the CPE, which then selectively forwards queries to the main ISP resolver. However, in a world where the DNS is encrypted, then this would require that the encryption be terminated at the CPE and then re-originated to the ISP resolver, like so: Client <------- TLS --------> CPE <------- TLS --------> ISP Resolver Is that your desired outcome? If so, it seems to come into conflict with your points in S 5.2 about the difficulty of upgrading the CPE. If not, maybe I just don't understand. In either case, perhaps you can elaborate. -Ekr On Mon, Jul 20, 2020 at 7:47 AM Andrew Campling wrote: > On Thu, Jul 16, 2020, at 00:12, Martin Thomson wrote: > > > Your draft seems to be making a case for supporting forwarders, but I'm > not clear on what supporting forwarders looks like. I understand that you > might not have specific ideas about what this support might look like, but > I don't see any real requirements here either. > > > > It would really help if the draft would clearly articulate what your > desired outcome is. > > Sorry for the lack of clarity. The primary intent of the document is to > provide information as we have the impression that at least some client > developers may not have good visibility of common network operator > architectures and practices outside of the US. By providing such clarity > we hope to see implementations that are sympathetic to the environment into > which they are being deployed in order to maximise the chances of working > correctly, ideally via SPAU as manual configuration of DNS settings by the > majority of users seems unlikely. > > In a nut shell, any ADD solution should measure itself to see whether it > meets the use case described in this document, at least one is needed that > does. > > > Andrew > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000693f2605aae0ceed Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Andrew,

Ignoring the discovery question for a mo= ment, I guess I'm not entirely
clear on what your desired outcome in= terms of network topology is.

As described in your draft, at presen= t the clients send DNS packets to
the forwarder on the CPE, which then s= electively forwards queries to
the main ISP resolver. However, in a worl= d where the DNS is encrypted,
then this would require that the encryptio= n be terminated at the
CPE and then re-originated to the ISP resolver, l= ike so:


Client <------- TLS --------> =C2=A0CPE =C2=A0<= ------- TLS --------> ISP Resolver

Is that your desired outcome? = If so, it seems to come into conflict
with your points in S 5.2 about th= e difficulty of upgrading the CPE.
If not, maybe I just don't unders= tand. In either case, perhaps you
can elaborate.

-Ekr


=

On Mon, Jul 20, 2020 at 7:47 AM Andrew Campling <andrew.campling@419= .consulting> wrote:
On Thu, Jul 16, 2020, at 00:12, Martin Thomson <mt@lowentropy.net> wrote:

> Your draft seems to be making a case for supporting forwarders, but I&= #39;m not clear on what supporting forwarders looks like.=C2=A0 I understan= d that you might not have specific ideas about what this support might look= like, but I don't see any real requirements here either.
>
> It would really help if the draft would clearly articulate what your d= esired outcome is.

Sorry for the lack of clarity.=C2=A0 The primary intent of the document is = to provide information as we have the impression that at least some client = developers may not have good visibility of common network operator architec= tures and practices outside of the US.=C2=A0 By providing such clarity we h= ope to see implementations that are sympathetic to the environment into whi= ch they are being deployed in order to maximise the chances of working corr= ectly, ideally via SPAU as manual configuration of DNS settings by the majo= rity of users seems unlikely.=C2=A0

In a nut shell, any ADD solution should measure itself to see whether it me= ets the use case described in this document, at least one is needed that do= es.=C2=A0


Andrew

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000693f2605aae0ceed-- From nobody Mon Jul 20 08:07:57 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5322B3A0BF8; Mon, 20 Jul 2020 08:07:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QkqwvDNayQYh; Mon, 20 Jul 2020 08:07:54 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6446F3A0BFA; Mon, 20 Jul 2020 08:07:54 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id EE523280607; Mon, 20 Jul 2020 17:07:51 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id E728E2806F7; Mon, 20 Jul 2020 17:07:51 +0200 (CEST) Received: from relay01.prive.nic.fr (unknown [10.1.50.11]) by mx4.nic.fr (Postfix) with ESMTP id DF56A280607; Mon, 20 Jul 2020 17:07:51 +0200 (CEST) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id D350C642C582; Mon, 20 Jul 2020 17:07:51 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id ABE23403D9; Mon, 20 Jul 2020 17:07:51 +0200 (CEST) Date: Mon, 20 Jul 2020 17:07:51 +0200 From: Stephane Bortzmeyer To: mohamed.boucadair@orange.com Cc: "ADD Mailing list (add@ietf.org)" , "draft-btw-add-home@ietf.org" Message-ID: <20200720150751.GA14985@nic.fr> References: <159438950508.10283.6338787113671554159@ietfa.amsl.com> <23877_1594815149_5F0EF2AD_23877_384_1_787AE7BB302AE849A7480A190F8B9330314F9783@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <23877_1594815149_5F0EF2AD_23877_384_1_787AE7BB302AE849A7480A190F8B9330314F9783@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.000002, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] TR: I-D Action: draft-btw-add-home-07.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 15:07:56 -0000 On Wed, Jul 15, 2020 at 12:12:28PM +0000, mohamed.boucadair@orange.com wrote a message of 100 lines which said: > * use the well-known URI to learn the supported services from the > * DHCP/RA discovered servers. clarify that DHCP/RA discovered ADN > * takes precedence over special-use domain name. add a discussion > * to the Security Considerations section to cover some internal > * attacks. I just want to be sure I understand how the client is supposed to discover the path in the DoH URL. If I get section 5 correctly, the workflow is: 1) get the IP address of the DoH resolver, say 2008:db8:1::d0 2) request https://[2008:db8:1::d0]/.well-known/resinfo, which gives you several URI templates 3) use one of the templates for the regular DoH requests. Is that correct? Also, since today, few CAs allow certificates based on IP addresses, the advice in section 4 "DoH/DoT servers SHOULD be located by their address literals rather than their names" eliminates small DoE resolvers and leave only the big ones, who can have (like Google and Cloudflare) IP-based certificates. Last thing, this proposal, like most (all?) ADD proposals is silent about the risks of using the "default" (indicated by the access network) resolver. If people need DoE, this is because they do not trust this resolver, because it lies or because it logs (or both). This deserves a warning. Section 9 mentions only the risks of a third-party hijacking DHCP or a similar protocol, not the risks of the default resolver, except in a limited way in the paragrapĥ "The use of DoH/DoT also depends on the user's policies." Speaking of this, the draft only mentions lying resolvers as providing a (presumably useful) service (I quote: "ISPs use DNS to provide additional services such as (but not limited to) malware filtering, parental control, or VoD (Video on Demand) optimization." It should mention censorship as well. At least add "ad blocking" in the list of services . (Personal opinion: I don't see the point of automatic discovery of a secure resolver but it is a general ADD problem, not specific to this draft.) From nobody Mon Jul 20 08:27:56 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6BAA3A0D8E for ; Mon, 20 Jul 2020 08:27:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YOZOkm1Acif9 for ; Mon, 20 Jul 2020 08:27:49 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97FD23A0D2D for ; Mon, 20 Jul 2020 08:27:41 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 01638280172; Mon, 20 Jul 2020 17:27:40 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id EF3E02806F7; Mon, 20 Jul 2020 17:27:39 +0200 (CEST) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id E7A1B280172; Mon, 20 Jul 2020 17:27:39 +0200 (CEST) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id DA297642C582; Mon, 20 Jul 2020 17:27:39 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id B2921403D9; Mon, 20 Jul 2020 17:27:39 +0200 (CEST) Date: Mon, 20 Jul 2020 17:27:39 +0200 From: Stephane Bortzmeyer To: Tommy Pauly Cc: ADD Mailing list Message-ID: <20200720152739.GA17509@nic.fr> References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.211542, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] Fwd: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 15:27:55 -0000 On Mon, Jul 13, 2020 at 02:13:06PM -0700, Tommy Pauly wrote a message of 221 lines which said: > We’ve published a revision of draft-pauly-add-resolver-discovery. This revision incorporates various pieces of feedback we’ve received. Specifically, the changes include: I'm a bit surprised by the use of PvD which, I thought, were meant for local configuration, not for remote domains but why not. > Note that clients MUST NOT accept designations for effective top- > level domains (eTLDs), such as ".com". I think I understand why, but it creates a problem for .corp (also called .brand) TLD. I don't see why the Example Corporation could not designate a resolver for their ".corp" TLD .example. (A full solution of this problem would probably require to resurrect the Dbound working group.) From nobody Mon Jul 20 15:22:11 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF92C3A103D for ; Mon, 20 Jul 2020 15:22:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qjDumjNh69zI for ; Mon, 20 Jul 2020 15:22:08 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100057.outbound.protection.outlook.com [40.107.10.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4823B3A103A for ; Mon, 20 Jul 2020 15:22:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=E+tNIN4M7NVNdrP4Vs4OzNKmqUWsEyh877FiNW/e8EAGT4piR9lwfo/MGPqL0fmqRDTq4caufFOZTFOXbqHtLUyvbkwdTQ5QKU/gPhYv+oY3j+LQdc/5LIBLNYVdlzht+EvoX6h1sMV/vLBHSWb1Z2kPk8NVv328oFEhE+nnOv0xvpLKUYfFOlZgzpcF2IK93UECOYbfZ0gpWcPUF4FfR5bxBlR2IFencs4QzOTJ7w7ODniycYIvjjvjuks3XBOtr9hPqKK5dKEfx8GmQ5+I6XdZUXOXJpUlVFfFfBfml5HxQARood+sriFAmaUKR6j4oNCOtp36FGTSV+886OOIHw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7NZerKS1Qo/5Rj+QPpFR14lpkdOBEMFwkbRwSl/ShHY=; b=eM/eK6TYV30zMuyH9jo7iktG0Nbcy/mJ8Hq9qliJHIvlQxBGlsUC2ex0JbM0tTp3gScIITAkerBct/rk7F7KJ3FAifD1lD5KuIdtpYG8gOC6bwJiCZvaqGyiQ+S8qM6lSl9j6eWpHPnd4d6DZD69DjnnJaOtHI12jdUw0xIhIROwo+DnVxYK7S/7HA/OGrj/yT5duOW+bZSowfEwJ8iVLvFNqKvabiWsJ5UFLzxZnQ4ndIXirL67mPGa9U7bBSACJxFogkgE2u7DDitSipQ9iABozHLmB00FO66ABFc4qXdfEllewny4gfZW4eGVYA3Q4ZgaaVS9VC4cSONG0fYW2g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7NZerKS1Qo/5Rj+QPpFR14lpkdOBEMFwkbRwSl/ShHY=; b=e4Kox7/Nw/lwe0u1lVlzuv9RD3zsTTGWjEpi0YHw/qyk1/2XqW6ofapz3nnfCm3r2qWmIEO2fEBM3BkV6i8NBWo+4ehN+aoCsDMccageCauQgYp7mVSmXaPSOaqIOwuSUoFtubiFKCz3q4hmxoZLIWn9WlOIpucWi+Q9jJmhxo4= Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:71::15) by LNXP265MB1419.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:7d::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.23; Mon, 20 Jul 2020 22:22:05 +0000 Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6]) by LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6%6]) with mapi id 15.20.3195.025; Mon, 20 Jul 2020 22:22:05 +0000 From: Andrew Campling To: Eric Rescorla CC: Martin Thomson , "add@ietf.org" Thread-Topic: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AQHWXqbmx2T6tR8Z9kGodk+PQJE0kKkRA1CQ Date: Mon, 20 Jul 2020 22:22:05 +0000 Message-ID: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: rtfm.com; dkim=none (message not signed) header.d=none;rtfm.com; dmarc=none action=none header.from=419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:a073:f924:a34f:6f80] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 75efe04a-4df8-4cc2-3539-08d82cfb555b x-ms-traffictypediagnostic: LNXP265MB1419: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: A7+6XA3JJ1VlTX/Vfifyz2eU3RcRYWR3NQf2beEznTz3vgF4TIBmeKcyT258s5gVBYHIjTRR7LdHp+CKPvPjj+yNfC8kZpv/cW87/kwgdXomeDzRUAskq25JHArKvXOMYYgD4AzKDhaeVd6fYZ4M1uHI8kmTn8Wi10ualc8QQYN25+s2MnWEd28G4YOktTW31I7PI4sF+XkAd9jVCpxLu+a63ch9hbgzEY6IU9WlAOUlFd/kn/gk55ydgDTA393oFMpMIFGOUw36gumyR95XTeV9si1fEUNaaHgfUU7RVFTbInkKqEGhmB5/Q2nidrwNCsfmFu3p5d4L6CLna3vuBd9snw+H4euPDJzlSsodcUcEIcmMtx5s8j+6ekPoqASRzmghT7T4vJ4sEvLxnxPgfV+AZrCrXtXEap1xYWBZC7TNCvW9AU0JsNR2PpuqOe5Hg1ogS8dUQZqB+xE7lbE7kg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFTY:; SFS:(396003)(136003)(376002)(366004)(346002)(39830400003)(76116006)(4326008)(8936002)(9686003)(166002)(8676002)(83380400001)(6916009)(7696005)(966005)(2906002)(55016002)(5660300002)(6506007)(52536014)(44832011)(86362001)(71200400001)(33656002)(53546011)(186003)(316002)(66946007)(508600001)(66476007)(64756008)(66556008)(54906003)(66446008)(46492007); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: FCdzNG45r4yaowyst2M4/Oqw2exlrJcV0UBIvOjd6bDGkpp7P6gCJ/wziHbFPMntC2mdMUcNR4a4oIMNYJc5E9frWdmITgLRsWawlXGDagDjSTkzY2sCpIeQekcinrGWFmXiWnvO5lv4J5U6zkNzwpAd1+GSCdfJSX2CGVY2sst8lvQ4sdB/gwgAVYp0lRuiPOfqCWeP9EvOkQei4lZOp77MN4XNWM441zNWMqAxkLcWGZegBea1EYM6lqU+ORBzPYuRD+dA5YZ/ZRIRSQhgthi22p7XbA68hWLW9j6J0PO+2MEYkWM81rxsz1KBvVwd5YdtGty+Ak7i7Pc3K0Hw2atCpwA522BUkSw6na7ks4cPDf8nALKccCCFgZYzYQb5LzcSOzAbTeHEgq48Kp4IkWgZf1dQOtpM2DEHXi5BbI3VbLhrpIfr63Lf36kDvtLn/haC9lmgpIdwUB0CJTFa4fa6jf8MTgqtEn65zl+ydfw7xvovc0yfRiDnoLppRpt/088XUyqXQtwmvWzCXlb+DxXm2/WycVXDUj3BprPY8QSppOekEpEfFzW0VwwF1vmH x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_LO2P265MB0573B4514852D705D2209EB0C27B0LO2P265MB0573GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 75efe04a-4df8-4cc2-3539-08d82cfb555b X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jul 2020 22:22:05.2969 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: +X3/AJosVEf+q6bEHWIq6eTSWb58iTxVorKScWlqBHy9XOLv86GYj8jiAN6eFi2+j5QwfzdGH9B8QdVF0ou2DrgAd1reCAf8mPVsJTQq2N8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LNXP265MB1419 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 22:22:11 -0000 --_000_LO2P265MB0573B4514852D705D2209EB0C27B0LO2P265MB0573GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RWtyDQpUbyBjbGFyaWZ5LCB0aGVyZSBhcmUgdHdvIGlzc3VlcyB0byBvdmVyY29tZSBoZXJlLCAo aSkgdXNlIG9mIFJGQzE5MTggcHJpdmF0ZSBhZGRyZXNzZXMgYnkgdGhlIENQRSAodG8gZmFjaWxp dGF0ZSBTUEFVKSBhbmQgKGlpKSBzdXBwb3J0IGZvciBETlMgZm9yd2FyZGVycyB0byBtYWludGFp biB0aGUgZnVsbCBmdW5jdGlvbmFsaXR5IHByb3ZpZGVkIGJ5IG5ldHdvcmsgb3BlcmF0b3JzIHRo YXQgaXMgZGVzY3JpYmVkIGluIHRoZSBkb2N1bWVudC4gIFRoZSBkZXNpcmVkIGVuZCBzdGF0ZSBp cyBhcyB5b3UgZGVzY3JpYmU6DQoNCkNsaWVudCAgPC0tLS0tLS0gVExTIC0tLS0tLS0tPiAgQ1BF ICA8LS0tLS0tLSBUTFMgLS0tLS0tLS0+ICBJU1AgUmVzb2x2ZXINCg0KV2hpbHN0IGl0IHdvdWxk IGJlIGlkZWFsIHRvIGRlYWwgd2l0aCBib3RoIG9mIHRoZSBhYm92ZSBpc3N1ZXMgc2ltdWx0YW5l b3VzbHksIHByYWdtYXRpY2FsbHkgaXQgbWF5IGJlIG5lY2Vzc2FyeSB0byBkZWFsIHdpdGggdGhl bSBzZXF1ZW50aWFsbHkgZ2l2ZW4gdGhlIHBvdGVudGlhbCBmb3IgZGVsYXlzIGluIHVwZ3JhZGlu ZyBDUEUgc29mdHdhcmUuICBTaW5jZSB0aGVyZSBhcmUgYWxyZWFkeSBzb21lIHByb3Bvc2VkIGRp c2NvdmVyeSBtZXRob2RzIHRoYXQgZGVhbCB3aXRoIHRoZSBwcml2YXRlIGFkZHJlc3NlcywgaXQg Y291bGQgbWFrZSBzZW5zZSBmb3IgdG8gaW1wbGVtZW50IGEgdHdvLXN0ZXAgc29sdXRpb24gdGhh dCBmaXJzdCBzb2x2ZXMgdGhlIHByaXZhdGUgYWRkcmVzcyBpc3N1ZSBpbiB0aGUgc2hvcnQtdGVy bSB3aGlsc3QgdGhlIENQRSBzb2Z0d2FyZSB1cGdyYWRlIGlzIGRlcGxveWVkLiAgVGhpcyB3b3Vs ZCBhdCBsZWFzdCBtYWludGFpbiBzdXBwb3J0IGZvciB0aGUgdXNlcuKAmXMgY2hvc2VuIHJlc29s dmVyIHZpYSBlbmNyeXB0ZWQgRE5TIHVzaW5nIFNQQVUgd2hpbHN0IGEgQ1BFIHNvZnR3YXJlIHVw Z3JhZGUgaXMgUUHigJlkIGJ5IHRoZSBuZXR3b3JrIG9wZXJhdG9yIGFuZCB0aGVuIGRlcGxveWVk Lg0KDQpPZiBjb3Vyc2Ugb3RoZXJzIG1heSB0aGluayBpdCBiZXR0ZXIgdG8gZ28gd2l0aCBhIHNp bmdsZS1zdGVwIGFwcHJvYWNoIHRoYXQgdXBncmFkZXMgdGhlIENQRSBzb2Z0d2FyZSB0byBtYWlu dGFpbiBzdXBwb3J0IGZvciBETlMgZm9yd2FyZGVycyBhbmQgZGVhbHMgd2l0aCB0aGUgcHJpdmF0 ZSBhZGRyZXNzIGlzc3VlIGZvciBTUEFVIGF0IHRoZSBzYW1lIHRpbWUuICBIb3dldmVyLCBzaW5j ZSB0aGUgdGltZWZyYW1lIGZvciB0aGlzIHdpbGwgYmUgbmVjZXNzYXJpbHkgbG9uZ2VyIGZvciBt YW55IHVzZXJzLCBteSBhc3N1bXB0aW9uIGlzIHRoYXQgdGhlIHByZWZlcmVuY2UgZm9yIG1vc3Qg d291bGQgYmUgdG8gZW5sYXJnZSB0aGUgcG90ZW50aWFsIHBvb2wgb2YgZW5jcnlwdGVkIEROUyB1 c2VycyBhcyBxdWlja2x5IGFzIHBvc3NpYmxlLg0KDQpEb2VzIHRoaXMgaGVscD8NCg0KDQpBbmRy ZXcNCg0KDQpGcm9tOiBFcmljIFJlc2NvcmxhIDxla3JAcnRmbS5jb20+DQpTZW50OiAyMCBKdWx5 IDIwMjAgMTY6MDMNClRvOiBBbmRyZXcgQ2FtcGxpbmcgPGFuZHJldy5jYW1wbGluZ0A0MTkuY29u c3VsdGluZz4NCkNjOiBNYXJ0aW4gVGhvbXNvbiA8bXRAbG93ZW50cm9weS5uZXQ+OyBhZGRAaWV0 Zi5vcmcNClN1YmplY3Q6IFJlOiBbQWRkXSBQcmFjdGljYWwgT2JzZXJ2YXRpb25zIGZyb20gRW5j cnlwdGVkIEROUyBEZXBsb3ltZW50cyBieSBOZXR3b3JrIE9wZXJhdG9ycw0KDQpIaSBBbmRyZXcs DQoNCklnbm9yaW5nIHRoZSBkaXNjb3ZlcnkgcXVlc3Rpb24gZm9yIGEgbW9tZW50LCBJIGd1ZXNz IEknbSBub3QgZW50aXJlbHkNCmNsZWFyIG9uIHdoYXQgeW91ciBkZXNpcmVkIG91dGNvbWUgaW4g dGVybXMgb2YgbmV0d29yayB0b3BvbG9neSBpcy4NCg0KQXMgZGVzY3JpYmVkIGluIHlvdXIgZHJh ZnQsIGF0IHByZXNlbnQgdGhlIGNsaWVudHMgc2VuZCBETlMgcGFja2V0cyB0bw0KdGhlIGZvcndh cmRlciBvbiB0aGUgQ1BFLCB3aGljaCB0aGVuIHNlbGVjdGl2ZWx5IGZvcndhcmRzIHF1ZXJpZXMg dG8NCnRoZSBtYWluIElTUCByZXNvbHZlci4gSG93ZXZlciwgaW4gYSB3b3JsZCB3aGVyZSB0aGUg RE5TIGlzIGVuY3J5cHRlZCwNCnRoZW4gdGhpcyB3b3VsZCByZXF1aXJlIHRoYXQgdGhlIGVuY3J5 cHRpb24gYmUgdGVybWluYXRlZCBhdCB0aGUNCkNQRSBhbmQgdGhlbiByZS1vcmlnaW5hdGVkIHRv IHRoZSBJU1AgcmVzb2x2ZXIsIGxpa2Ugc286DQoNCg0KQ2xpZW50IDwtLS0tLS0tIFRMUyAtLS0t LS0tLT4gIENQRSAgPC0tLS0tLS0gVExTIC0tLS0tLS0tPiBJU1AgUmVzb2x2ZXINCg0KSXMgdGhh dCB5b3VyIGRlc2lyZWQgb3V0Y29tZT8gSWYgc28sIGl0IHNlZW1zIHRvIGNvbWUgaW50byBjb25m bGljdA0Kd2l0aCB5b3VyIHBvaW50cyBpbiBTIDUuMiBhYm91dCB0aGUgZGlmZmljdWx0eSBvZiB1 cGdyYWRpbmcgdGhlIENQRS4NCklmIG5vdCwgbWF5YmUgSSBqdXN0IGRvbid0IHVuZGVyc3RhbmQu IEluIGVpdGhlciBjYXNlLCBwZXJoYXBzIHlvdQ0KY2FuIGVsYWJvcmF0ZS4NCg0KLUVrcg0KDQoN Cg0KT24gTW9uLCBKdWwgMjAsIDIwMjAgYXQgNzo0NyBBTSBBbmRyZXcgQ2FtcGxpbmcgPGFuZHJl dy5jYW1wbGluZ0A0MTkuY29uc3VsdGluZzxtYWlsdG86YW5kcmV3LmNhbXBsaW5nQDQxOS5jb25z dWx0aW5nPj4gd3JvdGU6DQpPbiBUaHUsIEp1bCAxNiwgMjAyMCwgYXQgMDA6MTIsIE1hcnRpbiBU aG9tc29uIDxtdEBsb3dlbnRyb3B5Lm5ldDxtYWlsdG86bXRAbG93ZW50cm9weS5uZXQ+PiB3cm90 ZToNCg0KPiBZb3VyIGRyYWZ0IHNlZW1zIHRvIGJlIG1ha2luZyBhIGNhc2UgZm9yIHN1cHBvcnRp bmcgZm9yd2FyZGVycywgYnV0IEknbSBub3QgY2xlYXIgb24gd2hhdCBzdXBwb3J0aW5nIGZvcndh cmRlcnMgbG9va3MgbGlrZS4gIEkgdW5kZXJzdGFuZCB0aGF0IHlvdSBtaWdodCBub3QgaGF2ZSBz cGVjaWZpYyBpZGVhcyBhYm91dCB3aGF0IHRoaXMgc3VwcG9ydCBtaWdodCBsb29rIGxpa2UsIGJ1 dCBJIGRvbid0IHNlZSBhbnkgcmVhbCByZXF1aXJlbWVudHMgaGVyZSBlaXRoZXIuDQo+DQo+IEl0 IHdvdWxkIHJlYWxseSBoZWxwIGlmIHRoZSBkcmFmdCB3b3VsZCBjbGVhcmx5IGFydGljdWxhdGUg d2hhdCB5b3VyIGRlc2lyZWQgb3V0Y29tZSBpcy4NCg0KU29ycnkgZm9yIHRoZSBsYWNrIG9mIGNs YXJpdHkuICBUaGUgcHJpbWFyeSBpbnRlbnQgb2YgdGhlIGRvY3VtZW50IGlzIHRvIHByb3ZpZGUg aW5mb3JtYXRpb24gYXMgd2UgaGF2ZSB0aGUgaW1wcmVzc2lvbiB0aGF0IGF0IGxlYXN0IHNvbWUg Y2xpZW50IGRldmVsb3BlcnMgbWF5IG5vdCBoYXZlIGdvb2QgdmlzaWJpbGl0eSBvZiBjb21tb24g bmV0d29yayBvcGVyYXRvciBhcmNoaXRlY3R1cmVzIGFuZCBwcmFjdGljZXMgb3V0c2lkZSBvZiB0 aGUgVVMuICBCeSBwcm92aWRpbmcgc3VjaCBjbGFyaXR5IHdlIGhvcGUgdG8gc2VlIGltcGxlbWVu dGF0aW9ucyB0aGF0IGFyZSBzeW1wYXRoZXRpYyB0byB0aGUgZW52aXJvbm1lbnQgaW50byB3aGlj aCB0aGV5IGFyZSBiZWluZyBkZXBsb3llZCBpbiBvcmRlciB0byBtYXhpbWlzZSB0aGUgY2hhbmNl cyBvZiB3b3JraW5nIGNvcnJlY3RseSwgaWRlYWxseSB2aWEgU1BBVSBhcyBtYW51YWwgY29uZmln dXJhdGlvbiBvZiBETlMgc2V0dGluZ3MgYnkgdGhlIG1ham9yaXR5IG9mIHVzZXJzIHNlZW1zIHVu bGlrZWx5Lg0KDQpJbiBhIG51dCBzaGVsbCwgYW55IEFERCBzb2x1dGlvbiBzaG91bGQgbWVhc3Vy ZSBpdHNlbGYgdG8gc2VlIHdoZXRoZXIgaXQgbWVldHMgdGhlIHVzZSBjYXNlIGRlc2NyaWJlZCBp biB0aGlzIGRvY3VtZW50LCBhdCBsZWFzdCBvbmUgaXMgbmVlZGVkIHRoYXQgZG9lcy4NCg0KDQpB bmRyZXcNCg0KLS0NCkFkZCBtYWlsaW5nIGxpc3QNCkFkZEBpZXRmLm9yZzxtYWlsdG86QWRkQGll dGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hZGQNCg== --_000_LO2P265MB0573B4514852D705D2209EB0C27B0LO2P265MB0573GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28t c3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgltc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUzt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7 c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBw dDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+ PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBz cGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4 bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIg ZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4N Cjxib2R5IGxhbmc9IkVOLUdCIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xh c3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+RWtyPG86cD48L286 cD48L3NwYW4+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTIuMHB0O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5UbyBjbGFyaWZ5LCB0aGVy ZSBhcmUgdHdvIGlzc3VlcyB0byBvdmVyY29tZSBoZXJlLCAoaSkgdXNlIG9mIFJGQzE5MTggcHJp dmF0ZSBhZGRyZXNzZXMgYnkgdGhlIENQRSAodG8gZmFjaWxpdGF0ZSBTUEFVKSBhbmQgKGlpKSBz dXBwb3J0IGZvciBETlMgZm9yd2FyZGVycyB0byBtYWludGFpbiB0aGUgZnVsbCBmdW5jdGlvbmFs aXR5DQogcHJvdmlkZWQgYnkgbmV0d29yayBvcGVyYXRvcnMgdGhhdCBpcyBkZXNjcmliZWQgaW4g dGhlIGRvY3VtZW50LiZuYnNwOyBUaGUgZGVzaXJlZCBlbmQgc3RhdGUgaXMgYXMgeW91IGRlc2Ny aWJlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5DbGllbnQgJm5ic3A7 Jmx0Oy0tLS0tLS0gVExTIC0tLS0tLS0tJmd0OyAmbmJzcDtDUEUgJm5ic3A7Jmx0Oy0tLS0tLS0g VExTIC0tLS0tLS0tJmd0OyAmbmJzcDtJU1AgUmVzb2x2ZXI8c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7bXNv LWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJl YXN0LWxhbmd1YWdlOkVOLVVTIj5XaGlsc3QgaXQgd291bGQgYmUgaWRlYWwgdG8gZGVhbCB3aXRo IGJvdGggb2YgdGhlIGFib3ZlIGlzc3VlcyBzaW11bHRhbmVvdXNseSwgcHJhZ21hdGljYWxseSBp dCBtYXkgYmUgbmVjZXNzYXJ5IHRvIGRlYWwgd2l0aCB0aGVtIHNlcXVlbnRpYWxseSBnaXZlbiB0 aGUgcG90ZW50aWFsIGZvciBkZWxheXMgaW4NCiB1cGdyYWRpbmcgQ1BFIHNvZnR3YXJlLiZuYnNw OyBTaW5jZSB0aGVyZSBhcmUgYWxyZWFkeSBzb21lIHByb3Bvc2VkIGRpc2NvdmVyeSBtZXRob2Rz IHRoYXQgZGVhbCB3aXRoIHRoZSBwcml2YXRlIGFkZHJlc3NlcywgaXQgY291bGQgbWFrZSBzZW5z ZSBmb3IgdG8gaW1wbGVtZW50IGEgdHdvLXN0ZXAgc29sdXRpb24gdGhhdCBmaXJzdCBzb2x2ZXMg dGhlIHByaXZhdGUgYWRkcmVzcyBpc3N1ZSBpbiB0aGUgc2hvcnQtdGVybSB3aGlsc3QgdGhlIENQ RSBzb2Z0d2FyZQ0KIHVwZ3JhZGUgaXMgZGVwbG95ZWQuJm5ic3A7IFRoaXMgd291bGQgYXQgbGVh c3QgbWFpbnRhaW4gc3VwcG9ydCBmb3IgdGhlIHVzZXLigJlzIGNob3NlbiByZXNvbHZlciB2aWEg ZW5jcnlwdGVkIEROUyB1c2luZyBTUEFVIHdoaWxzdCBhIENQRSBzb2Z0d2FyZSB1cGdyYWRlIGlz IFFB4oCZZCBieSB0aGUgbmV0d29yayBvcGVyYXRvciBhbmQgdGhlbiBkZXBsb3llZC4mbmJzcDsN CjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQ7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPk9mIGNvdXJz ZSBvdGhlcnMgbWF5IHRoaW5rIGl0IGJldHRlciB0byBnbyB3aXRoIGEgc2luZ2xlLXN0ZXAgYXBw cm9hY2ggdGhhdCB1cGdyYWRlcyB0aGUgQ1BFIHNvZnR3YXJlIHRvIG1haW50YWluIHN1cHBvcnQg Zm9yIEROUyBmb3J3YXJkZXJzIGFuZCBkZWFscyB3aXRoIHRoZSBwcml2YXRlIGFkZHJlc3MgaXNz dWUNCiBmb3IgU1BBVSBhdCB0aGUgc2FtZSB0aW1lLiZuYnNwOyBIb3dldmVyLCBzaW5jZSB0aGUg dGltZWZyYW1lIGZvciB0aGlzIHdpbGwgYmUgbmVjZXNzYXJpbHkgbG9uZ2VyIGZvciBtYW55IHVz ZXJzLCBteSBhc3N1bXB0aW9uIGlzIHRoYXQgdGhlIHByZWZlcmVuY2UgZm9yIG1vc3Qgd291bGQg YmUgdG8gZW5sYXJnZSB0aGUgcG90ZW50aWFsIHBvb2wgb2YgZW5jcnlwdGVkIEROUyB1c2VycyBh cyBxdWlja2x5IGFzIHBvc3NpYmxlLiZuYnNwOw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7bXNvLWZhcmVh c3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0LWxh bmd1YWdlOkVOLVVTIj5Eb2VzIHRoaXMgaGVscD88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDttc28tZmFyZWFz dC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7bXNvLWZhcmVhc3Qt bGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvYj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDttc28tZmFyZWFz dC1sYW5ndWFnZTpFTi1VUyI+QW5kcmV3PG86cD48L286cD48L3NwYW4+PC9iPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0 LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDttc28tZmFyZWFzdC1sYW5n dWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNt IDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tVVMiPkZy b206PC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1VUyI+IEVyaWMgUmVzY29ybGEgJmx0O2VrckBy dGZtLmNvbSZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiAyMCBKdWx5IDIwMjAgMTY6MDM8YnI+DQo8 Yj5Ubzo8L2I+IEFuZHJldyBDYW1wbGluZyAmbHQ7YW5kcmV3LmNhbXBsaW5nQDQxOS5jb25zdWx0 aW5nJmd0Ozxicj4NCjxiPkNjOjwvYj4gTWFydGluIFRob21zb24gJmx0O210QGxvd2VudHJvcHku bmV0Jmd0OzsgYWRkQGlldGYub3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbQWRkXSBQcmFj dGljYWwgT2JzZXJ2YXRpb25zIGZyb20gRW5jcnlwdGVkIEROUyBEZXBsb3ltZW50cyBieSBOZXR3 b3JrIE9wZXJhdG9yczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij5IaSBBbmRyZXcsPGJyPg0KPGJyPg0KSWdu b3JpbmcgdGhlIGRpc2NvdmVyeSBxdWVzdGlvbiBmb3IgYSBtb21lbnQsIEkgZ3Vlc3MgSSdtIG5v dCBlbnRpcmVseTxicj4NCmNsZWFyIG9uIHdoYXQgeW91ciBkZXNpcmVkIG91dGNvbWUgaW4gdGVy bXMgb2YgbmV0d29yayB0b3BvbG9neSBpcy48YnI+DQo8YnI+DQpBcyBkZXNjcmliZWQgaW4geW91 ciBkcmFmdCwgYXQgcHJlc2VudCB0aGUgY2xpZW50cyBzZW5kIEROUyBwYWNrZXRzIHRvPGJyPg0K dGhlIGZvcndhcmRlciBvbiB0aGUgQ1BFLCB3aGljaCB0aGVuIHNlbGVjdGl2ZWx5IGZvcndhcmRz IHF1ZXJpZXMgdG88YnI+DQp0aGUgbWFpbiBJU1AgcmVzb2x2ZXIuIEhvd2V2ZXIsIGluIGEgd29y bGQgd2hlcmUgdGhlIEROUyBpcyBlbmNyeXB0ZWQsPGJyPg0KdGhlbiB0aGlzIHdvdWxkIHJlcXVp cmUgdGhhdCB0aGUgZW5jcnlwdGlvbiBiZSB0ZXJtaW5hdGVkIGF0IHRoZTxicj4NCkNQRSBhbmQg dGhlbiByZS1vcmlnaW5hdGVkIHRvIHRoZSBJU1AgcmVzb2x2ZXIsIGxpa2Ugc286PGJyPg0KPGJy Pg0KPGJyPg0KQ2xpZW50ICZsdDstLS0tLS0tIFRMUyAtLS0tLS0tLSZndDsgJm5ic3A7Q1BFICZu YnNwOyZsdDstLS0tLS0tIFRMUyAtLS0tLS0tLSZndDsgSVNQIFJlc29sdmVyPGJyPg0KPGJyPg0K SXMgdGhhdCB5b3VyIGRlc2lyZWQgb3V0Y29tZT8gSWYgc28sIGl0IHNlZW1zIHRvIGNvbWUgaW50 byBjb25mbGljdDxicj4NCndpdGggeW91ciBwb2ludHMgaW4gUyA1LjIgYWJvdXQgdGhlIGRpZmZp Y3VsdHkgb2YgdXBncmFkaW5nIHRoZSBDUEUuPGJyPg0KSWYgbm90LCBtYXliZSBJIGp1c3QgZG9u J3QgdW5kZXJzdGFuZC4gSW4gZWl0aGVyIGNhc2UsIHBlcmhhcHMgeW91PGJyPg0KY2FuIGVsYWJv cmF0ZS48YnI+DQo8YnI+DQotRWtyPGJyPg0KPGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBNb24sIEp1bCAyMCwgMjAyMCBhdCA3OjQ3 IEFNIEFuZHJldyBDYW1wbGluZyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmFuZHJldy5jYW1wbGluZ0A0 MTkuY29uc3VsdGluZyI+YW5kcmV3LmNhbXBsaW5nQDQxOS5jb25zdWx0aW5nPC9hPiZndDsgd3Jv dGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGNtIDBjbSAwY20gNi4w cHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBjbSI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5PbiBUaHUsIEp1bCAxNiwgMjAyMCwgYXQgMDA6MTIsIE1hcnRpbiBUaG9tc29uICZsdDs8 YSBocmVmPSJtYWlsdG86bXRAbG93ZW50cm9weS5uZXQiIHRhcmdldD0iX2JsYW5rIj5tdEBsb3dl bnRyb3B5Lm5ldDwvYT4mZ3Q7IHdyb3RlOjxicj4NCjxicj4NCiZndDsgWW91ciBkcmFmdCBzZWVt cyB0byBiZSBtYWtpbmcgYSBjYXNlIGZvciBzdXBwb3J0aW5nIGZvcndhcmRlcnMsIGJ1dCBJJ20g bm90IGNsZWFyIG9uIHdoYXQgc3VwcG9ydGluZyBmb3J3YXJkZXJzIGxvb2tzIGxpa2UuJm5ic3A7 IEkgdW5kZXJzdGFuZCB0aGF0IHlvdSBtaWdodCBub3QgaGF2ZSBzcGVjaWZpYyBpZGVhcyBhYm91 dCB3aGF0IHRoaXMgc3VwcG9ydCBtaWdodCBsb29rIGxpa2UsIGJ1dCBJIGRvbid0IHNlZSBhbnkg cmVhbCByZXF1aXJlbWVudHMNCiBoZXJlIGVpdGhlci48YnI+DQomZ3Q7IDxicj4NCiZndDsgSXQg d291bGQgcmVhbGx5IGhlbHAgaWYgdGhlIGRyYWZ0IHdvdWxkIGNsZWFybHkgYXJ0aWN1bGF0ZSB3 aGF0IHlvdXIgZGVzaXJlZCBvdXRjb21lIGlzLjxicj4NCjxicj4NClNvcnJ5IGZvciB0aGUgbGFj ayBvZiBjbGFyaXR5LiZuYnNwOyBUaGUgcHJpbWFyeSBpbnRlbnQgb2YgdGhlIGRvY3VtZW50IGlz IHRvIHByb3ZpZGUgaW5mb3JtYXRpb24gYXMgd2UgaGF2ZSB0aGUgaW1wcmVzc2lvbiB0aGF0IGF0 IGxlYXN0IHNvbWUgY2xpZW50IGRldmVsb3BlcnMgbWF5IG5vdCBoYXZlIGdvb2QgdmlzaWJpbGl0 eSBvZiBjb21tb24gbmV0d29yayBvcGVyYXRvciBhcmNoaXRlY3R1cmVzIGFuZCBwcmFjdGljZXMg b3V0c2lkZSBvZiB0aGUgVVMuJm5ic3A7DQogQnkgcHJvdmlkaW5nIHN1Y2ggY2xhcml0eSB3ZSBo b3BlIHRvIHNlZSBpbXBsZW1lbnRhdGlvbnMgdGhhdCBhcmUgc3ltcGF0aGV0aWMgdG8gdGhlIGVu dmlyb25tZW50IGludG8gd2hpY2ggdGhleSBhcmUgYmVpbmcgZGVwbG95ZWQgaW4gb3JkZXIgdG8g bWF4aW1pc2UgdGhlIGNoYW5jZXMgb2Ygd29ya2luZyBjb3JyZWN0bHksIGlkZWFsbHkgdmlhIFNQ QVUgYXMgbWFudWFsIGNvbmZpZ3VyYXRpb24gb2YgRE5TIHNldHRpbmdzIGJ5IHRoZSBtYWpvcml0 eQ0KIG9mIHVzZXJzIHNlZW1zIHVubGlrZWx5LiZuYnNwOyA8YnI+DQo8YnI+DQpJbiBhIG51dCBz aGVsbCwgYW55IEFERCBzb2x1dGlvbiBzaG91bGQgbWVhc3VyZSBpdHNlbGYgdG8gc2VlIHdoZXRo ZXIgaXQgbWVldHMgdGhlIHVzZSBjYXNlIGRlc2NyaWJlZCBpbiB0aGlzIGRvY3VtZW50LCBhdCBs ZWFzdCBvbmUgaXMgbmVlZGVkIHRoYXQgZG9lcy4mbmJzcDsNCjxicj4NCjxicj4NCjxicj4NCkFu ZHJldyA8YnI+DQo8YnI+DQotLSA8YnI+DQpBZGQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0i bWFpbHRvOkFkZEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPkFkZEBpZXRmLm9yZzwvYT48YnI+ DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZCIgdGFy Z2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWRkPC9h PjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4N CjwvaHRtbD4NCg== --_000_LO2P265MB0573B4514852D705D2209EB0C27B0LO2P265MB0573GBRP_-- From nobody Mon Jul 20 16:08:10 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE7DD3A10B8 for ; Mon, 20 Jul 2020 16:08:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com header.b=uzHumPUA; dkim=pass (2048-bit key) header.d=comcast.com header.b=VxIizg/f; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=comcastcorp.onmicrosoft.com header.b=dhUT4des Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6TUpuMTIdeky for ; Mon, 20 Jul 2020 16:08:06 -0700 (PDT) Received: from mx0b-00143702.pphosted.com (mx0b-00143702.pphosted.com [148.163.141.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B7643A10BA for ; Mon, 20 Jul 2020 16:08:06 -0700 (PDT) Received: from pps.filterd (m0184891.ppops.net [127.0.0.1]) by mx0b-00143702.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06KMreVO021678 for ; Mon, 20 Jul 2020 19:08:05 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.com; h=from : to : cc : subject : date : message-id : content-type : content-id : content-transfer-encoding : mime-version; s=20190412; bh=ZC0EZbfgIEsmZAh5lO0kAcGqnOz9zuysY8r9You9SEM=; b=uzHumPUAbXbPBFTlg1G4XXKfDKltjF/uX/+qXP4RP+4t9dB7PzuJ5zSINP3QgUp7I063 /26iS+UwhXrOCEA2TkLXvAbEpj/QEn397MDR+G+n5sOpkG71of5QRTNlnEqmIogGIIq9 YW37tE2jGjfRKY+blX2B1bp/w33/+wIfLbGBZxDEsBMgN3mVheZHTbAOl4VkmA2yud8L YRqAXiu7uBiK++ol6qIvfhe+nLTzPRSl4LtA/w+DwKa8PBvFTztOdLzdUvuoJdv9GiMg zVIxI8ssuM3edULnOzB9Kmy3Au6iPRoIEQOdRH2hy1mhp7sfB0eI40R1uU/2OdGifEDO 3w== Received: from pacdcmhout01.cable.comcast.com (PACDCMHOUT01.cable.comcast.com [68.87.31.167]) by mx0b-00143702.pphosted.com with ESMTP id 32bwufv1ee-125 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 20 Jul 2020 19:08:05 -0400 DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1595286484; x=2459200084; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=ZC0EZbfgIEsmZAh5lO0kAcGqnOz9zuysY8r9You9SEM=; b=VxIizg/fQbzi5vAqAehSdVwZp9DWpLqEgoTBWlDv/twqg2socffTMQXGmH8naEX6 dIqjgDRMMVrxBJmcoAc7oNu4Vhd5L9xnSZsPD9ataU49obWZBTxCQzOJRIQtoHT2 bYS/m8Lk8Vhhzno8b7fAhFKRQ0mqCkmaKwkXjjrSEhJtDVM4+a6PrE7fypG1c4a2 M53Jl4og7qDZxQ2pePLyPsowc9CWOYINoNFnPy0mroCBa1ewF+0AcO4MhrTrlnjU 9j+UFTIvsVXMKAHBZD872fHjfos3xuGSGVzL/CnG/Hus8NR/zKQPV92JNPuLP5p5 9mipNQrNVI/J/xkecIXPnQ==; X-AuditID: 44571fa7-3fdff70000018e96-59-5f1623d48335 Received: from PACDCEX11.cable.comcast.com (cas-umc02.ndceast.pa.bo.comcast.net [68.87.34.28]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by pacdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id A7.34.36502.4D3261F5; Mon, 20 Jul 2020 19:08:04 -0400 (EDT) Received: from PACDCEX37.cable.comcast.com (24.40.2.136) by PACDCEX11.cable.comcast.com (24.40.1.134) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 20 Jul 2020 19:08:03 -0400 Received: from PACDCEXEDGE01.cable.comcast.com (76.96.78.71) by PACDCEX37.cable.comcast.com (24.40.2.136) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Mon, 20 Jul 2020 19:08:03 -0400 Received: from NAM10-BN7-obe.outbound.protection.outlook.com (104.47.70.103) by webmail.comcast.com (76.96.78.71) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 20 Jul 2020 19:08:03 -0400 Received: from BYAPR11MB3111.namprd11.prod.outlook.com (2603:10b6:a03:90::25) by BY5PR11MB4388.namprd11.prod.outlook.com (2603:10b6:a03:1c9::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.23; Mon, 20 Jul 2020 23:08:01 +0000 Received: from BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0]) by BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0%4]) with mapi id 15.20.3195.025; Mon, 20 Jul 2020 23:08:01 +0000 From: "Deen, Glenn" To: ADD Mailing list CC: "add-chairs@ietf.org" Thread-Topic: IETF108 ADD Agenda Thread-Index: AQHWXuqdTSzFseWptUy4yJH39rObGg== Date: Mon, 20 Jul 2020 23:08:01 +0000 Message-ID: <5EFC3442-045F-4F89-A4BA-769C1AFE87A4@comcast.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=comcast.com; x-originating-ip: [2605:e000:141b:121:9442:a71d:7b0a:7e04] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: c4665d32-2c3f-4a63-57f9-08d82d01c02d x-ms-traffictypediagnostic: BY5PR11MB4388: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: YwrYFvsLXC3fs4yoOgFyYUugxDIcbDlSPaMRO9xuS1xnHfDyfGr5KmS5NIInRX4OwoO/Y15fhghO0bcaIHvQ21E+ElIY/mzDFFjl9rdgnOs2hkF6uQtr8Ldzupy5FP9kaeAQYpwBzNyeluio+QpAfL3c5O3fs2nuuO/hR0s4hlDUOUq5qZLvx8t1RW5r/GImLlPL0/wO7rKEiBGw2wLKHsDxiS9uuySrX+1ufeMMPloAlTVPgJ4x6MMB+RYS4Dog5bIIpS2JsdhP5VioY/61nAyHKwOmnBsJQdNgIkZoeVyJpZ33iAlvdhoxijF3/h7FX9lTkT2Rp35jHSpiEJ9HYta1Sijd/9YZbD4jLbfDW8nH7sqFtrQJ8fuCP6k0f3Q70U0N4PeDpjE5egyXi/qTJg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3111.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(396003)(366004)(136003)(346002)(39860400002)(376002)(36756003)(6512007)(66476007)(66556008)(64756008)(66446008)(66574015)(7116003)(2906002)(71200400001)(66946007)(6916009)(316002)(8936002)(8676002)(76116006)(86362001)(83380400001)(5660300002)(4326008)(186003)(2616005)(6506007)(33656002)(966005)(6486002)(478600001)(450100002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: o7gAW0NGNEMjsrxzSZZPJ8IKpV6p0MCP+8mRgcLsoZu3unWT6z8lo2bVD+nVE4oR47CWKOMoyQVcmYKnlm/14Xe55se+GzkM/2NDtdRnOCycFxuMLsfrmtGV1NrBBj0yVbw8SwLDxxkDy00YOVsCUWPesDngfTPv8HpxRiMmv/l6cwZExoa2HY8p7diba3rwh2Ipu8E5c7DtWtn3WzpoTg4YVesx60DIO+Ob43FUbn5QwiFLKdDtpRv45L9OY3ZoxvJ31x0yEYRNLP4CjxzqDOnQx7DmbQPS6Vz6GNQXvgqaUXeHosErg0Avb1RVOxLB7lLoH3ohRWnj+hweEeFSI1zBe/MmNOE2P9w3nZ6MjbLLe+ZtGhgl88h0/KP0RuoN1izgILqofjHeO7d6reQDxuSsy/6TOoqK9IHQ6/NVrF4xvGmIf1ltuft2iqQ4sDUVUHlhXthtWA9F0fJA4i+8miK6PVS3iY3xErJf4Y0HyyMZWRvQjETvN5NOSzzKGB8Ix8Y9E/GudH+Vwq6yrMCk90Jq/WXTwT2Dg2lnKq8MKFmD9ST/Zde/dqiQhzdwq7M7 x-ms-exchange-transport-forked: True arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=C6Mt1Y0ZhHLHCTr2oqlpkMoLU9+gO800Dyu6symI60C7JoaV6EXg7+l7bQgL4HUfWUyUlVICF0M5EaRCWaeU6FLtuBvJvYOaNO6P2Ad8aIrvIN5LZdDBwmPUqIpIR8wKZo66VGf/F2CJBiD+Y2IWEydjtJnveGrwhrkGqqU92p8mYmqkp9IoLOFjITjOMdsBtDNyDeqpvpQuta+D23Apz1c+JhUieNpZ5bY4CvXTgB+FK76quUfs/aoe/2Id9LltQhLdpPoLi7d0LPlS2kQM/lPAzXpoi6SlJEk2NRqxeKr+XuUbzVnDecpz1nctWxsDHFUcSoPmU31ZgJ0Xrf+YFA== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4g8fT66udlcgNj9mZ6c0C82p32U93DxYxp8Bx+5SSTo=; b=l+DmfwSGxx2RtyrPdM8S9YDkpwGafv0ySLXRvEDQw0l8pXjy/GwXZ64qjjuAImb7QC1zvePxnz4tSqFgF54TPAILFteJgQ8kyP5vvaa6oH34bKBflCaE9decEKvfOPb1RN3mdlhlLtQwTamSRTbDp2axdwrc34mlMpVeN234qpf2UvTMQIm7r7Y01BKQvm7XtrhakBs8pGxSLSZy54v4JgC/htDQnAdAWcbA8yCAmnoMvSOqLGCDgmfp4tq/ETz5VzE9z+GJQd5KHtbuGE92lWo/Fa27jTFd8epQ6A8MNeyvhnnKWOQEbZB8v9gD/jWpDBJeF9BQj26BpN1Sf3dz5A== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=comcast.com; dmarc=pass action=none header.from=comcast.com; dkim=pass header.d=comcast.com; arc=none dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastcorp.onmicrosoft.com; s=selector1-comcastcorp-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4g8fT66udlcgNj9mZ6c0C82p32U93DxYxp8Bx+5SSTo=; b=dhUT4des5S/61mLM1JGMUnFSHNGJiWcARhhetycs9o2kAGyzndNjGmu8QHhykgl8lDCPwUyiZgq01jHC8RRbg9AjiP4tAz5A+Nlc8O0S6JUcJvGWyHQe9EvPYAWjkElN2b5xV2QLpg7mBbZJ6UyR92cdmfe1GGdW1/KmZHa1dFM= x-ms-exchange-crosstenant-authas: Internal x-ms-exchange-crosstenant-authsource: BYAPR11MB3111.namprd11.prod.outlook.com x-ms-exchange-crosstenant-network-message-id: c4665d32-2c3f-4a63-57f9-08d82d01c02d x-ms-exchange-crosstenant-originalarrivaltime: 20 Jul 2020 23:08:01.3637 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 906aefe9-76a7-4f65-b82d-5ec20775d5aa x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: 3HCWuhsNjxKuCXI/LaLmvhcflZgikxrgNl/fk5iyEmnrhF1eMc/T2xllLfOtiR1Mpg6Mhy2JRfjU2xIHXZCzSm9cwrG/3HucjdEkwLSPiEE= x-ms-exchange-transport-crosstenantheadersstamped: BY5PR11MB4388 x-originatororg: comcast.com Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA03Sb0hTURQAcO57b29vY6vrnPOkZjUzUmoqig4Js/KDX4KIQglxDXy05V/e zDIwV5G5rZGWBK4PGq4ClaSUzT8RY+hQRwmWJULlP8pENNJW64Pm21vQt9+959x7zrlchlRs UTGMsaKa5Sr0ZWpaSuUVqOMOv0tQ6VJ/3AGtO2ChtFv+Z3Quke90BolT6Jz0SAlbZqxhuZSc 81LD8tAqXRVIumIJSMxo5aAVSRjAGTAa7CJ4K/AwAY4vKiuSbnsQwY3eBrGwmELQ3/aKFLJ8 CEZWTULAScCHiRlSWMwjaHE+pKyIYWh8CFy9R/kDSpwAjz+6QyVInAINz20070gcC+b5RlrI 2QsDfhchWAPuXk/IFE4Ez92VkOU4B16Pj4l5I6yCX+Pd4TujYWaxjRDGweB8OUEKjoJvC5si 3lHbdT/1rFN8nwhbESxbPYjvE3A23PeGn2I3TLbZkOCT8Nm1IRKcDJZ7zWLBpeAcdoVzDsD0 SmO4Vjx02ucowXEwO+2m+VqAh0jwD38PB7ZIsFnOCF6k4JaVa0IZjv9mcGy3ROIk6BlMEbbz wbf+iBK8D1psc2JH6CkiYKx1kWpHok4ky9RqtFma9DRNWmbWCxT6Fnue9iO3w+BFmEFqmdwj U+kUIn2Nqbbci4Ah1Up5syxSp5CX6GuvslyljrtUxpq8KJah1NHypqmlYgW+oK9mS1m2iuX+ RQlGEmNGu4K+n9NrS2vGwsol24RyR4Mse1Rv33/bbq87W5451i7e+Dp7Iqb+dFN8d+s1nysR Fxcok7ux/g1a2LmRf/P35SljfaPkT7nMMPLkeK41byjKn9vxgMN9o0533bHJzZrrgfeejvYu 83ps39vC1AElnS65WBRpjOgrCkLxqTg1ZTLo05JJzqT/C8e8LqUSAwAA X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-20_09:2020-07-20, 2020-07-20 signatures=0 X-Proofpoint-Spam-Reason: safe Archived-At: Subject: [Add] IETF108 ADD Agenda X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2020 23:08:08 -0000 SGkgQURELA0KDQpUaGUgYWdlbmRhIGZvciBBREQgQCBJRVRGMTA4IGhhcyBub3cgYmVlbiBwb3N0 ZWQuICAoaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9tZWV0aW5nLzEwOC9zZXNzaW9uL2Fk ZCkNCg0KVGhlIEFERCBBZ2VuZGEgZm9yIElFVEYxMDggaGFzIG9ubHkgOTAgbWludXRlcyBhbmQg aXMgdmVyeSBmdWxsLiAgSXTigJlzIGdyZWF0IHRoYXQgdGhlcmUgaXMgbG90cyBvZiBhY3Rpdml0 eSBhbmQgaW50ZXJlc3QsIGJ1dCBhbGwgdGhlIGludGVyZXN0IGFuZCBhY3Rpdml0eSBtZWFudCB0 aGF0IG5vdCBldmVyeSByZXF1ZXN0IGZvciBhIHRpbWUgc2xvdCBjb3VsZCBiZSBtZXQuICAgICAg V2UgYXJlIHNvcnJ5IGlmIHlvdXIgcmVxdWVzdCBpc27igJl0IG9uIHRoZSBhZ2VuZGEgc3BhY2Ug LSB0aGUgY2hhaXJzIGRvIGhvcGUgdG8gYWNjb21tb2RhdGUgdGhlIGFkZGl0aW9uYWwgZG9jdW1l bnRzIGF0IGEgZnV0dXJlIGludGVyaW0gbWVldGluZy4NCg0KV2l0aCBzbyBtdWNoIGFjdGl2aXR5 IHRoZSBjaGFpcnMgZmVlbCB0aGF0IEFERCB0aGF0IG5lZWRzIGFuIGludGVyaW0gbWVldGluZyBz b29uIGFmdGVyIElFVEYxMDggYW5kIHByb3Bvc2UgaG9sZGluZyBpdCBpbiBTZXB0ZW1iZXIuICAg IFBsZWFzZSB2aXNpdCB0aGUgU2VwdGVtYmVyIEFERCBJbnRlcmltIERvb2RsZSBQb2xsIGF0OiBo dHRwczovL2Rvb2RsZS5jb20vcG9sbC96eXBweHF0ZThwY3dleDNwDQoNClJlZ2FyZHMsDQpHbGVu biBEZWVuICYgRGF2aWQgTGF3cmVuY2Ug4oCTIHlvdXIgZnJpZW5kbHkgQUREIGNoYWlycy4NCg0K LS0NCg0KQUREIEFnZW5kYSBmb3IgSUVURjEwOA0KPT09PT09PT09PT09PT09PT09PT09PQ0KLS0t DQoNCjVtaW4gICBXZWxjb21lIHRvIEFERCBXRyAgICBbQ2hhaXJzIF0NClBsZWFzZSB2aXNpdCB0 aGUgKipbU2VwdGVtYmVyIEludGVyaW0gUG9sbF0oaHR0cHM6Ly9kb29kbGUuY29tL3BvbGwvenlw cHhxdGU4cGN3ZXgzcCkqKiBEb29kbGUuIChBbHJlYWR5IG9wZW4gZm9yIHJlc3BvbnNlcykNCg0K QWdlbmRhIEJhc2ggW0NoYWlyc10NCi0tLQ0KRGlzY292ZXJ5IFRvcGljcw0KIzEgLSAxMG1pbiAg RE5TIFJlc29sdmVyIERpc2NvdmVyeSBQcm90b2NvbCAoRFJEUCkgW0RhbmllbCBNaWd1YWx0XQ0K RHJhZnQ6ICoqW2RyYWZ0LW1nbHQtYWRkLWRyZHAtMDJdKGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0 Zi5vcmcvZG9jL2RyYWZ0LW1nbHQtYWRkLXJkcCkqKg0KDQojMiAtIDEwbWluICBBZGFwdGl2ZSBE TlMgUmVzb2x2ZXIgRGlzY292ZXJ5IFtUb21teSBQYXVseV0NCkRyYWZ0OiAqKltkcmFmdC1wYXVs eS1hZGQtcmVzb2x2ZXItZGlzY292ZXJ5LTAxXShodHRwczovL2RhdGF0cmFja2VyLmlldGYub3Jn L2RvYy9kcmFmdC1wYXVseS1hZGQtcmVzb2x2ZXItZGlzY292ZXJ5LykqKg0KDQojMyAtIDEwbWlu ICBEb0ggUHJlZmVyZW5jZSBIaW50cyBmb3IgSFRUUCBbTmljayBTdWxsaXZhbl0NCkRyYWZ0OiAq KltkcmFmdC1zY2hpbmF6aS1odHRwYmlzLWRvaC1wcmVmZXJlbmNlLWhpbnRzLTAyXShodHRwczov L2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1zY2hpbmF6aS1odHRwYmlzLWRvaC1wcmVm ZXJlbmNlLWhpbnRzLykqKg0KDQojNCAtIDEwbWluICBBIEJvb3RzdHJhcHBpbmcgUHJvY2VkdXJl IHRvIERpc2NvdmVyIGFuZCBBdXRoZW50aWNhdGUgRG9UL0RvSCBzZXJ2ZXJzICAgZm9yIElvVCBh bmQgQllPRCBEZXZpY2VzIFtEYW4gV2luZ10NCkRyYWZ0OiAqKltkcmFmdC1yZWRkeS1hZGQtaW90 LWJ5b2QtYm9vdHN0cmFwLTAwXShodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFm dC1yZWRkeS1hZGQtaW90LWJ5b2QtYm9vdHN0cmFwLykqKg0KDQotLS0NCiMgUmVzb2x2ZXIgSW5m b3JtYXRpb24gVG9waWNzDQoNCiM1IC0gMTBtaW4gIEROUyBTZXJ2ZXIgU2VsZWN0aW9uOiBETlMg U2VydmVyIEluZm9ybWF0aW9uIHdpdGggQXNzZXJ0aW9uIFRva2VuIFtUaXJ1bWFsZXN3YXIgUmVk ZHldDQpEcmFmdDogKipbZHJhZnQtcmVkZHktYWRkLXNlcnZlci1wb2xpY3ktc2VsZWN0aW9uLTAz XShodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1yZWRkeS1hZGQtc2VydmVy LXBvbGljeS1zZWxlY3Rpb24vKSoqDQoNCiMgRGVwbG95bWVudHMsIENvbnNpZGVyYXRpb25zIGFu ZCBPYnNlcnZhdGlvbnMNCg0KLS0tDQoNCiM2IC0gMTBtaW4gIEVuY3J5cHRlZCBETlMgRGlzY292 ZXJ5IGFuZCBEZXBsb3ltZW50IENvbnNpZGVyYXRpb25zIGZvciBIb21lIE5ldHdvcmtzIFtNb2hh bWVkIEJvdWNhZGFpcl0NCkRyYWZ0OiAqKltkcmFmdC1idHctYWRkLWhvbWUtMDZdKGh0dHBzOi8v ZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWJ0dy1hZGQtaG9tZS8pKioNCg0KIzcgLSAg NW1pbiAgIFByYWN0aWNhbCBPYnNlcnZhdGlvbnMgZnJvbSBFbmNyeXB0ZWQgRE5TIERlcGxveW1l bnRzIGJ5IE5ldHdvcmsgT3BlcmF0b3JzIFtBbmRyZXcgQ2FtcGxpbmddDQpEcmFmdDogKipbZHJh ZnQtY2FtcGxpbmctb3BlcmF0b3Itb2JzZXJ2YXRpb25zLTAwXShodHRwczovL2RhdGF0cmFja2Vy LmlldGYub3JnL2RvYy9kcmFmdC1jYW1wbGluZy1vcGVyYXRvci1vYnNlcnZhdGlvbnMvKSoqDQoN CiM4IC0gMTBtaW4gIEEgUHJvcG9zYWwgZm9yIGEgRG9IIERpc2NvdmVyeSBUcmlhbCBbTmVpbCBD b29rXQ0KRHJhZnQ6ICoqW2RyYWZ0LWNvb2stZG9oLWRpc2NvdmVyeS10cmlhbC0wMF0oaHR0cHM6 Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtY29vay1kb2gtZGlzY292ZXJ5LXRyaWFs LykqKg0KDQoNCg0KRG9jdW1lbnRzIE5vdCBvbiBJRVRGMTA4IEFnZW5kYSBidXQgcmVsZXZhbnQg dG8gV0cNCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PQ0KDQpEZXBsb3ltZW50IENvbnNpZGVyYXRpb25zIGZvciBFbnRlcnByaXNlIE5ldHdvcmtzDQpk cmFmdC1yZWRkeS1hZGQtZW50ZXJwcmlzZS0wMCBbVGlydW1hbGVzd2FyIFJlZGR5XQ0KaHR0cHM6 Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtcmVkZHktYWRkLWVudGVycHJpc2UvDQoN CkFkYXB0aXZlIEROUyBEaXNjb3ZlcnkgVGhyZWF0cyBbR2xlbm4gRGVlbl0NCmRyYWZ0LWRlZW4t YWRkLXRocmVhdHMtMDANCmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWRl ZW4tYWRkLXRocmVhdHMvDQoNClVwZ3JhZGluZyBDb21tdW5pY2F0aW9uIGZyb20gU3R1YiBSZXNv bHZlcnMgdG8gRG9UIG9yIERvSA0KZHJhZnQtcHAtYWRkLXN0dWItdXBncmFkZS0wMiBbUGF1bCBI b2ZmbWFuXQ0KaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtcHAtYWRkLXN0 dWItdXBncmFkZS8NCg0KRE5TIFJlc29sdmVyIEluZm9ybWF0aW9uIFNlbGYtcHVibGljYXRpb24N CmRyYWZ0LXBwLWFkZC1yZXNpbmZvLTAyLnR4dCBbUGF1bCBIb2ZmbWFuXQ0KaHR0cHM6Ly9kYXRh dHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtcHAtYWRkLXJlc2luZm8vDQoNCkRvSCBhbmQgRG9U IFByb3RvY29sDQo9PT09PT09PT09PT09PT09PQ0KDQpTdXBwb3J0aW5nIFJlZGlyZWN0IFJlc3Bv bnNlcyBpbiBETlMgUXVlcmllcyBvdmVyIEhUVFBTIChEb0gpDQpkcmFmdC1idHctYWRkLXJmYzg0 ODQtY2xhcmlmaWNhdGlvbi0wMiBbTmVpbCBDb29rXQ0KaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRm Lm9yZy9kb2MvaHRtbC9kcmFmdC1idHctYWRkLXJmYzg0ODQtY2xhcmlmaWNhdGlvbi8NCg0KIyMj IElLRXYyIENvbmZpZ3VyYXRpb24gZm9yIEVuY3J5cHRlZCBETlMNCmRyYWZ0LWJ0dy1hZGQtaXBz ZWNtZS1pa2UtMDAgIFtWYWxlcnkgU215c2xvdl0NCmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5v cmcvZG9jL2RyYWZ0LWJ0dy1hZGQtaXBzZWNtZS1pa2UvDQoNCg0KDQoNCg0K From nobody Mon Jul 20 17:11:17 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDD173A11F7 for ; Mon, 20 Jul 2020 17:11:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Q_If1m3_vx9 for ; Mon, 20 Jul 2020 17:11:11 -0700 (PDT) Received: from mail-ot1-x32f.google.com (mail-ot1-x32f.google.com [IPv6:2607:f8b0:4864:20::32f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B089A3A11F6 for ; Mon, 20 Jul 2020 17:11:11 -0700 (PDT) Received: by mail-ot1-x32f.google.com with SMTP id h1so13721517otq.12 for ; Mon, 20 Jul 2020 17:11:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ukvMZ7ElZRyDGwWL6iTiYCPuRGvbQCCyfvBPn/1qIEY=; b=Tszfbz3GssS7NLGFHznXodV4TeOBuKGhPmYrR7S3GZgUaFHR+h/RDOPXwPQCEBM9nK D7FUtwgOvNuViIPyYBUMqxAuT+FZH1sSGFrsuRaBNNavKYz6UQIp94/7lN8tjbG8evTw ylFhC74ajRgPG10H8ce23gxEPAyh9WqCcAhg9V6hTmJvrNWlPWQocczh8jteD1hX4W99 p29UY4srpx00CSnVweoIpcoVXdNTSYyDbTHtmMEY7oIm7Tf3wAc9rRejqy3B8FDEIzaG CkCWrUe5SGGsNLSZCV3g3rfcsidJyD8N5J19Uof1nduC2/34ZSziU61rg3m8fy5M3ZOs w93w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ukvMZ7ElZRyDGwWL6iTiYCPuRGvbQCCyfvBPn/1qIEY=; b=J/q6afBGKDedPrPPYz8Ax17IaYEAJ0cQK1m1zLqfHgOjs8XrjVLg84CbYmkzdE16YV q6iErruWStU87pbHm0TDJpFXwRkgrrPFzOW0mHkng56S4mKrmW66iXuQxqPh1K76bYKV P+/r6nMH9XaBesnJkNGHcAM4RwkKi+AbmlT4baom1pvlqimLFgb9rbCKSUnjPfOhzsMB CXRb1W8Q6zi9tJOXn5Onp77bwnj5QcVaMCWrL0ilYtX5JAqnH1iddCtUg5ZO8/WWh/kE IyHGYEz2JL7s8qXyTWqP4AwluojEhMwWQvYKxAuptdphgHMaPG2mRz3vnk6QEyH2LsfL ICRA== X-Gm-Message-State: AOAM533oaxW5AJk6K+ILDGj/JmShYxuDq8Cwl/A3w2BGRcgEHb+ldj/2 RzEHtvggbMfcqznPoY+URgNVGRzVU8hDsN/rvFhkAA== X-Google-Smtp-Source: ABdhPJxH8vAvukN1o377ysCowIfA0ysl+qi5pyW9WgPhVDMMzDZw1qM5cyX+C4QLHYUpoYS163rLrRj3zey1OmPsglY= X-Received: by 2002:a9d:6659:: with SMTP id q25mr20155967otm.330.1595290270555; Mon, 20 Jul 2020 17:11:10 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: From: Kenji Baheux Date: Tue, 21 Jul 2020 09:10:59 +0900 Message-ID: To: Andrew Campling Cc: tirumal reddy , Martin Thomson , ADD Mailing list , Normen Kowalewski , "Winfield, Alister" , "Box, C, Chris, TLW1 R" , "Scalone, Gianpaolo Angelo, Vodafone Italy" Content-Type: multipart/alternative; boundary="000000000000e44ec205aae87594" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 00:11:16 -0000 --000000000000e44ec205aae87594 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks for the information thus far. Assumption: I'm setting aside an auto-upgrade to a discovered DoH resolver due to the lack of trust in any of the mechanism I'm aware of. Instead, I'm currently assuming a world where a discovered DoH resolver would be surfaced as an option (modulo some extra conditions TBD: recognized provider, etc) for the user to choose. Couldn't a CPE adjust its behavior and/or influence which DoH service gets discovered (family-safe-strict.doh.isp.net, family-safe.doh.isp.net, doh.isp.net) based on which device is asking (if at all, e.g. custom filtering configured on the CPE =3D> stop the discovery process in its trac= k)? - What level of flexibility / capability can we roughly count on with the typical CPE today? Is the issue that the flexibility is so low that = the above wouldn't work on most current CPEs? - Would these inflexible CPE be also incapable of halting any of the discovery process proposed thus far? What would be the bare minimum info that an ISP would need to know to avoid responding to a discovery proces= s in case of these too old/.. CPE being in the loop? Or rather, would ISP = be ok with responding to a discovery process if they get a confirmation tha= t the CPE is up to the task? On Mon, Jul 20, 2020 at 11:24 PM Andrew Campling wrote: > *Kenji* > > Some ISPs use identifiers such as the device MAC address for parental > controls, others implement the controls for the account rather than being > device specific so cover all devices connected to the line. The filterin= g > itself is often requested during account application (ie at customer > sign-up), with some ISPs offering several fixed levels of filtering (eg > high, medium, low =E2=80=93 with low often being the default), others do = this and > also offer customisation at account level. And of course the filtering c= an > be switched on or off at any point by the account holder. > > > > I=E2=80=99ve copied my co-authors in case they wish to add any details on= their > own implementations as there will be variation between them. > > > > > > *Andrew* > > > > *From:* Kenji Baheux > *Sent:* 20 July 2020 01:27 > *To:* tirumal reddy > *Cc:* Martin Thomson ; ADD Mailing list > *Subject:* Re: [Add] Practical Observations from Encrypted DNS > Deployments by Network Operators > > > > I'd like to get a clear picture of how per-device family-safe filtering i= s > typically configured in a plain ISP setup. > > > > I imagine that the ISP provided router offers a UI through which a parent > (logged in user) could add/remove specific devices to the "family-safe: > enabled" list. > > > > Which information is being used to dissociate the devices? > > What does the router do differently from there on? Where does the > filtering actually occur, on the upstream resolver (different one?)? > > > > Thanks. > > > > On Fri, Jul 17, 2020 at 11:54 PM tirumal reddy wrote: > > Hi Martin, > > > > Nowadays home routers are capable of running network security services. > For example, DNS filtering to enforce MUD ( > https://tools.ietf.org/html/rfc8520) rules for IoT devices, blocking > malware/phishing sites, parental control, anomaly detection etc. > > > > SPAU allows the ISP DoH/DoT resolver to enforce DNS filtering for the > entire home but cannot enforce device level filtering, isolate infected > devices, identify local attacks etc. > > > > Cheers, > > -Tiru > > > > On Thu, 16 Jul 2020 at 04:42, Martin Thomson wrote: > > Hi Andrew, > > Your draft seems to be making a case for supporting forwarders, but I'm > not clear on what supporting forwarders looks like. I understand that yo= u > might not have specific ideas about what this support might look like, bu= t > I don't see any real requirements here either. > > It would really help if the draft would clearly articulate what your > desired outcome is. > > I note that SPAU - as described - only really operates when the forwarder > has been cut out already. I don't believe that there are many CPE device= s > that intercept traffic on UDP port 53 to do their work, but it isn't > unthinkable. If there are, those are the only ones truly affected by the > described upgrade to encrypted transport. > > There is a SPAU upgrade path that might concern you more: > > Query using the default resolver for a name where the LHS labels are > unique (and therefore unlikely to be cached anywhere) and the RHS labels > identifies a zone under the control of the entity making the probe. The > authoritative puts the IP of the resolver that made the call in the > answer. This probably won't be a recognizable address for the resolver, > and it almost certainly won't be a quad-N anycast address, but it will > identify the true resolver with fair accuracy. The client can then do a > lookup and upgrade, cutting out any forwarder. (A variation on this has > the authoritative perform the lookup, which might be superior from a > deployment perspective as it centralizes the lookup tables.) > > Cheers, > Martin > > > On Thu, Jul 16, 2020, at 02:59, Andrew Campling wrote: > > > > *ADD **and EDDI **Group**s* > > This is to let you know that a new I-D has been submitted for > > consideration by the ADD WG that includes observations regarding a > > variety of implementations of recursive DNS capabilities that are > > important to network operators in terms of delivering DNS services to > > their customers. The document defines problems that need technical > > solutions to allow the deployment of encrypted DNS by the largest > > number of operators to the largest number of users in the shortest > > possible timeframe with little or no disruption to the user experience, > > ideally by clients using the =E2=80=9Csame provider auto-upgrade=E2=80= =9D approach > > wherever possible. > > > > Name: draft-campling-operator-observations > > Revision: 00 > > Title: Practical Observations from Encrypted DNS Deployments > > by Network Operators > > Document date: 2020-07-13 > > Group: Individual Submission > > Pages: 9 > > URL: > > _ > https://www.ietf.org/internet-drafts/draft-campling-operator-observations= -00.txt_ > > Status: > > _https://datatracker.ietf.org/doc/draft-campling-operator-observations/= _ > > Htmlized: > > _https://tools.ietf.org/html/draft-campling-operator-observations-00_ > > Htmlized: > > _ > https://datatracker...ietf.org/doc/html/draft-campling-operator-observati= ons_ > > > > > We hope that the details in this document will aid the development of > > discovery mechanisms for DNS resolvers including those using DoH. > > Discussion of its content is encouraged on the IETF ADD mailing list > > _add@ietf.org_, especially concerning any contributions from additional > > network operators to make the content as fully representative as > > possible of the significant use cases globally. > > > > > > *Andrew**, Normen, G**ianpaolo, Chris, Alister * > > > > > > > > -- > > Add mailing list > > Add@ietf.org > > https://www.ietf.org/mailman/listinfo/add > > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > > > -- > > Kenji BAHEUX > > Product Manager - Chrome > > Google Japan > --=20 Kenji BAHEUX Product Manager - Chrome Google Japan --000000000000e44ec205aae87594 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks for the information thus far.

Assumption: I'm setting aside an auto-upgrade to a discovered DoH res= olver due to the lack of trust in any of the mechanism I'm aware of. In= stead, I'm currently assuming a world where a discovered DoH resolver w= ould be surfaced as an option (modulo some extra conditions TBD: recognized= provider, etc) for the user to choose.

Couldn'= ;t a CPE adjust its behavior and/or influence which DoH service gets discov= ered (family-safe-strict.= doh.isp.net, family-safe.doh= .isp.net, doh.isp.net) based on whic= h device is asking (if at all, e.g. custom filtering configured on the CPE = =3D> stop the discovery process in its track)?

=
  • What level of flexibility / capability can we roughly count on with= the typical CPE today? Is the issue that the flexibility is so low that th= e above wouldn't work on most current CPEs?
  • Would these inflexi= ble CPE be also incapable of halting any of the discovery process proposed = thus far? What would be the bare minimum info that an ISP would need to kno= w to avoid responding to a discovery process in case of these too old/.. CP= E being in the loop? Or rather, would ISP be ok with responding to a discov= ery process if they get a confirmation that the CPE is up to the task?
    • =


On Mon, Jul 20, 2020 at 11:24 PM Andrew Campling = <andrew.campling@419.consulting> wrote:

Kenji

Some ISPs use identif= iers such as the device MAC address for parental controls, others implement= the controls for the account rather than being device specific so cover al= l devices connected to the line.=C2=A0 The filtering itself is often requested durin= g account application (ie at customer sign-up), with some ISPs offering sev= eral fixed levels of filtering (eg high, medium, low =E2=80=93 with low oft= en being the default), others do this and also offer customisation at account level.=C2=A0 And of course the filtering ca= n be switched on or off at any point by the account holder.=C2=A0

=C2=A0<= /span>

I=E2=80=99ve copied m= y co-authors in case they wish to add any details on their own implementati= ons as there will be variation between them.=C2=A0

=C2=A0<= /span>

=C2=A0

Andrew

=C2=A0<= /span>

From: Kenji Baheux <kenjibaheux@google.com>
Sent: 20 July 2020 01:27
To: tirumal reddy <kondtir@gmail.com>
Cc: Martin Thomson <mt@lowentropy.net>; ADD Mailing list <add@ietf.org>
Subject: Re: [Add] Practical Observations from Encrypted DNS Deploym= ents by Network Operators

=C2=A0

I'd like to get a clear picture of how per-devic= e family-safe filtering is typically configured in a plain ISP setup.

=C2=A0

I imagine that the ISP provided router offers a UI t= hrough which a parent (logged in user) could add/remove specific devices to= the "family-safe: enabled" list.

=C2=A0

Which information is being used to dissociate the=C2= =A0 devices?

What does the router do differently from there on? W= here does the filtering actually occur, on the upstream resolver (different= one?)?

=C2=A0

Thanks.

=C2=A0

On Fri, Jul 17, 2020 at 11:54 PM tirumal reddy <<= a href=3D"mailto:kondtir@gmail.com" target=3D"_blank">kondtir@gmail.com= > wrote:

Hi Martin,

=C2=A0

Nowadays home routers are capable of running network= security services. For example, DNS filtering to enforce MUD (https://tools.ietf.or= g/html/rfc8520)=C2=A0rules for IoT devices, blocking malware/phishing sites, parental control, anomaly detection etc.<= u>

=C2=A0

SPAU allows the ISP DoH/DoT resolver to enforce DNS = filtering for the entire home but cannot enforce device level filtering,=C2= =A0isolate infected devices, identify local attacks etc.

=C2=A0

Cheers,

-Tiru

=C2=A0

On Thu, 16 Jul 2020 at 04:42, Martin Thomson <mt@lowentropy.net&g= t; wrote:

Hi Andrew,

Your draft seems to be making a case for supporting forwarders, but I'm= not clear on what supporting forwarders looks like.=C2=A0 I understand tha= t you might not have specific ideas about what this support might look like= , but I don't see any real requirements here either.

It would really help if the draft would clearly articulate what your desire= d outcome is.

I note that SPAU - as described - only really operates when the forwarder h= as been cut out already.=C2=A0 I don't believe that there are many CPE = devices that intercept traffic on UDP port 53 to do their work, but it isn&= #39;t unthinkable.=C2=A0 If there are, those are the only ones truly affected by the described upgrade to encrypted transport.<= br>
There is a SPAU upgrade path that might concern you more:

Query using the default resolver for a name where the LHS labels are unique= (and therefore unlikely to be cached anywhere) and the RHS labels identifi= es a zone under the control of the entity making the probe.=C2=A0 The autho= ritative puts the IP of the resolver that made the call in the answer.=C2=A0 This probably won't be a recog= nizable address for the resolver, and it almost certainly won't be a qu= ad-N anycast address, but it will identify the true resolver with fair accu= racy.=C2=A0 The client can then do a lookup and upgrade, cutting out any forwarder.=C2=A0 (A variation on this has the authoritativ= e perform the lookup, which might be superior from a deployment perspective= as it centralizes the lookup tables.)

Cheers,
Martin


On Thu, Jul 16, 2020, at 02:59, Andrew Campling wrote:
>=C2=A0
> *ADD **and EDDI **Group**s*
> This is to let you know that a new I-D has been submitted for
> consideration by the ADD WG that includes observations regarding a > variety of implementations of recursive DNS capabilities that are
> important to network operators in terms of delivering DNS services to =
> their customers.=C2=A0 The document defines problems that need technic= al
> solutions to allow the deployment of encrypted DNS by the largest
> number of operators to the largest number of users in the shortest > possible timeframe with little or no disruption to the user experience= ,
> ideally by clients using the =E2=80=9Csame provider auto-upgrade=E2=80= =9D approach
> wherever possible.
>=C2=A0
> Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-campling-operator-= observations
> Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
> Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Practical Observations from E= ncrypted DNS Deployments
> by Network Operators
> Document date:=C2=A0 2020-07-13
> Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
> Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 9
> URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://www.ietf.org/internet-dr= afts/draft-campling-operator-observations-00.txt_
> Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://datatracker.ietf.org/doc/draft-cam= pling-operator-observations/_
> Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://tools.ietf.org/html/draft-campling-op= erator-observations-00_
> Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0
> _https://datatracker...ietf.org/doc/htm= l/draft-campling-operator-observations_
>=C2=A0
> We hope that the details in this document will aid the development of =
> discovery mechanisms for DNS resolvers including those using DoH.=C2= =A0
> Discussion of its content is encouraged on the IETF ADD mailing list <= br> > _add@ietf.org_= , especially concerning any contributions from additional
> network operators to make the content as fully representative as
> possible of the significant use cases globally.=C2=A0
>=C2=A0
>=C2=A0
> *Andrew**, Normen, G**ianpaolo, Chris, Alister *
>=C2=A0
>=C2=A0
>=C2=A0
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
>

--
Add mailing list
Add@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/add

--
Add mailing list
Add@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/add


=C2=A0

--

Kenji BAHEUX<= /span>

Product Manag= er - Chrome

Google Japan<= /span>



--
Kenji BAHEUX
= Product Manager - Chrome
Google Japan
--000000000000e44ec205aae87594-- From nobody Mon Jul 20 17:20:05 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 881193A120D for ; Mon, 20 Jul 2020 17:20:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K6Xf6OWiSeej for ; Mon, 20 Jul 2020 17:20:00 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650118.outbound.protection.outlook.com [40.107.65.118]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB25E3A120C for ; Mon, 20 Jul 2020 17:19:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=B3/YkruJKUsaWirQPJKCT1eIUKsyweVvHoNRfTFc6UknksB7FCHBlpP+Iw2IGxGhs5svDm5BYOLvjuGS42eyRW/pcgkGAoFI06yzlWb0uCgr4h9DbRI7p2+nvYwCCy8y6BQW81w2AHmYRsqOCaFecmp6h8cUvY4jHc0NUzAme1VIgw5r+CQjKoXZxBJbCH1UnxIuguxKHq622cj03g7UmmfSjCxAPosqrORgDZyiU+jvF19E8UAMNT2SZ9O9cVlBliY+ThW+Kmp7L0NjroF+RYCRKcEbJD5JIZeO8iXxuhLe/h7W7PdD1l4zzWLQyUsR3b6lSY6dzzZd5uMNbmXJAw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=woM9i61yvp2HqkNYc4Co3UWm0rbZmqXMd/dcfNg86gE=; b=GQ8uuGr8fC20JY0o8hbOOwiU+V1FD26OmZczbII2EDTAq40S/JXavRcpToErJ4c/mJCKLlQk4GwPSnJkWkCsC6YUzEfk1uZ9Ci3JyoaKpNHJQ9ZQH4VMbIt6WsHpwo9Iq4IhHA48ryFmWbNJ5ByIwzdywr5QkjYubbpbf7xR4+2BDI92RrNEhaeM53vjqZimgcPLPx4TG4ohO0+hk6vliQAXoe6g3V72Qd+dF08GczvsX+TnIzj6BlepFhLKQBYw9blYB4/3BZMaaK8HxWDFJdN2vLf9ncvmK2xxg/0R8lpQiig0Wuqeqaf/1Ta0K+qVCfM00/EGnZe36ggQSSU6Eg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=woM9i61yvp2HqkNYc4Co3UWm0rbZmqXMd/dcfNg86gE=; b=HCu0j0akfQkIfz3TYmfDS2EoaB3B3OefcFdgJN5cQ/+h+vsxE6bKjySGEfJ//nV3i0++uY6o6fjagy+wG/BTESaeRFG+kYsc2jVADgK24SHOb7ghS+3r+V/8oarCwh/Wg2udkmCawYVJPQrSLAeLq/RLfZMxTJ4lWgTfGkz1V+o= Received: from BY5PR00MB0773.namprd00.prod.outlook.com (2603:10b6:a03:1d8::23) by BYAPR00MB0632.namprd00.prod.outlook.com (2603:10b6:a03:106::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3250.0; Tue, 21 Jul 2020 00:19:56 +0000 Received: from BY5PR00MB0773.namprd00.prod.outlook.com ([fe80::243b:859:4321:2eb4]) by BY5PR00MB0773.namprd00.prod.outlook.com ([fe80::243b:859:4321:2eb4%8]) with mapi id 15.20.3252.000; Tue, 21 Jul 2020 00:19:56 +0000 From: Tommy Jensen To: Andrew Campling , Eric Rescorla CC: "add@ietf.org" , Martin Thomson Thread-Topic: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AQHWXuQ8PIJgt7QxrESomxJlTaV/OqkREy5j Date: Tue, 21 Jul 2020 00:19:56 +0000 Message-ID: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-21T00:19:56.171Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; authentication-results: 419.consulting; dkim=none (message not signed) header.d=none;419.consulting; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2601:600:a080:aff0:9da7:d37e:e792:d7dd] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: fad65ea1-7532-4cac-0294-08d82d0bcc5b x-ms-traffictypediagnostic: BYAPR00MB0632: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 3CDTNfzaRxg+BbcW7jnt/p3NzhXFPoAWMA2i4cT5K+UQjs/I4H7cd5G5M130khynBn4MFAO/uIrTLvZeUoa5FPcXDRJ0kseLqPd4m6j2f9rLcwylfigNBsOgwyP1oyTgnmG9V3b0WqZIwwXZKn0g0ak+nUvu4E5Sul5get4EVwqmTMCnDtkWroBC6gXEQ0NeRuxZ1R4IgSAuicU5erKhDbBpX7wUtU8Brk7NT2l36rdj/5v4ufg9XoWJojdriWfaXzan5A50OaAT+UF9E6EAmIM2qNSQKId8qkn2GTqvE7tWr0jfmuY6Pa+C5GAvnf3AzouTTGJMyYlLHISIFHJsYcqyHjmMKR1v5Sum/DLTOBP1HB2sN9cFaSSmcDpPM/0zBP+WAZuC6gYeUzWF2b8eOw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR00MB0773.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(366004)(39860400002)(376002)(396003)(136003)(8936002)(83380400001)(71200400001)(4326008)(76116006)(66476007)(2906002)(166002)(66446008)(64756008)(316002)(55016002)(86362001)(66556008)(66946007)(9686003)(478600001)(8676002)(19627405001)(54906003)(110136005)(6506007)(966005)(186003)(82960400001)(10290500003)(5660300002)(53546011)(8990500004)(52536014)(33656002)(7696005)(82950400001)(19627235002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: aUKcMA66rLvyDCQy+p/L4hiV0mICJRyu1rJJDGCNQCsDYUt4H3hnSsmHuFMlW9AmLl1SvaMcdVGJ4qWy3D8Pu3XBaB4hRyLHHw1COs5Dkmzn5cU791NCSk4Ym8tS1MBJ6IGigmRxRgwyhN2AxRA48k/zE4RfNNhEtTOxkakdX6EfGbgaCUgm7nYYDSfocGdtjvpwiqH3j1sb/8s4a8je7xDkRQI7ZYQWW+wJMDqn1dm0ntsnpnUH81HplBXTdPI3L1MLl8toEW3dS6VI+TPrts8QRytqSOkBKHfxaDPmZwuPkXIuITNNwYswyc5XnE74gQtPJ/rplG6gndnvOXgKsWGBR1+/5H83Z6wB6K+pds5kDPeZez3W8GpPv3+VtImNOrROpmNvb/lQtQ3FOIkYWZSEF8baJXLDgo9ZMFQ+EmDTdA98bdP/56JSFogxAHHT0t06Nd4qLqsrFoXKtdW5oPMjf5WZqiE5WHICeLRGG1TNewMIzwUdehWidHeXQH1BEDrJ02TnuJfhtAjTlMhUtcxf88NiemPJUW301y04F+f9yWZhR0FYYjRDc9Sx86bfgpLFoPHkIK9EufzTSsTcyR3h0VrUSLjcQ9W9iGx81LVkMdIBj+6yzWb6L8qG5yeVbqaguJ/BMUWg3eRigSXhISPobCXvreJ+zaTUFVrIDUBRt5BST3D0H/4TOQ0IPbnM8PKp+ITde9wf8t26797HQg== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_BY5PR00MB077392611F6416D71E18C5F5FA7B0BY5PR00MB0773namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY5PR00MB0773.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: fad65ea1-7532-4cac-0294-08d82d0bcc5b X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2020 00:19:56.7280 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: IG2Y6AcqMxER0+W2suSHLm2AnhkG9PBnUjyKJU0lFYppjfKALka4OCabYmfxuBUnVmKYESXw8VeuMGh96DN/pw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR00MB0632 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 00:20:04 -0000 --_000_BY5PR00MB077392611F6416D71E18C5F5FA7B0BY5PR00MB0773namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hey Andrew, Thank you for bringing this to the WG. I think it's important to talk throu= gh the ISP perspective. Given the two documents are intertwined, I'll addre= ss your proposal directly despite the subject being your informational docu= ment. andrew> However, since the timeframe for this will be necessarily longer fo= r many users, my assumption is that the preference for most would be to enl= arge the potential pool of encrypted DNS users as quickly as possible. Part of my feedback on this document was that this assumption does not hold= true for me. I would rather avoid building protocols or systems we'll regr= et later than maximize the number of encrypted DNS users ASAP. I'm about to= write out the verbose version of why I don't feel that way. Please feel fr= ee to correct anything I've misunderstood or overlooked. In the spirit of ekr's calls for a threat model, let's walk through an atta= cker scenario. Let's say I discover 192.168.1.100 as a DNS server from my C= PE from my home Wi-Fi network. I did this via DHCP, which is an insecure pr= otocol. This proposal has a third party vouch for the authenticity, in this= case, the separately maintained mapping by DNS client vendors. I do not see this ISP list the same as the current Windows list of public D= oH servers, and I am not willing to accept the risk posed by maintaining th= is new mapping. Where the existing SPAU list we rely on contains only publi= cly documented and PKI verifiable names, the proposed mechanism does not. T= his means I'm not just confirming what someone else has already validated; = I'm now responsible for the maintenance of the original ownership verificat= ion for an ever-increasing number of ISPs which will include enterprises ru= nning their own internal networks also eager to avoid infrastructure update= s on their end. I will not do that, especially for a stop-gap feature whose= value will fade away as a proper bootstrapping mechanism is deployed. The proposal I'm coauthoring (https://tools.ietf.org/html/draft-pauly-add-r= esolver-discovery-01#section-5) won't work for RFC1918 addresses because th= ey can't be verified using PKI. I'm ok with this, as DNS use of HTTPS shoul= d not be less secure than any other use of HTTPS. Since DHCP discovery of 192.168.1.100 is insecure to start with and PKI can= 't be used to secure RFC1918 addresses, our choices are to invent a new tru= st mechanism (such as your proposal) or settle for opportunistic security. = For example, a DNS client receiving an RFC1918 address can simply try it wi= th DoT without concern for hostname. Literally just add TLS SPAU style. In = a threat model, what this provides is protection against multiple eavesdrop= pers, reducing the eavesdropper count between the client and the CPE to a m= aximum of one (whoever convinces the client to use their spoofed DHCP messa= ge). It does not guarantee the identity of who you are sending queries to. = However, this is no worse than before, as you have the same lack of authent= ication with classic DNS to a DHCP-discovered address but have now prevente= d eavesdropping by a third party. If this is viewed as a regression because an attacker can then prevent the = CPE from inspecting classic DNS traffic coming through it for ISP provided = filtering purposes, then we're back to inventing a new trust mechanism. Fro= m my perspective, this is a non-starter. That leaves us with two alternativ= es I can think of: make DHCP (or its replacement) secure, or allow use of c= lassic DNS on the client to CPE link. The former has previously been determ= ined to be a hard problem. The latter is our current situation. This is my in-depth way of asking: is rushing to get encrypted DNS to as ma= ny people as possible worth either settling for opportunistic protection or= inventing a whole new trust mechanism (which will be permanent whether we = wish it to be temporary or not, Paul Vixie recently shared some wisdom alon= g this line)? My answer here in order are "maybe" and "no" but I'd like to = hear what others think. I hear you that deploying public DNS servers is costly and not within your = interests. I also hear you that updating CPEs is time consuming. I simply d= on't see a way to avoid those things and continue to enable DNS to a CPE wh= ile providing the same level of security as DoH to a public resolver withou= t either securing DHCP (which is hard and brings us back to updating CPEs) = or inventing a new trust mechanism for private addresses (which adds a heav= y burden to DNS clients for stop-gap work). I welcome any comments or corrections. I'd be happy to be wrong. Thanks, Tommy Jensen =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D How can you secure your DNS queries? https://aka.ms/dohblogpost ________________________________ From: Add on behalf of Andrew Campling Sent: Monday, July 20, 2020 3:22 PM To: Eric Rescorla Cc: add@ietf.org ; Martin Thomson Subject: [EXTERNAL] Re: [Add] Practical Observations from Encrypted DNS Dep= loyments by Network Operators Ekr To clarify, there are two issues to overcome here, (i) use of RFC1918 priva= te addresses by the CPE (to facilitate SPAU) and (ii) support for DNS forwa= rders to maintain the full functionality provided by network operators that= is described in the document. The desired end state is as you describe: Client <------- TLS --------> CPE <------- TLS --------> ISP Resolver Whilst it would be ideal to deal with both of the above issues simultaneous= ly, pragmatically it may be necessary to deal with them sequentially given = the potential for delays in upgrading CPE software. Since there are alread= y some proposed discovery methods that deal with the private addresses, it = could make sense for to implement a two-step solution that first solves the= private address issue in the short-term whilst the CPE software upgrade is= deployed. This would at least maintain support for the user=92s chosen re= solver via encrypted DNS using SPAU whilst a CPE software upgrade is QA=92d= by the network operator and then deployed. Of course others may think it better to go with a single-step approach that= upgrades the CPE software to maintain support for DNS forwarders and deals= with the private address issue for SPAU at the same time. However, since = the timeframe for this will be necessarily longer for many users, my assump= tion is that the preference for most would be to enlarge the potential pool= of encrypted DNS users as quickly as possible. Does this help? Andrew From: Eric Rescorla Sent: 20 July 2020 16:03 To: Andrew Campling Cc: Martin Thomson ; add@ietf.org Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by= Network Operators Hi Andrew, Ignoring the discovery question for a moment, I guess I'm not entirely clear on what your desired outcome in terms of network topology is. As described in your draft, at present the clients send DNS packets to the forwarder on the CPE, which then selectively forwards queries to the main ISP resolver. However, in a world where the DNS is encrypted, then this would require that the encryption be terminated at the CPE and then re-originated to the ISP resolver, like so: Client <------- TLS --------> CPE <------- TLS --------> ISP Resolver Is that your desired outcome? If so, it seems to come into conflict with your points in S 5.2 about the difficulty of upgrading the CPE. If not, maybe I just don't understand. In either case, perhaps you can elaborate. -Ekr On Mon, Jul 20, 2020 at 7:47 AM Andrew Campling > wrote: On Thu, Jul 16, 2020, at 00:12, Martin Thomson > wrote: > Your draft seems to be making a case for supporting forwarders, but I'm n= ot clear on what supporting forwarders looks like. I understand that you m= ight not have specific ideas about what this support might look like, but I= don't see any real requirements here either. > > It would really help if the draft would clearly articulate what your desi= red outcome is. Sorry for the lack of clarity. The primary intent of the document is to pr= ovide information as we have the impression that at least some client devel= opers may not have good visibility of common network operator architectures= and practices outside of the US. By providing such clarity we hope to see= implementations that are sympathetic to the environment into which they ar= e being deployed in order to maximise the chances of working correctly, ide= ally via SPAU as manual configuration of DNS settings by the majority of us= ers seems unlikely. In a nut shell, any ADD solution should measure itself to see whether it me= ets the use case described in this document, at least one is needed that do= es. Andrew -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add --_000_BY5PR00MB077392611F6416D71E18C5F5FA7B0BY5PR00MB0773namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
Hey Andrew,

Thank you for bringing this to the WG. I think it's important to = talk through the ISP perspective. Given the two documents are intertwined, = I'll address your proposal directly despite the subject being your informational document.

andrew> However, since the timeframe for this will be necessarily longer for many users, my= assumption is that the preference for most would be to enlarge the potenti= al pool of encrypted DNS users as quickly as possible. 

Part of my feedback on this document was that this assumption does not hold= true for me. I would rather avoid building protocols or systems we'll regr= et later than maximize the number of encrypted DNS users ASAP. I'm about to= write out the verbose version of why I don't feel that way. Please feel free to correct anything I've misun= derstood or overlooked.

In the spirit of ekr's calls for a threat model, let's walk = through an attacker scenario. Let's say I discover 192.168.1.100 as a DNS s= erver from my CPE from my home Wi-Fi network. I did this via DHCP, which is an insecure protocol. This proposal has a th= ird party vouch for the authenticity, in this case, the separately maintain= ed mapping by DNS client vendors.

I do not see this ISP list the same as the current Windows list of public D= oH servers, and I am not willing to accept the risk posed by maintaining th= is new mapping. Where the existing SPAU list we rely on contains only publi= cly documented and PKI verifiable names, the proposed mechanism does not. This means I'm not just confirming= what someone else has already validated; I'm now responsible for the maint= enance of the original ownership verification for an ever-increasing number= of ISPs which will include enterprises running their own internal networks also eager to avoid infrastructure upd= ates on their end. I will not do that, especially for a stop-gap feature wh= ose value will fade away as a proper bootstrapping mechanism is deployed.

The proposal I'm coauthoring (https://tools= .ietf.org/html/draft-pauly-add-resolver-discovery-01#section-5) won't w= ork for RFC1918 addresses because they can't be verified using PKI. I'm ok with this, as DNS use of HTTPS should = not be less secure than any other use of HTTPS. 

Since DHCP discovery of 192.168.1.100 is insecure to start with and PKI can= 't be used to secure RFC1918 addresses, our choices are to invent a new tru= st mechanism (such as your proposal) or settle for opportunistic security. = For example, a DNS client receiving an RFC1918 address can simply try it with DoT without concern for hostname= . Literally just add TLS SPAU style. In a threat model, what this provides = is protection against multiple eavesdroppers, reducing the eavesdropper cou= nt between the client and the CPE to a maximum of one (whoever convinces the client to use their spoofed DHC= P message). It does not guarantee the identity of who you are sending queri= es to. However, this is no worse than before, as you have the same lack of = authentication with classic DNS to a DHCP-discovered address but have now prevented eavesdropping by a thi= rd party.

If this is viewed as a regression because an attacker can then prevent the = CPE from inspecting classic DNS traffic coming through it for ISP provided = filtering purposes, then we're back to inventing a new trust mechanism. Fro= m my perspective, this is a non-starter. That leaves us with two alternatives I can think of: make DHCP (or its rep= lacement) secure, or allow use of classic DNS on the client to CPE link. Th= e former has previously been determined to be a hard problem. The latter is= our current situation.

This is my in-depth way of asking: is rushing to get encrypted DNS to as ma= ny people as possible worth either settling for opportunistic protection or= inventing a whole new trust mechanism (which will be permanent whether we = wish it to be temporary or not, Paul Vixie recently shared some wisdom along this line)? My answer here in= order are "maybe" and "no" but I'd like to hear what o= thers think. 

I hear you that deploying public DNS servers is costly and not within your = interests. I also hear you that updating CPEs is time consuming. I simply d= on't see a way to avoid those things and continue to enable DNS to a CPE wh= ile providing the same level of security as DoH to a public resolver without either securing DHCP (which i= s hard and brings us back to updating CPEs) or inventing a new trust mechan= ism for private addresses (which adds a heavy burden to DNS clients for sto= p-gap work). 

I welcome any comments or corrections. I'd be happy to be wrong.

Thanks,
Tommy Jensen
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
How can you secure your DNS queries? https://aka.ms/dohblogpost 
From: Add <add-bounces@i= etf.org> on behalf of Andrew Campling <andrew.campling@419.consulting= >
Sent: Monday, July 20, 2020 3:22 PM
To: Eric Rescorla <ekr@rtfm.com>
Cc: add@ietf.org <add@ietf.org>; Martin Thomson <mt@lowentr= opy.net>
Subject: [EXTERNAL] Re: [Add] Practical Observations from Encrypted = DNS Deployments by Network Operators
 

Ekr=

To clarify, there= are two issues to overcome here, (i) use of RFC1918 private addresses by t= he CPE (to facilitate SPAU) and (ii) support for DNS forwarders to maintain= the full functionality provided by network operators that is described in the document.  The desired end= state is as you describe:

 

Client  <------- TLS -------->  CP= E  <------- TLS -------->  ISP Resolver

 

Whilst it would b= e ideal to deal with both of the above issues simultaneously, pragmatically= it may be necessary to deal with them sequentially given the potential for= delays in upgrading CPE software.  Since there are already some proposed discovery methods that deal with the= private addresses, it could make sense for to implement a two-step solutio= n that first solves the private address issue in the short-term whilst the = CPE software upgrade is deployed.  This would at least maintain support for the user=92s chosen resolver via = encrypted DNS using SPAU whilst a CPE software upgrade is QA=92d by the net= work operator and then deployed. 

 <= /b>

Of course others = may think it better to go with a single-step approach that upgrades the CPE= software to maintain support for DNS forwarders and deals with the private= address issue for SPAU at the same time.  However, since the timeframe for this will be necessarily long= er for many users, my assumption is that the preference for most would be t= o enlarge the potential pool of encrypted DNS users as quickly as possible.=  

 

Does this help?

 

 <= /b>

Andrew<= /b>

 

 

From: Eric Rescorla <ekr@rtfm.com>
Sent: 20 July 2020 16:03
To: Andrew Campling <andrew.campling@419.consulting>
Cc: Martin Thomson <mt@lowentropy.net>; add@ietf.org
Subject: Re: [Add] Practical Observations from Encrypted DNS Deploym= ents by Network Operators

 

Hi Andrew,

Ignoring the discovery question for a moment, I guess I'm not entirely
clear on what your desired outcome in terms of network topology is.

As described in your draft, at present the clients send DNS packets to
the forwarder on the CPE, which then selectively forwards queries to
the main ISP resolver. However, in a world where the DNS is encrypted,
then this would require that the encryption be terminated at the
CPE and then re-originated to the ISP resolver, like so:


Client <------- TLS -------->  CPE  <------- TLS -------= -> ISP Resolver

Is that your desired outcome? If so, it seems to come into conflict
with your points in S 5.2 about the difficulty of upgrading the CPE.
If not, maybe I just don't understand. In either case, perhaps you
can elaborate.

-Ekr


 

On Mon, Jul 20, 2020 at 7:47 AM Andrew Campling &l= t;andrew.campling@419.con= sulting> wrote:

On Thu, Jul 16, 2020, at 00:12, Martin Thomson <= ;mt@lowentropy.net> wrote:

> Your draft seems to be making a case for supporting forwarders, but I'= m not clear on what supporting forwarders looks like.  I understand th= at you might not have specific ideas about what this support might look lik= e, but I don't see any real requirements here either.
>
> It would really help if the draft would clearly articulate what your d= esired outcome is.

Sorry for the lack of clarity.  The primary intent of the document is = to provide information as we have the impression that at least some client = developers may not have good visibility of common network operator architec= tures and practices outside of the US.  By providing such clarity we hope to see implementations that are sympathe= tic to the environment into which they are being deployed in order to maxim= ise the chances of working correctly, ideally via SPAU as manual configurat= ion of DNS settings by the majority of users seems unlikely. 

In a nut shell, any ADD solution should measure itself to see whether it me= ets the use case described in this document, at least one is needed that do= es. 


Andrew

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

--_000_BY5PR00MB077392611F6416D71E18C5F5FA7B0BY5PR00MB0773namp_-- From nobody Mon Jul 20 17:40:35 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50BD23A122D for ; Mon, 20 Jul 2020 17:40:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com header.b=xeYQbvct; dkim=pass (2048-bit key) header.d=comcast.com header.b=g/974eFI; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=comcastcorp.onmicrosoft.com header.b=Va77tltl Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wn_Ho_gfKwxl for ; Mon, 20 Jul 2020 17:40:31 -0700 (PDT) Received: from mx0b-00143702.pphosted.com (mx0b-00143702.pphosted.com [148.163.141.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C3FBC3A1217 for ; Mon, 20 Jul 2020 17:40:31 -0700 (PDT) Received: from pps.filterd (m0156896.ppops.net [127.0.0.1]) by mx0b-00143702.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06L0Jl3n012140 for ; Mon, 20 Jul 2020 20:40:30 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.com; h=from : to : subject : date : message-id : content-type : mime-version; s=20190412; bh=Su2A8HDZnllbKP+idaGx1DM+sNlTZxWyr5UEhXYCh8U=; b=xeYQbvctvIuTkWCeTwda007dgKZZtKWRVYfIqP/d6Z3ipKjI2gsS4nxZqzdWFFgoq+yQ zgnLXn6M5VsmX3d3NGtkgNC9bKwITRsU6x708akyjNNHdCyoPooSaY9oUU9S2mj8wnjD Ak6McMwDL093moZs4PGU9zsKh7PrlivA3BYf2JthNmgR7tIiFVhPMYrCJc5jmqSycqdW vlM0djElwjmxd0y4GBq7gbsjoImQnruO5/SE5omEBdGl+d4x+L1kBmku7vpx+ZBwwgoI Rev1bEd/SBtNgZ4tg9WSnZWGZ3/cxJA9rgNGZxk/NGWy/C0Dw01AUjOmeQg/jUvoxnUc xg== Received: from pacdcmhout01.cable.comcast.com (PACDCMHOUT01.cable.comcast.com [68.87.31.167]) by mx0b-00143702.pphosted.com with ESMTP id 32bv38vspp-59 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 20 Jul 2020 20:40:30 -0400 DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1595292030; x=2459205630; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Su2A8HDZnllbKP+idaGx1DM+sNlTZxWyr5UEhXYCh8U=; b=g/974eFI0OKSmIrbGA7Kzces6JfJFvhGnss3/Cmro/yxocZapsjpNgZRWgdemojw jwT5CL3gWCSYUMiXn1WU9kaGvHoi05fc5RhqPyUxOVkceCq8yawrC0WN9VQWS0zh VjyqGL0Lg6LuyllF+0x6d4/ZjsH2R6rsUyjU8Pa1PYJoTvhyqVfOScMA7PMTc2HM perEQRiCcZUnJsZyM9FahSahczBkYrle5RpfF0ea1KOkuD3+7KPvU7lAuFOy3i9q 3kUAGFxFnC4OJDxz/sDvlEclQOoAuozbnKWQ26t9NskOw7s7ZtgbBBlrIcH0EGym HeMarFrTWTUQOAyzrm9Dkg==; X-AuditID: 44571fa7-3fdff70000018e96-91-5f16397d25b6 Received: from PACDCEX14.cable.comcast.com (cas-umc02.ndceast.pa.bo.comcast.net [68.87.34.28]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by pacdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 4C.4E.36502.D79361F5; Mon, 20 Jul 2020 20:40:29 -0400 (EDT) Received: from PACDCEX09.cable.comcast.com (24.40.1.132) by PACDCEX14.cable.comcast.com (24.40.1.137) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 20 Jul 2020 20:40:29 -0400 Received: from PACDCEXEDGE01.cable.comcast.com (76.96.78.71) by PACDCEX09.cable.comcast.com (24.40.1.132) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Mon, 20 Jul 2020 20:40:29 -0400 Received: from NAM12-MW2-obe.outbound.protection.outlook.com (104.47.66.42) by webmail.comcast.com (76.96.78.71) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 20 Jul 2020 20:40:28 -0400 Received: from BYAPR11MB3111.namprd11.prod.outlook.com (2603:10b6:a03:90::25) by BYAPR11MB2725.namprd11.prod.outlook.com (2603:10b6:a02:c5::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.25; Tue, 21 Jul 2020 00:40:27 +0000 Received: from BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0]) by BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0%4]) with mapi id 15.20.3195.025; Tue, 21 Jul 2020 00:40:27 +0000 From: "Deen, Glenn" To: ADD Mailing list Thread-Topic: New Threats ID for ADD Thread-Index: AQHWXveH7JO1nsTxqkKNHNNtJCTm0A== Date: Tue, 21 Jul 2020 00:40:27 +0000 Message-ID: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=comcast.com; x-originating-ip: [2605:e000:141b:121:9442:a71d:7b0a:7e04] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: c646000f-3836-4b5e-b25b-08d82d0ea9cd x-ms-traffictypediagnostic: BYAPR11MB2725: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: ZjyLrdPyDUTHElzrLg7Et2ZehqJYdg3RGYtatMMD3ZXE3bTriXPYLJf0fD5ornYiZvSRH/DW45xSlvP0SR/PzSOWC2ZCsBVns8bWr4gLI+tUXsqBvo8O5oPHJvHZWvnowTzABIVU5g9RzaUVQfP0qhTy9JoR7Yu5tlHilp3Fv3ZKA16bRK+7z+Legttn0HDONN3CgFUkHUY7BUJWJqhjMlcuGeElLxawqIKsx8Njpg54Y1cAV7rnKsKTuueXL9mOFtvLMIpYFflGzVypI2wKRtBy8kPLC0C/lj6t+iMfhLbdS4iYAW4htp3XQEFGyilEUutaFuWFqQu+5TjFhFpt7/j7EaOFLBgTSwoMZ4lhgMCQ7AVkaTwImOW94+PvmZGvYafVezR7Af7TQgug8rlg/Q== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3111.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(136003)(346002)(39860400002)(396003)(376002)(6512007)(66476007)(64756008)(66556008)(76116006)(66946007)(6506007)(66446008)(71200400001)(6486002)(4744005)(166002)(8676002)(86362001)(316002)(2906002)(8936002)(33656002)(5660300002)(966005)(478600001)(186003)(6916009)(2616005)(36756003); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: +uM7ubyqXLDvAKMSk9MwFONiIRYspCc7upJqiaEuciljeALYNcPuZY6hAzadRv7gCz64WAjPNSZDxeol4axSQ3qonC2to1oo5ozd+X021StNWjwPm8ANqC/FVjw1MFORXYICkReRdLcybSopfxMA0Ppbh6n3asuz+80KFgWK0TH4tuTrRJJnK2aRueogFxAAfO1inWBHHRopzbJvXdL98EyNeyemQ3ezbrxjjjTPwCGX1RnxjmgnTuWQEK20AKEw5ASjMp1XKjqijWibMdxwx6ElWab+3Oa0fEB452LU9illM45PU+bwWUq6cLJ6o8m3+0VQ+iPtcDv6bHjJKAT8uLzGDyqaIhvodoUdDTqhbhPrlbPcw0eyz4S2RzEeYIn9A76miq75XmwsBTVtYQmZs1Kvmf0g9Yk+YosaHtFhLSZgtng9woZhYTNq/sitUiEywdr0lQ5w1piAc8GNxCKXA/gIPO1knkgQ4l2pHmpgi6R6zZpLV4KaI20nyZqsYXEI2F/7V6nVgeLaOmN1HJisWt42YFpaFXN9prYikJb1yClT3nhDGT1eqhC44SPNkIZX x-ms-exchange-transport-forked: True arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=gnWGdf1MTn87PLB7frX+Xrb+coJr3YwlwE+D2bY/hUXcgGN1qkxXr0eU99pzJbcCjJSXgdsdd7yqrLo6P+8OMkEV+gjDvWarhA60Pwsios8AnWzlKxbhIO7GDHLFnBEgSz77ahBC93rLwXI4YiD3q16LdRQWyUeF7fDKfuekKrNNT5G0b2gYR7MdBQXikGGCapcc1FOl2FATpDdRWicQ5VLsI0HYlmjhkgCZnnwEiQfC0txdoXtLT/ZxYdjRnxQk4qyM+SsdQZWtomPiKURzdTp7hT7BSBKuf1nBy1hkgn/4DpKyUI4qy7Ymw6mzK3ARvFFBKw0QoWJ2ho1NZZwJJQ== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=st2yixWzOmBdsCiXM6RY2D6uLIEU91uR4+tlI9EMDuE=; b=T/YrwZoQKLP722qQTb1QoQdLSSo+iS9pDDPvHnG2L60j/9JR+n+gVklgkMu8k6IXxC50FCFCYCn1PMNbSfTZhcE86LSz5zN/j3R/7CsaOe4tG04p7dbYZc+N7DIxkzx8EFnT3z5QjxC1b+xTpHE3luCMyWt7xMfGCxzLfo3yIQPJMc5KmPQco8eJlBSah5RKnzNbVvbNaYBbdlGH9DP3Idd1iHbeqUl8CXohHalR6LzbRzb1u97qNTIgDOebCxmm4akrseuaneM2/UZDdDpAnW6Ef+27nNu2/7VcwPwWSowwDEuMgJeXlQ35xwABjn1Oi/Ndg/+gRgeXE+vyN0H14A== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=comcast.com; dmarc=pass action=none header.from=comcast.com; dkim=pass header.d=comcast.com; arc=none dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastcorp.onmicrosoft.com; s=selector1-comcastcorp-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=st2yixWzOmBdsCiXM6RY2D6uLIEU91uR4+tlI9EMDuE=; b=Va77tltlxXtnYZ6oZ/myBgokbhfKsn8uwxF94Q4kMRL1t03c2Cri8nPtZahdei1k552mIZ2seuSZpY1Ui2yFwR8fCIkLFBcNxTrtYw2Z8Y3VpL/3vzGX1sogRJxYLWrqBKvdXb8h6tgKT3WOicctrXj+g8WwntbpFTDBVcGtQEo= x-ms-exchange-crosstenant-authas: Internal x-ms-exchange-crosstenant-authsource: BYAPR11MB3111.namprd11.prod.outlook.com x-ms-exchange-crosstenant-network-message-id: c646000f-3836-4b5e-b25b-08d82d0ea9cd x-ms-exchange-crosstenant-originalarrivaltime: 21 Jul 2020 00:40:27.0280 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 906aefe9-76a7-4f65-b82d-5ec20775d5aa x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: 4tuX5vS0VwtdFpegjmEoWdm24KNMhPoQkGI9nduGSpEdVn3Q2THHMPJ5tYEwxvebU8xaSAcntdRdvU9Jh/sYTxnrSx8DRbcaEb1iZ0ui2I4= x-ms-exchange-transport-crosstenantheadersstamped: BYAPR11MB2725 x-originatororg: comcast.com Content-Type: multipart/alternative; boundary="_000_02A55BA85A8D4B7DB0F0A2A3DE12A776comcastcom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA02Sa0hTYRjHec85m8fh4HXqfDBzuVRMdDYMtZspRAgqFBmRhXPhIc01ZVNx WWFJjOYlTSkaLadpmZQrE+eNacsIb1mZMsRCc5TmhzChUGnldhb47fd/nv9ze3lpUtDICaBz lYWMSilXiLk86vBJcWDU5b1C2e5rK/vj/462cxNRcnPzGnEUZfAOZDOK3GJGFZ2Qxcv5urKA CqaiSvp7LJwy1BqpQ5404D3wfKOVo0M8WoCHCKj+YyFY0YtgoLyWYsUUAt3cjFu8RnB/w4yc 9QL8gADHqIJNfEHQ97Zps56muTgSul4ccnp88U5o+WQmnOyDRfDw/QCHjYfA3I3bFMsSmOw2 uHpSOBR+ttldzMcJYFtadfkRFsLvkSeuPiT2hxl7A8HegKG5f4Jk2Q+WFhwuvx+Ohs+mVdfS COsQfNcNIudugPdBnTWc9W+HDw0ViOU00P7q9WA5AsYaDe54HlS9u+PuHwbm6Qn33CBoq5qn WA6EOZuZ65wFuI+EW+s9bjFLws3FOoIVdgrWB4e57BYh4LBqapBUv+Ugls9C51AXqXc9gDcM 37VT+s0KEu8CU280awmG+op5D5bD4fo9g5uTYenNAtrqMSK6DXnFxkvi4yQxUok0Nq4DuT6O 6FE3MutzrAjTSOzFN4QJZQKOvFituWBFQJNiX36tl49MwM+Way4yqnyZqkjBqK1oG02J/fk1 U4uZAnxOXsjkMUwBo/qfJWjPgDIkPyMylihDT9c8M1gqvdXEbENWU9D5GHlP0LIpv92oT02a zjaFZZbXa6vDxccsR9IcfsaYgKsFI51FmoOPX+1YvvKN9/JHBqUdfZqalF7Y3XGKqltL7lMf T7VVjwtHgj9eSklZHrMlptiV9sHSSVIhGm+YbTzBLc1r0ZalVzrElDpHLo0gVWr5P8dfxDo0 AwAA X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-20_09:2020-07-20, 2020-07-20 signatures=0 X-Proofpoint-Spam-Reason: safe Archived-At: Subject: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 00:40:33 -0000 --_000_02A55BA85A8D4B7DB0F0A2A3DE12A776comcastcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQURELA0KDQpJIHdhbnRlZCB0byBicmluZyB0byB5b3VyIGF0dGVudGlvbiBhIHNob3J0LCB2 ZXJ5IHNob3J0LCBkcmFmdCB0aGF0IEkgd3JvdGUgdXAgYmFzZWQgb24gYW4gZW1haWwgdGhyZWFk IG9uIHRoZSBXRyBsaXN0LiAgSXQgY2FwdHVyZXMgYSBiYXNpYyBmcmFtZXdvcmsgb2YgR3JlZW4t WWVsbG93LVJlZCB0aHJlYXQgYW5kIHRydXN0IHJlbGF0aW9uc2hpcHMgdGhlIHVzZXIgbWF5IGhh dmUgd2l0aCB0aGVpciBuZXR3b3JrLiAgIFRoZSBob3BlIGlzIHRoYXQgdGhpcyBjYW4gYmUgYSBi YXNpcyBmb3IgZm9jdXNpbmcgZGlzY3Vzc2lvbiBvZiB0aHJlYXRzIGFuZCB3aGF0IG1pdGlnYXRp b25zIG1heWJlIG5lZWRlZCBpbiBkaWZmZXJlbnQgc2l0dWF0aW9ucy4NCg0KaHR0cHM6Ly9kYXRh dHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1kZWVuLWFkZC10aHJlYXRzLTAwDQoNCkl0 IGlzIGJ5IG5vIG1lYW5zIGNvbXBsZXRlLCBhbmQgaGFzIG9uZSBnbGFyaW5nIHR5cG8gaW4gdGhl IHRpdGxlIHdoaWNoIEkgd2lsbCBmaXggb25jZSB0aGUgZGF0YXRyYWNrZXIgb3BlbnMgZm9yIG5l dyB2ZXJzaW9uIHVwbG9hZHMuICBDb21tZW50cyBvbiBsaXN0IHBsZWFzZS4NCg0KUmVnYXJkcw0K R2xlbm4NCg0KDQoNCg0KDQo= --_000_02A55BA85A8D4B7DB0F0A2A3DE12A776comcastcom_ Content-Type: text/html; charset="utf-8" Content-ID: <67912FA44BE7994DB5CF12A191733349@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6IlRpbWVzIE5ldyBSb21hbiBcKEJvZHkgQ1NcKSI7DQoJcGFub3NlLTE6MiAyIDYgMyA1 IDQgNSAyIDMgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1z b05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAw MDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLkVt YWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZvbnQtZmFt aWx5OkhlbHZldGljYTsNCgljb2xvcjp3aW5kb3d0ZXh0Ow0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsN Cglmb250LXN0eWxlOm5vcm1hbDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpl eHBvcnQtb25seTsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCglt YXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdl OldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMi IGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9u MSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTpIZWx2ZXRpY2EiPkhpIEFERCw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpIZWx2ZXRpY2EiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGlj YSI+SSB3YW50ZWQgdG8gYnJpbmcgdG8geW91ciBhdHRlbnRpb24gYSBzaG9ydCwgdmVyeSBzaG9y dCwgZHJhZnQgdGhhdCBJIHdyb3RlIHVwIGJhc2VkIG9uIGFuIGVtYWlsIHRocmVhZCBvbiB0aGUg V0cgbGlzdC4mbmJzcDsgSXQgY2FwdHVyZXMgYSBiYXNpYyBmcmFtZXdvcmsgb2YgR3JlZW4tWWVs bG93LVJlZCB0aHJlYXQgYW5kIHRydXN0DQogcmVsYXRpb25zaGlwcyB0aGUgdXNlciBtYXkgaGF2 ZSB3aXRoIHRoZWlyIG5ldHdvcmsuJm5ic3A7Jm5ic3A7IFRoZSBob3BlIGlzIHRoYXQgdGhpcyBj YW4gYmUgYSBiYXNpcyBmb3IgZm9jdXNpbmcgZGlzY3Vzc2lvbiBvZiB0aHJlYXRzIGFuZCB3aGF0 IG1pdGlnYXRpb25zIG1heWJlIG5lZWRlZCBpbiBkaWZmZXJlbnQgc2l0dWF0aW9ucy48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Imh0dHBzOi8vZGF0YXRyYWNrZXIu aWV0Zi5vcmcvZG9jL2h0bWwvZHJhZnQtZGVlbi1hZGQtdGhyZWF0cy0wMCI+aHR0cHM6Ly9kYXRh dHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1kZWVuLWFkZC10aHJlYXRzLTAwPC9hPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JdCBpcyBieSBubyBtZWFucyBjb21wbGV0ZSwgYW5kIGhh cyBvbmUgZ2xhcmluZyB0eXBvIGluIHRoZSB0aXRsZSB3aGljaCBJIHdpbGwgZml4IG9uY2UgdGhl IGRhdGF0cmFja2VyIG9wZW5zIGZvciBuZXcgdmVyc2lvbiB1cGxvYWRzLiZuYnNwOyBDb21tZW50 cyBvbiBsaXN0IHBsZWFzZS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UmVnYXJkczxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+R2xlbm4gPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpIZWx2ZXRpY2EiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGlj YSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_02A55BA85A8D4B7DB0F0A2A3DE12A776comcastcom_-- From nobody Mon Jul 20 17:43:43 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D0DC3A1234 for ; Mon, 20 Jul 2020 17:43:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H13dJKHnIYPj for ; Mon, 20 Jul 2020 17:43:40 -0700 (PDT) Received: from mail-lf1-x12d.google.com (mail-lf1-x12d.google.com [IPv6:2a00:1450:4864:20::12d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 501003A1233 for ; Mon, 20 Jul 2020 17:43:40 -0700 (PDT) Received: by mail-lf1-x12d.google.com with SMTP id j21so10725409lfe.6 for ; Mon, 20 Jul 2020 17:43:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=8uYNQNrhc+7nrDJ9xFOgmCehwa8RD4/feZJaUSd9SdM=; b=qIjq6bzuEm+/JC3o+ZjAqdLWt4BcNyIFvzqMW/vduagdBQuyZ9JYu7Cuox5mOGuXtq /7kXkdxu3W8ziihpfPlIbkEzwOKKqH9vgpgb0ln4KEk1F2Ypv8lZg1KltEH3672y7320 n5qlycyCtHwg+oHup4AhONvE0blKORS7t/iZrEmDwhKWr8wt8/msSi98BBD+gOSJxdDj tHTUnqe+zVAsFfu0/c1zaXj6/EimrCGVzjO6GpZceMd4Ya8CqLN/t2nDcgOlRz7nOPw1 l8v3kkRHj31WDcAiUvG9aYmXBTFV8QNBNUIpvNQwhXvjVxtjMraZ4Y9je5pNtkw2DJ6g 7r5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=8uYNQNrhc+7nrDJ9xFOgmCehwa8RD4/feZJaUSd9SdM=; b=LiK1FvrV6tAo6qmqiu650wG1Xz1mqI50rRNIqLPylW7XU0XHfhwFjuCnRwHYJw7DXn EbrpUQfj2Yj/F8elcWrqI+l5D2k5aB5NPK/DF0tuA73hb0AHhTCwPvvEJNThOt1Ti86j cPDwzl9pFf/6gIA73hKPLUrt7U1Zh9SAcnAJjoZ++W7xKLFTut1IhyPspRxSs1GkREs6 85OC3C33erRk+rEIU0d3AskgtdLP8/6NLXTI0gEzv8s1CQ4mc/7ubozSjU53uJflrTy1 xZkiKUAu9rvipaga2nB+cPQfB45Npf8vvmiQpW1UpzIxQmIEyM4RBcRhcqRCBRBdzK0c IsGg== X-Gm-Message-State: AOAM5323aIfsyhXGrFbyaGC5Lr7R9NfEp53e53XaWmzfm6M/L5FuLWTy Fnwwi+K55JbsQOQTm3KciX6W7uTxNFqeGweGxuPyqg== X-Google-Smtp-Source: ABdhPJzMpS2j3fI6Hep9Ry/S+y1tbRspenF/4SlBpPuLmLFkNcA+Aawd6mzDVEWVWOVrB4JsIC+JfVGOUGkdfnFlCUM= X-Received: by 2002:ac2:5f81:: with SMTP id r1mr11859880lfe.168.1595292218294; Mon, 20 Jul 2020 17:43:38 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: From: Eric Rescorla Date: Mon, 20 Jul 2020 17:43:02 -0700 Message-ID: To: Andrew Campling Cc: Martin Thomson , "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000fc21ca05aae8e9d5" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 00:43:42 -0000 --000000000000fc21ca05aae8e9d5 Content-Type: text/plain; charset="UTF-8" Thanks for the clarification. On Mon, Jul 20, 2020 at 3:22 PM Andrew Campling wrote: > To clarify, there are two issues to overcome here, (i) use of RFC1918 > private addresses by the CPE (to facilitate SPAU) and (ii) support for > DNS forwarders to maintain the full functionality provided by network > operators that is described in the document. The desired end state is > as you describe: > > > > Client <------- TLS --------> CPE <------- TLS --------> ISP Resolver > > > > Whilst it would be ideal to deal with both of the above issues > simultaneously, pragmatically it may be necessary to deal with them > sequentially given the potential for delays in upgrading CPE software. > Since there are already some proposed discovery methods that deal with > the private addresses, it could make sense for to implement a two-step > solution that first solves the private address issue in the short-term > whilst the CPE software upgrade is deployed. So the idea here would be to have a mechanism which enabled Do[TH] but bypassed the CPE, correct? So, it would be something that one deployed at the ISP's recursive and that we just expected the CPE to pass on? It seems like the primary requirement there would be for something which had a very high chance of passing through existing CPE. With that said, I have some concerns about the objective of having the CPE in the user's resolution path. While I certainly can understand the reasons you consider it advantageous, it seems to me that it significantly weakens the user's security posture. Even assuming arguendo that we have a secure mechanism for discovering this case, in practice the CPE seems to have quite a high rate of security issues, including specifically DNS hijacking (see for instance [0]). One of the advantages of Do[TH] from client to recursive is that it has the potential to mitigate attacks from attackers on the network -- including the local router -- and this seems like it would regress that. -Ekr [0] https://labs.bitdefender.com/2020/03/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/ --000000000000fc21ca05aae8e9d5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Thanks fo= r the clarification.

On Mon, Jul 20, 2020 at 3:22 PM Andrew C= ampling <andrew.campling@419.consulting> wrote:
> To clarify, t= here are two issues to overcome here, (i) use of RFC1918
> private ad= dresses by the CPE (to facilitate SPAU) and (ii) support for
> DNS fo= rwarders to maintain the full functionality provided by network
> ope= rators that is described in the document.=C2=A0 The desired end state is> as you describe:
>
> =C2=A0
>
> Client <= ------- TLS --------> CPE <------- TLS --------> ISP Resolver
&= gt;
> =C2=A0
>
> Whilst it would be ideal to deal with = both of the above issues
> simultaneously, pragmatically it may be ne= cessary to deal with them
> sequentially given the potential for dela= ys in upgrading CPE software.
> Since there are already some proposed= discovery methods that deal with
> the private addresses, it could m= ake sense for to implement a two-step
> solution that first solves th= e private address issue in the short-term
> whilst the CPE software u= pgrade is deployed.

So the idea here would be to have a mechanism wh= ich enabled Do[TH] but
bypassed the CPE, correct? So, it would be someth= ing that one deployed
at the ISP's recursive and that we just expect= ed the CPE to pass on?
It seems like the primary requirement there would= be for something which
had a very high chance of passing through existi= ng CPE.


With that said, I have some concerns about the objective= of having the
CPE in the user's resolution path. While I certainly = can understand
the reasons you consider it advantageous, it seems to me = that it
significantly weakens the user's security posture. Even assu= ming
arguendo that we have a secure mechanism for discovering this case,=
in practice the CPE seems to have quite a high rate of security
issu= es, including specifically DNS hijacking (see for instance [0]).
One of = the advantages of Do[TH] from client to recursive is that
it has the pot= ential to mitigate attacks from attackers on the network
-- including th= e local router -- and this seems like it would regress
that.

-Ekr=

[0] https://labs.bitdef= ender.com/2020/03/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-= infostealer/




--000000000000fc21ca05aae8e9d5-- From nobody Mon Jul 20 17:50:56 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38CAA3A0C26 for ; Mon, 20 Jul 2020 17:50:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p0xhCNfxvzda for ; Mon, 20 Jul 2020 17:50:49 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7F0D3A0BEF for ; Mon, 20 Jul 2020 17:50:48 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 16680C3F16; Tue, 21 Jul 2020 00:50:46 +0000 (UTC) From: Paul Vixie To: Andrew Campling , add@ietf.org Cc: "add@ietf.org" , Martin Thomson , Eric Rescorla Date: Tue, 21 Jul 2020 00:50:45 +0000 Message-ID: <2515140.uIgGUBp3BU@linux-9daj> Organization: none In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 00:50:51 -0000 On Tuesday, 21 July 2020 00:43:02 UTC Eric Rescorla wrote: > ... I have some concerns about the objective of having the > CPE in the user's resolution path. While I certainly can understand > the reasons you consider it advantageous, it seems to me that it > significantly weakens the user's security posture. yes. > Even assuming > arguendo that we have a secure mechanism for discovering this case, > in practice the CPE seems to have quite a high rate of security > issues, including specifically DNS hijacking (see for instance [0]). there's no method at present to distinguish dns hijacking from dns filtering, and dns filtering is an oft-used tool in network defense. sure one is the baby and the other is the bathwater, but how can an app know the difference? > One of the advantages of Do[TH] from client to recursive is that > it has the potential to mitigate attacks from attackers on the network > -- including the local router -- and this seems like it would regress > that. yes. because the internet is a network of networks, and the operators of edge networks may have policies which may be regulatory, and the users whose security posture concerns you may be minor children, employees, disgruntled employees, intruders, malicious or poisoned supply chains, or malware. as the owner and operator of an edge network, i will be held responsible for the traffic leaving my network. i intend to exercise that responsibility. if this WG contemplates a design or feature which would obfuscate the difference between on-path actors who own and operate the edge network, as against on- path actors who are upstream (like an evil ISP or authoritarian government), then we have to keep moving until we find a non-obfuscating security model. -- Paul From nobody Mon Jul 20 18:15:34 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C1C0F3A125B for ; Mon, 20 Jul 2020 18:15:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HinsOgD07PI7 for ; Mon, 20 Jul 2020 18:15:29 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8AA1E3A125E for ; Mon, 20 Jul 2020 18:15:29 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 58D9DBE47; Tue, 21 Jul 2020 02:15:27 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AhkqSWrXWAcO; Tue, 21 Jul 2020 02:15:25 +0100 (IST) Received: from [10.244.2.119] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 8330BBE3E; Tue, 21 Jul 2020 02:15:25 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1595294125; bh=y/NXl2+/zaaNsiWDuz7YBMkOgKIk8rpa/qeIDEToAfU=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=zrTJVdWoBhNZHtMAOyf/4zCw+4fKpOY6P9xkk//l2BnQdiBHSKPkKo3Uzr/SdlKbZ 7XSZxku5my94PSQv3tUWLq9KYYTST/KQzI7wksO2T+AUz9sOZ7ivsUVLIzGMTEdALl o63MHD+DclSfO0MX+eX1zR2cbjav16S3aOoDzas0= To: Paul Vixie , Andrew Campling , add@ietf.org Cc: Eric Rescorla , Martin Thomson References: <2515140.uIgGUBp3BU@linux-9daj> From: Stephen Farrell Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <73db546a-0c47-fe18-0b9e-ec120e56bddd@cs.tcd.ie> Date: Tue, 21 Jul 2020 02:15:24 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: <2515140.uIgGUBp3BU@linux-9daj> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="5pTtOgXrvGZ28EJBaGpKRs6QzgB2CwUeO" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 01:15:33 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --5pTtOgXrvGZ28EJBaGpKRs6QzgB2CwUeO Content-Type: multipart/mixed; boundary="30vtIjJ2afwShfqYPTA1RAj5i7rqbjtGw"; protected-headers="v1" From: Stephen Farrell To: Paul Vixie , Andrew Campling , add@ietf.org Cc: Eric Rescorla , Martin Thomson Message-ID: <73db546a-0c47-fe18-0b9e-ec120e56bddd@cs.tcd.ie> Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators References: <2515140.uIgGUBp3BU@linux-9daj> In-Reply-To: <2515140.uIgGUBp3BU@linux-9daj> --30vtIjJ2afwShfqYPTA1RAj5i7rqbjtGw Content-Type: multipart/mixed; boundary="------------0863EADAF7ED405FB0CFA522" Content-Language: en-US This is a multi-part message in MIME format. --------------0863EADAF7ED405FB0CFA522 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 21/07/2020 01:50, Paul Vixie wrote: > because the internet is a network of networks, and the operators of edg= e=20 > networks may have policies=20 There's an interesting thing there - the current Internet, with Cloudy-blah-services, CDNs, VPNs, Tor etc seems no longer to be a network of networks that only touch at their edges, but rather a network of networks some of which are much more intimately entwined. I don't have a solution to offer that solves all problems in that context, but I do think it means that "my network, my policy" is no longer as practical as was once the case. Cheers, S. --------------0863EADAF7ED405FB0CFA522 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------0863EADAF7ED405FB0CFA522-- --30vtIjJ2afwShfqYPTA1RAj5i7rqbjtGw-- --5pTtOgXrvGZ28EJBaGpKRs6QzgB2CwUeO Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl8WQawACgkQWrL68XsX K+q/Lw/+IuPs+Hu3fX0OL7HKMILNcL8uPNQNvUcggv/FqzIJ1mtsh1sIIUTJB/b/ KiMp60eXlpfDKITA7IqpSZMbwog3is+uUtwwTp0v6iGqmqju5qYBhi5NK8s3p58u U8WIrPdv6eA6pjJZgBmfSsPNCjdthHnAHxX5sopPb2gVVh3In+HyotGCR/WL3CZU rIDimVJpmjHXulEPTv5IOmIpqVpuEcrnhQuJO3D41B1NHKign8UGo4w/kKlrEfrQ /wDN6hiBLlqhgILgYmV48Uxo0ZLoGyMupC1LJQdPtzMDAu8YinhtkSKuxoBYrwrM kuHMv5TYUU8AClm5KHtUu8NlwZeLHlW0gvTU0D488/1QdYas4Qhw3ifUhtnjg+Oa TMc4xCBJ83Ko3KMmpU2HvZ5jkj10Bx5flpTztxgPg4Rt2iEGAN+FkPmj5v4RyQZ8 6PP1PfNUkeOaL8c7aZLUInzK2DmLj9gESEHm8vW5n9YY5cPTkxC5oLpHbkFWgudf owS80V9Zu8+nTWe+Dk89iq+x3cHTy10amX4Vreq8UjM8XKjFZ+uwCXZMIXGCEw5Y qtrms2lgbgemy4ev2WiFLfOKxkmwtgqhoTR83vtxojI0FDrbu2DLobdTQXwnDx0P QN4Oxni9aJfhR2oONsXyiSo3mIn0chzzZqoqq1I6hYmgUD19YhQ= =peBq -----END PGP SIGNATURE----- --5pTtOgXrvGZ28EJBaGpKRs6QzgB2CwUeO-- From nobody Mon Jul 20 18:30:54 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E1E13A127B for ; Mon, 20 Jul 2020 18:30:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.62 X-Spam-Level: X-Spam-Status: No, score=-9.62 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=bIvWnMAm; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=cisco.onmicrosoft.com header.b=tOkKvvUF Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 799IhWoWlX-3 for ; Mon, 20 Jul 2020 18:30:50 -0700 (PDT) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E6833A1279 for ; Mon, 20 Jul 2020 18:30:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=21386; q=dns/txt; s=iport; t=1595295049; x=1596504649; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=o/n1M4Y2ZNGwLVbv11jyRbgGbkBJileDgdcg+Nl4yCY=; b=bIvWnMAmIY60cbmwRiZSY70rip8HRLdEPA0nwhhjzrHeBo034zHIVruc Qi1LEA20OEDDDuec5N9Jr26eqdecyv4OjLjkILTf592TvlnCwRhiEyIxc Y4ufs4R2jkWPVYoAUNN26Hc7+X1bIfjLiMcw6RlEOxujHdTF/bT1aO+7/ Q=; X-Files: smime.p7s : 3980 IronPort-PHdr: =?us-ascii?q?9a23=3AWHSGuh+/FcD/0P9uRHGN82YQeigqvan1NQcJ65?= =?us-ascii?q?0hzqhDabmn44+7ZhCNuaw8ylTOW57G7+5FjeWF+6zjWGlV55GHvThCdZFXTB?= =?us-ascii?q?YKhI0QmBBoG8+KD0D3bZuIJyw3FchPThlpqne8N0UGRJ+vIVbVpGav6SITHB?= =?us-ascii?q?qsfQZwL/7+T4jVicn/3uuu+prVNgNPgjf1Yb57IBis6wvLscxDiop5IaF3wR?= =?us-ascii?q?zM8XY=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0C0BQCcRBZf/4YNJK1gHAEBAQEBAQc?= =?us-ascii?q?BARIBAQQEAQGCCoEjLyMGKAdvKy0vLAqEKYNGA41Kk3KEbIJTA1UEBwEBAQk?= =?us-ascii?q?DAQEYAQoKAgQBAYFWgnYCgh8CJDgTAgMBAQsBAQUBAQECAQYEbYVcDIVxAQE?= =?us-ascii?q?BAwEBARARBAYTAQEsCwEECwIBCBEEAQEoAwICAiULFAkIAgQBDQUIBg0HgwW?= =?us-ascii?q?Bfk0DDhEPAQ6hTwKBOYhhdn8zgwEBAQWFERiCBwcDBoE4gVOBF4NVhhYdGoF?= =?us-ascii?q?BP4ERQ4IfLj6CXAEBgVARKwmCYDOCLY9FASqCZqJ1CoJdhDOCWIgBiniPd49?= =?us-ascii?q?RkgGefwIEAgQFAg4BAQWBaiOBV3AVO4JpUBcCDY4eN24BCYJChRSFQnQ3AgY?= =?us-ascii?q?BBwEBAwl8jBGBMwGBEAEB?= X-IronPort-AV: E=Sophos;i="5.75,377,1589241600"; d="p7s'?scan'208,217";a="791268179" Received: from alln-core-12.cisco.com ([173.36.13.134]) by rcdn-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 21 Jul 2020 01:30:24 +0000 Received: from XCH-ALN-005.cisco.com (xch-aln-005.cisco.com [173.36.7.15]) by alln-core-12.cisco.com (8.15.2/8.15.2) with ESMTPS id 06L1UO7Z020777 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 21 Jul 2020 01:30:24 GMT Received: from xhs-aln-001.cisco.com (173.37.135.118) by XCH-ALN-005.cisco.com (173.36.7.15) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 20 Jul 2020 20:30:23 -0500 Received: from xhs-aln-003.cisco.com (173.37.135.120) by xhs-aln-001.cisco.com (173.37.135.118) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 20 Jul 2020 20:30:22 -0500 Received: from NAM10-DM6-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Mon, 20 Jul 2020 20:30:22 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=SJDw7PmC0FTdi4lh++r5leGi4e0N1OOK5z4CLmetcKTzO+TKf9Zrj+QEegAs6qR6HIxWdjQGZhJCU7yQhgzZNkkz7TYODSvwBibKH44JW2nm7Q7CHvThl56kNyWQw327AmQawZIJ6a8wIVnTVjvM+i8KOglCPNhYIbS/T9N/CdzgeAKLy2zzBrsyA+BZK63bP8BEZbfmR5lFx/P+PcRfYXYIeQ/DQ+J2JCMkw8/iiBI63El/zwyEIdguQtGVsa3S5+IPAszp/0nF7FOc++0R+N/gXm6Z8lVYjzOxwcDuFwtMgnxk03uCHnGz886433+v+TxIHMbsB+1WrAlEVVCKrQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LxDaUwTP0tlTY13f7oy7zIZ85J/8IRT0NLddjc/BYJs=; b=mmsn3xIfLNX0h6a+v6kmSkiFnFBpnieRkSJxNiNJlvotBvwxT2isqRqoPywyQTM+dXM0kmQJbJhpPN8R2F7M/Rnj2jrlaQ3zvcmN6/VR4457aPa1KuZxDOOnNQAvVpzmKm6GfisR8BB/s0zcFdX6v3u5Gsa1HDZyIH+PpRTb+ntvM2COvn0esjFHB+AlSDowjhK3fpRC48gn23sFQu4+AILj0PVmPLFcD0hs6hO3pj05shMkf7gmD8piX3UGlR1gXbsXOUCwBZPf5Jdb4EeSDxYcJESmDyqOPl9Pew8ZXX2dLwAAKzbM541mpC/x7UfAw9Ey3dZUnlB82sUsBzOIpA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LxDaUwTP0tlTY13f7oy7zIZ85J/8IRT0NLddjc/BYJs=; b=tOkKvvUFJLIH6eGsQT54fMfrUuN6buSv5rCijOsFiCS4rcHDtM5pFHvOvDApfnUK7BPKXDKEjj1EdA3Nrzy6b9nTtXLBPKcGMzM4UOXiEGG0LP8N/uA827fOdZ5n5NvAVyLEpN+josAsNNAtf7QBz67vOi3WvwDqTrNAeCPi0/s= Received: from MN2PR11MB4760.namprd11.prod.outlook.com (2603:10b6:208:266::22) by MN2PR11MB4760.namprd11.prod.outlook.com (2603:10b6:208:266::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.25; Tue, 21 Jul 2020 01:30:21 +0000 Received: from MN2PR11MB4760.namprd11.prod.outlook.com ([fe80::cb0:4953:d19f:b3de]) by MN2PR11MB4760.namprd11.prod.outlook.com ([fe80::cb0:4953:d19f:b3de%2]) with mapi id 15.20.3195.025; Tue, 21 Jul 2020 01:30:21 +0000 From: "Vinny Parla (vparla)" To: Andrew Campling , Eric Rescorla CC: "add@ietf.org" , Martin Thomson Thread-Topic: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AQHWXuRG2acz4cQYUkeZGxUb750oyKkRPpRw Date: Tue, 21 Jul 2020 01:30:21 +0000 Message-ID: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: 419.consulting; dkim=none (message not signed) header.d=none;419.consulting; dmarc=none action=none header.from=cisco.com; x-originating-ip: [98.217.108.128] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 5d4e7be8-f322-46d9-2e2d-08d82d15a25f x-ms-traffictypediagnostic: MN2PR11MB4760: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: DmWZvT+cl7R1eyu09Mhu3MgoVx0XmJHYspo21VH5DY9urex1su/hEFMvWesbokneYLAX+inMa7wAdQT+SBFkH2OFtKRigvUUJQm9/1T/ocajwgILMXQAhsKk2CxGyvO6uKveSXb8CFJO1bkuwohFWzI3QpWmGw+XWuDeXox2IFh8HvUIHOhAkqXjN4r2TEMIuI1GjAm1uOfcxZZfL6x2l0gIHKNurvEQeMvm2HgEEqdj+gTXJFWMZH3UZN63rljV7QO/9CMjAjD8QsFJiJMQoTey35BQSSnuHUnwk83Ui6RgfYT2VBV2T9MOtBvCl5S+ZD3iXpdoKHATkgfNqtF1d7p5PZW87IJ5wQizOMgF3D1Vc6xELyNuv0LunvsY+WILwF03mmqMJTZo+923WGz0Vg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MN2PR11MB4760.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(136003)(39860400002)(366004)(376002)(346002)(396003)(8936002)(54906003)(110136005)(71200400001)(66616009)(2906002)(64756008)(478600001)(52536014)(8676002)(66446008)(66946007)(66476007)(66556008)(76116006)(5660300002)(966005)(86362001)(7696005)(9686003)(166002)(186003)(26005)(55016002)(33656002)(4326008)(53546011)(99936003)(6506007)(316002)(83380400001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: VUpLhBwOMrxuG4ssuq16pxlKLJ8SXAqhJq6nkTbo3Ok5TVCS8kqtu1obVhzGXo/iOWlWUAqE3P86YUYsPT+u7/J8BPo3KIjaq35E7JYxS2dLsa/xIFa6TewuUEb+v5UzEHxtmHujHuc8XovV46/5RSq1Sh8PdTRzSAcxFf+VwG/DS+ZjTBDeIo7jJab7qwk09eamYgghBT8POGaZJf+ClmaiXjQCXG2dASaZz1kwbCYegppVNYnCoIR437Ue8n6zsjSSJM/MyKDzXJ/mi5d2xoZeDg8Rp+E+dLTXD6ZHmDiQEwmj6uzmEn6LHn1giw/aHTNDYB/DRl3K/z2umIOAAe4pcLLkmKsM/JvPccSH0MGQtXxhHiGRy5TLnQR8ZydG6GwPNqXZLjxfh2kFqeQLnnTFI4pwbzAl/X7JTYGZ5utrcZPvk1lvD+cWTR0FAgjmgjRrvsmCtXzhNXTzKcsuvv70F89g2ftiIH/1kltQaA87JvubwsHZF8k8MQOyJzHy x-ms-exchange-transport-forked: True Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_0261_01D65EDC.F775B1F0" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MN2PR11MB4760.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5d4e7be8-f322-46d9-2e2d-08d82d15a25f X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2020 01:30:21.3300 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: ViXgpufBxIVM8sFFeOO+lQqklBlHRZHXY0OtO+/RRzX3JY4KZGUFoopUda5Td/pwjonQT8dKKQH0hVmDrbJzfA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4760 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.15, xch-aln-005.cisco.com X-Outbound-Node: alln-core-12.cisco.com Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 01:30:52 -0000 ------=_NextPart_000_0261_01D65EDC.F775B1F0 Content-Type: multipart/alternative; boundary="----=_NextPart_001_0262_01D65EDC.F775B1F0" ------=_NextPart_001_0262_01D65EDC.F775B1F0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable I don=E2=80=99t see how an endpoint could distinguish between a = malicious on-path device or service vs the CPE depicted in this flow: Client <------- TLS --------> CPE <------- TLS --------> ISP = Resolver =20 This is equivalent to =20 Client <------- TLS --------> MitM Proxy <------- TLS --------> Any = Website =20 Which is seems like a non-starter. =20 -Vinny =20 From: Add On Behalf Of Andrew Campling Sent: Monday, July 20, 2020 6:22 PM To: Eric Rescorla Cc: add@ietf.org; Martin Thomson Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments = by Network Operators =20 Ekr To clarify, there are two issues to overcome here, (i) use of RFC1918 = private addresses by the CPE (to facilitate SPAU) and (ii) support for = DNS forwarders to maintain the full functionality provided by network = operators that is described in the document. The desired end state is = as you describe: =20 Client <------- TLS --------> CPE <------- TLS --------> ISP = Resolver =20 Whilst it would be ideal to deal with both of the above issues = simultaneously, pragmatically it may be necessary to deal with them = sequentially given the potential for delays in upgrading CPE software. = Since there are already some proposed discovery methods that deal with = the private addresses, it could make sense for to implement a two-step = solution that first solves the private address issue in the short-term = whilst the CPE software upgrade is deployed. This would at least = maintain support for the user=E2=80=99s chosen resolver via encrypted = DNS using SPAU whilst a CPE software upgrade is QA=E2=80=99d by the = network operator and then deployed. =20 =20 Of course others may think it better to go with a single-step approach = that upgrades the CPE software to maintain support for DNS forwarders = and deals with the private address issue for SPAU at the same time. = However, since the timeframe for this will be necessarily longer for = many users, my assumption is that the preference for most would be to = enlarge the potential pool of encrypted DNS users as quickly as = possible. =20 =20 Does this help? =20 =20 Andrew =20 =20 From: Eric Rescorla >=20 Sent: 20 July 2020 16:03 To: Andrew Campling > Cc: Martin Thomson >; = add@ietf.org =20 Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments = by Network Operators =20 Hi Andrew, Ignoring the discovery question for a moment, I guess I'm not entirely clear on what your desired outcome in terms of network topology is. As described in your draft, at present the clients send DNS packets to the forwarder on the CPE, which then selectively forwards queries to the main ISP resolver. However, in a world where the DNS is encrypted, then this would require that the encryption be terminated at the CPE and then re-originated to the ISP resolver, like so: Client <------- TLS --------> CPE <------- TLS --------> ISP Resolver Is that your desired outcome? If so, it seems to come into conflict with your points in S 5.2 about the difficulty of upgrading the CPE. If not, maybe I just don't understand. In either case, perhaps you can elaborate. -Ekr =20 On Mon, Jul 20, 2020 at 7:47 AM Andrew Campling = = > wrote: On Thu, Jul 16, 2020, at 00:12, Martin Thomson > wrote: > Your draft seems to be making a case for supporting forwarders, but = I'm not clear on what supporting forwarders looks like. I understand = that you might not have specific ideas about what this support might = look like, but I don't see any real requirements here either. >=20 > It would really help if the draft would clearly articulate what your = desired outcome is. Sorry for the lack of clarity. The primary intent of the document is to = provide information as we have the impression that at least some client = developers may not have good visibility of common network operator = architectures and practices outside of the US. By providing such = clarity we hope to see implementations that are sympathetic to the = environment into which they are being deployed in order to maximise the = chances of working correctly, ideally via SPAU as manual configuration = of DNS settings by the majority of users seems unlikely. =20 In a nut shell, any ADD solution should measure itself to see whether it = meets the use case described in this document, at least one is needed = that does. =20 Andrew=20 --=20 Add mailing list Add@ietf.org =20 https://www.ietf.org/mailman/listinfo/add ------=_NextPart_001_0262_01D65EDC.F775B1F0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

I = don=E2=80=99t see how an endpoint could distinguish between a malicious = on-path device or service vs the CPE depicted in this = flow:

Client =  <------- TLS -------->  CPE  <------- TLS = -------->  ISP Resolver

 

This is equivalent = to

 

Client  <------- TLS -------->  MitM Proxy =  <------- TLS -------->  Any = Website

 

Which is seems like a non-starter.

 

-Vinny

 

From: Add = <add-bounces@ietf.org> On Behalf Of Andrew = Campling
Sent: Monday, July 20, 2020 6:22 PM
To: = Eric Rescorla <ekr@rtfm.com>
Cc: add@ietf.org; Martin = Thomson <mt@lowentropy.net>
Subject: Re: [Add] Practical = Observations from Encrypted DNS Deployments by Network = Operators

 

Ekr

To = clarify, there are two issues to overcome here, (i) use of RFC1918 = private addresses by the CPE (to facilitate SPAU) and (ii) support for = DNS forwarders to maintain the full functionality provided by network = operators that is described in the document.  The desired end state = is as you describe:

 

Client  <------- TLS = -------->  CPE  <------- TLS -------->  ISP = Resolver

 

Whilst = it would be ideal to deal with both of the above issues simultaneously, = pragmatically it may be necessary to deal with them sequentially given = the potential for delays in upgrading CPE software.  Since there = are already some proposed discovery methods that deal with the private = addresses, it could make sense for to implement a two-step solution that = first solves the private address issue in the short-term whilst the CPE = software upgrade is deployed.  This would at least maintain support = for the user=E2=80=99s chosen resolver via encrypted DNS using SPAU = whilst a CPE software upgrade is QA=E2=80=99d by the network operator = and then deployed. 

 

Of = course others may think it better to go with a single-step approach that = upgrades the CPE software to maintain support for DNS forwarders and = deals with the private address issue for SPAU at the same time.  = However, since the timeframe for this will be necessarily longer for = many users, my assumption is that the preference for most would be to = enlarge the potential pool of encrypted DNS users as quickly as = possible. 

 

Does = this help?

 

 

Andrew

 

 

From: Eric Rescorla <ekr@rtfm.com>
Sent: 20 = July 2020 16:03
To: Andrew Campling <andrew.campling@419.consul= ting>
Cc: Martin Thomson <mt@lowentropy.net>; add@ietf.org
Subject: Re: = [Add] Practical Observations from Encrypted DNS Deployments by Network = Operators

 

Hi = Andrew,

Ignoring the discovery question for a moment, I guess I'm = not entirely
clear on what your desired outcome in terms of network = topology is.

As described in your draft, at present the clients = send DNS packets to
the forwarder on the CPE, which then selectively = forwards queries to
the main ISP resolver. However, in a world where = the DNS is encrypted,
then this would require that the encryption be = terminated at the
CPE and then re-originated to the ISP resolver, = like so:


Client <------- TLS -------->  CPE =  <------- TLS --------> ISP Resolver

Is that your = desired outcome? If so, it seems to come into conflict
with your = points in S 5.2 about the difficulty of upgrading the CPE.
If not, = maybe I just don't understand. In either case, perhaps you
can = elaborate.

-Ekr

 

On Mon, Jul 20, 2020 at 7:47 AM = Andrew Campling <andrew.campling@419.consul= ting> wrote:

On Thu, Jul 16, 2020, at = 00:12, Martin Thomson <mt@lowentropy.net> wrote:

> Your = draft seems to be making a case for supporting forwarders, but I'm not = clear on what supporting forwarders looks like.  I understand that = you might not have specific ideas about what this support might look = like, but I don't see any real requirements here either.
> =
> It would really help if the draft would clearly articulate what = your desired outcome is.

Sorry for the lack of clarity.  The = primary intent of the document is to provide information as we have the = impression that at least some client developers may not have good = visibility of common network operator architectures and practices = outside of the US.  By providing such clarity we hope to see = implementations that are sympathetic to the environment into which they = are being deployed in order to maximise the chances of working = correctly, ideally via SPAU as manual configuration of DNS settings by = the majority of users seems unlikely. 

In a nut shell, any = ADD solution should measure itself to see whether it meets the use case = described in this document, at least one is needed that does.  =


Andrew

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

------=_NextPart_001_0262_01D65EDC.F775B1F0-- ------=_NextPart_000_0261_01D65EDC.F775B1F0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMXjCCA0Mw ggIroAMCAQICEF/4eygrVNyNQqMVtWjJrf8wDQYJKoZIhvcNAQEFBQAwNTEWMBQGA1UEChMNQ2lz Y28gU3lzdGVtczEbMBkGA1UEAxMSQ2lzY28gUm9vdCBDQSAyMDQ4MB4XDTA0MDUxNDIwMTcxMloX DTI5MDUxNDIwMjU0MlowNTEWMBQGA1UEChMNQ2lzY28gU3lzdGVtczEbMBkGA1UEAxMSQ2lzY28g Um9vdCBDQSAyMDQ4MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAsJq5q6evCnen4nG2 tGZilHiIR8ZiVYRAMr/Aqy6lHHHWvG57qKq6btIViEhFnaL8g9DMuYzgJmhwSnjfIRee9GEFyRXI zxbaNWGJlEOohKgxmHibuU5vLFMSbM0drSskuzHEK/+DRG+2PSR3Ceq/Kqgfalb2IA8RVJeBdacl zllqgmXvt+rn4o11i27y3U+mXmKczxAKZNBObc4rzFv1YKUnR41p9H/OG3DecBsg1m7NpgGoPBLS qT+ga167jiCLepHjtWjuoOfEAXSoUwsrSpoPZRIOgk2OY/3v65sa21OmE2Cvwn3Xx2wXJdRz+0dk UIGAlEzhv65LHN+S7S4F3wIBA6NRME8wCwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYD VR0OBBYEFCfzyBUebpoCCRatK6CJYF/aey+qMBAGCSsGAQQBgjcVAQQDAgEAMA0GCSqGSIb3DQEB BQUAA4IBAQCdnYSEo0GpfHcMt1PKTkRQYu9UfNN1Fxzo4MZIS7b+TDoZgVawVu4ZlmKqWqNkwfZO VDPGd/7FHLrlXSXK9fCTmoMRLubL+HRF/ucFuKvn38tL4TeE2rmLl3Ae8OKL17DYDp2xadYqkXup SU9+5o6V2IMnPNVoSQ7UnfYu66e+6zCkrB9E/JWrMwb7fWAK3rSKY7CcqfKkuVMBh9BopCd/q//p +slAOIhntDnGhG9XyVPbuo7uwEOy+AmDbv9mzz7vF7NYGCUJNF7jy9YUtuzykm905C+BKtWSkeDg lzwyaAWFS9H3V+JSHZMaVJ8FcMBKcWAeQwtgHv6jzoEZ4Qs1MIIEbjCCA1agAwIBAgIKYRCAbQAA AAAADjANBgkqhkiG9w0BAQUFADA1MRYwFAYDVQQKEw1DaXNjbyBTeXN0ZW1zMRswGQYDVQQDExJD aXNjbyBSb290IENBIDIwNDgwHhcNMTQwNDA0MjAyNDE4WhcNMjkwNTE0MjAyNTQyWjAsMQ4wDAYD VQQKEwVDaXNjbzEaMBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0EwggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDK334WTFMV+yNWzca5ZQoEleXeTEVnjAzHBuCrH21fNyp75+2jrYB/Ecjz guvun1DZyb89oS+7PBEHNe+4pdlRTtmw91OglIAsLJJlrRBvoYZrX0AKmaVQRBqQTc/mTPtGBo1I 4wfX4a1j19XoJwAVv24HskO7ZQYvffZZXZsSxSx9vetEsFLhwvwe7Z1Z9x2Tp6sxpkJCOSfTgWLG VCwmjNs9FNCojhXqKKQb/r2sPJ5N1tVMr4zL/0ufBWwPcYEyJGHtGau+6nG0aIy7yPTkiz93U6J+ FZ5zC+NXdF6D0uiTxsw0kQwCl53XB5N1VLRfgywCF6iwkGV32VLk7iJ3AgMBAAGjggGHMIIBgzAQ BgkrBgEEAYI3FQEEAwIBADAdBgNVHQ4EFgQUn5U2tI5d1UvDCsGnKZNDUQb9iVEwGQYJKwYBBAGC NxQCBAweCgBTAHUAYgBDAEEwCwYDVR0PBAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHwYDVR0j BBgwFoAUJ/PIFR5umgIJFq0roIlgX9p7L6owQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL3d3dy5j aXNjby5jb20vc2VjdXJpdHkvcGtpL2NybC9jcmNhMjA0OC5jcmwwUAYIKwYBBQUHAQEERDBCMEAG CCsGAQUFBzAChjRodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY2VydHMvY3JjYTIw NDguY2VyMFwGA1UdIARVMFMwUQYKKwYBBAEJFQEVADBDMEEGCCsGAQUFBwIBFjVodHRwOi8vd3d3 LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvcG9saWNpZXMvaW5kZXguaHRtbDANBgkqhkiG9w0BAQUF AAOCAQEAPk6+IxpGAo1ea9uKAjQLY5vlATwmXYxwsiTrYF7sioRkLhtZFaNnGuEW4/3gTX1EmiMo 0u2296If50TN7W3qhiFUKKxsYbz7yGVQBECKKov8n24YnvXFPqWiqRwArnGmF7tJMktKWBOTTDbp 9y8N6IDrOF1UecqFUqSk4lZ30w0HIU6cJDIM4r6lw3EtTog31PAvVmhGR0VrXVCIJfc6KaTxiEGt U35XMYYq1uBnh9hTq4GjdXe+2yHIOke0aSfV7t/39NZxjbp60XMvfd3NpniUKGXDiXdeQuroB8IQ MXl2OkF2IJGPCkFQghsJKbIRIG8D6wviPyLW+j+4Rqu2sDCCBKEwggOJoAMCAQICCgGGGmG8CetC JFAwDQYJKoZIhvcNAQELBQAwLDEOMAwGA1UEChMFQ2lzY28xGjAYBgNVBAMTEUNpc2NvIEVtcGxv eWVlIENBMB4XDTIwMDYwOTE4MTEzOFoXDTIyMDYwOTE4MjEzOFowgZYxHTAbBgNVBAMTFFZpbm55 IFBhcmxhICh2cGFybGEpMRQwEgYDVQQLEwtDaXNjbyBVc2VyczESMBAGA1UECxMJRW1wbG95ZWVz MRMwEQYKCZImiZPyLGQBGRMDY29tMRUwEwYKCZImiZPyLGQBGRMFY2lzY28xHzAdBgkqhkiG9w0B CQEMEHZwYXJsYUBjaXNjby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg5zG6 WUz2eLCtkokcmka2wwjH6DXR8dfR2VqJ3szmqqmiZLHtOZQ7/3+/ztkZk0iM3yQQc2l9KsQ2jzHU rkOZpqMpYCv43rxL2uAM0gQfpIxWGoHN5L3kW7gVpXuPmgGgF6TpMI9vytRh1gl4SHJD8f9QTvTU JynVycwV0KCQfjrJ77AGHX+7+Jwt7vkY64UtJmM7gCoJj7CU7eO+PAJc2qAJMaljtK4XI6InXFPB 7meUpm8k1TBtUuOpe25WYdUcbeipNtqjTFDtYNtXSXwHn1JRWr14CMWI2iTUu69D6M5p8KxXMStS F197vWn7QrFJ1PaK366O/LgsHumVQxAHAgMBAAGjggFYMIIBVDAOBgNVHQ8BAf8EBAMCBPAwDAYD VR0TAQH/BAIwADB6BggrBgEFBQcBAQRuMGwwPAYIKwYBBQUHMAKGMGh0dHA6Ly93d3cuY2lzY28u Y29tL3NlY3VyaXR5L3BraS9jZXJ0cy9jZWNhLmNlcjAsBggrBgEFBQcwAYYgaHR0cDovL3BraWN2 cy5jaXNjby5jb20vcGtpL29jc3AwHwYDVR0jBBgwFoAUn5U2tI5d1UvDCsGnKZNDUQb9iVEwOgYD VR0fBDMwMTAvoC2gK4YpaHR0cDovL2Npc2NvY2VydHMuY2lzY28uY29tL2ZpbGUvY2VjYS5jcmww GwYDVR0RBBQwEoEQdnBhcmxhQGNpc2NvLmNvbTAdBgNVHQ4EFgQU77mvrtX1ZwgDCBrBz254abit a7kwHwYDVR0lBBgwFgYKKwYBBAGCNwoDDAYIKwYBBQUHAwQwDQYJKoZIhvcNAQELBQADggEBAJ0C qW6utEOTvSb85ZBZel2OgSpFDDjaLWIEceNr23m4NkhjweswzFPJY4nnKgD40Ryv5WVW4KdpmbZx NBZl4Ypd5XlwleoU9jHuSwp6kaYCEJ7YfOIKVBcF1rYclNL0J0nJ2/fnaxGoYylNfW99vu4UaqEl BWU66VkGfsg5hWPRg90fuge1zZhlwI2AE6xq7pV8C2302ag94ti465IhjnHswtA4Q+r39Tc+me1o b2s1g8WKyds2DPI0PAjWnNpsEvYYOXU8MeMv9p6jPbFG9uaCpt8kCGcYytt8FD285Rmq77FRMEBe ptFCTJh5yr5hIaMVoqBUydvZmQAYKnRX8zMxggLwMIIC7AIBATA6MCwxDjAMBgNVBAoTBUNpc2Nv MRowGAYDVQQDExFDaXNjbyBFbXBsb3llZSBDQQIKAYYaYbwJ60IkUDAJBgUrDgMCGgUAoIIBizAY BgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA3MjEwMTMwMTlaMCMG CSqGSIb3DQEJBDEWBBRnUyU3eWnlowJTpazbZP+zKxGTwTBJBgkrBgEEAYI3EAQxPDA6MCwxDjAM BgNVBAoTBUNpc2NvMRowGAYDVQQDExFDaXNjbyBFbXBsb3llZSBDQQIKAYYaYbwJ60IkUDBLBgsq hkiG9w0BCRACCzE8oDowLDEOMAwGA1UEChMFQ2lzY28xGjAYBgNVBAMTEUNpc2NvIEVtcGxveWVl IENBAgoBhhphvAnrQiRQMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFl AwQBFjAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMC AgFAMAcGBSsOAwIaMAsGCWCGSAFlAwQCAzALBglghkgBZQMEAgIwCwYJYIZIAWUDBAIBMA0GCSqG SIb3DQEBAQUABIIBAI82Qbs0kfDy2NEj6Y3qN3iJ7oh7/qHSmMeAIXhf2MkkZBgp6aXwYdCn2qzI BIxz9olxDY8fqOR30scgC4g1IVsSFeMNJ4E2j9zh9B7wRzXrcEtTGP/XifvgjfQplQJKQoNni+QF FeiMwxGtdx++NfGTh7aH8C7uA7wBUtT/9KzL2iwUkG/ekRJ0GVxCm8+3XG3PVfSUbr8c7e+H3ar2 mBwwY1PEdYks4lGYGkczGJI2M5nebKv2cTNHTkkyfFK3JWpAUn+9VSU+KMOvBtWg26iLKM9OKF7M PlIx6Fy/PNKT6cm8mMsPiumjN5nMQ52gxOJVigSaWQApgSqxspJPIKMAAAAAAAA= ------=_NextPart_000_0261_01D65EDC.F775B1F0-- From nobody Tue Jul 21 00:29:49 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2BBDF3A124E for ; Tue, 21 Jul 2020 00:29:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id onTih4Ph4Nyd for ; Tue, 21 Jul 2020 00:29:46 -0700 (PDT) Received: from mail-il1-x12c.google.com (mail-il1-x12c.google.com [IPv6:2607:f8b0:4864:20::12c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 968E73A12EF for ; Tue, 21 Jul 2020 00:29:46 -0700 (PDT) Received: by mail-il1-x12c.google.com with SMTP id r12so15582797ilh.4 for ; Tue, 21 Jul 2020 00:29:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=o0CM+6GxrwvOrWmpcMHCQt/bfsVmcVwm3nBwOVPclwg=; b=QvMEQndnirNnw1HFcRK19IItBqVVTx9F7JG3ygHsCfFQ2iEtIAsBScLJORFwVDbUTU LfW3wGomhvdQK5jKwWo97q8/a9l7OHWW8Aat0VcVtQMw7NOzqcqyhzHdQxYuF8FQ+E1m ek2pkmNCcoaPo1xuOv5rm30nLMeZhtXFHMQKfLR4EEFe4K/HhaLhdWTWv9fNzeu3FDAH pzjyyhfu7zhA2x0PywAKH3m74wIGV5qizo68oRKybYT2vbzk7LJyHZpxvJGdEh2KPNnD qgsoMywUu7eY9SbJxsYhMZ8RDRrqLOah1p4cD0iThi8kcAnPNgH97HImD+/7mn2fIYm2 Lrfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=o0CM+6GxrwvOrWmpcMHCQt/bfsVmcVwm3nBwOVPclwg=; b=KPeifvav3ThQ/VvxhnVOT3PR9S6VrhriS7CXqV7nwbskbVX6rzzpeDvhVBofZ8Ncoa hscUcNu37PMzX/5m/+RoGIYKHFAxJX1nuO6+GU9ouJtzlwVkIoHT8wienmuI++7HIP9+ 7/T+lXC5IG4/zIlelBVvKzhwHjnvFShb2swir1/hwv4hWEl1c2WsLFkBWGiF0CST98/a ubqTIW7OZzE+Aoi+LWyZ7wicxlTEsw06IDC4Zu/bQb2NI/fHWXYHOuJTHHAb9p8TOsoO 2YZ5/uR94Y0IN/97c2M3WX3mBha8F6fy/54H4VCi1kAP4sDpBoDt2GNcykyusTAKR0gu ursA== X-Gm-Message-State: AOAM530XjC+TrvyeQTiUQDpt13cghmhKsjFi8dlT79+Sv4p3Q+IfdVgw +5+OHpflIVv6RveMs7utBEVH3zEtGB6KF1eFV7U= X-Google-Smtp-Source: ABdhPJxkAF9Btej2Eeq5sDdiAA+vtSWRl7K2QiiqnNcpq0pfiVOi0q8XfmmSRzltgA+GPBvtBGXN3dzy2d/BbEEmtfk= X-Received: by 2002:a92:cf09:: with SMTP id c9mr26169506ilo.214.1595316585719; Tue, 21 Jul 2020 00:29:45 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <1646663239.1256.1595235234146@appsuite-gw1.open-xchange.com> <1F504D1C-449F-41AA-BB76-A36ECD0A6BE2@noware.co.uk> In-Reply-To: <1F504D1C-449F-41AA-BB76-A36ECD0A6BE2@noware.co.uk> From: tirumal reddy Date: Tue, 21 Jul 2020 12:59:34 +0530 Message-ID: To: Neil Cook Cc: Vittorio Bertola , Kenji Baheux , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000656f8c05aaee9615" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 07:29:48 -0000 --000000000000656f8c05aaee9615 Content-Type: text/plain; charset="UTF-8" On Mon, 20 Jul 2020 at 19:46, Neil Cook wrote: > Hi Tiru, > > On 20 Jul 2020, at 10:54, tirumal reddy wrote: > > On Mon, 20 Jul 2020 at 14:24, Vittorio Bertola 40open-xchange.com@dmarc.ietf.org> wrote: > >> >> >> Il 20/07/2020 02:26 Kenji Baheux >> ha scritto: >> >> >> I'd like to get a clear picture of how per-device family-safe filtering >> is typically configured in a plain ISP setup. >> >> I imagine that the ISP provided router offers a UI through which a parent >> (logged in user) could add/remove specific devices to the "family-safe: >> enabled" list. >> >> It depends on the implementation. In other cases, the filtering engine >> and the UI reside on the ISP's central resolver platform, and the CPE only >> adds an identifier (which can be generated locally and opaque) that allows >> the platform to tell which device is sending the query. >> > > If the client uses DoH/DoT, the unique identifier can longer be sent in > the DNS request. > > > If the forwarder supports DoH/DoT as described in > https://tools.ietf.org/html/draft-btw-add-home-07#section > -7 then it > can send any identifier it likes, > Yes, that would work. -Tiru > > Neil > > -Tiru > >> -- >> >> Vittorio Bertola | Head of Policy & Innovation, Open-Xchange >> vittorio.bertola@open-xchange.com >> Office @ Via Treviso 12, 10144 Torino, Italy >> >> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> > > --000000000000656f8c05aaee9615 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, 20 Jul 2020 at 19:46, Neil Cook &= lt;neil.cook@noware.co.uk>= wrote:
Hi Tiru,

On 20 Jul 2020, at 10:54, tirumal red= dy <kondtir@gmail= .com> wrote:

On Mon,= 20 Jul 2020 at 14:24, Vittorio Bertola <vittorio.bertola=3D40open-xchange.c= om@dmarc.ietf.org> wrote:
=20 =20 =20


<= /div>

<= /div>

Yes, that would work.

-Tiru
=C2=A0

=
Neil

-Tiru

--

=20 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchangevit=
torio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torin=
o, Italy
=20
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

--000000000000656f8c05aaee9615-- From nobody Tue Jul 21 00:39:39 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A4153A13BB for ; Tue, 21 Jul 2020 00:39:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6F-WROB6ZGUq for ; Tue, 21 Jul 2020 00:39:36 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6519D3A134A for ; Tue, 21 Jul 2020 00:39:36 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 693852801B6; Tue, 21 Jul 2020 09:39:34 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id 622132802B2; Tue, 21 Jul 2020 09:39:34 +0200 (CEST) Received: from relay01.prive.nic.fr (unknown [10.1.50.11]) by mx4.nic.fr (Postfix) with ESMTP id 5A95C2801B6; Tue, 21 Jul 2020 09:39:34 +0200 (CEST) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 4F15064C6C03; Tue, 21 Jul 2020 09:39:34 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id 281CD40233; Tue, 21 Jul 2020 09:39:34 +0200 (CEST) Date: Tue, 21 Jul 2020 09:39:34 +0200 From: Stephane Bortzmeyer To: Eric Rescorla Cc: Andrew Campling , "add@ietf.org" , Martin Thomson Message-ID: <20200721073934.GA29757@nic.fr> References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.000193, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 07:39:38 -0000 On Mon, Jul 20, 2020 at 05:43:02PM -0700, Eric Rescorla wrote a message of 111 lines which said: > With that said, I have some concerns about the objective of having > the CPE in the user's resolution path. While I certainly can > understand the reasons you consider it advantageous, it seems to me > that it significantly weakens the user's security posture. Even > assuming arguendo that we have a secure mechanism for discovering > this case, in practice the CPE seems to have quite a high rate of > security issues, including specifically DNS hijacking (see for > instance [0]). Even without hijacking by a third-party (cracker with hoodie), the local router is often controlled by the access provider which may be the party you precisely want to work around. If you want to use DoE to avoid the provider's lying resolver, using their router is not a smart move. From nobody Tue Jul 21 00:42:41 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 910713A1493 for ; Tue, 21 Jul 2020 00:42:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dk1RL6l2AnAf for ; Tue, 21 Jul 2020 00:42:38 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9B03A3A1492 for ; Tue, 21 Jul 2020 00:42:37 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 3A3382801B6; Tue, 21 Jul 2020 09:42:36 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id 323F92802B2; Tue, 21 Jul 2020 09:42:36 +0200 (CEST) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id 2A7262801B6; Tue, 21 Jul 2020 09:42:36 +0200 (CEST) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 1F2EF64C6C03; Tue, 21 Jul 2020 09:42:36 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id EBE3140233; Tue, 21 Jul 2020 09:42:35 +0200 (CEST) Date: Tue, 21 Jul 2020 09:42:35 +0200 From: Stephane Bortzmeyer To: Stephen Farrell Cc: Paul Vixie , Andrew Campling , add@ietf.org, Eric Rescorla , Martin Thomson Message-ID: <20200721074235.GB29757@nic.fr> References: <2515140.uIgGUBp3BU@linux-9daj> <73db546a-0c47-fe18-0b9e-ec120e56bddd@cs.tcd.ie> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <73db546a-0c47-fe18-0b9e-ec120e56bddd@cs.tcd.ie> X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.011400, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 07:42:40 -0000 On Tue, Jul 21, 2020 at 02:15:24AM +0100, Stephen Farrell wrote a message of 271 lines which said: > There's an interesting thing there - the current Internet, with > Cloudy-blah-services, CDNs, VPNs, Tor etc seems no longer to be a > network of networks that only touch at their edges, but rather a > network of networks some of which are much more intimately entwined. RFC 8799 is an interesting reading here. > I don't have a solution to offer that solves all problems in that > context, but I do think it means that "my network, my policy" is no > longer as practical as was once the case. Also, I strongly object to this "my network, my policy" principle. I want Internet access providers to be neutral tubes, not to force their policies onto me. From nobody Tue Jul 21 00:46:06 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C87BE3A14A4; Tue, 21 Jul 2020 00:46:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pNAyq3tPCvTl; Tue, 21 Jul 2020 00:46:00 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BE24C3A14C4; Tue, 21 Jul 2020 00:46:00 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 522D82801B6; Tue, 21 Jul 2020 09:45:59 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id 4B65A2802B2; Tue, 21 Jul 2020 09:45:59 +0200 (CEST) Received: from relay01.prive.nic.fr (unknown [10.1.50.11]) by mx4.nic.fr (Postfix) with ESMTP id 440AB2801B6; Tue, 21 Jul 2020 09:45:59 +0200 (CEST) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 37D2764C6C03; Tue, 21 Jul 2020 09:45:59 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id CF2CF40918; Tue, 21 Jul 2020 09:45:58 +0200 (CEST) Date: Tue, 21 Jul 2020 09:45:58 +0200 From: Stephane Bortzmeyer To: "Deen, Glenn" Cc: ADD Mailing list , "add-chairs@ietf.org" Message-ID: <20200721074558.GC29757@nic.fr> References: <5EFC3442-045F-4F89-A4BA-769C1AFE87A4@comcast.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5EFC3442-045F-4F89-A4BA-769C1AFE87A4@comcast.com> X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.153476, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] IETF108 ADD Agenda X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 07:46:05 -0000 On Mon, Jul 20, 2020 at 11:08:01PM +0000, Deen, Glenn wrote a message of 71 lines which said: > The agenda for ADD @ IETF108 has now been posted. > (https://datatracker.ietf.org/meeting/108/session/add) Typo: the draft for DRDP is draft-mglt-add-rdp, not draft-mglt-add-drdp. From nobody Tue Jul 21 01:45:07 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E65DB3A16D6; Tue, 21 Jul 2020 01:45:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.118 X-Spam-Level: X-Spam-Status: No, score=-2.118 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=orange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T8WvuY1F3Su6; Tue, 21 Jul 2020 01:45:03 -0700 (PDT) Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.70.35]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A9283A16B0; Tue, 21 Jul 2020 01:45:03 -0700 (PDT) Received: from opfednr03.francetelecom.fr (unknown [xx.xx.xx.67]) by opfednr23.francetelecom.fr (ESMTP service) with ESMTP id 4B9sbx34pNz5wLf; Tue, 21 Jul 2020 10:45:01 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.com; s=ORANGE001; t=1595321101; bh=Y2iyC0MiUNdfOUqP157seeELGgwiYtWPSmHoP+iOyOs=; h=From:To:Subject:Date:Message-ID:Content-Type: Content-Transfer-Encoding:MIME-Version; b=fokRz77V2xCMT0W4ZZn51m9ADr7QkcyOLZDcL93U4KGQStfnV0/IJRFnAWkYptOLb BtgWzK8xIlovxdlp3zIljqdenOBNAa/hs1A6rz6STP9JtXB4y276vz4ItY45qWBVEo tlCGJ2Dkf8Ydg0gNtgAN/pgPZz41cTg/YGKdTfjgUfDxs1w8fyUD0tq3GnsoMjfsbk mr0Tl/dI0a25Jdgo9HzKsdIkld5evHvsF8ysL7xaH9JWEZsbcuEMcO9xkRcLCLT/Ob I3jQEJZPXMUC5AHO6canCiF7HZq0E5obHQk7wFCFN33RVE6FXtysAun+eM1TZeAciO k9f0fh3HYx4tg== Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.29]) by opfednr03.francetelecom.fr (ESMTP service) with ESMTP id 4B9sbx24qrzDq7f; Tue, 21 Jul 2020 10:45:01 +0200 (CEST) From: To: Stephane Bortzmeyer CC: "draft-btw-add-home@ietf.org" , "ADD Mailing list (add@ietf.org)" Thread-Topic: [Add] TR: I-D Action: draft-btw-add-home-07.txt Thread-Index: AQHWXqeUzZYtVRXXYkCU6G2sVaXhWakRsK8w Date: Tue, 21 Jul 2020 08:45:00 +0000 Message-ID: <17264_1595321101_5F16AB0D_17264_254_1_787AE7BB302AE849A7480A190F8B9330314FEE52@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> References: <159438950508.10283.6338787113671554159@ietfa.amsl.com> <23877_1594815149_5F0EF2AD_23877_384_1_787AE7BB302AE849A7480A190F8B9330314F9783@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <20200720150751.GA14985@nic.fr> In-Reply-To: <20200720150751.GA14985@nic.fr> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.114.13.245] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Add] TR: I-D Action: draft-btw-add-home-07.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 08:45:05 -0000 SGkgU3TDqXBoYW5lLCANCg0KUGxlYXNlIHNlZSBpbmxpbmUuIA0KDQpDaGVlcnMsDQpNZWQNCg0K PiAtLS0tLU1lc3NhZ2UgZCdvcmlnaW5lLS0tLS0NCj4gRGXCoDogQWRkIFttYWlsdG86YWRkLWJv dW5jZXNAaWV0Zi5vcmddIERlIGxhIHBhcnQgZGUgU3RlcGhhbmUNCj4gQm9ydHptZXllcg0KPiBF bnZvecOpwqA6IGx1bmRpIDIwIGp1aWxsZXQgMjAyMCAxNzowOA0KPiDDgMKgOiBCT1VDQURBSVIg TW9oYW1lZCBUR0kvT0xOIDxtb2hhbWVkLmJvdWNhZGFpckBvcmFuZ2UuY29tPg0KPiBDY8KgOiBk cmFmdC1idHctYWRkLWhvbWVAaWV0Zi5vcmc7IEFERCBNYWlsaW5nIGxpc3QgKGFkZEBpZXRmLm9y ZykNCj4gPGFkZEBpZXRmLm9yZz4NCj4gT2JqZXTCoDogUmU6IFtBZGRdIFRSOiBJLUQgQWN0aW9u OiBkcmFmdC1idHctYWRkLWhvbWUtMDcudHh0DQo+IA0KPiBPbiBXZWQsIEp1bCAxNSwgMjAyMCBh dCAxMjoxMjoyOFBNICswMDAwLA0KPiBtb2hhbWVkLmJvdWNhZGFpckBvcmFuZ2UuY29tIDxtb2hh bWVkLmJvdWNhZGFpckBvcmFuZ2UuY29tPiB3cm90ZQ0KPiBhIG1lc3NhZ2Ugb2YgMTAwIGxpbmVz IHdoaWNoIHNhaWQ6DQo+IA0KPiA+ICogdXNlIHRoZSB3ZWxsLWtub3duIFVSSSB0byBsZWFybiB0 aGUgc3VwcG9ydGVkIHNlcnZpY2VzIGZyb20NCj4gdGhlDQo+ID4gKiBESENQL1JBIGRpc2NvdmVy ZWQgc2VydmVycy4gIGNsYXJpZnkgdGhhdCBESENQL1JBIGRpc2NvdmVyZWQNCj4gQURODQo+ID4g KiB0YWtlcyBwcmVjZWRlbmNlIG92ZXIgc3BlY2lhbC11c2UgZG9tYWluIG5hbWUuICBhZGQgYQ0K PiBkaXNjdXNzaW9uDQo+ID4gKiB0byB0aGUgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMgc2VjdGlv biB0byBjb3ZlciBzb21lIGludGVybmFsDQo+ID4gKiBhdHRhY2tzLg0KPiANCj4gSSBqdXN0IHdh bnQgdG8gYmUgc3VyZSBJIHVuZGVyc3RhbmQgaG93IHRoZSBjbGllbnQgaXMgc3VwcG9zZWQgdG8N Cj4gZGlzY292ZXIgdGhlIHBhdGggaW4gdGhlIERvSCBVUkwuIElmIEkgZ2V0IHNlY3Rpb24gNSBj b3JyZWN0bHksDQo+IHRoZSB3b3JrZmxvdyBpczoNCj4gMSkgZ2V0IHRoZSBJUCBhZGRyZXNzIG9m IHRoZSBEb0ggcmVzb2x2ZXIsIHNheSAyMDA4OmRiODoxOjpkMA0KDQpbTWVkXSAuLi4gYW5kIHRo ZSBhdXRoZW50aWNhdGlvbiBkb21haW4gbmFtZSAoQUROKS4gIA0KDQo+IDIpIHJlcXVlc3QgaHR0 cHM6Ly9bMjAwODpkYjg6MTo6ZDBdLy53ZWxsLWtub3duL3Jlc2luZm8sIHdoaWNoDQo+IGdpdmVz IHlvdSBzZXZlcmFsIFVSSSB0ZW1wbGF0ZXMNCg0KW01lZF0gR2l2ZW4gdGhhdCB3ZSBzdXBwbHkg dGhlIEFETiwgdGhlIFVSSSB3aWxsIGxvb2sgbGlrZTogaHR0cHM6Ly9kb2guZXhhbXBsZS5jb20v LndlbGwta25vd24vcmVzaW5mbw0KDQo+IDMpIHVzZSBvbmUgb2YgdGhlIHRlbXBsYXRlcyBmb3Ig dGhlIHJlZ3VsYXIgRG9IIHJlcXVlc3RzLiAgSXMgdGhhdA0KPiBjb3JyZWN0Pw0KPiANCj4gQWxz bywgc2luY2UgdG9kYXksIGZldyBDQXMgYWxsb3cgY2VydGlmaWNhdGVzIGJhc2VkIG9uIElQDQo+ IGFkZHJlc3NlcywgDQoNCltNZWRdIEluZGVlZC4gVGhpcyBpcyBjYXB0dXJlZCBpbiB0aGUgZHJh ZnQ6IA0KDQogICBBcyByZXBvcnRlZCBpbiBTZWN0aW9uIDEuNy4yIG9mIFtSRkM2MTI1XToNCg0K ICAgICAgImZldyBjZXJ0aWZpY2F0aW9uIGF1dGhvcml0aWVzIGlzc3VlIHNlcnZlciBjZXJ0aWZp Y2F0ZXMgYmFzZWQgb24NCiAgICAgIElQIGFkZHJlc3NlcywgYnV0IHByZWxpbWluYXJ5IGV2aWRl bmNlIGluZGljYXRlcyB0aGF0IHN1Y2gNCiAgICAgIGNlcnRpZmljYXRlcyBhcmUgYSB2ZXJ5IHNt YWxsIHBlcmNlbnRhZ2UgKGxlc3MgdGhhbiAxJSkgb2YgaXNzdWVkDQogICAgICBjZXJ0aWZpY2F0 ZXMiLg0KDQogICBJbiBvcmRlciB0byBhbGxvdyBmb3IgUEtJWC1iYXNlZCBhdXRoZW50aWNhdGlv biBiZXR3ZWVuIGEgRE5TIGNsaWVudA0KICAgYW5kIGEgRG9IL0RvVCBzZXJ2ZXIgd2hpbGUgYWNj b21tb2RhdGluZyB0aGUgY3VycmVudCBiZXN0IHByYWN0aWNlcw0KICAgZm9yIGlzc3VpbmcgY2Vy dGlmaWNhdGVzLCB0aGlzIGRvY3VtZW50IGFsbG93cyBmb3IgY29uZmlndXJpbmcgYW4NCiAgIGF1 dGhlbnRpY2F0aW9uIGRvbWFpbiBuYW1lIHRvIGJlIHByZXNlbnRlZCBhcyBhIHJlZmVyZW5jZSBp ZGVudGlmaWVyDQogICBmb3IgRE5TIGF1dGhlbnRpY2F0aW9uIHB1cnBvc2VzLg0KDQoNCnRoZSBh ZHZpY2UgaW4gc2VjdGlvbiA0ICJEb0gvRG9UIHNlcnZlcnMgU0hPVUxEIGJlDQo+IGxvY2F0ZWQg YnkgdGhlaXIgYWRkcmVzcyBsaXRlcmFscyByYXRoZXIgdGhhbiB0aGVpciBuYW1lcyINCj4gZWxp bWluYXRlcyBzbWFsbCBEb0UgcmVzb2x2ZXJzIGFuZCBsZWF2ZSBvbmx5IHRoZSBiaWcgb25lcywg d2hvDQo+IGNhbiBoYXZlIChsaWtlIEdvb2dsZSBhbmQNCj4gQ2xvdWRmbGFyZSkgSVAtYmFzZWQg Y2VydGlmaWNhdGVzLg0KDQpbTWVkXSBUaGF0IGlzIG5vdCB0aGUgaW50ZW50IG9mIHRoYXQgdGV4 dC4gVGhlIHJlY29tbWVuZGF0aW9uIGlzIHRvIHN1cHBseSBhIGxpc3Qgb2YgSVAgYWRkcmVzc2Vz IChsb2NhdG9ycywgaWYgeW91IHdpbGwpIGluIGFkZGl0aW9uIHRvIHRoZSBBRE4gdG8gYXZvaWQg YSBkZXBlbmRlbmN5IG9uIGFub3RoZXIgcmVzb2x2ZXIgdG8gcmVzb2x2ZSB0aGUgbmFtZS4NCg0K UGxlYXNlIG5vdGUgdGhhdCB0aGUgc2VudGVuY2UgeW91IHF1b3RlZCBzdGFydHMgd2l0aCAiRnJv bSBhbiBJUCByZWFjaGFiaWxpdHkgc3RhbmRwb2ludCwgIiBhbmQgdGhlbiBmb2xsb3dlZCBieSAi VGhpcyBhdm9pZHMNCmFkZGluZyBhIGRlcGVuZGVuY3kgb24gYW5vdGhlciBzZXJ2ZXIgdG8gcmVz b2x2ZSB0aGUgRG9IL0RvVCBuYW1lLiAiDQoNCj4gDQo+IExhc3QgdGhpbmcsIHRoaXMgcHJvcG9z YWwsIGxpa2UgbW9zdCAoYWxsPykgQUREIHByb3Bvc2FscyBpcw0KPiBzaWxlbnQgYWJvdXQgdGhl IHJpc2tzIG9mIHVzaW5nIHRoZSAiZGVmYXVsdCIgKGluZGljYXRlZCBieSB0aGUNCj4gYWNjZXNz DQo+IG5ldHdvcmspIHJlc29sdmVyLiBJZiBwZW9wbGUgbmVlZCBEb0UsIHRoaXMgaXMgYmVjYXVz ZSB0aGV5IGRvIG5vdA0KPiB0cnVzdCB0aGlzIHJlc29sdmVyLCBiZWNhdXNlIGl0IGxpZXMgb3Ig YmVjYXVzZSBpdCBsb2dzIChvciBib3RoKS4NCj4gVGhpcyBkZXNlcnZlcyBhIHdhcm5pbmcuIFNl Y3Rpb24gOSBtZW50aW9ucyBvbmx5IHRoZSByaXNrcyBvZiBhDQo+IHRoaXJkLXBhcnR5IGhpamFj a2luZyBESENQIG9yIGEgc2ltaWxhciBwcm90b2NvbCwgbm90IHRoZSByaXNrcyBvZg0KPiB0aGUg ZGVmYXVsdCByZXNvbHZlciwgZXhjZXB0IGluIGEgbGltaXRlZCB3YXkgaW4gdGhlIHBhcmFncmFw xKUNCj4gIlRoZSB1c2Ugb2YgRG9IL0RvVCBhbHNvIGRlcGVuZHMgb24gdGhlIHVzZXIncyBwb2xp Y2llcy4iDQoNCltNZWRdIEFjdHVhbGx5LCB3ZSBoYXZlIGEgZnVsbCBwYXJhZ3JhcGggdG8gY292 ZXIgdGhpczogDQoNCiAgIFRoZSB1c2Ugb2YgRG9IL0RvVCBhbHNvIGRlcGVuZHMgb24gdGhlIHVz ZXIncyBwb2xpY2llcy4gIEZvciBleGFtcGxlLA0KICAgdGhlIHVzZXIgbWF5IGluZGljYXRlIGhp cy9oZXIgY29uc2VudCB0byB1c2UgKG9yIG5vdCkgdGhlIGxvY2FsbHktDQogICBkaXNjb3ZlcmVk IERvSC9Eb1Qgc2VydmVyIG9yIHJlcXVlc3QgdG8gcmV2aWV3IGh1bWFuLXJlYWRhYmxlIHByaXZh Y3kNCiAgIHBvbGljeSBpbmZvcm1hdGlvbiBvZiBhIHNlbGVjdGVkIEROUyBzZXJ2ZXIgYW5kIHRv IGFzc2VzcyB3aGV0aGVyDQogICB0aGF0IEROUyBzZXJ2ZXIgcGVyZm9ybXMgRE5TLWJhc2VkIGNv bnRlbnQgZmlsdGVyaW5nIChlLmcuLA0KICAgW0ktRC5yZWRkeS1hZGQtc2VydmVyLXBvbGljeS1z ZWxlY3Rpb25dKS4gIFRoZSBETlMgY2xpZW50IGlzIGFzc3VtZWQNCiAgIHRvIGFkaGVyZSB0byB0 aGVzZSBwb2xpY2llcy4gIFRoaXMgZG9jdW1lbnQgZG9lcyBub3QgbWFrZSBhbnkNCiAgIGFzc3Vt cHRpb24gYWJvdXQgdGhlIHN0cnVjdHVyZSBvZiBzdWNoIHBvbGljaWVzIG5vciBtYW5kYXRlcyBz cGVjaWZpYw0KICAgcmVxdWlyZW1lbnRzLiAgU3VjaCBwb2xpY2llcyBhbmQgdGhlaXIgaGFuZGxp bmcgaXMgb3V0IG9mIHNjb3BlLg0KDQpXZSB3YW50ZWQgdG8gYXZvaWQgZ29pbmcgdG9vIGZhciBp biB0aGUgInBvbGljeSBsYW5kIiwgaGVuY2UgdGhpcyB3b3JkaW5nLiANCg0KQXMgb2YgdG9kYXkn cyBkZXBsb3ltZW50cywgYSB1c2VyIGNhbiBvdmVycmlkZSB0aGUgY29uZmlndXJhdGlvbiByZWNl aXZlZCBmcm9tIHRoZSBuZXR3b3JrLiBXZSBoYXZlIGEgc2VudGVuY2UgZm9yIHVubWFuYWdlZCBD UEVzOiANCg0KIm92ZXJyaWRlIHRoZSBETlMgY29uZmlndXJhdGlvbiBpdCByZWNlaXZlcyBmcm9t IHRoZSBJU1Atc3VwcGxpZWQiDQoNCldlIGNhbiBhZGQgYSBzaW1pbGFyIG9uZSBmb3IgbWFuYWdl ZCBDUEVzLg0KDQo+IA0KPiBTcGVha2luZyBvZiB0aGlzLCB0aGUgZHJhZnQgb25seSBtZW50aW9u cyBseWluZyByZXNvbHZlcnMgYXMNCj4gcHJvdmlkaW5nIGEgKHByZXN1bWFibHkgdXNlZnVsKSBz ZXJ2aWNlIChJIHF1b3RlOiAiSVNQcyB1c2UgRE5TIHRvDQo+IHByb3ZpZGUgYWRkaXRpb25hbCBz ZXJ2aWNlcyBzdWNoIGFzIChidXQgbm90IGxpbWl0ZWQgdG8pIG1hbHdhcmUNCj4gZmlsdGVyaW5n LCBwYXJlbnRhbCBjb250cm9sLCBvciBWb0QgKFZpZGVvIG9uIERlbWFuZCkNCj4gb3B0aW1pemF0 aW9uLiIgSXQgc2hvdWxkIG1lbnRpb24gY2Vuc29yc2hpcCBhcyB3ZWxsLiBBdCBsZWFzdCBhZGQN Cj4gImFkIGJsb2NraW5nIiBpbiB0aGUgbGlzdCBvZiBzZXJ2aWNlcyA8aHR0cHM6Ly9waS1ob2xl Lm5ldC8+Lg0KDQoNCltNZWRdIFRoYXQgbGlzdCBpcyBub3QgZXhoYXVzdGl2ZSwgYnV0IHdlIGNh biBtZW50aW9uIGFkIGJsb2NraW5nLiBUaGFua3MuIA0KDQoNCgpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpDZSBtZXNzYWdl IGV0IHNlcyBwaWVjZXMgam9pbnRlcyBwZXV2ZW50IGNvbnRlbmlyIGRlcyBpbmZvcm1hdGlvbnMg Y29uZmlkZW50aWVsbGVzIG91IHByaXZpbGVnaWVlcyBldCBuZSBkb2l2ZW50IGRvbmMKcGFzIGV0 cmUgZGlmZnVzZXMsIGV4cGxvaXRlcyBvdSBjb3BpZXMgc2FucyBhdXRvcmlzYXRpb24uIFNpIHZv dXMgYXZleiByZWN1IGNlIG1lc3NhZ2UgcGFyIGVycmV1ciwgdmV1aWxsZXogbGUgc2lnbmFsZXIK YSBsJ2V4cGVkaXRldXIgZXQgbGUgZGV0cnVpcmUgYWluc2kgcXVlIGxlcyBwaWVjZXMgam9pbnRl cy4gTGVzIG1lc3NhZ2VzIGVsZWN0cm9uaXF1ZXMgZXRhbnQgc3VzY2VwdGlibGVzIGQnYWx0ZXJh dGlvbiwKT3JhbmdlIGRlY2xpbmUgdG91dGUgcmVzcG9uc2FiaWxpdGUgc2kgY2UgbWVzc2FnZSBh IGV0ZSBhbHRlcmUsIGRlZm9ybWUgb3UgZmFsc2lmaWUuIE1lcmNpLgoKVGhpcyBtZXNzYWdlIGFu ZCBpdHMgYXR0YWNobWVudHMgbWF5IGNvbnRhaW4gY29uZmlkZW50aWFsIG9yIHByaXZpbGVnZWQg aW5mb3JtYXRpb24gdGhhdCBtYXkgYmUgcHJvdGVjdGVkIGJ5IGxhdzsKdGhleSBzaG91bGQgbm90 IGJlIGRpc3RyaWJ1dGVkLCB1c2VkIG9yIGNvcGllZCB3aXRob3V0IGF1dGhvcmlzYXRpb24uCklm IHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMgZW1haWwgaW4gZXJyb3IsIHBsZWFzZSBub3RpZnkgdGhl IHNlbmRlciBhbmQgZGVsZXRlIHRoaXMgbWVzc2FnZSBhbmQgaXRzIGF0dGFjaG1lbnRzLgpBcyBl bWFpbHMgbWF5IGJlIGFsdGVyZWQsIE9yYW5nZSBpcyBub3QgbGlhYmxlIGZvciBtZXNzYWdlcyB0 aGF0IGhhdmUgYmVlbiBtb2RpZmllZCwgY2hhbmdlZCBvciBmYWxzaWZpZWQuClRoYW5rIHlvdS4K Cg== From nobody Tue Jul 21 01:55:31 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41BDA3A16EB for ; Tue, 21 Jul 2020 01:55:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y2tJdEhccgtl for ; Tue, 21 Jul 2020 01:55:27 -0700 (PDT) Received: from mx3.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 68BAD3A159B for ; Tue, 21 Jul 2020 01:55:27 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx3.open-xchange.com (Postfix) with ESMTPS id 4C8026A230; Tue, 21 Jul 2020 10:55:25 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1595321725; bh=pvC/iVv/KJ/l0Vi+C9ECtXBUpm7EnVhN63a/UcWB00U=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=h/1QJK3rmUI2Ki5sgRlVKpf336jq/LPhGxmllPe7LBWR37ymlADBqx5/7NOvomAxW jQVK/3BKOWLXIonsrThC0I6rTNmtECxOtklSGbwcKVgPms+/DGhpkCfgFHFvVG2hsm rwEimFIsyWyd6cFjal0rVZIx7eEW6e0S1vWsfXk3riNoZ+ETaLhoSAEqcVLgu1Yp9m F+wdEWutODKQGzNbZV1UTS8TK18PLjakbHVMwC0DY6gC1sxPZOXITv31KnY73bOMTI u/2ylZ1d/c5jJX/YtIDd/ipEZxyC/SUZ/AhOIVr/h3PHQHRZKT7orReVSdsnhZj3je tr0KQOCNE5Vsg== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 3E43F3C0330; Tue, 21 Jul 2020 10:55:25 +0200 (CEST) Date: Tue, 21 Jul 2020 10:55:24 +0200 (CEST) From: Vittorio Bertola To: Eric Rescorla Cc: "add@ietf.org" Message-ID: <1848099210.1572.1595321725155@appsuite-gw1.open-xchange.com> In-Reply-To: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_1570_1373817735.1595321725136" X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev17 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 08:55:29 -0000 ------=_Part_1570_1373817735.1595321725136 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit > Il 21/07/2020 02:43 Eric Rescorla ha scritto: > > > So the idea here would be to have a mechanism which enabled Do[TH] but > bypassed the CPE, correct? So, it would be something that one deployed > at the ISP's recursive and that we just expected the CPE to pass on? > It seems like the primary requirement there would be for something which > had a very high chance of passing through existing CPE. > > > With that said, I have some concerns about the objective of having the > CPE in the user's resolution path. > I just want to note that the mechanism described in the draft I recently posted ( https://datatracker.ietf.org/doc/draft-cook-doh-discovery-trial/?include_text=1 ) only goes through the CPE via Do53 in the discovery phase, then the DoH TLS connection bypasses the CPE and goes directly to the main resolver. For ISPs and vendors that do filtering and other DNS-based services on the main recursor platform, this would be enough to let the current functionalities continue working. Also - to a point by Kenji - you can't do that by picking from a finite set of preconfigured filtering options, e.g. "http://family-safe-strict.doh.isp.net ,http://family-safe.doh.isp.net ,http://doh.isp.net ", because current solutions offer complete control to end-users over the filtering configuration for each single device, even to the level of blocking or allowing individual domains if they like. There are people using filtering for purposes unrelated to parental control, for example SMBs blocking access to social media from the office during working hours. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com mailto:vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy ------=_Part_1570_1373817735.1595321725136 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit
 
Il 21/07/2020 02:43 Eric Rescorla <ekr@rtfm.com> ha scritto:


So the idea here would be to have a mechanism which enabled Do[TH] but
bypassed the CPE, correct? So, it would be something that one deployed
at the ISP's recursive and that we just expected the CPE to pass on?
It seems like the primary requirement there would be for something which
had a very high chance of passing through existing CPE.


With that said, I have some concerns about the objective of having the
CPE in the user's resolution path.
I just want to note that the mechanism described in the draft I recently posted ( https://datatracker.ietf.org/doc/draft-cook-doh-discovery-trial/?include_text=1 ) only goes through the CPE via Do53 in the discovery phase, then the DoH TLS connection bypasses the CPE and goes directly to the main resolver.
 
For ISPs and vendors that do filtering and other DNS-based services on the main recursor platform, this would be enough to let the current functionalities continue working.
 
Also - to a point by Kenji - you can't do that by picking from a finite set of preconfigured filtering options, e.g. "family-safe-strict.doh.isp.net, family-safe.doh.isp.net, doh.isp.net", because current solutions offer complete control to end-users over the filtering configuration for each single device, even to the level of blocking or allowing individual domains if they like. There are people using filtering for purposes unrelated to parental control, for example SMBs blocking access to social media from the office during working hours.

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
------=_Part_1570_1373817735.1595321725136-- From nobody Tue Jul 21 02:15:22 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE0733A1720 for ; Tue, 21 Jul 2020 02:15:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.117 X-Spam-Level: X-Spam-Status: No, score=-2.117 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=orange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A52RREtGqlja for ; Tue, 21 Jul 2020 02:15:18 -0700 (PDT) Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.66.41]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 02C633A1713 for ; Tue, 21 Jul 2020 02:15:17 -0700 (PDT) Received: from opfedar06.francetelecom.fr (unknown [xx.xx.xx.8]) by opfedar23.francetelecom.fr (ESMTP service) with ESMTP id 4B9tGr3lsWzBrYK; Tue, 21 Jul 2020 11:15:16 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.com; s=ORANGE001; t=1595322916; bh=uWPTbWf+wXqn+4na9Aio9eEZoWLHXrCbVG+7MF2qL3s=; h=From:To:Subject:Date:Message-ID:Content-Type:MIME-Version; b=bQ5jgbqfLHc3DpDCEsRzF20iE55q2EJZ0nKgVIg3VqyZ/7yIf/lXDOpLCIYfhcKE8 +fmBdGeVLWGCglzL4/M4UQB6mTlNR03PY8J0Dt8A5PTmY0ZgDnAXL/Ym/iAkbpv1OX qnN55w7dMM8hAJRnMB+TKwxGe1UVNpDxDhHus51uucqy5+fGPBFAwXMWg1D/bkbC8g XewWc8FKCgnH+iWltki7M4v+2sdqV/S4bf+4QoCQKkPzi5sWtsWAmApHAN6mg7yiWh uKaVALIw1a4+TQOJK2NnN+yMAAci83p6RoPIxm0CY4HgKE0iuZ5xI1asMY5BF8E3PN TsjTw6tsJUTlg== Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.38]) by opfedar06.francetelecom.fr (ESMTP service) with ESMTP id 4B9tGr2pS3z3wc3; Tue, 21 Jul 2020 11:15:16 +0200 (CEST) From: To: "Vinny Parla (vparla)" CC: "add@ietf.org" Thread-Topic: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AQHWXqbmx2T6tR8Z9kGodk+PQJE0kKkRA1CQgAAa2oCAAKG+YA== Date: Tue, 21 Jul 2020 09:15:15 +0000 Message-ID: <18625_1595322916_5F16B224_18625_283_1_787AE7BB302AE849A7480A190F8B9330314FEF08@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.114.13.245] Content-Type: multipart/alternative; boundary="_000_787AE7BB302AE849A7480A190F8B9330314FEF08OPEXCAUBMA2corp_" MIME-Version: 1.0 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 09:15:21 -0000 --_000_787AE7BB302AE849A7480A190F8B9330314FEF08OPEXCAUBMA2corp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgVmlubnksDQoNClBsZWFzZSBjaGVjayBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJh ZnQtYnR3LWFkZC1ob21lLTA3I3NlY3Rpb24tNyB3aGVyZSB3ZSBkaXNjdXNzIGhvdyB0byBwdXQg dGhpcyBpbiBwbGFjZS4NCg0KQ2hlZXJzLA0KTWVkDQoNCkRlIDogQWRkIFttYWlsdG86YWRkLWJv dW5jZXNAaWV0Zi5vcmddIERlIGxhIHBhcnQgZGUgVmlubnkgUGFybGEgKHZwYXJsYSkNCkVudm95 w6kgOiBtYXJkaSAyMSBqdWlsbGV0IDIwMjAgMDM6MzANCsOAIDogQW5kcmV3IENhbXBsaW5nIDxh bmRyZXcuY2FtcGxpbmdANDE5LmNvbnN1bHRpbmc+OyBFcmljIFJlc2NvcmxhIDxla3JAcnRmbS5j b20+DQpDYyA6IGFkZEBpZXRmLm9yZzsgTWFydGluIFRob21zb24gPG10QGxvd2VudHJvcHkubmV0 Pg0KT2JqZXQgOiBSZTogW0FkZF0gUHJhY3RpY2FsIE9ic2VydmF0aW9ucyBmcm9tIEVuY3J5cHRl ZCBETlMgRGVwbG95bWVudHMgYnkgTmV0d29yayBPcGVyYXRvcnMNCg0KSSBkb27igJl0IHNlZSBo b3cgYW4gZW5kcG9pbnQgY291bGQgZGlzdGluZ3Vpc2ggYmV0d2VlbiBhIG1hbGljaW91cyBvbi1w YXRoIGRldmljZSBvciBzZXJ2aWNlIHZzIHRoZSBDUEUgZGVwaWN0ZWQgaW4gdGhpcyBmbG93Og0K Q2xpZW50ICA8LS0tLS0tLSBUTFMgLS0tLS0tLS0+ICBDUEUgIDwtLS0tLS0tIFRMUyAtLS0tLS0t LT4gIElTUCBSZXNvbHZlcg0KDQpUaGlzIGlzIGVxdWl2YWxlbnQgdG8NCg0KQ2xpZW50ICA8LS0t LS0tLSBUTFMgLS0tLS0tLS0+ICBNaXRNIFByb3h5ICA8LS0tLS0tLSBUTFMgLS0tLS0tLS0+ICBB bnkgV2Vic2l0ZQ0KDQpXaGljaCBpcyBzZWVtcyBsaWtlIGEgbm9uLXN0YXJ0ZXIuDQoNCi1WaW5u eQ0KDQpGcm9tOiBBZGQgPGFkZC1ib3VuY2VzQGlldGYub3JnPG1haWx0bzphZGQtYm91bmNlc0Bp ZXRmLm9yZz4+IE9uIEJlaGFsZiBPZiBBbmRyZXcgQ2FtcGxpbmcNClNlbnQ6IE1vbmRheSwgSnVs eSAyMCwgMjAyMCA2OjIyIFBNDQpUbzogRXJpYyBSZXNjb3JsYSA8ZWtyQHJ0Zm0uY29tPG1haWx0 bzpla3JAcnRmbS5jb20+Pg0KQ2M6IGFkZEBpZXRmLm9yZzxtYWlsdG86YWRkQGlldGYub3JnPjsg TWFydGluIFRob21zb24gPG10QGxvd2VudHJvcHkubmV0PG1haWx0bzptdEBsb3dlbnRyb3B5Lm5l dD4+DQpTdWJqZWN0OiBSZTogW0FkZF0gUHJhY3RpY2FsIE9ic2VydmF0aW9ucyBmcm9tIEVuY3J5 cHRlZCBETlMgRGVwbG95bWVudHMgYnkgTmV0d29yayBPcGVyYXRvcnMNCg0KRWtyDQpUbyBjbGFy aWZ5LCB0aGVyZSBhcmUgdHdvIGlzc3VlcyB0byBvdmVyY29tZSBoZXJlLCAoaSkgdXNlIG9mIFJG QzE5MTggcHJpdmF0ZSBhZGRyZXNzZXMgYnkgdGhlIENQRSAodG8gZmFjaWxpdGF0ZSBTUEFVKSBh bmQgKGlpKSBzdXBwb3J0IGZvciBETlMgZm9yd2FyZGVycyB0byBtYWludGFpbiB0aGUgZnVsbCBm dW5jdGlvbmFsaXR5IHByb3ZpZGVkIGJ5IG5ldHdvcmsgb3BlcmF0b3JzIHRoYXQgaXMgZGVzY3Jp YmVkIGluIHRoZSBkb2N1bWVudC4gIFRoZSBkZXNpcmVkIGVuZCBzdGF0ZSBpcyBhcyB5b3UgZGVz Y3JpYmU6DQoNCkNsaWVudCAgPC0tLS0tLS0gVExTIC0tLS0tLS0tPiAgQ1BFICA8LS0tLS0tLSBU TFMgLS0tLS0tLS0+ICBJU1AgUmVzb2x2ZXINCg0KV2hpbHN0IGl0IHdvdWxkIGJlIGlkZWFsIHRv IGRlYWwgd2l0aCBib3RoIG9mIHRoZSBhYm92ZSBpc3N1ZXMgc2ltdWx0YW5lb3VzbHksIHByYWdt YXRpY2FsbHkgaXQgbWF5IGJlIG5lY2Vzc2FyeSB0byBkZWFsIHdpdGggdGhlbSBzZXF1ZW50aWFs bHkgZ2l2ZW4gdGhlIHBvdGVudGlhbCBmb3IgZGVsYXlzIGluIHVwZ3JhZGluZyBDUEUgc29mdHdh cmUuICBTaW5jZSB0aGVyZSBhcmUgYWxyZWFkeSBzb21lIHByb3Bvc2VkIGRpc2NvdmVyeSBtZXRo b2RzIHRoYXQgZGVhbCB3aXRoIHRoZSBwcml2YXRlIGFkZHJlc3NlcywgaXQgY291bGQgbWFrZSBz ZW5zZSBmb3IgdG8gaW1wbGVtZW50IGEgdHdvLXN0ZXAgc29sdXRpb24gdGhhdCBmaXJzdCBzb2x2 ZXMgdGhlIHByaXZhdGUgYWRkcmVzcyBpc3N1ZSBpbiB0aGUgc2hvcnQtdGVybSB3aGlsc3QgdGhl IENQRSBzb2Z0d2FyZSB1cGdyYWRlIGlzIGRlcGxveWVkLiAgVGhpcyB3b3VsZCBhdCBsZWFzdCBt YWludGFpbiBzdXBwb3J0IGZvciB0aGUgdXNlcuKAmXMgY2hvc2VuIHJlc29sdmVyIHZpYSBlbmNy eXB0ZWQgRE5TIHVzaW5nIFNQQVUgd2hpbHN0IGEgQ1BFIHNvZnR3YXJlIHVwZ3JhZGUgaXMgUUHi gJlkIGJ5IHRoZSBuZXR3b3JrIG9wZXJhdG9yIGFuZCB0aGVuIGRlcGxveWVkLg0KDQpPZiBjb3Vy c2Ugb3RoZXJzIG1heSB0aGluayBpdCBiZXR0ZXIgdG8gZ28gd2l0aCBhIHNpbmdsZS1zdGVwIGFw cHJvYWNoIHRoYXQgdXBncmFkZXMgdGhlIENQRSBzb2Z0d2FyZSB0byBtYWludGFpbiBzdXBwb3J0 IGZvciBETlMgZm9yd2FyZGVycyBhbmQgZGVhbHMgd2l0aCB0aGUgcHJpdmF0ZSBhZGRyZXNzIGlz c3VlIGZvciBTUEFVIGF0IHRoZSBzYW1lIHRpbWUuICBIb3dldmVyLCBzaW5jZSB0aGUgdGltZWZy YW1lIGZvciB0aGlzIHdpbGwgYmUgbmVjZXNzYXJpbHkgbG9uZ2VyIGZvciBtYW55IHVzZXJzLCBt eSBhc3N1bXB0aW9uIGlzIHRoYXQgdGhlIHByZWZlcmVuY2UgZm9yIG1vc3Qgd291bGQgYmUgdG8g ZW5sYXJnZSB0aGUgcG90ZW50aWFsIHBvb2wgb2YgZW5jcnlwdGVkIEROUyB1c2VycyBhcyBxdWlj a2x5IGFzIHBvc3NpYmxlLg0KDQpEb2VzIHRoaXMgaGVscD8NCg0KDQpBbmRyZXcNCg0KDQpGcm9t OiBFcmljIFJlc2NvcmxhIDxla3JAcnRmbS5jb208bWFpbHRvOmVrckBydGZtLmNvbT4+DQpTZW50 OiAyMCBKdWx5IDIwMjAgMTY6MDMNClRvOiBBbmRyZXcgQ2FtcGxpbmcgPGFuZHJldy5jYW1wbGlu Z0A0MTkuY29uc3VsdGluZzxtYWlsdG86YW5kcmV3LmNhbXBsaW5nQDQxOS5jb25zdWx0aW5nPj4N CkNjOiBNYXJ0aW4gVGhvbXNvbiA8bXRAbG93ZW50cm9weS5uZXQ8bWFpbHRvOm10QGxvd2VudHJv cHkubmV0Pj47IGFkZEBpZXRmLm9yZzxtYWlsdG86YWRkQGlldGYub3JnPg0KU3ViamVjdDogUmU6 IFtBZGRdIFByYWN0aWNhbCBPYnNlcnZhdGlvbnMgZnJvbSBFbmNyeXB0ZWQgRE5TIERlcGxveW1l bnRzIGJ5IE5ldHdvcmsgT3BlcmF0b3JzDQoNCkhpIEFuZHJldywNCg0KSWdub3JpbmcgdGhlIGRp c2NvdmVyeSBxdWVzdGlvbiBmb3IgYSBtb21lbnQsIEkgZ3Vlc3MgSSdtIG5vdCBlbnRpcmVseQ0K Y2xlYXIgb24gd2hhdCB5b3VyIGRlc2lyZWQgb3V0Y29tZSBpbiB0ZXJtcyBvZiBuZXR3b3JrIHRv cG9sb2d5IGlzLg0KDQpBcyBkZXNjcmliZWQgaW4geW91ciBkcmFmdCwgYXQgcHJlc2VudCB0aGUg Y2xpZW50cyBzZW5kIEROUyBwYWNrZXRzIHRvDQp0aGUgZm9yd2FyZGVyIG9uIHRoZSBDUEUsIHdo aWNoIHRoZW4gc2VsZWN0aXZlbHkgZm9yd2FyZHMgcXVlcmllcyB0bw0KdGhlIG1haW4gSVNQIHJl c29sdmVyLiBIb3dldmVyLCBpbiBhIHdvcmxkIHdoZXJlIHRoZSBETlMgaXMgZW5jcnlwdGVkLA0K dGhlbiB0aGlzIHdvdWxkIHJlcXVpcmUgdGhhdCB0aGUgZW5jcnlwdGlvbiBiZSB0ZXJtaW5hdGVk IGF0IHRoZQ0KQ1BFIGFuZCB0aGVuIHJlLW9yaWdpbmF0ZWQgdG8gdGhlIElTUCByZXNvbHZlciwg bGlrZSBzbzoNCg0KDQpDbGllbnQgPC0tLS0tLS0gVExTIC0tLS0tLS0tPiAgQ1BFICA8LS0tLS0t LSBUTFMgLS0tLS0tLS0+IElTUCBSZXNvbHZlcg0KDQpJcyB0aGF0IHlvdXIgZGVzaXJlZCBvdXRj b21lPyBJZiBzbywgaXQgc2VlbXMgdG8gY29tZSBpbnRvIGNvbmZsaWN0DQp3aXRoIHlvdXIgcG9p bnRzIGluIFMgNS4yIGFib3V0IHRoZSBkaWZmaWN1bHR5IG9mIHVwZ3JhZGluZyB0aGUgQ1BFLg0K SWYgbm90LCBtYXliZSBJIGp1c3QgZG9uJ3QgdW5kZXJzdGFuZC4gSW4gZWl0aGVyIGNhc2UsIHBl cmhhcHMgeW91DQpjYW4gZWxhYm9yYXRlLg0KDQotRWtyDQoNCk9uIE1vbiwgSnVsIDIwLCAyMDIw IGF0IDc6NDcgQU0gQW5kcmV3IENhbXBsaW5nIDxhbmRyZXcuY2FtcGxpbmdANDE5LmNvbnN1bHRp bmc8bWFpbHRvOmFuZHJldy5jYW1wbGluZ0A0MTkuY29uc3VsdGluZz4+IHdyb3RlOg0KT24gVGh1 LCBKdWwgMTYsIDIwMjAsIGF0IDAwOjEyLCBNYXJ0aW4gVGhvbXNvbiA8bXRAbG93ZW50cm9weS5u ZXQ8bWFpbHRvOm10QGxvd2VudHJvcHkubmV0Pj4gd3JvdGU6DQoNCj4gWW91ciBkcmFmdCBzZWVt cyB0byBiZSBtYWtpbmcgYSBjYXNlIGZvciBzdXBwb3J0aW5nIGZvcndhcmRlcnMsIGJ1dCBJJ20g bm90IGNsZWFyIG9uIHdoYXQgc3VwcG9ydGluZyBmb3J3YXJkZXJzIGxvb2tzIGxpa2UuICBJIHVu ZGVyc3RhbmQgdGhhdCB5b3UgbWlnaHQgbm90IGhhdmUgc3BlY2lmaWMgaWRlYXMgYWJvdXQgd2hh dCB0aGlzIHN1cHBvcnQgbWlnaHQgbG9vayBsaWtlLCBidXQgSSBkb24ndCBzZWUgYW55IHJlYWwg cmVxdWlyZW1lbnRzIGhlcmUgZWl0aGVyLg0KPg0KPiBJdCB3b3VsZCByZWFsbHkgaGVscCBpZiB0 aGUgZHJhZnQgd291bGQgY2xlYXJseSBhcnRpY3VsYXRlIHdoYXQgeW91ciBkZXNpcmVkIG91dGNv bWUgaXMuDQoNClNvcnJ5IGZvciB0aGUgbGFjayBvZiBjbGFyaXR5LiAgVGhlIHByaW1hcnkgaW50 ZW50IG9mIHRoZSBkb2N1bWVudCBpcyB0byBwcm92aWRlIGluZm9ybWF0aW9uIGFzIHdlIGhhdmUg dGhlIGltcHJlc3Npb24gdGhhdCBhdCBsZWFzdCBzb21lIGNsaWVudCBkZXZlbG9wZXJzIG1heSBu b3QgaGF2ZSBnb29kIHZpc2liaWxpdHkgb2YgY29tbW9uIG5ldHdvcmsgb3BlcmF0b3IgYXJjaGl0 ZWN0dXJlcyBhbmQgcHJhY3RpY2VzIG91dHNpZGUgb2YgdGhlIFVTLiAgQnkgcHJvdmlkaW5nIHN1 Y2ggY2xhcml0eSB3ZSBob3BlIHRvIHNlZSBpbXBsZW1lbnRhdGlvbnMgdGhhdCBhcmUgc3ltcGF0 aGV0aWMgdG8gdGhlIGVudmlyb25tZW50IGludG8gd2hpY2ggdGhleSBhcmUgYmVpbmcgZGVwbG95 ZWQgaW4gb3JkZXIgdG8gbWF4aW1pc2UgdGhlIGNoYW5jZXMgb2Ygd29ya2luZyBjb3JyZWN0bHks IGlkZWFsbHkgdmlhIFNQQVUgYXMgbWFudWFsIGNvbmZpZ3VyYXRpb24gb2YgRE5TIHNldHRpbmdz IGJ5IHRoZSBtYWpvcml0eSBvZiB1c2VycyBzZWVtcyB1bmxpa2VseS4NCg0KSW4gYSBudXQgc2hl bGwsIGFueSBBREQgc29sdXRpb24gc2hvdWxkIG1lYXN1cmUgaXRzZWxmIHRvIHNlZSB3aGV0aGVy IGl0IG1lZXRzIHRoZSB1c2UgY2FzZSBkZXNjcmliZWQgaW4gdGhpcyBkb2N1bWVudCwgYXQgbGVh c3Qgb25lIGlzIG5lZWRlZCB0aGF0IGRvZXMuDQoNCg0KQW5kcmV3DQoNCi0tDQpBZGQgbWFpbGlu ZyBsaXN0DQpBZGRAaWV0Zi5vcmc8bWFpbHRvOkFkZEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vYWRkDQoKX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKQ2UgbWVzc2FnZSBldCBzZXMg cGllY2VzIGpvaW50ZXMgcGV1dmVudCBjb250ZW5pciBkZXMgaW5mb3JtYXRpb25zIGNvbmZpZGVu dGllbGxlcyBvdSBwcml2aWxlZ2llZXMgZXQgbmUgZG9pdmVudCBkb25jCnBhcyBldHJlIGRpZmZ1 c2VzLCBleHBsb2l0ZXMgb3UgY29waWVzIHNhbnMgYXV0b3Jpc2F0aW9uLiBTaSB2b3VzIGF2ZXog cmVjdSBjZSBtZXNzYWdlIHBhciBlcnJldXIsIHZldWlsbGV6IGxlIHNpZ25hbGVyCmEgbCdleHBl ZGl0ZXVyIGV0IGxlIGRldHJ1aXJlIGFpbnNpIHF1ZSBsZXMgcGllY2VzIGpvaW50ZXMuIExlcyBt ZXNzYWdlcyBlbGVjdHJvbmlxdWVzIGV0YW50IHN1c2NlcHRpYmxlcyBkJ2FsdGVyYXRpb24sCk9y YW5nZSBkZWNsaW5lIHRvdXRlIHJlc3BvbnNhYmlsaXRlIHNpIGNlIG1lc3NhZ2UgYSBldGUgYWx0 ZXJlLCBkZWZvcm1lIG91IGZhbHNpZmllLiBNZXJjaS4KClRoaXMgbWVzc2FnZSBhbmQgaXRzIGF0 dGFjaG1lbnRzIG1heSBjb250YWluIGNvbmZpZGVudGlhbCBvciBwcml2aWxlZ2VkIGluZm9ybWF0 aW9uIHRoYXQgbWF5IGJlIHByb3RlY3RlZCBieSBsYXc7CnRoZXkgc2hvdWxkIG5vdCBiZSBkaXN0 cmlidXRlZCwgdXNlZCBvciBjb3BpZWQgd2l0aG91dCBhdXRob3Jpc2F0aW9uLgpJZiB5b3UgaGF2 ZSByZWNlaXZlZCB0aGlzIGVtYWlsIGluIGVycm9yLCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIg YW5kIGRlbGV0ZSB0aGlzIG1lc3NhZ2UgYW5kIGl0cyBhdHRhY2htZW50cy4KQXMgZW1haWxzIG1h eSBiZSBhbHRlcmVkLCBPcmFuZ2UgaXMgbm90IGxpYWJsZSBmb3IgbWVzc2FnZXMgdGhhdCBoYXZl IGJlZW4gbW9kaWZpZWQsIGNoYW5nZWQgb3IgZmFsc2lmaWVkLgpUaGFuayB5b3UuCgo= --_000_787AE7BB302AE849A7480A190F8B9330314FEF08OPEXCAUBMA2corp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLkVtYWlsU3R5bGUxNw0KCXtt c28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10 eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7DQoJY29sb3I6 YmxhY2s7DQoJZm9udC13ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFsOw0KCXRleHQt ZGVjb3JhdGlvbjpub25lIG5vbmU7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6 ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7 c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBw dDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+ PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBz cGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4 bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIg ZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4N Cjxib2R5IGxhbmc9IkZSIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9 IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2s7bXNvLWZhcmVhc3QtbGFu Z3VhZ2U6RU4tVVMiPkhpIFZpbm55LA0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7O2NvbG9yOmJsYWNrO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIg c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrO21z by1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5QbGVhc2UgY2hlY2sNCjxhIGhyZWY9Imh0dHBzOi8v dG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1idHctYWRkLWhvbWUtMDcjc2VjdGlvbi03Ij5odHRw czovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtYnR3LWFkZC1ob21lLTA3I3NlY3Rpb24tNzwv YT4gd2hlcmUgd2UgZGlzY3VzcyBob3cgdG8gcHV0IHRoaXMgaW4gcGxhY2UuDQo8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrO21zby1m YXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrO21zby1mYXJlYXN0LWxhbmd1YWdlOkVO LVVTIj5DaGVlcnMsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90Oztjb2xvcjpibGFjazttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+TWVkPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjazttc28t ZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRp diBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5n OjBjbSAwY20gMGNtIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5EZSZuYnNwOzo8L2I+IEFkZCBbbWFpbHRvOmFkZC1ib3Vu Y2VzQGlldGYub3JnXSA8Yj5EZSBsYSBwYXJ0IGRlPC9iPiBWaW5ueSBQYXJsYSAodnBhcmxhKTxi cj4NCjxiPkVudm95w6kmbmJzcDs6PC9iPiBtYXJkaSAyMSBqdWlsbGV0IDIwMjAgMDM6MzA8YnI+ DQo8Yj7DgCZuYnNwOzo8L2I+IEFuZHJldyBDYW1wbGluZyAmbHQ7YW5kcmV3LmNhbXBsaW5nQDQx OS5jb25zdWx0aW5nJmd0OzsgRXJpYyBSZXNjb3JsYSAmbHQ7ZWtyQHJ0Zm0uY29tJmd0Ozxicj4N CjxiPkNjJm5ic3A7OjwvYj4gYWRkQGlldGYub3JnOyBNYXJ0aW4gVGhvbXNvbiAmbHQ7bXRAbG93 ZW50cm9weS5uZXQmZ3Q7PGJyPg0KPGI+T2JqZXQmbmJzcDs6PC9iPiBSZTogW0FkZF0gUHJhY3Rp Y2FsIE9ic2VydmF0aW9ucyBmcm9tIEVuY3J5cHRlZCBETlMgRGVwbG95bWVudHMgYnkgTmV0d29y ayBPcGVyYXRvcnM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLVVTIj5JIGRvbuKAmXQgc2VlIGhvdyBhbiBlbmRwb2ludCBjb3VsZCBkaXN0aW5n dWlzaCBiZXR3ZWVuIGEgbWFsaWNpb3VzIG9uLXBhdGggZGV2aWNlIG9yIHNlcnZpY2UgdnMgdGhl IENQRSBkZXBpY3RlZCBpbiB0aGlzIGZsb3c6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPkNsaWVudCAmbmJzcDsmbHQ7LS0tLS0t LSBUTFMgLS0tLS0tLS0mZ3Q7ICZuYnNwO0NQRSAmbmJzcDsmbHQ7LS0tLS0tLSBUTFMgLS0tLS0t LS0mZ3Q7ICZuYnNwO0lTUCBSZXNvbHZlcjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+VGhpcyBpcyBlcXVp dmFsZW50IHRvPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gbGFuZz0iRU4tR0IiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5DbGllbnQgJm5ic3A7Jmx0Oy0tLS0tLS0gVExT IC0tLS0tLS0tJmd0OyAmbmJzcDtNaXRNIFByb3h5ICZuYnNwOyZsdDstLS0tLS0tIFRMUyAtLS0t LS0tLSZndDsgJm5ic3A7QW55IFdlYnNpdGU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPldoaWNoIGlzIHNl ZW1zIGxpa2UgYSBub24tc3RhcnRlci48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPi1WaW5ueTwvc3Bhbj48 c3BhbiBsYW5nPSJFTi1VUyI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxk aXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4w cHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48 c3BhbiBsYW5nPSJFTi1VUyI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVTIj4gQWRk ICZsdDs8YSBocmVmPSJtYWlsdG86YWRkLWJvdW5jZXNAaWV0Zi5vcmciPmFkZC1ib3VuY2VzQGll dGYub3JnPC9hPiZndDsNCjxiPk9uIEJlaGFsZiBPZiA8L2I+QW5kcmV3IENhbXBsaW5nPGJyPg0K PGI+U2VudDo8L2I+IE1vbmRheSwgSnVseSAyMCwgMjAyMCA2OjIyIFBNPGJyPg0KPGI+VG86PC9i PiBFcmljIFJlc2NvcmxhICZsdDs8YSBocmVmPSJtYWlsdG86ZWtyQHJ0Zm0uY29tIj5la3JAcnRm bS5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gPGEgaHJlZj0ibWFpbHRvOmFkZEBpZXRmLm9y ZyI+YWRkQGlldGYub3JnPC9hPjsgTWFydGluIFRob21zb24gJmx0OzxhIGhyZWY9Im1haWx0bzpt dEBsb3dlbnRyb3B5Lm5ldCI+bXRAbG93ZW50cm9weS5uZXQ8L2E+Jmd0Ozxicj4NCjxiPlN1Ympl Y3Q6PC9iPiBSZTogW0FkZF0gUHJhY3RpY2FsIE9ic2VydmF0aW9ucyBmcm9tIEVuY3J5cHRlZCBE TlMgRGVwbG95bWVudHMgYnkgTmV0d29yayBPcGVyYXRvcnM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+RWtyPG86cD48L286cD48 L3NwYW4+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBz dHlsZT0iZm9udC1zaXplOjEyLjBwdCI+VG8gY2xhcmlmeSwgdGhlcmUgYXJlIHR3byBpc3N1ZXMg dG8gb3ZlcmNvbWUgaGVyZSwgKGkpIHVzZSBvZiBSRkMxOTE4IHByaXZhdGUgYWRkcmVzc2VzIGJ5 IHRoZSBDUEUgKHRvIGZhY2lsaXRhdGUgU1BBVSkgYW5kIChpaSkgc3VwcG9ydCBmb3IgRE5TIGZv cndhcmRlcnMgdG8gbWFpbnRhaW4gdGhlIGZ1bGwgZnVuY3Rpb25hbGl0eSBwcm92aWRlZA0KIGJ5 IG5ldHdvcmsgb3BlcmF0b3JzIHRoYXQgaXMgZGVzY3JpYmVkIGluIHRoZSBkb2N1bWVudC4mbmJz cDsgVGhlIGRlc2lyZWQgZW5kIHN0YXRlIGlzIGFzIHlvdSBkZXNjcmliZTo8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5DbGllbnQgJm5ic3A7Jmx0Oy0tLS0tLS0g VExTIC0tLS0tLS0tJmd0OyAmbmJzcDtDUEUgJm5ic3A7Jmx0Oy0tLS0tLS0gVExTIC0tLS0tLS0t Jmd0OyAmbmJzcDtJU1AgUmVzb2x2ZXI8L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJm b250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVO LUdCIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+V2hpbHN0IGl0IHdvdWxkIGJlIGlkZWFsIHRv IGRlYWwgd2l0aCBib3RoIG9mIHRoZSBhYm92ZSBpc3N1ZXMgc2ltdWx0YW5lb3VzbHksIHByYWdt YXRpY2FsbHkgaXQgbWF5IGJlIG5lY2Vzc2FyeSB0byBkZWFsIHdpdGggdGhlbSBzZXF1ZW50aWFs bHkgZ2l2ZW4gdGhlIHBvdGVudGlhbCBmb3IgZGVsYXlzIGluIHVwZ3JhZGluZyBDUEUNCiBzb2Z0 d2FyZS4mbmJzcDsgU2luY2UgdGhlcmUgYXJlIGFscmVhZHkgc29tZSBwcm9wb3NlZCBkaXNjb3Zl cnkgbWV0aG9kcyB0aGF0IGRlYWwgd2l0aCB0aGUgcHJpdmF0ZSBhZGRyZXNzZXMsIGl0IGNvdWxk IG1ha2Ugc2Vuc2UgZm9yIHRvIGltcGxlbWVudCBhIHR3by1zdGVwIHNvbHV0aW9uIHRoYXQgZmly c3Qgc29sdmVzIHRoZSBwcml2YXRlIGFkZHJlc3MgaXNzdWUgaW4gdGhlIHNob3J0LXRlcm0gd2hp bHN0IHRoZSBDUEUgc29mdHdhcmUgdXBncmFkZQ0KIGlzIGRlcGxveWVkLiZuYnNwOyBUaGlzIHdv dWxkIGF0IGxlYXN0IG1haW50YWluIHN1cHBvcnQgZm9yIHRoZSB1c2Vy4oCZcyBjaG9zZW4gcmVz b2x2ZXIgdmlhIGVuY3J5cHRlZCBETlMgdXNpbmcgU1BBVSB3aGlsc3QgYSBDUEUgc29mdHdhcmUg dXBncmFkZSBpcyBRQeKAmWQgYnkgdGhlIG5ldHdvcmsgb3BlcmF0b3IgYW5kIHRoZW4gZGVwbG95 ZWQuJm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvYj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJF Ti1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPk9mIGNvdXJzZSBvdGhlcnMgbWF5IHRoaW5r IGl0IGJldHRlciB0byBnbyB3aXRoIGEgc2luZ2xlLXN0ZXAgYXBwcm9hY2ggdGhhdCB1cGdyYWRl cyB0aGUgQ1BFIHNvZnR3YXJlIHRvIG1haW50YWluIHN1cHBvcnQgZm9yIEROUyBmb3J3YXJkZXJz IGFuZCBkZWFscyB3aXRoIHRoZSBwcml2YXRlIGFkZHJlc3MgaXNzdWUgZm9yIFNQQVUgYXQNCiB0 aGUgc2FtZSB0aW1lLiZuYnNwOyBIb3dldmVyLCBzaW5jZSB0aGUgdGltZWZyYW1lIGZvciB0aGlz IHdpbGwgYmUgbmVjZXNzYXJpbHkgbG9uZ2VyIGZvciBtYW55IHVzZXJzLCBteSBhc3N1bXB0aW9u IGlzIHRoYXQgdGhlIHByZWZlcmVuY2UgZm9yIG1vc3Qgd291bGQgYmUgdG8gZW5sYXJnZSB0aGUg cG90ZW50aWFsIHBvb2wgb2YgZW5jcnlwdGVkIEROUyB1c2VycyBhcyBxdWlja2x5IGFzIHBvc3Np YmxlLiZuYnNwOw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPkRvZXMgdGhpcyBoZWxwPzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5BbmRyZXc8bzpwPjwv bzpwPjwvc3Bhbj48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4t R0IiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6 ZToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAw Y20gMGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLVVTIj5Gcm9t Ojwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tVVMiPiBFcmljIFJlc2NvcmxhICZsdDs8YSBocmVm PSJtYWlsdG86ZWtyQHJ0Zm0uY29tIj5la3JAcnRmbS5jb208L2E+Jmd0Ow0KPGJyPg0KPGI+U2Vu dDo8L2I+IDIwIEp1bHkgMjAyMCAxNjowMzxicj4NCjxiPlRvOjwvYj4gQW5kcmV3IENhbXBsaW5n ICZsdDs8YSBocmVmPSJtYWlsdG86YW5kcmV3LmNhbXBsaW5nQDQxOS5jb25zdWx0aW5nIj5hbmRy ZXcuY2FtcGxpbmdANDE5LmNvbnN1bHRpbmc8L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gTWFydGlu IFRob21zb24gJmx0OzxhIGhyZWY9Im1haWx0bzptdEBsb3dlbnRyb3B5Lm5ldCI+bXRAbG93ZW50 cm9weS5uZXQ8L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzphZGRAaWV0Zi5vcmciPmFkZEBpZXRm Lm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtBZGRdIFByYWN0aWNhbCBPYnNlcnZh dGlvbnMgZnJvbSBFbmNyeXB0ZWQgRE5TIERlcGxveW1lbnRzIGJ5IE5ldHdvcmsgT3BlcmF0b3Jz PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBsYW5nPSJFTi1HQiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gbGFuZz0i RU4tR0IiPkhpIEFuZHJldyw8YnI+DQo8YnI+DQpJZ25vcmluZyB0aGUgZGlzY292ZXJ5IHF1ZXN0 aW9uIGZvciBhIG1vbWVudCwgSSBndWVzcyBJJ20gbm90IGVudGlyZWx5PGJyPg0KY2xlYXIgb24g d2hhdCB5b3VyIGRlc2lyZWQgb3V0Y29tZSBpbiB0ZXJtcyBvZiBuZXR3b3JrIHRvcG9sb2d5IGlz Ljxicj4NCjxicj4NCkFzIGRlc2NyaWJlZCBpbiB5b3VyIGRyYWZ0LCBhdCBwcmVzZW50IHRoZSBj bGllbnRzIHNlbmQgRE5TIHBhY2tldHMgdG88YnI+DQp0aGUgZm9yd2FyZGVyIG9uIHRoZSBDUEUs IHdoaWNoIHRoZW4gc2VsZWN0aXZlbHkgZm9yd2FyZHMgcXVlcmllcyB0bzxicj4NCnRoZSBtYWlu IElTUCByZXNvbHZlci4gSG93ZXZlciwgaW4gYSB3b3JsZCB3aGVyZSB0aGUgRE5TIGlzIGVuY3J5 cHRlZCw8YnI+DQp0aGVuIHRoaXMgd291bGQgcmVxdWlyZSB0aGF0IHRoZSBlbmNyeXB0aW9uIGJl IHRlcm1pbmF0ZWQgYXQgdGhlPGJyPg0KQ1BFIGFuZCB0aGVuIHJlLW9yaWdpbmF0ZWQgdG8gdGhl IElTUCByZXNvbHZlciwgbGlrZSBzbzo8YnI+DQo8YnI+DQo8YnI+DQpDbGllbnQgJmx0Oy0tLS0t LS0gVExTIC0tLS0tLS0tJmd0OyAmbmJzcDtDUEUgJm5ic3A7Jmx0Oy0tLS0tLS0gVExTIC0tLS0t LS0tJmd0OyBJU1AgUmVzb2x2ZXI8YnI+DQo8YnI+DQpJcyB0aGF0IHlvdXIgZGVzaXJlZCBvdXRj b21lPyBJZiBzbywgaXQgc2VlbXMgdG8gY29tZSBpbnRvIGNvbmZsaWN0PGJyPg0Kd2l0aCB5b3Vy IHBvaW50cyBpbiBTIDUuMiBhYm91dCB0aGUgZGlmZmljdWx0eSBvZiB1cGdyYWRpbmcgdGhlIENQ RS48YnI+DQpJZiBub3QsIG1heWJlIEkganVzdCBkb24ndCB1bmRlcnN0YW5kLiBJbiBlaXRoZXIg Y2FzZSwgcGVyaGFwcyB5b3U8YnI+DQpjYW4gZWxhYm9yYXRlLjxicj4NCjxicj4NCi1Fa3I8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxh bmc9IkVOLUdCIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5PbiBNb24sIEp1bCAyMCwgMjAy MCBhdCA3OjQ3IEFNIEFuZHJldyBDYW1wbGluZyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmFuZHJldy5j YW1wbGluZ0A0MTkuY29uc3VsdGluZyI+YW5kcmV3LmNhbXBsaW5nQDQxOS5jb25zdWx0aW5nPC9h PiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5n OjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjUuMHB0O21hcmdpbi1ib3R0b206NS4uMHB0Ij4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5PbiBUaHUsIEp1bCAxNiwg MjAyMCwgYXQgMDA6MTIsIE1hcnRpbiBUaG9tc29uICZsdDs8YSBocmVmPSJtYWlsdG86bXRAbG93 ZW50cm9weS5uZXQiIHRhcmdldD0iX2JsYW5rIj5tdEBsb3dlbnRyb3B5Lm5ldDwvYT4mZ3Q7IHdy b3RlOjxicj4NCjxicj4NCiZndDsgWW91ciBkcmFmdCBzZWVtcyB0byBiZSBtYWtpbmcgYSBjYXNl IGZvciBzdXBwb3J0aW5nIGZvcndhcmRlcnMsIGJ1dCBJJ20gbm90IGNsZWFyIG9uIHdoYXQgc3Vw cG9ydGluZyBmb3J3YXJkZXJzIGxvb2tzIGxpa2UuJm5ic3A7IEkgdW5kZXJzdGFuZCB0aGF0IHlv dSBtaWdodCBub3QgaGF2ZSBzcGVjaWZpYyBpZGVhcyBhYm91dCB3aGF0IHRoaXMgc3VwcG9ydCBt aWdodCBsb29rIGxpa2UsIGJ1dCBJIGRvbid0IHNlZSBhbnkgcmVhbCByZXF1aXJlbWVudHMNCiBo ZXJlIGVpdGhlci48YnI+DQomZ3Q7IDxicj4NCiZndDsgSXQgd291bGQgcmVhbGx5IGhlbHAgaWYg dGhlIGRyYWZ0IHdvdWxkIGNsZWFybHkgYXJ0aWN1bGF0ZSB3aGF0IHlvdXIgZGVzaXJlZCBvdXRj b21lIGlzLjxicj4NCjxicj4NClNvcnJ5IGZvciB0aGUgbGFjayBvZiBjbGFyaXR5LiZuYnNwOyBU aGUgcHJpbWFyeSBpbnRlbnQgb2YgdGhlIGRvY3VtZW50IGlzIHRvIHByb3ZpZGUgaW5mb3JtYXRp b24gYXMgd2UgaGF2ZSB0aGUgaW1wcmVzc2lvbiB0aGF0IGF0IGxlYXN0IHNvbWUgY2xpZW50IGRl dmVsb3BlcnMgbWF5IG5vdCBoYXZlIGdvb2QgdmlzaWJpbGl0eSBvZiBjb21tb24gbmV0d29yayBv cGVyYXRvciBhcmNoaXRlY3R1cmVzIGFuZCBwcmFjdGljZXMgb3V0c2lkZSBvZiB0aGUgVVMuJm5i c3A7DQogQnkgcHJvdmlkaW5nIHN1Y2ggY2xhcml0eSB3ZSBob3BlIHRvIHNlZSBpbXBsZW1lbnRh dGlvbnMgdGhhdCBhcmUgc3ltcGF0aGV0aWMgdG8gdGhlIGVudmlyb25tZW50IGludG8gd2hpY2gg dGhleSBhcmUgYmVpbmcgZGVwbG95ZWQgaW4gb3JkZXIgdG8gbWF4aW1pc2UgdGhlIGNoYW5jZXMg b2Ygd29ya2luZyBjb3JyZWN0bHksIGlkZWFsbHkgdmlhIFNQQVUgYXMgbWFudWFsIGNvbmZpZ3Vy YXRpb24gb2YgRE5TIHNldHRpbmdzIGJ5IHRoZSBtYWpvcml0eQ0KIG9mIHVzZXJzIHNlZW1zIHVu bGlrZWx5LiZuYnNwOyA8YnI+DQo8YnI+DQpJbiBhIG51dCBzaGVsbCwgYW55IEFERCBzb2x1dGlv biBzaG91bGQgbWVhc3VyZSBpdHNlbGYgdG8gc2VlIHdoZXRoZXIgaXQgbWVldHMgdGhlIHVzZSBj YXNlIGRlc2NyaWJlZCBpbiB0aGlzIGRvY3VtZW50LCBhdCBsZWFzdCBvbmUgaXMgbmVlZGVkIHRo YXQgZG9lcy4mbmJzcDsNCjxicj4NCjxicj4NCjxicj4NCkFuZHJldyA8YnI+DQo8YnI+DQotLSA8 YnI+DQpBZGQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOkFkZEBpZXRmLm9yZyIg dGFyZ2V0PSJfYmxhbmsiPkFkZEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWRkPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxQUkU+X19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoK Q2UgbWVzc2FnZSBldCBzZXMgcGllY2VzIGpvaW50ZXMgcGV1dmVudCBjb250ZW5pciBkZXMgaW5m b3JtYXRpb25zIGNvbmZpZGVudGllbGxlcyBvdSBwcml2aWxlZ2llZXMgZXQgbmUgZG9pdmVudCBk b25jCnBhcyBldHJlIGRpZmZ1c2VzLCBleHBsb2l0ZXMgb3UgY29waWVzIHNhbnMgYXV0b3Jpc2F0 aW9uLiBTaSB2b3VzIGF2ZXogcmVjdSBjZSBtZXNzYWdlIHBhciBlcnJldXIsIHZldWlsbGV6IGxl IHNpZ25hbGVyCmEgbCdleHBlZGl0ZXVyIGV0IGxlIGRldHJ1aXJlIGFpbnNpIHF1ZSBsZXMgcGll Y2VzIGpvaW50ZXMuIExlcyBtZXNzYWdlcyBlbGVjdHJvbmlxdWVzIGV0YW50IHN1c2NlcHRpYmxl cyBkJ2FsdGVyYXRpb24sCk9yYW5nZSBkZWNsaW5lIHRvdXRlIHJlc3BvbnNhYmlsaXRlIHNpIGNl IG1lc3NhZ2UgYSBldGUgYWx0ZXJlLCBkZWZvcm1lIG91IGZhbHNpZmllLiBNZXJjaS4KClRoaXMg bWVzc2FnZSBhbmQgaXRzIGF0dGFjaG1lbnRzIG1heSBjb250YWluIGNvbmZpZGVudGlhbCBvciBw cml2aWxlZ2VkIGluZm9ybWF0aW9uIHRoYXQgbWF5IGJlIHByb3RlY3RlZCBieSBsYXc7CnRoZXkg c2hvdWxkIG5vdCBiZSBkaXN0cmlidXRlZCwgdXNlZCBvciBjb3BpZWQgd2l0aG91dCBhdXRob3Jp c2F0aW9uLgpJZiB5b3UgaGF2ZSByZWNlaXZlZCB0aGlzIGVtYWlsIGluIGVycm9yLCBwbGVhc2Ug bm90aWZ5IHRoZSBzZW5kZXIgYW5kIGRlbGV0ZSB0aGlzIG1lc3NhZ2UgYW5kIGl0cyBhdHRhY2ht ZW50cy4KQXMgZW1haWxzIG1heSBiZSBhbHRlcmVkLCBPcmFuZ2UgaXMgbm90IGxpYWJsZSBmb3Ig bWVzc2FnZXMgdGhhdCBoYXZlIGJlZW4gbW9kaWZpZWQsIGNoYW5nZWQgb3IgZmFsc2lmaWVkLgpU aGFuayB5b3UuCjwvUFJFPjwvYm9keT4NCjwvaHRtbD4NCg== --_000_787AE7BB302AE849A7480A190F8B9330314FEF08OPEXCAUBMA2corp_-- From nobody Tue Jul 21 02:25:09 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EE303A1716 for ; Tue, 21 Jul 2020 02:25:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.62 X-Spam-Level: X-Spam-Status: No, score=-9.62 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=b8kcwC/o; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=cisco.onmicrosoft.com header.b=HhnO3loA Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ztNT16DbJXC5 for ; Tue, 21 Jul 2020 02:25:05 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C11183A089C for ; Tue, 21 Jul 2020 02:25:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=28474; q=dns/txt; s=iport; t=1595323504; x=1596533104; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=jWQB5+yL+bBONroGxc5av/U8shOEMQ21Zjb0Xhfxr7A=; b=b8kcwC/oJgc6KWu1AjdgS2GH/2Hb7FNCYG8+WZi1y3PBBPoFRuriCNgf 9w8nKfnEiTcROhcuorna8ychfDXJ/jlqM7eb5PIiRM+U5iNJ2pEHM0jc8 Awi8JT0E782AzHWzp7tH7Nu9+hmAOdNzxf8G6zgD9i7Ghj8abST644TlD 4=; X-Files: smime.p7s : 3980 IronPort-PHdr: =?us-ascii?q?9a23=3As+fzLRWT8c7N+PXyO4/ZZ6Qkd63V8LGuZFwc94?= =?us-ascii?q?YnhrRSc6+q45XlOgnF6O5wiEPSBNyFufVeguzZvubrXmlTqZqCsXVXdptKWl?= =?us-ascii?q?dFjMgNhAUvDYaDDlGzN//laSE2XaEgHF9o9n22Kw5ZTcD5YVCBpWe76zEfXB?= =?us-ascii?q?74MFk9KuH8AIWHicOx2qi78IHSZAMdgj27bPtyIRy6oB+XuNMRhN5pK706zV?= =?us-ascii?q?3CpX4bdg=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DkBQDTsxZf/40NJK1gHAEBAQEBAQc?= =?us-ascii?q?BARIBAQQEAQGCCoEjLyMGKAdvKy0vLAqEKYNGA41MmF6BQoERA1UEBwEBAQk?= =?us-ascii?q?DAQEYAQoKAgQBAYFWgnYCghoCJDgTAgMBAQsBAQUBAQECAQYEbYVcAQuFcQE?= =?us-ascii?q?BAQMBAQEQEQQGEwEBLAsBBAsCAQgRBAEBKAMCAgIlCxQJCAIEDgUIBg0HgwW?= =?us-ascii?q?Bfk0DDhEPAQ6hNwKBOYhhdn8zgwEBAQWFHhiCBwcDBoE4gVOBF4NVhRWBAR0?= =?us-ascii?q?agUE/gRFDgh8uPoJcAQECAYEnARIBEhErCYJgM4ItjyMiASqCZpIZkFwKgl2?= =?us-ascii?q?EM4JYgUuGNop4gnqJPoM/jS6CI5IBiieUWAIEAgQFAg4BAQWBaiNncHAVO4J?= =?us-ascii?q?pUBcCDY4eN24BCYJChRSFQnQ3AgYBBwEBAwl8jHWBMwGBEAEB?= X-IronPort-AV: E=Sophos;i="5.75,378,1589241600"; d="p7s'?scan'208,217";a="791098205" Received: from alln-core-8.cisco.com ([173.36.13.141]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 21 Jul 2020 09:25:01 +0000 Received: from XCH-RCD-005.cisco.com (xch-rcd-005.cisco.com [173.37.102.15]) by alln-core-8.cisco.com (8.15.2/8.15.2) with ESMTPS id 06L9P1ej018901 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 21 Jul 2020 09:25:01 GMT Received: from xhs-rcd-003.cisco.com (173.37.227.248) by XCH-RCD-005.cisco.com (173.37.102.15) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 21 Jul 2020 04:25:01 -0500 Received: from xhs-rtp-002.cisco.com (64.101.210.229) by xhs-rcd-003.cisco.com (173.37.227.248) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 21 Jul 2020 04:25:00 -0500 Received: from NAM02-SN1-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Tue, 21 Jul 2020 05:25:00 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=NjH0Eg/n2kblOBwL5fcnOEpGTt8KncucBX659p4J5yQzEMduEBXCjY9JylHIkKB5rDuHDpA+Q/3xoPGH4ScesJs7tgpBr1D1n2jNKw4eG6KNgRSZABN6Yd4aTuSTw3qx7cU6zdpRTabehLX9ZGOSkHI6AKRHMF+3lCrpWeUtpdRIxJPzTyjo298Yr7hXplDnC0WMmaEDsjdH3O+JGaJU7eUbeugtbZHzBwnV7C/dltgN1V5qLQnvC8JNBkcUAI0Rebmu/uDCxG31pjS3wdKB6uRlG9lx9AlcdNlB1vGexrhe42ec7OI6k9+EMqUE14ne8O3ofr5XebbIG+2f9sRZxw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=M84YZM+Y8AAkpG2dgoRcaCLhwCk2uvA5754nl7mMPns=; b=PVZIKybkwYH4wl9WbwJ270Qt6WxO+8RfhujHs9bgm3xrSb9lDHZgMpCmpD1E7k9JUjOvDn7UQtPMV3uuQwWT14bd7bXPo+kojCdhAkfZz7rCBc4TpcuvYLNo1Hf733QCsu09s5LTl/ZrhLpsFd5EWoUxLupPKj+bJQzgQPbNuj12U4Mk3njxGm88Mt3GtxLfV2Ch8iZKSDIMB8QrPWnbfD2qwHvk3Zl90Plgu7uTKE+sIicIeGDM23MHNBqJ5tsAfopN/KfuL04guBFfDoAsJkpKfSl2ijWop1n2kqe7dEnOzqvbrwkqdt6j1kv133PAFQiLu4XSrc5BaLT3IXskjA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=M84YZM+Y8AAkpG2dgoRcaCLhwCk2uvA5754nl7mMPns=; b=HhnO3loAiLk7nh3m9opt1RWEfz0JkZ1O27GmJjpL1KygHmRspbYBUguY8oYZScvM9Dwb69g+cUkNjcD1DOcALipVNp2Nm3mx8+furonbn6zwPKYgBD53doi+ZYhTMWNIOiVNM213a6VkpAZ4XhACARzFXrIt/kXCVLl6uDeThCQ= Received: from MN2PR11MB4760.namprd11.prod.outlook.com (2603:10b6:208:266::22) by BL0PR11MB3044.namprd11.prod.outlook.com (2603:10b6:208:7a::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.17; Tue, 21 Jul 2020 09:24:57 +0000 Received: from MN2PR11MB4760.namprd11.prod.outlook.com ([fe80::cb0:4953:d19f:b3de]) by MN2PR11MB4760.namprd11.prod.outlook.com ([fe80::cb0:4953:d19f:b3de%2]) with mapi id 15.20.3195.025; Tue, 21 Jul 2020 09:24:57 +0000 From: "Vinny Parla (vparla)" To: "mohamed.boucadair@orange.com" CC: "add@ietf.org" Thread-Topic: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AQHWXuRG2acz4cQYUkeZGxUb750oyKkRPpRwgACChoCAAAKH4A== Date: Tue, 21 Jul 2020 09:24:57 +0000 Message-ID: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <18625_1595322916_5F16B224_18625_283_1_787AE7BB302AE849A7480A190F8B9330314FEF08@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> In-Reply-To: <18625_1595322916_5F16B224_18625_283_1_787AE7BB302AE849A7480A190F8B9330314FEF08@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: orange.com; dkim=none (message not signed) header.d=none;orange.com; dmarc=none action=none header.from=cisco.com; x-originating-ip: [98.217.108.128] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: bafb3515-5baa-487f-6510-08d82d57ef6d x-ms-traffictypediagnostic: BL0PR11MB3044: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: rxXRCQ66hKUz6v3UxYjS5g8Dv8sSePZDT7YoIwkgepizvYBnQMwHRJHzkWZ7Ev967F5//bHblYXV65v35GQGSMV5qGfaMoLJ/lwKY1wri3KrqKzkqQ+Afh7vx2nHQUqB/MwTGzI/OaiLkz1u4V5ytSW7ZgjdoLDGo/HnVsCnPDAhkI/3eOwooGU3w2oZRU/edp/dc8TH70B6iM+eEk8HuOw2/UqGjFJkcm3WBYX0jWnUT9o0e/XNX6CNbLOIYRFuaMWev7ZN+Su9sjlqehai+HwJ9nk2+5rNf3fO4SBy9BWuUzeYtYv4amcWz/dcKEhabsdv3bvTRr7Jqrvi8L190cyGCqZIXUl2TaXHCv95FRMAEr+EPU7ig4YPF/PXE9a4z45Sd+WBJh7bOkF4ba/4EQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MN2PR11MB4760.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(396003)(376002)(136003)(39860400002)(366004)(86362001)(4326008)(966005)(478600001)(33656002)(2906002)(5660300002)(6916009)(8936002)(7696005)(8676002)(71200400001)(186003)(52536014)(76116006)(26005)(6506007)(53546011)(316002)(66446008)(66946007)(64756008)(66476007)(66616009)(99936003)(83380400001)(166002)(55016002)(9686003)(66556008); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: TJs2KHumo8VaeUioDu5/qrwWbog4WYpFfpTC9LfQrhDt7fcMdUL5ZVItZC49EH/WLTfC3yo0XEQoIWqkTpiuU5nJPo/fZKxvXR0Sd/TYfWdzjhmIK2n6NPzV+dwVYQgHIXGQ4M1Gv5aXH/gBC3AdGNBt5Moc2SAzpnVWy80tkzwR9uAnbm4jmtaWlzTzIwnlFDIR9Pf9EtcLfi3xjHaBge5+8cLox0Ve1kLhCPcLEwC48amJB5QCBPLb4AfY6W9PESSYcBVhiFJQsSm61pl9R4/VGtLqUn9e721CkZBqsYiUZPaTsY3FK8TmixJvL2eB0NJBpE16/Wqo+iflQRTxb8NQnUTBTSW3yFqCe6KXQ2BfJOQIpkLtcCz5xLi03qZVeuzLfRDbq2T+zv+e2SZGBadMlxIsnUfkyjpibh00UrYfgT4MwaC46EYsh3efZfF04lXP4lqZoCxTMLCA5pQ6iFaXcoUuOq5Lhqc6cvxViI9y0Omcw0NbkanXjykv/aZ5 x-ms-exchange-transport-forked: True Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_0293_01D65F1F.452FBE30" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MN2PR11MB4760.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: bafb3515-5baa-487f-6510-08d82d57ef6d X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2020 09:24:57.4009 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: /jZPDyOeRTGcjTFKMjMn40FuYYUI1b18bK7DGseH+MD6xuHnsWifbPeg6G04+Vo3sxGzbupe6xNHPr3FqQ8sxQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR11MB3044 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.15, xch-rcd-005.cisco.com X-Outbound-Node: alln-core-8.cisco.com Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 09:25:07 -0000 ------=_NextPart_000_0293_01D65F1F.452FBE30 Content-Type: multipart/alternative; boundary="----=_NextPart_001_0294_01D65F1F.452FBE30" ------=_NextPart_001_0294_01D65F1F.452FBE30 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable I know it well. Have provided out of band feedback on the proposals as = you may be aware. =20 From: mohamed.boucadair@orange.com =20 Sent: Tuesday, July 21, 2020 5:15 AM To: Vinny Parla (vparla) Cc: add@ietf.org Subject: RE: [Add] Practical Observations from Encrypted DNS Deployments = by Network Operators =20 Hi Vinny,=20 =20 Please check https://tools.ietf.org/html/draft-btw-add-home-07#section-7 = where we discuss how to put this in place.=20 =20 Cheers, Med =20 De : Add [mailto:add-bounces@ietf.org] De la part de Vinny Parla = (vparla) Envoy=C3=A9 : mardi 21 juillet 2020 03:30 =C3=80 : Andrew Campling >; Eric Rescorla > Cc : add@ietf.org ; Martin Thomson = > Objet : Re: [Add] Practical Observations from Encrypted DNS Deployments = by Network Operators =20 I don=E2=80=99t see how an endpoint could distinguish between a = malicious on-path device or service vs the CPE depicted in this flow: Client <------- TLS --------> CPE <------- TLS --------> ISP = Resolver =20 This is equivalent to =20 Client <------- TLS --------> MitM Proxy <------- TLS --------> Any = Website =20 Which is seems like a non-starter. =20 -Vinny =20 From: Add > On = Behalf Of Andrew Campling Sent: Monday, July 20, 2020 6:22 PM To: Eric Rescorla > Cc: add@ietf.org ; Martin Thomson = > Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments = by Network Operators =20 Ekr To clarify, there are two issues to overcome here, (i) use of RFC1918 = private addresses by the CPE (to facilitate SPAU) and (ii) support for = DNS forwarders to maintain the full functionality provided by network = operators that is described in the document. The desired end state is = as you describe: =20 Client <------- TLS --------> CPE <------- TLS --------> ISP = Resolver =20 Whilst it would be ideal to deal with both of the above issues = simultaneously, pragmatically it may be necessary to deal with them = sequentially given the potential for delays in upgrading CPE software. = Since there are already some proposed discovery methods that deal with = the private addresses, it could make sense for to implement a two-step = solution that first solves the private address issue in the short-term = whilst the CPE software upgrade is deployed. This would at least = maintain support for the user=E2=80=99s chosen resolver via encrypted = DNS using SPAU whilst a CPE software upgrade is QA=E2=80=99d by the = network operator and then deployed. =20 =20 Of course others may think it better to go with a single-step approach = that upgrades the CPE software to maintain support for DNS forwarders = and deals with the private address issue for SPAU at the same time. = However, since the timeframe for this will be necessarily longer for = many users, my assumption is that the preference for most would be to = enlarge the potential pool of encrypted DNS users as quickly as = possible. =20 =20 Does this help? =20 =20 Andrew =20 =20 From: Eric Rescorla >=20 Sent: 20 July 2020 16:03 To: Andrew Campling > Cc: Martin Thomson >; = add@ietf.org =20 Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments = by Network Operators =20 Hi Andrew, Ignoring the discovery question for a moment, I guess I'm not entirely clear on what your desired outcome in terms of network topology is. As described in your draft, at present the clients send DNS packets to the forwarder on the CPE, which then selectively forwards queries to the main ISP resolver. However, in a world where the DNS is encrypted, then this would require that the encryption be terminated at the CPE and then re-originated to the ISP resolver, like so: Client <------- TLS --------> CPE <------- TLS --------> ISP Resolver Is that your desired outcome? If so, it seems to come into conflict with your points in S 5.2 about the difficulty of upgrading the CPE. If not, maybe I just don't understand. In either case, perhaps you can elaborate. -Ekr =20 On Mon, Jul 20, 2020 at 7:47 AM Andrew Campling = = > wrote: On Thu, Jul 16, 2020, at 00:12, Martin Thomson > wrote: > Your draft seems to be making a case for supporting forwarders, but = I'm not clear on what supporting forwarders looks like. I understand = that you might not have specific ideas about what this support might = look like, but I don't see any real requirements here either. >=20 > It would really help if the draft would clearly articulate what your = desired outcome is. Sorry for the lack of clarity. The primary intent of the document is to = provide information as we have the impression that at least some client = developers may not have good visibility of common network operator = architectures and practices outside of the US. By providing such = clarity we hope to see implementations that are sympathetic to the = environment into which they are being deployed in order to maximise the = chances of working correctly, ideally via SPAU as manual configuration = of DNS settings by the majority of users seems unlikely. =20 In a nut shell, any ADD solution should measure itself to see whether it = meets the use case described in this document, at least one is needed = that does. =20 Andrew=20 --=20 Add mailing list Add@ietf.org =20 https://www.ietf.org/mailman/listinfo/add _________________________________________________________________________= ________________________________________________ =20 Ce message et ses pieces jointes peuvent contenir des informations = confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez = recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages = electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme = ou falsifie. Merci. =20 This message and its attachments may contain confidential or privileged = information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and = delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have = been modified, changed or falsified. Thank you. ------=_NextPart_001_0294_01D65F1F.452FBE30 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

I know it = well.=C2=A0 Have provided out of band feedback on the proposals as you = may be aware.

 

From: mohamed.boucadair@orange.com = <mohamed.boucadair@orange.com>
Sent: Tuesday, July 21, = 2020 5:15 AM
To: Vinny Parla (vparla) = <vparla@cisco.com>
Cc: add@ietf.org
Subject: = RE: [Add] Practical Observations from Encrypted DNS Deployments by = Network Operators

 

Hi Vinny, =

 

Please check http= s://tools.ietf.org/html/draft-btw-add-home-07#section-7 where we = discuss how to put this in place.

 

Cheers,

Med

 

De : Add [mailto:add-bounces@ietf.org] = De la part de Vinny Parla (vparla)
Envoy=C3=A9 : = mardi 21 juillet 2020 03:30
=C3=80 : Andrew Campling = <andrew.campling@419.consul= ting>; Eric Rescorla <ekr@rtfm.com>
Cc : add@ietf.org; Martin Thomson <mt@lowentropy.net>
Objet&n= bsp;: Re: [Add] Practical Observations from Encrypted DNS = Deployments by Network Operators

 

I don=E2=80=99t see how an endpoint could distinguish = between a malicious on-path device or service vs the CPE depicted in = this flow:

Client =  <------- TLS -------->  CPE  <------- TLS = -------->  ISP Resolver

 

This is equivalent = to

 

Client  <------- TLS -------->  MitM Proxy =  <------- TLS -------->  Any = Website

 

Which is seems like a non-starter.

 

-Vinny

 

From: Add <add-bounces@ietf.org> On = Behalf Of Andrew Campling
Sent: Monday, July 20, 2020 6:22 = PM
To: Eric Rescorla <ekr@rtfm.com>
Cc: add@ietf.org; Martin Thomson <mt@lowentropy.net>
Subject= : Re: [Add] Practical Observations from Encrypted DNS Deployments by = Network Operators

 

Ekr

To = clarify, there are two issues to overcome here, (i) use of RFC1918 = private addresses by the CPE (to facilitate SPAU) and (ii) support for = DNS forwarders to maintain the full functionality provided by network = operators that is described in the document.  The desired end state = is as you describe:

 

Client  <------- TLS = -------->  CPE  <------- TLS -------->  ISP = Resolver

 

Whilst = it would be ideal to deal with both of the above issues simultaneously, = pragmatically it may be necessary to deal with them sequentially given = the potential for delays in upgrading CPE software.  Since there = are already some proposed discovery methods that deal with the private = addresses, it could make sense for to implement a two-step solution that = first solves the private address issue in the short-term whilst the CPE = software upgrade is deployed.  This would at least maintain support = for the user=E2=80=99s chosen resolver via encrypted DNS using SPAU = whilst a CPE software upgrade is QA=E2=80=99d by the network operator = and then deployed. 

 

Of = course others may think it better to go with a single-step approach that = upgrades the CPE software to maintain support for DNS forwarders and = deals with the private address issue for SPAU at the same time.  = However, since the timeframe for this will be necessarily longer for = many users, my assumption is that the preference for most would be to = enlarge the potential pool of encrypted DNS users as quickly as = possible. 

 

Does = this help?

 

 

Andrew

 

 

From: Eric Rescorla <ekr@rtfm.com>
Sent: 20 = July 2020 16:03
To: Andrew Campling <andrew.campling@419.consul= ting>
Cc: Martin Thomson <mt@lowentropy.net>; add@ietf.org
Subject: Re: = [Add] Practical Observations from Encrypted DNS Deployments by Network = Operators

 

Hi = Andrew,

Ignoring the discovery question for a moment, I guess I'm = not entirely
clear on what your desired outcome in terms of network = topology is.

As described in your draft, at present the clients = send DNS packets to
the forwarder on the CPE, which then selectively = forwards queries to
the main ISP resolver. However, in a world where = the DNS is encrypted,
then this would require that the encryption be = terminated at the
CPE and then re-originated to the ISP resolver, = like so:


Client <------- TLS -------->  CPE =  <------- TLS --------> ISP Resolver

Is that your = desired outcome? If so, it seems to come into conflict
with your = points in S 5.2 about the difficulty of upgrading the CPE.
If not, = maybe I just don't understand. In either case, perhaps you
can = elaborate.

-Ekr

 

On Mon, Jul 20, 2020 at 7:47 AM = Andrew Campling <andrew.campling@419.consul= ting> wrote:

On = Thu, Jul 16, 2020, at 00:12, Martin Thomson <mt@lowentropy.net> wrote:

> Your = draft seems to be making a case for supporting forwarders, but I'm not = clear on what supporting forwarders looks like.  I understand that = you might not have specific ideas about what this support might look = like, but I don't see any real requirements here either.
> =
> It would really help if the draft would clearly articulate what = your desired outcome is.

Sorry for the lack of clarity.  The = primary intent of the document is to provide information as we have the = impression that at least some client developers may not have good = visibility of common network operator architectures and practices = outside of the US.  By providing such clarity we hope to see = implementations that are sympathetic to the environment into which they = are being deployed in order to maximise the chances of working = correctly, ideally via SPAU as manual configuration of DNS settings by = the majority of users seems unlikely. 

In a nut shell, any = ADD solution should measure itself to see whether it meets the use case = described in this document, at least one is needed that does.  =


Andrew

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

_______________________________________________________________=
__________________________________________________________
 
Ce message et ses pieces jointes peuvent contenir des =
informations confidentielles ou privilegiees et ne doivent =
donc
pas etre diffuses, =
exploites ou copies sans autorisation. Si vous avez recu ce message par =
erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. =
Les messages electroniques etant susceptibles =
d'alteration,
Orange decline =
toute responsabilite si ce message a ete altere, deforme ou falsifie. =
Merci.
 
This =
message and its attachments may contain confidential or privileged =
information that may be protected by =
law;
they should not be =
distributed, used or copied without =
authorisation.
If you have =
received this email in error, please notify the sender and delete this =
message and its attachments.
As emails may be altered, Orange is not liable for messages =
that have been modified, changed or =
falsified.
Thank =
you.
------=_NextPart_001_0294_01D65F1F.452FBE30-- ------=_NextPart_000_0293_01D65F1F.452FBE30 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMXjCCA0Mw ggIroAMCAQICEF/4eygrVNyNQqMVtWjJrf8wDQYJKoZIhvcNAQEFBQAwNTEWMBQGA1UEChMNQ2lz Y28gU3lzdGVtczEbMBkGA1UEAxMSQ2lzY28gUm9vdCBDQSAyMDQ4MB4XDTA0MDUxNDIwMTcxMloX DTI5MDUxNDIwMjU0MlowNTEWMBQGA1UEChMNQ2lzY28gU3lzdGVtczEbMBkGA1UEAxMSQ2lzY28g Um9vdCBDQSAyMDQ4MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAsJq5q6evCnen4nG2 tGZilHiIR8ZiVYRAMr/Aqy6lHHHWvG57qKq6btIViEhFnaL8g9DMuYzgJmhwSnjfIRee9GEFyRXI zxbaNWGJlEOohKgxmHibuU5vLFMSbM0drSskuzHEK/+DRG+2PSR3Ceq/Kqgfalb2IA8RVJeBdacl zllqgmXvt+rn4o11i27y3U+mXmKczxAKZNBObc4rzFv1YKUnR41p9H/OG3DecBsg1m7NpgGoPBLS qT+ga167jiCLepHjtWjuoOfEAXSoUwsrSpoPZRIOgk2OY/3v65sa21OmE2Cvwn3Xx2wXJdRz+0dk UIGAlEzhv65LHN+S7S4F3wIBA6NRME8wCwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYD VR0OBBYEFCfzyBUebpoCCRatK6CJYF/aey+qMBAGCSsGAQQBgjcVAQQDAgEAMA0GCSqGSIb3DQEB BQUAA4IBAQCdnYSEo0GpfHcMt1PKTkRQYu9UfNN1Fxzo4MZIS7b+TDoZgVawVu4ZlmKqWqNkwfZO VDPGd/7FHLrlXSXK9fCTmoMRLubL+HRF/ucFuKvn38tL4TeE2rmLl3Ae8OKL17DYDp2xadYqkXup SU9+5o6V2IMnPNVoSQ7UnfYu66e+6zCkrB9E/JWrMwb7fWAK3rSKY7CcqfKkuVMBh9BopCd/q//p +slAOIhntDnGhG9XyVPbuo7uwEOy+AmDbv9mzz7vF7NYGCUJNF7jy9YUtuzykm905C+BKtWSkeDg lzwyaAWFS9H3V+JSHZMaVJ8FcMBKcWAeQwtgHv6jzoEZ4Qs1MIIEbjCCA1agAwIBAgIKYRCAbQAA AAAADjANBgkqhkiG9w0BAQUFADA1MRYwFAYDVQQKEw1DaXNjbyBTeXN0ZW1zMRswGQYDVQQDExJD aXNjbyBSb290IENBIDIwNDgwHhcNMTQwNDA0MjAyNDE4WhcNMjkwNTE0MjAyNTQyWjAsMQ4wDAYD VQQKEwVDaXNjbzEaMBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0EwggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDK334WTFMV+yNWzca5ZQoEleXeTEVnjAzHBuCrH21fNyp75+2jrYB/Ecjz guvun1DZyb89oS+7PBEHNe+4pdlRTtmw91OglIAsLJJlrRBvoYZrX0AKmaVQRBqQTc/mTPtGBo1I 4wfX4a1j19XoJwAVv24HskO7ZQYvffZZXZsSxSx9vetEsFLhwvwe7Z1Z9x2Tp6sxpkJCOSfTgWLG VCwmjNs9FNCojhXqKKQb/r2sPJ5N1tVMr4zL/0ufBWwPcYEyJGHtGau+6nG0aIy7yPTkiz93U6J+ FZ5zC+NXdF6D0uiTxsw0kQwCl53XB5N1VLRfgywCF6iwkGV32VLk7iJ3AgMBAAGjggGHMIIBgzAQ BgkrBgEEAYI3FQEEAwIBADAdBgNVHQ4EFgQUn5U2tI5d1UvDCsGnKZNDUQb9iVEwGQYJKwYBBAGC NxQCBAweCgBTAHUAYgBDAEEwCwYDVR0PBAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHwYDVR0j BBgwFoAUJ/PIFR5umgIJFq0roIlgX9p7L6owQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL3d3dy5j aXNjby5jb20vc2VjdXJpdHkvcGtpL2NybC9jcmNhMjA0OC5jcmwwUAYIKwYBBQUHAQEERDBCMEAG CCsGAQUFBzAChjRodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY2VydHMvY3JjYTIw NDguY2VyMFwGA1UdIARVMFMwUQYKKwYBBAEJFQEVADBDMEEGCCsGAQUFBwIBFjVodHRwOi8vd3d3 LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvcG9saWNpZXMvaW5kZXguaHRtbDANBgkqhkiG9w0BAQUF AAOCAQEAPk6+IxpGAo1ea9uKAjQLY5vlATwmXYxwsiTrYF7sioRkLhtZFaNnGuEW4/3gTX1EmiMo 0u2296If50TN7W3qhiFUKKxsYbz7yGVQBECKKov8n24YnvXFPqWiqRwArnGmF7tJMktKWBOTTDbp 9y8N6IDrOF1UecqFUqSk4lZ30w0HIU6cJDIM4r6lw3EtTog31PAvVmhGR0VrXVCIJfc6KaTxiEGt U35XMYYq1uBnh9hTq4GjdXe+2yHIOke0aSfV7t/39NZxjbp60XMvfd3NpniUKGXDiXdeQuroB8IQ MXl2OkF2IJGPCkFQghsJKbIRIG8D6wviPyLW+j+4Rqu2sDCCBKEwggOJoAMCAQICCgGGGmG8CetC JFAwDQYJKoZIhvcNAQELBQAwLDEOMAwGA1UEChMFQ2lzY28xGjAYBgNVBAMTEUNpc2NvIEVtcGxv eWVlIENBMB4XDTIwMDYwOTE4MTEzOFoXDTIyMDYwOTE4MjEzOFowgZYxHTAbBgNVBAMTFFZpbm55 IFBhcmxhICh2cGFybGEpMRQwEgYDVQQLEwtDaXNjbyBVc2VyczESMBAGA1UECxMJRW1wbG95ZWVz MRMwEQYKCZImiZPyLGQBGRMDY29tMRUwEwYKCZImiZPyLGQBGRMFY2lzY28xHzAdBgkqhkiG9w0B CQEMEHZwYXJsYUBjaXNjby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg5zG6 WUz2eLCtkokcmka2wwjH6DXR8dfR2VqJ3szmqqmiZLHtOZQ7/3+/ztkZk0iM3yQQc2l9KsQ2jzHU rkOZpqMpYCv43rxL2uAM0gQfpIxWGoHN5L3kW7gVpXuPmgGgF6TpMI9vytRh1gl4SHJD8f9QTvTU JynVycwV0KCQfjrJ77AGHX+7+Jwt7vkY64UtJmM7gCoJj7CU7eO+PAJc2qAJMaljtK4XI6InXFPB 7meUpm8k1TBtUuOpe25WYdUcbeipNtqjTFDtYNtXSXwHn1JRWr14CMWI2iTUu69D6M5p8KxXMStS F197vWn7QrFJ1PaK366O/LgsHumVQxAHAgMBAAGjggFYMIIBVDAOBgNVHQ8BAf8EBAMCBPAwDAYD VR0TAQH/BAIwADB6BggrBgEFBQcBAQRuMGwwPAYIKwYBBQUHMAKGMGh0dHA6Ly93d3cuY2lzY28u Y29tL3NlY3VyaXR5L3BraS9jZXJ0cy9jZWNhLmNlcjAsBggrBgEFBQcwAYYgaHR0cDovL3BraWN2 cy5jaXNjby5jb20vcGtpL29jc3AwHwYDVR0jBBgwFoAUn5U2tI5d1UvDCsGnKZNDUQb9iVEwOgYD VR0fBDMwMTAvoC2gK4YpaHR0cDovL2Npc2NvY2VydHMuY2lzY28uY29tL2ZpbGUvY2VjYS5jcmww GwYDVR0RBBQwEoEQdnBhcmxhQGNpc2NvLmNvbTAdBgNVHQ4EFgQU77mvrtX1ZwgDCBrBz254abit a7kwHwYDVR0lBBgwFgYKKwYBBAGCNwoDDAYIKwYBBQUHAwQwDQYJKoZIhvcNAQELBQADggEBAJ0C qW6utEOTvSb85ZBZel2OgSpFDDjaLWIEceNr23m4NkhjweswzFPJY4nnKgD40Ryv5WVW4KdpmbZx NBZl4Ypd5XlwleoU9jHuSwp6kaYCEJ7YfOIKVBcF1rYclNL0J0nJ2/fnaxGoYylNfW99vu4UaqEl BWU66VkGfsg5hWPRg90fuge1zZhlwI2AE6xq7pV8C2302ag94ti465IhjnHswtA4Q+r39Tc+me1o b2s1g8WKyds2DPI0PAjWnNpsEvYYOXU8MeMv9p6jPbFG9uaCpt8kCGcYytt8FD285Rmq77FRMEBe ptFCTJh5yr5hIaMVoqBUydvZmQAYKnRX8zMxggLwMIIC7AIBATA6MCwxDjAMBgNVBAoTBUNpc2Nv MRowGAYDVQQDExFDaXNjbyBFbXBsb3llZSBDQQIKAYYaYbwJ60IkUDAJBgUrDgMCGgUAoIIBizAY BgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA3MjEwOTI0NTZaMCMG CSqGSIb3DQEJBDEWBBTl7uKlQxvP3RCDoVVLPkXzQtZQHzBJBgkrBgEEAYI3EAQxPDA6MCwxDjAM BgNVBAoTBUNpc2NvMRowGAYDVQQDExFDaXNjbyBFbXBsb3llZSBDQQIKAYYaYbwJ60IkUDBLBgsq hkiG9w0BCRACCzE8oDowLDEOMAwGA1UEChMFQ2lzY28xGjAYBgNVBAMTEUNpc2NvIEVtcGxveWVl IENBAgoBhhphvAnrQiRQMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFl AwQBFjAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMC AgFAMAcGBSsOAwIaMAsGCWCGSAFlAwQCAzALBglghkgBZQMEAgIwCwYJYIZIAWUDBAIBMA0GCSqG SIb3DQEBAQUABIIBAG4C9VV9zxAslfKSOwarnzxG/XNpy8zyqk2QUR9XBxMDLkdu5zcIXCEhjY+U 1jb75CELZ1OenHJgRQrTJNfR8upQdoXpEKZjBExQCwbijTUb/xdALqHomnAwQNOcMJxS3cl6MRUx orgHZ4eWFP+Dd53E18xZGOanR1ASMDjXIjQBGINnJnukd0aGu/UQGNUXbXUUtfFKzFFnTuYZDBNv rJ1jzGeGtmJbt/ksc04g+CBDopk1I4B5yZ0lopTYRjFTHuCo3KtYFQE33wxLQ8Xq8k4xyG4cPIDI m7MjlTBnIZ37lFwdfMmxYgqsr3Yv4YdH4dh4lXOpklK/MZ5q3gpfACAAAAAAAAA= ------=_NextPart_000_0293_01D65F1F.452FBE30-- From nobody Tue Jul 21 02:27:15 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 49E933A1716 for ; Tue, 21 Jul 2020 02:27:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.12 X-Spam-Level: X-Spam-Status: No, score=-2.12 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=m0K/P7w2; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=s1sL3Dcn Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EepgwpSpZFWZ for ; Tue, 21 Jul 2020 02:27:13 -0700 (PDT) Received: from wout3-smtp.messagingengine.com (wout3-smtp.messagingengine.com [64.147.123.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 14E6F3A08B0 for ; Tue, 21 Jul 2020 02:27:13 -0700 (PDT) Received: from compute2.internal (compute2.nyi.internal [10.202.2.42]) by mailout.west.internal (Postfix) with ESMTP id 3490C1609 for ; Tue, 21 Jul 2020 05:27:12 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute2.internal (MEProxy); Tue, 21 Jul 2020 05:27:12 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm2; bh=+949AK+A++BoYfEVvs9nFQaAkrQrdvh BcFmk7/keLC4=; b=m0K/P7w2JWbyk1KESqmxnLkMo11NdCxSN7yOJwJELWReuX2 B7XS1f5g2h/PMBVEOLnMp3rfM+Th7FemSbHmykBzdBKkhPuKc7a3JFCV3sT8tBhb +tTwim3v5Rr7r1rX1hZ/RS2Ik6oBrnX4XiwRQm1ChNV06EOLd3M4MTqjwv5rntyU /ZhlNAwnhdCTHSAHGVGtrVV7whl6z0Lf8T0D4rjPZ7BmMY6eRZDaIbQIVu9LtXce uEFltzDqHWw0ESgeaLYBRQPqtY9cE5KmsJuE+MWW1FrjKgvGNApp8oN0LJAMMMD1 Ahh7dw4/vmng0vDURn8w5f7sEzzowwENoaFOQRQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=+949AK +A++BoYfEVvs9nFQaAkrQrdvhBcFmk7/keLC4=; b=s1sL3DcnF9dLcV1YBdkraH nHJnMlf8UZ6v6txpiht0mQCIuZgZ51Owhxv0/6oNksv6hMCglLvNjkfr6T989uLx bAvnPzq6UFlUsxYGWQHagal9O0QMBaGgvzKqsZ5d6FV5igvhdkpLW9/q9RjPfxpJ taBygW4JIjtLPzmfxobjg1mFeaOq2gTED/1ZUVqVgwscw/srp/Z6kVmsm1OC51rw fmmXj9tKHrAoF2NLCusMbbRtsoWxxr1uRkTxOLfizU385ijdqbQlSudyQ9s+jLDG 0E0UxYRiJdZypMQVauOArLC8UWPvdoV+xHZyTHzcChB+/u1td0yBAGMY857rGvoA == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduiedrgeeigdduudcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecuggftrfgrthhtvghrnhephfeitddtveeihfejjefgve efuedugffgkeevkeehueeggeelveekveektdfhueeinecuffhomhgrihhnpehivghtfhdr ohhrghenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpe hmtheslhhofigvnhhtrhhophihrdhnvght X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 87417E00ED; Tue, 21 Jul 2020 05:27:11 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.3.0-92-g11c785d-fm-20200721.004-g11c785d5 Mime-Version: 1.0 Message-Id: In-Reply-To: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> Date: Tue, 21 Jul 2020 19:26:52 +1000 From: "Martin Thomson" To: add@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 09:27:14 -0000 On Tue, Jul 21, 2020, at 10:40, Deen, Glenn wrote: > https://datatracker.ietf.org/doc/html/draft-deen-add-threats-00 Hi Glenn, This is an interesting take on the problem. How do you anticipate identifying networks, or is that left as an exercise for the reader? One of the things we have struggled with in general is network identification. And even that falls short of what Green would seem to demand, which is network authentication. I know that there are some EAP methods that integrate network authentication and therefore might allow for making this call, but I don't know how portable those approaches are. From nobody Tue Jul 21 02:43:04 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C36FB3A175A for ; Tue, 21 Jul 2020 02:43:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H_l2eDT8k_G9 for ; Tue, 21 Jul 2020 02:43:00 -0700 (PDT) Received: from mail-io1-xd29.google.com (mail-io1-xd29.google.com [IPv6:2607:f8b0:4864:20::d29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0DB233A1625 for ; Tue, 21 Jul 2020 02:43:00 -0700 (PDT) Received: by mail-io1-xd29.google.com with SMTP id y2so20689077ioy.3 for ; Tue, 21 Jul 2020 02:43:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gXKGulDmG/c+E2wi2M42nCop7RKIaXaYZOqEGhkVaHQ=; b=gfAmBToRzt8mwg7cJq3OiZK+RZUszfTolsXwmFODsEYItMrJjagfYvdaZkhS2opEHC T/Eehr8TCaNARYye4OL8tZCIFPjA2MBfv97jj1Qgqt6RuJ7f9oDtTucG6EfAemW0xGvm DbKoxgN15mRZ/+lWXEtfpVr+kJ8vB/zuSuIOI05nn2ilwAkPU5tTnw25cwZSw3xUlc0W 9ZQGiE6v8zh4u6KGhJHcI0HlDo7mEP3eql4tHpWXvG4tKnpc9hr+6KtjgKZpEFuhMd+b SwGeVIR1/HnqlHbqPzauQxLnKXQQjmilpnyMIG6lZjBb6tPVPvN0S6O84baNbI2LZc/Q x24w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gXKGulDmG/c+E2wi2M42nCop7RKIaXaYZOqEGhkVaHQ=; b=sQki5PaQ/zvjymaCoNSLcBLqc/Bf3lEaMh2Gaug+lyRGZEMJpziHZG7FRUESbZnAkk ZvoInBI4OA+0sA6iU0b1S488Zd1VoWzHSAZCe2jISWkzLZzJkP98+aWwcM1X+I9UoFwb OcWYPp0AkxycizU5pWeDh4+b8LZv8R2n/dJRWkgY7k+2fqp561pQhT5psMzv76tgbo2a hnzayL2vnl4OlBKKSfCiJqr2Fh9SEqXGGHpuH6H1jryXQVyF1SPW9rznuBYoYvGx2vdG FuYZdZTI3zIDLlOuVFaiVSSQ0bqndj4da2qMkW8W4W4YT/w7nMEn/W5BP4OzLnbHPua+ s8Ig== X-Gm-Message-State: AOAM532vSEYP46zRug2Zo6X6rsvOtXLhdm7JpgUD5uhQNXa2DDddoR8E 41gi0bN/TgfG1zbm40yJNR2jEqGDzCfR08K50v4= X-Google-Smtp-Source: ABdhPJzKHPOqBKOkreQ2nSjOuKz4nBzP3dEbJeZEZqaoJoptIoyPOAlaZ3MMRXiAjxo4vZLJW0Ui08WBO5S0pqzcPJI= X-Received: by 2002:a6b:b457:: with SMTP id d84mr27127779iof.21.1595324579243; Tue, 21 Jul 2020 02:42:59 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: From: tirumal reddy Date: Tue, 21 Jul 2020 15:12:47 +0530 Message-ID: To: Eric Rescorla Cc: Andrew Campling , "add@ietf.org" , Martin Thomson Content-Type: multipart/alternative; boundary="000000000000d8ee9305aaf07202" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 09:43:02 -0000 --000000000000d8ee9305aaf07202 Content-Type: text/plain; charset="UTF-8" On Tue, 21 Jul 2020 at 06:13, Eric Rescorla wrote: > > Thanks for the clarification. > > On Mon, Jul 20, 2020 at 3:22 PM Andrew Campling > wrote: > > To clarify, there are two issues to overcome here, (i) use of RFC1918 > > private addresses by the CPE (to facilitate SPAU) and (ii) support for > > DNS forwarders to maintain the full functionality provided by network > > operators that is described in the document. The desired end state is > > as you describe: > > > > > > > > Client <------- TLS --------> CPE <------- TLS --------> ISP Resolver > > > > > > > > Whilst it would be ideal to deal with both of the above issues > > simultaneously, pragmatically it may be necessary to deal with them > > sequentially given the potential for delays in upgrading CPE software. > > Since there are already some proposed discovery methods that deal with > > the private addresses, it could make sense for to implement a two-step > > solution that first solves the private address issue in the short-term > > whilst the CPE software upgrade is deployed. > > So the idea here would be to have a mechanism which enabled Do[TH] but > bypassed the CPE, correct? So, it would be something that one deployed > at the ISP's recursive and that we just expected the CPE to pass on? > It seems like the primary requirement there would be for something which > had a very high chance of passing through existing CPE. > > > With that said, I have some concerns about the objective of having the > CPE in the user's resolution path. While I certainly can understand > the reasons you consider it advantageous, it seems to me that it > significantly weakens the user's security posture. Even assuming > arguendo that we have a secure mechanism for discovering this case, > in practice the CPE seems to have quite a high rate of security > issues, including specifically DNS hijacking (see for instance [0]). > Home routers are hardened (for example, see https://www.mind.be/openwrtsummit18/2018-10-30-OpenWRT18-prplWRT.html) to host network security services to protect the network from internal and external attacks. > One of the advantages of Do[TH] from client to recursive is that > it has the potential to mitigate attacks from attackers on the network > -- including the local router -- and this seems like it would regress > that. > > -Ekr > > [0] > https://labs.bitdefender.com/2020/03/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/ > > > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000d8ee9305aaf07202 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, 21 Jul 2020 at 06:13, Eric Rescor= la <ekr@rtfm.com> wrote:

Thanks= for the clarification.

On Mon, Jul 20, 2020 at 3:22 PM Andre= w Campling <andrew.campling@419.consulting> wrote:
> To clarify= , there are two issues to overcome here, (i) use of RFC1918
> private= addresses by the CPE (to facilitate SPAU) and (ii) support for
> DNS= forwarders to maintain the full functionality provided by network
> = operators that is described in the document.=C2=A0 The desired end state is=
> as you describe:
>
> =C2=A0
>
> Client &= lt;------- TLS --------> CPE <------- TLS --------> ISP Resolver>
> =C2=A0
>
> Whilst it would be ideal to deal wi= th both of the above issues
> simultaneously, pragmatically it may be= necessary to deal with them
> sequentially given the potential for d= elays in upgrading CPE software.
> Since there are already some propo= sed discovery methods that deal with
> the private addresses, it coul= d make sense for to implement a two-step
> solution that first solves= the private address issue in the short-term
> whilst the CPE softwar= e upgrade is deployed.

So the idea here would be to have a mechanism= which enabled Do[TH] but
bypassed the CPE, correct? So, it would be som= ething that one deployed
at the ISP's recursive and that we just exp= ected the CPE to pass on?
It seems like the primary requirement there wo= uld be for something which
had a very high chance of passing through exi= sting CPE.


With that said, I have some concerns about the object= ive of having the
CPE in the user's resolution path. While I certain= ly can understand
the reasons you consider it advantageous, it seems to = me that it
significantly weakens the user's security posture. Even a= ssuming
arguendo that we have a secure mechanism for discovering this ca= se,
in practice the CPE seems to have quite a high rate of security
i= ssues, including specifically DNS hijacking (see for instance [0]).

Home routers are hardened (f= or example, see https://www.mind.be/openwrtsummit18/2018-10-30-OpenW= RT18-prplWRT.html) to host network security services to protect the net= work from internal and external attacks.=C2=A0
=C2=A0
One of the advantages of Do[TH] from client to recursive is thatit has the potential to mitigate attacks from attackers on the network
= -- including the local router -- and this seems like it would regress
th= at.

-Ekr

[0] https://labs.bitdefender.com/2020/03/new-router-dns-hijacking= -attacks-abuse-bitbucket-to-host-infostealer/

<= div>


--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000d8ee9305aaf07202-- From nobody Tue Jul 21 02:52:46 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 007443A1775 for ; Tue, 21 Jul 2020 02:52:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mVmNevrxYmuy for ; Tue, 21 Jul 2020 02:52:43 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2F1F3A176B for ; Tue, 21 Jul 2020 02:52:42 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id E9989280140; Tue, 21 Jul 2020 11:52:40 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id E373D2802B2; Tue, 21 Jul 2020 11:52:40 +0200 (CEST) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id DB6F2280140; Tue, 21 Jul 2020 11:52:40 +0200 (CEST) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id D057964C6C03; Tue, 21 Jul 2020 11:52:40 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id 730F040935; Tue, 21 Jul 2020 11:52:40 +0200 (CEST) Date: Tue, 21 Jul 2020 11:52:40 +0200 From: Stephane Bortzmeyer To: "Deen, Glenn" Cc: ADD Mailing list Message-ID: <20200721095240.GA10868@nic.fr> References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.052435, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 09:52:45 -0000 On Tue, Jul 21, 2020 at 12:40:27AM +0000, Deen, Glenn wrote a message of 102 lines which said: > I wanted to bring to your attention a short, very short, draft that > I wrote up based on an email thread on the WG list. It captures a > basic framework of Green-Yellow-Red threat and trust relationships > the user may have with their network. The hope is that this can be > a basis for focusing discussion of threats and what mitigations > maybe needed in different situations. > > https://datatracker.ietf.org/doc/html/draft-deen-add-threats-00 I see no use for this document. It seems to consider only the potential risks by outsiders, and not the risks by the operators, which are as important. For instance, assessing that the "User's ISP network" is safe or not is not just a matter of wether it is properly secured: it is also a matter of what they decide to do (an ISP resolver which censors Sci-Hub is not safe for me, even if it is secured and protected from outside attackers). This draft is not a proper threat model for the Internet. Also, how was decided the list of examples? "User's own home network" is marked as green but it is typically quite unsafe, both because typical users do not have the knowledge, inclination and/or time to secure it, and also because the danger can be inside (see this excellent paper for many examples ) From nobody Tue Jul 21 03:06:06 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5228A3A0948 for ; Tue, 21 Jul 2020 03:06:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XNekie0XNTGw for ; Tue, 21 Jul 2020 03:06:03 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100058.outbound.protection.outlook.com [40.107.10.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C14B3A0937 for ; Tue, 21 Jul 2020 03:06:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=KuCywJ7vOHHuHjGAwq4SBXzQQ4t5hGZmhcHTlQPSrmLBpyjvJDnBS/ZeV0/o5RcIhIBxp0bJOYY22diIkWn6CAJXTGKR0YttNt7zEhrcVzo7Z+z0dcTDmUT/ClUrjGWeOK5fW6Ls/5MWI+VxD7zOkRa27/NupmHaVQdz1LK2IOSgYRCwBAFvtMgpGNmstXtx6fCWAOmPwukBiabJPy2dHmtufkOOyK8YnMXt4R+OYGp3Z6UqsmE6TS4D1yhf0hHUmtSIdb4eEoT65No1frztBg1cmQ2O5iMFbtCb0I+0neq04SmvJqDcO2hky28MFpv8rDcyl5G4qXEK7MD7yUpWog== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+0s5Omq4tpAvqYxb78qFSI/KUhseBXMgqiPzn8bncT0=; b=Hc5Gj7Sjw/FY9EdTFAwJl0iz1rIbtfGaRczVzAvqYQdJ/K7jOSyECjWoBQqhg6+IjKnI19Opf9NseSraEdoq51TtBlNIDz2xwxKGD6wr7dDvNGYBNSONQ/1eJgORAP/Si3iBwCaj3+A/hXXzOhEaguZK2yInsVdyZPT8cxzUOn02ziVigrvFxLslHyz4s7ommJsD3UlvBQNZ0jzoG5sbpHzivpS8XGqNsBfYJLxI3MyVjUqkCkAs9UHQU457K4R9JQdJ8/gp0tFiFnSLh1UNzzCJK+Ao5DMSOmm6Wlw5efGp0XrYMmVmz06mFTPGC6CKx0jUb9claMyCAwWDQpZUmQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+0s5Omq4tpAvqYxb78qFSI/KUhseBXMgqiPzn8bncT0=; b=HOWior35EKhDCPD3E+4zbQl4WivW7sGfsL+psPpeNMzEW1TiYzkqYLWEfgaSaBHn/tI+BOq7PwZiJqVb766fnoPEt9lC1sq4UE0Q6PkVYGIw8vgNf4lrhY7Q53GNwXaDNJcCOfo49ezbo6W1LFu6M5CXOFUqg25XxTAW/uvRPCo= Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:71::15) by LO2P265MB0909.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:94::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.23; Tue, 21 Jul 2020 10:06:00 +0000 Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6]) by LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6%6]) with mapi id 15.20.3195.026; Tue, 21 Jul 2020 10:06:00 +0000 From: Andrew Campling To: Stephane Bortzmeyer , Eric Rescorla CC: "add@ietf.org" , Martin Thomson Thread-Topic: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AQHWXzIVX7+rvX+O50+PZhSNc5e+WqkRzOVA Date: Tue, 21 Jul 2020 10:06:00 +0000 Message-ID: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <20200721073934.GA29757@nic.fr> In-Reply-To: <20200721073934.GA29757@nic.fr> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: nic.fr; dkim=none (message not signed) header.d=none;nic.fr; dmarc=none action=none header.from=419.consulting; x-originating-ip: [81.141.77.119] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 8cbffd6d-a146-471f-a6c2-08d82d5daba8 x-ms-traffictypediagnostic: LO2P265MB0909: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: O8+BE8RSE9IQxktEBKrAJSvTyykQ3Cz52N6m4aoJk6WDXRErZ2k8lw5z0ODnehNY6mlMqHZClpNum4rRRokCdBxqMjWt7R9DoYYNZv9xW4r8VlFhHpFrC82aY+leGranx/ivUm8dI53vEnEbpPvx7dkDdb9r8hdnnridIMBEuwFUx5U5O73QKxU/AU4b6GCHcN13r7Yk8ctQG3qqSAWEJzCY8nRe5tNnOrtU+d0vVeSj/peMNvO73QHbyVSV0F/ib9bTbE+1WpHw5mjWbSAxzy3IuQBEvW6Xg8z5ucHSE+P4hlTqyQ8N8lFey7rEIvSMNFZAtA2l1Ku5e/8v0J70fFPI0zbxKXA0AFD6EA6In89P6dKC4Im5shw7nzxzBmAp x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFTY:; SFS:(366004)(396003)(376002)(39830400003)(346002)(136003)(53546011)(4744005)(83380400001)(86362001)(71200400001)(33656002)(6506007)(44832011)(66574015)(186003)(4326008)(508600001)(55016002)(316002)(8676002)(26005)(5660300002)(52536014)(9686003)(2906002)(76116006)(7696005)(66476007)(110136005)(66446008)(66556008)(64756008)(8936002)(66946007)(54906003)(46492007); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: RMQOzrTSav0ZiaLlkllVvVa96OezoUb3Sy3C8u8zCAIl5w3uduc0KDnN+eQ7GxYLUWtpJLbmyTpztRAaj8/C/o2GmBPYV6ftKCCGl7yEXnCvtGqyXb1XXCXpSSGeuhiZfJp7b49VkkcJMReuf6xQrAbomVCE4Q/KMkJSEy0JzNF6jqY9PKmj2vSBME27C2H7zwxA9G1DNPfXFMUxLcJfvab54gKol04VqCdHj8YEYM24wkXPI81l8CiX6GYBxzqUpQqwxqNbji8CY1+/J+rnO7eyzstnmyaHxQ5zaKa+/ZKd53nVWKW9dxzJJw58SM102iibLAR4Ly00lxrXQDMtl8353QvwTuBoH7m8deuflUoy71DPxf92jupkp4J2o9oP29Nc6hGfdXhtvkte+kbzf3ZX2egUqbzyCEqHNnnZxU0vWS5Sz2+H1ZkDiyADVvKvlmG3L3aGozv5hpRzDfVg3y90GOGT3Ulna3rdnubhDTQ= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 8cbffd6d-a146-471f-a6c2-08d82d5daba8 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2020 10:06:00.7260 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: aPTOScVXowXvsnxwz1DfSfcVKmTwi/Bj3hvD4k2C2HIB8PCPNw1y+hPOm74NPFJkjl4IiTjQ1jXNWoR/pgWr+7OKYYEUusWzL4uMjnaFgkM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0909 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 10:06:05 -0000 On Tuesday, Jul 21, 2020 at 08:40, Stephane Bortzmeyer = wrote: > Even without hijacking by a third-party (cracker with hoodie), the local = router is=20 > often controlled by the access provider which may be the party you precis= ely=20 > want to work around.=20 In which case you already have other options including changing the router,= configuring an alternate DNS provider and/or changing your access provider= . =20 > If you want to use DoE to avoid the provider's lying resolver, using thei= r router is=20 > not a smart move. Ignoring the pejorative language, I feel that this is straying into policy = areas and is therefore out of scope for the ADD charter and list. Perhaps = a discussion for another place such as the EDDI list? =20 Andrew=20 From nobody Tue Jul 21 03:09:40 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0295E3A09E8 for ; Tue, 21 Jul 2020 03:09:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jf1zN5Jm3l_6 for ; Tue, 21 Jul 2020 03:09:38 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110060.outbound.protection.outlook.com [40.107.11.60]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B300E3A09E5 for ; Tue, 21 Jul 2020 03:09:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=eQWQ835NqthPSMJlcm6Uw7Zf8J5Mzr73QqdPWdZf9BhO9fe4NdZ2msci3DuI9TSLJwikjmiEhqbo094Dp2McP6HBSQJFZNeX2CLrj7J00We5v0qhkZOpxpVjH9b10JN7FE+Nilf8ScQlCAX8J+htiJE70tHvvq5XgNgrG5aqHkQSqNJzWDlMSfWJ91FMHKPaA6sccNv8wZLtZwT5Q1JU7twXTbRu7rQ74uSKO6if1iyOrr8Ew72ZCDqFUlCbaDJMqR38TzyzTXeDjIo+Ytt3zyy9UEbLwv7eP7wT7SwkT2sE9kcK+0V1E2g2kh3xaN0yd57h7USEtAIDDgt8V3d4rg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mvS99yE7gkfuNIfnaJXF0Qy8houJfFAAHI2RpZDxk6g=; b=Ea+svzEOrzUZZ4DCWSoqjg17krZll+fuY9Trp5gbNrdYu2sS1vdVrJJ7jWnhOgBmFon63eqwQZIYaTAWzvb/WoSEHNFFT2ZZng4z4cXAceBQHLXy2SlbDN7sJ8GeTjHLlZZHXfFVZzAa2xusWZLtPtxR2YjtAf6XrwGWv5/9wcrwTr8mcgsg8TBK2T6SjGJbkZrQ4vydnvltnUlItWamLOKnboR9N0GRLAIjA5XLZMQuOpiBVTGctK4RHHSoAb54F7dA9+UiqsZn4a682szMtVnXRxZHG7UVCtghhzuALc2ydafd0FIPyj2QF6dkBnhOLJFQcVVm+6WR67maPHJpTg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mvS99yE7gkfuNIfnaJXF0Qy8houJfFAAHI2RpZDxk6g=; b=apcxOL38cXzW2ClREAupHpT1IL/hvurrAsG+AryOmh5+XIOntHhZVcxd2SN21Vdsn9arTc2O0CPQ1pSCoW234hLkqEbD+0PwWM5b3pUv0pGNCSVlIdkdcYaYm68kuvg8HgEF5S1UI9BfN1JgSLkWneNI7j/XIC6EMf2nyWB0RWg= Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:71::15) by LO2P265MB0574.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:6a::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.23; Tue, 21 Jul 2020 10:09:35 +0000 Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6]) by LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6%6]) with mapi id 15.20.3195.026; Tue, 21 Jul 2020 10:09:35 +0000 From: Andrew Campling To: Stephane Bortzmeyer , Stephen Farrell CC: Paul Vixie , "add@ietf.org" , Eric Rescorla , Martin Thomson Thread-Topic: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AQHWXzKBLPAY0pTF1EqUfIS2OKmg5akRztZw Date: Tue, 21 Jul 2020 10:09:34 +0000 Message-ID: References: <2515140.uIgGUBp3BU@linux-9daj> <73db546a-0c47-fe18-0b9e-ec120e56bddd@cs.tcd.ie> <20200721074235.GB29757@nic.fr> In-Reply-To: <20200721074235.GB29757@nic.fr> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: nic.fr; dkim=none (message not signed) header.d=none;nic.fr; dmarc=none action=none header.from=419.consulting; x-originating-ip: [81.141.77.119] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b2124067-5cd0-4c5a-76ac-08d82d5e2b61 x-ms-traffictypediagnostic: LO2P265MB0574: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: YFzV9rMlrhM0cL5xMhITnILOw/QMIjS1A0G1XzA2fRtaw6OEClX8uYfJtR66B6+l2TeqZMcSfuCp4N23I33iLLF8GVsuxotCfUUDUBscjpFAxLQxNuSBBZt5gQYpWAibhDUeQm3VyiUx3RIm3enGCTWXpVMVpcclgUgD91MjZjEBFuUQ5ZJcB7/tIhlxIsXz/YmJgZdzgPXQppNaU4UTW2vmIxtSl8dd0Z5FN9G+V6ljuap7JdwaasHBSCFVkx1OqR760ZbLGvyV/Uy3n9WdPmQKE2DcNNRfcdNagqHNxkoUXV9gQ5OP9GSfW82vPlo0JjsQhjxeRR59QRRd+cnHh8sPY5d5m4iJ7omfctTrY5RmS2pu7fUUF+6Jb1awzBJ0 x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFTY:; SFS:(136003)(39830400003)(346002)(396003)(366004)(376002)(9686003)(33656002)(2906002)(66574015)(44832011)(7696005)(26005)(5660300002)(55016002)(4744005)(83380400001)(71200400001)(508600001)(8676002)(316002)(8936002)(86362001)(66476007)(66446008)(64756008)(66556008)(76116006)(66946007)(186003)(54906003)(52536014)(53546011)(6506007)(4326008)(110136005)(46492007); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: yw6xQjol2csRKtI1L80f71a1+HQO1tSZWrs61hKL7uuKuQL8si67dP0DdQNxnojKM0/fZQwHGTd5FAP1GXSrdcCih4MH8cNGq+T4F0Yw2em+SlepkiP0O40uLPwUPSvWnzZBMUNQU+QGKFS/NtSAJu7v3rROIiyZQwlvdNGnAWjn9guk+GDJRQ5cy2c5Ivh3oUj/BbC7Tw17eLAKzEv/CA/kCZh7UIL+8+Z7dB3RL1nM/pFDB4yvkQUu+5teXB/3x1aJ15V8Ha0Ht1RHiOQ+qPQhu8GALgH3LeOj5OWHmzHWkTjC+jbahroOTUtVoMzIptuPJxFs8ovuUTV+uNqE2XEv0AqVd2Zg8hyYi0sKV/5QpiAb3U8vMsm7oSMRJhuHa9IEpYU1fD8biL6xRPFIPOGBwxH7wI90nDmawi3x3pxDAQLWSJwfJiS3qBoflR19cmEuhjhEAil5AfUs4nv43i0ciThwkUWt4uIXISKQPXw= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: b2124067-5cd0-4c5a-76ac-08d82d5e2b61 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2020 10:09:35.0019 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 4wVBHE8hXfVkb6/7AteY86N6J9GL3tSPy1ruMFTYD39/nt7PTZXWUb7jc7UhZc0LDzDtJCPCcWdYli3VsMMdDvXWQaWtnjhP+Ch3n+1J7lE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0574 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 10:09:39 -0000 On Tuesday, Jul 21, 2020 at 08:43, Stephane Bortzmeyer = wrote: > Also, I strongly object to this "my network, my policy" principle. I=20 > want Internet access providers to be neutral tubes, not to force their=20 > policies onto me. I feel that this is again straying into policy areas and is therefore out o= f scope for the ADD charter and list. =20 Andrew=20 From nobody Tue Jul 21 03:32:30 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A01C3A0A13 for ; Tue, 21 Jul 2020 03:32:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U1t-jBhpwSik for ; Tue, 21 Jul 2020 03:32:26 -0700 (PDT) Received: from mail-io1-xd2d.google.com (mail-io1-xd2d.google.com [IPv6:2607:f8b0:4864:20::d2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 487833A0A0C for ; Tue, 21 Jul 2020 03:32:26 -0700 (PDT) Received: by mail-io1-xd2d.google.com with SMTP id k23so20792093iom.10 for ; Tue, 21 Jul 2020 03:32:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=XmHu63jvjehRM+oYLGl8Z3JJhxIMAQOWAG3WfNTnsAU=; b=hmF8fwy3vw0zJkw98C86vKrdZcbPDiR1grhHvmLD4zHHxqlhDFfgNcpglqzOo7nyRX mdLvCUl+Q508bBn1rooj84iB3ub5zGAZPAjI2WJa6D37wBOlEEOaZuNGUE1U9I0ypYZv vTS+YF60PkKvDbQS/nbBgQc8SIoJlPA1zyQlk+9X8k+YqriZ8VI+XGk/fsWGPO+symY2 qkvCNNcZ/7BAcQ08Taxu0WUWLCoImJxQLXdYUGVumu0vXD1lk23LH54/YSkkXSe20DEb DmDv6PT14qWi5VyN5Pyp/W/BWDjfFm6D3Hbnq7vlUph19aA+5J90Qsxh8+sCuznRJujQ L7sg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=XmHu63jvjehRM+oYLGl8Z3JJhxIMAQOWAG3WfNTnsAU=; b=o/awpOxZs+2aOMB7fC3BkeU9VTqasMB3K3FRZlCaznchCE4kUq0eckM2D781tX+PaI dlZo4LIv3kGx3I6XhV3C4BmoNo2IAe06Z0NN6Oll8BMu+jhFQU/4898SLeB1k1Rtx3KS WYvWdujwwv64Kct6BiM02JR3yL1LnQwonHRA5yfyZ9iKoElcm8hvd0cBr6rDAW8SQeD0 IcOhXNIulePvf7q3rP/UTDqvlsM/zS4PM+I/FbG1/WdnuBCrVi6p3u8xduURmmAsmKfI J7KqGVT6h9cIcNfOLGQFDNnRbPTYY8u3AW4N0p+ATNWW+IyHqmUjqsW2iKQFyy264bnR pI7w== X-Gm-Message-State: AOAM531MlxRocX41z39TrrTKpAgOWPZJFmmB+Qe5kRbHJcblSeyMBcSV LMWexCiFtzCIdNRbxhVJi57dlsNMCvT0BSFEmko= X-Google-Smtp-Source: ABdhPJwfOLForPStN0V1UQt5d894I2Dk9qCpK4Z8wMQRferLwcAZJzU7eR4WWXstfHSqezPBisCFCWtsDkmGH1lQlr4= X-Received: by 2002:a6b:b5cd:: with SMTP id e196mr26790515iof.46.1595327545401; Tue, 21 Jul 2020 03:32:25 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: From: tirumal reddy Date: Tue, 21 Jul 2020 16:02:13 +0530 Message-ID: To: Tommy Jensen Cc: Andrew Campling , Eric Rescorla , "add@ietf.org" , Martin Thomson Content-Type: multipart/alternative; boundary="000000000000a4e57f05aaf12383" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 10:32:29 -0000 --000000000000a4e57f05aaf12383 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Tommy, Please see inline On Tue, 21 Jul 2020 at 05:50, Tommy Jensen wrote: > Hey Andrew, > > Thank you for bringing this to the WG. I think it's important to talk > through the ISP perspective. Given the two documents are intertwined, I'l= l > address your proposal directly despite the subject being your information= al > document. > > andrew> However, since the timeframe for this will be necessarily longer > for many users, my assumption is that the preference for most would be to > enlarge the potential pool of encrypted DNS users as quickly as possible. > > Part of my feedback on this document was that this assumption does not > hold true for me. I would rather avoid building protocols or systems we'l= l > regret later than maximize the number of encrypted DNS users ASAP. I'm > about to write out the verbose version of why I don't feel that way. Plea= se > feel free to correct anything I've misunderstood or overlooked. > > In the spirit of ekr's calls for a threat model, let's walk through an > attacker scenario. Let's say I discover 192.168.1.100 as a DNS server fro= m > my CPE from my home Wi-Fi network. I did this via DHCP, which is an > insecure protocol. This proposal has a third party vouch for the > authenticity, in this case, the separately maintained mapping by DNS clie= nt > vendors. > It is possible to host a DoT/DoH forwarder on the home router, the forwarder can use a certificate that can be validated by PKI and the CPE can continue to use private IP addresses. Please see https://tools.ietf.org/html/draft-btw-add-home-07#section-7.1 for more details. > > I do not see this ISP list the same as the current Windows list of public > DoH servers, and I am not willing to accept the risk posed by maintaining > this new mapping. Where the existing SPAU list we rely on contains only > publicly documented and PKI verifiable names, the proposed mechanism does > not. This means I'm not just confirming what someone else has already > validated; I'm now responsible for the maintenance of the original > ownership verification for an ever-increasing number of ISPs which will > include enterprises running their own internal networks also eager to avo= id > infrastructure updates on their end. I will not do that, especially for a > stop-gap feature whose value will fade away as a proper bootstrapping > mechanism is deployed. > > The proposal I'm coauthoring ( > https://tools..ietf.org/html/draft-pauly-add-resolver-discovery-01#sectio= n-5 > ) > won't work for RFC1918 addresses because they can't be verified using PKI= . > I'm ok with this, as DNS use of HTTPS should not be less secure than any > other use of HTTPS. > > Since DHCP discovery of 192.168.1.100 is insecure to start with and PKI > can't be used to secure RFC1918 addresses, our choices are to invent a ne= w > trust mechanism (such as your proposal) or settle for opportunistic > security. For example, a DNS client receiving an RFC1918 address can simp= ly > try it with DoT without concern for hostname.. Literally just add TLS SPA= U > style. In a threat model, what this provides is protection against multip= le > eavesdroppers, reducing the eavesdropper count between the client and the > CPE to a maximum of one (whoever convinces the client to use their spoofe= d > DHCP message). It does not guarantee the identity of who you are sending > queries to. However, this is no worse than before, as you have the same > lack of authentication with classic DNS to a DHCP-discovered address but > have now prevented eavesdropping by a third party. > > If this is viewed as a regression because an attacker can then prevent th= e > CPE from inspecting classic DNS traffic coming through it for ISP provide= d > filtering purposes, then we're back to inventing a new trust mechanism. > From my perspective, this is a non-starter. That leaves us with two > alternatives I can think of: make DHCP (or its replacement) secure, or > allow use of classic DNS on the client to CPE link. The former has > previously been determined to be a hard problem. The latter is our curren= t > situation. > > This is my in-depth way of asking: is rushing to get encrypted DNS to as > many people as possible worth either settling for opportunistic protectio= n > or inventing a whole new trust mechanism (which will be permanent whether > we wish it to be temporary or not, Paul Vixie recently shared some wisdom > along this line)? My answer here in order are "maybe" and "no" but I'd li= ke > to hear what others think. > > I hear you that deploying public DNS servers is costly and not within you= r > interests. I also hear you that updating CPEs is time consuming. I simply > don't see a way to avoid those things and continue to enable DNS to a CPE > while providing the same level of security as DoH to a public resolver > without either securing DHCP (which is hard and brings us back to updatin= g > CPEs) or inventing a new trust mechanism for private addresses (which add= s > a heavy burden to DNS clients for stop-gap work). > The home network itself is susceptible to both internal and external attacks. https://tools.ietf.org/html/draft-btw-add-home-07#section-9 discus= ses various attacks possible and the mechanisms endpoint can use to avoid using the attacker's DoH/DoT server. Cheers, -Tiru > > I welcome any comments or corrections. I'd be happy to be wrong. > > Thanks, > Tommy Jensen > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > How can you secure your DNS queries? https://aka.ms/dohblogpost > ------------------------------ > *From:* Add on behalf of Andrew Campling > > *Sent:* Monday, July 20, 2020 3:22 PM > *To:* Eric Rescorla > *Cc:* add@ietf.org ; Martin Thomson > *Subject:* [EXTERNAL] Re: [Add] Practical Observations from Encrypted DNS > Deployments by Network Operators > > > *Ekr* > > To clarify, there are two issues to overcome here, (i) use of RFC1918 > private addresses by the CPE (to facilitate SPAU) and (ii) support for DN= S > forwarders to maintain the full functionality provided by network operato= rs > that is described in the document. The desired end state is as you > describe: > > > > Client <------- TLS --------> CPE <------- TLS --------> ISP Resolver > > > > Whilst it would be ideal to deal with both of the above issues > simultaneously, pragmatically it may be necessary to deal with them > sequentially given the potential for delays in upgrading CPE software. > Since there are already some proposed discovery methods that deal with th= e > private addresses, it could make sense for to implement a two-step soluti= on > that first solves the private address issue in the short-term whilst the > CPE software upgrade is deployed. This would at least maintain support f= or > the user=E2=80=99s chosen resolver via encrypted DNS using SPAU whilst a = CPE > software upgrade is QA=E2=80=99d by the network operator and then deploye= d. > > > > Of course others may think it better to go with a single-step approach > that upgrades the CPE software to maintain support for DNS forwarders and > deals with the private address issue for SPAU at the same time. However, > since the timeframe for this will be necessarily longer for many users, m= y > assumption is that the preference for most would be to enlarge the > potential pool of encrypted DNS users as quickly as possible. > > > > Does this help? > > > > > > *Andrew* > > > > > > *From:* Eric Rescorla > *Sent:* 20 July 2020 16:03 > *To:* Andrew Campling > *Cc:* Martin Thomson ; add@ietf.org > *Subject:* Re: [Add] Practical Observations from Encrypted DNS > Deployments by Network Operators > > > > Hi Andrew, > > Ignoring the discovery question for a moment, I guess I'm not entirely > clear on what your desired outcome in terms of network topology is. > > As described in your draft, at present the clients send DNS packets to > the forwarder on the CPE, which then selectively forwards queries to > the main ISP resolver. However, in a world where the DNS is encrypted, > then this would require that the encryption be terminated at the > CPE and then re-originated to the ISP resolver, like so: > > > Client <------- TLS --------> CPE <------- TLS --------> ISP Resolver > > Is that your desired outcome? If so, it seems to come into conflict > with your points in S 5.2 about the difficulty of upgrading the CPE. > If not, maybe I just don't understand. In either case, perhaps you > can elaborate. > > -Ekr > > > > > On Mon, Jul 20, 2020 at 7:47 AM Andrew Campling < > andrew.campling@419.consulting> wrote: > > On Thu, Jul 16, 2020, at 00:12, Martin Thomson wrote: > > > Your draft seems to be making a case for supporting forwarders, but I'm > not clear on what supporting forwarders looks like. I understand that yo= u > might not have specific ideas about what this support might look like, bu= t > I don't see any real requirements here either. > > > > It would really help if the draft would clearly articulate what your > desired outcome is. > > Sorry for the lack of clarity. The primary intent of the document is to > provide information as we have the impression that at least some client > developers may not have good visibility of common network operator > architectures and practices outside of the US. By providing such clarity > we hope to see implementations that are sympathetic to the environment in= to > which they are being deployed in order to maximise the chances of working > correctly, ideally via SPAU as manual configuration of DNS settings by th= e > majority of users seems unlikely. > > In a nut shell, any ADD solution should measure itself to see whether it > meets the use case described in this document, at least one is needed tha= t > does. > > > Andrew > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000a4e57f05aaf12383 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Tommy,

Please see inline<= /div>
O= n Tue, 21 Jul 2020 at 05:50, Tommy Jensen <Jensen.Thomas=3D40microsoft.com@dmarc.ietf.org>= wrote:
Hey Andrew,

Thank you for bringing this to the WG. I think it's important to tal= k through the ISP perspective. Given the two documents are intertwined, I&#= 39;ll address your proposal directly despite the subject being your informational document.

andrew>=C2=A0However, since the timeframe for this will be necessarily longer for many users, my= assumption is that the preference for most would be to enlarge the potenti= al pool of encrypted DNS users as quickly as possible.=C2=A0

Part of my feedback on this document was that this assumption does not hold= true for me. I would rather avoid building protocols or systems we'll = regret later than maximize the number of encrypted DNS users ASAP. I'm = about to write out the verbose version of why I don't feel that way. Please feel free to correct anything I'= ve misunderstood or overlooked.

In the spirit of ekr's calls for a threat model,=C2=A0let's walk= through an attacker scenario. Let's say I discover 192.168.1.100 as a = DNS server from my CPE from my home Wi-Fi network. I did this via DHCP, which is an insecure protocol. This proposal has a th= ird party vouch for the authenticity, in this case, the separately maintain= ed mapping by DNS client vendors.

<= /div>
It is possible to host a DoT/DoH forwarder on the home router, th= e forwarder can use a certificate that can be validated by PKI and the CPE = can continue to use private IP addresses. Please see=C2=A0https://tools.ietf= .org/html/draft-btw-add-home-07#section-7.1=C2=A0for more details.
=C2=A0

I do not see this ISP list the same as the current Windows list of public D= oH servers, and I am not willing to accept the risk posed by maintaining th= is new mapping. Where the existing SPAU list we rely on contains only publi= cly documented and PKI verifiable names, the proposed mechanism does not. This means I'm not just confir= ming what someone else has already validated; I'm now responsible for t= he maintenance of the original ownership verification for an ever-increasin= g number of ISPs which will include enterprises running their own internal networks also eager to avoid infrastructure upd= ates on their end. I will not do that, especially for a stop-gap feature wh= ose value will fade away as a proper bootstrapping mechanism is deployed.

The proposal I'm coauthoring (https://tools..ietf.org/html/draft-pau= ly-add-resolver-discovery-01#section-5) won't work for RFC1918 addr= esses because they can't be verified using PKI. I'm ok with this, as DNS use of HTTPS= should not be less secure than any other use of HTTPS.=C2=A0

Since DHCP discovery of 192.168.1.100 is insecure to start with and PKI can= 't be used to secure RFC1918 addresses, our choices are to invent a new= trust mechanism (such as your proposal) or settle for opportunistic securi= ty. For example, a DNS client receiving an RFC1918 address can simply try it with DoT without concern for hostname= .. Literally just add TLS SPAU style. In a threat model, what this provides= is protection against multiple eavesdroppers, reducing the eavesdropper co= unt between the client and the CPE to a maximum of one (whoever convinces the client to use their spoofed DHC= P message). It does not guarantee the identity of who you are sending queri= es to. However, this is no worse than before, as you have the same lack of = authentication with classic DNS to a DHCP-discovered address but have now prevented eavesdropping by a thi= rd party.

If this is viewed as a regression because an attacker can then prevent the = CPE from inspecting classic DNS traffic coming through it for ISP provided = filtering purposes, then we're back to inventing a new trust mechanism.= From my perspective, this is a non-starter. That leaves us with two alternatives I can think of: make DHCP (or its rep= lacement) secure, or allow use of classic DNS on the client to CPE link. Th= e former has previously been determined to be a hard problem. The latter is= our current situation.

This is my in-depth way of asking: is rushing to get encrypted DNS to as ma= ny people as possible worth either settling for opportunistic protection or= inventing a whole new trust mechanism (which will be permanent whether we = wish it to be temporary or not, Paul Vixie recently shared some wisdom along this line)? My answer here in= order are "maybe" and "no" but I'd like to hear wh= at others think.=C2=A0

I hear you that deploying public DNS servers is costly and not within your = interests. I also hear you that updating CPEs is time consuming. I simply d= on't see a way to avoid those things and continue to enable DNS to a CP= E while providing the same level of security as DoH to a public resolver without either securing DHCP (which i= s hard and brings us back to updating CPEs) or inventing a new trust mechan= ism for private addresses (which adds a heavy burden to DNS clients for sto= p-gap work).=C2=A0

The home net= work itself is susceptible to both internal and external attacks.=C2=A0https:/= /tools.ietf.org/html/draft-btw-add-home-07#section-9=C2=A0discusses var= ious attacks possible and the mechanisms endpoint can use to avoid using th= e attacker's DoH/DoT server.

Cheers,
=
-Tiru
=C2=A0

I welcome any comments or corrections. I'd be happy to be wrong.

Thanks,
Tommy Jensen
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
How can you secure your DNS queries? https://aka.ms/dohblogpost=C2=A0
Fro= m: Add <ad= d-bounces@ietf.org> on behalf of Andrew Campling <andrew.campling= @419.consulting>
Sent: Monday, July 20, 2020 3:22 PM
To: Eric Rescorla <ekr@rtfm.com>
Cc: add@ietf.org <add@ietf.org&g= t;; Martin Thomson <mt@lowentropy.net>
Subject: [EXTERNAL] Re: [Add] Practical Observations from Encrypted = DNS Deployments by Network Operators
=C2=A0

Ekr

To clarify, there are two issues to overc= ome here, (i) use of RFC1918 private addresses by the CPE (to facilitate SP= AU) and (ii) support for DNS forwarders to maintain the full functionality = provided by network operators that is described in the document.=C2=A0 The desired end= state is as you describe:

=C2=A0

Client =C2=A0<------- TLS --------> =C2=A0CPE =C2=A0<------- TL= S --------> =C2=A0ISP Resolver

=C2=A0

Whilst it would be ideal to deal with bot= h of the above issues simultaneously, pragmatically it may be necessary to = deal with them sequentially given the potential for delays in upgrading CPE= software.=C2=A0 Since there are already some proposed discovery methods that deal with the= private addresses, it could make sense for to implement a two-step solutio= n that first solves the private address issue in the short-term whilst the = CPE software upgrade is deployed.=C2=A0 This would at least maintain support for the user=E2=80=99s chosen resolve= r via encrypted DNS using SPAU whilst a CPE software upgrade is QA=E2=80=99= d by the network operator and then deployed.=C2=A0

=C2=A0

Of course others may think it better to g= o with a single-step approach that upgrades the CPE software to maintain su= pport for DNS forwarders and deals with the private address issue for SPAU = at the same time.=C2=A0 However, since the timeframe for this will be necessarily long= er for many users, my assumption is that the preference for most would be t= o enlarge the potential pool of encrypted DNS users as quickly as possible.= =C2=A0

=C2=A0

Does this help?

=C2=A0

=C2=A0

Andrew

=C2=A0

=C2=A0

From: Eric Resco= rla <ekr@rtfm.com&= gt;
Sent: 20 July 2020 16:03
To: Andrew Campling <andrew.campling@419.consulting>
Cc: Martin Thomson <mt@lowentropy.net>; add@ietf.org
Subject: Re: [Add] Practical Observations from Encrypted DNS Deploym= ents by Network Operators

=C2=A0

Hi Andrew,

Ignoring the discovery question for a moment, I guess I'm not entirely<= br> clear on what your desired outcome in terms of network topology is.

As described in your draft, at present the clients send DNS packets to
the forwarder on the CPE, which then selectively forwards queries to
the main ISP resolver. However, in a world where the DNS is encrypted,
then this would require that the encryption be terminated at the
CPE and then re-originated to the ISP resolver, like so:


Client <------- TLS --------> =C2=A0CPE =C2=A0<------- TLS -------= -> ISP Resolver

Is that your desired outcome? If so, it seems to come into conflict
with your points in S 5.2 about the difficulty of upgrading the CPE.
If not, maybe I just don't understand. In either case, perhaps you
can elaborate.

-Ekr


=C2=A0

On Mon, Jul 20, 2020 at 7:47 AM Andrew Campling <andrew.campling@419.consult= ing> wrote:

On Thu, Jul 16, 2020, at 00:12, Martin Thomson <mt@lowentropy.net> wrote:

> Your draft seems to be making a case for supporting forwarders, but I&= #39;m not clear on what supporting forwarders looks like.=C2=A0 I understan= d that you might not have specific ideas about what this support might look= like, but I don't see any real requirements here either.
>
> It would really help if the draft would clearly articulate what your d= esired outcome is.

Sorry for the lack of clarity.=C2=A0 The primary intent of the document is = to provide information as we have the impression that at least some client = developers may not have good visibility of common network operator architec= tures and practices outside of the US.=C2=A0 By providing such clarity we hope to see implementations that are sympathe= tic to the environment into which they are being deployed in order to maxim= ise the chances of working correctly, ideally via SPAU as manual configurat= ion of DNS settings by the majority of users seems unlikely.=C2=A0

In a nut shell, any ADD solution should measure itself to see whether it me= ets the use case described in this document, at least one is needed that do= es.=C2=A0


Andrew

--
Add mailing list
Add@ietf.org
https:/= /www.ietf.org/mailman/listinfo/add

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000a4e57f05aaf12383-- From nobody Tue Jul 21 04:36:13 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B52F3A0AE5 for ; Tue, 21 Jul 2020 04:36:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O8Ok7194mBFE for ; Tue, 21 Jul 2020 04:36:10 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100070.outbound.protection.outlook.com [40.107.10.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C3EC3A0AE4 for ; Tue, 21 Jul 2020 04:36:10 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cAGXwZu2wn6qprAyDvcndLq8ktvtGVt+SW29YTpKDp5sf1CpEsiYP7tSoDWKeRFrN0CwO5XQjPSLd0FBt4QBo/ziJaj05pi25m5FXe3KU//GCxJySExLCTLgy1JfoMZmoHJ5MtPr5Y/h3o5DOsDiHCl/eGFDv5R4NPHGthiglO5by2vz+RMUcRY/Bf97aRRAWH6ToddcCiA9O07+01nHwnvuzJnlkNgXNf25a3OJOVToWDIzPtonww/VoSztOAPZJv9dAYiR1P/ZaOEWewCIS/jLe7hK1aRzNBLpeqrrTdEbstRM4eYwe/RJQ0kCUlPBdidkP8o0BNvLlM4IwvBIfw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9aWWkEusZwf8HhvLjRPivDCChOtomsnGsYjns0nYKaE=; b=bWP/At9r3QEwfEy5BZQeczRyNgC/+WamDLdsL4UjpcMDXIxoAW7ugvGJphg+Hds/iv6T/t3ez4mSHzhTqAXfl5eF9WOfcEWd1Sw6YKf5uegBPVTwjbtwS0LO+/ocpqQCpUj4FEgNs2D/jEA0/dp0EYmCga5s9SWxkJJuJuFrscFeL2GXO2PHYITs6PcbRAQg5F1qaAVjgZZVHmOql34/2mOD15Pe36PQkGjKH/gPf4IFahSNNUwTmbbBSeZ6lLRQMraUGWisdeht8Wfxt3rrzE4ocWC84vnfGbMZ16428cD+Di4AqLgX7at+WYZVNFSjKTnozH6xC64/V1MWVZNpQg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9aWWkEusZwf8HhvLjRPivDCChOtomsnGsYjns0nYKaE=; b=c/DDebp6XVB+cieB6dWAPWxZwR5ufpdRiTTviKHnUn3aEEIJAZt3XNTqmRQDBDTcmlXnggJIuFA3LNAJNzUDSVQ9kJ0oH03szJ5R81NKtLTaVHlZBxa2CPt+n/NHQs2hPfOPln0KZVV910+O3w8q7hI2DvSQperDHDlgTEL+4Ts= Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:71::15) by LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:71::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.23; Tue, 21 Jul 2020 11:36:08 +0000 Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6]) by LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6%6]) with mapi id 15.20.3195.026; Tue, 21 Jul 2020 11:36:08 +0000 From: Andrew Campling To: Tommy Jensen , Eric Rescorla CC: "add@ietf.org" , Martin Thomson Thread-Topic: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AQHWXqbmx2T6tR8Z9kGodk+PQJE0kKkRA1CQgAAotACAALsSoA== Date: Tue, 21 Jul 2020 11:36:08 +0000 Message-ID: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> , In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-21T00:19:56.171Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; authentication-results: microsoft.com; dkim=none (message not signed) header.d=none;microsoft.com; dmarc=none action=none header.from=419.consulting; x-originating-ip: [81.141.77.119] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 24c9b9d1-27ee-4ed8-a6fd-08d82d6a42dc x-ms-traffictypediagnostic: LO2P265MB0573: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: sCtA5Y3Xt8zZUCmbKozXmFVp5SegAZ+fZzql/KWiPzk8wVvbApJctIwyeZWh0y2oXRVQoIYYPxWIxR9RGuz5t40UMm9qP8llyxJsp9QisQxCjRycC0Hs76h2rZtIjNQDxxhzwYTEqa8pkIXIa4s/dO0ubJYcx9Q/ytQX6kEgHVTjRhuBP/cDuSd0eT7Lo414nSQ1bZHslhE6MhSgTiiqGiP/w5IyAuEcuGaIdt+ybiryXuJHsrasuVbCwRSOccrNTK1IekIQvtZD2I9E/5NxunU4GrO/69goh+NFAo5N6Xbtpp0wHFeauDV2MYIQvK0QVoXIBwRo1RsfUJsxdZ5KhGpOLCPG6vqfVnHqDJP3Wv52cvRAD3RXi2XXyLKpAdO1 x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFTY:; SFS:(346002)(39830400003)(396003)(366004)(376002)(136003)(4326008)(86362001)(66946007)(33656002)(55016002)(66556008)(66476007)(186003)(7696005)(44832011)(66446008)(316002)(110136005)(2906002)(54906003)(26005)(64756008)(6506007)(4744005)(5660300002)(8676002)(71200400001)(45080400002)(508600001)(9686003)(76116006)(8936002)(52536014)(46492007); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: Um90xveChzzZoNdzNaKhulAhe7q97Q32KZyw07aTzJksFfoUK2e0TkLzI9CbpYK4xtMkph56LOFSQAm30K407Nv3MHi1jUA2sfJ+/tjzWQc1XvB9BhMbuV1RuKNrHxV5KmRHqZmEm2hVkDEvC7hpMreqVYGyvMqGtspIyRaWHcV5g/FTRi1a2p7q/cSYY+spTm3m4V1kgf1/WEhh+kDUe75K4jXvZU72FmNIDS5GagxlBF/VJ7Aco9t0TTc2VY5cQ4/enphMhK9ZBwdT7ose0ntiirfWanMKCMBrDXY4+q52qpdpChxJxNEo/Enp2zZymVZR6qiouaBvd0qiop9hRnI6QC7cFYI9FIO6Xnjdh6I4n1lVSXfpM2CiAMK650kfAqHWaxG3TQQwqogYTeXuP8CRcVidsTMKwEgVuuio8dl6hu9gFsYklxHJKczQbaVe0qMPFMlADxqNxYM+B2pA+jG62Y94AcTK54DLDDBQU7Nab0ePtKUyuFnXPB/cie7k x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_LO2P265MB057393CF0FB8538CD464B3A6C2780LO2P265MB0573GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 24c9b9d1-27ee-4ed8-a6fd-08d82d6a42dc X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2020 11:36:08.3625 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: k1ZVwAMZXdjXttNXxo2Itojpe09Yy6lZCKdwm01uXqJ6tydiOhfUIuGpGC8n+VOjisLoGm/MZMHuuIZM4MSUCSqYNbOHzfUqjK9yJXCw5NE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0573 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 11:36:12 -0000 --_000_LO2P265MB057393CF0FB8538CD464B3A6C2780LO2P265MB0573GBRP_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable On Tues, Jul 21, 2020 at 01:20 Tommy Jensen w= rote: > Part of my feedback on this document was that this assumption does not ho= ld true for me. I would rather avoid building protocols or systems we'll re= gret later than maximize the number of encrypted DNS users ASAP. I think it would be beneficial to have further discussion whether the IETF'= s policy of encrypting end-to-end communication comes with an implied requi= rement to do so as quickly as possible (another way of looking at maximizin= g the number of encrypted DNS users ASAP), or whether this can be done so i= n a more leisurely manner. I appreciate that having this discussion is cou= nter to the ADD charter so it has to be had elsewhere, perhaps someone coul= d suggest an appropriate IETF venue? Or could this take place within the E= DDI list? Andrew --_000_LO2P265MB057393CF0FB8538CD464B3A6C2780LO2P265MB0573GBRP_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

On Tues, Jul 21, 2020 at 01:20 Tommy Jensen <Jensen.Thomas@microsoft.com> wrote:

 

> Part of my feedback on this document was that this= assumption does not hold true for me. I would rather avoid building protoc= ols or systems we'll regret later than maximize the number of encrypted DNS users ASAP.

 

I think it would be beneficial to have further discussi= on whether the IETF’s policy of encrypting end-to-end communication c= omes with an implied requirement to do so as quickly as possible (another way of looking at maximizing the number of encrypted DNS users ASAP)= , or whether this can b= e done so in a more leisurely manner.  I appreciate that having this discussion is counter to the ADD chart= er so it has to be had elsewhere, perhaps someone could suggest an appropri= ate IETF venue?  Or could this take place within the EDDI list? 

 

 

Andrew

--_000_LO2P265MB057393CF0FB8538CD464B3A6C2780LO2P265MB0573GBRP_-- From nobody Tue Jul 21 04:41:35 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59AD53A0121 for ; Tue, 21 Jul 2020 04:41:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eoUHAeHVOCi8 for ; Tue, 21 Jul 2020 04:41:33 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D9C053A00E4 for ; Tue, 21 Jul 2020 04:41:32 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 51D1B24205EC; Tue, 21 Jul 2020 11:41:30 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.6\)) From: Jim Reid In-Reply-To: Date: Tue, 21 Jul 2020 12:41:29 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> To: Andrew Campling X-Mailer: Apple Mail (2.3445.9.6) Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 11:41:34 -0000 > On 21 Jul 2020, at 12:36, Andrew Campling = wrote: >=20 > I think it would be beneficial to have further discussion whether the = IETF=E2=80=99s policy of encrypting end-to-end communication comes with = an implied requirement to do so as quickly as possible (another way of = looking at maximizing the number of encrypted DNS users ASAP), or = whether this can be done so in a more leisurely manner. I appreciate = that having this discussion is counter to the ADD charter so it has to = be had elsewhere, perhaps someone could suggest an appropriate IETF = venue? =20 The dprive WG would appear to be the right place for discussing = encryption of DNS traffic. If you=E2=80=99re looking at end-to-end = communications in general, that=E2=80=99s probably far too big and = diffuse a topic to sit inside a single, all-encompassing tent. From nobody Tue Jul 21 05:23:36 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 189283A07CC for ; Tue, 21 Jul 2020 05:23:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eW12GTn-7Sjv for ; Tue, 21 Jul 2020 05:23:33 -0700 (PDT) Received: from mx3.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E6443A07CA for ; Tue, 21 Jul 2020 05:23:32 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx3.open-xchange.com (Postfix) with ESMTPS id AC6926A256; Tue, 21 Jul 2020 14:23:30 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1595334210; bh=0uw2kiv9yU+JA5hMGdKXLpURXUPgenQOJKyPU9K50fM=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=9Vr0rWkMOzZ/rs/lCE7SKV9AMQCmBai4KfWjMoigtPgwXjlJzzwdVs3qdMFu3dEW5 FeLeVBtiabtfE0SEKD98eOC+7YZSJok5ndG0zN2j8xJR6VIR13Hk9390JGMVen/4zR ktRF7BmGksxHi+et1t5o3PMseH5vkuhNUzEIVRtSqKyJDjtdZrHMUxayyeoyENbeJR buvxYOzd7uMtWsa2BPnm2wn7P+XkvfgQ4ddrlS0zN6DhVyKVpyRqGsxoGzjEG3f/Fz VBl+FOv0X3g32B56/wAZGr6K1/2bspwc/cZUaVjcwws5eDE+qN7apBG0pmKW4boJn0 cWpT6zwvKi9HA== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 9D3E73C02C7; Tue, 21 Jul 2020 14:23:30 +0200 (CEST) Date: Tue, 21 Jul 2020 14:23:30 +0200 (CEST) From: Vittorio Bertola To: Jim Reid Cc: ADD Mailing list Message-ID: <1672194657.2185.1595334210541@appsuite-gw1.open-xchange.com> In-Reply-To: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev17 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 12:23:35 -0000 > Il 21/07/2020 13:41 Jim Reid ha scritto: >=20 > The dprive WG would appear to be the right place for discussing encryptio= n of DNS traffic. If you=E2=80=99re looking at end-to-end communications in= general, that=E2=80=99s probably far too big and diffuse a topic to sit in= side a single, all-encompassing tent. Well, RFC 7258 is the IETF's policy statement from which Tommy's question d= escends, so where was it discussed and approved at the time? That would loo= k like an appropriate venue. By the way, the policy dimensions hit by that question are multiple and go = way beyond the simple strive for encryption or for technical security. Some= parties will prefer continuing to use the local resolver with encrypted DN= S, even if discovered through a process which is only 99.99% secure, rather= than switching to an open global resolver that can be authenticated with 1= 00% certainty. I think that the IETF should provide the tools so that both = things can happen easily, and then the decision on what to implement is lik= ely to be non-technical and not driven by threat models (e.g. in Europe the= re currently are a lot of concerns and political debates about consolidatio= n, competition and "self-preferencing" by the big platforms against local o= perators, so I wouldn't be surprised if this popped up there). --=20 Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com=20 Office @ Via Treviso 12, 10144 Torino, Italy From nobody Tue Jul 21 05:25:20 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6EC513A07CE for ; Tue, 21 Jul 2020 05:25:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d_X_zD2Knkcj for ; Tue, 21 Jul 2020 05:25:18 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8F2D3A07CA for ; Tue, 21 Jul 2020 05:25:17 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 56E84BE4D; Tue, 21 Jul 2020 13:25:15 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y_lFsKFzJ74w; Tue, 21 Jul 2020 13:25:13 +0100 (IST) Received: from [10.244.2.119] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id B2833BE4C; Tue, 21 Jul 2020 13:25:13 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1595334313; bh=ptH/7T7hPYcce9+gKbhXl1axejGmQunoTC6meGMbE3s=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=q1J7LjEDE0Ll9GgmTfRGQzKXQW7PmuP/stMf7xj6+va72TC0VgkC/tJUy+nktz4s/ UyfJ0e4DS33mldwLSgCkVnfGwVCvojYVSyMcc8D5YljiBYno+syAa/XLeAMNcDgHDe 59sz8zlFL1enlXpJkMME0E7KmfoZHdVkfPZQk18Y= To: Vittorio Bertola , Jim Reid Cc: ADD Mailing list References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <1672194657.2185.1595334210541@appsuite-gw1.open-xchange.com> From: Stephen Farrell Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Tue, 21 Jul 2020 13:25:12 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: <1672194657.2185.1595334210541@appsuite-gw1.open-xchange.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="IOXuTUGPhZXilKN9nZz17WfESYCVeh5CP" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 12:25:20 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --IOXuTUGPhZXilKN9nZz17WfESYCVeh5CP Content-Type: multipart/mixed; boundary="dtfWQK3BPd95yF96kMO8eeFkMKGQ1zPJ7"; protected-headers="v1" From: Stephen Farrell To: Vittorio Bertola , Jim Reid Cc: ADD Mailing list Message-ID: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <1672194657.2185.1595334210541@appsuite-gw1.open-xchange.com> In-Reply-To: <1672194657.2185.1595334210541@appsuite-gw1.open-xchange.com> --dtfWQK3BPd95yF96kMO8eeFkMKGQ1zPJ7 Content-Type: multipart/mixed; boundary="------------6C3AEF7931FC8058942A9DCF" Content-Language: en-US This is a multi-part message in MIME format. --------------6C3AEF7931FC8058942A9DCF Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 21/07/2020 13:23, Vittorio Bertola wrote: > Well, RFC 7258 is the IETF's policy statement from which Tommy's > question descends, so where was it discussed and approved at the > time? ietf@ietf.org, in about 1000+ messages ;-) S. --------------6C3AEF7931FC8058942A9DCF Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------6C3AEF7931FC8058942A9DCF-- --dtfWQK3BPd95yF96kMO8eeFkMKGQ1zPJ7-- --IOXuTUGPhZXilKN9nZz17WfESYCVeh5CP Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl8W3qgACgkQWrL68XsX K+r58g//fOkUnXkDA0joppwT5urvbVsin99HKtF0YyxU7Owo7EWpMYBwyUmSXw3D SoJufxGcK0DcTg5o2HWfBuyyF2WaFf9tA2OVC+2jydubcoua70YhJ3eeu3VU3SI1 tt8az9h9AqHZnXeFaL8jVLrnmTeAbQPsjmNom8mVEPY7juRiV3uiIOKkItM6nLVc ncn8e9pyVqIdcVDrkFq1pleA6XCA9g+dqioFG60KBHPf1pESaffhwlPz2YqOj5Yu g6mC7wPHIMdp9I3mYHSQhOvT8y17s7A8iG0XJqjDifvbs4Srr7MMGYjjpF6sXRBC aBzrFyQf4Eg56BQ0R9loPgjGvoDc5Zc4vNSPEwf0NUDWMluWDbw2ZldlSwjECRQt bOyKroMPM6ciJM7et5J78La+QM0LUYkFvqxNYYw7wkIHtcICGb5YsxCAdRHLSyEJ FMZaMtafgC0S3l2M05GeYo6eJw+C6vcSgmduSGnW5JS0kkcu13y66MuSdc0vTwPH hXaPbSaFaTs+4jj2HjMubJU3WDZ91wSyaEhMBvEWd6/H2AoDpv514wFbhhVpNEp2 KciQzKx2aJxEjqVlgXsfLgTOS5fdgHPXCKivSFF9xiXIcy5TYlwP3ukcB4w0q8zi 8ZT3zQFaGEcds23js+pjA2IsapZRTZXNm+CqAgw5G1bPAbCjO/c= =BqY4 -----END PGP SIGNATURE----- --IOXuTUGPhZXilKN9nZz17WfESYCVeh5CP-- From nobody Tue Jul 21 05:29:24 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E2E13A07D4 for ; Tue, 21 Jul 2020 05:29:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xOugtOL41s6D for ; Tue, 21 Jul 2020 05:29:22 -0700 (PDT) Received: from mail-lj1-x22a.google.com (mail-lj1-x22a.google.com [IPv6:2a00:1450:4864:20::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BAB463A07CC for ; Tue, 21 Jul 2020 05:29:21 -0700 (PDT) Received: by mail-lj1-x22a.google.com with SMTP id d17so23868307ljl.3 for ; Tue, 21 Jul 2020 05:29:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=GNBqHdnXMz4UCJIwadIdIibF9xfJUjYjexLnP3TB73M=; b=bEjTwGCTaO/R0BUaBqNe/ZM2OkmjbAygbbxskP52iOQxZpCWOg3W3hfeI0NP+F+K+Y 5oOby9oh8FhOZeNy5RPwsjNKq/6hQYuYIzz/dg2EC07kkhQqV1ywwx2cnM/qZjQxiGrL mGiEDOPtpC1OkosdV0/m84ty/potewReFK3hTJJm7IeOLNERcGveqY7APX0zCZccrwD4 6W9aRwQ6No1k+VnoKBRnbNSlkvnk95dstvJYUYbyiAEuVvWUwWQrBqYVizF218J+E6AY NIeeXyGiX+9aLgSC5w7YpUmbwMmraP6Sf4sXhz1zya1AK0tLSjIddqQfGIdR5QAt2JEP ttCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=GNBqHdnXMz4UCJIwadIdIibF9xfJUjYjexLnP3TB73M=; b=MqoWSHK3SiqqM7brHgGa+SEY8zRRN+9u+juXnre3rDOi1bHp+FEuj0njJTJhL6K3zR rAtLTdB9Z+jQeoRqN29dVi+tWNwhfMM1pyLAJgM1ZmmGdBaulQdKp0N968IvLsWAToA/ NvuBYZz62AuqM1Y8nRs93UVDHchF3h5KEAcWQjJd7XjrEUkxxmGZ/wRRhQrX9MrSjkAP uZ6PZXopRQMVHwDAcFO82ODDPOn3prjuZaqOG6COiUnBK8uMuSYPXgGMin6RiX4SafQq QRmzPV4kG8HQsQp7+3midCaOeG/sTPxCDajv5FEidoD9msvbIYGF0wdwjNHzIhBQ0vX0 5pRQ== X-Gm-Message-State: AOAM531P91DM1GAzbm/syB9lKw2npQudHRLhcQOEY5tEUVLfUB7yEzEJ dvI1K9KfiKdlUsub3ecE3irYpIAHi9VpIs4y6bb9Eg== X-Google-Smtp-Source: ABdhPJwIjgao1zcGIA8XjUKQQpMQW/Og9liOBsnkI9OEmu6j+3yZXxN49OmW9uu2Wo9nhIuLaAR0QeILAoqFNWuBvNc= X-Received: by 2002:a2e:9d04:: with SMTP id t4mr12308750lji.184.1595334559880; Tue, 21 Jul 2020 05:29:19 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: From: Eric Rescorla Date: Tue, 21 Jul 2020 05:28:43 -0700 Message-ID: To: tirumal reddy Cc: Andrew Campling , "add@ietf.org" , Martin Thomson Content-Type: multipart/alternative; boundary="000000000000bd695805aaf2c583" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 12:29:24 -0000 --000000000000bd695805aaf2c583 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 21, 2020 at 2:42 AM tirumal reddy wrote: > On Tue, 21 Jul 2020 at 06:13, Eric Rescorla wrote: > >> >> With that said, I have some concerns about the objective of having the >> CPE in the user's resolution path. While I certainly can understand >> the reasons you consider it advantageous, it seems to me that it >> significantly weakens the user's security posture. Even assuming >> arguendo that we have a secure mechanism for discovering this case, >> in practice the CPE seems to have quite a high rate of security >> issues, including specifically DNS hijacking (see for instance [0]). >> > > Home routers are hardened (for example, see > https://www.mind.be/openwrtsummit18/2018-10-30-OpenWRT18-prplWRT.html) to > host network security services to protect the network from internal and > external attacks. > Some home routers are hardened, but as the link I posted indicated, many are not. -Ekr --000000000000bd695805aaf2c583 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 21, 2020 at 2:42 AM tirum= al reddy <kondtir@gmail.com>= wrote:
On Tue, 21 Jul 2020 at 06:13, Eric Rescorla <<= a href=3D"mailto:ekr@rtfm.com" target=3D"_blank">ekr@rtfm.com> wrote= :

With that said, I h= ave some concerns about the objective of having the
CPE in the user'= s resolution path. While I certainly can understand
the reasons you cons= ider it advantageous, it seems to me that it
significantly weakens the u= ser's security posture. Even assuming
arguendo that we have a secure= mechanism for discovering this case,
in practice the CPE seems to have = quite a high rate of security
issues, including specifically DNS hijacki= ng (see for instance [0]).

Home routers are hardened (for example, see = https://www.mind.be/openwrtsummit18/2018-10-30-OpenWRT18-prplWRT.html) = to host network security services to protect the network from internal and = external attacks.=C2=A0

S= ome home routers are hardened, but as the link I posted indicated, many are= not.

-Ekr
--000000000000bd695805aaf2c583-- From nobody Tue Jul 21 06:57:14 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 547133A08B8 for ; Tue, 21 Jul 2020 06:57:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QLC4CHP7FMJe for ; Tue, 21 Jul 2020 06:57:11 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9E04D3A08B7 for ; Tue, 21 Jul 2020 06:57:11 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 1864F28018B; Tue, 21 Jul 2020 15:57:09 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id 1136228051E; Tue, 21 Jul 2020 15:57:09 +0200 (CEST) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id 0B66428018B; Tue, 21 Jul 2020 15:57:09 +0200 (CEST) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id F126064C6C03; Tue, 21 Jul 2020 15:57:08 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id CECB840935; Tue, 21 Jul 2020 15:57:08 +0200 (CEST) Date: Tue, 21 Jul 2020 15:57:08 +0200 From: Stephane Bortzmeyer To: Andrew Campling Cc: Stephane Bortzmeyer , Eric Rescorla , "add@ietf.org" , Martin Thomson Message-ID: <20200721135708.GA5122@nic.fr> References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <20200721073934.GA29757@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.010582, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 13:57:13 -0000 On Tue, Jul 21, 2020 at 10:06:00AM +0000, Andrew Campling wrote a message of 23 lines which said: > > If you want to use DoE to avoid the provider's lying resolver, > > using their router is not a smart move. > > Ignoring the pejorative language, Sorry for using the correct word. > I feel that this is straying into policy areas and is therefore out > of scope for the ADD charter and list. Discussing the threat model is certainly fundamentally in-scope. From nobody Tue Jul 21 08:35:40 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C53CA3A0B2A for ; Tue, 21 Jul 2020 08:35:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NjgN4vDFA_2q for ; Tue, 21 Jul 2020 08:35:35 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640106.outbound.protection.outlook.com [40.107.64.106]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E8A3E3A0B24 for ; Tue, 21 Jul 2020 08:35:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ARa6vpPYZTBcttoKoG0uS2lC436JR3DsM3L/j4dAndoRactKdDMX3OlceVNrWmgd/Mo/Cm2HG5mbiU7SdugKJGrnWowcz+oYYkD2ff3O1D6QvUw2M3HF+0os1YkwB0NpupulJQh1gNwq6ei3lt4uaUZjDv9jExxnY/mWwD/PDFb7SQw4EjbtQHlTn3aEpkuZddtg8p1L9zUbtsBtzwg/hlWpH0Ebtf01bVaFOCeyy/M2yQ4IS++GeulmrHtokBfLqW8Ewbe9HJ5ZGWKJ5jh3Bg4FyLRiEXCFwYDkanZM+eWVZ5BYb2CMhEGOXKxgQkxSnMWy1IGZdqFwffbM5u8QSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=F2fIKun7wjJdzZ+UEsYIHKf3YITLUn33EqAq50JUy+o=; b=GFtKQDqY0R1hnvoms06436TETKOr89AbGIY8HAaYxSGPr9uj/DzvxkJoXsxFXXlImnbrsz5X1xXfONchGZBPhhHgh97e1eaBTRur1km/16NwwuFCgKeIHYmYbQArLdNkpuu/ndnYz26QUJstV/54ar5/EA5TDD3+vDQf17wyeF+tdOhS7NIaaVwfFR7YfudnI6rKva4iqBXWW63e0FiUCkd87qsynTGIKMFljPP0rHRiuW+RXAAStaSXz41sgU5Nmc5zHZiKOasEbkMgKmaCv5yK2PISZX66c/IFsY0H7sI8LrLqgJnd381a+O7mA5Ljh3hFfCjutk9UQ5LhmwFO9g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=F2fIKun7wjJdzZ+UEsYIHKf3YITLUn33EqAq50JUy+o=; b=ORdtAtksS2esJFUvTA3rYNAJ7ny8crOaJRi/tsLJ0MwWy13OUF/m/TG9kDjsMK7XXJrnJFDtIpU+4e5Bg6bq561f1+hL1YffYm76ioujvTjv3cphCh1ycsx3lZajQ2GmVs55T3EHE68je9tf1/GZp3PZ5glkE0ut/s8gI+PqMWg= Received: from CH2PR00MB0779.namprd00.prod.outlook.com (2603:10b6:610:66::11) by CH2PR00MB0695.namprd00.prod.outlook.com (2603:10b6:610:78::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3253.0; Tue, 21 Jul 2020 15:35:29 +0000 Received: from CH2PR00MB0779.namprd00.prod.outlook.com ([fe80::983f:9a0:9769:6e2]) by CH2PR00MB0779.namprd00.prod.outlook.com ([fe80::983f:9a0:9769:6e2%9]) with mapi id 15.20.3251.000; Tue, 21 Jul 2020 15:35:29 +0000 From: Tommy Jensen To: tirumal reddy , Tommy Jensen CC: Andrew Campling , "add@ietf.org" , Eric Rescorla , Martin Thomson Thread-Topic: [EXTERNAL] Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AQHWXuQ8PIJgt7QxrESomxJlTaV/OqkREy5jgADDboCAAEIVWw== Date: Tue, 21 Jul 2020 15:35:29 +0000 Message-ID: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2601:600:a080:aff0:89ec:d83:c400:dc3f] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 04eb3af5-d2be-44da-7a39-08d82d8bb297 x-ms-traffictypediagnostic: CH2PR00MB0695: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 7CmVItW5UNjnzuxXX1f7bDwonjyvpXn69TeGYBWlYMOKyyxsLIE9q9ANXeJj9d8dIBn77dIsxEuxDHkxavQjBD3/v2JGMWlBzwHQmae5atazbHW6UZP7XIzwIUGLSn8Ur+9AeXTqMOwr7uDGCi5z5M1cvt01vPgFB/hMAjzViAYIVekAdUkaYzGzlX+Vm4FR6xLEZVXCaxv8ZSt0sRnyBIsIpN7w4c534Dx1g4C2BS6BX0qGGa/jPGIx+EwlBfkr18CSUU+mYaZFpbldlJPXNUZIJ4bBTB3jp2++TXIp0HxeiXHY+7cuiXnljuDEMZ5sGaAISSjTjWvqSw+fq+gx9l4eTUAkRZaoz5IWERHE8GWdW9Ii/WQG00De/IyPSLCr/qK14fH4fBzJgE4tuKMsYg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR00MB0779.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(376002)(136003)(346002)(396003)(39860400002)(366004)(71200400001)(4326008)(86362001)(66946007)(64756008)(66476007)(66556008)(76116006)(91956017)(33656002)(8676002)(66446008)(10290500003)(8936002)(8990500004)(6506007)(54906003)(478600001)(53546011)(7696005)(186003)(83380400001)(166002)(66574015)(966005)(82950400001)(82960400001)(30864003)(9686003)(5660300002)(52536014)(55016002)(2906002)(316002)(110136005); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: KruQShw9EBphQsAq1JcVkyAWU9HEKF8+viohs7CBk/Y9LGWJBga6yI4A37tmpyOB5Olw15ZbWU67zioYEsjwj3B8PYq+/bn4sbmGkGr+Q1GLpfTD2c1H/TWhREVUvkeW6I7/2RZLxxqJrM0EGNeltpdaKVZ56mnucLjTvKP78tWjb74bY3gJaJMx3fD1Du/j+SBTlMu0cnDhDef3AMCOAZYOI9AnSi4yeVbIY7WUi4b59zHEDZ/8tB7AE0FlC3RJGhyD21yJPYh6oxxOl5VO8fQ/vzAowuxbaGCKGhqw4P9I3jOccd0QZ1S6af209nv3yYshfpnjiEk3VxldKwUfkEGzs2rpTre7zJSrMg9GlbkN/4Axhb7mh7RCOgAmbJDK8G16Hrkm7RA+DmfMvEhokqBrv6u5pCRKKcCXo7GqXlJUM6cK//5E0mHXgnacipqXHskawpnNbGUVuHWiyCrEgL8/3f1K25lg9cTFmGaYGBhmfKAWBGkwdXsvzR4wg42hmBSn8tRkYcrdIs1vAOsUod3nqJZ8svyHiyTdCZgPCTtdpbHTzk3fKKtXhgtW5Tg2Od64DXbRY9hJopiiLBVuvrwSjAfgPrmZQpHab+eUfqyZ6jVIZC7cusZczIcyXvQUQnoC4JwzvMnYNCnjUKeSGkNiqbXAAYdzGvpVt0e+GSYsFqcrMQ6hyV4SYVGtYBK4ILqkX7V6i/+bOarm2b5wrg== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CH2PR00MB07795CFE498C3584692BFB90FA780CH2PR00MB0779namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: CH2PR00MB0779.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 04eb3af5-d2be-44da-7a39-08d82d8bb297 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2020 15:35:29.1775 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 8UUPVz4925OuM5gNWffrtC6M+6MyIM3GDqv8UgBBZ6P/51DEyyVvfnBSFvwCQ9lbb1a2KPqHZ/hsLUTKZYQdnQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR00MB0695 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 15:35:39 -0000 --_000_CH2PR00MB07795CFE498C3584692BFB90FA780CH2PR00MB0779namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hey Tiru, Thanks for sharing. In section 7 of your draft which defines the mechanism = you=92re proposing for PKI secures communication with an RFC1918 address, I= see one problem: > Let's suppose that "example.net" is pre-configured as a verified resolved= in the browser or OS. This depends on the DNS client already having =93example.com=94 configured = as a resolver. This doesn=92t scale well. In order for a client to work out= of the box with my ISP, it would need to come preconfigured with all known= ISPs or provide a UX to add example.com as a resolver. The first doesn=92t= scale any better than pre-shared HOSTS files, and the second requires the = user to get involved rather than providing security by default. While we ar= e using a pre shared list today, it=92s incredibly short and not a viable s= olution in the long term nor something I would want have as a requirement f= or mainstream consumer scenarios. One approach (which may be in your draft and I simply missed it) would be t= o make a connection to the parent of the DHCP/RA domain by dropping the lef= tmost labels and verify the certificate the same way. I would expect the CP= E to provide the IP hint for that resolver as well. This at least would all= ow bootstrapping without any preconfiguration or user involvement needed un= less I=92m missing something? This should negate the need for the work desc= ribed here requiring other token types for going from a DHCP message with n= ovel server identifiers to a secure DNS connection to a local address. > If the insecurely discovered DoH/DoT server is not pre-configured in the = OS or browser, the client must validate the signatory (e.g., cryptographica= lly attested by the ISP [I-D.reddy-add-server-policy-selection]). Thanks, Tommy Jensen =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D How can you secure your DNS queries? https://aka.ms/dohblogpost ________________________________ From: Add on behalf of tirumal reddy Sent: Tuesday, July 21, 2020 3:32 AM To: Tommy Jensen Cc: Andrew Campling ; add@ietf.org ; Eric Rescorla ; Martin Thomson Subject: [EXTERNAL] Re: [Add] Practical Observations from Encrypted DNS Dep= loyments by Network Operators Hi Tommy, Please see inline On Tue, 21 Jul 2020 at 05:50, Tommy Jensen > wrote: Hey Andrew, Thank you for bringing this to the WG. I think it's important to talk throu= gh the ISP perspective. Given the two documents are intertwined, I'll addre= ss your proposal directly despite the subject being your informational docu= ment. andrew> However, since the timeframe for this will be necessarily longer fo= r many users, my assumption is that the preference for most would be to enl= arge the potential pool of encrypted DNS users as quickly as possible. Part of my feedback on this document was that this assumption does not hold= true for me. I would rather avoid building protocols or systems we'll regr= et later than maximize the number of encrypted DNS users ASAP. I'm about to= write out the verbose version of why I don't feel that way. Please feel fr= ee to correct anything I've misunderstood or overlooked. In the spirit of ekr's calls for a threat model, let's walk through an atta= cker scenario. Let's say I discover 192.168.1.100 as a DNS server from my C= PE from my home Wi-Fi network. I did this via DHCP, which is an insecure pr= otocol. This proposal has a third party vouch for the authenticity, in this= case, the separately maintained mapping by DNS client vendors. It is possible to host a DoT/DoH forwarder on the home router, the forwarde= r can use a certificate that can be validated by PKI and the CPE can contin= ue to use private IP addresses. Please see https://tools.ietf..org/html/dra= ft-btw-add-home-07#section-7.1 for more details. I do not see this ISP list the same as the current Windows list of public D= oH servers, and I am not willing to accept the risk posed by maintaining th= is new mapping. Where the existing SPAU list we rely on contains only publi= cly documented and PKI verifiable names, the proposed mechanism does not. T= his means I'm not just confirming what someone else has already validated; = I'm now responsible for the maintenance of the original ownership verificat= ion for an ever-increasing number of ISPs which will include enterprises ru= nning their own internal networks also eager to avoid infrastructure update= s on their end. I will not do that, especially for a stop-gap feature whose= value will fade away as a proper bootstrapping mechanism is deployed. The proposal I'm coauthoring (https://tools..ietf.org/html/draft-pauly-add-= resolver-discovery-01#section-5) won't work for RFC1918 addresses because they can't be ver= ified using PKI. I'm ok with this, as DNS use of HTTPS should not be less s= ecure than any other use of HTTPS. Since DHCP discovery of 192.168.1.100 is insecure to start with and PKI can= 't be used to secure RFC1918 addresses, our choices are to invent a new tru= st mechanism (such as your proposal) or settle for opportunistic security. = For example, a DNS client receiving an RFC1918 address can simply try it wi= th DoT without concern for hostname... Literally just add TLS SPAU style. I= n a threat model, what this provides is protection against multiple eavesdr= oppers, reducing the eavesdropper count between the client and the CPE to a= maximum of one (whoever convinces the client to use their spoofed DHCP mes= sage). It does not guarantee the identity of who you are sending queries to= . However, this is no worse than before, as you have the same lack of authe= ntication with classic DNS to a DHCP-discovered address but have now preven= ted eavesdropping by a third party. If this is viewed as a regression because an attacker can then prevent the = CPE from inspecting classic DNS traffic coming through it for ISP provided = filtering purposes, then we're back to inventing a new trust mechanism. Fro= m my perspective, this is a non-starter. That leaves us with two alternativ= es I can think of: make DHCP (or its replacement) secure, or allow use of c= lassic DNS on the client to CPE link. The former has previously been determ= ined to be a hard problem. The latter is our current situation. This is my in-depth way of asking: is rushing to get encrypted DNS to as ma= ny people as possible worth either settling for opportunistic protection or= inventing a whole new trust mechanism (which will be permanent whether we = wish it to be temporary or not, Paul Vixie recently shared some wisdom alon= g this line)? My answer here in order are "maybe" and "no" but I'd like to = hear what others think. I hear you that deploying public DNS servers is costly and not within your = interests. I also hear you that updating CPEs is time consuming. I simply d= on't see a way to avoid those things and continue to enable DNS to a CPE wh= ile providing the same level of security as DoH to a public resolver withou= t either securing DHCP (which is hard and brings us back to updating CPEs) = or inventing a new trust mechanism for private addresses (which adds a heav= y burden to DNS clients for stop-gap work). The home network itself is susceptible to both internal and external attack= s. https://tools.ietf.org/html/draft-btw-add-home-07#section-9 discusses various attacks possible and the= mechanisms endpoint can use to avoid using the attacker's DoH/DoT server. Cheers, -Tiru I welcome any comments or corrections. I'd be happy to be wrong. Thanks, Tommy Jensen =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D How can you secure your DNS queries? https://aka.ms/dohblogpost ________________________________ From: Add > on behalf of = Andrew Campling Sent: Monday, July 20, 2020 3:22 PM To: Eric Rescorla > Cc: add@ietf.org >; = Martin Thomson > Subject: [EXTERNAL] Re: [Add] Practical Observations from Encrypted DNS Dep= loyments by Network Operators Ekr To clarify, there are two issues to overcome here, (i) use of RFC1918 priva= te addresses by the CPE (to facilitate SPAU) and (ii) support for DNS forwa= rders to maintain the full functionality provided by network operators that= is described in the document. The desired end state is as you describe: Client <------- TLS --------> CPE <------- TLS --------> ISP Resolver Whilst it would be ideal to deal with both of the above issues simultaneous= ly, pragmatically it may be necessary to deal with them sequentially given = the potential for delays in upgrading CPE software. Since there are alread= y some proposed discovery methods that deal with the private addresses, it = could make sense for to implement a two-step solution that first solves the= private address issue in the short-term whilst the CPE software upgrade is= deployed. This would at least maintain support for the user=92s chosen re= solver via encrypted DNS using SPAU whilst a CPE software upgrade is QA=92d= by the network operator and then deployed. Of course others may think it better to go with a single-step approach that= upgrades the CPE software to maintain support for DNS forwarders and deals= with the private address issue for SPAU at the same time. However, since = the timeframe for this will be necessarily longer for many users, my assump= tion is that the preference for most would be to enlarge the potential pool= of encrypted DNS users as quickly as possible. Does this help? Andrew From: Eric Rescorla > Sent: 20 July 2020 16:03 To: Andrew Campling Cc: Martin Thomson >; add@ietf.= org Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by= Network Operators Hi Andrew, Ignoring the discovery question for a moment, I guess I'm not entirely clear on what your desired outcome in terms of network topology is. As described in your draft, at present the clients send DNS packets to the forwarder on the CPE, which then selectively forwards queries to the main ISP resolver. However, in a world where the DNS is encrypted, then this would require that the encryption be terminated at the CPE and then re-originated to the ISP resolver, like so: Client <------- TLS --------> CPE <------- TLS --------> ISP Resolver Is that your desired outcome? If so, it seems to come into conflict with your points in S 5.2 about the difficulty of upgrading the CPE. If not, maybe I just don't understand. In either case, perhaps you can elaborate. -Ekr On Mon, Jul 20, 2020 at 7:47 AM Andrew Campling > wrote: On Thu, Jul 16, 2020, at 00:12, Martin Thomson > wrote: > Your draft seems to be making a case for supporting forwarders, but I'm n= ot clear on what supporting forwarders looks like. I understand that you m= ight not have specific ideas about what this support might look like, but I= don't see any real requirements here either. > > It would really help if the draft would clearly articulate what your desi= red outcome is. Sorry for the lack of clarity. The primary intent of the document is to pr= ovide information as we have the impression that at least some client devel= opers may not have good visibility of common network operator architectures= and practices outside of the US. By providing such clarity we hope to see= implementations that are sympathetic to the environment into which they ar= e being deployed in order to maximise the chances of working correctly, ide= ally via SPAU as manual configuration of DNS settings by the majority of us= ers seems unlikely. In a nut shell, any ADD solution should measure itself to see whether it me= ets the use case described in this document, at least one is needed that do= es. Andrew -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add --_000_CH2PR00MB07795CFE498C3584692BFB90FA780CH2PR00MB0779namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
Hey Tiru,

Thanks for sharing. In section 7 of your draft which defines the mecha= nism you=92re proposing for PKI secures communication with an RFC1918 addre= ss, I see one problem:

> Let's suppose that "example.net" is pre-configured as a verif= ied reso= lved in the browser or OS.

This d= epends on the DNS client already having =93example.com=94 configured as a r= esolver. This doesn=92t scale well. In order for a client to work out of the box with my ISP, it would need to come pre= configured with all known ISPs or provide a UX to add example.com as a reso= lver. The first doesn=92t scale any better than pre-shared HOSTS files, and= the second requires the user to get involved rather than providing security by default. While we are using a p= re shared list today, it=92s incredibly short and not a viable solution in = the long term nor something I would want have as a requirement for mainstre= am consumer scenarios.

One approach (which may be in your draft and I simply missed it) would= be to make a connection to the parent of the DHCP/RA domain by dropping th= e leftmost labels and verify the certificate the same way. I would expect t= he CPE to provide the IP hint for that resolver as well. This at least would allow bootstrapping without any= preconfiguration or user involvement needed unless I=92m missing something= ? This should negate the need for the work described here requiring other t= oken types for going from a DHCP message with novel server identifiers to a secure DNS connection to a local addres= s.

> If the insecurely discovered DoH/DoT server is not pre-configured in the OS or browser, the client must validate the signatory (e.g., cryptograp= hically attested by the ISP [I-D.reddy-add-server-policy-selection]).

Thanks,
Tommy Jensen
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
How can you secure your DNS queries? https://aka.ms/dohblogpost 

From: Add <add-bounces@i= etf.org> on behalf of tirumal reddy <kondtir@gmail.com>
Sent: Tuesday, July 21, 2020 3:32 AM
To: Tommy Jensen <Jensen.Thomas=3D40microsoft.com@dmarc.ietf.org&= gt;
Cc: Andrew Campling <andrew.campling@419.consulting>; add@ietf= .org <add@ietf.org>; Eric Rescorla <ekr@rtfm.com>; Martin Thoms= on <mt@lowentropy.net>
Subject: [EXTERNAL] Re: [Add] Practical Observations from Encrypted = DNS Deployments by Network Operators
 
Hi Tommy,

Please see inline

On Tue, 21 Jul 2020 at 05:50, Tommy= Jensen <Jensen.Thomas=3D40microsoft.com@dmarc.ietf.org> wrote:
Hey Andrew,

Thank you for bringing this to the WG. I think it's important to talk t= hrough the ISP perspective. Given the two documents are intertwined, I'll a= ddress your proposal directly despite the subject being your informational document.

andrew> However, since the timeframe for this will be necessarily longer for many users, my assumption is that the prefe= rence for most would be to enlarge the potential pool of encrypted DNS user= s as quickly as possible. 

Part of my feedback on this document was that this assumption does not hold= true for me. I would rather avoid building protocols or systems we'll regr= et later than maximize the number of encrypted DNS users ASAP. I'm about to= write out the verbose version of why I don't feel that way. Please feel free to correct anything I've misun= derstood or overlooked.

In the spirit of ekr's calls for a threat model, let's walk throug= h an attacker scenario. Let's say I discover 192.168.1.100 as a DNS server = from my CPE from my home Wi-Fi network. I did this via DHCP, which is an insecure protocol. This proposal has a th= ird party vouch for the authenticity, in this case, the separately maintain= ed mapping by DNS client vendors.

It is possible to host a DoT/DoH forwarder on the home router, the for= warder can use a certificate that can be validated by PKI and the CPE can c= ontinue to use private IP addresses. Please see https://tools.ietf..org/html/draft-btw-add-home-07#section-7.1 for more details.
 

I do not see this ISP list the same as the current Windows list of public D= oH servers, and I am not willing to accept the risk posed by maintaining th= is new mapping. Where the existing SPAU list we rely on contains only publi= cly documented and PKI verifiable names, the proposed mechanism does not. This means I'm not just confirming= what someone else has already validated; I'm now responsible for the maint= enance of the original ownership verification for an ever-increasing number= of ISPs which will include enterprises running their own internal networks also eager to avoid infrastructure upd= ates on their end. I will not do that, especially for a stop-gap feature wh= ose value will fade away as a proper bootstrapping mechanism is deployed.

The proposal I'm coauthoring (https://tools..ietf.org/html/draft-pauly-add-resolver-discovery-01#se= ction-5) won't work for RFC1918 addresses because they can't be verified using PKI.= I'm ok with this, as DNS use of HTTPS should not be less secure than any o= ther use of HTTPS. 

Since DHCP discovery of 192.168.1.100 is insecure to start with and PKI can= 't be used to secure RFC1918 addresses, our choices are to invent a new tru= st mechanism (such as your proposal) or settle for opportunistic security. = For example, a DNS client receiving an RFC1918 address can simply try it with DoT without concern for hostname= ... Literally just add TLS SPAU style. In a threat model, what this provide= s is protection against multiple eavesdroppers, reducing the eavesdropper c= ount between the client and the CPE to a maximum of one (whoever convinces the client to use their spoofed= DHCP message). It does not guarantee the identity of who you are sending q= ueries to. However, this is no worse than before, as you have the same lack= of authentication with classic DNS to a DHCP-discovered address but have now prevented eavesdropping by a= third party.

If this is viewed as a regression because an attacker can then prevent the = CPE from inspecting classic DNS traffic coming through it for ISP provided = filtering purposes, then we're back to inventing a new trust mechanism. Fro= m my perspective, this is a non-starter. That leaves us with two alternatives I can think of: make DHCP (or its rep= lacement) secure, or allow use of classic DNS on the client to CPE link. Th= e former has previously been determined to be a hard problem. The latter is= our current situation.

This is my in-depth way of asking: is rushing to get encrypted DNS to as ma= ny people as possible worth either settling for opportunistic protection or= inventing a whole new trust mechanism (which will be permanent whether we = wish it to be temporary or not, Paul Vixie recently shared some wisdom along this line)? My answer here in= order are "maybe" and "no" but I'd like to hear what o= thers think. 

I hear you that deploying public DNS servers is costly and not within your = interests. I also hear you that updating CPEs is time consuming. I simply d= on't see a way to avoid those things and continue to enable DNS to a CPE wh= ile providing the same level of security as DoH to a public resolver without either securing DHCP (which i= s hard and brings us back to updating CPEs) or inventing a new trust mechan= ism for private addresses (which adds a heavy burden to DNS clients for sto= p-gap work). 

The home network itself is susceptible to both internal and external a= ttacks. https://tools.ietf.org/html/draft= -btw-add-home-07#section-9 discusses various attacks possible and the mechanisms endpoint can use to avoid usin= g the attacker's DoH/DoT server.

Cheers,
-Tiru
 

I welcome any comments or corrections. I'd be happy to be wrong.

Thanks,
Tommy Jensen
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
How can you secure your DNS queries? https://aka.ms/dohblogpost 
F= rom: Add <= add-bounces@ietf.org> on behalf of Andrew Campling <andrew.campling@419.consulting>
Sent: Monday, July 20, 2020 3:22 PM
To: Eric Rescorla <ekr@rtfm.com>
Cc: add@ietf.org <add@ietf.org&g= t;; Martin Thomson <mt@lowentropy.net>
Subject: [EXTERNAL] Re: [Add] Practical Observations from Encrypted = DNS Deployments by Network Operators
 

Ekr

To clarify, there are two issues to overc= ome here, (i) use of RFC1918 private addresses by the CPE (to facilitate SP= AU) and (ii) support for DNS forwarders to maintain the full functionality = provided by network operators that is described in the document.  The desired end state is as you descri= be:

 

Client  <------- TLS -------->  CPE  <------- TL= S -------->  ISP Resolver

 

Whilst it would be ideal to deal with bot= h of the above issues simultaneously, pragmatically it may be necessary to = deal with them sequentially given the potential for delays in upgrading CPE= software.  Since there are already some proposed discovery methods that deal with the private addresses, it c= ould make sense for to implement a two-step solution that first solves the = private address issue in the short-term whilst the CPE software upgrade is = deployed.  This would at least maintain support for the user=92s chosen resolver via encrypted DNS using SPAU whil= st a CPE software upgrade is QA=92d by the network operator and then deploy= ed. 

 

Of course others may think it better to g= o with a single-step approach that upgrades the CPE software to maintain su= pport for DNS forwarders and deals with the private address issue for SPAU = at the same time.  However, since the timeframe for this will be necessarily longer for many users, my assum= ption is that the preference for most would be to enlarge the potential poo= l of encrypted DNS users as quickly as possible. 

 

Does this help?

 

 

Andrew

 

 

From: Eric Resco= rla <ekr@rtfm.com&= gt;
Sent: 20 July 2020 16:03
To: Andrew Campling <andrew.campling@419.consulting>
Cc: Martin Thomson <mt@lowentropy.net>; add@ietf.org
Subject: Re: [Add] Practical Observations from Encrypted DNS Deploym= ents by Network Operators

 

Hi Andrew,

Ignoring the discovery question for a moment, I guess I'm not entirely
clear on what your desired outcome in terms of network topology is.

As described in your draft, at present the clients send DNS packets to
the forwarder on the CPE, which then selectively forwards queries to
the main ISP resolver. However, in a world where the DNS is encrypted,
then this would require that the encryption be terminated at the
CPE and then re-originated to the ISP resolver, like so:


Client <------- TLS -------->  CPE  <------- TLS -------= -> ISP Resolver

Is that your desired outcome? If so, it seems to come into conflict
with your points in S 5.2 about the difficulty of upgrading the CPE.
If not, maybe I just don't understand. In either case, perhaps you
can elaborate.

-Ekr


 

On Mon, Jul 20, 2020 at 7:47 AM Andrew Campling <andrew.campling@419.consult= ing> wrote:

On Thu, Jul 16, 2020, at 00:12, Martin Thomson <mt@lowentropy.net> wrote:

> Your draft seems to be making a case for supporting forwarders, but I'= m not clear on what supporting forwarders looks like.  I understand th= at you might not have specific ideas about what this support might look lik= e, but I don't see any real requirements here either.
>
> It would really help if the draft would clearly articulate what your d= esired outcome is.

Sorry for the lack of clarity.  The primary intent of the document is = to provide information as we have the impression that at least some client = developers may not have good visibility of common network operator architec= tures and practices outside of the US.  By providing such clarity we hope to see implementations that are sympathe= tic to the environment into which they are being deployed in order to maxim= ise the chances of working correctly, ideally via SPAU as manual configurat= ion of DNS settings by the majority of users seems unlikely. 

In a nut shell, any ADD solution should measure itself to see whether it me= ets the use case described in this document, at least one is needed that do= es. 


Andrew

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--_000_CH2PR00MB07795CFE498C3584692BFB90FA780CH2PR00MB0779namp_-- From nobody Tue Jul 21 08:42:46 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E8AC3A0B50 for ; Tue, 21 Jul 2020 08:42:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YJ37WmgfdUlu for ; Tue, 21 Jul 2020 08:42:39 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E8A63A0B39 for ; Tue, 21 Jul 2020 08:42:39 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id BA9FD38A1E; Tue, 21 Jul 2020 11:22:12 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id jY4clkIGxCwR; Tue, 21 Jul 2020 11:22:12 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id E2A8738A1A; Tue, 21 Jul 2020 11:22:11 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 21A4F1FB; Tue, 21 Jul 2020 11:42:37 -0400 (EDT) From: Michael Richardson To: "Deen\, Glenn" , ADD Mailing list In-Reply-To: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 15:42:45 -0000 --=-=-= Content-Type: text/plain Deen, Glenn wrote: > I wanted to bring to your attention a short, very short, draft that I > wrote up based on an email thread on the WG list. It captures a basic > framework of Green-Yellow-Red threat and trust relationships the user > may have with their network. The hope is that this can be a basis for > focusing discussion of threats and what mitigations maybe needed in > different situations. I feel that the title: _Adaptive DNS Discovery Threats Here_ is trying to do something cute by having "Here" at the end, but I don't know what it is. Maybe it's just a typo? First, I disagree with your Yellow list, a number of things I'd put into the Red zone. I think that Airport and Cafe networks may be even more hostile than Hostile Regimes. But, I think that ultimately, it's up to the end user and their OS to figure this out. (Windows already asks this question for new networks, so that's basically done. We just need to have extended-POSIX APIs that would allow browsers to determine this) I would rework these categories a bit. The key thing is whether or not the end user is aware of the risk. That is, knowledge that one is on a Hostile Regime network may cause the user to be more cautious in their use than being on a "Yellow" Hotel network which is in fact compromised. Or worse, on a home network which is completely compromised, and the user has been trained to click through all the https warnings on 192.168.1.x addresses. Stephane Bortman's criticism is valid, if this were a categorization of the security of the *networks*, but it's not intended. It's intended, think, as feedback to the user as to *their* risk of privacy disclosure through DNS snooping. Richard Barnes' anticipated my suggestion with the question: how do we tell? Well, we have RFC3118. Servers can sign their offers. They can do this with raw public keys. Or SEND for RAs. For WIFI, it can also all be tied into the L2 keys. It would be worth expanding this ID better to explain these things. Historically, this was considered useless, but it does allow clients to recognize servers on a TOFU basis! RFC3118 does define an assymmetric key mechanism, but the FreeS/WAN/wavesec team did this ~15 years ago. http://web.archive.org/web/20050206050646/http://www.wavesec.net/ hmm. Not all the details of the RFC3118 signature is there. I can dig stuff up. We never were able to deploy our signed version for reasons involving getting certain pieces of, at the time unmaintained, DHCP code upstreamed. RFC3118 was created in the best of IETF tradition: Jeff Schiller and Christian Huitema developed the original version of this authentication protocol in a terminal room BOF at the Dallas IETF meeting, December 1995. One of the editors (Droms) transcribed the notes from that discussion, which form the basis for this document. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl8XDOwACgkQgItw+93Q 3WWlhAf/bJvs/qrWiT9jxWJ1rw3vzm3PtOSDygA8qJ49G9ir3B0IEEIsPAXMp1D3 xHIHh3OION82gaIchIgqfm8rUULFvNV6H7b6x8zpngfPgPFVlKLHbRdjRbjl7qhL Qr3pRO+uae0qeKFqGJ3EqKOgmfFjfJrG8gIfg4a0kJZAFAqgnO+L/6uWkXy+PJVw rsKP9FejNcO+2x8ao9OWr3ZDdCSGcNUxHs4xrLQP8JML7KYuMTNa2eKjQfvHcgFu 8wty7Lns6Kna6kIIL9q8SDmdfKbaQKtS/WKNZ8/01wIxqUP4A50MMc3+63JTT4gU 3kKCeIAY29gHVDPxKBKwfjmbqngq4w== =0s6q -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Jul 21 08:50:43 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B2393A0B3F for ; Tue, 21 Jul 2020 08:50:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ng1Hxijjr9yl for ; Tue, 21 Jul 2020 08:50:40 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 424623A0B3C for ; Tue, 21 Jul 2020 08:50:40 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id AA36928018B; Tue, 21 Jul 2020 17:50:38 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id A21A62802B2; Tue, 21 Jul 2020 17:50:38 +0200 (CEST) Received: from relay01.prive.nic.fr (unknown [10.1.50.11]) by mx4.nic.fr (Postfix) with ESMTP id 9A44928018B; Tue, 21 Jul 2020 17:50:38 +0200 (CEST) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 8D89D64C6C03; Tue, 21 Jul 2020 17:50:38 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id 2DC1746C6C; Tue, 21 Jul 2020 17:50:38 +0200 (CEST) Date: Tue, 21 Jul 2020 17:50:38 +0200 From: Stephane Bortzmeyer To: Tommy Jensen Cc: tirumal reddy , Andrew Campling , "add@ietf.org" , Eric Rescorla , Martin Thomson Message-ID: <20200721155038.GA32287@nic.fr> References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.146816, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 15:50:42 -0000 On Tue, Jul 21, 2020 at 03:35:29PM +0000, Tommy Jensen wrote a message of 865 lines which said: > One approach (which may be in your draft and I simply missed it) > would be to make a connection to the parent of the DHCP/RA domain by > dropping the leftmost labels and verify the certificate the same > way. "Climbing the tree" is dangerous since you don't know when you cross an administrative boundary (see the relics of the DBOUND working group). Can eu.org vouch for something.eu.org? RFC 1535 is still relevant... From nobody Tue Jul 21 09:49:38 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C0E23A0BF4 for ; Tue, 21 Jul 2020 09:49:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u5TuJGrs1wOX for ; Tue, 21 Jul 2020 09:49:35 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0164C3A0BF3 for ; Tue, 21 Jul 2020 09:49:34 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 14DCEC3F16 for ; Tue, 21 Jul 2020 16:49:32 +0000 (UTC) From: Paul Vixie To: "add@ietf.org" Date: Tue, 21 Jul 2020 16:49:31 +0000 Message-ID: <8646010.mL01ujt3hu@linux-9daj> Organization: none In-Reply-To: References: <20200721074235.GB29757@nic.fr> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 16:49:36 -0000 On Tuesday, 21 July 2020 10:09:34 UTC Andrew Campling wrote: > On Tuesday, Jul 21, 2020 at 08:43, Stephane Bortzmeyer wrote: > > Also, I strongly object to this "my network, my policy" principle. I > > want Internet access providers to be neutral tubes, not to force their > > policies onto me. > > I feel that this is again straying into policy areas and is therefore out of > scope for the ADD charter and list. part of it is in-scope, and stephane's misunderstanding as quoted above illuminates this perfectly. i, like him, do not expect my ISP to have a policy beyond anti-abuse, because they have no enforcement capability beyond that, and because they do not also own the end-devices nor employ or parent the end- users. anti-abuse means if they let their users spam or ddos, or if they host harmful content, they'll face consequences. however for the purpose of this WG i will stipulate that an ISP ought not dictate DNS policy to its customers. the misunderstanding comes in the network-of-networks concept. my edge network is not an ISP. it's a LAN, perhaps containing a bridged WLAN, or a small or virtual campus containing many LANs. the edge is a private artifact, crafted by me in the case of my family and my day job, paid for by my family or my company. all devices connected to the edge network are owned by the same family or company who constructed and operates that network, and who pays for an ISP connection to connect this network to the rest of the network of networks ("internet"). in the hierarchy of responsibility, ISP's have far less than edge network operators. exercise of whatever responsibilities a network (ISP or edge) operator should not be challenged nor should this hierarchy be upended by new protocol standards such as those discussed in this WG. there's already a Tor project, and there are hundreds of private tunnel methods available on github, so that hostile use of an edge network ("hostile" meaning the user disagrees with the owner/operator's policies) can proceed. a solid engineering plan and associated protocol for DNS discovery would allow an edge network operator to reliably express its resources and policies to connected devices, and to reliably detect and prohibit violations of that policy. if DHCP is inadequate to tell devices what DNS server to use and what protocols and crypto algs and keys to use, then we should define a new way to do that which lacks DHCP's inadequacies. but we should also respect the edge network operator's ability to set and enforce policy for the private network they build, operate, and pay for. "should" in this case is not because of ethics, but because of practicalities: corporate, private, government, military, and other sensitive networks _will not_ have their architecture dictated to them. sometimes this is by law, or by regulation, or enlightened self interest (defense) or just plain stubbornness. if the new way to DNS disintermediates edge network policy, then the result will be some combination of losses due to disappearance of defense technology, and explicit edge proxies which force cleartext inspection of traffic. the IETF should not implicitly legislate edge network policy by creation of new standards. and if i see that trying to happen on the ADD list, i will object, because that objection will be on-topic. apple has done a lot of work in the area of discovering local-network policy, i believe it relies on broadcast/multicast as a way to differentiate between edge operators (who can hear multicast from a connected device) and ISP's (who cannot). while there are some weaknesses like authentication, the model is sound: it assumes that the local network operator knows what policy they want or need or are required to implement, and ISP's have no role in it other than offering resources. this is why i think glenn's tri-color model is essential for our discussions. (sometimes i'm told that edge networks are an anachronism and that the internet should be considered public from end to end. i don't know what to tell folks except, please get out there and try to sell that idea and see who bites, but don't ram it down anybody's throat if they just plain disagree. the first few thousand networks to join the "network of networks" ("Internet") were all privately owned and operated. third-party transit came later.) -- Paul From nobody Tue Jul 21 10:06:49 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75FCB3A0C20 for ; Tue, 21 Jul 2020 10:06:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A4YH9bDjkDGb for ; Tue, 21 Jul 2020 10:06:47 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77E963A0C1F for ; Tue, 21 Jul 2020 10:06:47 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 2E980C3F16; Tue, 21 Jul 2020 17:06:47 +0000 (UTC) From: Paul Vixie To: Tommy Jensen , Eric Rescorla , add@ietf.org Cc: "add@ietf.org" , Martin Thomson , Andrew Campling Date: Tue, 21 Jul 2020 17:06:46 +0000 Message-ID: <2107922.zMOg1SKWvj@linux-9daj> Organization: none In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 17:06:48 -0000 On Tuesday, 21 July 2020 11:36:08 UTC Andrew Campling wrote: > On Tues, Jul 21, 2020 at 01:20 Tommy Jensen wrote: > > Part of my feedback on this document was that this assumption does not > > hold true for me. I would rather avoid building protocols or systems > > we'll regret later than maximize the number of encrypted DNS users ASAP. > I think it would be beneficial to have further discussion whether the IETF's > policy of encrypting end-to-end communication comes with an implied > requirement to do so as quickly as possible (another way of looking at > maximizing the number of encrypted DNS users ASAP), or whether this can be > done so in a more leisurely manner. ... everything we do with internet protocols has a long tail. there is always a motive to get it right rather than ship it fast. if someone is having a raging surveillance fire, there's NLNetLabs "stubby" and similar software from CF. we should not treat the future of DNS encryption as a raging fire. -- Paul From nobody Tue Jul 21 10:46:41 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C94C73A0D32; Tue, 21 Jul 2020 10:46:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OTgsQ7l2QyKS; Tue, 21 Jul 2020 10:46:38 -0700 (PDT) Received: from mail-qk1-x72d.google.com (mail-qk1-x72d.google.com [IPv6:2607:f8b0:4864:20::72d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 59E873A0D31; Tue, 21 Jul 2020 10:46:38 -0700 (PDT) Received: by mail-qk1-x72d.google.com with SMTP id u64so6988283qka.12; Tue, 21 Jul 2020 10:46:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=FkBbvAshJN247jf+mw0Oge/+Uys3XfiHy2BzMaQS+jo=; b=joQGdlSieDZfNN9LJXjjc2cYgqR5XM6nzfBdTjyDrYKd4t+OiEJIwa3I9sqn5b6nKq yslJgIjVAgTBEoFweoCNw5tIV/IQB97TbsFSO2o6WDiRUM258Bsy3lsfqO1Z877Suojn y8mhAa620L6+2pRrlVTtYRI7ey2+3HQL+jP/LsP2j95DbPPlGTRkzlkK6myk5bvIH+m+ Ary3t+wdnJpK1K9lC7xxqqwWMn+3W7XreBDmJWsEl1oufEDThCg2UPIO2M6M3eANpUUO KkUlnGt1yi8/a7OhpSFCcjea5Lk6BX/HGa9qANCqyonWPiS7yM3AfmHZad8/eSgDOXsE vjjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=FkBbvAshJN247jf+mw0Oge/+Uys3XfiHy2BzMaQS+jo=; b=D7R0/qx/vAUlyCvBiE6/MgzGHW2TAx2myd5zBmUyss8Q10EmX1sG93AwVoMhc8WVpo 44kFoWsQZhgBISW0mnv/ppPZB+ADQ3QNU1KXVSZ+wA3ONnl0cA2YstPjX4tM8ftx8YcW verZWEd8EMTO3gye+ZqxhfnX2gBhYScn8B7+4WONpB//fD9R+gWhtVSM3cyNylpT0HlC A8vIa0fn+CJOafbx49+Vyig9sDSpz5qzoRbSfT1jeVV24Ul9yXPRS4tbaDO39XrTK2VY /6jwb9NxScJbOqMHgW/J649gCd1lwEZ4wjEVEh7QSxuEbCVVsb/TPDoh6M3o0ukAKLZZ QbBw== X-Gm-Message-State: AOAM530XIOogliNMNJmyKx1+9Gw92zldjNj93cEaDKdfQI8AUNwGYPrk r3DDKVvgl6ewX1yVVwwZJ9W2p3g6Z13BUGMu7ns= X-Google-Smtp-Source: ABdhPJxaiTL8I9dw/YM5h31SprUZbXdK/gIakpYD683mPrS+JIwJRuQlVcLrQI7LBzLhqHru7RZNlcIBbRyGXdRU/iM= X-Received: by 2002:a05:620a:15bc:: with SMTP id f28mr27188616qkk.322.1595353597415; Tue, 21 Jul 2020 10:46:37 -0700 (PDT) MIME-Version: 1.0 References: <5EFC3442-045F-4F89-A4BA-769C1AFE87A4@comcast.com> <20200721074558.GC29757@nic.fr> In-Reply-To: <20200721074558.GC29757@nic.fr> From: "Chris Box (BT)" Date: Tue, 21 Jul 2020 18:46:25 +0100 Message-ID: To: Stephane Bortzmeyer Cc: "Deen, Glenn" , ADD Mailing list , "add-chairs@ietf.org" Content-Type: multipart/alternative; boundary="0000000000007715e405aaf734a6" Archived-At: Subject: Re: [Add] IETF108 ADD Agenda X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 17:46:40 -0000 --0000000000007715e405aaf734a6 Content-Type: text/plain; charset="UTF-8" In a similar vein, draft-btw-add-home-06 should now be -07. The agenda looks like a high-speed tour of the drafts, which is probably necessary, but it's unfortunate there are only 90 minutes to play with. I imagine the time available for questions on each draft will be only a minute or two. When do the chairs expect discussion to take place on selecting a coherent set of drafts to move forward with? Will this be on the list afterwards, or is this planned for the interim meeting? I'm hoping we don't need to wait until September for that. Thanks, Chris On Tue, 21 Jul 2020 at 08:46, Stephane Bortzmeyer wrote: > On Mon, Jul 20, 2020 at 11:08:01PM +0000, > Deen, Glenn wrote > a message of 71 lines which said: > > > The agenda for ADD @ IETF108 has now been posted. > > (https://datatracker.ietf.org/meeting/108/session/add) > > Typo: the draft for DRDP is draft-mglt-add-rdp, not > draft-mglt-add-drdp. > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000007715e405aaf734a6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
In a similar vein,=20 draft-btw-add-home-06 should now be -07.

The agend= a looks like a high-speed tour of the drafts, which is probably necessary, = but it's unfortunate there are only 90 minutes to play with. I imagine = the time available for questions on each draft will be only a minute or two= .

When do the chairs expect discussion to take pla= ce on selecting a coherent set of drafts to move forward with? Will this be= on the list afterwards, or is this planned for the interim meeting? I'= m hoping we don't need to wait until September for that.

=
Thanks,
Chris



On Tue, 21 Jul 2020 at 08:46, Stephane Bortzmeyer <bortzmeyer@nic.fr> wrote:
On Mon, Jul 20, 2020 at 11:08:01PM +000= 0,
=C2=A0Deen, Glenn <Glenn_Deen@comcast.com> wrote
=C2=A0a message of 71 lines which said:

> The agenda for ADD @ IETF108 has now been posted.
> (https://datatracker.ietf.org/meeting/108/= session/add)

Typo: the draft for DRDP is draft-mglt-add-rdp, not
draft-mglt-add-drdp.

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000007715e405aaf734a6-- From nobody Tue Jul 21 11:14:54 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 68D073A0D3B for ; Tue, 21 Jul 2020 11:14:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.306 X-Spam-Level: X-Spam-Status: No, score=-1.306 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RDNS_NONE=0.793, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=noware.co.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QH-aFPloJu8s for ; Tue, 21 Jul 2020 11:14:50 -0700 (PDT) Received: from mail.noware.co.uk (unknown [IPv6:2604:a880:0:1010::add:2001]) by ietfa.amsl.com (Postfix) with ESMTP id 61D4B3A0D31 for ; Tue, 21 Jul 2020 11:14:50 -0700 (PDT) Received: from [192.168.1.170] (unknown [81.156.224.99]) by mail.noware.co.uk (Postfix) with ESMTPSA id A24281DB3D6; Tue, 21 Jul 2020 18:13:38 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.noware.co.uk A24281DB3D6 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=noware.co.uk; s=default; t=1595355219; bh=XFoa2jf2uYx9t3a5msSZ2SeO1xtOjR3uDFtYTHdZDKw=; h=Subject:From:In-Reply-To:Date:Cc:References:To:From; b=oV4jv7z+6o7cBCKrg9TtaVqN26KByjbwtkRj9fgKNddZySzjWKJ6scjm7vHewL3uY uo7VuLhFIVuToXppYg7BG5BN2ilzlNKCBeRsIa1FevIXJlwA2dr9QHOv19QD8hWEQr RdEzdmKx55IhZZMFxi+fYQBmZbqRc/urAMNWxaFA= Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) From: Neil Cook In-Reply-To: <20200721073934.GA29757@nic.fr> Date: Tue, 21 Jul 2020 19:14:47 +0100 Cc: Eric Rescorla , Andrew Campling , "add@ietf.org" , Martin Thomson Content-Transfer-Encoding: quoted-printable Message-Id: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <20200721073934.GA29757@nic.fr> To: Stephane Bortzmeyer X-Mailer: Apple Mail (2.3608.80.23.2.2) X-VADE-SPAMSTATE: clean X-VADE-SPAMSCORE: -100 X-VADE-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgeduiedrgeeigdduudejucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecupffgkffnvefqqffmnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenucfjughrpegtggfuhfgjfffgkfhfvffosehtqhhmtdhhtdejnecuhfhrohhmpefpvghilhcuvehoohhkuceonhgvihhlrdgtohhokhesnhhofigrrhgvrdgtohdruhhkqeenucggtffrrghtthgvrhhnpeefkeejhedtheefgfetfedugfekleetkeevhffgheeltedtueeiuefhtedtjefhjeenucfkphepkedurdduheeirddvvdegrdelleenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpeekuddrudehiedrvddvgedrleelpdhhvghloheplgduledvrdduieekrddurddujedtngdpmhgrihhlfhhrohhmpefpvghilhcuvehoohhkuceonhgvihhlrdgtohhokhesnhhofigrrhgvrdgtohdruhhkqedprhgtphhtthhopegsohhrthiimhgvhigvrhesnhhitgdrfhhrpdhrtghpthhtohepvghkrhesrhhtfhhmrdgtohhmpdhrtghpthhtoheprghnughrvgifrdgtrghmphhlihhnghesgeduledrtghonhhsuhhlthhinhhgpdhrtghpthhtoheprgguugesihgvthhfrdhorhhgpdhrtghpthhtohepmhhtsehlohifvghnthhrohhphidrnhgvth Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 18:14:51 -0000 > On 21 Jul 2020, at 08:39, Stephane Bortzmeyer = wrote: >=20 > On Mon, Jul 20, 2020 at 05:43:02PM -0700, > Eric Rescorla wrote=20 > a message of 111 lines which said: >=20 >> With that said, I have some concerns about the objective of having >> the CPE in the user's resolution path. While I certainly can >> understand the reasons you consider it advantageous, it seems to me >> that it significantly weakens the user's security posture. Even >> assuming arguendo that we have a secure mechanism for discovering >> this case, in practice the CPE seems to have quite a high rate of >> security issues, including specifically DNS hijacking (see for >> instance [0]). >=20 > Even without hijacking by a third-party (cracker with hoodie), the > local router is often controlled by the access provider which may be > the party you precisely want to work around. If you want to use DoE to > avoid the provider's lying resolver, using their router is not a smart > move. >=20 What does this comment have to do with ADD? People are free to choose = their CPE. If you don=E2=80=99t want to use the access provider=E2=80=99s = resolver, use a different one. Neil From nobody Tue Jul 21 11:21:49 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F26703A0E02 for ; Tue, 21 Jul 2020 11:21:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.306 X-Spam-Level: X-Spam-Status: No, score=-1.306 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RDNS_NONE=0.793, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=noware.co.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VS2j8Kr6QIn5 for ; Tue, 21 Jul 2020 11:21:46 -0700 (PDT) Received: from mail.noware.co.uk (unknown [IPv6:2604:a880:0:1010::add:2001]) by ietfa.amsl.com (Postfix) with ESMTP id 6480E3A0DFF for ; Tue, 21 Jul 2020 11:21:46 -0700 (PDT) Received: from [192.168.1.170] (unknown [81.156.224.99]) by mail.noware.co.uk (Postfix) with ESMTPSA id D4CE41DB3D6; Tue, 21 Jul 2020 18:20:35 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.noware.co.uk D4CE41DB3D6 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=noware.co.uk; s=default; t=1595355636; bh=4SPLhogW5qYXTFBogNole25YWYLFdg3QYjAyjNemNY8=; h=Subject:From:In-Reply-To:Date:Cc:References:To:From; b=d6QCBn9s3YvfdZ9Q5tFybosMohf+U/5VccvMTgEzorVK4sbALP2C/eiUPYMW9NwQU EGHTewIcFXoY/T2I+ap91btUd8sOdMse3w4Sg5VDqTirC5MT71SsWOO91q9lFMKjRz OS3EU3mQgeKlhzYNhQTum+9ehaIFU4Kz1uLr8No0= Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) From: Neil Cook In-Reply-To: Date: Tue, 21 Jul 2020 19:21:44 +0100 Cc: Andrew Campling , Martin Thomson , "add@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> To: Eric Rescorla X-Mailer: Apple Mail (2.3608.80.23.2.2) X-VADE-SPAMSTATE: clean X-VADE-SPAMSCORE: -100 X-VADE-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgeduiedrgeeigdduudelucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecupffgkffnvefqqffmnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenucfjughrpegtggfuhfgjfffgkfhfvffosehtqhhmtdhhtdejnecuhfhrohhmpefpvghilhcuvehoohhkuceonhgvihhlrdgtohhokhesnhhofigrrhgvrdgtohdruhhkqeenucggtffrrghtthgvrhhnpeefkeejhedtheefgfetfedugfekleetkeevhffgheeltedtueeiuefhtedtjefhjeenucfkphepkedurdduheeirddvvdegrdelleenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpeekuddrudehiedrvddvgedrleelpdhhvghloheplgduledvrdduieekrddurddujedtngdpmhgrihhlfhhrohhmpefpvghilhcuvehoohhkuceonhgvihhlrdgtohhokhesnhhofigrrhgvrdgtohdruhhkqedprhgtphhtthhopegvkhhrsehrthhfmhdrtghomhdprhgtphhtthhopegrnhgurhgvfidrtggrmhhplhhinhhgseegudelrdgtohhnshhulhhtihhnghdprhgtphhtthhopehmtheslhhofigvnhhtrhhophihrdhnvghtpdhrtghpthhtoheprgguugesihgvthhfrdhorhhg Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 18:21:48 -0000 > On 21 Jul 2020, at 01:43, Eric Rescorla wrote: >=20 >=20 > With that said, I have some concerns about the objective of having the > CPE in the user's resolution path. While I certainly can understand > the reasons you consider it advantageous, it seems to me that it > significantly weakens the user's security posture. It doesn=E2=80=99t weaken the security posture vs the current situation, = which Andrew=E2=80=99s draft attempts to detail, and which is very = widely deployed, i.e. CPEs forwarding Do53 to a Do53 recursor. > Even assuming > arguendo that we have a secure mechanism for discovering this case, > in practice the CPE seems to have quite a high rate of security > issues, including specifically DNS hijacking (see for instance [0]). > One of the advantages of Do[TH] from client to recursive is that > it has the potential to mitigate attacks from attackers on the network > -- including the local router -- and this seems like it would regress > that. >=20 It=E2=80=99s not perfect (nothing is), but it=E2=80=99s better than the = status quo.=20 Neil From nobody Tue Jul 21 11:36:49 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 252203A0486; Tue, 21 Jul 2020 11:36:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.918 X-Spam-Level: X-Spam-Status: No, score=-1.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nbcuni.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ICgljn5L7pLi; Tue, 21 Jul 2020 11:36:46 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0a-00176a04.pphosted.com [67.231.149.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 782743A0477; Tue, 21 Jul 2020 11:36:46 -0700 (PDT) Received: from pps.filterd (m0048276.ppops.net [127.0.0.1]) by m0048276.ppops.net-00176a04. (8.16.0.42/8.16.0.42) with SMTP id 06LISSID015075; Tue, 21 Jul 2020 14:36:46 -0400 Received: from usushmgip003.mail.tfayd.com ([216.178.109.222]) by m0048276.ppops.net-00176a04. with ESMTP id 32bt0uxcjk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 21 Jul 2020 14:36:45 -0400 IronPort-SDR: NQ/U7ya0kemhjf/l3G5iyBIrFT+gVjcIU9Gk09LBpsl+ZLCmBtpiJIgUHYKhDS0P3Ofk+TrJMK UcO6oW7/flrQ== Received: from unknown (HELO potemwp00004.mail.tfayd.com) ([100.124.56.28]) by USUSHMGIP003.mail.tfayd.com with ESMTP/TLS/ECDHE-RSA-AES128-SHA256; 21 Jul 2020 14:36:46 -0400 Received: from potemwp00001.mail.tfayd.com (100.124.56.25) by potemwp00004.mail.tfayd.com (100.124.56.28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1913.5; Tue, 21 Jul 2020 12:36:43 -0600 Received: from NAM04-BN3-obe.outbound.protection.outlook.com (10.40.33.204) by potemwp00001.mail.tfayd.com (100.124.56.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1913.5 via Frontend Transport; Tue, 21 Jul 2020 12:36:43 -0600 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=lYvVXe8i5y5CsDg9G4Sm7xFIgeglF8qk+mxubMg63uBmdhNWyTB+D5WRc4RHnKSCSbj2ffCsYR5sIvVTZVBS2ce7qYpKocrwlCxfbDTpfozlIFgACsfYT9JuzdP3joRlBJOmlf5EC+Cz565Q6dOwjmoJs//tf0z/d3PG8f//7OhzHtVOcM9shWYLCTvleqMhLV3Gzhd+/Zqy/F/gKaLpGKiPmNaBKf8ul7rnR4ca6MOGSP+QKi8Eh5g+tDqlwpr3k6ui5uSbIet01Awf14VfCxRLJMy+dgPvM66hkv2dDPgyjgrDHyRGSJCkDi5NrbHHdRBCLdc8R/j+h5l5ADt+Og== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OuotqWqTBLGOX7oRrbx5r/ReBkE9gDlY5e7QFCsxCEQ=; b=DS4vbWkN8IAUxwf9QmAuZ7EmwcHCJA5mkAgqvJPliXgvWnV6Xaz/YHGudOVj3TALYbIFjGgvUo8ErxOyEdFJGInQsuwXSovV0RM1aZLikwOfDYI+WyFvkTBSFQukDT0e6C1C5tcav8LiSwrqUzGrkdivpdqQjvBM2w2oLRWLQLkA5fxYmR057n3NuOAk7IVNBkgWnCaA3c217Gxd4+J9ymCVDAwVwb9SW8aaLZeytf+l/hIRxhoiH4hDrXwfE1NYnzZbIqt5oI5KrHSgX+UpJIonHJVsMRFllnasNbaa+nqHNAv5QqXFc97wtV6w4+gtF/XOCUdvR5Y/zrkJuUN0/w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nbcuni.com; dmarc=pass action=none header.from=nbcuni.com; dkim=pass header.d=nbcuni.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NBCUNI.onmicrosoft.com; s=selector1-NBCUNI-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OuotqWqTBLGOX7oRrbx5r/ReBkE9gDlY5e7QFCsxCEQ=; b=W6MLUV/uD0BnF8ZFFpSue+kDYyH42MLQ5IxbbkX+WriFOntyVdQKS5ZagQPqJgJzVA8OtjkEdKP7Lg0Ubixa0icIgjJxWdDrRYwSWeQtfZvdzaKe+7XmSLCHdr4m3Jg2KTqsCNS5D+aZ4Cee64LUpkeOlts0+pQfdg0yCUKzI1k= Received: from BYAPR14MB3094.namprd14.prod.outlook.com (2603:10b6:a03:14d::30) by BYAPR14MB2375.namprd14.prod.outlook.com (2603:10b6:a02:b8::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.23; Tue, 21 Jul 2020 18:36:41 +0000 Received: from BYAPR14MB3094.namprd14.prod.outlook.com ([fe80::e074:901e:d085:be5c]) by BYAPR14MB3094.namprd14.prod.outlook.com ([fe80::e074:901e:d085:be5c%7]) with mapi id 15.20.3195.025; Tue, 21 Jul 2020 18:36:41 +0000 From: "Deen, Glenn (NBCUniversal)" To: ADD Mailing list CC: "add-chairs@ietf.org" Thread-Topic: [Add] IETF108 ADD Agenda Thread-Index: AQHWX43gW0i/OVGfEUm73otto4bpsQ== Date: Tue, 21 Jul 2020 18:36:41 +0000 Message-ID: <9BFAE6FB-C6BE-4F08-92DD-5F3A151B4478@nbcuni.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=nbcuni.com; x-originating-ip: [2605:e000:141b:121:9442:a71d:7b0a:7e04] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e1819edf-c08c-4f4b-0e77-08d82da502cd x-ms-traffictypediagnostic: BYAPR14MB2375: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: ZCRX6cZjn+vmh+PQkEjKhQts3ZrWqf3dik3XTmuechNCva2uXul2G7cItD7tfPvl6JuFxGXUk7lcBx1Ergls/kZNXEK6/Ty04akbbbv8R5IXob0rYwCDN+Wau6DCz8/nIeQYL1UbIVcJdRjcPfcnW8ExscCsQlRZZb8M+mt1UZbqCphLw68JtNyxcN+OMK6VdkWX1zQtnyHFd12kG4o584qsuUSY1HzdfR9gcxXnlO1el7EmmN4ssAQIe4kP9I2PLMKYAW2wx3gX3ByIHYlGJS34erXuvcNl+CplIRypF40eOFV18F03SeYrMlSoRMTSAc8i+0TcL9U4wjYrlS2kuw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR14MB3094.namprd14.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(136003)(396003)(346002)(376002)(39860400002)(66446008)(66946007)(64756008)(66556008)(66476007)(316002)(6486002)(71200400001)(2616005)(76116006)(86362001)(83380400001)(478600001)(6512007)(36756003)(6916009)(8936002)(450100002)(6506007)(5660300002)(2906002)(4326008)(8676002)(33656002)(186003)(53546011); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: py/yu4MJLE8QziDoGVguS3pb0JFqQzTJyl9eYsKvk1T26HSCMZLqBFBsdZ4qsdCSlU4QrboGjUDyBtdYZj6uN2PeExkmgH5GL2lahgDUgBINl8VOQAqtVeqd1hAYI1OauPo9l4+oX7u8Ww3ER9xT3NdheynYCeVkusE0JiCB/hAy06hfEMGr9oolym5l2oz1vPoHTSEr7mLh9oGx1WE2TeiVgOE6PGooCruh44G5fm9Tor0+ybkFi/XBzMIAIF8iIMBJjQfTu85GzrpBZSoeQ3W/U+4J1fK8fb0LQb5KTLJT+baXWhTuSbG906TyFLbrf8HR6x8/Z6uPSwLpycs9ZdIWYD8Ju7ERQoJsykwRliX+zm5StRUHr+zYVfP8/s9jtng6rZpDrjoEeE54RjE0cSHflo7Cp1Z+zRWt8BSXaU+1mj1gs4iNagsc9eXj5HkD/8QRHDiobRC1SVXRVqCHMIDRBwSuVSxldJWb6AOptqu487fl8d0+cegFAj4G9x5P2YQ6qlvBGEr67eN2u5wVEVb1WCFSYnJpY04mnZ3UPJ+8kF1CqL7i//9ZpiVv+m2M x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_9BFAE6FBC6BE4F0892DD5F3A151B4478nbcunicom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BYAPR14MB3094.namprd14.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: e1819edf-c08c-4f4b-0e77-08d82da502cd X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2020 18:36:41.1272 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4f3526f9-97d6-412d-933a-4e30a73110f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: XQiZgUzcfYb0FXAoSSl6LvLtip/f9cySUd4JYzVu2SkN2Xim511Su2edKOO+awmvUqxwG4ZELShPLppQpnne/Q== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR14MB2375 X-OriginatorOrg: nbcuni.com X-EXCLAIMER-MD-CONFIG: 47edc00f-f2d6-45ef-be83-8a353bd47e45 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-21_12:2020-07-21, 2020-07-21 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 mlxlogscore=999 lowpriorityscore=0 suspectscore=0 adultscore=0 phishscore=0 mlxscore=0 bulkscore=0 spamscore=0 clxscore=1011 impostorscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007210122 Archived-At: Subject: Re: [Add] IETF108 ADD Agenda X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 18:36:48 -0000 --_000_9BFAE6FBC6BE4F0892DD5F3A151B4478nbcunicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Q2hyaXMsDQoNCk9uIDcvMjEvMjAsIDEwOjQ3IEFNLCAiQWRkIG9uIGJlaGFsZiBvZiBDaHJpcyBC b3ggKEJUKSIgPGFkZC1ib3VuY2VzQGlldGYub3JnPG1haWx0bzphZGQtYm91bmNlc0BpZXRmLm9y Zz4gb24gYmVoYWxmIG9mIGNocmlzLmJveC5pZXRmQGdtYWlsLmNvbTxtYWlsdG86Y2hyaXMuYm94 LmlldGZAZ21haWwuY29tPj4gd3JvdGU6DQoNCldoZW4gZG8gdGhlIGNoYWlycyBleHBlY3QgZGlz Y3Vzc2lvbiB0byB0YWtlIHBsYWNlIG9uIHNlbGVjdGluZyBhIGNvaGVyZW50IHNldCBvZiBkcmFm dHMgdG8gbW92ZSBmb3J3YXJkIHdpdGg/IFdpbGwgdGhpcyBiZSBvbiB0aGUgbGlzdCBhZnRlcndh cmRzLCBvciBpcyB0aGlzIHBsYW5uZWQgZm9yIHRoZSBpbnRlcmltIG1lZXRpbmc/IEknbSBob3Bp bmcgd2UgZG9uJ3QgbmVlZCB0byB3YWl0IHVudGlsIFNlcHRlbWJlciBmb3IgdGhhDQoNClRoZSBk aXNjdXNzaW9uIHNob3VsZCBiZSBoZWxkIHByaW1hcmlseSwgYW5kIGFwcGVhcnMgdG8gYmUgZ29p bmcgdmVyeSBhY3RpdmVseSByZWNlbnRseSwgb24gdGhlIEFERCBsaXN0LiAgVGhlIFNlcHRlbWJl ciBwcm9wb3NlZCBkYXRlcyBhcmUgIGFjdHVhbGx5IG9ubHkgYWJvdXQgNiB3ZWVrcyBhZnRlciBJ RVRGMTA4IGFuZCB3aXRoIGEgbG90IG9mIHBlb3BsZSB0cmFkaXRpb25hbGx5IGJlaW5nIG91dCBv biB2YWNhdGlvbiBpbiBBdWd1c3QsIGl04oCZcyB2ZXJ5IGxpa2VseSB0aGF0IHdl4oCZbGwgc2Vl IGEgY2FsbWluZyBvZiBhY3Rpdml0eSBkdXJpbmcgQXVndXN0IHRoYXQgYW5kIHRoZW4gcGljayB1 cCBpbiBTZXB0ZW1iZXIgaW4gdGltZSBmb3IgdGhlIGludGVyaW0uICBUaGUgU2VwdGVtYmVyIElu dGVyaW0gYWxzbyB3aWxsIHBlcm1pdCBtb3JlIGV4dGVuc2l2ZSBkaXNjdXNzaW9uIGFuZCBjb21t ZW50cyBiZWNhdXNlIHdlIGNhbiBzY2hlZHVsZSBtb3JlIHRpbWUgZm9yIGl0LiAgICBPZiBjb3Vy c2UgdGhpcyBpcyBhbGwgc2xvd2VyIHRoYW4gZG9pbmcgaXQgaW4gcGVyc29uIHdvdWxkIGhhdmUg YmVlbiwgYW5kIG5vdCBuZWFybHkgYXMgbmljZSBhcyBiZWluZyBpbiBNYWRyaWQsIGJ1dCBpdCBp cyB3aGF0IGl0IGlzLg0KDQoNCi1nbGVubg0K --_000_9BFAE6FBC6BE4F0892DD5F3A151B4478nbcunicom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6IlRpbWVzIE5ldyBSb21hbiBcKEJvZHkgQ1NcKSI7DQoJcGFub3NlLTE6MiAyIDYgMyA1 IDQgNSAyIDMgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1z b05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAw MDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLkVtYWls U3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseTpI ZWx2ZXRpY2E7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5 bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0 aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4w aW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxl Pg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPkNocmlzLDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRp Y2EiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPk9uIDcvMjEvMjAsIDEwOjQ3IEFN LCAmcXVvdDtBZGQgb24gYmVoYWxmIG9mIENocmlzIEJveCAoQlQpJnF1b3Q7ICZsdDs8YSBocmVm PSJtYWlsdG86YWRkLWJvdW5jZXNAaWV0Zi5vcmciPmFkZC1ib3VuY2VzQGlldGYub3JnPC9hPiBv biBiZWhhbGYgb2YNCjxhIGhyZWY9Im1haWx0bzpjaHJpcy5ib3guaWV0ZkBnbWFpbC5jb20iPmNo cmlzLmJveC5pZXRmQGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+V2hlbiBkbyB0aGUgY2hhaXJzIGV4cGVjdCBkaXNjdXNzaW9uIHRv IHRha2UgcGxhY2Ugb24gc2VsZWN0aW5nIGEgY29oZXJlbnQgc2V0IG9mIGRyYWZ0cyB0byBtb3Zl IGZvcndhcmQgd2l0aD8gV2lsbCB0aGlzIGJlIG9uIHRoZSBsaXN0IGFmdGVyd2FyZHMsIG9yIGlz IHRoaXMgcGxhbm5lZCBmb3IgdGhlIGludGVyaW0gbWVldGluZz8gSSdtIGhvcGluZyB3ZSBkb24n dA0KIG5lZWQgdG8gd2FpdCB1bnRpbCBTZXB0ZW1iZXIgZm9yIHRoYTxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYSI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYSI+VGhlIGRpc2N1c3Npb24gc2hvdWxkIGJlIGhl bGQgcHJpbWFyaWx5LCBhbmQgYXBwZWFycyB0byBiZSBnb2luZyB2ZXJ5IGFjdGl2ZWx5IHJlY2Vu dGx5LCBvbiB0aGUgQUREIGxpc3QuJm5ic3A7IFRoZSBTZXB0ZW1iZXIgcHJvcG9zZWQgZGF0ZXMg YXJlICZuYnNwO2FjdHVhbGx5IG9ubHkgYWJvdXQgNiB3ZWVrcyBhZnRlciBJRVRGMTA4IGFuZCB3 aXRoIGEgbG90IG9mDQogcGVvcGxlIHRyYWRpdGlvbmFsbHkgYmVpbmcgb3V0IG9uIHZhY2F0aW9u IGluIEF1Z3VzdCwgaXTigJlzIHZlcnkgbGlrZWx5IHRoYXQgd2XigJlsbCBzZWUgYSBjYWxtaW5n IG9mIGFjdGl2aXR5IGR1cmluZyBBdWd1c3QgdGhhdCBhbmQgdGhlbiBwaWNrIHVwIGluIFNlcHRl bWJlciBpbiB0aW1lIGZvciB0aGUgaW50ZXJpbS4mbmJzcDsgVGhlIFNlcHRlbWJlciBJbnRlcmlt IGFsc28gd2lsbCBwZXJtaXQgbW9yZSBleHRlbnNpdmUgZGlzY3Vzc2lvbiBhbmQgY29tbWVudHMN CiBiZWNhdXNlIHdlIGNhbiBzY2hlZHVsZSBtb3JlIHRpbWUgZm9yIGl0LiZuYnNwOyZuYnNwOyZu YnNwOyBPZiBjb3Vyc2UgdGhpcyBpcyBhbGwgc2xvd2VyIHRoYW4gZG9pbmcgaXQgaW4gcGVyc29u IHdvdWxkIGhhdmUgYmVlbiwgYW5kIG5vdCBuZWFybHkgYXMgbmljZSBhcyBiZWluZyBpbiBNYWRy aWQsIGJ1dCBpdCBpcyB3aGF0IGl0IGlzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTpIZWx2ZXRpY2EiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPi1nbGVu biA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+ DQo8L2h0bWw+DQo= --_000_9BFAE6FBC6BE4F0892DD5F3A151B4478nbcunicom_-- From nobody Tue Jul 21 11:42:39 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6628B3A053E for ; Tue, 21 Jul 2020 11:42:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.089 X-Spam-Level: X-Spam-Status: No, score=-2.089 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FREEMAIL_DOC_PDF=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LMpvd0-0mVxe for ; Tue, 21 Jul 2020 11:42:34 -0700 (PDT) Received: from mail-qv1-xf2e.google.com (mail-qv1-xf2e.google.com [IPv6:2607:f8b0:4864:20::f2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E13C3A0522 for ; Tue, 21 Jul 2020 11:42:33 -0700 (PDT) Received: by mail-qv1-xf2e.google.com with SMTP id e3so9779635qvo.10 for ; Tue, 21 Jul 2020 11:42:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language; bh=lA00gZ8+gQilcWOjMqtM9JVBRoWE1bmrKIFzDEn2Jgo=; b=oLp48V4ZfJOULsQ94TXXO0KleWr2H0AXlk8E25g/gV9arWuFX7oqlhXoBl+kQ6vAOG WP3yhflWTBK/JGrU5eXfaiO9fJ9nb8w5jAuIDxOqtEd65nJzZqXSNrhWAma3V7ySGKiG apuWJSkQrz74XwVJ4eTlBnqD/NLcAcwSVAdi1se4oGFsak/fsP9B8YorDK4OT/uXLMdE UIJLt1o+53+RKVQDGVUWSrPnZoPGQQdNYO3zjped8cVNWuhN6gOAVoWE1nweM/C/QM4O AChXhYsLQygPAPm7h4qzae7Rf+x2TnelQPKAK6DSEkethyICtGLcUMNJne9X4lnwQ6rV EDzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language; bh=lA00gZ8+gQilcWOjMqtM9JVBRoWE1bmrKIFzDEn2Jgo=; b=kSgDQ1bXOR1C+ZFkAIsGsdTr1anDtXsoId4iJYK/6HD9ftJBMezRcLlzL35E2ikzxE nUGfZ7wzeudbg9OLdsPwHLY+OIU3fomsF11FSyjnRI8Q4Qzh7TYOn0RKVPA8VKYz45Vv Y/SLs7Rhjmw8py5ccAysRxgjSa6PYNYCnb7DXF+9IrTqS43XAeSpi8GFYKBMR12HpUlt 4F09ml5zFnlK5mrphYEwEwxb03g+7WqXEhpt9IP82INNlG9PR8psgk0UrjVj5GCGqdlr McRw8bxT/9Irz7h2Jk4sIZifbeaS2BA4ZMywdK8tHwO9LviM/qin3P2ZDFQi0/z+Lz7q FuvA== X-Gm-Message-State: AOAM530j8X33cdZbu+cX+CS/8vJuQOCsihBUaIvFW7YhnyxXSbszfR5u C3wDmFYO3Uw5RmWb6GXDbGzvvg8Ltgs= X-Google-Smtp-Source: ABdhPJwH7sEHyP7JB905N+vh13htOzY6tSl9RzDhcCMSqoCUHvLUsjqXfdDmbVUV+r8/9vD2xA4RqA== X-Received: by 2002:a0c:df92:: with SMTP id w18mr28493926qvl.0.1595356950590; Tue, 21 Jul 2020 11:42:30 -0700 (PDT) Received: from [192.168.1.249] (pool-70-106-222-98.clppva.fios.verizon.net. [70.106.222.98]) by smtp.gmail.com with ESMTPSA id q4sm887738qte.19.2020.07.21.11.42.25 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 21 Jul 2020 11:42:26 -0700 (PDT) To: Paul Vixie , "add@ietf.org" References: <20200721074235.GB29757@nic.fr> <8646010.mL01ujt3hu@linux-9daj> From: Tony Rutkowski Message-ID: <452c8cf6-d32e-6971-7839-2275a3565d15@gmail.com> Date: Tue, 21 Jul 2020 14:42:25 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: <8646010.mL01ujt3hu@linux-9daj> Content-Type: multipart/mixed; boundary="------------28E9D1F09DD3434BEF3A563D" Content-Language: en-US Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 18:42:38 -0000 This is a multi-part message in MIME format. --------------28E9D1F09DD3434BEF3A563D Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Hi Paul, Perhaps given your model, you might appreciate the CPE (a/k/a middlebox) protocol initiative to provide shared endpoint and provider control of CPE discovery and behavior. The challenges here are non-trivial. The near final version of the baseline part is attached.  Significant credit should be given to David Naylor as it originated as his CMU PhD thesis. I also haven't forgot our previous dialogue on competition complexities, but chose to spend the time researching and writing on CircleID. http://www.circleid.com/posts/20200711-addressing-anticompetitive-behaviur-in-internet-standards-bodies/ Over the past 30 years, the IETF's track record in understanding the adverse effects of actions relating to competition, trust, and security has been mixed at best. best, tony On 21-Jul-20 12:49 PM, Paul Vixie wrote: > On Tuesday, 21 July 2020 10:09:34 UTC Andrew Campling wrote: >> On Tuesday, Jul 21, 2020 at 08:43, Stephane Bortzmeyer > wrote: >>> Also, I strongly object to this "my network, my policy" principle. I >>> want Internet access providers to be neutral tubes, not to force their >>> policies onto me. >> I feel that this is again straying into policy areas and is therefore out of >> scope for the ADD charter and list. > part of it is in-scope, and stephane's misunderstanding as quoted above > illuminates this perfectly. i, like him, do not expect my ISP to have a policy > beyond anti-abuse, because they have no enforcement capability beyond that, > and because they do not also own the end-devices nor employ or parent the end- > users. anti-abuse means if they let their users spam or ddos, or if they host > harmful content, they'll face consequences. however for the purpose of this WG > i will stipulate that an ISP ought not dictate DNS policy to its customers. > > the misunderstanding comes in the network-of-networks concept. my edge network > is not an ISP. it's a LAN, perhaps containing a bridged WLAN, or a small or > virtual campus containing many LANs. the edge is a private artifact, crafted > by me in the case of my family and my day job, paid for by my family or my > company. all devices connected to the edge network are owned by the same > family or company who constructed and operates that network, and who pays for > an ISP connection to connect this network to the rest of the network of > networks ("internet"). > > in the hierarchy of responsibility, ISP's have far less than edge network > operators. exercise of whatever responsibilities a network (ISP or edge) > operator should not be challenged nor should this hierarchy be upended by new > protocol standards such as those discussed in this WG. there's already a Tor > project, and there are hundreds of private tunnel methods available on github, > so that hostile use of an edge network ("hostile" meaning the user disagrees > with the owner/operator's policies) can proceed. > > a solid engineering plan and associated protocol for DNS discovery would allow > an edge network operator to reliably express its resources and policies to > connected devices, and to reliably detect and prohibit violations of that > policy. if DHCP is inadequate to tell devices what DNS server to use and what > protocols and crypto algs and keys to use, then we should define a new way to > do that which lacks DHCP's inadequacies. but we should also respect the edge > network operator's ability to set and enforce policy for the private network > they build, operate, and pay for. > > "should" in this case is not because of ethics, but because of practicalities: > corporate, private, government, military, and other sensitive networks _will > not_ have their architecture dictated to them. sometimes this is by law, or by > regulation, or enlightened self interest (defense) or just plain stubbornness. > if the new way to DNS disintermediates edge network policy, then the result > will be some combination of losses due to disappearance of defense technology, > and explicit edge proxies which force cleartext inspection of traffic. > > the IETF should not implicitly legislate edge network policy by creation of > new standards. and if i see that trying to happen on the ADD list, i will > object, because that objection will be on-topic. > > apple has done a lot of work in the area of discovering local-network policy, > i believe it relies on broadcast/multicast as a way to differentiate between > edge operators (who can hear multicast from a connected device) and ISP's (who > cannot). while there are some weaknesses like authentication, the model is > sound: it assumes that the local network operator knows what policy they want > or need or are required to implement, and ISP's have no role in it other than > offering resources. > > this is why i think glenn's tri-color model is essential for our discussions. > > (sometimes i'm told that edge networks are an anachronism and that the > internet should be considered public from end to end. i don't know what to > tell folks except, please get out there and try to sell that idea and see who > bites, but don't ram it down anybody's throat if they just plain disagree. the > first few thousand networks to join the "network of networks" ("Internet") > were all privately owned and operated. third-party transit came later.) > --------------28E9D1F09DD3434BEF3A563D Content-Type: application/pdf; name="CYBER-0027-1v0025.pdf" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="CYBER-0027-1v0025.pdf" JVBERi0xLjcNCiW1tbW1DQoxIDAgb2JqDQo8PC9UeXBlL0NhdGFsb2cvUGFnZXMgMiAwIFIv TGFuZyhlbi1VUykgL1N0cnVjdFRyZWVSb290IDI1OCAwIFIvTWFya0luZm88PC9NYXJrZWQg dHJ1ZT4+L01ldGFkYXRhIDU0MzUgMCBSL1ZpZXdlclByZWZlcmVuY2VzIDU0MzYgMCBSPj4N CmVuZG9iag0KMiAwIG9iag0KPDwvVHlwZS9QYWdlcy9Db3VudCA1OC9LaWRzWyAzIDAgUiAy NSAwIFIgMzUgMCBSIDQ0IDAgUiA0OCAwIFIgNTAgMCBSIDU2IDAgUiA2MyAwIFIgNzEgMCBS IDc5IDAgUiA5NiAwIFIgMTA1IDAgUiAxMDkgMCBSIDExMSAwIFIgMTEzIDAgUiAxMTcgMCBS IDExOSAwIFIgMTIxIDAgUiAxMjMgMCBSIDEyNSAwIFIgMTI4IDAgUiAxMzAgMCBSIDEzMiAw IFIgMTM0IDAgUiAxNDggMCBSIDE1MCAwIFIgMTc2IDAgUiAxNzggMCBSIDE4MCAwIFIgMTgy IDAgUiAxODQgMCBSIDE4NiAwIFIgMTg4IDAgUiAxOTAgMCBSIDE5MiAwIFIgMTk0IDAgUiAx OTYgMCBSIDE5OCAwIFIgMjAwIDAgUiAyMDIgMCBSIDIwNCAwIFIgMjA2IDAgUiAyMDggMCBS IDIxMCAwIFIgMjEyIDAgUiAyMjQgMCBSIDIzNCAwIFIgMjM2IDAgUiAyMzggMCBSIDI0MCAw IFIgMjQyIDAgUiAyNDQgMCBSIDI0NiAwIFIgMjQ4IDAgUiAyNTAgMCBSIDI1MiAwIFIgMjU0 IDAgUiAyNTYgMCBSXSA+Pg0KZW5kb2JqDQozIDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50 IDIgMCBSL1Jlc291cmNlczw8L1hPYmplY3Q8PC9JbWFnZTUgNSAwIFI+Pi9FeHRHU3RhdGU8 PC9HUzYgNiAwIFIvR1M5IDkgMCBSPj4vRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9GMyAx MiAwIFIvRjQgMTQgMCBSL0Y1IDE2IDAgUi9GNiAyMSAwIFIvRjcgMjMgMCBSPj4vUHJvY1Nl dFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNTk1 LjMyIDg0Mi4wNF0gL0NvbnRlbnRzIDQgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5z cGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyAwPj4NCmVuZG9i ag0KNCAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMTY1Pj4NCnN0cmVh bQ0KeJzFWd9vGkcQfkfif9jHu0rs7ezvbS1LBoNDFCduQK0qNw8XfKGohnPIWW3++8weTYq4 W0PNktovJ7jZ75uZnW9nluxiXS0+5LOKnJ1lF1WVz/4o7shtNi0f3mXTzw9FdpPPF6u8WpSr bPL4vvIfvSjyu2J9fk76lwOSXU00mX/qdj52O0JSTZTQ1EmiOKOCcK6pIuui2/n1B7Lqdjaf MvzffLNtMVt2O9l4mc8LRS5L8nO9JKPM/1lrAI2UU1RwYiWnTG4t25+i6QiII9MP3Q7UAEDw LU2sEFRLMsXFGZnja1cTV/Nl5KrbuU1I+o5MX3Y7Q1wCIcnwGn0KRKVfVlW5DAdmVJbVt8D8 R/J8hzx3hhpDgFO+xb6ddCQo6vg+pDo8JJs85Csfm+vB+JKw7FW+mpOkWPWu+unzvBfEUaeb 2TPgKNfPYQUnZKWdpWZvVtpY8VOyMpbyZ2VQnJKVMtQ+i5U8JSthUIcOIeVlTRBjmFcRxesQ C0eBb2HtEFcB4nvX2XCWRNS+bJMGFErJ0dxR0yyH4XQybkrCEXAcEM61w5EeJgC8pM5uk+kk Lq6WlAdwbxNgApcUMQGFZRQgBNiLCuXQzgR9iwklmaVKhaCOyBie3rtQYKgUIahfokIJRk3Q KxYVSoLvSAJQNC4UBlB/H6+UpTooInG9wkKGQAC9gADjtX5wFRXVaiqCaTti34NqnCIOqA2m 7feEH5G5JppCPQ7JsT8ONd/IcWRUVBYd9PEIcWyDspSdogpaoKR+orZNVCilfO8T2iRpzL2v NHiDw/b+VnMjhW/7BeMUwRUwL0Zglc9GsMHRgQbnoLW+zmp4cDROfxwJDZEG/JGy68Ig7fHk t1Qlff8wxIe3jfgdSUDgTMpFiMBP0eEE+AMtAHdAh2xOkwew4C2kQokzDV7XCwz93Z1Pwn0q kuJ9mfZE8ndTXY/dDVgI2AsGWEyiw6HTOghXzFKdPK4X6HD1Obqrwg8vJoR9Ex1OCSqDcOuy KmflfWxQCUAhGN/otSVBUwMhuANqy56mtixOwyjvEo9WAc1U5+uKYHnBj9H3GEhVF3U78PUk +i4Dy/3IGgCM7x9GFkQIbrROTZIvi79SmZTrPwnWcb7yOha/lv1AZEI8psXy4T6vvG5GB3a8 Pry+U7yFwzYKQnBvMc7Fx0f000vmulh6j1fVp2NY8BYW3kIEyym60wp7PHbonm5TFXeizsk5 ylBcgVOzt5PYbv78XZhAKEm59euabby9L5Ds5t/7VrblzZNWGzdU21BV2zkqGg3sGWMwOm91 Y/feN3Txewip1iZeU2vbWT0VWUWMt+TfsokDsZXhnhpCV8P7V9pw182rTqWk364GRwO99wr2 KPKhG+T/g7ygStc9LKowtQQfuH6Ke+ieee9CX/fMzq9O9Q7iyF7t/YlgmzbzaEo6Pwv4QwSw rLn/LMw8dNF8yFob8qatCjfWOLsaVzsA3gH45wAbDl6kPZW8RkEf40hmkgt8euVHADLBpxv/ NPRvDMaj8eBimvZ0Mn7zuqnER3HkOMRrFSIZiPIXQtmnqQ0KZW5kc3RyZWFtDQplbmRvYmoN CjUgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDYwMC9IZWln aHQgMjU3L0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9GaWx0ZXIv RENURGVjb2RlL0ludGVycG9sYXRlIHRydWUvTGVuZ3RoIDIxNjY5Pj4NCnN0cmVhbQ0K/9j/ 4AAQSkZJRgABAQEASABIAAD/4Q9gRXhpZgAATU0AKgAAAAgABwESAAMAAAABAAEAAAEaAAUA AAABAAAAYgEbAAUAAAABAAAAagEoAAMAAAABAAIAAAExAAIAAAALAAAAcgEyAAIAAAAUAAAA fodpAAQAAAABAAAAkgAAAL4AAABIAAAAAQAAAEgAAAABR0lNUCAyLjYuNgAAMjAxMTowNzow NSAxMjowMjozNgAAA6ABAAMAAAAB//8AAKACAAQAAAABAAACWKADAAQAAAABAAABAQAAAAAA AAAGAQMAAwAAAAEABgAAARoABQAAAAEAAAEMARsABQAAAAEAAAEUASgAAwAAAAEAAgAAAgEA BAAAAAEAAAEcAgIABAAAAAEAAA48AAAAAAAAAEgAAAABAAAASAAAAAH/2P/gABBKRklGAAEB AAABAAEAAP/bAEMACAYGBwYFCAcHBwkJCAoMFA0MCwsMGRITDxQdGh8eHRocHCAkLicgIiwj HBwoNyksMDE0NDQfJzk9ODI8LjM0Mv/bAEMBCQkJDAsMGA0NGDIhHCEyMjIyMjIyMjIyMjIy MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMv/AABEIAFMAxAMBIgACEQED EQH/xAAfAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAA AX0BAgMABBEFEiExQQYTUWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1 Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJma oqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4 +fr/xAAfAQADAQEBAQEBAQEBAAAAAAAAAQIDBAUGBwgJCgv/xAC1EQACAQIEBAMEBwUEBAAB AncAAQIDEQQFITEGEkFRB2FxEyIygQgUQpGhscEJIzNS8BVictEKFiQ04SXxFxgZGiYnKCkq NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqCg4SFhoeIiYqSk5SVlpeY mZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2dri4+Tl5ufo6ery8/T19vf4 +fr/2gAMAwEAAhEDEQA/AKMUIQiKJcuf0+taC26WwBf55TTrWJLO3Mj8uevufSrFnHuY3EvJ PIr6Js+dt06/kEdrhfNmOPahm3dBhfSiafzX4+4OlVricRITTXdmTd3ZD5LhY+pqjPrEUXes W8v5JpfLiBZj2FRWdnNeO0UcIluM4ALfKnbJ9KiUrG8KKteRfk8SKDwcCiLxIrHqD9DVbXtI tbOwRJpvMvscbTjOe5B6L7VgLYFJwFmQD5WLDjGeo49P8ayc5p6I6IUqUkd1ba7FJgE1qRXi SDg1zNvpQn02KcjDkEbkyckHHU9f1qKGeaymCSHK9m9a2TdrnNKnFuy3O0R+4NTxgPyvDelZ NlciVBg1oKxBBBwab1MfhepdiIY4PyuK0LeXDBX/ADrPUieMMOHFTwyb1w3UVjJXOmErHRW0 pXGeRWzby5AIORXK2lwVOxjzWzaz7SOeDXFVgd9KodBG+RVgGs+GTIBFXEbIrjkjsi7ktFA6 UVBQUUUUDCiiigAooooA8CkPmzpF2HJq1NJtiCjjPH4VUtfmnkf8KlnbMoHoK+itrY+cb0bE B4rH1i4KIQDWvn5awdQHm3aIemcmrtczho9SraYihc7f3jj5j0Kj2/z3pEEqWzIk0kaux+Ve PzI5PH86s/Js5+VmPbp/n/ClaMkqilWOMYB7n61oqaFKtJkUumm8a2cRw20LsI943BA3Qkk5 7YNejafo2mWoj0dUimEluJWl8sMXJyC3IwMdh7+xqLQNJTVtNWLUYhttpQNmwq2QuAMg9Oee +a6uC0tIpZJYI4xIfldxye3BP5cV5+IrL4V0OulB7sxrzSolt/KVQFQYUAdMVwmsWSqWG3AJ 5PofWvQptZsJL9rJZf3wYqeCRuHaub163TLd89P6U6MpLSRFVLdHJ6RcPHP5TnkHFdYhyoNc auVv0Yd+D+FddbnMI+ldVrGNR3sy5bPtlA7HirTjy5A46Hg1nr1rVdd8GfUZrKejKpu6sTKe Aw7Vq2ku5RWRbHdEPyq5ZvglawmtDrpy1Oks5exNakTVg2z4ce9bMLcCvPqI9Gmy8p4paYhq GfULO2kEc1zGsh/gzlvy61hZt6GzaW5ZoqpFqdnO5SGbzWHUIpbH1wOPxqy8ixjLbseyk/yo aaHdPUdRVH+2NPEgja6jVjwN2VH5mrqsGUMpBB5BHehxa3BST2YtFFFIZ4BZ8PIPepJv9cah hOy5Yf3hmpph86n1FfR9T5p/CJ1Wsa7G29BPoa2lrL1SMqyygdKtbmadioyhioVhnHQ1b021 uLjV4lghWRhJvAf7pAOeT6VniVWkUgjPHBruPDvl2tlFtTa7/Mx7mqqTtHQlR11NfWdL1PWX VBdxW1uh/wBWpLb/AHJwPyrnxqWqaVqYtI7eeWUq8YOwgyKBhSvrjGcnPpXXR3p/vH86fJdg kEnJHQ+lefGTj7rV0djs9U7MxdJ1S/uQkUumNbptJllKkbn5ye3J4qjr0xXb8uQR1HOK1NTu PPtym9lYjKsp5Bzwa47VtRk+yqJl2S4w354yPrW1ON3e1jOUtLbmbsD3ke0cbjXVwDbEPpXL 6UftN3vA+UdK6tRhRW8tDJvRIUCteP8A49k/3KywO1arjy4APRcVjU6GtFbsS0HyfjT57hrO zu7hFLNHEzKqjJJA4FFquIx71dtI97sSMg1jJ7nTBaI4HThqMnhjULua/wBVN5DCpjWKacNv Y8Ahhjjj7ue9XNWi1vTZLCxt9R1q6maFHmg86UNJK2AfLkUEYHo3A5616PFaxZH7pP8AvkVq QWsOB+5j/wC+RWM8Qk72OmFBtWucbod7rMthqVxNPeL9qu5BF5zHdHBGABtzwGYnqB71XlW0 tdYs9Ov72KzjnDyXE0koTKrjKhiepYgDvhWPXBG7rGiy2L3F7Zq7xTMWkiT+HK7Wx+QI7Aj0 pPDmq2s7vBfRxOWO5XdAcNjnr0Bxn25z2JXN7jlD+v8AhhW99Rnv/X5mzbeIvC9pAsFvrGlR RL0VbqMD+dS/8JX4d/6Dumf+Baf41eFjZEAi1tyD3Ea02S00+GNpJbe2RFGWZkUAD3NcN4Pu d3veRzus3nh/V4T9k1SwmvACRHFcIzSADkYB5OB+npkVTsr280GF3CPPApy0agkkAgNtH0IY fiPSqOvXlpfatBNaQpFa2iuElVApkdxtLD2CkgepbPAGTv8Ahu0vJZ/t11G0MQDeUjZBYtjJ weQAAAM8nk1125KXvbdmcjfPV93fujp1YMoYdCMiilorgO8+fpAdqyr1X+VTkiWEMPrVW3k8 o+TL90/dNTrm2k9Y2/Svoj5x9xVNNuIRLGQRUrptw68oangQSHFWn1MZLocTqlrLbneoJUdc dqsaP4p+xAxTMzR5ypU5I9sV2Vzo6yxkkY9zXGav4TiLs0MyxP8AofwqZ8z1h9xdKcfhqr5n TR+MtOaYobgIcn76ED8yK1JNWz0IPA7D0ryGbRdTgb5JI3x0KS4/niulsbq+ezjW6lzMBhiW H9CaxptydpRsaVqcIq9OVzp73U3KAFiOO5xXH3V3Jqt0EiB8hDjd/eNa0di92433AUegNblj 4djUKEKkjoOlb2S3ZhztbLUpaPa+Qg45rfUcClWwECg4HrxUioSQBRKSewoJ9SWzh8ycE/dX k1duPmdY16k802IrbxYHLH9antYuTK/U1zSlrc7YR05SVY9iAfhWnZW+1BnvzUFtD5sgZh8o 6CteKPoAK5ak+h2U4dSSGPJzWjEmBUUMWBVtFrknI7IxHKKgk0yxmk8yS1iMn97bg/nVoClr K7WxbSe5HHbxQ8RrtHoCajnsba5YNPCspHID8gfQdqsUUXe47LYrR6fZxSCRLaIOOjbeR9DV miihtvcEktgooopDPmdNcsXTbLIfqFNSx+ILFBseYunrsP8AhV7/AIU74r/uWf8A3/8A/rUf 8Kd8V/3LP/v/AP8A1q+g9tR/mR4PsK38rKsfiHT4jgXBZD2KN/hViHxNpcThhcNj02Nx+lO/ 4U74r/uWf/f/AP8ArUf8Kd8V/wByz/7/AP8A9aj29H+ZE/Vqv8rNFfGejFcNckexib/CmN4k 8LTNmaTPv5b/AOFUf+FO+K/7ln/3/wD/AK1H/CnfFf8Acs/+/wD/APWqfa0P5gWGq/ysvf2r 4Gf77n/vy/8AhThqngJej/8AkF/8Kz/+FO+K/wC5Z/8Af/8A+tR/wp3xX/cs/wDv/wD/AFqn nofz/iaKlWX2TRHiHwdEcxNz/wBcn/wqT/hNNCQfu7gL/wBsm/wrK/4U74r/ALln/wB//wD6 1H/CnfFf9yz/AO//AP8AWpqpQ/m/Eh0Kr+yX5PGWjvx9qIH/AFyb/ClTxdoac/azn/rk3+FZ /wDwp3xX/cs/+/8A/wDWo/4U74r/ALln/wB//wD61P2tD+YFh6q+yzWj8Y6Duy96f+/T/wCF XIvHHhwH575gPTyX/wAK53/hTviv+5Z/9/8A/wCtR/wp3xX/AHLP/v8A/wD1qlyoP7RpGFeP 2Ts4fiF4XTGdQYf9sH/wq9F8SvCSddSb/wAB5P8A4mvPv+FO+K/7ln/3/wD/AK1H/CnfFf8A cs/+/wD/APWrJ08M/t/ibKeIX2PwPS1+KXg9f+Ym/wD4Dyf/ABNaukeO/DOtXC29lqsRnY4W OQNGWPoNwGfwrx//AIU74rP8Fn/3/wD/AK1Nf4QeLY0LrDauw5CpcDJ+mcVm8PhntP8AItV8 St4H0PRXn/grxnKoXw94oDWOs24Co1x8ouF7HPQt/PqK73zov+eif99CvPqU5Qdmd0Jqauh9 FM86L/non/fQo86L/non/fQqCx9FM86L/non/fQo86L/AJ6J/wB9CgY+imedH/z0T/voUUAP ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigDkviFomm6n4Zubi8tElntoy0M nIZD9R29ulfNRZs/eP50UV7GXNuDTPJx6SmmJub+8fzo3N/eP50UV6BwBub+8fzo3N/eP50U UAG5v7x/OiiigD//2f/bAEMACAYGBwYFCAcHBwkJCAoMFA0MCwsMGRITDxQdGh8eHRocHCAk LicgIiwjHBwoNyksMDE0NDQfJzk9ODI8LjM0Mv/bAEMBCQkJDAsMGA0NGDIhHCEyMjIyMjIy MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMv/AABEIAQECWAMB IgACEQEDEQH/xAAfAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQD BQUEBAAAAX0BAgMABBEFEiExQQYTUWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUm JygpKjQ1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOU lZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy 8/T19vf4+fr/xAAfAQADAQEBAQEBAQEBAAAAAAAAAQIDBAUGBwgJCgv/xAC1EQACAQIEBAME BwUEBAABAncAAQIDEQQFITEGEkFRB2FxEyIygQgUQpGhscEJIzNS8BVictEKFiQ04SXxFxgZ GiYnKCkqNTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqCg4SFhoeIiYqS k5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2dri4+Tl5ufo6ery 8/T19vf4+fr/2gAMAwEAAhEDEQA/AOdht2fk8L61oRQhBgCpESpsKi7mOAK+kcrnzsYKKGrH xk1G0uflT86Y8plOBwvpVq2sy+GcYX09aLW1ZLk5O0SKGBpTwOO5NaEVuqDgfjU6xBRgDApk soj+VeW/lU3bK5VFXY12WMep9Kh5Y5NIAScnmrcFsXwzcL/OnojNtyZFHCXPA/GraQqnQZPr UyoAMAVHLIE+Uct/KldsrlUVdiMQg9T6VCSWOTSck5NLiqSsZuVwpaKaWoJsOzSFqiMmKYZQ O9K5VixmjfVNp+OTUTXfvSuUoM0PMHrTTMAetZT3gHU1C1/6UuYtU2bPn80nn1hm+OeopPtp /vClzFeyZvCenicetc+L4+oqRb/jmjmE6TN8Sj1p4krDW9B6GrCXnvTuS6bNcMKeDWclyDyD U6zA96q5m4st5pagElPDUE2JKKaDS5pgPVitSja4qDtSgkHIpNFJj2Qj3FCkg5qWNw3B60rR Z5Xipv3Lt1QJIDweDUu0MKqnIPPWpo5ccN+dS0XGXRj9pWpY5CODyKUc0hj7r+VRuaJW2LSE EcVOmCOaz0cqeKuxOGHHX0rOSNYyuWBlatRS+tVkNSgdxWTNol9CCKnU46VnxyFTV2JwelZS RtFluNqsKaqLiplOKxaNUy2rVIDVZWqZWqGjRMnBp1RA08GoKH06mCnVIxaKKKBhRRRQAUUU UAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQB88ZWJNzdKpvI0zZPA7CmySNM+T0 HQelaFhabsSyD5f4R619JpFXZ8225uyHWVlnEkg+i1qKlKq1HcziBNq/fPT2rJtyZskoIZcz iP8Adp97ufSqYFIOTk8k1o2dr0kkH+6K00ijDWbC2teA8g+gq6Fp2KhuJxEuF++entWd3Jmt lBDJ5vLGxfvd/aqg9TScnk9aXtWiVjnlLmYopaSms1MkGbAqB5MUkkmKpyzYyc0mzSMSV5sd 6rPc4GSeaqy3GMnNUZbnBzmobN40y9Jd9yfwqpJeE8A1QknJPX8KkjsridTI/wC6jHVmH9KR soRjuK936HNRG6Y5x2qZPsf2Z5bRRdOpwDKdq/XHcfzomsbvUncGzSNYE8szbsZb1C8ge3H4 1EpW21Li4X1KpuT1Ljn/AGhUZvox1kHr1qhLbqt1JbyebGIuZDkMT+PFRIsErynzJB+7OAIh wBj/AGq53WlfY6FTi1oa63YJwJB+fSpluHzgc/SsOJIpBtWWXzVGUPlgZH93735fl3qSGWMs PLVjIOiMwCt9OOD+NCry6oHTibi3Zzz1qzHeEd81nQ3F7OTGNO3IuC0RQhwPZjyfpWgNNEka vAxViM+W2cj+tdEHzbHNNxi7MuRXnoavRXYbnNc4yzW5+ZePUdKniuT1Bq9UQ4KSujqI7kN3 qwk2a56G5zg5rQiuM4OapM55U7Gwr5qVWrOjlzVtG96oxasWQaWmKaeKBCirUMu75W69jVWl B5pNXKi7MuvGHHPX1quVKHBqeCXeNrfeH61KyBxg1ne2htZSV0QxS7eD0q0vrVFlKNg1LDLt 4PT+VDXVDjK2jLLIG5HWkVip9CKeDSlQwyOtQaehahlDfWrSNWUpIPuKuQy7uD1rOUTWEi+A GHvT0YqfQ1AjVOMMOaxZumXYpA3XrVpTkVlqSpq7FLng9aylE1jIuLxUqmoEapBWTNUWFNSA 1ApqUGoaLTJacKjBp4qCh1LTaWkMWiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK KKKACiiigD5ysrbzpMn7g61uIoAAAwBVe3iEUYRe361aXpX0Endng048qFkkWGIu3bp71lM7 SyF2PJqS7m82XaD8q9PemwRGWQKPxPtVxVlcxqS5nZFqzt/Mbew+UfrWoKhQBFCrwBT81nJ3 ZrGPKhZJVijLH8B61ms7O5ZjkmnXExlk4+6OlR1cY2MKk7sdR2pKO1UQBNQSSYFPdsCqM0uK GUkMmmwKzp5+wPHeluJuSc1mTS9qhnTTgOlnzk54qq0hILMwVB1Y9BT4oWuH6HaDzgZJ9h71 ZktI4rYT3oKheY4F7fX1P8ql36G/NGOgWslpDA1wsb3EgICoo+Y++OoFXpb5ba0+03qCIlcx WzNh3/DsKpR3dvZRK8MIl3kN/wBdH9B7D1rUtNBvr+f7ZqNwHaY7mjKbiB6c9KhSlsiJRg3z TMPTbLU9f1VLhgY7YH5iCURUBzgY/wD112YtEWNIYU2wRjCL/U+9bUVrFawLbR28agff25/L r2/n9KqX+o2emyQLLayOJ9wRkkBBYdulEPdMqjdR2RzOt6VpNhp8kksca3E65VN5XOOmAPfn pXHWUBa4KAElo34/4CT/AErb1e/g1XUpbmVZeu1NuOFHSm6U9tbajHPCbgSRq7LkLjOxvepl C+tjrp+7pcw5LWe0mCyI8Uq4IBGCPSnXVuN6zIAElG4AdFPcfn+hFa+oXNtqF9NdSJNukbO3 jA9BSRC0ltZIfs8jGP8AermXH+8Onpz+FS6RcZ36lWA3cbRSjzEn27lByBOg/ma6y1mh1G1S XP3h9/qVPo3r/P61kiW0vdMhx5UV3akhBPIfmTqMHjkGun0Wd77SknS1t4lB2MYgCNw68HOM 9auneDsc9dKUb9Sg9tIWKSRluM7xzx657isy704RkNEy5P8Ad+6fxrp5lZ18qdmaPOR/sH1A /pWZNC0DsjAFTyR2I9RW++5yKTg7owEkaNsMCCOoNX4J+evBpbq0V13Dp/C3cexrPUtE+x+M dKlqx0xmqi8zorebtmtGKTIrnLefoc1rW81NGM4WNhGzUoNU4nyKtKao52S0UlLQA4Eg5BwR V6KQSJnuOorPqSKQxvnt3qZK6LhKzLzoHXBqqVKNg1byCMjnNMkj3r7jpWaZtJXCGT+E/hVg Gs8ZB96uRPuX3HWiSHCXQmYbhkdRSIxB4oBpWHcfjUF+Zdik3CrKPWXG+05q9G+QCKylE2hI vA7hUiNg1WRqn6jI61k0bpl6KTP1q0prMjersb5FYyRrGRaB44qVTUCmpBWbRqidaeKiBqQG s2Wh4pwplOFIY6iiikMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA8LWm3 MvlQnB+ZuBSrVK6k3zYHReK+girs8CpK0SIVqWsXlxZP3m61Rto/MlAPQcmtOqm+hlTXUkzU NzLtTaOrVJmqMr75Ce3alFalTlZCU6m0orQwHUhPFFNY8UAQTNisu4lxmrlw+Kx7mTrz1qWb QRVnk96gggkvJ/LX8T6CmyEu2AMknArXgjTT7PzGP7wnAx1Lf/WqbHS5ckfMu29sttGEUYYD /vn/AOvWNdXZvndASlnH98jq/t+PpWrLqA+xCOWOQ3MgAG3Af+v6is2e2g2rbQXCYjPzCQY3 P3wRkEDoM49e9NpvQxp2T5mW9Bt7U+Zq166okJ2RqRwv09TWifFvleZPbWqtGhCoZScs/wCH oOfyrn/sF0U2rE8iA5xEd4z/AMByKLuMRlLYdIhg+7HrTVNbA53fNI0rfWfEWqXUr2RyYoyz RxqMBfp3NZ7TX0s0lxfGXdDGxXepXDHgED6kVc0LW7jQZ5HhjSSOUYdH7kdDmpNX1e71i3Wa 62DL7UVFwAo5P6lfyp8jva2go1EtTm9tWbBf9MUequP/AB00vl+1dB4W8NXWtagjBXitFDb5 yvHQjA9TWk1GMbsmEm5If4Y8GNq8f2y6kMdur4VVGfNx159O1dLceANPa+S4tZZLZAMGIDcp /Oul1OeHSNHco4hKp5cACbsvjCgL35qexiu10+EX7I91t/elAAM+gx+VedKrJ+90OlKzPN4/ AiQa0bSW785VUSgIuMDd0b6iuyW0it8qkSrG3DKoAz/9er8Oi2llcyXUEeJJh8xwPx564+tO kiodTmFJHOXdnsZl646Ed6zJYBIvktwf4GPY+n0NdZNbNND8qFmT0GeP/wBf86x7qxODvZE/ 3jz+Qya2hO5hKJyrqYmYMvHRlNUrm0DruB+UDKv/AE+tdHeRQmMygNLIvD5+Uex45P51jyOX OyQgIemBgL7gVsndGafKzFjco5VuorUtp+lUbyEqxbGGXg/Skt5alqx1JqcbnTW8ma0Y2yBW FaS8iteB8gVSOWasXR0p1MHSn0zMKKKKQy5ayZBQ9ulWKzkfY4YdjWiMEAjvWUlqdFN3ViGZ P4h+NMjba2askZGDVQjaxHpQtVYUlZ3LwOalB7VVgbK4ParAqGjWLuhMbWqxC+DiomGV+lIp qXqilozTRqsI1UYnyuatIaxkjoiyyDg5qzE+DVVTkYqRGrJo2TNJDU6niqcTZGKsoaxaNkyd TUi1EpqRazZoiUUopgNPFSUOpaQUtSMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiii gAooooA8HZ9kbN6Cs4cnJq1dNiIL6mqyjJx6mvo4LQ+bqu7saFom2Ld3arIqNBtQKOwp4qHq zRKyEmfZEfU8VTqa6b5lX0GahHSrjsYzeo4Uopo6U4VRAGo5DwaeahlPBoAz7p+tYtw/Nal0 3Wsec5OBSsdNMZbRtJLuXg5wDWis3zxIwXyY2yPl5pY4PItgeu4bQffvTAueAMn0FaRhoZVa l2S9ZJr3btJbbGP9o9/wH6kVVEQq7cgIywDkRDacd27n8/0AqHFXGJlKfQW1iCymYjiIb/x7 frS/abr+K4kYejNuH5GpmHl2Sr/FK24/QdP1/lVfFCVxObWiHec5+9HA3/bFR/ICtGGwn1F4 Le20+GRliLtksoHOSc7sDgrUOlac2qajFaK2zeeW25wPpXdabpkej+JxZwyTPJJabZ5AowmM BcHt909axrVFDRbm1JOSuzzlxCGKtaICDg4dv6k161pGoabY6fplt5tvvmHlxiFyylsc8/49 zXmmu201trl5FcSNLIJMl26sD0P5V0HhKBIdNuLtLSSW6M6plUyUUDcCB7sMH61niIqdNSuV Rm1NxN/xuLEaKstx8s8Uge35OWf0+mP5Uuga5d6/D5hFrbNGf3iBWZn9xkgKPzrK1yHWfFFz 9khsWtra3+f9/wDKS+MdfxrqtGspLHR7S3nCefFHsYr9c4zXJLljSSe50Jtz8i6SDHwi8H3q By3bA+igVZAyGHqKhYVzpmjKMhYsN7My9CCe1ZF5BtZlPOD1rblXiqV3HuRX742n8P8AP6V0 QepjJXRy8yiOQkjKHhgO4rFu4DFIyHnHQjuPWulu4utZF3HvgDfxRnafoen9R+VdcGcskYkq 748/xJwfcdvy/wAKzCvlTFex5Fa7fLIDjPYj1FUb6HyzjqyHk1bLoysy1Zycit22ckCuatG5 Fb1o3ApIdRGuh4qSoYzxUw6UzAWikpaACr9q+6LHdTVCrNm2Jcf3hUSV0aU3aRcxzUM68BvT rVjvTWXcpHrWSZ0NXRXiba4NXRWf0OKuxNujBpyRMH0JlphG16cKJB8oPpUGr2JoGw31q6pr NQ1fjbIBrOaNIMtxmpejfWqyGrHVfpWLN0y1E3NW0NZ8Zq5GcispI2iy2pqUVAp4qVTWLNUT A0+oxTx0qGWPFOpgp1SMWiiigYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAHz3d t86r6Ckt13TL+dNuDmc+wqazH7wn0FfSfZPmXrMvCnimCniszcpzHdM35U0dKQnJJ9TSitTm e44U4U0U4UCGt1qvKeKsN3qtN0poEZN0etZ8SeZcr6Dmr133qKwQb3cjgH9Byaa3Nr2iWWfy 22YDIBgqe571PawRvKZonH7sbtjnBz2weh55/CqbEkknqetTfcsh6yvn8B/9fNaNaHMpa6kU iPG+JFZWPOGGM03BJwO9SpczRrtD5TurDcp/A8VYtJYHuFaS2X5AZCY2K5wM9OR29KbbSEkm 9yC7I+0GMdIwIx+HX9c1BVgrbOc+dKrHrvQH9Qf6Un2cH7lxA/8AwIr/AOhAUJoTTbHWDMt9 AVdl+cbipxxnn9K6vwx4gFtDMJbW6ur2clyVA+ZVGcAnrjniuZtbWYSOwCttjf7kityVIHQ+ pFdf4Gu7xZW065gkESqXhZoiCD3GfTqa58TZwb3OigpJpGnFo761qkOr6hAIEj/1VsyDcw7F z3+ldNEqowCKFHooxRgjqDSp98V5E5uR6EYpCUhFLS7WPRT+VSMav31+uKhYdalcGNGdgVVR uJI6AVykvimKT+0IbiZbbBb7NNCyklf4eM5z+FaU4SnsRKSitTeYqwO0g4ODg96qyLujkX23 D8Kw9K8UaZHaQWt1cuJFUKZSC4J9ScCuh3w5V1y6noQRgg/59a2cJQdmjNSUtmYF0nBrLa3b f+8xHG42sznAweh98HB/Ct+6cozBFVMHGQOfz61z96CxYsSSfWuiDbRzzSRi3O2EskYO8cF2 GCPoO1Z0y74gT6bT/StTUBmQSf8APRQx+vQ/qDWcfuuPbP5V0LYzvqUrU4bHpW/ZnpWAg2zs Petyy7Ujepqrm5EeKnHSq0PSrK9KDmCil70lAC1JE22RW9DUdOFJjW5rkUhFKh3RK3qKCK5j tKcw2yn35qW2PUfjSXI5U/hTbc4kA9a03RktJF0U8jKkUwVIKyZuiJTVyBvlx6VS6MR71YgP zUSWgQdmX1NWUOaqJVmM1zs6YksZwauQmqQ+/VqI81nI1iXENTrVdKmWsGbInFSCohTxUMtE gpwpgpw61LKHUUUhIHJOKQxaKzW17TfNaKO6WeRfvJADKV+u3OPxxRb61a3JIhDyEHH7sBxn 0LKSB+JFVyS7E88e5pUVn/2zZbHcyjCffIIZV+rDIH4kVBB4jsrw4sVmu/RrdN6H/tp9z/x6 jlYcyNeio4pGkTc0Txn+65Gf0JpZGKLlUZ/ZcZ/WpKH0VSfUo4VJuIpocd3T5fxYZUfiajfW LaOATNv8s8hxgpj13g7R+JFPlZPMjRorHl8SWEKo0xeMP0ZwFQ/Rydp/AmrUOsWE7oi3Kq7/ AHFkyhb6A4z+FPklvYSqRely9RRRUlhRRRQAUUUUAfO03+varNn1aq03+varNn/FX0j+E+ZX xlwU88A/SmCnN90/SszYoinCmCnitTmFFOFNFOFACN1qtN0qy3Wq8w4poFuY113otFxaM3rn +eKW7HWnWp22gPXJwQe/Jpx3NZfCRt3qa5+UxR/3Ixke55NL5HmkeVlgTgr3WmXLb7mQ/wC1 j8uK13ZzNWRFU8PFtcN6qEH1JB/kDUFT/dsP9+X/ANBH/wBlTZMSCkpafDJ5M8cu0PscNtbo cHOKbEtz07QtItbjwxbRXtrFIWiBOUweTkcjnpj8qvaZoGm6TO81nB5cjrtJLFuPxpdJ1a01 TT2uLZ/lDBWVuCpweKx/GGtxWulNa290BdSkAhDyF789uK8a1Sc3HuepeEYqXYtav4wt9G1J LR4nmUpud4nGV9Bj/wCvVPSvGdxcaxC948cFhc7khTdllIPVj6HnrXnHHrWtbz2n9m2luiH7 SLhpJXK8YxgAH8K63hKcY2OeOInKR2F1d33hPUJp1W4vdMu2EjO0hJibJzz/APqzx6V01hqE Op2EV3bsxjkHG7qPUH3rhtAn1nTIyL8OmlyRE+ZNhgnykrtz16D5aPCniXy9SaznVEguWGwq NoV8YzjtnHOO9c9Sg2nbdG0Ktmr9TtdUCyabdwiZImaFvmY8KPU+1cbpfgxrkxXOottg8pQs aN8zkADJPYfr9KjvNV/srxw073Lyw/6qRSvzIvp7465rsLvWtOt7aKeW7jEbNs3A555pJVKU Uo9RtwqN83Qyj4Q0VCT9mc/WVuP1q+6qkSoihVUYUDoAKhg1q2vdQltIskpGJFfs49qllNJu bfvCtFfCU77l9394A1g3Y61uXZzHGfYj8jWHdHrW9MxnuZF0M2oP9xyPzHH8j+dZn/LQD1OK 1nVpIp1UZwA36gfyJrNO0HCnLd2HT8K6ImfUoEAXTAe1bNl2rJYf6U1bNkOlI3l8KNiHpVgV BEOKnHSg5hTSUpoHSgAFOFNpRSGa1sc2yfSpKis+bVfqalPWuZ7nbH4UQXI/dg+9QRnDr9as 3H+pNVU6itI7GUviNAVItRipF6VkzZET/fqWE4cVHL98fSnR/eH1oewLc0ENY48ceHEYq2pp kHB+Vv8ACptdvv7N8P312Dho4W2H/aPC/qRXi+ix6XJqAGsTyw2gU5aJcsT2op0lNNsudRxa SPZR468NlgBqaEnj7jf4VZbxz4btp2il1NFdDhhsbg/lXE6B4b8IaxfY0y8v5JbfEpDrgDB4 6j1rO8a+DbTw9YrfDUJZ57icgRtGAMcknOe3H50vZU3Ll1K9pUUebQ9NT4ieFh11aP8A74b/ AArYt/E+izaU+ppqMAskco0zNtXdxxz35FeMeCPAcfiuyurqe8kto4pBGmxA244yep9x+dZv jO1k0bU10BJpHtbFQYyw272f5i+PXnH/AAGpeGpynyRepSxFRR5mtD2UfFDwj53l/wBpnrjd 5Em389tdJLremW+j/wBrSXsQsNobzw2VwTgdPc14La6b4L1i0tIYNTuNKvsATG7G5HOOxHA5 rb8Z6e/hD4f2WgC/F0Lu7adXUYAQDOPpls1nPDQ5lFXuzSOInyuTtY9b0fxRo2vTSQ6Zfx3M ka7nCA8DOK13kSKNpJGCIoyWY4Ary74K6eLbw/qOqSYX7RMEBP8AdQdfzY/lVrVr698YaqNO s3MWnqcsegYDqze3oKweHTqOKei6mn1hqmpNavoat/45e6umsfDtp9smH3riT5YkHr7j34Fc 95l7rt4bYzya3cj/AFmWMVjD9QMb8fhn3pwtf7Tuk0DRh5OnqczzfxS46sx9PQVblVbx/wDh H9GYWulwAtd3PQuB95ifT+f0rpUIQ0iv68/8kccpVKjvJ/1/XUjD2yFrWIpq00AzIWxDp9qP UqODj3zn2NQWt9qfiic22kAX8UZ2yXtwhjsovaOIf6wj/azWXptv/wAJ/rB0jTg9p4U09gZS vDXTdix7k449Bz6V7FZ2Vtp9pHa2kKQwRLtREGABWNaooadTooUnPV7GBYeC7KMxzatNJq90 nKtdY8qP/ciHyL+WfeulChQAAABwAKWiuOUnLc7oxUdgoooqSgrPudHtppGmi32twxyZrc7G J9+zf8CBrQopptbCcU9zhtUsZtLLy3IaGJz82oWKfL/22h5Vh7j9KwLqBbML5jpYx3HMd5aD zLG4/wB+I5Cn6V6uyhlKsAQRggjrXBa1p3/CN3DSQwibRLtsXFoeQhPdfSuyhV5nZ7/1/XY4 MRQsuZbGZba7qGiXKW13J9iLDMcmTNaSjsRzuQf7px7Cu0sPEccsiQX8X2WZxlGDbopB6q/S uKeGHSmWxuc3egXg3wufvRZ7qexHcUkHmeG73+zb7/StJm+eNuuFPR09D6itqlKE1pv/AF/V jKlVnTer0PUgc0tcpDrI0S7is7uQvZygGGbOflPT8K6pWDKGUggjII71584OJ6UKimLRRRUF nzvPxMfep7M8sKhuR+8U+oqS0P7wj1FfSfZPmdpl4U/qp+lMFPFZmxQFOFJ0Yj3pRWpzDu9O ptOoAD1qCUcGrBqKQcU0IxbsdabbnNpj0b/Gp7tetVrU/u5V9GBprc0esSWHIuYypIIYEEU5 7iOaRjPHklid6cN+PY0kH/HzH9armtbXZhdpE/2dX/1MyP8A7LfI368frTrmOSG1tlkRlzvf JHXJA/8AZarVbkuJoVtxHI64hAOD1+Zj/Wh3BNWZUq/pGkz6xd+TEQiqMvIeiiptOs7nVJNq 20BQdZGTaB+K4JNdromlW2kxPt3GWTG8huOOwB5/WsqtblVluXTpJu72JLPwxYw6KtlMXkzK ZGkVihJwPTtip7LwzpFnL5q2wkkzkNKd2PzrTBj8pPnYcnqv096cu3tIv45/wry3Unrqd6jH sRnT7F5FkazgLryp8scVR1uK1ttFnCRLFuPBjhB56/h061rAf7an8aei5YA7SDwQWFQpNO7L smeK/brk2bWZnc25IbyycgEdPpUGcHjg9sV6xqnhqxv7BreOG3gk6xyIoyhznt2rD0fwdcaZ rcNzPcW0sEYJyAc7sccY/rXpQxVPlb2OGWHnzI4eZ5nlzOXMmBkvnOPxqQgmygCglvNZQAPZ T/WvWLzTNPvSDdQQykdCUyaih0nSrP8AewWiK4Y4KqBjIHTrjpUrGRa2K+rNN6nK+GIb99Wu L2/SYN5OwNKuM8jA/IV0kzUmpapb6dbefNExj3BcjJIz37VG16ZIw8LrsYZBTgEfhWMm5vms Wkoq1yK4jka15+T5iNzcY461yMzSaZiF2N0CSVIBA57E9a6WaTNvLk9GU/zrEuWzWtPTczmz NmeV1kUsFj8pjsUYGcZ/GqMY5q1M/wA7D1R//QTVaL7wrqhsZPVkG3/S3HocVt2S8Csa3+eV m9Tmt+0TgVnY2m9LGhGOKm7UxBxT+1IxCiilpAHagUuKKBo1LL/j1X6mpTTLQYtUp561zPc7 Y/CiKf8A1JqqtWbg/uvqarr1H1q47GcviL4qQUxakFZs2RHJ94fSnJ94Ukn3/wAKdGPmH1o6 Atzl/iVe+RoMFoDhrmbJHqq8n9StcT4fbwwsEx15Lx5Sw8sQdAO+ea9U1nw/Zay8L3ViLlow Qubho9ufp1rPXwHo/fQ0/wDA6T/CrhUioWFKEnK4vgebwy1xdx+H4bxX2BpmuBxjPABzXOfF e/8AN1izsFPFvDvYf7Tf/WArutI0SLQRINO0qKHzSN+btmzj6rUGoeENP1i9kvL7Rklnkxub 7c69OOwrOM4xqczNXFuHKW/AVi2l+BrMiPMskbXBX+8W5H6YFcNd+N/D/ii9hi8Q6EIYx8pu onPmRj/DNep25vYIUii0+FY0UKq/aTwB0/hrndT+H+m6vePdS6MkM0hy5gvSoY+uNmM1lCUe Zyn+ZpKMuVKJ4/r1tpCav5Ph+a4urZgAvmJ8xY9h61peNpLiCfS9IuWJk02wiikGc4cjcR+G QPwr1zQ/BthoE4uLPQbc3A6TS3hdh9Mpx+FZXirw/oFlJJrOseHXmkuZvnaPUJDljk9OABxW 0cQpTSSv9xjKjywbbt95rWVm+ifDTTdOUFZZYl8wdwXy7fzIotrb+zfCs0qDE94+wMOoX/Oa VvEcOv6FHfR27QpHcGEo5zztB/rVu8uEPhmxkABUSEEeh5rnXMtJdXqb3jLWL0toU7C3/s3w xc3EYxPdN5QbuF/zmub8ZXX/AAj3w9W3hO261eXa57+UvUfyH/AjXW3Fwh8M2sgA2iUqfrWP 4w8Faj4007RZNPubaKO3gIYTFhy2OmAfSmpJSvPa/wCQnFuNob2N34ZaXHpfgXTyqgSXS/aJ G9S3T/x3aPwrsK8ah+Gvju3hSGHxLHHFGoVEW5lAUDoANtP/AOFd+P8A/oaF/wDAqX/CsZ04 Tk5c61N4VJxio8jPYqK8d/4V34//AOhoX/wKl/wo/wCFd+P/APoaF/8AAqX/AAqPY0/50X7a f8jPYqK8d/4V38QP+hpX/wACpf8ACj/hXfxA/wChpX/wKl/wo9jT/nQe2n/Iz2Glrx3/AIV3 4/8A+hoX/wACpf8ACj/hXfxA/wChpX/wKl/wo9jT/nQe2n/Iz2Kqmp2aX+mz2zjO9Dj69q8o /wCFd+P/APoaV/8AAqX/AArJ8A3uuS/EZNOu9WurmO2MvmgzMyNt47+9VHDqzlGV7Euu7qMo 7naWVqbvQ7zT5Blrf9/CfTH3h/n1qWO1/tLwrJDIMzWDboyeuw9R/P8AIVc0aeOTU7sADaIZ CT7ZFO0GdJINQOBsWH5v1raUmrvtZmEYp2XqjF1CJrvwNchv9dpzeZGx67O4/nWp8N9fbVNK lspn3TWhAUnqUPT+oqXw/Fb6ol7ZzJugli2yAEjIPuK2NH8KaPoNxJPp1s0Uki7WJldsj6Em prVIKEqclre6ClSqOpGpF6WszaooorgPRPnu5HyKfQ0yBsSqankXdEw9qqKehr6SOqPmp6Su aop4qJG3KD6inioNStIMSt9aQVJcD5wfUVFVrY55aMfTqYKeKYhaa44p1BHFAjLuk4rMjYx3 H+8MVtXCZBrFuUIbI6jkVRUWWI8earr0B5HpULcMR6GmLKUZXU471K7xPIwY+W2eo+6f8K0T JcLoZmrZia4ubaFSAzooBJ4qo8boNxGV/vLyPzq1Hl7ux2gMSq9f94j+lDZKi7Hb6dbxWVss MQwByT6nua0kesuOSrSSVxSVzWMrGrv/AHUf4/zp6vVPzP3UX0P8zTlkrBxN1IvCSpIn/eL9 aoiSpYpP3q/WocC1In300vVcyU0yUcgcxO0lMaT9y3sw/rVdpaY0n7iT/eX+tWokcxFdCOeF 4pVDI4ww9RXKWkk+k6mdPkbNrISYyx6V0cktYOuWYvoAynEkYJUevtXTT7Mxk76mhJJ/o0xz 3X+tY1xJgGotIupH06eCQN5iMu0Ec7eap3jmYsrSBIkGWxyxq1GzsDu0VllaWWRgP4CAP0/r TGlEcbBTkkYzVf7T+6cKoVTgepPfk/hTA3mMo7DmtuhKRo2KdK6G2XAFY1inSt2AYAqGEncs r0p1IKdUkhS0lLSGKKKKfGm6RV9TSZSRqxLtgRfQUGnn0phrmOy2hXuTwo96jj5cfWlnOZMe gp0C5kB9K06GW8i4tSL1pgqQcCsmboifmQ1LEPnWohyxPvVq3X580N6BFXZaQVYUVEg5qwgr nbOmKFPUVMgqPHz1MgqGaInSp1qFBxU6ismaolWqOvaUutaLcWTY3OuUJ7MOR/h+NX1qRahS cXdFOKlFxZ5hoFlKlpqGjOpSWT95CG4xKvUfiOPwq1ol1/aWl3uiOdtx/rYA3B3Dqv6V1+ra P9ob7XaqBdLz6bsf1rhdWtpLy/8Atun5ttYhbdJbn5TIR/Evv6jvXfCoqt3/AEmedOm6KVun 5FrQ7j+0dOvtFc7bj/WwBv7w6iuk8EamLnTZLGQ4ntXIKnrtJ/xyK4gztrk66hpp+y6/bndN an5fNI/iT39RWlaXsmp3g1jSFEGtwcXmnudvnDuR9adanzRa/pP/ACYqNflkn/TX+aPT6Kzd H1u01q28yAlJU4lhfh429CK0q8txcXZnqxkpK6CiiikUFFFFABRRVa+v7XTbOS7vJ0ggjGWd zgChJvYG7FTxFrEGg6DeajOwCwxkqO7N2A9ya8m+H1u+laJqviu9GJ70mK2B6sScsw/H+VWN XvpviFeC7u3fT/CFk+fMf5WuW9h3J7en1q8QmsLHf36/2b4asl228J4MgHYD1PrXo0afJCz6 7/5ep5tetzSuvl/mW7Gc6Z4Wu9RmOJb39zAD1K9z/P8AIU9Ln+x/Bskkh23OpHbGp6+WO/5E /mKzbu8j1CVNY1hTaaPANtlZDh5gOgA9D3NW9I0jUfGeqDVNSjNvpy4EcYGMqOiqPT1NatJL mntu/wBEYRm2+WGr6fqzpvA1m8WlveSgg3DZUH+6O9dVTY41ijWNFCooAUAcAU6vMqT55OR6 1OHJFRCiiioLPAhVORdkhH5VcFQ3KcBx24NfRRep87UV0SWr5Tb6VaFZsL7JAe3etAUSWooO 6EnXdFn0quKudRj1qoRtYg9qcWTNa3FHSnCminCqMxwpaQUtAiCVcisq6i61tOM1SnjzVohs wShOUHXqv+FQvJnafUVfnhIOR2rPuQOvQnn8aJe7qbU2p6BHcSRNmNyp9jWxZ6lFHNZSzxqF w0bOnynqT+P3hXNs5U4NTebuscd45P8A0If/AGIqXJM1UGro9LieFwCspXPQOP6j/CrSK/8A CyMPUMP61xXh3UzJG1tLJl15QE8kV0cc1ZuJzvR2ZuHzBBGTG/cZ2n1pFmHrVFZ2FshDEEO3 f2WpFvZv+ern6mo5WVzIvCWpoZf3yfWs8Xj9wh+qA1LBdnz4xtj+8P8Almv+FQ4spSVyfzaa Zveqxu2/ux/9+1/wppvZB91tv+6AKfKw5kT72f7oLfQZoIk+ztlSMuPvEDsfX61Sku5GHzSM fqahln/0VeesjfyFPlYcyJpCo+/Mg9lyTVKWeBeis5/2jgfpVeSb3qnLNWiiTckvZvOsgh+Q NIeI/lyMetc7qEyW9sIYwF3cAD071pXtysUCF2wqruP41ys87XMxkc7VPT2FNNRNIwlNkwcl VUd+TVy1Qlqp26FzuxgHoPQVsWcPIrWN2rsipJJ2Rq2UeAK14hxVG2TAFaEY4qZGaJhS0Clq GNABS0UCkUKKt2Me6fd2UZqrWrZRbINxHLc1E3ZGtKN5ErUw+tSMKr3DbY8dzxWKOl6Iqk7m LepqzbrwTVdRV6JNqAVcnZGcFdj1FPbhCaFWh+wrI2sMQVet1+XPrVZFyQBWjGmABUTZcEPR asKtRotT9F+tYtnQkNUZOasIKjQVOgqGy0iRBU6io1FSqKyZoh4p4poqQCoZaFHSs/VNCsdY jAuYsSL9yVDtdfoa0RTqSk4u6BxUlZnnmreC74uJCPt+z/V3EbCK5T056N+OKyZobkzodQjk kuIz+7u4/wDR7pPqG+WT8CSa9aprxRyrtkRWHowzXTHFytaSucksFBu8XY87guXluUa4LPeK MJd26+RcgejxNjePpmuosdYuf9XMq3eP44RskA/2o2wR+Faf9lWIUqLWIKeq7eD+FOGnWirt ECbey44H0FROrCXQ1p0Zw6iwaha3DBI5l3n+Bvlb/vk81ZqBrSB02PGrr6MM0sVtFAf3YKj+ 6Cdo/DpWDt0OhX6k1RXN1b2cLTXM8cMS9XkcKB+JqQjIxVFtG095hNJbLJMOkj/M35nmhW6g 79DDv/GQZTHotjLfSHgTyfubcH/fb73/AAHNcxd6Pf6zMl7r8v28qcxW7k29lEfx+aQ/hzXp Ys7dfuxKue4GDSGxtmJJiXJ6nufqa2hVjDZGM6cp7s86uIYUljlu9t9PGP3KTL5FrD/uRfeb 8vxoGlaxrF0lwLRrqVf9XPfL5VvD/uRdT+NejRWVtASYreNCe6qBU1afWmtkY/U092clpvgW 2W7F/rNw+pXnYyDEa/RfSutVQihVACgYAHalornnUlN3kzpp0oU1aKCiiioNAooooA8CFOK7 lIPQ1WtJfMTaT8w/WrQr6F6HgKzRQZSjFT2q5bSbl2nqKZcx5XeOo61XjcowIq90YfBI0xUU 68hh3609GDKGHenEBlIPepWjNGroqinCmkFWwe1OFWYDhThTaeKAEIqGRM1ZxTSuaaZDRlzw 9xWVdWodSOh7e1dHJFmqU1v7VorPRmWsXdHGy77dyjjI9D0pYnRw6K20uuArevUc/hW3eWKT oVYYPY9xXNXUE1lLhwcZ+Vh0NcdaEqeq2PUw1eNXR7k2+SB1b5kYchh/SuhsfFCJCqXauZBx vQA7q5L7S6HKMQp5x2/Kl+1o3+shU+6naayVZo6J4eM9z0a18SafNaSfv9m11++COob/AAFS f8JDpq9b2L8DmvPIJbdkmQPIpaPI3KCBgg9vYGosRn7tzGf94Ff501XMngo9GeqWupW95GXt 5lkUHBKnpVy3m/0mPn+IV5LDNc2+RBexx7uuybGa7LwpJfygTXV3HLGzjy8yAkYPNaRqqWhh Uwrp+9fQ6Mz+9MM/vVQ5/wCesP8A38FMZgOs8X4NmtTksyy8/vTJ58Qwj1Uk/XJ/piqjyQr1 mz/uof60y6uIVk27XbaoXlscgUFJaCSTe9V3Y7dzkIndmOBUcl4f4AqfQf41ja1PI1ngFmkk cKBnJNEnZXLpxUpJFXVdVS6uCIyWjB+XPAPviorSB5z5j52/zqWx0sx/vJxucjhew/8Ar1rx W/QAYHpRSpSfvTNK+JjBezpjIIOenFa9tFjHFRw2/tWhFHjFdDOFNsswrgVcjqvGtWUFZM1i SiloFLWZogpaKXFIZJBEZZVTsTzWxwBgdB0qrZQ+XHvYfM38qtVhN3Z10o2QGs+d98vHQcCr VxLsTA+81UwKIrqE30JbePfIPQcmr4Wo7eLYnPU1YVaiTuzSEbIAMDJqIfM2fWpJT0Qd+tEa ZIAqS7E9tHltx7VeVaZFGFUCrCLWMpG0Y2HItO6t9KX7o96VFrO5pYegqdVpqrUyiobNEhyi pQKaoqQVmy0KBTxTRThUlC06kFKKQxaWkpaQwooooAKKKKACiiigAooooAKKKKACiiigAooo oAKKKKAPm2Nyjhl6itaKQSIGH41nTwbDvUfKeo9KIJjE+Ryp6ivpGuZXR83FuDszV61Smi8p 8j7p6VdRldQynINKyCRSp71CdmaTjzIqQS7Gwfumrw6VmvG0T7T+B9asW0+3CMeOx9KprqjK MraMnmj3DcOo61AKuiq80Ww7h90/pRF9AnHqNFPFRiniqMyVRT9me1NSrKDPU0risVzCahkt 61RECM4/E0hiU8Dk+ijNNSJcTnZrXPasy6slkQpIgZT612ElqTxsx/vGqcunseoA/D/GtFNN WZk4STujze/0KWPL237xOuw/eH09aw33RuUYFWHVWGDXq02nEdTisu80a3ul2zxo/ueo/Gua phYy1g7HbRx84aVFc89jk2SBjnHQ/Q8GmF8Eg9q6W68Irkm1uGT/AGXGR+dZU+gapF/yxWXH dGB/nXHOhVjuj0aeLoT2kZ/mVoaTrFzpl0rQsChYFkboaoSWV5F/rLKYf8Aao0VhIu+GQDPO FOcVknKLNnySXc9FtdQS8tY5487XHQ9j3FSGf3rH0yez+ziK0jKgclWBBz6n1q9+8bpH+ler B3imeJUioyaLCzAuCeg5NQvKzEk8Z9acsMzDH3QetTx6eCcsSatRZm5xRmPc5cxxI00g6heA PqalhspHcSzkNIOAFHC/StyHT4+2B+FXotNj7Y/OhKKd2TKc5K0dDFitGP8ADVyK0x2rbj0w DnBH41YSwP8ACx/LNN1UQqLMmO29v0qwkIrSFo6/3D9eKcYGUZaJseo5FQ5mihYpLFipQmKm 2L2/UYpNuKlu5aQ2lpaMUi0gAqxbw+ZJk/dHWokQu2BV+MBECis5M1pxu7k+aGcKpY9qZniq 8khkOB90Vklc6HKwxmMjljU9tFvbcegqONC7YFaEahVCjtTk7KwoRu7skUU4kIuT+FA4FRkl 29h0rI3BQWOT1NXbeHA3EcnpUcEWTk9KvItRORcIjkWp1FNUU488CsWbJC/ebPapkWmKtWEW obLSFUVKopFWpQKzbLSACngUAU8CpbLACnUlOqRhSigClpAFFFFAwooooAKKKKACiiigAooo oAKKKKACiiigAooooAKKKKAPn4EEYNVZoDGdy/d/lUkcgYZU5qYHIwa+iTsfPtKSKtvO0Leq nqK1EdXUMpyDWbLBjLJ07j0psMzRNkdO4ptJ6ozjJw0ZpyxrKuD17GqLKyNtYc1bjmWQZU/h TpI1lXB69jSTsVOKlqhlvcbcK547GrvDDB5BrKZWjbDVPBcFODyv8qbj1REZ20ZJJGY2/wBk 9DQDVkMsi+oNQPGUORytCYpRtqiSP9KuQ8kBR171RQ9quQnB9KGQaHlpGQpG9z3PQVNInlyL F1Y924UfTFRrKkijzVOf761KG3LtDpIo6BuCKy1K0Ibj9y7RgHI4Jbj9BxVGbfg5J+g4rVOS u1kZh0H8X/16ha3hbgkoT25H86qMrbiauc3cOV7VnyTkdq6xtLjl+66n9f5VCfD27pg1ftEJ U+5x73B9Kha5I/hrsz4Zz/CPzpjeFCf4Kn2vmaKlHscS14R/DUZ1D/ZP5V3H/CI5P+rP5Un/ AAh3/TI/lUuq+5oqUexxIvyf4D+VTLeE/wANdiPB3T90fyp6+EMf8sz+VL2r7j9jHsckl0f7 tWEuW9DXUjwoR/AKkXwvjsv50/a+ZPskuhz0M7HtWpAS3UVpr4eCdSB+FTppkUXV8Y7ZAqva IzlApoGXlSR9DVu3lkeRUaMSgnHTn86nEdsnYMR3JJ/lUok4xGsgHpHHj9TUSlfoJKxHdf6M V8tycn7jc04oDD5gBibGeuBScq2fLijb1lfc1RSPGeZZmkPoOBUJMehFuEyEsoyO4FV2GDip pJs8Iu0e9Q4PU1qriDFKBk4FAGeBUyLt+tDZcVcfGoQe/epQaYOBTWYtwOlZ7my0Fd93yjpS KpPAFCrk1ZjTb9aTdhpXZJEgQe561OtRgU4EtwOlZPU3Wg4ndwOlTRR5PtSRx5+lW0XAqJM0 jG49FxjirCCo0Wph7Vi2bJD/AGFSKtNRanVahs0SFRRU6imqtSgVm2WkKBUgFIBTwKhspIAK fSClqSgpe9JTgKAFooopDCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAPmp C8Tdx7VdilD+x9K4bzH/AL7fnSeY/wDfb86+mcbnzUbo9BBPpTJLfd8yjB9K4LzZP77fnR5s n/PRvzpctht33O3G+Nu4YVcin3cMMGvO/Mk/vt+dHmP/AH2/Om43Ero9JZQ4wwqu0TIehI9a 8/8ANk/56P8AnR5sn/PRvzpKNglZnoUbshyM1cjlEgxjn0NeY+bJ/fb86PNk/wCejfnTcbiV 0enNGRyoOPSnRSsp6fnXl/nS/wDPV/8Avo0edL/z0f8A76o5RNHr0U47oRVkYfvj8K8Z8+X/ AJ6v/wB9Gjz5v+er/wDfRqeQLHtIjfjaR+fNSD7So6SgfTNeJfaJv+e0n/fRpftM/wDz3k/7 6NL2Y7Htwd/4kXHfclTRtn/liuB6CvC/tM//AD3k/wC+zR9pn/57Sf8AfRpeyGme+owznyiP xNSoRj/Vt/30a+fftVx/z3k/77NH2q4/57y/99mpdDzLU2j6H42/cb/vqnjBXOx/XrXzt9qu P+e8v/fZo+1XH/PxL/32an6t5le1PorK4zsfj3+lISAfuP8A99V87farj/nvL/32aPtVx/z3 l/77NH1bzH7Y+hWcAf6tuf8AbNQySDHMOfcs1eAfarj/AJ7y/wDfZpPtVx/z3l/77NNYfzJd Rs94kk28fZ049VzULTSD7saD/gNeG/abj/nvJ/32aPtM/wDz2k/76NUqJDk2e3GS5bpux/sp UTLcN94uf95q8W+03H/PeT/vs0faJ/8AntJ/30ar2ZNj2Xbzyw+gFJlR/CT9a8a+0Tf89X/7 6NH2ib/nq/8A30afIKx7GWPZaAjMeh/KvHPtE3/PV/8Avo0v2if/AJ7Sf99GjkGj2hYyOx/K nYIHINeK/aJ/+e0n/fRo+0T/APPaT/vo1PsvMvmse04ZuxpyxsTwprxT7RP/AM9pP++jR9pn /wCe0n/fRo9l5j5z3NIiOxz9KmCkdQfyrwb7Vcf895P++zR9quP+e8v/AH2al0G+paq26HvY Vm/hP5VYjhbqVP5V8+farj/nvL/32aX7Xc/8/Ev/AH2al4d9ylXS6H0Ykbf3T+VTrGf7p/Kv mz7Xc/8APxL/AN9ml+2XX/PzN/32ah4RvqaLFJdD6XVGPRT+VTpG390/lXzD9suv+fmb/vs0 fbbr/n5m/wC/hqXg33KWMXY+pUjb+6fyqVY2/un8q+Vftt3/AM/U3/fw0fbrv/n6m/7+GoeB f8xSxy7H1gqH+6fyqQKfSvkz7dd/8/U//fw0fbrv/n6n/wC/hqf7Pl/MV9fX8p9bAUor5I+3 Xn/P1P8A9/DR9uvP+fqf/v4aP7Of8w/7QX8p9c0V8jjUL1WBF3OCOh8w1vaZ8QvFGlMvk6tN Kg/5ZznzFx6c9PwqJZdO2jHHHx6o+nAKWvNPCXxdsdXljstZjSxunOFlB/dOfTn7v48e9elA gjIriqUp03aSO2nUjUV4sWiiiszQKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAo oooA+O6KsfYbz/n0uP8Av03+FJ9iu/8An0n/AO/Tf4V9PzLufN8r7EFFT/Yrv/n0n/79N/hR 9iu/+fSf/v03+FHMg5X2IKKn+xXf/PpP/wB+m/wo+xXf/PpP/wB+m/wo5kHK+xBRU/2K7/59 J/8Av03+FH2K7/59J/8Av03+FHMg5X2IKKn+w3f/AD6z/wDfpv8ACj7Dd/8APrP/AN+m/wAK OZByvsQUVP8AYbv/AJ9Lj/v03+FH2G8/59Lj/v03+FHMg5X2IKKn+w3n/Ppcf9+m/wAKPsN5 /wA+lx/36b/CjmQcr7EFFT/Ybz/n0uP+/Tf4UfYbz/n0uP8Av03+FHMg5X2IKKsfYbz/AJ9L j/v03+FJ9hvP+fS4/wC/Tf4UcyDlfYgoqf7Def8APpcf9+m/wo+w3n/Ppcf9+m/wo5kHK+xB RU/2G8/59Lj/AL9N/hR9hvP+fS4/79N/hRzIOV9iCip/sN5/z6XH/fpv8KPsN5/z6XH/AH6b /CjmQcr7EFFWPsN5/wA+lx/36b/Ck+w3n/Ppcf8Afpv8KOZByvsQUVP9hvP+fS4/79N/hR9h vP8An0uP+/Tf4UcyDlfYgoqf7Def8+lx/wB+m/wo+w3n/Ppcf9+m/wAKOZByvsQUVP8AYbz/ AJ9Lj/v03+FH2G8/59Lj/v03+FHMg5X2IKKn+w3n/Ppcf9+m/wAKPsN5/wA+lx/36b/CjmQc r7EFFT/Ybz/n0uP+/Tf4UfYbz/n0uP8Av03+FHMg5X2IKKn+w3n/AD6XH/fpv8KPsN5/z6XH /fpv8KOZByvsQUVP9hvP+fS4/wC/Tf4UfYbz/n0uP+/Tf4UcyDlfYgoqf7Def8+lx/36b/Cl +w3n/Ppcf9+m/wAKOZByvsV6Kn+w3n/Ppcf9+m/wpfsN5/z6XH/fpv8ACjmQcr7Feip/sN5/ z6XH/fpv8KPsN5/z6XH/AH6b/CjmQcr7EFFT/Ybz/n0uP+/Tf4UfYbz/AJ9Lj/v03+FHMg5X 2IKKn+w3n/Ppcf8Afpv8KPsN5/z6XH/fpv8ACjmQcr7EFFWPsN5/z6XH/fpv8KPsN5/z6XH/ AH6b/CjmXcOV9ivRVj7Def8APpcf9+m/wpPsN5/z6XH/AH6b/CjmXcOV9iCvb/hL42N9bDw/ qMxN1CM2rueZEH8P1H8vpXiTxvE22RGQ+jDFPtrmezuorm2laKeJg8bqeVI6Gsa9GNaHKa0a sqU7n1/RXG+AvHNv4s04RzFItUhX99F03f7S+38q7KvAnBwlyyPdhNTjzRCiiipKCiiigAoo ooAKKKKACiiigAooooAKKKKACiiigAooooAbsT+4v5UeWn9xfyp1FO7Cw3y0/uL+VHlp/cX8 qdRRdhZDfLT+4v5UeWn9xfyp1FF2FkN8tP7i/lR5af3F/KnUUXYWQ3y0/uL+VHlp/cX8qdRR dhZDfLT+4v5UbE/uL+VOoouwshuxP7i/lRsT+4v5U6ii7CyG7E/uL+VGxP7i/lTqKVwsN2J/ cX8qNif3F/KnUUXCw3Yn9xfyo2J/cX8qdRRcLDdif3F/KjYn9xfyp1FFwsN2J/cX8qNif3F/ KnUUXCw3Yn9xfyo2J/cX8qdRRcLDdif3F/KjYn9xfyp1FFwsN2J/cX8qNif3F/KnUUXCw3Yn 9xfyo2J/cX8qdRRcLDdif3F/KjYn9xfyp1FFwsN2J/cX8qNif3F/KnUUXCw3Yn9xfyo2J/cX 8qdRRcLDdif3F/KjYn9xfyp1FFwsN2J/cX8qNif3F/KnUUXCw3Yn9xfyo2J/cX8qdRRcLDdi f3F/KjYn9xfyp1FFwsN2J/cX8qPLT+4v5U6ii7CyGGJOyr+VJ5a/3V/KpKKd2KyGBF/ur+VL sT+6v5U6ii7Cw3Yn9xfyo2J/cX8qdRSuOyKN5o+nahG0d3Y28yt13xg1594m+DumXsbz6G/2 K5xkRMcxN7eq16fRWtOtOm7xZlOjCatJHyfJHq3hTXdr+bZahbNkEHn6j1Br2Lwn8XtP1CJL bXSLO7Ax5wH7t/8A4k/pXT+MfBOn+L7ILP8AubyMHyblRyvsfVfavA/EfgrXPDErfbrRmtwf luYhujI+vb6HFejGdLFRtPSR58o1cNK8dUfSaa7pEiB01SyZT0InX/Gnf2zpf/QStP8Av+v+ NfJQJHQ0bj6ml/Zq/mH/AGg/5T61/tnS/wDoJWn/AH/X/Gj+2dL/AOglaf8Af9f8a+Stx9TR uPqaP7NX8wf2g/5T61/tnS/+glaf9/1/xo/tnS/+glaf9/1/xr5K3H1NG4+po/s1fzB/aD/l PrX+2dL/AOglZ/8Af9f8aP7Z0v8A6CVn/wB/1/xr5K3H1NG4+po/s1fzB/aD/lPrT+29K/6C dn/3/X/Gj+29K/6Cdn/3/X/GvkvJ9TRk+tH9mr+YP7Qf8p9af23pX/QTs/8Av+v+NH9t6V/0 E7P/AL/r/jXyXk+tGT60f2av5g/tB/yn1p/belf9BOz/AO/6/wCNH9t6V/0E7P8A7/r/AI18 l5PrRk+tH9mr+YP7Qf8AKfWn9t6V/wBBOz/7/r/jS/2zpf8A0ErT/v8Ar/jXyVk+tG4+po/s 1fzB/aD/AJT61/tnS/8AoJWn/f8AX/GivkrcfU/nRR/Zq/mD+0H/ACn2HRRRXlHqBRRRQAUU UUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFA BRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFACVDd/wDH rL/uH+VFFVHcmex8p69/yHLv/roazqKK+lj8KPnZbsKKKKYgooooAKKKKACiiigAooooAKKK KACiiigAooopgf/ZDQplbmRzdHJlYW0NCmVuZG9iag0KNiAwIG9iag0KPDwvVHlwZS9FeHRH U3RhdGUvQk0vTm9ybWFsL2NhIDE+Pg0KZW5kb2JqDQo3IDAgb2JqDQo8PC9UeXBlL0ZvbnQv U3VidHlwZS9UcnVlVHlwZS9OYW1lL0YxL0Jhc2VGb250L0FyaWFsLUJvbGRNVC9FbmNvZGlu Zy9XaW5BbnNpRW5jb2RpbmcvRm9udERlc2NyaXB0b3IgOCAwIFIvRmlyc3RDaGFyIDMyL0xh c3RDaGFyIDEyMi9XaWR0aHMgNTQwMyAwIFI+Pg0KZW5kb2JqDQo4IDAgb2JqDQo8PC9UeXBl L0ZvbnREZXNjcmlwdG9yL0ZvbnROYW1lL0FyaWFsLUJvbGRNVC9GbGFncyAzMi9JdGFsaWNB bmdsZSAwL0FzY2VudCA5MDUvRGVzY2VudCAtMjEwL0NhcEhlaWdodCA3MjgvQXZnV2lkdGgg NDc5L01heFdpZHRoIDI2MjgvRm9udFdlaWdodCA3MDAvWEhlaWdodCAyNTAvTGVhZGluZyAz My9TdGVtViA0Ny9Gb250QkJveFsgLTYyOCAtMjEwIDIwMDAgNzI4XSA+Pg0KZW5kb2JqDQo5 IDAgb2JqDQo8PC9UeXBlL0V4dEdTdGF0ZS9CTS9Ob3JtYWwvQ0EgMT4+DQplbmRvYmoNCjEw IDAgb2JqDQo8PC9UeXBlL0ZvbnQvU3VidHlwZS9UcnVlVHlwZS9OYW1lL0YyL0Jhc2VGb250 L0FyaWFsLUJvbGRJdGFsaWNNVC9FbmNvZGluZy9XaW5BbnNpRW5jb2RpbmcvRm9udERlc2Ny aXB0b3IgMTEgMCBSL0ZpcnN0Q2hhciAzMi9MYXN0Q2hhciAxMjEvV2lkdGhzIDU0MDQgMCBS Pj4NCmVuZG9iag0KMTEgMCBvYmoNCjw8L1R5cGUvRm9udERlc2NyaXB0b3IvRm9udE5hbWUv QXJpYWwtQm9sZEl0YWxpY01UL0ZsYWdzIDMyL0l0YWxpY0FuZ2xlIC0xMi9Bc2NlbnQgOTA1 L0Rlc2NlbnQgLTIxMC9DYXBIZWlnaHQgNzI4L0F2Z1dpZHRoIDQ3OS9NYXhXaWR0aCAxOTUw L0ZvbnRXZWlnaHQgNzAwL1hIZWlnaHQgMjUwL0xlYWRpbmcgMzMvU3RlbVYgNDcvRm9udEJC b3hbIC01NjAgLTIxMCAxMzkwIDcyOF0gPj4NCmVuZG9iag0KMTIgMCBvYmoNCjw8L1R5cGUv Rm9udC9TdWJ0eXBlL1RydWVUeXBlL05hbWUvRjMvQmFzZUZvbnQvVGltZXNOZXdSb21hblBT TVQvRW5jb2RpbmcvV2luQW5zaUVuY29kaW5nL0ZvbnREZXNjcmlwdG9yIDEzIDAgUi9GaXJz dENoYXIgMzIvTGFzdENoYXIgMjUyL1dpZHRocyA1NDA4IDAgUj4+DQplbmRvYmoNCjEzIDAg b2JqDQo8PC9UeXBlL0ZvbnREZXNjcmlwdG9yL0ZvbnROYW1lL1RpbWVzTmV3Um9tYW5QU01U L0ZsYWdzIDMyL0l0YWxpY0FuZ2xlIDAvQXNjZW50IDg5MS9EZXNjZW50IC0yMTYvQ2FwSGVp Z2h0IDY5My9BdmdXaWR0aCA0MDEvTWF4V2lkdGggMjYxNC9Gb250V2VpZ2h0IDQwMC9YSGVp Z2h0IDI1MC9MZWFkaW5nIDQyL1N0ZW1WIDQwL0ZvbnRCQm94WyAtNTY4IC0yMTYgMjA0NiA2 OTNdID4+DQplbmRvYmoNCjE0IDAgb2JqDQo8PC9UeXBlL0ZvbnQvU3VidHlwZS9UcnVlVHlw ZS9OYW1lL0Y0L0Jhc2VGb250L0FyaWFsTVQvRW5jb2RpbmcvV2luQW5zaUVuY29kaW5nL0Zv bnREZXNjcmlwdG9yIDE1IDAgUi9GaXJzdENoYXIgMzIvTGFzdENoYXIgMjMzL1dpZHRocyA1 NDEyIDAgUj4+DQplbmRvYmoNCjE1IDAgb2JqDQo8PC9UeXBlL0ZvbnREZXNjcmlwdG9yL0Zv bnROYW1lL0FyaWFsTVQvRmxhZ3MgMzIvSXRhbGljQW5nbGUgMC9Bc2NlbnQgOTA1L0Rlc2Nl bnQgLTIxMC9DYXBIZWlnaHQgNzI4L0F2Z1dpZHRoIDQ0MS9NYXhXaWR0aCAyNjY1L0ZvbnRX ZWlnaHQgNDAwL1hIZWlnaHQgMjUwL0xlYWRpbmcgMzMvU3RlbVYgNDQvRm9udEJCb3hbIC02 NjUgLTIxMCAyMDAwIDcyOF0gPj4NCmVuZG9iag0KMTYgMCBvYmoNCjw8L1R5cGUvRm9udC9T dWJ0eXBlL1R5cGUwL0Jhc2VGb250L0JDREVFRStXaW5nZGluZ3MtUmVndWxhci9FbmNvZGlu Zy9JZGVudGl0eS1IL0Rlc2NlbmRhbnRGb250cyAxNyAwIFIvVG9Vbmljb2RlIDU0MTMgMCBS Pj4NCmVuZG9iag0KMTcgMCBvYmoNClsgMTggMCBSXSANCmVuZG9iag0KMTggMCBvYmoNCjw8 L0Jhc2VGb250L0JDREVFRStXaW5nZGluZ3MtUmVndWxhci9TdWJ0eXBlL0NJREZvbnRUeXBl Mi9UeXBlL0ZvbnQvQ0lEVG9HSURNYXAvSWRlbnRpdHkvRFcgMTAwMC9DSURTeXN0ZW1JbmZv IDE5IDAgUi9Gb250RGVzY3JpcHRvciAyMCAwIFIvVyA1NDE1IDAgUj4+DQplbmRvYmoNCjE5 IDAgb2JqDQo8PC9PcmRlcmluZyhJZGVudGl0eSkgL1JlZ2lzdHJ5KEFkb2JlKSAvU3VwcGxl bWVudCAwPj4NCmVuZG9iag0KMjAgMCBvYmoNCjw8L1R5cGUvRm9udERlc2NyaXB0b3IvRm9u dE5hbWUvQkNERUVFK1dpbmdkaW5ncy1SZWd1bGFyL0ZsYWdzIDMyL0l0YWxpY0FuZ2xlIDAv QXNjZW50IDg5OS9EZXNjZW50IDIwNS9DYXBIZWlnaHQgNzcxL0F2Z1dpZHRoIDg5MC9NYXhX aWR0aCAxMzU5L0ZvbnRXZWlnaHQgNDAwL1hIZWlnaHQgMjUwL1N0ZW1WIDg5L0ZvbnRCQm94 WyAwIDIwNSAxMzU5IDc3MV0gL0ZvbnRGaWxlMiA1NDE0IDAgUj4+DQplbmRvYmoNCjIxIDAg b2JqDQo8PC9UeXBlL0ZvbnQvU3VidHlwZS9UcnVlVHlwZS9OYW1lL0Y2L0Jhc2VGb250L0Fy aWFsLUl0YWxpY01UL0VuY29kaW5nL1dpbkFuc2lFbmNvZGluZy9Gb250RGVzY3JpcHRvciAy MiAwIFIvRmlyc3RDaGFyIDMyL0xhc3RDaGFyIDMyL1dpZHRocyA1NDE2IDAgUj4+DQplbmRv YmoNCjIyIDAgb2JqDQo8PC9UeXBlL0ZvbnREZXNjcmlwdG9yL0ZvbnROYW1lL0FyaWFsLUl0 YWxpY01UL0ZsYWdzIDMyL0l0YWxpY0FuZ2xlIC0xMi9Bc2NlbnQgOTA1L0Rlc2NlbnQgLTIw OC9DYXBIZWlnaHQgNzI4L0F2Z1dpZHRoIDQ0MS9NYXhXaWR0aCAxODc2L0ZvbnRXZWlnaHQg NDAwL1hIZWlnaHQgMjUwL0xlYWRpbmcgMzMvU3RlbVYgNDQvRm9udEJCb3hbIC01MTcgLTIw OCAxMzU5IDcyOF0gPj4NCmVuZG9iag0KMjMgMCBvYmoNCjw8L1R5cGUvRm9udC9TdWJ0eXBl L1RydWVUeXBlL05hbWUvRjcvQmFzZUZvbnQvQkNERkVFK0NlbnR1cnlHb3RoaWMtQm9sZC9F bmNvZGluZy9XaW5BbnNpRW5jb2RpbmcvRm9udERlc2NyaXB0b3IgMjQgMCBSL0ZpcnN0Q2hh ciAzMi9MYXN0Q2hhciA4NC9XaWR0aHMgNTQxNyAwIFI+Pg0KZW5kb2JqDQoyNCAwIG9iag0K PDwvVHlwZS9Gb250RGVzY3JpcHRvci9Gb250TmFtZS9CQ0RGRUUrQ2VudHVyeUdvdGhpYy1C b2xkL0ZsYWdzIDMyL0l0YWxpY0FuZ2xlIDAvQXNjZW50IDEwMDYvRGVzY2VudCAtMjA4L0Nh cEhlaWdodCA3NTAvQXZnV2lkdGggNDg1L01heFdpZHRoIDEzNzUvRm9udFdlaWdodCA3MDAv WEhlaWdodCAyNTAvTGVhZGluZyAxNC9TdGVtViA0OC9Gb250QkJveFsgLTExNSAtMjA4IDEy NjAgNzUwXSAvRm9udEZpbGUyIDU0MTggMCBSPj4NCmVuZG9iag0KMjUgMCBvYmoNCjw8L1R5 cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDcgMCBSL0YyIDEw IDAgUi9GMyAxMiAwIFIvRjQgMTQgMCBSL0Y4IDMwIDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2 IDAgUi9HUzkgOSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdl SV0gPj4vQW5ub3RzWyAyNyAwIFIgMjggMCBSIDI5IDAgUl0gL01lZGlhQm94WyAwIDAgNTk1 LjMyIDg0Mi4wNF0gL0NvbnRlbnRzIDI2IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFu c3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgMT4+DQplbmRv YmoNCjI2IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDQ1MDE+Pg0Kc3Ry ZWFtDQp4nL1cX3PbuBF/z0y+Ax6lu5giAP7N3GQmcZw0bZK6ka+dTnIPikzbam3JlWj7ct+o L51+pL7et+juggAoEnAYCU4eFIoGsYvF/v0tqMnzdb04m81r9tNPk+d1PZtfVKfs4+Rkdf3L 5OTLdTU5np0vlrN6sVpOpjefa7z1h2p2Wq2fPWMvXh6yfz1+FEcx/iuKnLOYpWUaScGKRERx wtbV40d/+4EtHz96cfL40eQVZyU7OXv8CEfGjLOMRzkMy8syygp2cgVjXk8zdr6Badk5fSub b68fP/o4YuNf2MkfHz86gtn+8vgRO3p3yCaeRbxY1fXqyr+OV6tVves6RGcdosijNGe8iIqE lkHcN0wfnUzfbPO9JzUZ51HGPdS+RUTftM+yyKK0hL0C4gnjqYh4wXiMfFuGh45zq4N5tIzS zC3HAzliJ/g5ZXx8kI7icTmSdDfFr4K+doW9B0tJmkZ54mPpICyp4h5SnBb513hcjKIYlxqJ cT5K6e6nEV7HeC3wIw7JVipEVIjvIoFUpF5SDCxGws35x1GcfxoHJStB8IVvhR2DUtQEGKxI NbUUrdZhCgNGuTkyDzo5Er3F70xIxnEkvBbnXHqaIQ1LKnMufcAoz2Y0Dw5kiPwbm0yvZ0t0 bu8O37xk8eTtbHnORtXy4PWL8W4eXrIyKjMXZxizhrndDlv8QdlKeCTELmyJB2VLxGjRQ9hC pclZBuuIBUsKgf+lZSSKFrUO69LD+lfn8XIt8jzKJcvKOCr7m/xhnIyqM3S+1Zo+l+ODfDSv eva4OwMSorrkPgZYj9IQYjQDB1OUsDJwk2XBRMwjWYBPzZVFnv1wn0El+8k56Xo30A0Ucl5E adFb48uT6eTw7y+OPuwq1S45GReR4D5y/QC2KxkOFuhZVTt4xX33vStFkUUy9S0sD0ZGgq6U Dy8/mdxDhocjU5KBuckM8JfpgzgdCU9Dqil7HP2p+jI+KEZ3q/FBNlpjdneKrmcT2OekqYd+ AJeT8ijJvtHlZI2Uz9YHrz4EcDlZST4gkZCK9NZ4GEq5RJ5GWekj8wW38DNuYYUf62BUS0ly dlPtb+DOZFJy224yG1wcrWsOtcgNLXAxPkhG9ZhzWHpAn5d7N9KTHxI51LskjVHTG4qciyhJ /OlF7rX0AXOZ0r1n7QorSFMZZX1zO4IUA+pbMZrCRR822I+0jMso95Ie4PsKr1UOZqufDHA0 mRSCTJz3eMpQj1JV02Kl+2GF/91AlV9X6AbZKSgbaR3pH0Nde6uGNJpIOkhPXcJTzdA9xNpT yASswsv/AJmWDyBTSEUyLKfB2aY9nl6FXL7gecSlj5QrOdidFNDwkyL9IHUpFQ5SNpDJdIWK cg3fL/A76cOM/vJ8zMVoiZf1ArUHxzSaAmMW8E0p1WGlwm6jPr8qTQuqQxJTn+8hRJlk95AK vKoiKv1a+OH5+0PwcUf7kHQlM0WK5AYvcCjBJqMpohgmR6VPvzGj4fEDGDrwAyE5hQpnN4fO +QMwFQu00wR442WPqRPy22Rh0VMywx81hKtwXHThCV2VCtHVN8mu1V8ScOzqD7EGgRmj76/w cwbfyUqfMrj6UeKlbB7EoGFmUzczA6TSn3OcjcDlLKg5IIKS+sQyZK9EiL3KCVfr61BSFFi+ 7sKXfBi+ZBwl8FxeYsLX5Wu6WFf1uAD+itF7RGH+O+awbXgFfmfMc3WdCbyUqAapuqbbcRzj Nc/3dHg9pqVII5H7mN7Tkzuo5Zh7eKiFX1sZFdJHjTYBImoG+UWhpJzjt0Sg8F0V1l68ZBnG lmErdypt8jBKK2RUoNI6s8HnGxDNBkWzQtHM8Woxw8uaLldLo6H/w7t09fkGb9ZaqMvWoMsb M826NQ1eneFVeA3gSurO1VXLdYWsnS9wmcTK+vfKrMOu6HIWmq+cChoPX0O0IX0gbcgoEmbw QN+1Tle0s3tWI32ikEyK0kc0tAsSUP4U3Eftev27UcZK6WqjGTdrF2q+FyfgC1KvsEObgiio bPVQO62Mjb7GZSvrJMtH26gYZiSfRngzzj6NlWWYQCZb7rOI5QT8Z1EENxlO2cggaTlNxo/Q 7ZvOJimM/qodt8EdjiThkxs0SSYJoixebId7wZ0Bc/mxnVRGSUnnGGRfqm+urhswQozWsMs1 5arLmnLSJZWpdGvh6ijtwxYi+EXuY8tdEw2g15REAksiCWNg5d9YEhV7b0JXhThk2QXsAOh1 7Cg+LqhtR7n+NV6ux1y28KMKTE0BAqxB2iVsV4khNiPU6cqgnEvEoJhCmeDeTD/JPisSpSoz ming4255iQNxupmZ3CAL7IwQ05Wm8XQPDehVHkWJ9uSRyRBbL4Pvk+BllIHa4Aza1PH++lxf fSDuCLOpySyu8ePpBD8nd3d3YyggK2UzIGfaPsJ2IvxKEl+f01jz53qGw3HjTlWViGNOCeYJ KGyZYpb81YU5AvEeNAtMg79K02L0au2o/KS9FwOOCfhOVezBdpb22PbqpV2RUZ0YWzo8ybAT EEcZFHXcOB3nEnwnMHZfAvj7PKPKyOFYH8TbXGlvQ90k8Da5cjZX2CWcbQGVjPT9FkbMDPJ5 qd3PZwuJh1NEAYpY5j55OHKw3SklnCKtmxItFWXGLNpUacnW4GVzJfiFvsdux81Ora0nWen9 sb2FmdoMvVsT62sYQchEU+31AhI6tbtRc2qxQaDV3syBoCGgmhlaFxoU+oxpLIv+oPa7Atb7 y2ncGnE9H8JswJ2AZyDdkGCUcb8Sv7Z9QLu6W6PWZBBtgTeqrgSO26SEUF+YoKqEW+lBlVkj hQHqB61MVO4akeZgo5xeYwqXyjDgg8S2NCGbxtqGLf31SgVxLVTUoLOFIXGq4/7dosYJL8xc N5ZHimYX29O2BLUykmF3TQu1VoN1ikF2bSe0ROgpeuQ35Sb0kLZ4NcmWkumjtRQ72ZvtcXMz 1UY32xip3BmNNkH1i6cvsrtmlVFeJHR+J+vnLbYXYzo1tbHBc8vl2spX6dx83GzWYksXT82C T423PDvTgl8bNzw3QmiobcnJypjk3lHPTeOzG2Wu7yrDVjNPQA+ZlYifeqS30ebRxH+9iFsd mNZes5xp76m8yspEtq5AesaPN590Ddp4L7LAL8Z7qadJNrc65i2MpS60Maid9pr9VoS1Lb3G BMNGPzy+nPsEHnJr84QMA8tl2U+cnD63Zewge63Bx2rzatzSz8YV0ra8vFecZPmvrN8xWYkS 9KfR8ctXn8YQVRMTVTOnE/qnsb9r87TRN+Vb2AZTm2ud1ZimPrjdvIl2S5No1XeoiYopmptU Q0nj1qz7TrnVCz0VEQu4QQkek818G2ReZJhS2J+rk106NVRVCqUPsyZ9CBmsYzz25mFsyGlh 33Hh3XmCKiARCZ2dKvup3M8bpZImNevGrpY6u3OD8pvy643xhzj0xhiFDQ+thIC2CjQubQoq dbfWmd7Muh4bqKuuw2pOS7mT/SbytpN9fHwzbhIAYuYf1jYwCqK912TZIHt45HYrSC60N1h2 Y6QNBbMt72qzlJbYMRdQqlrfjHM1dRTShjgeO4UoluJRlh6URhZ/ppg3UqoXWqp6bU2k2kq5 Sky+waOoM2rW8DrpYbM4XPaNUYx24mPntHFlOzaylZnCbv2aHakXmN7g8RNGpzm9WrmdOCy0 oInOrcnLFjp6NpVdqf240VHlsAeYt/dI/e77WGRRgtBoGomsBU648R1UqwbjuVaSOWjSWrUf lwbiUc4SDUHBPkoXzmHxE5Lvi0lbzi+rS5PPmDiwdshr6tz3yNRTG31S6NcB0vQenN8dMymz KMt90gwZKmRZYjdti5I3VJhNlpABCS6iDCGZtCzL4n5Ixnuaeme+yxgGQziRwvUGxRvK6Bmd qTYOXoGvJhNQtkuxWbmHVSf62NyqnUjaCOSDeZoKVat11/XrYU+aqfKWWs62ghozPsEEjNNm XWmr3FyDo2syLiJxNe5UwpqplfVWS7MW5eoomLSALByu/O6lxpMUvL1YIgm0P5WwKQu71Xmf KZs2oeHtpEzpfLl7w4c4vSy808tLSgCFiNKgPi8kVpchfupm0e1XjyvD3vWW05wcGjMxiqZS 7MpoznTME6WW13oCtdB6WptkCQruchTN1BsOuRo5xNHu383raVWc4Umetnj83k/vNr20JUSO gh3k/vZvgLm6kEkc8ZxxcOCOVwIPm/07EKMva9zl8wvTeWTvqTmpupBneLmYz8ZJc2O1DNyW TFI8Cufhc7+2JDYHCuoGygJGJlGJTUkglQ/oS4rw/a5MRSUOpXvZf+3o/YoZw1CVBOWhVybD +wLGoHEj3Ke1yYBUtb/SEcCce29hWi2ExmQ1CiozUMpvOgKpJzpAzkwHGVWGnKnqSDupK5sY r22BZIEcC0PbezbHNXNTXFDoUGWdy1dB7gbQvtJIw3wL2m2h/HkL7H1i4KCleeZSZwOnW387 N8HYwqz1SiMPxhd+0aVV66GQxVAmIg7qkyWYWXXVpwP0WwlbWdk8hmATksKV6SgQjGq05toU QjbjtTup1OdCV1odyNmi4KStpLceFPvaqLNVI1NJbbZe3XCD1hhQDHAdMJ8QEt8Q9Mh6QD4h w7dKeZxGRcZ4mrhcZbvRGFLpQBDgrDxE51u1dl3pyreF4XXrZKq9j1++ohHuLlBpm2Iqjfz2 Ls2Vznm9DZoW/Pe13sxd6yW2VpfObw6NKeQ+RMLAB0fYEJy+Caq5kIdkwrdhQzQ3fIecyxxz I56ALt2ruPOxSS2bgKdkea52RENiJl4oV9dRrlZoqnQbaGX9uW4MrSuVYVJkMRWdijS+dpnt N3U6O9bntkE3HZcbnTOtFhV4rZLbtvFsq6hSDX0Tku1rS0EVJiki6dmbIeoSHgwWpcAjgFzK HV/PluERLJFleMYV3aEDCfk3uBvmeItpd3IFRyDcQ871Y1L7iDvFAxseWkHbkWWBBzaclFo/ jyBi7jjqujuIpV5tH7Y+pzqFh/AQUUs4nYl1/DTK80sT7Nh6oSEVBRlgUW58V24QlnbqHhQB FFCypT5GwyqHsvp4QLHt3KX9YcTe7xCleGS6xJ+R6oNKL48O6T3tfSSwXQsXMf1GEphjnx6a R5qQeZy8Cyj1ooB9TdxrRJq8IJpP9tnprlhLCXmsh+bH0fHbn1+Djp8cTRV0H1DAPMkxg3YL +ACln4WXME8zUOjvKmCe8Sj1Cvjnd+MCQkhIuRY5Hvz6roqLsE6e+9YYtASCqCVKHyXTJtW5 6NYJP91+gtQwVg59pbCBBvhUCR/lqSqNpTqoczb8KmgwJEjTu5gDOjORbXU6e5V2E3/ONRKz 2c6I1+0T7RrhdZ54sxWbaTmoOq17XsUWYBaJeGcKOoSaW7+pgudMgh6YEHgI7SFUrWe4sDuJ YJD8OQjRi8roGo+Pg/rEmEgmLpInWH+8C32mj6cxumH3Kju1XVCvWCAQ7CKLTkpwclJvT/bJ 44te4zvFA3jOpf4Ux8VhHMfyGedwnSTPDiT8n6ZwXajrWML3XN9/xmVrXNLch7El/jl+FvJk dYzp6T071HMSGs9o3N1W9d04ibxBT9YWZG7V6o3r1J1HC3R/1TWUmBUfFF/xCgZgsqdVT0OW 0aBdZeIRWdA8GcoZUKmcR30620eitvq1Le/B/jzWL8ZsA+T3HBhuA3DsGE9TND2K5TaC25yU CBiwMsgtpHu5Qb0D4mYZ/hp13MccVkvT5iT9wl+WCZnMCE5v0LqJh1Ye/JkwJyHTx7eQmT3q YONuC9WyMV/hWgh69Qybmk6dvMgcf16ae9STaAPHTKcXW9YdULNy+sUdtywq3XrreZCALiO+ h4GgEF9Mv08VXr36+Qu1NiG+532kBZ3PNGgJIKE+9xD7DyJyM4PVO5Pz19Ox1NkN6FY7PT9Q Rz9Nem7QXfxYP2B+LjKJBwfci+pG3mFp+FarYmlScwrbd0sz/LQxzLxp0XZQ9ZawniMGtdEQ 9tw0Gb2vmoTtb8SYxbkF5Hk9/P/Soo3LDQplbmRzdHJlYW0NCmVuZG9iag0KMjcgMCBvYmoN Cjw8L1N1YnR5cGUvTGluay9SZWN0WyAyMTcuNDQgMzM3Ljg0IDM2OC4wMSAzNjAuMTldIC9C Uzw8L1cgMD4+L0YgNC9BPDwvVHlwZS9BY3Rpb24vUy9VUkkvVVJJKGh0dHA6Ly93d3cuZXRz aS5vcmcvc3RhbmRhcmRzLXNlYXJjaCkgPj4vU3RydWN0UGFyZW50IDI+Pg0KZW5kb2JqDQoy OCAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDE4NC4xOCAyNDEuNCAzOTguNzcgMjYz Ljc1XSAvQlM8PC9XIDA+Pi9GIDQvQTw8L1R5cGUvQWN0aW9uL1MvVVJJL1VSSShodHRwczov L3BvcnRhbC5ldHNpLm9yZy9UQi9FVFNJRGVsaXZlcmFibGVTdGF0dXMuYXNweCkgPj4vU3Ry dWN0UGFyZW50IDM+Pg0KZW5kb2JqDQoyOSAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3Rb IDE3Ni45MiAyMDguNyA0MDguNTMgMjMxLjA1XSAvQlM8PC9XIDA+Pi9GIDQvQTw8L1R5cGUv QWN0aW9uL1MvVVJJL1VSSShodHRwczovL3BvcnRhbC5ldHNpLm9yZy9QZW9wbGUvQ29tbWl0 ZWVTdXBwb3J0U3RhZmYuYXNweCkgPj4vU3RydWN0UGFyZW50IDQ+Pg0KZW5kb2JqDQozMCAw IG9iag0KPDwvVHlwZS9Gb250L1N1YnR5cGUvVHlwZTAvQmFzZUZvbnQvQXJpYWxNVC9FbmNv ZGluZy9JZGVudGl0eS1IL0Rlc2NlbmRhbnRGb250cyAzMSAwIFIvVG9Vbmljb2RlIDU0MDkg MCBSPj4NCmVuZG9iag0KMzEgMCBvYmoNClsgMzIgMCBSXSANCmVuZG9iag0KMzIgMCBvYmoN Cjw8L0Jhc2VGb250L0FyaWFsTVQvU3VidHlwZS9DSURGb250VHlwZTIvVHlwZS9Gb250L0NJ RFRvR0lETWFwL0lkZW50aXR5L0RXIDEwMDAvQ0lEU3lzdGVtSW5mbyAzMyAwIFIvRm9udERl c2NyaXB0b3IgMzQgMCBSL1cgNTQxMSAwIFI+Pg0KZW5kb2JqDQozMyAwIG9iag0KPDwvT3Jk ZXJpbmcoSWRlbnRpdHkpIC9SZWdpc3RyeShBZG9iZSkgL1N1cHBsZW1lbnQgMD4+DQplbmRv YmoNCjM0IDAgb2JqDQo8PC9UeXBlL0ZvbnREZXNjcmlwdG9yL0ZvbnROYW1lL0FyaWFsTVQv RmxhZ3MgMzIvSXRhbGljQW5nbGUgMC9Bc2NlbnQgOTA1L0Rlc2NlbnQgLTIxMC9DYXBIZWln aHQgNzI4L0F2Z1dpZHRoIDQ0MS9NYXhXaWR0aCAyNjY1L0ZvbnRXZWlnaHQgNDAwL1hIZWln aHQgMjUwL0xlYWRpbmcgMzMvU3RlbVYgNDQvRm9udEJCb3hbIC02NjUgLTIxMCAyMDAwIDcy OF0gL0ZvbnRGaWxlMiA1NDEwIDAgUj4+DQplbmRvYmoNCjM1IDAgb2JqDQo8PC9UeXBlL1Bh Z2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA3IDAgUi9GMiAxMCAwIFIv RjQgMTQgMCBSL0YzIDEyIDAgUi9GOSAzNyAwIFIvRjEwIDM5IDAgUj4+L0V4dEdTdGF0ZTw8 L0dTNiA2IDAgUi9HUzkgOSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VD L0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA1OTUuMzIgODQyLjA0XSAvQ29udGVudHMgMzYg MCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9U YWJzL1MvU3RydWN0UGFyZW50cyA5Pj4NCmVuZG9iag0KMzYgMCBvYmoNCjw8L0ZpbHRlci9G bGF0ZURlY29kZS9MZW5ndGggNjM1Mz4+DQpzdHJlYW0NCniczV3bchs5kn13hP+hHsmJFVS4 FqqjoyN8aXt7Y7TjbWl2H9rzQEm0zViZdEuU296vXySqKNlmJgWKyCr4QSYpUnkyCeTBJXFw /Ox6vXg3u1hXP/98/Gy9nl18mF9WfxyfrT796/js66f58ZvZ+8Vytl6slsent+dreOnf57PL +fUvv1TPX76o/nz6pBY1/PO+kVVd2dYKrSpvlKhNdT1/+uR//lYtnz55fvb0yfErWbXV2bun T+CddSUrJ0UT3ta0rXC+OvsY3vP61FXvb8Kfrd7HZ23/7PXTJ39Mqum/qrP/ePrk1/DX/uvp k+rXkxfVMeHE89V6vfpI+/FqtVo/1g/1gx/KN8I2lfTCm+hGRN+D/vXs9LfvcR9oTdeNcJKw tk+I9vqetXfCtuG7CsZNJa0S0leyBtz3gFPfhzeHu4+2wjo8jkd6Up3Bz9NKTo/spJ62Ex1f tfBUxac/BvsASMZa0RgK0lFeU36HKRmd/O966ieiBleFmjYTG199O4HHNTxW8KPOCcsqJbwa JAJWWdJUFXqMDi9e/DGpm7fTrGZ1CLynPPyhQ3XWVOiwym6sWei1SFdIeBeO6O6DKKLtBv5o Q7quhSJ7HOq6dWDj3pRDXU94F/Fl9B9MBBTzW3V8+mm2hOR28uK3l1V9/PfZ8n01mS+PXj+f Pi7DB7gew2UCU6ktXC9WUztZrufTIxX+uzko229ZlsoL5yjT1SON/dn/mZDfQo9zMdzGG9FW Upjuje/+tivKMkOUdSUlvI4EWjnRbMd5aiar5Xp6ZILZkOrjo8PCjUEIH2g8heGxAd9hLnis KHPigX/Z0UhoBMWgUY2OCaoMNDoMWJ0uBY0JGaH1j0KTHYvVKnJoSpfBsoniyiZaC0m1Zv0w Lp0BV4vi6pJ61hRD+GB4M3Xthdxy4bcwIO0T9VXgxqv46CIMXuNrt7OQvONr1ZvrVXj8aX4d 3hV/97X6fSrtZAGP339YTx1DgpeNF0oR0PMneNm0wlDmhk+prhFNUwoaHVqRlKWgMcYI40pB s0mqKc0U6/iWOamiuNzDuBxzUs3arQkfGtak6nwrtN/y4dXqeg4T/L9CslxdhxR7mX8wCoZJ AIN3AelDstLFwFGNE7UtBo52Rui2GDjGKljBegwcrtxJYElInp43eRLAErJny5s90yJ2aPqU ORZpduTPpoZv/0cnTlaXs5A1u5Hn53kYeF5DOj2/qTaLCXevfQwDzzgGXa6mUnYfWb3/mj/B OS8shZdjKCpj68PtDZ9PbRgZt8XA0aYRXhcDx+gwNiYbx+BwrDJ0U+XM4UmdA80ybIuUfRLH kSUkcZljwWNXFs+bUCgvciyP7Mji3S7O1kbgl/nF7XrarxHENF7d3IafH+E5JO7ZNeyQMSTr MD0M3EjgYsjWxglNmRs+WWsjnC0GjlZKtG0xcEx4Scty4EBNhUuBw5a2k3oJmlbYViz7tI0j S0nbOZZUdqXtvJmF8iLHAsyOtB2ibLAKhtwNzUGwSHv50zHsjNH2Ti9Wn+b5KSC85N1wPkqp oQUS9gZPY6qWwupy4ITJsbfFwNGNF7ItBo5xTliyfwwGY8M/SV0GzY9si7s9/+DIfAKyHKtS u/gnb5qhvMixhLWDf6SBlPmjE4qNf3B7fPyD2/t9aibzdzDxiZup8yVst84ZNk9DG/FqOK+l tkI5yt7wFKA0VN+WAkeHl1pbDBwDBYVNOXC8h6K5RDhsTJTUVdCyGLZl8p6JcGQJTKRyLK3t YqK86YXyIk/dUStahxFRrZGNaBWrt6FU9NAZ0ZZZ14YvlbJ7aGbesta2IS9T1v5zNT1ym62U IzOZrRefIzdV8Cy+3pPVVNb98+X0qJlcxB3uQ2lrC6z0Vrh2qNBIqEbXqLVYyB7r2Jmz4RYo KPyRTWGgNlsuRYEyygtTWqRs3caUnQYqu3Ut46gvpf+gmTbPVgGCS0eGR3Gl8FiOtcZdPJY1 4VBO5Kn0ImjMtlJYu4PHDp1ZUTxGGOYiMsJcPHS2BGffwaMVPLoOU6syaK2thdSDRUqCnQY3 NyKxNUooWRoqbZXwxcXKhHxpi4uVDaN96RNRMVFbWh9C02+e/RSK2whgbQKwHAuZO8gtc9qh vGArxevordGwiP7wKctMy4WEPbblQsLeS1gjjFTVlblBlVt8tN5Uvq3iazf/Vt3EcxnwJHLe +X1F3E0F9XTLywoOdJyfd3z3OTyOf2C2qar79s8x1JA1QuvhwtrXrBH2mDMnWbNWCpy+Zq0U OF3NGoWGwVwDa9VpbRHNdWxbIwEZcAmOTMqHoekca5G7yCRvB6a8yFMSSE2VXCwC2uYS7iU/ wjDbVAk39xIIJbDHMib99WIVD8SD8/knPsbEnjaQ31CJBwNUzNyIEx/loByhMFSgTwMEWRgq 7yMxlYXKOB/nHo9ClX0iBKeRiUaexF6aaztFedHQQepkYZI4jPk8d+Z0RHmRpz6S4jCQFdjF YWzLfbhhNg7DzZ1+vduzOgeX43rfVX7+0kbowVyWMCrHrY3IXtLBQfTSULWBvYqLFVT61cXF qpcsezwqLgZL6lZoauXaSekYjApUz2ApgiTMh+czZyTKizwVlhSDBVc0tqK3YbBD1/ZIBsMN szEYbu7ZOUzCzrt9qm5B7qiZLGZxPma45mPWinawAMjwRcPsDzM3InUElm11aai0bEAZsTRU rRequFiZQLOPCRUXjyV1JzTB5tkzoXiMCtAePMYsY5A5ExFeGF4ZA6u6RveDE4Ztawq3x7c1 hds7+zBnKCOvQdySsHiy2bK6vLyausn8fPWlOoXtqvkFjBdu4WHk0kX4bS9T9uY6fGgVn6wu VneCZm8n02ZycvoG0ag9eOfJGeFJHxh2ulwDVYyEvdM5KBDFqDGcMlCtidOwwXyFTzSUPWYe Qnb1vBYN6f7gcEyjILnvAYdtay2pQaC5mk0Mot9aw5GlkKFhVoPI3IsoL7hKPDsurD2cLNnm QvatNdww26QON3dfhbi+Bm/jsuRlYKNbeHAR53Y2vCH7vlcc72GYxtz2amOuLguVluEPyOJQ tbVwxcXKNFJooq0/hIprrpXUzdG8x7Udo3b2vfS5lmFWrcicISkvuKosI72YNrSC7VJGw77r RRjmohfCXCq9hB8V/H69CmP//Mt6ToKAAIFx/SHONWKl/cniEhY1L+Pm3Px82u/TfQmII77T +cUtvKGbtK3jnl78BehNH3nAH/5KmLaF91xVUKsf5m3Zd5I83MpBeBOmiPkZKMpBEAYPnpBu 21Ox/HeoFgyCT07j5kakslpD8isNVZg/tkRP2oGKiVvTWgia9Lk2iiK3kuHpudUkAGRW5Mjc uSgv8pSdUtzqLaz109zKtR9HGGbjVtxcyPTVDAgoktHFh7gbt55frG/vjkgfqhuFMKmHu0GG CgDIymrC3IjzRKtArbswVBpEIWRpqIzUQhcXK9MaUau9UHFRWFJPwnKrzbNHRFEYFZqewmwC QGYpj8xJiPKCVcrDNHE9fheFsa1DNi7ekkpASGmBTAuzoBWocVx7tkCuQ/hSadg0SAvdwS2Q 9RS+gT3a7Q3tV1fzL/G0xXn8ebVYT83BysfbAxwvdE1iyD+cqGuoiifMzZZ3U//8lmUDskOE ZQh1M1nDiX64lkozR12CYIsfLupwFoHwfcRBnGlhE7owVFrXcamlLFRG1nAWtDRUcEp8P1Bc g7iknoTmdq7F524QR8VmDwplPuqfOQlRXnCVrXUUauNeWMogLvtq/2YQh0Ng4LE4NMOtvQYC 8yATCqf/L6q4Rp5/69haGsL2veEHW+uaKW4uFkPPYJl/2W1sbPYxYG3mYzyzehnLv7b2E7Kz mRVeDtYMlGlgTxo1NyJ5QsFMUxoqU3s4u1caKt8t5O2Fios+k1otmte51pc7+qSCk06fjlnc IHOHp7xgFTcwut1dgcV4wGZDnzgELvrErWH0Gdki7pWv80/LaqiVIcDkJ1KnhfW4ufs+tXrH sYXQEnY53GzsjqhujRdyW29NHAYM1ZzbKJFEmGOoRFCyiaUPA/mnZAsniQlz8Sx3GN99Uy4S BnxM47swTTLtcI67eCUX2VnH0vS1cSRVFiqjLCjlF4bK1g6KxxNRcQ3skporOuJgVfx4gISS BnbMih+ZezrlBavihwnzsceV5zimLY9+/IXh+ubrT7lqnuu4/GZnKSl0B3/9rMfljXQgn5sy rj/05CE5rschcI3rcWsntzCsv1ovPoGrV/M4sL+4WnQCzuubqenWjD71d+w8tIbEN8joFCiH ChqYcxI3N+YgI940Uxgqo2qQzygMlYVb9Hw6Kq5hRlKDRRMg63F2Mi578AzzcfbMfZ3wouEq Vep4pjZwBUsKz1gunsEhcPEMbg3lGagm6Djl8z29wIsPUs4w01oZ55kDhQ9m0ZKI35iMo0TT lobKhIGoKS5WNsCRyaC4+CapuaKJkGshveMbKizpfNMwnxjP3NMpL1hPjOtWw31XKXzjmPiG gMDEN4Q1lG8enrQA49xUn+CV+8tsIvt0x+aWdycCQSRFT+CMoM9/Al15C/VfQ0VS+bhUjpob kXpcI9q2NFTGxFxxGCqm3J/WXtCkxHqcmwxWn/ubBIDMx7kzdzXKC9bj3NrHAWtK7m+4cj8O gSv349aS0nxM6lfdiejZt6mcQyiy3xocKjqwNaha3NyYIsMtKEUWhkr7GpQiC0NlwtxTucej 4iKYpAaMZj7WM81knPYgGOYzzZn7PuUF21U6HcM4DYnlRydsfmk6Z0RrSINs4oyEPWCUV9ez zQWY879WU9nffPm/2aFA7ZNxw7kunYIjMIQ95syHXTUmYdW3FDhat6D3UQoc2Hv1TTFwLCzR q11w8pvsNBHTugeWIz2bfm2niUggSyEhz3wqOXNOobxgPZWsQ36w2yerLbsmImGYS1iDMDeq JiKKaXRNxMJQ9ZqIpaHqNBELQ9VrIj4KFdccJ6mbo3mPa2Vf7ex76XMczyU5sKGXvBmS8oJV cgBKbOrtooN7elEsZ/BDP3C0dTaOwc2ddHKBi8/ANTM+StGx0WAYxuQUE/dCykKlQci/KQ6V tyBOWBgq45x4NCguUknq12i2Yz2ET0apJxWfAJD5EH7mlEh5wXoIX4dgu12kollJBbfORiq4 uTfXi1hTfLGI2+tXB9+fsU0ocCxBDeauNDLMC3FzY/KXhFN2haHStRLGFofKayGLi5VxOlLG I1FxMVhSr0JTK+s5eDJM6QzWMp+Dz5yQKC9Yz8HDhXo1svMzoBYgAYGrtgC39nK2nm3pqs+7 ZTfHMEdqLIjCDeZ6CLUhzI0paRvhFIZK63gKrjBURsYrAEtDFYaGISGno+IisaR+hGZX1jO/ ZGD2IDHmM7+ZUxDlBeuZX11bYbeL/DAS49JCIyBwkRhu7Qw8jNULnawoHLmJp21m8bRNd/bz AuqfWeQ9oTUNFYZO3hM1N7q8Z2GoennPwlD18p6loYrynnuB4qK0pJ6E5lqufZSO0qjY9JTW JgDk0jHYUFreJER5wapjAFfG1ttlhRilcemTERCYKI2w9uwinseZ39xM+9ruF1Mzub/A65ti iav8syYjmgHj0E3SUHOjT9IKQ9VP0gpD1U/SSkPVTdLSUTExWlo/QlMtq2ICGZg9GI1ZMSFz CiK8kDWrZILyaneBH780DwGBi9Jwa69XdyeW7rWbgdUW68X/zfMvNToHt+cN5no3M0PNjT4z KwxVPzMrDFU/MysNVZyZ7QWKi8eSehKeYFmlGMjgpBOZrJm1GDKnIdINVjEG1cjdtYTZ+asv VScMc1V8EOZO19fxPmLeSx+1jTwykMdSOyFxayOylnQgBVwaqrYRprhY6caLurhYGevjEsKj UXFxWFK3wlMrq6QEGal9OIxZUyJzTiLdYBWV6IUwd3EYd+EHAYFrNoZb+zt4ODsHPptf3VTf 3ccXfvMh3osAanWm09D/5t7j/JtoIbMqOVxcAs1LIjAj0ksT9e8LQ6Xh8HZxsTJQqloaKKtk 5LyHUHFRW1LvwTMuq5gFGZB9qI1ZzSJz6iHd4Cod7ajN+BjUBGrjKgchIHBRG27t5BTULSJz RdkkkLc48ht5iw3DfSOA118Gu2bRSWpInFw6Sai50XWSCkPV6yQVhqrXSXo0Ki5uSWrAaMqT XHsrHbdQgeq4RdUpCJlFKjL3ftKNPBWdlFQSaBNs15YcqrmKCCUpIT1ljk0nCTcHRHIGmt7T thNK+nQ1dZPZOhYVhteq36dmMv/zNjxcwK/7FcH+zfBgOZVysoZnh3ILIiwkbaxQGChSYE5r whxznkRkjGoN8mOloGklSLsWgsb4eNlgIhouQaOkdolnsjybGKSgEY5M6RRozIoTeTsz6QWr 4gQMeluDUAW3oBFhmG2XCDf3z5vZ+y79557zKAPHgYfyUoahX02YG3EyAVfttcWh6gTHC0PV C44XhqoXHD8MFdc8J6lv4TmVVdeCjFY/z0niLmZhi8yJiXSDVdkC8otRO8mLfXsIh8C1hoZb +8fnuHJ2f5nRYv5XdgBWxU43lL9Wx/V5zNyI1KFNrCooC5WGuWVTHKrwgaa4WJnQbzXRjHej 4mKxpA6FJ1dWbQsyRHuwmGIWt8icjUg3WNUt4Gr67bPNGIlxbQThCJg4DDd2uu4nYhX8jC7/ VJ3Or+Zx9+dOBXCzH9SLX1zMNzf5MewGeTifN1Bo+s0gzNroe0Flgeq3gsoC1e8EPRYUE7Uk tV084bEKTlBh6onFpABkFpzI2+1JL1gFJ6TXMNRJI5b4qM0/TfImrvYRWBjWwRq4d5kw9+YW 6CJu/ETFidXmytf8y3+2hcLwwdwO+Ufj1sY8ziRBNrYwVFopkI0tDJWpNdytXhqqAKclOu8O VFx0ltSZ8ETLqjZBxmcfQmOWm8iciUg3WPUmZCMhq+7FaDyK6d5FcVsCEBut4ebub+WIrBbv 4lj/VJ3Ay6dvpqabMkXdpXmssYtvu5qtu8lWVxcB9XXxk4soVhEvoO0qI2KxOUO5XaNgG2ao ECrQySDMjchG1oIYQ2GojHZgujBUcN1TkwKKi3+SWiqeFlm1IciQ9PxjUxAyi0Nk7uaUG5pV HAIux9O7iyW2+Ce78NFmRoVjYaMe3Nw/4uHa9Scgig3vvJj2c6x5f7XtEv57/+Pa3Tt4dREv R1ffcZDbUFBXD85FP14J3w4WRhW+Ni9xc2MWHVhhmtJQGeNA274wVBsWSGoweHJiFVYgw7UH C2hmYYXMvY10g1VYAW6je6Bkjlv1joDAtWODW/t+y0Z1WzYvVneTkZjg4xJbZIOPd6dT42+7 rZuY/J/FAz2zq6/w381UBgLIn+5NHTdYBgrcZu0LMzf+2ldZqDZrX4Wh6te+9kTFxTpJ7RZP hqxSCGR8etZJuBhQamYphMydnnSDVQpB6ia11o1LmI6AwMU6uLXvWUd3rPPq9o5m1h/ib6/v phv3lHPHMBoIpl8Wezu5o6m4LBZLDfTmA2+n2ZnBGriMaKhYgjkoY8DMjakpZ4UivuIxNeUs XG9eGqrWCUt0PhwVFwclNVk8NbJqFpCh6Tko4QILqZk1CzL3d9INVs0CqezOSrXs9Wn9WSHc LtdRIdxad7wUqCV5C+X79StzIGBZI9ld1SCOgyL+ua6fy19y00mwJJuhvhAFRwBbwtrLYS/D Um0NB3iH8rxVcLk8Zm1M9Todt4WKAmXgoMAhmLjYMqWhoDncsIowUJHagysNswZD3j5GesFV 49hRpTS7i++yLw1uuBI3zEaWuLmi2RKFzEqXA30nG77EzT108db90mx2zUDYbKvtcHEI5hQR hzE325RoiSCMudmmQWahMFQWjs87qsGwcXZS+8TZhGvLqSNt6tvpWTtFlc8wq2Fk7tykG6xy GLJWuysMuUTTCcNstI2bK5q2UcistD3Qd7KhbdzcmJeLKd+CiPRggQjmvMXNjTntrYUlgjDm vFcK6Q9DxUWjSc0Fz+6swhxksDoa1SkChIZZmCNzXyPdYBXmaKUwbleJjGWiUcIwF40S5kqm URwyJ40O9Z30NEqYG/hCM+UlqOQP5ns340XNjT7jLQxVP+MtDFU/4yUaDBdVp7VPnEFY1UfI b6enapmA0DKrj2Tu3KQbecqGKa1g2NTZnrY/C5ON5XL+pXqWX5w2kKetKcNdPc5v02ay7AtI pdwUkEY5X9vJ934Gxd6Dy3O2wUm4DMkT4H4Cy9U/pxKOjbeTefVidjOf+slNtXrXkUoAG9g/ OyplHCjo4qgY5IONhyIl3BxzZkQEe3XIVW0paAyMamQpaKzUIQntQpPfZCcZnNQW8YTGJn7e SQbjyLRKgcasK5K3A5NesOqKgNbNNl8ISNH5VRYDxSrCJNekDjV2f8b6m/W2y8BIcRJ3L1CV uxTWwGAIQTSirIdqoTSlKExa1rBOWRamthausDiZ0J802sIfwsQ0/0jp2HiKY1X0IALUzz2S iIRZzyNrRtw48f/mXzezDQplbmRzdHJlYW0NCmVuZG9iag0KMzcgMCBvYmoNCjw8L1R5cGUv Rm9udC9TdWJ0eXBlL1RydWVUeXBlL05hbWUvRjkvQmFzZUZvbnQvQkNER0VFK0NhbGlicmkv RW5jb2RpbmcvV2luQW5zaUVuY29kaW5nL0ZvbnREZXNjcmlwdG9yIDM4IDAgUi9GaXJzdENo YXIgMzIvTGFzdENoYXIgMzIvV2lkdGhzIDU0MTkgMCBSPj4NCmVuZG9iag0KMzggMCBvYmoN Cjw8L1R5cGUvRm9udERlc2NyaXB0b3IvRm9udE5hbWUvQkNER0VFK0NhbGlicmkvRmxhZ3Mg MzIvSXRhbGljQW5nbGUgMC9Bc2NlbnQgNzUwL0Rlc2NlbnQgLTI1MC9DYXBIZWlnaHQgNzUw L0F2Z1dpZHRoIDUyMS9NYXhXaWR0aCAxNzQzL0ZvbnRXZWlnaHQgNDAwL1hIZWlnaHQgMjUw L1N0ZW1WIDUyL0ZvbnRCQm94WyAtNTAzIC0yNTAgMTI0MCA3NTBdIC9Gb250RmlsZTIgNTQy MCAwIFI+Pg0KZW5kb2JqDQozOSAwIG9iag0KPDwvVHlwZS9Gb250L1N1YnR5cGUvVHlwZTAv QmFzZUZvbnQvVGltZXNOZXdSb21hblBTTVQvRW5jb2RpbmcvSWRlbnRpdHktSC9EZXNjZW5k YW50Rm9udHMgNDAgMCBSL1RvVW5pY29kZSA1NDA1IDAgUj4+DQplbmRvYmoNCjQwIDAgb2Jq DQpbIDQxIDAgUl0gDQplbmRvYmoNCjQxIDAgb2JqDQo8PC9CYXNlRm9udC9UaW1lc05ld1Jv bWFuUFNNVC9TdWJ0eXBlL0NJREZvbnRUeXBlMi9UeXBlL0ZvbnQvQ0lEVG9HSURNYXAvSWRl bnRpdHkvRFcgMTAwMC9DSURTeXN0ZW1JbmZvIDQyIDAgUi9Gb250RGVzY3JpcHRvciA0MyAw IFIvVyA1NDA3IDAgUj4+DQplbmRvYmoNCjQyIDAgb2JqDQo8PC9PcmRlcmluZyhJZGVudGl0 eSkgL1JlZ2lzdHJ5KEFkb2JlKSAvU3VwcGxlbWVudCAwPj4NCmVuZG9iag0KNDMgMCBvYmoN Cjw8L1R5cGUvRm9udERlc2NyaXB0b3IvRm9udE5hbWUvVGltZXNOZXdSb21hblBTTVQvRmxh Z3MgMzIvSXRhbGljQW5nbGUgMC9Bc2NlbnQgODkxL0Rlc2NlbnQgLTIxNi9DYXBIZWlnaHQg NjkzL0F2Z1dpZHRoIDQwMS9NYXhXaWR0aCAyNjE0L0ZvbnRXZWlnaHQgNDAwL1hIZWlnaHQg MjUwL0xlYWRpbmcgNDIvU3RlbVYgNDAvRm9udEJCb3hbIC01NjggLTIxNiAyMDQ2IDY5M10g L0ZvbnRGaWxlMiA1NDA2IDAgUj4+DQplbmRvYmoNCjQ0IDAgb2JqDQo8PC9UeXBlL1BhZ2Uv UGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA3IDAgUi9GMiAxMCAwIFIvRjMg MTIgMCBSL0Y5IDM3IDAgUi9GMTEgNDYgMCBSPj4vRXh0R1N0YXRlPDwvR1M2IDYgMCBSL0dT OSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9N ZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyA0NSAwIFIvR3JvdXA8PC9U eXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQ YXJlbnRzIDEwPj4NCmVuZG9iag0KNDUgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9M ZW5ndGggNjYzNT4+DQpzdHJlYW0NCnic1V3bchw3kn1XhP6hHrs3RqXCpW4TExMhyR6vJkYz 2iVj98GahzbVkrlLNTVk25b26xe3aspiJoVq4qBAR5gUW02dk2ggTyWQmXj67Gp//m5ztq/+ 9Kenz/b7zdnP27fVj09PLz/+8+np54/bp6837893m/355e7pyS8/7e1L/77dvN1e/fnP1fPv XlT/evyoqRv73zD0omqqdmxrJatBy7rR1dX28aP//rdq9/jR89PHj57+RVRjdfru8SP7zqYS VSfq3rytH8e6G6rTD+Y9P5x01ftr889W791PY/jph8ePflxV639Wp399/Oh786/9x+NH1fev XlRPGSOeX+73lx94O/5yebk/1g75lR1y6Ou2r8RQD9qZ4dgH0t+fnrz8Pe97oqmmrzvBoM0Z olmfsxq6uh3NZ2XAdSVaWYuhEo3lfUM49n30dDj86li3HT2OT9SqOrVfTyqxftKumvW4Uu7V 1v4o3Y9fD/Y9KOm2rXvNUXqSFmq4A0o4I/+rWQ+rurGm1nLdr1r36puV/XNj/yztlyYlrVbK epBZRqCVLQtVmRWjzItnP66a/s06KawyAz9wFn61oDyaNAtWthNaa1ctsRQi3kUzOvwiyUjf Mv5oINU0tWRXHGl621mMG6iOND3iXcyHEX4xkpDzb9XTk4+bnXVur168/K5qnv5ts3tfrba7 Jz88Xx/n4VU11mNHMbOaddvtPqv96ruPnycwe1FryYJWqeHMqEvexr9vf3PuZv1Ers536yd6 9c7+fGW/bK73V7+sn/Srs7351vkXt3+wb3Lvv16bH6+s3/rVfjk/217/obJ/u1mLZrWzr721 X774x3frbnV5+A0rTvb7LrXNsjeOQ2UbYtn3bqlScM7HORdXf+O/1KxU29ejKI2VNo65HUpj 1QqzSmQEq+TAsnM6FTVTKccoQI5RGv3kx8OLtpLf5icT8BsrIezrXwt816Ve4owRCqo+rRFR Tn1uP/gmUh8aFKY+NNzJZ2uj1ZH99sNBKpyunNm/+cW+5mTnfP/5oFObnRWlG2lx77pOzVyM olaKY+517xbd7oZtao1RqpYi2+cmla41A7egpAnz2NkXx8r8Ql/cWGnzDKSGY1ihNC5q6lLu V0M1jhugeI1rwRqXds0zRnRQjTOWDJLRuNuxbyKNo0FhGkfDvd46SXBh1eVBzz64OMkJ2dk2 uXTZCTNks1+0wj08U3DL+T+pRD2MpbFSQtZtWxyrUdWiuLHSvaqH7ihWKAmLWlGUd+2hEsaN UJAw9W1+A1jC0roixogRKmGyrxWjYC1KwUhMmICRaP/4aPf+fLxzs2EHibi0shv8mYy2aHZm EmgLipbULugsipRqdD32pZEa2rorbaR0Z2KuIzmhJCtmNZEbi6gjFy9ZzBjFK5ZIsfN5l2Ql dUOcESm2R3nJEq2dArRmdSjNokFhokXDvVhrH225QOuj/dPF+cbplom3pp1E946f/F++d0de VuA6lL6N2maU5BogMXY2pYSEW1DhwllZWayms7KyWE1nZWWxms7KvskKpWhR64f0tqhzHC9p 3IDM0LQUO513aVpa18NZkWI/lBc18zQqb6eReFHrUaJGg8JEjYb73mqW06a9jceCrvkTp2sj eNvK51iYF7f73y7t5uLVelj9r1cz5vTsrdG7zX5TmW9eGT3Alf27bXINlLpz50qZxlPqvm4Y uAXVxjxadn1prHQz1Kq4sdLDUI/DTFYo5YmataRLRJ2ueOXhBicoTxtBMMUG5V3Kk3bBc1ak 2MYUgjLDaU83yHq8LT3rdrXb2SyAT9Xz+7kwEls0TS0Y7Dcr67Jf7mzGnT9iulqPNuixscy6 X51bRfh1a14j8mvvz6xTZvrRzP7ooqzv16JdffLJHR/XQq0u3MHXVWUYvTp5Xb0wHC937y7N j1cfzDgadTJvskIkV5Ub2PSslVnNUjG0N47g57UQq+tzo6n3U0AavxV1PzL4gPmjWlWrlsGD +nOSjtaCnTTZybRGio1fivosSI+T4syBZdZJhpnqvk1NptjAu8Olp52/nBGo/Ebvz83jvbid WfHcrPvaeiCRPJxo6kGyuKhwgoF7+dXT/qXP2O58Qt0ZKjlbaPvMQnJa8uBlrFVxrJRobPhS GquxseFLYay0oaOYuf4tVqB4IW6Zk24PdS4g71x7IV6IEZcUW2l3iUtaD8lZgcos9OrSjlbB WXVJX1kU1IXGhakLDec2qz65vagPNoPAn8Fsrg7lQyfbi60XmXDg4l59fWVeGMJWlN20Sr8F ZZzqMGYbJWnmeK9ouAX1bpRO78pipXploQtjpVsX5d6DFEpfoqYw6fhQW/ReX7ihmqEvKTbM 7tKXtKufswKV9uf1xTxIi69H+Yn5p7Xyc/J58onX2fMjGvlHW6feouKmoVYsbvqTc6FqxYCd Wvt+Ppy7bDf2675yEmdTB9zByvaicjtwXx21bK6v162Prm7SEqwCJg9mOpuwRc6PwyrcpRdW 1dZDm+tDksoYSX9KSwZsve1YUBipcXD7nUWR0mZJHzFQKCWNmbOkh09x4sAL6Z0rOEpHU+xP 3qWjSRc7Y4SCdn/ojCPp74rSJlVLH68FVSMJoFSNBIuOxb5MnHNCtj9zv+T0LHkhk5RNrcdc AySlqAdBoi2ZfC1r3ZZGalC1KG2ktD2MHI4lhRKWmKlL+jxoYwdukOKFRYEbO6Rd85wR0MYO nWxtPQurLOl7O4T9PxoXtv9Hwx0ysJ2e3Fn+OnhRebazSrK5+Gy/Wak5hzR1kCLbCIlRub0/ Gu6rMXFj4HZNT9fj6iS9urV112Yz3cagAwO3pJr27oGiMFaDeYgubqx052o2j2OFktOo2Uu6 emgTCXaQgqD2EQTBXSQSL3zOCmgbiU64ms07FBW+A0kzQAVrNNp3m/3moBghSNt/Eb+l5tK7 Fp7ZTO+7WjNwCx6YtX3djKWxUqqv+7Y0VlqYxVLcWGnzvGr8cTwrlIZFrSPSuUK7SLADM0PD wG0kErsgzgpoH4mukXfmHH6pYTA1G1ofKdJc0rt02dtCRgbuH7/edJjwnWS3vyVn0PVu8ecy 2D47M3ALapgebVvcwlgp1djmQ4Wx0jZLqLix0qOo23mkUCoWtZIo96qhjSXYsYlXMQ3uLJHY CXFWQFtLtGNjD7pnqVjy87OgYgwXlIoxcK9OXqfPlDeAHN7tWxrui9Y2VrM48zaHaoG3vhXU 5aEn/OevTwzdzub5xda99p+2MvlfdqvX9sc994XFLl9m6zaA9+kTUQZptzpzzQs5aHtuSMIt KKtdW+u+NFZad9b3FcYqaFrchCGdLbSzBDtaQdOGCILgzhKJ1xpnBbSzRNuPtrv0LE1LfoY3 aRrNBaZpNNxX7jy94mi7sciAAwRusDvgDNxtgUuOPwxOJ2j8cBA4xKmp9tk3edR0tCd5JO0l SwWMw2EGc8lSAcFOsVhWKHGL8iik14U2r2DHaoa4gZtXJHbGnBWoVFIvbp3rOTNL3JI3Zp/E jeYCEzcaLpO40eAwcaPhfBNfd0AYNG7jSxS+FbBZjbEdOXyxA1hnGlu1kGty2CBRjjTcklGb rMe2NFba9kpm5vKSUZvrKcRMGJiORs1P0sGjzpW8jnIfTryOtuCOIYmXNmcFtGVIa76Jdp6O Jm8PP+kozQWmozRcJh2lwWE6SsP93W16po8Me3UHaHob7fWY7PR59vGmXP/8bPOTVXv3ZOCf FtTdDwsZAlLVDDaJN9fsD01YSLjFm7AUxio0YTmKFUqvo6YJKSTQJizsGAW9HiMIgpuwJF5h nBXQJiyt1vaeiFl6nbw1/qTXNBeYXtNwmfSaBofpNQ3n1Ol//O2c++1bq0pR55TZtlZ9yJtp XkwhLwW3fMhbFqsp5C2L1RTy0hMGJqFR85P07dA+M+yHM0NCwX1mEi9tzgpon5lWuWrfCAlF VcgzDEBVFwya6/xyddPXxVYouihp4zJXvUac2UbMyS9/ttmrdjLlGgafvUrCLZ69WhirkL1a GKuQvVoaK5e9OosUStGiVhLpaqENX9ixmaFo4I4viZ0QY0UHbfnSShGZvQrsaTYFhTQXWFBI w2WswchmcFAxCm55FSuL1aRiZbGaVKwwVl7F5pBCqVjUSiLdK7S7DDs28SrWgdvLJHZCnBXQ /jKtPZiISukB9jCbVIzmAlMxGg5Xg0HjwWowGPMeYA1Gpnkx1WBQcMvXYJTFaqrBKIvVpGlR E4Z0ttAOL+xoeU3TIoIguMNL4rXGWQHt8KLHITJNVcJrMBguKE1j4PIc1zHgqOM6Bo4VuGKr IkhDFq+KKIxVqIq4FyuQ3MStcdIPQpuxsGM1Q27AzVgSu0fOCmgzFj30kdmcEl4VwXCByQ0N l0luaHCY3NBwD6gqItfkCCkiJNziKSKFsQopIoWxCikizISB6WjU/KQcfA9tB8N+OPE62oPb wSRe2pwV0HYwum8jsywlvCqC4QLTURouk47S4DAdpeGwVRHZbPRVEQzcQ6mKyDX7Q1UECbd4 VURhrEJVxFGsUHodNU1IIYG2umHHKOi1jCAIbnWTeIVxVkBb3ehOR6d0oqsiGC4wvabhMuk1 DQ7TaxruYVRF5JoXU8hLwS0f8pbFagp5y2I1hbz0hIFJaNT8JH07tKEO++HMkFBwQ53ES5uz AtpQR7cyMoc0/T1PviqCYQCqimDQnp05Gdm6q22dYvz+4qf91eG+wIv0EZuu+4zj4C+mIOEW v5iiMFbhYorCWIWLKUpj5S+miGeFErSodUR6WmhnG3Zg4gVtAHe2SeyCOCugnW20FpHppMBr lqaYkOYCiwlpuIxFEdkM9kURJNziRRGFsQpFEYWxCkURpbFyRRGzSKFULGolke4V2u+FHZsZ Kgbu95LYCXFWQPu9aDlGJpACy9YnFaO5wFSMhoMVRTB4qKIIzryHVxSRa16EoggSbvGiiMJY haKIwlhNmhY1YUhnC23Awo5W0DQVQRDcgCXxWuOsgDZgsdsWIiq7BrjpOGkazQWmaTRcptM6 Ghx2WkfDPcCiCMqQ5YsiymI1FUXchxVKbqLWOOkHod1R2LGaITfg7iiJ3SNjxQjtjqIb8y0q OUThiyJoLjC5oeEyyQ0NDpMbGu4hFUVkmhxThggFt3yGSFmspgyRslhNGSL0hIHpaNT8JB08 tD8L++HE6+gI7s+SeGlzVkD7syjza01khgi6KILhgtJRBi6PjjLgKB1l4LBFEdls9EURDNyt oojUwiuUFV4GvcTyi1zrLJRfkHCLl18UxiqUXxzFCvRkEDdNSMmCdrlhx2jGkwG4y03iFcZZ Ae1yowZVtzMPKVHlFwwX2JMBDZfpyYAGhz0Z0HAPo/wi17wIwTUJt3hwXRirEFwXxioE18yE gUlo1PwkfTu0cw/74QQJ1REEwZ17Ei9tzgpo5x7Vy1pESWjyrelQfsEwAJVfMGg/uCjz8nA4 eKjAON+f/59RiOTpo109ZjTdZ6uScItnqxbGKmSrFsYqZKuWxsplq84ihVKxqJVEuVfRQBvn sIMTL2OiAXfOSeyGWDNS7HULQdnhpczmN97e6362ble73Vqttp+qF/dzrSS4mUD2c6bB36xs FPJyZ68zcgHJ5dV6XH1wtx/t1/3qfP1Er37dmtferAHUOm0lj6b2R0uiWguxemngd9e/vHtn 9c4SOjMvuD9sd5Zk9erkdfXC/OFyZw8mv7SjX212Z9vq2W5tzzfX3erz9bn5V+4XTJG2qHas e8EZA/hcVSdsfwoGEOpqST7ayOU4HMMnPZdW9i5UifowaGeQ4siI5WaDO5qbbmPIgVufJJ7E rBnQ3ifK2DLeTtF5MUUOwj9Hpw4azEO8ZsGTw42jmecsnLvK7m/2ywkgXBndiRGFbJ8fZOuf IF5t0kcnqq9Hzub0m3xaOF/CGaqVf458md5O41E7Bhmym6nMx8bPpXH1s7sAERH9tfms7IWL NWm4V+dv7W6ri7Ht1mzqkLIx7kFx4IebJi/O92sRgnz3gsu1ctH/J/sMkz7S7ewDdi6nJXXv DjW5FbVQYG11mRmEBUPYZqhVcWOlh8E9681ihQqto2Yt/QACbdDDjk4IraOe9MAdehIvedYM aIseu3L17cfVw5Ne+uuKG3+kSuPCHvJouNObo0IvHpu9PVPUEWeK1fX2wp5Pyps84NSuXhru bbaRsnCqp+EWVJaQxFMYq5DEUxarKYnnGFYogYmavLTfgzbMYQcpCEwXwVCAO+YkXvmsGdCW OUp0dgHfITA3jXIQmwpDY+YhSwN1EkmjObn5+RCUbF3V4r764M8nOx86bX0pyWZ3CKZcLLNx 3eOcGn2wCuX0ykrP4CtQ0ue4qNYWKuYaOKk6+zRFwi0pP71tWlUaq3GoZXFjpfuhPmaoUNIT NXFpjwjtcsOO0BzpAbe5SbzqWTOgfW5Uo2t9Ow2WkB4JlR6aBkp6aLQTG624SKXzevFlOuXZ 1iqO3UKz/1eHbqRObfZn7pec6CTfv5SysWxzDZGUwh7OkHALuvNG1rotjtWgbAPiwljpTjnn fiQrlNZEzV/aBUK7z7DjNEdrwO1nEi9+1gxo/xk5SpsRzmpN+gbXfh+NwUXtozFwx6bl6xDb uJ83F5/tX1oJOk8fzYjRptCT/BdMkzTDaoKewlgp8+DSFjdWunNnyUezArn+uAVIeyRoJxh2 oILr72MYglvBJPZenBkS2gtGDsI+vt3h+mGtoEOaPcMAFGEwaN9t9hufdngTWOy/iDmS5yLY 2rx8pvuLDUi4xS82KIxVuNigMFbhYoPSWPmLDeJZoWQsah3R3hXaiIUdmRkyJsGdWBI7IdYM aCsW2Y135nyq3x/UQO82YLigCq4ZuIx3G2Qz2FeLkXCLV4sVxipUixXGKlSLlcbKVYvNIoUS sqiVRPtXaN8QdnDmCBm4cUhiN8SaAe0cItvBepNZQoa63oDhAhMyGu4V6noDBg91vQFn3sO7 3iDXvAjXG5Bwi19vUBircL1BYawmWYuaMLS3hfbyYIcryNoQwxDczCPxamPNgHbzsIUm4zBP 1lA3HDBcYLJGw+VpiMWAoxpiMXAP74YD0pDFbzgojFW44eBerFCKE7XGSUeooG032MGaoTgK 3HYjsYNkzUAlKnrFUeYxrZunOKhLDhguMMWh4TIpDg0OUxwa7gFdcpBrcoQ+jCTc4n0YC2MV +jAWxir0YWQmDExKo+Yn7eFRZz5eSrlPZ46UghuqJF7crBnQhipSKtsUcJaUou45YLjApJSG yySlNDhMSmk47D0H2Wz09xwwcLfuOTCCX+LtA7lmfyhcJuEWL1wujFUoXD6KFUqyo6YJrSTQ zhjsIAXJHmMYgjtjJF5jrBnQzhhSSJvxN0uyURcQMFxgkk3DZZJsGhwm2TTcw7iAINe8mAJf Cm75wLcsVlPgWxarKfClJwxMRaPmJ+3coe0/2E9nhopqcPuPxIubNQPa/kM2xlHFiGj6RlOh NoIkgCqNIMFc24+rm6Yeh16FG5da6jXizLaRTt6d0KaX2qmUaRBCdimBtnxyaVGkptzSokhN qaVlkfKZpTM4obQsZg3RHhbaToQbmjlKBu4mktb9sFZAm4mIwbiROCFDV0fQVFDBII2WsTYi l7levCi0xcWrLFJBvMoiFcSrMFJOvOZwAolX1BqivSq0Pwk3NHPEC9yeJK37Ya2AdicRfR+Z OyrhJREMF5h80XCwkggGD1USwZn38Eoics2LUBJBwi1eElEYq1ASURirSdOiJgztbaGdV9jh 8qrWihiG4M4riVcbZ0YL7bxir9qMS1CV8JIIhgtM1mi4PEd0DDjqiI6Be3glEaQhi5dEFMYq lETcixVKcaLWOO0IoU1S2MGaoTgtuElKYgfJmgFtkmIdYFwep4SXRDBcYIpDw2VSHBocpjg0 3AMqicg1OUJmCAm3eGZIYaxCZkhhrEJmCDNhYFIaNT9pDw9t08J+OnOkFNymJfHiZs2AtmkR ZjXE5VdKeEkEwwUmpTRcJimlwWFSSsNhSyKy2ehLIhi4WyURqbVXKKe9NHqJxRe51lkoviDh Fi++KIxVKL44ihXq4SBqmtCaBW12wxBLLkutUnXP+pWoRxBwS53EK5k1A9pSRygRm5yKrvCg qcAeQEi0TM8fJDbs8YNEexjVHZnmxBTCE2jLR/BFkZoC+KJITfE7OVlgCh0zNUmP3kF7A3Ef zYzgvQO3Bkq7qlkroJ2BhGzikmEV8mI9mgWotIMGe3bmNGTrLmd1cmEHwV2e5/aH91eHy/Qu 0gef2j0kZhoFfwEGhbb4/RdlkQrXX5RFKtx+URgpf/lFNCmUmMWsINrLQrvzcOMSxEzGEAQ3 50nrfFgroL15RDNEJscCb3KawkCaCywOpOFyFnfkMjhUd1Bwy5d3lMVqqu8oi9VU4FEYK1/h MYcUSsWiVhLtX6Eda9jBmaNj4I41id0Qawa0Y83Y17qLSk4Clt0HIWO4oISMgYNVeTB4qCoP zryHV+WRa16EKg8SbvEqj8JYhSqPwlgFWYubMLS3hbaQYYcryJqKYNiDW8gkXm2sGdAWMkZR xqg8IQUv8qCpoESNRstzSkdjo07paLSHV+BB2bF4fUdZpEJ5x31IgZQmanHT/g/a4IUbqjk6 A27wktYvslZAG7z0up4ZO6EKO0gmKJEhwfJoDAmNkhgS7AEVdOSZFCEXhABbPBWkKE4hE6Qo TiERhJwoKM2MmZW0L4e2lWE+lzmKCe4qk3Q5s0ZAm8qYZTnMPDZD1W/QVFCSSaPl0UwaGyWa NBq2diOXhb50g0bLVLlBg5dYuJFpgYW6DQpt8bKNskiFqo1jSIEeBaKmCC1T0G483BCFhwEd QxDcjCft6pqs+H9BV3vxDQplbmRzdHJlYW0NCmVuZG9iag0KNDYgMCBvYmoNCjw8L1R5cGUv Rm9udC9TdWJ0eXBlL1RydWVUeXBlL05hbWUvRjExL0Jhc2VGb250L1RpbWVzTmV3Um9tYW5Q Uy1Cb2xkTVQvRW5jb2RpbmcvV2luQW5zaUVuY29kaW5nL0ZvbnREZXNjcmlwdG9yIDQ3IDAg Ui9GaXJzdENoYXIgMzIvTGFzdENoYXIgMTIyL1dpZHRocyA1NDIxIDAgUj4+DQplbmRvYmoN CjQ3IDAgb2JqDQo8PC9UeXBlL0ZvbnREZXNjcmlwdG9yL0ZvbnROYW1lL1RpbWVzTmV3Um9t YW5QUy1Cb2xkTVQvRmxhZ3MgMzIvSXRhbGljQW5nbGUgMC9Bc2NlbnQgODkxL0Rlc2NlbnQg LTIxNi9DYXBIZWlnaHQgNjc3L0F2Z1dpZHRoIDQyNy9NYXhXaWR0aCAyNTU4L0ZvbnRXZWln aHQgNzAwL1hIZWlnaHQgMjUwL0xlYWRpbmcgNDIvU3RlbVYgNDIvRm9udEJCb3hbIC01NTgg LTIxNiAyMDAwIDY3N10gPj4NCmVuZG9iag0KNDggMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJl bnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9GMyAxMiAw IFIvRjkgMzcgMCBSL0YxMSA0NiAwIFI+Pi9FeHRHU3RhdGU8PC9HUzYgNiAwIFIvR1M5IDkg MCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlh Qm94WyAwIDAgNTk1LjMyIDg0Mi4wNF0gL0NvbnRlbnRzIDQ5IDAgUi9Hcm91cDw8L1R5cGUv R3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVu dHMgMTE+Pg0KZW5kb2JqDQo0OSAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0 aCAxOTM1Pj4NCnN0cmVhbQ0KeJzNXF1v2zYUfTfg/8BHaUBofoscigL5aNMOC5DVxvbQ9kFz lNRbaqe2MrT79eOlnHSNSUe2SVt5MCKG8jn3iryHvJfK4HheT67LcY1evBgc13U5/lRdofeD 0ezu42D07a4aXJY3k2lZT2bTwfD+zxqa3lTlVTV/+RKdnJ2iL/0ewQR+tC4oIkgaiTlDWjBM BJpX/d4fP6Fpv3cy6vcGrykyaHTd70FPgihSFBe2W2EMVhqNPts+50OFbhb2a9GNuzLLq/N+ 732G8o9o9Eu/98p+22/9Hnp1cYoGASNOZnU9+xy24/VsVm9rB3tiB9MFlgWiGmvhzHDsl6Rf jYZvf+S9IxonBVY0gLaJizZ6zlwrLI19VhZcICoZphpRAry/E27bzz8cHm81WCq/H494hkbw OUQ0P5IZyU3GXauES+Yunzp7B0pCSlyIEKWjuFB6DRR1Rv5Ocp1hAqZilheZdK0fMvidwO8M PkhMWpIxrNlePCCZDEIhO2O4bRy/z0jxIY8Ky63jdcjCJxOqQWN2wjL5gCZh1nqmQotefkaP N3oZyRXjtwbihGAWnHFe06UCjO9Qymt6i16Bh7G8sSUhF9/QYHhXTiG4XZy+PUNk8Gs5vUFZ NT06P8m3i/AcGWyUjxlo1mrYPc1FhvMjBsFIPv1N7RT+PVQ0zJMgFxQbjjIrbzoEdzmf5Uc6 u4bIM7mtooNL4YKCH3w1/uwMpyFyBODe2cdc/VWNwda6usqPlPW2fcJPfODaXN8v+VGR3cNI mMyhsfoM91RTaK4XsckzTbAp9jYumGYuevjgXLx24Ro/8xObFVcMG9k1VkJwrALD+HCsJBOY qdCASQCnnNK2Gp++0E4ThXZmVwDhZ9MsO6R4nh+LwM8gSqH96RJFBZ/TthM7YARPqp/SLgNa 6aeIPfoKjbkOMoivmpRjHkI7n4EOzMDYK/hwigFOmNSTf608xOaiFDZ7NF3Zvanywx0u2DFh F5WBJ3JAueIEU9M1VsKu1nXnfCUMxXIzUqkkrNVM8kVXkVTCQq5pL2EysYTFDUEBI1RSCbOW 2B1JUMJEE9Bjq5dVExEEjw5nN+AsbOvwHnY6di8jmo9yDjZ/i64jFp3uz2aAgzW6D+6AskWN 22V1jJUdIIZ3jRW3G2DZOV8Ju2yHXda2rFJpWKtp5QuvRVINC7lpqWHyeX46sYbFjUcBI0wE Iyj1WdGoGC2wWE2xHucym05znlVf0dluEdYLTgmBZ+wH/5CBrLyd5pQ0ubTZPDegMDwr67zI JqA1/1S2zVMB2J2aErBh81P7eVl6ojL7NK8sG6fxlGbltLz9lutsMbH6v0DX8IcZ/GGOLmA1 MLy07c2NkPyT2d2t7Q1fYH1sLUHvrMerL/eTea6gh72Ygq27JQe9BgpCXWbMb2GChy0Ih+gW AEwahv187P6B61Z84oNLVjgVaOV9b/IrRmEjSA0WPn5qbSIujZGZWxdy447ZkBUx8nfhfQOR UEZ5asMZhlBAo+8XKBYsCJpsv+CHc4X7KUS/2pVBlokv1ZRGxvXENcRPewm3oPBxOuDKmRnM O8eKU/sFtHOsDMGqc74Sdm7xwFh/jlWqtXyrae6NeanS/Wzt3Gu/mKcxMmbrpCVuhAxZESOv FpQWZQRUrf3SwhJJSwA0lbQE4EagJ59APuZuSV262jxydfbyzq6971z1fQpbh5vHUsu1XYPP Hm9yTWdlXT5eLAv6dQUr+XF8CVBYmJBFTg15fDVk0DOIGv90gBBBIw+oKExiKrvGStgYVHTO V0IrWHRvyCqRwrUbtt7Qm6oa4BQu6J0NFC5GPm2NwkWe8SErYmTdwgqnGZjiV7jVI7+RFM4P mkzh/HDRFG6Um+aqdOfPFjlvbm2qNxVk3dwebRy9kMM4h2rBvvzJuJUe6oc75BZLYlJ0jpW9 oeicr0ShIFO3BatU8tNq6HrjYoxEflh+Qh5qLz8sRl5xnfzEnfUhK1KdDWzkxyoCXT220MhP /JNqS/nxgyaTHz9cNPk5Hrtz09Vikf/vwNsy8/djavA2/maEYG325lEmKBzE9sIdcu9jJyLv GisoErHO+UpoDicmN2WVSn1ajVtvWExV0mjUJ+SeDdQnRv5xnfrEnfIhK1Id62vURxqoz/nV Z/V1sEjq4wdNpj5+uGjqcz7L5f4OXMOGh9G9+fBhw+ODO/yGp2OslhuebrF62PBsziqV5LQa ut5YmKrU0UhOyEMbSE6MhOA6yYk760NWpDqF10iO0JgGFCf6+6wPiuPFTCY4XjT37xH+htoP pMecSlRf3dua1Rw0xu1UylvkZGgGLa7PxfASXUG3ajG5gYb4imKnJaH78hGgaelFO2DkJoWr KHWLlNauoNQpUkK5E6pbkUqlJ20GrjfOpaorNHIScNEGahIjv7dOTaLO+IARPM4/TQgdNlbM +F5cfWOX5O5M76JuXoeEY7MQWXctQKzy0FaSw0R2jZ+reMbuOkkQL3E88JxtLoyV2M7QYarA RdEZOtyOUko7Q0fAyQm1HZ3oZJbHlttNHG9oiZOYD55aDjCTRQtqid/XjxxtQlYkfWFf0QKb ducu/gOrYy0gDQplbmRzdHJlYW0NCmVuZG9iag0KNTAgMCBvYmoNCjw8L1R5cGUvUGFnZS9Q YXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9GNCAx NCAwIFIvRjMgMTIgMCBSL0YxMSA0NiAwIFIvRjEyIDUyIDAgUi9GMTAgMzkgMCBSPj4vRXh0 R1N0YXRlPDwvR1M2IDYgMCBSL0dTOSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdl Qi9JbWFnZUMvSW1hZ2VJXSA+Pi9Bbm5vdHNbIDU0IDAgUiA1NSAwIFJdIC9NZWRpYUJveFsg MCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyA1MSAwIFIvR3JvdXA8PC9UeXBlL0dyb3Vw L1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDEy Pj4NCmVuZG9iag0KNTEgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNTg2 Nj4+DQpzdHJlYW0NCnicxT1dc9u2su+ZyX/g9OVKZ2yaAL97Op05adOe3Gl6fGNPz9xp+kDL lMOpLKkSHcf31x/sggAoEusoEcDbmSqSDHEXC2C/d3Hxj13bLKtFG3z33cU/2rZafKhvg98v rjfbPy6un7b1xWV116yrttmsL64eblr46p91dVvvvv8+ePXjD8FfL19EYQT/FUXOgihIyzSM eVAkPIySYFe/fPHvvwXrly9eXb98cfETC8rgevnyBYyMAhZkLMzFsLwsw6wIru/FmJ+vsuBu Lx4b3OGnsvv088sXv8+C+R/B9X+/fPFaPO1/Xr4IXr/9IbggJvFq07abe3oeP2027dfOgw/m wYs8TPOAFWGR4DQQ+w7p19dXbw7xPhFaHOVhxghoX0KiL1rnuMjCtBRrJYAnAUt5yIqARYC3 QfjYcfbtoH9ahmlmp+N5PAuu4fUqYPPzdBbNy1mM36bwkePHIbFPQClJ0zBPKJTO3YIqngHF cJK/RfNiFkYw1ZDP81mK376fwfsI3nN4iVyilXIeFnwSCqQ8JUEF4sTE4svF77Mofz93CjYW hC+oGQ4OlITGxYHlqYKWwqm1HIUjRtkx0j+0YpSNJv/VgOIoCjl54qxTTzOAYUBl1qkfMYpY jO6HRyKE/C24uNpWa2Bub39482MQXfxSre+CWb0+//nV/Os4vEC3sOGVCEnFR3i9Wbf1ah7P VvU8nS3aBzif1Uq8Dy53G/iwhT/s2qcAjue7Zp7M7uDdh3Z/kmQYYclzIVFjCs3gK4H91T1G 8EJxOjNcmqRIwjJgYSIHLv/23IowJytShmVmWxMuhK9F7Aoi74H2+FKvxce26RYmF6Q4Z9Fs W8G3+FYOEGOTryYTiSeLU1gOAlGbxB7QjzugX0zST6gTbIwWytrLd/NMEDAGevFZLchT4kdB rfNc0LNaBRt4t0M5BGO2QGLc8y0MynDQ6kn/vZ4LYsMjBo9pNzAYh7QfYBXqAF7xcfj0eg+j xWODW/gRglg8iEW7x9Hw2O7v9/Ck6glG4fM+4KrDgI+4FfDBN/i2FuIUf4UDb/G7BUBbVTv9 2Fs9AJCE/VGK3SU+XsPL1ZtQ//1ag5NAmjW8LgWQjZ4HoguqlqBsB/qU7UYua1amNh6ABK13 SKmqQQQklnf9WeYHK7Gvu+Xfz9P+mr2Bn+gtcgZjcGCz1G8rHP0EA3t/38+T3m5BdonrsWoW sFW6P5olq5pVdQMPWtXIQZfwYkh6GgUZG5MwZmVY5BQNgbVci/+FPtqR7B4ORi1eGZvd1Lt9 UMEeXN+qea43gOfaOZ4JZ2EWU3iOlbPT4QmuX1LwhlRwvbGTLAlTCvjZYM+ZU7uoDk75TXc+ 8942elCH8XaeeTuQQmKyEdry8CFifZ7iGoWiCFlE4eB8wmUkVsgOLTgXz2ZC3QZN/uqda8gs 4mBETTRPFgmNKLPPUzy6M1eisT12KlwudOlislkKC7AkgMXivKAhnsDLtydyYm4BnsRgydmh f+MBXE5T9o3iI0LbX7kHnRU0aKmVgGUhlAcUlcGllH8dB+vkujAx3qFMv4ORqIq0Wtq+n8FD pGIHn9/BC4huYU+L7/4uptcxonKsoqFWdIZqzUZBJjU+HLx6MmztucdZEJJC0zy4WYLNVN9q nc7oKJJrXumZSQ1jfboib1ujjpPnPEyL0RoBRer9FpVVuVxSOV4Gr2ESQxxhnm0FeHaSB7XU jrK30nJxv8cE4yAncNpxsnEOENgkOCOxH+dCY8DN2iw+aDvAqInVR6CjVQvcSRmeSb16ZD/0 ZOqcJT3qX9ULVILrFjT9bNZUbajx+QWBtvW+DR7gj1uzQOLLoJKAiw6GHTvcuEbraOcs7psG fWEfwNf/hg1+Ize4H/0jYyiSBquApxJJ8dGYBopdfNYyjf1YpkUeRnyAMny/u1Pv3iHyksG1 eOZgIt9eXACjMFYjrmnd7pt5995YDXefn13iZ3YsLVCm2RYE9aM8y1F1eD8P3R/JGHysxGYY bD1DdLUgaSk08JyFLBMKTlJEEdPuHxsBU5+OiyyJbP6UywfNF2BLSGecFDuUl+HwMGY93wcO vUTrTRinAzvWCCjJr+CIr81J2rew6+4k22gMP+gZwiimFitgfw+axyh7vIM+QAbPa6WnCPwy F7DOkOlIV8c+uIFp1rU0Ont2kPoVvjQ1wDV20kYb4614QCKt9pFlYrwdv8LPzfTv9M/RcEcQ Hd3r2hdP46XNdyVnOjb5lJsDV+pj5xdUKoUgW2tm098e6AX6hD8EkdSpOYtaCxP82fLwY/cA TYrBWtq0nEBKpKXhw8atJaF1i1VOZTbGMYeoCkFm54sax2nImB2cZ8MxFoo/j6ebaVKGeUrM 1KfpGAuVDDxbU80zE/YUuYEOrUeldBQHrr3+Wcwlf9mKnxltDHXstfXg/j8oWSy3OaesSpa0 uqQCjFpvX/k1PLQ+00e9o0uhnY6J9nOXHZM7Ux7qAQ2tgxdaUZVO9DNlVI1cvV/nnoc5PJjH y8c5V2nivBAqE0X6I8Irmc/wVFrmFnseN6UUkeAkru/FBql2f87PixOtPlv4iSFDsSNyBHly n0pcmmdhmtrp0zOX7Bst0WEgsbE+GwcSMjMXyhZadLfm0e0Ozxtu21r+Rp+9P6UZHo8cyxfg f+hxqP4zNAoVPk2wqEdU0g6O984gUMnDJmMy4OPINLhEQxPjDDhJiDt8qNRIZLTq9uB4Pw15 YrNT5xvJ9ohqjIS7V/aRJ76YZmkYxZZIyoBBL1ZVg1Sz6Ec05tJ1sD2YnVHHeqa3imR9AkJJ lWorN8tSgsl6VFaxKw8RAS7sKJ5SVLFIA6MNGu1PGgsLIQR7qqFUZKX+3yCZeoG9gQ9iq8RJ 34OI5ICBT4c0N/TsL9rZPBudDWlsAK7G5vmo8X86OFL91fWz8dI4TMdsTxpAPSdpX8I9KBRR 5RgIUnn2YCaGJ22k7ZbJX/YMAzzCT4cLoLi+YTdI8z8tlPwSLhMqwf/WmH1odfYNIfJkbHpT /iKeaIzeo5QDHU8fxu87A13zdME1PW2IhEEIc7gh+maYUYvWaq5tA753MT/p3KuM2WgW4vaA hSAx5dJ0c4OBA8Y84n/wc7M+hwf0VhvYixbtfT7UK5sFkE0dPLNxtN4onRGIT/N/0imRnRiW tir9UVgyitJGnKLckxuhGXGxx0bupd62+vwm3Qny6f3pXNFMIwZ+bGJeR2hShb/MtDTKwiQf IfXTZlc/ApV3krpOs81YjMFWArSTbLOUZ2A/flG2WelTXwVM4vHiG33VRC3wO2ljfdDMRMjr Fe7eq16gSCbMgChXJ/LAHJYM4v3cfWRX/CBKqTk960zcKj5nk33mFN+IP4zYXam43fMU+kHJ ApQQ+NK06EsU439QgvVGaxaG313V0iSQUr412WcyAgq//d9XgkMgPu/EJ2mKe2AYmIZM0PcI hsFc5LLSexliAeOD68L2avZB23sEirRGaz8oUYMths2kwtlFSo3iBJoXPhW31aptnKvgSR4m JUWD01KnrBp/FBYpBQ5JrEihdaR61Sh3kZBt/eDiAsnV8yWhbWs0/bfNrVYiV+jmv9H6zSc9 Co9JMj4lmLRcdNmOEtTKfTJXHkO6A0EQ56wuydOQWG3wtyZxLCNus7fOIUPuFXHYDp3al5a6 BgccKCVP+pl7cJDrP9midmws5WE8diHJI7TsTodjyHkexhEJWkXw3KfVsYQE6j6Lj4cZRV7Y uCziuG8r95DLMKWpi2xOGlVG7jeLQFtdqFA8aKmlWZvzUDomohJYyoTmB8GW663RRXBjtM6F izBM8nyyjcGjBKqGCHBLlZGzcw6XCR4eTzdNVoRJSoGrjGIjPTDN6klFZvpuFtdIZckzSz1w SUm1a1VLk7scun/eXl06N/15AQnpBHrjDKuddrr1VSBpQjkPE5UhJynXkabwALeEjB4KrvRs GKOx03kzUHm3xvXbhdV6GiFQS6uErlWWEpNuCZQfm9UqwDCFlq5K+/cl4ROhPI/95Ghr1I/O gQpVsaChDs5YpyVrr9sKltKk+LiqUrHmZReg0h6FpXQPggGmIl/OhaEYyT+DTWGOmeZKgkaj cp6BI7nvj1duwKXitTKWI8NgsBPjnhl0CBa93dJoVTZNf6UkxKrVekTVNvAPYjeKpSEmz2ob ZZebJQ9wJTOCZaCuw3ZhvOjrgauz8cICu9PEyzAeh0QkN0HTXDpWndegQLoeCX4hCW8/XXK9 AkiuTkY+M09ZywSezh0RDFJk7NDQPJSpQJu1+1RQIRCzjJqn3Tt1aVxTrPNGiQeJx0GSaLe9 ogxqkJM4A9wZC1P+bI4o81rdmkRFWIx9b7+7JmYWYYIsAQ4djTJe2250AuZ/gWPGuWOlK74i MHFvq8XSKLWD64XV6m+Rv2EKVqDLHuqBw1iV2EIIeTOHQV1ArNlp9WjEh2UcFETwvSm7NWKA jEWPgqSaIffQMNLHuWbISlSWJ1qpmPOQpRS4YQC/0iFufOnV5Ro5KgeuVhYF3rVGKphKNB2p AE5KkkpGEUbpRKM66oFqryu+awg3pO7DDUlRhklGYf2HeyuBh/mRS2Jl/C6KR2xVyjnDhiNx UYTx2At5KXc3qBmtXivmvFS6zMO0IJH41jk8FkVQ2EHAc18iz1gcJiS8EyszrfCEtUPS8y2U 41+iMPgJs3SqLixVCgMRoxmQXCnEbaBX31TnX2MG5nZVSe52rgyNd/VfD82uK2iv1600DNz3 GsDM88kICWIgTyl4f/cAL3tmfsfwCU9lWIpN5BiZG7GJaidrOLlzjSnBrncE3NM4gw1cLoQC Cc6H755PCE6xITs49xWt4rCmFLReUvda2dJbrQB328k5RmkJjhcCpV98BD0YubyVzvDs1ZG+ vbo88xCDKMOCkYdXRrA7/zdU/rr3ePG4hPAAgYHTFjXWfIIYrOznoJvUTOeWC8/EKSep7z55 AgrIcwrcnaZy1YBF7TzYy4WNG5UUeJV179pag1A6CVS6E2W2leqtoIxmVQ7V7lTI57RmFdYM TwYZTVNx3VgwnYRc/9NUFiu4AjWWo0SYVWPxVPesNBZx9uOxk11rLOMOqI40FjtcbxqLHZw3 jWUicEpjsYPzpbHYob3WNRhdZMK439Fv4SNOxCC0SOBj16AyrwoUjzi0UyYwGqWSOtciUmAy U+0GUFrKmALnnJNyMTIrjzxaVk7qojbTxknBWZJgwXkxjn1oTpp44KTI2uxwfXBSTk/TGyed CJzipHZwvjipHdqv7qP7QuhS0Or20fRd/VNaWs7tSkzlJBDwYFdKuWAHJ6t4D21K93IgQtZo x8DkCRzaljUE+r0be0kJPnYCtaXJLPRg6KXgtSMguzf0hOadk2vQN/TcG3lF+cxMB42AjzS/ VP6Pe/srzSE+NRXnA3MvI5fFg/2F9TLHiRGr1uCpZYHSGlgK+a+k1pDCHvAmy+3AfcjyPJkO nJLldnDfvNZhftJQEV/+KuVicSAXiXqwb+BEOw/B8rhAY+Ioqlm3rosaUXrrcqGAfmW01kVZ JVG82rVDGAX1Nrdz7IkZz1bBx3p3Iz7tAxmgwySa+wbq6zerzd0cUvROilyNrlJIOSRaE6g5 KW7leRmy/MuKW7nXikAe03cBUEX+2Zc2APKiqmYZhbyHUHQKvJGChw1Jug64nlL2vMzUBq6I yYnihTyYmug+uMOKAiT/dAtacuCKRyxosN74qeDhyGamWlgeo0Nm8oUF8SiU7MkWFvxPCUlW XFhM/ntYndYawRqzisJswhXNE7Ccpl9RwZHyKVdUsKTimRUVyp9Z0oPbN5yf2a7WaaoVhl6c OcEUfa5wLADmnjayNV8oYVBCQsDDlC7M33Luioe2NbEnqUNbudOvZ1aGiadta13PHDtwEfDW dX3r85AmEd7kM9WiJsKMLYnD4nNRE7gNdEI2nMCdICRTgApB5zMUqkMyneqbJNg4YfqFTCBv eMKFTNkzFgWWenpSeRMhyX3N1AouJyfqdUExS3669SwzuMyUgLeopHvadV0hY88Adb6UKYMC XQqc+6pJhhfzEOAO6ma81Gtybr3wzP3eEfoPuHwJeN3eWavOT84ZQlFivxEv07UXrj0zW/f+ 9Axj4wS4fj/gXu2ZaW7WKxMeecDrtp6X5m6Aat9V5+8X0uF9028OfO7mdiRrlJKFEaNmCE3X VtWD6u3rIVJZhCyebDmVeW8HF8v6LkFrrlaFbkp8zAWwLm7QtVYgMsh0PJgFfD+8Z2fUp/RH 3ILVUhZQdmX3XScPaKgnu7bV+yOm5qn8NxbnuyR3o4cuHxlaVXZwsmLwN9nuBHoiYovD0UWm 96qpQL8tgmt9JItRD7Ijam/AUH+aH7YBhMatzUbH5PpNb0YdVMyO0rstgcySgodZAbcI5WVZ 6MiHM6HJbNfoWbtiQPywNxlzIZ77ivsogSQXO27HsAFP121JkrEydn8r3DN6BgEPPTwPsMPc axgMG7t4magNXBqW9Dyds6CiwNxCApxPPRXuQU2n2z8swjrnI/aPYmaenEtwW2jEJ9tPTNjq bLLtxNIYJAS1nXY23cXF4sprUAmweOfYv4BXX7sPOmKS3WTkLXmYkKtZrVbypgtQ24tRk6CR PjbsF6v6YYCuIdSwwHLjxaNp82u62ZtmFz1z4bDFv+x1sDOtm2XH2kXTHtxy5767QcrDktwY x0hPF3XERAYLS3OoTh/VV3yqBS0XD23zsYa74vcP95gNUe1Oi16MsOAsBnOEQMNJtgrLc/C6 fFm2itcLIFmcwo4Y9wJwvPOyFBtXEeCg1XKiWi1jr3TTZlleFqsuDYGe1lLlbIX+L29nMU3/ NupWM9PU1Bw6Wcaps76L/i0cJ3HgyJaLgB097NP9Lopese89pCOUMUVgD1kIGWQFEOCWPmpu CkaB0+3p7t2XCKf0OvqoSC5QoNnB6V6N2SyFtz8Huu+TuUxnhVbY0zBh7LBP38HFIPXHXhtg 1ya90N+LnJqQ89z3WOgfnDwEstHsHn1//buTcOrIF1Lb9TwHTQ3HDbe8+KuhckWo51bbW6om fbdH0V1NuDYKiuGJlbnl6M5c89JtC1BLeu0bN16cmizPwGQn5oSXgO+b/TwbNJ90fbYY5jER WPjqg8pjhkqFHeoCa3Ju+s0enHOUDK5oIOBXbSvLMByJQmtNCLYyJBAwjMh56X8OjnQCrGR5 sq7ko+682+ug90FfFijvie7fKLE0+r46a84TLiLoMkcgb9ze7vt2Jgxv0yMge0i5wBoc6nTo noNbLx04oL1mTJ4N9/33kijk2XS0FSNzkuseagByM+9kSljWWbe9azS7brZL3UhyceZl43fC T3BqiwXWi+n9dum8VlSwqTIiYbt3NJZhwklwn/WxOy+UzcOYxMa9D5+XYAZPRWu4Y40fC85q gnuqoJfbHZxY/LmCEXNpoeks/aRiokOFVKutso1r37Cm7jBq64V4kLk9bGPsiLuDu8fUCSyl vlAbVxh8J5uXLkzvP8v1gyhnTRty5VB3nlUcQdN9grBemsIKI4cAJxM95Ox3Kr47UkCMg9A0 PzWXF/echkZdMVdk2jq8Lyr9532Ipss/8V68RwBddOpmp/p74eJFFBbWyEJidfdkvQ0p9Sy8 8mWlG+VaTVrdFHYpW8N3/qBSlTjv62BwQbs0ksGXO7oiun95xLmfC9NybEhlJ42Hll94+Yod 2gr6AWRqJxV9Z/Vfmt/Ue0GD4T2ugblSY6PuLOz4lOV6e2t/f1jUFrshG+OzV42Ke1xwkqLH exSrONBIDFM8uPyuNH84aCjsZZ9nZRiP9avP7XNxKN2X/wquR6BjE3L/AZ4LSJsNCmVuZHN0 cmVhbQ0KZW5kb2JqDQo1MiAwIG9iag0KPDwvVHlwZS9Gb250L1N1YnR5cGUvVHJ1ZVR5cGUv TmFtZS9GMTIvQmFzZUZvbnQvVGltZXNOZXdSb21hblBTLUl0YWxpY01UL0VuY29kaW5nL1dp bkFuc2lFbmNvZGluZy9Gb250RGVzY3JpcHRvciA1MyAwIFIvRmlyc3RDaGFyIDMyL0xhc3RD aGFyIDEyMS9XaWR0aHMgNTQyNSAwIFI+Pg0KZW5kb2JqDQo1MyAwIG9iag0KPDwvVHlwZS9G b250RGVzY3JpcHRvci9Gb250TmFtZS9UaW1lc05ld1JvbWFuUFMtSXRhbGljTVQvRmxhZ3Mg MzIvSXRhbGljQW5nbGUgLTE2LjQvQXNjZW50IDg5MS9EZXNjZW50IC0yMTYvQ2FwSGVpZ2h0 IDY5NC9BdmdXaWR0aCA0MDIvTWF4V2lkdGggMTgzMS9Gb250V2VpZ2h0IDQwMC9YSGVpZ2h0 IDI1MC9MZWFkaW5nIDQyL1N0ZW1WIDQwL0ZvbnRCQm94WyAtNDk4IC0yMTYgMTMzMyA2OTRd ID4+DQplbmRvYmoNCjU0IDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsgODQuNzA5IDY0 OS45NSAxNjAuMzIgNjcwLjQ1XSAvQlM8PC9XIDA+Pi9GIDQvQTw8L1R5cGUvQWN0aW9uL1Mv VVJJL1VSSShodHRwczovL2lwci5ldHNpLm9yZy8pID4+L1N0cnVjdFBhcmVudCAxMz4+DQpl bmRvYmoNCjU1IDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsgMzA4LjkzIDIyMy41NyAz OTYuMTkgMjM1LjA3XSAvQlM8PC9XIDA+Pi9GIDQvQTw8L1R5cGUvQWN0aW9uL1MvVVJJL1VS SShodHRwczovL3BvcnRhbC5ldHNpLm9yZy9TZXJ2aWNlcy9lZGl0SGVscCEvSG93dG9zdGFy dC9FVFNJRHJhZnRpbmdSdWxlcy5hc3B4KSA+Pi9TdHJ1Y3RQYXJlbnQgMTQ+Pg0KZW5kb2Jq DQo1NiAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250 PDwvRjEgNyAwIFIvRjIgMTAgMCBSL0YzIDEyIDAgUi9GMTMgNTggMCBSL0Y0IDE0IDAgUi9G MTAgMzkgMCBSPj4vRXh0R1N0YXRlPDwvR1M2IDYgMCBSL0dTOSA5IDAgUj4+L1Byb2NTZXRb L1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDU5NS4z MiA4NDIuMDRdIC9Db250ZW50cyA1NyAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNw YXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDE1Pj4NCmVuZG9i ag0KNTcgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNTM2NT4+DQpzdHJl YW0NCnicxT3LcttIkndH+B8QexlyQoLwfrg7OsLv6Ylxr3eknTm4+wCRkIQ1RWlISLLm66cy E6gqAJUUbVVxfZApCkBmZeU7sxInrzdtc1EtWu/nn09et221uKqX3peTs5vbP07OHm/rk8/V ZbOu2uZmfXJ6d97CV3+pq2W9+eUX7827t96/Xr4I/AD+FUUeeoGXlqkfR16RRH6QeJv65Yt/ /tlbv3zx5uzli5MPoVd6ZxcvX8CVgRd6Wejn4rK8LP2s8M6uxTUfTzPvcise613ib2X328eX L77MvPkf3tlfX754L572Py9feO8/vfVOmEW8uWnbm2t+HR9ubtofXUc0WkdU5H6ae2HhFwku A7HvkH5/dvrrEO9nQouD3M9CBtr3kOi79jkuMj8txV4J4IkXppEfFl4YAN4K4X2vM7ODvLX0 08xMx+N45p3Bz1MvnB+ns2BezmL8NoVfI/x1TOxnoJSkqZ8nHErHdkEVO0CFuMh/BPNi5gew VD+a57MUv/19Bp8D+BzBj8AmWmkU+UV0EAqkUcqC8oTExOLLxZdZkP8+two2FoQvuBWOBIqg RUJgo7SHloLUGkRhj6vMGMkbjRjlk8X/MKA4CPyIlTjj0tMMYChQmXHpe1zFbEZ3454IoX7z Tk5vqzUot09vf33nBSd/q9aX3qxeH398M/8xDR97pV9mJszAZk3VrtBJ0ewK5LL25sfJ7NPp Z29bb+BjU2+9L/jBF5oK5TSd/YGC+yyzYEAxTHI/iDgcqyWAX86z2Qag19vtXKC79VrEu9nO E4GRWMYl/FrdwsX4+zn8/gg/rCMcxQnynxnh7Tye3SJNF4Bwc2EdvFC5Yc6BxyU38zCereHT pRsK5IWfpOyWeUKxI/R6HgazBw/ogIjUa9gf4DCxV8Jww/9rwrCc4W8XxGJiA6+R+2xjHueB n4Yc5ktAAX+sasFAmcApm30jBAVKuK0bYcwQ1fYGMFzcwJJWkg+BLxOxOFx0tVrhpUQCWtES fkoYKT3rm6QWsI/1/eq0QCqU2XTRtA61QNqei36ZG4k6XnKP/NVWK+9C0OZO7uBC304niwhh zwpuFQCSJO5O6orVI+yhfURKdJwZRB6uAGizAj3Vel+R4WtAB4nbrIGSlz3PI/1uJYM9NMQ+ PSflnWLG5ZByI/5Ru1XhmpF18MuRFLWCJiXpeNyZZiF2TnJgfY/oreZhSDfiI3GzSVRb3zbx kjRGd8lMPOt7lQjWj1nWP+tp09m/pjM2KJxAFLQiSkJdCabw5QRNxtid1os7wAd3v2kf5aZ+ 3giUiqECEv40YChMuPAzxTV4IQoFinODyyG5FH+gm5Aj2qrRZFb8rUJa4K2kxUYsNTVw4kvB V6AABvIvvr6Q92/k/be9fO6rRZG58bnVOV5W49eIIfxJoxLtY7XufQYH/BT5ZcHt2EWvf6Yq EcUuRoOiadmREXTDXVHuxxNUR5tK5vobyrwHRDXb66zHVBro5TwfWcyJOfOJH21r4aLwg5JZ nSmhMHK4Q6cOd5CBrRqj9d93QKIW2Jz0OPFrtxeWCVQWfsajYn8/ghCiVwYcCXRtHWgY+0l0 uDWGqV+yJBW61zrAOPWL7HDrE2otZvdQtyZbF95dwKwU0yiYRTly4FVmfsit+L+sQxPhBy8k pgBBqVTbMZwQHQgjD7TyKMwx23MgTo7C0s9YcOQrXCg7LB2WPhiyHrOnmDIwo1NJ7x2jq6qT sfZxFBoXdJHmujeLenuENuSuXwaZlEUlXaStV0kLv5TW2+CqZA6DtwRyJjFHAOG7WoeX+xlr GJAutZNsFjiIvMZ+vQaB1pwt3IvXhtTwc9EoI58Vbl8GCH+Rkd8DMFTRicORE4+NXKMM0r7T LCkFxprzX1uHX0DOh0VgmPx0YGji0C854Ls1f6cFntZaUjmAQqFMzaLLlWZ9NDXI8XQRiZ7j KXvVcLjMTiyENWZpcyUzmhiTXCn8DRkUR35mXAq7zWJonyAgvSEHDvagrRZfQV6PBAmADN3m StHpI/iF3MtJFmFVYXpMkNK67kGtcyhiJWUJPhUDbpR8GKY1Xam4IuYqA6YNsa3mhA+fsEhM a5/PDTOpHWLHmg3JImRWk57RfBBHaYMs91MW3dM7wR+LK2mZn5KhJ70uLSt13aWmktkjZqYg 1baW+UbN/QPlTZDqJUjokTTXpNy3C/rrOak6cbV6wnreWY21dTELUj8vD8ZWSSCkOuXA4aq/ ibWiNagwAYhqsbkfZP6B2ZRjoXtf9ICebK+P5JbiDi0d5uOyPPKjae4QuWZFzGZYxqrBggJx hKcKt2gI61f2i7IZhOMMrnuk1yIL6bXQgFieYFYrS0MRto/w+jkI8uKX51AiMQAsBQUYgPZZ RBh+dnmTSt2m99/I1Vvub/tVKkd5ic2aWKuc/fbhH0b1dPruN/yf0sJ050YWndaqdiQT9pjq VPqr2nrIvyMVtpT61iCstvUKpPBKhsBjreB33Unp7CfreCTihv24yiResWPxgvrGxJlyKl9G iO4EzAwO5OKxt+ltfS1ZYSwKyvBv5Hc7hE6JgGrNWKywGrCclIWhPgeMiIicD8Md8gAuVHFm UfdpoQGK5UBDgCRiAXAxrDeN6sWlcVlLqv5UR4oYZjEeeiL72V2UsNiJhKUh8PKejGWSscSx jEUZpKgOKWNGiO5kzAxONRoYaqBQJi12udVH1FjzA4YkG6TckPESxdLSZC115ixmqZYPo+fm OyUXL8BPb+eJZhjbGtFovXdoQVfNvaLAo7z7NxDSun24kRXtr4NEzxdcrB/Bn1FqsCXPgeik fronu5gkJ3UsOUKy40la06nkGCG6kxwzOOqSQBcL5WfVVGRJaunYnQs2V+xEKleyU0Hc5KAU X0IpicF60vIgc86bXqynzU830vatmkuU+GkWchSsmdxaFCfqCblUTSK1THd2XU4jL3X4UBJz uIQSA9VGLIjaI7rqfaY3XG2ULZbJD6rodAZbmnbX4WbPTAG2rEyKTnfSXWha7waU04Te2Yjc mlYlSl7Ou8rTqmp17SudHHy+VOdEnKbevprrgYhiX6Y+gso6G2piUK94tOJ0HiZGjatCE9VY 1CnQFJ79h4r5Ddr/PfzADunTXz34Fj//vX9QKIgTwNexvAM/BeL71HqwUMTQvsbspP3cS5H5 OQct7JNXHSkzSUoHZgh7BRlE9rBDmVs7lJYBpOkPaIfMEJ2pDgYcZTIpX9C3D479oE6zYtSx kXUnctZAGkl3cgZqGs70UYinDJ4m5TW0nN9LRU3uYLNqWsy29o+U3lNCDOumzBknsR/lHO32 8VzzJ5RhMcvhSwe9uSHkxvdjMpO85S576tIca3BjtEDpkzGqKHW6lscNtHZWouIDco/e2ihz 7ZUhMs5UYDyOpo1dq+d9KVUTBt1VwS0stQDots/W413tncRUMG6oc66W+dMac6dLo9LgWkYn 6KsstSUdjzt5Rz3zepKQTShA7JJ0neeI408eOnVaK7W6uN7WJKiO0ulpWvhZbj7Kgeul9uBx YpK6Zqr+IBFhjaShlCZS0rvtHD7CX9w8bq8HR4c9QXWk/Ee8z3BsiVxexVh3vW95pfZeq+nC 8z/g46tr1CIP2AneRYqZ1tkxONuVP3GjlJX+vMrW/maF4FMwm+Wq46PjkCSHUtLuhg+vvZFk OFcb2rVEU/AOPEH6umtBH2cFNfp9Qs/x89yQr+85qFnVpg4ODfpCspz0w5F1+mTCaiysFVWM ULCVSdG78IsduUpgZpD/QTDUL6nRz5P1D10BfTK6E/Ge2NzJCQA3WxynfjZtAyc9TDHOvWqx uVOZph37omgwPNKD8vOE94NH4EjUL+EvSpq5JLG2LwMFLg2UxmV4u0Ia7lGMNO4AMZ7hgJMu 41ajDAuqVOj5npMnwJD2XZGyhMZuZl/3cEUKp65ImEI3o6FLOUmwT/nsyjZBslyEQgzkL7zR td/lH4MaN2Ph4ExBBuVnBtyy957MFt5+STz104JDRmmLzxV5c15ov3s8gRang1E/z6CAwoAb e0IjL0VZVuu91MKcJyW/D9Zbt8UDwoMRPUojP415lj/uy39kcmrNgbWNCRwgYhf+VIeBblgH +d+2qd00kebiBhZdnVttAy4ygMgArly0omaHU8FxGUPUzYAz+RHHqVbgnXgSBe9IWHcNgxLq EWZjfRzA6UGw1b6DWCfxWYZ4r1y4Kydp/85FAUM9TeJY18ZZ4KcBCw51w3nvpNb/gn2+U+kX +zmBzj8xY6PVYhxAjkIestlYymM/YDDtN7qWPD50dvo4jPtGU/vn+UqyY2b4DmYypH6QcuCm ZtO6sYwCP2SXa98HimK/ZHfXvisQZehymcH1mU1HjBwJFVOypGUCeOtIFLmfsRR43prDwOR8 oX0yw/s5CN6Ez6owGd29dAcHO/Au8x36ocu4LK5UGzelTK2fPIrRmWIYexRV66l/mZlbOfBk M5hRxCA1GI1BMS9Ww1oiUOksmQpHOJPdFoWLB2xjkhW8aTPoeq4vcWCGnXhhcAzTULNyoSbz 0g8DFuKHTaX4xZz7H+Wy3QhcmMZQy2ewpL27xqlYWu9J11ODHSbF3nUTkl7qCekeNkyEqwM5 i3EHipZHb6wb71hcKZSOkQZq1IH9sCROchAYhvZn1sHBpKeYA9fXwWwDzVJQUgxQ+yTNcjhN wIBzWE6LS2EjUg7wtaxyrNoGZIbaBV3YhGgHGi7UHMy2DSIO4oG8waTAUXQMEtaZOilSaMQ9 FFMnReGHrCVRbZpuLGYRmCrEWuvrtRyZtHYx4atMsNOKweOuh7tUGc0Vlkz7EqCLgYNJAIfx GJQO6Xl1FQgGk+Fkt3HO1/qElwQGyjCoWC9IRtC/kHPgnMyvCfcFZ6p/li7rn4kIyQ0dFVrP iXXvNhJ8xwK270wnQr+z4FzYNREOo9oxQxyM3nKQuoyg2M7A7romDzQGmkFCdUwtR21oquKr umesz1QIhVWI44OxXyi8uyLlwGG7rIupzp1GNUPdMa2hWjXUNjQ6uvF/tbgKGgPvu+43mlHq uiUojgrInzDrqIe9/rIFk+x36ybNBLn40owRRHxJTDHf77P39kdBxUUEPTSH4t1YOKshy0UO j7skgbgy5wA/Oa3Uvtcu4t+IVWhOAqOcNSAgefHsE8wGpjP+XZvQLf5nGDoBVzpr10uSwtTW NZydvlF9kPrQ8b6ZVrYygjXGnrwdo9WV5ahvqdYcdioIOxVNUwusj9SIkgRqNsza95lY6+gd ESCwkDkUajPs86mBH4m/bC7V57+r6vUr+95PhlXkvVCwD7wk33Lv9evWo2dHdeStla6KzsKD 0dVaty91AlACUjVylvxEOP2FBKYxHlu94wKE2bp1zdGW/cBWGZna0RzmnqkDrNvtRvOTA4bu eGov8IOx8xO7NBwkZb1LAKcj7IUn9iKf95nEIRsPQ/97KRFLJQEmZm1vZIGvlkPbNaHSfTJT 83ThhMPTwC/T/WiyD4fbGIXEmtK4yCFR8P/QimyEvKMV2Vv2x3PN/boOIkqhojg0DZ2U9pNl GNEyCDjIzWHLPAPuQiuVqcgL6nzX/TEI7SRa1Q2rgN3Rzn0hoRbNLfxx5SClJ1aQxgcjWCQC oyDlwGnK7Xrev8Ol7WapCqY2xbr39LfOBg9fQ/PT6NbDkRWqFSkrrw7KBwlkqxlwpgT6bSeF +aiV3EnsAX3CmTmnt8cBuVGRXOsgoL0exiekC/nWeH98VK/jjcrRVL+oKP085kiwjy2zMXeM P1Afp9iDNDVmGZqy8HlZfcOx+iLCrKsRrrtj9QNwgZ+L5QWIR+9fqG/Iy3hXtdb7yMNQaIWD rTwME7SF37vyvk+8psllDgYChoBScThCpCJ84qBRluZd9wqnV3T8WJ/h1uVTR0cxB7MRYMKx ukUO9R5NWhhqNXi7rvyq02aF/To2zPmO2MXvo35sjGTboX7iBE68cOoncqZ+THAdqh8d3D5C eCYD0KfnGjmoCoWHo1CYlHDkjQFH4onUoPToK3SQaQYxvY9DawIQV33tnR1I2zys6Ej2YHTU 4FhA3/UqZykoR7Eanp3qHQaC2nUwlt0D+gSqMbM0PGuuuya9FrHuD0bYY7vfFhql3sY4uR1S D2UvXupjZ1JvgutQ6nVw+0j96wW9WhLfuOvtnq/lqE30UCQKRWiQctBI6l+/FeLTSz320mJz X0yDEcJ8MvpoR3VxKIOUB6nkRKPRy3sv+nmYK23aw2Wfbqu6c1R4+2TDxgOjp1qk7+ZSmYFW m+Wiqu5f5bZTR+NAl9k/PwevStlv840Kw8bcL15hRGWsEoNThZG4UhhGuO4UxgDcPgrj441M XasIGXRG0zb/ru077knmxwcjCiQTi4gDRzrio64jlO/evWWXJFUogkIf9Dwe6YkD075RvVPJ +7AyKs/cSjF+9w6fc0q1gpbeDtOlU6j5YqES9sOxmyZvIOfCBScjxxKWrPvIutOZY1Eem5JY g+FKblrPGMgOW88YiE+cHHEwZKNkcVEvt7pQiVMXDXF5Dm2uDBYk1OosMw0MqyltOGwiGJ84 IjOvvWBmNDyWBBCygCWfINbbI7rJ2NYrYDh2h1m/GnWy6Byh2k1HD6SQg3yXKJxBZh4JT9qz aimWgTGt3A71I3+tTxtIfZZkai7b/26beTxI4DjJckdZaErxTmbJOah7xwULnlzWHfl1JEnX 1+lArDMcJ8Qgd9776toY6sGQM/NQ0dG0aO3N6uNxbYtHEnvrJ2kTWA6zKizaLzbScx9kAmgy 2oVcaa3lc1oYYZcwI+yy0QQ7216BcP1TdkmO3tGaRIlf5BxQkJZROrYngdZcJt+7WK9upFZS L2t0+V5NmFM0jZaeQru5ht861/Na2/2beT5yFEeMjpWsW5TUwavdKpmo7698oHJXW2+cGKuo yCCxZFq/y9OUUYl8Yib7wEHsdO0Z0uo7jdXYnbB+fi+AVmnzIjTmpW406yPVkhSGgpqhO2iQ LVH7G6FpMyxwZi5ZqkeTn+bAbxCBtBkt/UUobrRGDEfpJ6fttBeuWI9vcsouGAHbf+cvvG+d gzYZ36r1aw5ex6e9da/Lqqu4eGnI2Y0D62p4RmWHUv4ThP+jYZ76dGvqdFY5lnplPSSPI2x/ c7FBiRcWo0kOCeR594KF0f9/AOZVHLENCmVuZHN0cmVhbQ0KZW5kb2JqDQo1OCAwIG9iag0K PDwvVHlwZS9Gb250L1N1YnR5cGUvVHlwZTAvQmFzZUZvbnQvU3ltYm9sTVQvRW5jb2Rpbmcv SWRlbnRpdHktSC9EZXNjZW5kYW50Rm9udHMgNTkgMCBSL1RvVW5pY29kZSA1NDI2IDAgUj4+ DQplbmRvYmoNCjU5IDAgb2JqDQpbIDYwIDAgUl0gDQplbmRvYmoNCjYwIDAgb2JqDQo8PC9C YXNlRm9udC9TeW1ib2xNVC9TdWJ0eXBlL0NJREZvbnRUeXBlMi9UeXBlL0ZvbnQvQ0lEVG9H SURNYXAvSWRlbnRpdHkvRFcgMTAwMC9DSURTeXN0ZW1JbmZvIDYxIDAgUi9Gb250RGVzY3Jp cHRvciA2MiAwIFIvVyA1NDI4IDAgUj4+DQplbmRvYmoNCjYxIDAgb2JqDQo8PC9PcmRlcmlu ZyhJZGVudGl0eSkgL1JlZ2lzdHJ5KEFkb2JlKSAvU3VwcGxlbWVudCAwPj4NCmVuZG9iag0K NjIgMCBvYmoNCjw8L1R5cGUvRm9udERlc2NyaXB0b3IvRm9udE5hbWUvU3ltYm9sTVQvRmxh Z3MgMzIvSXRhbGljQW5nbGUgMC9Bc2NlbnQgMTAwNS9EZXNjZW50IC0yMTYvQ2FwSGVpZ2h0 IDY5My9BdmdXaWR0aCA2MDAvTWF4V2lkdGggMTExMy9Gb250V2VpZ2h0IDQwMC9YSGVpZ2h0 IDI1MC9TdGVtViA2MC9Gb250QkJveFsgMCAtMjE2IDExMTMgNjkzXSAvRm9udEZpbGUyIDU0 MjcgMCBSPj4NCmVuZG9iag0KNjMgMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIv UmVzb3VyY2VzPDwvRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9GNCAxNCAwIFIvRjMgMTIg MCBSL0YxMiA1MiAwIFIvRjE0IDY2IDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2IDAgUi9HUzkg OSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vQW5u b3RzWyA2NSAwIFJdIC9NZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyA2 NCAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+ L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDE2Pj4NCmVuZG9iag0KNjQgMCBvYmoNCjw8L0ZpbHRl ci9GbGF0ZURlY29kZS9MZW5ndGggNjA0Nz4+DQpzdHJlYW0NCniczT3bbuQ2lu8N9D8I8xJX 0JZF6j4bBOjuXCaLyUw2NnYeOnmQy7IttFzlVMnt6b9fnkOKpCSecqVNeidA3L6odA7Jc7/x 7O1u6K6b9RB9883Z22Fo1rftVfTh7GJ7//vZxef79uyX5qbbNEO33ZydP1wO8Ku/tc1Vu/v2 2+jdd++jP16/SuIE/quqkkVJlNd5nPKoynicZNGuff3qX19Hm9ev3l28fnX2A4vq6OL69St4 MolYVLC4FI+VdR0XVXRxJ5758byIbvbitdEN/lSrn358/erDSbT6Pbr479evvhdv+5/Xr6Lv f34fnRGLeLcdhu0dvY4fttvhS9fBZ+vgVRnnZcSquMpwGYi9Qvr7i/Ofpng/E1qalHHBCGh/ Zov+1DmnVRHntTgrATyLWM5jVkUsAbwNwsc+5yYH/dE6zgv3Pp6mJ9EFfD2P2Oo0P0lW9UmK v83hR44/zjf7GShleR6XGYXSqV9Q1QFQDBf5v8mqOokTWGrMV+VJjr/97QS+T+B7Dl8Sn2jl nMcVf5EdyHlOgooEx6Til+sPJ0n528or2FRsfEWtcMZQEhoXDMvzEVoOXOtghSOecmOkP+jE qFos/osBpUkSc5LjnEvPC4BhQBXOpR/xFHEY6oNHIoTyLTo7v282INx+fv/Td1Fy9vdmcxOd tJvTH9+tvkzCC3QrF16Z0FTcwZzPke8LWIWAxUlgkV9gjKVxSsE6X29X6cl96xlkkdEgv3R5 f6jXCIEtREiB9JNVWVxHLM7kg9dfHyIb5oFs0qiO68JFOFxYCEttLVQZP7kFcd5Gq9Ps5B6+ 3YEMb/ftBn4YoqtVdrKFb9cPq9Py5A6ea1csOVF/f9bZOBBmWRUzCuFuL7CJAOvhFhFBtK8B 427FUon7XtBMALzqJM5qCrFf/IMr4oTch2YnN38LR4LLHzfFMxpcwK8INEAnMqG5QCm23veb p1lcltQG/NxdwdKvYBv69nKVSxr9N3zBrThvBb1mkiC64bPcIs8opqyIa5okdgKl6mTYAomu 8aR6YSt5R0JweJWS+3TunTLTsojLnALosI2eC69KYkZygv9DrXhckPsJsqVF5uvavW/QWSI+ 8HIrzYQjR1POB+ScOBVMhAb/797B8zouSe6JvYNL+YturhBf9OaiJzlE3T7qpBoFbVtIcYbK 9UoLMik//OMnTFzwOtz4XRqb4AG+RbJHiesdEWWgCFHKXApG+lyXn73DFSYapwCj3IzuYb2o QFC3SCujF7tSq4P6BA+0/RaO7l4fnbZB3sDx4RkefJv4e3cHP91LZXaHb9rA4+LsS/M+fLTZ aL0HiMCb9/doCq3xjdf4vjUEUwCtjaajxx081Q3t9H0jeYlv1yjX2gZpExBLDyHuX/rVLM6p 8whA/1mccArcZJfDEHySudwPCbjpP8PhIdchEyprt9vpw8K/4ZE/aKMd7Bzv1jjDqJAbW+9C mmWZ4EoKXABfo0Ah6AZ3IfjL7RwBm+MBSC6NUDIunCT1Ry3O8YF2H21Ga3WYs2598lnzq6QE p/goZtJj2Is3tv01vCuWQse3USS4heVHnovLu+UhvdtC+NksiHOLB9teo723wT96F3usLEEQ udfgn+LLOs4oaA3uEyVZRicTbYNm3/awI1MB1QzevcAyiav6pXaHl2mcMQKa5MLMqQrV1lzr XeulHu6jYas5+lKbCJJtkaDW/QNl+ckHpJaG4IZFy6j2W6nRA2hi4XGVxC74t8urNOYvRv9Z hQmVpySGijMF0fxFyeO8cpvcE7byDF2YV3VGgjfSEQn2E+4CUN2V0lqNtmYRUyBbIQ41Q0hi HSDAUUyCc0CqPyClNndA6e0jhkXwQx9n2u5KfFZrvAt8x502rvtmkG/8VcBs/4DnkdXAKOLq QaVz4fR+WwWJ+WQJ+nXELqLBbkRBAwy97vpuQNx9o5ILj7aiUJlY8+AMpKMz4J2lSkh2EWgY QRnAhIdIMQEXKCgQ/xYM3dLDDOTWDVv5UKWIHsn5sbsygl0GdneaeIw9qM2+0WOsXA6j9Psy edRup9G3zhRUCBravSu4CMRTIjt6prnAEBwc33ZqwiBqTiDzxj+4NM5TCpx/Kzwp4iSnwKFY NvQCh2/HFbrrzyB3pZy+GQWtLakPGn710jU1yRhpVS9E8pV/UQOZu5fa7qwqoB6AAHctGHCr 9wm3QQrbNZD8bcDQQZHVrpgdIYC8G2wVVEmQWBzhC6ZBfUFeuwI6/7mZTgJhw1zKsmohbCA1 xZWODIzRu9qO2Eq1citYHJkR1yGY17vcT6AMjEB/WZjzbHBpXOUUOHmSyH64Rc0lptvEflQo 66RUujKyzgp7UiKwWLq+kiTgAwXqYxPW6cHwu5lK4JlNa0hOeX7CvGajDhf2NUZ4lKxuA4Ue eQLy072HgRINii1Z6YoczUPOvkVViqU/BPCZl+KdvQXUkgTuX5qIs+UFBe6HHe6xJGDKA8us 4IOSjQ/wTz8AxXJJ3wf8M//hmALNK+L4ZIriOG8QsRa+qUp9tK3m6ffir33zMI23F1jiCH/m IZK8rKYW5V1uZkkVZ+QeqnXWJ1i+6j93n/Es5qUbOpZUYnYv9m+6CRGXMmrVziPHHTApO5os FrI9jMAUtv4yQvV2o5N67b+1FfDdmyD+NbjXFYXJoBWe0oftzrtES5O4puD7l59pGmcFAe2x k8oCLC23nb1iYCz6xqmSMt2Jk3dRwYS6FNzihgZMIHPckzwzimC3Z2h4yQ59jErINr1kSNy3 8qhZzMoDqzmU43CtyHvdVhnn+UtRd1qIF1C7MTufUcPHKPMsz0meU004TzoFCo8Zz2NMg3aQ +ES7GZ9vhGWOHw2ZZM/rDPZ4vt5ZNtZGCuzQob3TLuIACZxJ/iaAG4hKisD1QE4OovNAs9nc vwDXxMim/4r2rfRo5xGdmSTTEUYTN9wZrxL+igfWG5DNPtoPq9R6Bz5h7ETvJmEKDTE5tVmm qsUy7Zs9pMcNQcpz7bYjAeoPSUdZpnwj5TTbDty6sYLo4ue+hYcrK0Nncn1NKIoGlyZ1c3DT 79toLyvJjM1iB+AP1I2If2ItsFXtHxdSvIKnvNf+sRLLSojVBMh6Y1kJAe6DoAQodBRnnYZZ bV1Af8yLrVYYbsWx4FwBuixkgC4veJyHrNbYryVRX67gh2iwXnqnGWLoPiHL6GSELQikoL+F t6GQtfUUqkYI3Pzy1X5UDHSqTTudTnci014mU+7Xqa4a9F7AU0Haktj821FhPELADJx73Epp 5KHskDXPrqpB66CwHrIDx+DBPB1GDOYJVN7P14HnK8N8ujNAhepMZ8D9mIOThGCX588iBU8c Gg/jM0OjSZlSSwwgLVIUTm5wjWavQNlDloCVTkCHXd8aSzJalSHzyTzLIKJN4CK44qsV42Go mkMSm9wGaYatpUAaVqe10uAD1mAoIQmVF+KpJ2g2DUOzaYmdCwT+3lNQaVnGJQnuCA2XB9Vw aQK9wAE0nH/XI4faCQLhQAkvAppKc+3GWgeUN5CFWbfGJ/Eu+zhKHzdGx1cxeZcGOUqDFzoW XlZxUlPgDqjCfGG/+OZzXkLUgsDMBJgewSCThXtrDEb6t5/yCkQNRbvacJDuujQn7qTJWVqe sXLBmCCgIZqGEJ/yzqysDAiEPyR7zDMeRlYErGDMWQ3H4uaXxn+iXHhvEIgmwD7o3ZXZ8d1K JaSkRDHBjL7XuasnW2a8h/s41O7U1Br883RSoS3jBid52k+RpW9GS9O4KCnETYhiok3L/4h6 jizFjBaBetPvt0Fcu0xo1aKgwKryXe0TYw9DgFKpCkpRDwoG/5FTJY2S0hULPODr+7YikgTM Gjca/m2WhGO42A3OUZWGTIJ+3CcjFW8sbaSUjV23pjUZvE9Wo1LF2/VxFsLoLJs4o3crRnpv 7n15Arvl0CYPowGq8sWIIhWMl9YUOIhgT5uYIu+uRJqncUYu2HJ70FbSRDc2Flxp/a2EOORT 7a7jMSxnyquON8+DJekzGNKxDLFOyq1tTH2XN1VxRmOhRcHDGPAKIIuwe5xAYFnwdg9n0+ug LJiKlRRF4Oip+jxz4LKxkQ6xeo//YK8ZsRqn6aGbuXDmDNpIUpYOKGqMub4sw4dFbVeqUl/1 /5tSpZlfMEmUKxv2iKaa3RRJaQvYgoBsOFvKyzAMVGWueLQRzCpy5duhYMJiIqEfET8qQsaP BE/DwJOjVJipSFoe7jT3oUPyzY3KcPoWBkUONiCB/ay8cFLtum4u/ceVC5gs50QmOoWXV5Wc XATdWd7b5jkMGympvQgyK6kiVvth1jmkldGfcJpUCYcphdD6+3KkKstX1I3v3nNYSVwzapW4 GDUXyxKjzqV7d/xAEVOIhehEywqxFRTAyYyi+JgiVxYkt6OkWc5dITOXuLrVpTiPGBw7bOEJ z8N4Oh+DrAByY2VKLeGx6/sIE4wvMykH8lNZ7cYm6KgcnpcQuyK2wZpOUdklkZA572WNNjUu RyeVnaNyJm8zk3KcfY9bnQmzmx6zSdY+VENoljFX1IOomDxmMk8YD5ll0A5Bobtofj91jijw HztidQ0JaAKthZwQX8sxfOFdjeYxSylMbGn0l/O2VznYeb3HL+C5moI4k72C///iXymmCcRL CZwPWvRLFWAiNQGUdwoZYmpvrSlUeoZWCzWiqstDDVOcyIJjOz/CMD2vneWaSBQy/7PTom/e dOtoPrNqZuTRyGpD8/MiqKBHgljNb0N0p3Wo5Jz+je42J1+gaNo7OxUlZFeJnQohj3lVQwyQ gPh+NG03Wq3MitJNtcvaNAjJnot5dbv33UqrHOZOErgHGHNZwUQnAtwoNwJUoWUkRRwtodJp 93ojU6lhZrZkZRmnJLtbZsw08n6nQlm+ZQ+r4rp6MSJRok4ATRwePcYRmk7XGw+R6gQydcco 04b7UbotBxbPZBCq1YWBpIT/VJUSqUDlKizymgBI5jbz/y/FkZaYH6S206q1t40eXYBqBUaB 1uSYqd7UBgTi2SyrYT4ZgfWcZ/2zH85nJKD7n3xV1shfbnAB0qbCo6KghexBFR9gFFz/Lai1 DI8cXKZqQQ0lwpICXGe3mlP+Dar2Tyg3vAec4fmEROOIgHMZMuAMl5ckQQoWI6kdFkPutJMu T8Bpi2HaPjfWb2b3vUJw2+q26a7GyCSEDaxBELO6dcsfspJL89B4rB+a9tuOv4z0mBdjTg5N N5u5hHjj72TrlHdRlcRVQZ2dfyaGFhpOgcPNkTk9pAM0B2TZhTy/voPd9h8TVgQskMuXXuUs iUY7WPvoWp7T6awF0n8IhoE6I/A1Js2S7uqTdyP9Se+SoLqNNhIUo9i1XbuVNVH2vQlcOPkP 3yRsruqQG2QCdxNTWDUhAjOOlvCI1hNm4/dipSolupsKHYQXKhGZFimM1nKKwJ3pcdYxPbNZ Q3Tuqtis7EaS77WZev7bCk3Q+3G8zHb0Hcaohuq9Y1Y7GtbMeE+QYbkMse4AfR4lhNYIcG+h fnejZak12uD9SPTuOrbbcZSyTBhImSvz8LKRs0Nngsv3Nn00srzKPA6Roq/Kuj9ElZjUY59w MW8Tlp5CK0/fJt5wMeY0ZzAKxRVjHpqNVq7SiTAxHpRuVqXxg9bK3qfP1KiN3GgGGNaAoy8J cHOv0mW4TKdyu60X2QBvy2L4m+kk+y4ywT6HOK4DdAELKxIsSGrht6YhSMUDTc+yc3LfE9L4 Z7EIoQUzy9H+8mLhUKyRJS6/YhIbmrduj6385TJpN43PSirq71fLEpkrlSthY4vKTsOY11g2 02y7PcH9KxB9s771wwHdyKgjw+hPBI8tGsXzl5VWKCwwH1WYv/kf8MxyiDQSx3SE71MF9X0Y hozJWPHdTIBgE16rjQHlMEa6u1gonBs8cmdnsQwSFqORGWaAC7Ek7H8I0NkOat0N0VhKY31b J1SwGrLRrD+OmxhZxWrS29O18vVEb82ih/BZrKGTtuebWVZlOw7+Q0a8DVEGmlYMpmsR61+0 rwYYJZaU5HmLPcb50/Q+K68MRF8xEujpdBRMGJGdVC4v8ikpdaq7qOp5MbDjBh2jx1vwewJc 3CB+RS0lAG9zuLiBAGepJWJEmH8HImVwP99LrR9K3Di53ef+wdVw7yEB7gUu3oHkqbDwXmx7 ITeRU+DG+c7ZxL4DBrPrA6ni5ZspO6rStLX/EVcZtGi+1I6lcEAkhcxGBz22fe9f+jMoxyIQ CDBIUmwvSSEftXAGrfvoP9opHD72cocLt/eV5OHKZoTPMo5zmluzEGWo6H4Mho7z8fobbcQr eXE7RsYCDknhwjhzRBlDXgZQpnGZ0JBxEleLX11taIc6n23vadx3c93e0JmLFmbSZ3FYelDX gROzoo53EhMw9DmWvwl/rZuKuoPW6Vjm3sZj8PWtMn6rud+nnNUGOphbO31wag2nm9vNtlkU oKszpw7TCrJ4J98kAT+GAOyfW5IUgvIEuHAxPV7lrmDocXWjvs1LBpPBCYwmF8yZiL/pHL01 0f191N1pXjtwN0kAAxFbLoglfBp9wX5jORUgP9CRgCaQFd6l9eaAM7rg9+wAu/uvHsFrl4n1 Pc+8Z9wFr4awDQHviLBN7SFskwm/x8U5WQ3h3zlSz6uTWMAqBCxOAnseAS+AMZYCA7ph/doK /rtudxhm3Kzhp+e5swvwHK6eLn2v9Q/1mjyPhTgvxLtTbLqrIwibCGMdHr3+Gl9KUBFL/JBR TshgDq2AjmaKBI4e+imE3fncrV7ALqu4ooB7oKwFPEVcbnD/2O7uhGgG0lIJ+1173WL7aou2 xVp1ZPvGigsGS0m0jpAwjIWMDENfQr28JgNzHdfGkW3HPPkpMTi37VQb5m5i7DpUPHRDy4Sx Cn1Jvdldd61OOKj0RWHFvmTmD1Ixxdz4vR/V3qXMd65ncbRpWfiZNo1NEURr0qi19amN1IOF dGIu7fXV81eA7jV1OBMbwLwJo6Sl/abxAr86fDySQSe9634C2VK12Xr3Z2H+bUUADuC8l7mw cElwBDnG+gR/2I5jQA6T75gEU/xhOjlmPOL9IjaeZBCMJNYXYLpSCcFIApxhsP7z6PPZzUPr brCSjZ+mW7VgkXraKx1iUIkw84ilyP7RFAhgPFvDtEHK2mBQfc1ejDEgaMhJwvlzhF456Hz0 G+zzh7T5fog+GVHnkovzCRCWux3iugQlCIWTQYV/CZ2nY5xWNYX7BgA5oNQUtNtVoXZXn1ZK 1lVas1jzlXn5dOLdqDROZyMG2iCpbbhjQjhH7l07xoAJei06E/8sPbdD9ouxMJ46TB0Ae8Rq ET12sZ6YPnb46nq0TtS8vsJuRXNdY3c/mhij7WJfPPBJwG+63tzzdppO7su22E1mwSw2HlqI 4Rno/daUTFj3AuDfZE7/Br7eynXomIF8u651nI0hlGjOC16dRBD0PkSh9qGjQVIB/Hp3M373 6496NNMw3I8y669nZ1da/qwv9bUeWPaEFartsO/GBhxlmqkpPme/rnI3cT29C4GGzrOqhjza ZBt8hU2cBREsrklwM2owBzKeVQpaCIrbqlqYn1mVKKjgIzt3LdAgY6gtF/4v4xl0biw8xn9e yFJdQQB/DTFNj3MKdIDAp9xzN7h/6byAqs6dK6bbaXLB2HHqGvePo3q3qscW3RDOCUxShIVp alSeN7Ho0D1dvBZbnr/YCXPxgbqkwD2CoBrTLWiSNX0XJjkGFXA5oxBRyZ957eoA4XTuuMul HhWk07svLNvTqj7/KdIqXVKyraFvxvy+VOHygaENMClK8RzjrgCL0t3dTrNCb0zjG++45Bzc fAIX/3es5fmhpcueB3NB2oQgZVuBfyM2qWPOKJSOMWCCTkOroe7p6QudTeFa36Oz+tgBFxiX YunEzJr9r0Z/+2jbd2HqtipUCumyxuSdrdLPSWBscksVgLrXisQZqtO9IotP63YS54VsD6ts sgD/Jb5pKTwN4qSOoaBA7Y0lmBIZBNuqpTH2j61V1++731NYgRkF+HnylGXkOoskTpViERom FRZkXsJXnubS7F/8Fl2AbwTo9FvfEUdpQVooPUES/wfeMxIZDQplbmRzdHJlYW0NCmVuZG9i ag0KNjUgMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyA1NC40NSAxMzMuODggMTkxLjY5 IDE1NC4zOF0gL0JTPDwvVyAwPj4vRiA0L0E8PC9UeXBlL0FjdGlvbi9TL1VSSS9VUkkoaHR0 cHM6Ly9kb2Nib3guZXRzaS5vcmcvUmVmZXJlbmNlKSA+Pi9TdHJ1Y3RQYXJlbnQgMTc+Pg0K ZW5kb2JqDQo2NiAwIG9iag0KPDwvVHlwZS9Gb250L1N1YnR5cGUvVHlwZTAvQmFzZUZvbnQv QkNESEVFK1dpbmdkaW5nczMvRW5jb2RpbmcvSWRlbnRpdHktSC9EZXNjZW5kYW50Rm9udHMg NjcgMCBSL1RvVW5pY29kZSA1NDI5IDAgUj4+DQplbmRvYmoNCjY3IDAgb2JqDQpbIDY4IDAg Ul0gDQplbmRvYmoNCjY4IDAgb2JqDQo8PC9CYXNlRm9udC9CQ0RIRUUrV2luZ2RpbmdzMy9T dWJ0eXBlL0NJREZvbnRUeXBlMi9UeXBlL0ZvbnQvQ0lEVG9HSURNYXAvSWRlbnRpdHkvRFcg MTAwMC9DSURTeXN0ZW1JbmZvIDY5IDAgUi9Gb250RGVzY3JpcHRvciA3MCAwIFIvVyA1NDMx IDAgUj4+DQplbmRvYmoNCjY5IDAgb2JqDQo8PC9PcmRlcmluZyhJZGVudGl0eSkgL1JlZ2lz dHJ5KEFkb2JlKSAvU3VwcGxlbWVudCAwPj4NCmVuZG9iag0KNzAgMCBvYmoNCjw8L1R5cGUv Rm9udERlc2NyaXB0b3IvRm9udE5hbWUvQkNESEVFK1dpbmdkaW5nczMvRmxhZ3MgMzIvSXRh bGljQW5nbGUgMC9Bc2NlbnQgOTI4L0Rlc2NlbnQgMjA1L0NhcEhlaWdodCA3NzEvQXZnV2lk dGggNzczL01heFdpZHRoIDEwMjcvRm9udFdlaWdodCA0MDAvWEhlaWdodCAyNTAvU3RlbVYg NzcvRm9udEJCb3hbIDAgMjA1IDEwMjcgNzcxXSAvRm9udEZpbGUyIDU0MzAgMCBSPj4NCmVu ZG9iag0KNzEgMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwv Rm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9GNCAxNCAwIFIvRjMgMTIgMCBSL0YxNCA2NiAw IFI+Pi9FeHRHU3RhdGU8PC9HUzYgNiAwIFIvR1M5IDkgMCBSPj4vUHJvY1NldFsvUERGL1Rl eHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L0Fubm90c1sgNzMgMCBSIDc0IDAgUiA3NSAw IFIgNzYgMCBSIDc3IDAgUiA3OCAwIFJdIC9NZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRd IC9Db250ZW50cyA3MiAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NT L0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDE4Pj4NCmVuZG9iag0KNzIgMCBv YmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNTYyOD4+DQpzdHJlYW0NCniczT3b cts4su+pyj+w5mWlrZgiCBAkMlNzKjdnsmdz2dg7W1vJPMgy7XBXtnxsepych/Pti26AF4lo hYkBzsmDIlMkuwF0N/qOxZPrujpbrurop58WT+p6ufpUnkYfFsebq98Wx1+uysW75Xl1uayr zeXi6Pakhku/lMvT8vrnn6Onz59F//PwQRIn8K8ochYlUaaymKdRIdI4EdF1+fDBP/4cXT58 8PT44YPFIYtUdHz28AHcmUQskizO9W25UrEsouMLfc/LIxmd3+jXRuf4l7J/vXz44MMsmv8W Hf/l4YMX+m1/e/ggevH6WbQgBvF0U9ebC3och5tN/b3jSHfGkRZ5nOURK+JC4DAQe4v0i+Oj V9t43xMaT/JYMgLat0zRN60zL2ScKb1WGriIWJbGrIhYAnh3CI+9z00O7aMqzqR7Hg/4LDqG z6NoMKf3gCxSHjMSMgOAyVzNOMLP5gfZLMU/faKQZXEuKBQO/IIq9oDC0Ua/JvNiFicw1Did 57MMr36cwfcEvqdmUjyilaVpXKSTzECWZiSoSPMm1xdXH2ZJ/nHuFSzXE19QI9yhaAMt1aIh zRpoGcgHB9ONuMuNUfugEyM1GPx3A+JJEqckhzmHnkmA0YGSzqGPuItYDPvgSIRQkkaLo6vl JYjR189ePY+SxV+Xl+fRrLw8ePl0/n17CZBQrKQLNf0fcxBnIlOB5JlqzrzPxuICnetdhYA9 mBUP4BjjMSegvbo821xf6F1pfiBmv4O4KfU7z8r5gZxdw7XycoX/3XhHK81T2NBHzYKLMJgH wuCRIuiCi5gXA7Tez/VUnIHALq/x83J+kM9WJUzczVwL7/lBOluanyKct6r+1N2OP8N9V3ht BY9VZ3CxWkV6L/g4wyunZuLh1VqnqEq44bR9/mQuZ1/av/D6stbQ5GxzrzVyzEWqN7Ekoybj DLcrQOJKA78FRE7gY12tQM2Br5ctnkscDmK7mDM+w5+v2zeUp/BzBY+p3lP47Va//QKm5KQ/ k2r3Fb/r28yPMMMAXwzfpD8u9O7ae5PeffAN2+/zPJGWqGDzdW2FZie83Fz6hptr5b8gALu2 +/uCy2ImSHAE4cftCh5uNA90C0oyiv4D77KcOGeJ/XuHGx9554dExHlOjc871aTaCIH93A2u Y7D1F03SOGUgbIQVPauqNlxluWNrqgYsombLK7j5ynBwCTfE8GCzMs2kd9y00QznnWK5TGLF JqNYLkWckiv6bRRYOAiwmcD+wqy1uL6po987GeQSWLi8nYitQWh+aqGFklCMxXxo8PbHOtj3 TjUZdFsRor0CFK2w7bayCLa3bFbBSHCcq/Ut6Bn4XHWpafh8Z7votrklvLH3stPu5fALvq6+ 0btzI87hGQdB++ZQxXCDdE/bCCUmDaPE5Ik2vUQklWamIV5v3h7DzL2ASXrse0oYGCEpBdo7 3YJyK0hw/9AUgUxTrcshXflGJcuBCghUEA0EfLUtitea9PV//24EAeIJ18QWg+ADnRZobujJ lgqo3/8WJGXMOTWmZ3OQZogjYF76Zy+9uNlktASGt8opcHcg+qSV4Si8l+uqW5BljdtCT07j jXV1gfot/tGX6crQAaE2y97egXx6DB9Hr6JWvBpKvmxlbh2d69XA1xkDxNxQl2UwnssV/Lc7 T3arq65bAl13W1sn4WtN0MxwwEV759a0VvUX+NW/0E6KWCgK/RFCm4e0PKW2udQAK1z+Hlkh EeG6r9eom91VQDTd9A637HafbLZtq/d9bds2cqVv1/pej5QhlzsHfol2LdI3omM0sfLmZt7Q eack2EmRPUV1lx23dIJdM1UNlK5Ga7OPmEm9KY26EZ3OLUuvbuGtW7oOTOVJy+B1BK/SwuNL O5k4AhTa7Y+BlDopcpf5fttsOD3fxF1lhtwjoXMYj5lpo+n5FiapQH3BjWS9adFZtstgsKmr FQ5hvWwFSWs2dlL1X+WqNitvqHcZRqTwNGacGsQIkSLC6oGpdJk3H9CoiRms8G/3mhImhrCL HL2cfdixkDxK4iyHz5Rn0fW56+p7wO4nDZv/7BsplQ8m5I9HigkGsaI/DikXW2qcNDIE5Ry9 egmsBvrf29fw7bV/uaA0S+UUAn/yD47HReYG17noWOZfGeGx4tQwOyXwzVLvc4VVpXp+U6N1 LtfoRbO3e7cBeCwVheIP/sHl4GQjwL2+xWmoK+9gC4XKvxusd8cTmDacXPdnjWZhNI3yM+gH NUTls9lf0RKwzhTUOVZozpvrH+dajXkcvWgfXp6AeLdGZqcfHpV697SUZFQjDPx79+cJbUCC rTDRtAqpIPpLgHtT1ncboJ/r1uL2L7esMGeZyyV0eGtmGZTGvvKpbR6wdsTAuEfF3yytf707 Q0ZzY+qfr1OFEtYNzr+vXqtknBydfyHJRVwoCtyT27m1fVutu45Q78qDEGEKIWZGYeNfmBVm r55qrgsBkWMCXAozyuDDbofKXErMdTnLer81zGViGWjjtJGNrbv+fgkiuAKvRT8Y+99V59Zo H73wLtXSQqt71IC9WzOCJ7EkwY2wZrKg1kymxF6vtufZ0CaDkCRU78St9JWCBMf8u+uzOEkp cAGiAznsz+Mm00VaMgxpWZdmVmitrHFCwXU0u/Db+86LX9dXsIs/XixWnWcTvUburJC4cUtU 56iubYy3yHqM4jbaByFElCQLcAtt36y/4scihc9tWba4gmvgnUEkzJ/G09XFF/XV3IhF1X7E TfLGqRnBV2c/DzP7kO7H2PfMfv7Nkw+OuU2rOo9bga156VBriUabyhzzW5Nc24qiSBKGwz77 s0d3e5ZrMHlvdsycjCONZo4sbcAkXG3Hn80vlkDkCPrwoTNloKIRA9sRBu0sJDEHryEDAaIn O1eqaCfbRbNF2M0oYzHPKNfa/XIHHVBB80lIqMGceH14f7y/zDrx/jikaLOPWJjTNnqwxJBM 7X1flUmcU9C96/tMCvCIEeCMMO7SMrSM8Q1fkyWfcLhKTy53g4sO4OVFUaB/sF7fL0/W6SDU L1CTjRX8kSLbS8cmBIfU/EXvDVcmGLMJ4j5KhYQUuMlGL1ScESv9wWyt+PEYwooBHK2YXkhA D+BoLcAhQ4BrU2e6+OqLNvUPeFprCzYo6jsnL01iReKFIdPyJnqDGl4vw/Et5qF4l6w8l7Ga jgJ5ATsVIWvaOMTGuy7GiwJs/smGqdieWX2ql7iXML7rCI2e49qvbPg/sAjS6jyomlNxpSiM Qe4G591NKqCskhyddxEnVLJHcziKoQrisAylN2SpJKFjSRoy16NQMYGMKzAUBzU4QLZdktfh o8jW/vV8loUxxwIoNkJReAUJ6RZjwblMORXWlGMKTEvClOP3z5Jw2XO5JgwSdDBCdIMbJBri 9/dNyhJrKZK3Ulk0jgbpXTvR9j5ofm5UvTsmUyYhk3uqhUhZASEMAlyA2FsaS3J0EG3+59O5 FUKw3j8G0G3ZnvnVIpBZj5zJzSsvOl9ebdL0xNfT9PRnL8RbNBHe7fIzeMGrNgq7nTOIGAyL 1/rBcpuVitdNvd4byD/DNx59nAdjWXCcD9Mjn1cmgo8mWV2ZCk7vKOQFakBuFLwTKys4akBu cP43Qa1wASu6wY0pRPVRokxvS6Ch8SFidlsSIbclAnQoGifAfee21MWBH4cS3wTCocQ3AW4q 8c3IATvzajQuL5c1Wmp3JnktanIGv7Tpub3c4+eQrS6389S9W505KPlTLZtIGIS1CHD+w/YJ BxN+HNM6BVlTUn92fXD43r8gk7KL8wwEWeYQZE4kfZTM7Ql19LH8fxPq8IiUc055mIVv5Lp7 4UESGLXJWLzd3/43GPCqyX2I9LItr9tw8Bp8jV0O0K+mAsxVrZu34dJkO2/ImvHS7EQuM965 IIHqAVIlQAsn5mGMiAib2iOEdPmF3nhvVFBoDZME9/bYeGTCJBIRQEMlEhHgvEembSIRAS5U ItFUk2mzD8aBczJOqMSlVM/DNl7ufBmQWo8Xi7u7OxRTq0qb3CYxxhiPt22Iuq277LJimtRx SLkhxORixBwESh+CTkIpm3QSDmyCKNYXXnfFmI6Z8KDYMRnn5Ph282QsQQiwZqGoIWGDnCTn 4oTNkxHQDY50rsqgVqwbdDAr1g2ub8U+2o5q0aasMl/wkv/SI4aIEvj6j60zhbqHG1w/YTtA 4QHjFGD/xjrnKI3c4CYx1nMGzUv3YGBFXLVaogBcR0eE/GtNdlo/7pdeH/Qbcr1ofzhz+Cix ic0Yf0Avn/PH6J33kKC20YWk5spWGptSDf9upEZiMAGhjq/V/G8v3LrzTGvcvmnNvPuGUiQ3 9ygCpK1IKEckwPkv7ZYK2dkNbozmFzZqyaFwlXQP5yE3VgJ0KDYhwO2Gz6P3WroePmu6UuEG mrZ7qgjlEE4hS49A0T8PaI2Q5RS419VpG+1alycgRZH1P/vnjQR4g0ADZTxq3KZwdfkZsOqE ks3C32rzZcN0du1eNTp729Phnn1I6YZzU60cNJxTJKF4l15c5nFGjm5Mg7KwwS2ec8jkJaRX EVR6uUEHk15ucBNlhhPQQ2WGk4OVPcXRSoIwydqTDRg8qooCZ/QuI9VMM0nZ05K9rzVYOpJN NnYosVYkbWEuhd6JvKdoF5CgTlKYb3AZhxQ5AlzY3TVHm2Sy1cwV6hQTicW0YBBCJ8B1TpAA upqS0HKFgOx/x9cWZkIu4xOsK9/OSep69Rrjrev58qXRjHYyoI7182YTaZ9qe9cGlDcikXFO 8qL/5h4sgXg6Ac64CHrmrm3Ue3g7LxwdN9pWm++uMXUBJx1705oil66w4KRJMw+mGkgGhRjj 1fgginCzk7mR8Z/lpQoUN25wXQD1edcf/Dn63fu6Q79NprUDFZlF7V2MJLgRuQdQ+AeHxbIE uACdjbELEwFujOEQ6HyGxnDQrMOHSeTWcFBBDQc36GDSwQ1uKsPBDT2Y4eAGd94k6JZlkBof VmCZ4WSDLRTk8znBBS8oZQpjglONNU2wDxMBDjshLetq5d8U4nvA+h9lKtHqdK5oW7Z3+sm/ CSbRRphqmCLBTfvrhFsFKAXO0dqcaqgZwiHAAV8y209leETdvS2xhBQPQQw/sUcgtLlrAQwx LQZTcpz+neam5SIB7vmyXm5Fz2zxSdn1Me86Jg+6uUMoTj/PIMC5Mspq1YU+K++ZzIIpOCBv KhIRaQol2QS4X8r1Gut1jKNrTwtDCKRKk1TjnWuyBMtGpqImqBchmKZfSvo6DqYXQj/FYcj6 pTm2rTOGBxbSoNBUNhaS/sj9h6qwVweBrX+7RTNGToIbY7eEPZKFJyoWZB4U5hngYng3XlSK R4ER8IMRqRvcVMaLG3ow48UNDioRP7UD9u6hhtx2eqYD2C4C5J4L2gSmi3HGTzVUJcH5QYCD 8WWhNEBm7NGJBgpCU5IDNZ5RbIh3gjGddVVj0pZ3jTtD42KqQWcF9PohwIVUe3OOW5QbsH+1 N8/3UDGlnDUZGW+vsKtOtWmc6Dbdr9jN9nsDJ4XYq3U1Z6466h2N+dcKS2m2ieqAOuDKKN2N mo59HDsVPUCjkLyYbIkynkC7crdQTYL3JQFfryM7BJJTkRp+Qb97a/2sS++sD5tKmlKIfF2D 7ddY+ddgeQa7DoFcgLNkEA4BbowGG+h8KqvBgjyhU3ZQg2UhNVgCfjDmcIPzXpLGBDZZIMCZ ushjFIFH75qs66KNbiX+dR/cjAl0AqhauBk7wXX+U5U8CVQE4Qa8pc8GUARSBhFXYo4DdBHY t6R4tPmqTeO3bYXz/nmrww3doQe87/Vuk713GSUBe/TtnMANyQ8vAUxhLwzh/P2mmvPdEwSf l6a7QNe5xegM5lA18MWBKy6QVJCZKy7aH3yX4dqMHtraVXX0svPNNOPFDdYezBwmQkAgHOAc DAUOsT3zU/6OR72jPbFTRe0/Rl+koFER2PjnsEKipuAG1zvM6RXK8WPv3fw42I35ZIvNWYFV hm5wf8GkbVsoabT3bV+j94o2nqFXnMAnQHJ1CvlIk822FJDLPQ6cUzEMe8pgKvRzQ0Wpd9h0 FMTxbyvP3eBDFZ67oYWqOx8Fzbnkgfo1mCrjPlruguvHi8UpLPpn0/jioH9KfBW3ZzH0iqvZ 3HrA8W7ZCAy08VDfXbwxyjC4GNAKxBtRKY4DK8Vw8FDKiGEHOFUphwxZNzTVTMyTa3Nuw9dJ IVAHAq5JNOHjSLQhGw46FDRe49wWp4u9xelpoM4BjeRKBfD0PpM2DWrSuuEHU17d4BqtZHoj 041PMCPTBa5vZD4NYWSC3HACDm5kYo9fYo4DGJl4NhsBzpeRaT3CbRF5rzO9rXS2TcE7f/IR eLBtfXvROx/I2peQ772nlv2bDDs5sGO9u6eLmCCnIN5preYWNNuE9k5DI2BJSqtHZhW8R3SL WBUUbLBsDDUgQe2eQ79t5fjPBDfdIAnc/Puj0wz6dhDgxuigYTvLYFdxB33s2h0ikN1BwA9l eBDgQlke48A5lz1Q3wOjQ27h5bY9bLOn0zbyWMWbtleG29iwcaShsXEc6zunsTFybEdMjC9A 8mcBxXBOcGF1Iv2AZPdbx6Jdxubgu3iummV0Go16HRvltr+Q0v86Cm3kZJMtI/QG03C+dRld fMsDVfwLORQo3Yw4DUWmmLYpOc+g/dkYO5GHLTpieeo6EbdvJ/KQdiIBP5TmRYBz9+O26SPb 3cuylgsDpEilEDwjcAyQIpVBtR8BzlYqhzozfap1t2emE+C261Hh0IOT1hb63NlZux2piq0y W1PMbE61Xf8YvWs6bHHbYUtbdNQxY/A+PPwLHRRIdCaFlGqvQHY1+wHAeFeUISM8K0YullN6 hU09ZhnT/++VXiKo9HLDDya93OD8FzKLDOAQ4Jr6/gD5zUBrbqDmsHrDauvOsXEEV9L9nQSA yUVXc55tlZxHVeeVwRKZ9Rp5a73simQcZwEE6NmEkTDn6EHbYdL4JH7wH2DVvKTUSFJ28njY 5CzG2ZgYHO7LwSxUJw7B2HwMNOdKBIqGAl6givfwImNjd+VJa32akp3VTWxzZCCTZfWpTck1 DSmQ3Rb/97+wgZnDinAnXbyD495F/zhvTIUpa0zfrVb4znVZ2xO99U1jj3zngSKIwMMJH7d8 zZRqbQjDFylEDUbZA4FiXg23seRrcaMs6I7qhh+M1dzgYCdY415z2xLWSadyrR6jyAnQQIRB UIVAqj2+dlljjrAJkxrV8QkyBXLBGlrgal5qDw9ttjdMiTepSuXavKGul6t/w84G/PVf/vsE CTyUYdyaOok9bJBUwREaQ712sLfIMFUTMC+cQmLM7ATyQlve2EJsrx+rbT6/7tLqBzyDTW+M lYRifoFFEmtIaty0WZCLtPV7seYcxkUC19AeXSzBRkMyb2k9VESKZyKWOTUL/o8PzgrYPAhw a+BbqfnWv/aXx2LCUUJlH6PALUEe9XRsPuYIBh7IKS8Yg3Mdx7GnZRk4cbrA/soZ7ua5UsX2 bv4fjDkD/Q0KZW5kc3RyZWFtDQplbmRvYmoNCjczIDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsv UmVjdFsgMTExLjI1IDU4MS4yNSAzODguMiA1OTIuNzVdIC9CUzw8L1cgMD4+L0YgNC9BPDwv VHlwZS9BY3Rpb24vUy9VUkkvVVJJKGh0dHA6Ly9jb25mZXJlbmNlcy5zaWdjb21tLm9yZy9z aWdjb21tLzIwMTUvcGRmL3BhcGVycy9wMTk5LnBkZikgPj4vU3RydWN0UGFyZW50IDE5Pj4N CmVuZG9iag0KNzQgMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyAxMjUuNDUgNDM1LjI2 IDI3NC4zNyA0NTUuNzZdIC9CUzw8L1cgMD4+L0YgNC9BPDwvVHlwZS9BY3Rpb24vUy9VUkkv VVJJKGh0dHBzOi8vd3d3LmNpc2VjdXJpdHkub3JnL2NvbnRyb2xzLykgPj4vU3RydWN0UGFy ZW50IDIwPj4NCmVuZG9iag0KNzUgMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyAxMjUu NDUgMjM0LjI3IDMxNS4yMyAyNTQuNzddIC9CUzw8L1cgMD4+L0YgNC9BPDwvVHlwZS9BY3Rp b24vUy9VUkkvVVJJKGh0dHA6Ly9keC5kb2kub3JnLzEwLjYwMjgvTklTVC5TUC44MDAtOTBB cjEpID4+L1N0cnVjdFBhcmVudCAyMT4+DQplbmRvYmoNCjc2IDAgb2JqDQo8PC9TdWJ0eXBl L0xpbmsvUmVjdFsgMTI1LjQ1IDE4MS43NyA0NjUuNTQgMjAyLjI3XSAvQlM8PC9XIDA+Pi9G IDQvQTw8L1R5cGUvQWN0aW9uL1MvVVJJL1VSSShodHRwczovL2RvaS5vcmcvMTAuNjAyOC9O SVNULlNQLjgwMC05MEJodHRwczovZG9pLm9yZy8xMC42MDI4L05JU1QuU1AuODAwLTkwQikg Pj4vU3RydWN0UGFyZW50IDIyPj4NCmVuZG9iag0KNzcgMCBvYmoNCjw8L1N1YnR5cGUvTGlu ay9SZWN0WyAxMzkuNjUgMTIwLjI4IDM2Ni4xNiAxNDAuNzhdIC9CUzw8L1cgMD4+L0YgNC9B PDwvVHlwZS9BY3Rpb24vUy9VUkkvVVJJKGh0dHA6Ly93ZWIuZWVjcy51bWljaC5lZHUvfnpt YW8vUGFwZXJzL25ldHBpY3VsZXQucGRmKSA+Pi9TdHJ1Y3RQYXJlbnQgMjM+Pg0KZW5kb2Jq DQo3OCAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDEzOS41NSA3OS4yOCA0MTMuNDMg OTkuNzc5XSAvQlM8PC9XIDA+Pi9GIDQvQTw8L1R5cGUvQWN0aW9uL1MvVVJJL1VSSShodHRw czovL3d3dy5jbG91ZGJyaWMuY29tL2Jsb2cvMjAxNS8wMy9hcHBsaWNhdGlvbi1sZXZlbC1h dHRhY2tzLykgPj4vU3RydWN0UGFyZW50IDI0Pj4NCmVuZG9iag0KNzkgMCBvYmoNCjw8L1R5 cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDcgMCBSL0YyIDEw IDAgUi9GMyAxMiAwIFI+Pi9FeHRHU3RhdGU8PC9HUzYgNiAwIFIvR1M5IDkgMCBSPj4vUHJv Y1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L0Fubm90c1sgODEgMCBS IDgyIDAgUiA4MyAwIFIgODQgMCBSIDg1IDAgUiA4NiAwIFIgODcgMCBSIDg4IDAgUiA4OSAw IFIgOTAgMCBSIDkxIDAgUiA5MiAwIFIgOTMgMCBSIDk0IDAgUiA5NSAwIFJdIC9NZWRpYUJv eFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyA4MCAwIFIvR3JvdXA8PC9UeXBlL0dy b3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRz IDI1Pj4NCmVuZG9iag0KODAgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGgg NTY2OD4+DQpzdHJlYW0NCniczV1bc9tGsn53lf8Dyg+nyC0LxNxwce2lZMtKnKwvG2njreOk UjAFSUgoUUtBUbS/fR/OdA8wAMkZComnWcdVpkgQYPfcer6+zuxw1dTn5byJ/vzn2WHTlPPL 6iz6NDtd3vw4O324qWYfyov6umzq5fXs5O5zA5e+rsqzavXXv0Yvj15F/376JIkT+JfnGYuS SBUqFjzKJY8TGa2qp08+/im6fvrk5enTJ7NjFhXR6fnTJ3BnErEoZXGmb8uKIk7z6PRK3/PV SRpd3OqfjS7wU9F++urpk0+TaPpjdPrN0yev9a/94+mT6PXbV9HM04iXy6ZZXvnbcbxcNn+0 HXyjHTzPYpVFLI9zic1A7lumX5+evFnn+wupiSSLU+ah9nu66HeNs8jTWBV6rDRxGTHFY5ZH LAG+e4bH3ueeDvbRIlapux8PxCQ6hdeTiE0P1CSZFhOBVxV85Phxs7O/gCWpVJxJH0sHYUnl O0gxbOT3yTSfxAk0NebTbKLw6g8TeJ/Aew4vSUi2FOdxzvfSA4orL6lIrxihL84/TZLsh2lQ skJ3fO5r4caCMtR4weNMdNSKuEhdS2HEXW6O7IO7O4JtD/QfJikSHqfetefsBJUCjZaUihPo 9+1OGHGXZ1jaB0cyhJIump3clNcg5t6+enMUJbO/l9cX0aS6Pvjq5fSPyXphenHIWZboaapZ g+1rWwJ/giVYx3rBZpMUVuqPXyT9HfRhjHMv/Sg0OSaRjofcs3cVNLi5X0JbV/D+F3gXTQ/4 5KSa30E/4OW6eYA/L6JXd/B3ZV+qa7iniU6aKROTstFfp5PbqTC/UeK3Z/Y3j/FpuEm2j0fw 9qg2H+b4bb3UgvIanoHfefYc7sCnX03l5BKulzdItFrZrzK4/CJ6pp/EjQYfb1bw1V33S/p3 9e3XlpmjqsHmz4Fi2n1RTL6H3zWNsM+SDYxKYs63BmZ0Gz4E50vL4kT5+MJhwsnSVNhtyvDy LDQbXG8nqYcNlKIoRJ8HHxYuEhSl7ub/3Y5FfTttZ94JzFY7PiXOZ5io5Qqu4dRfdt8uQ7Mr tDjWcNLD7nPgD5m8AQ7wJdYTvEVfoXnRWzEXniE70D9uNj4eBycsVay8U9YFqje2Gka71fAC kNEmX+/en8JUeW3HyIiw4OtZKxwAkNxMjOgcTtM5nfwb8gXXVxfdu++QQ5T3TXMDggeW0IvZ 7DP01tIurF+61RXD9Qt7HWQ6flpUMYr5JWwaMP/v7GP6tzK8cf2X/lafwQ7wlzN44uuHbjco 4Pv3/3oLv3b89k230v8H3uDiQnJ/+XDI4InEKDWPdrCg6WDJspgVIwe+73s7LnoxpxHPVCyV FrgyR5rnf3K3QdKuoKSIxU6slpFiNSd5MkTgpPbsUM/FfPIroh8EVfOqWxIoPepri4XeVQjo ciegk2t4zgnSDm+m7WaxqOdgWIC3Fo+9iOQXtjyF2bQuwPUczaKMQX+7do6ESYmbR3MZfPNQ Mi7YvsZYqCyWwkNtAPo0As3M23LKEoTE3XflIjRTMsn9TAXvAqkhS6E81ECcttMtNFmulVhf I89R+0DAVnWLKzR9PfIs963u4NS0vqfFt5va8/DURJz6qIWfQGnq78mj8leQfLB/D5TG2ICs YvJRf3hAydbfUDVUojwtsm2B9kmv4NjK3iEwb3mUBp3rF8QbPYh/dlSfa6jimqwHBBoq13he ZL5GfEb6zX3VGwGQSRRiRydRaQVWv7Hgdx9OrOb00O1gTXVl1f3gIjeVMVO+ZoRXRvTsTL29 NgJvK1IolWYZCIZHlZGcUhnxMDGic1JSZWSNr/8nKsj3VjWs/g0Pgzg7PDz8B/zcS3g/PWB8 8o1+YlsNkfALhZEkj3ZtRqWGaEUiGznkdhxUnGndI42VeFz3yGkXjEofMxTnlMqHhz7ZluUm p1WK2zlOUJy4zYvw9HMeKy/9Z1on0du6UylBeYWWufIBhsNsjbCTorv0F3gQd5bgsp4XGoKI kUPkmroF7dQVqcsgtiXrC2M7Dz6i4CryMTHGKkfkAepm+pCxncL+/v4e5fq1gTy4EGS7EOK5 tYhfwdXZvXFQNMHnWprHRebjetuV+6XkMo5T20XOqOR5nqNKXt+Gp62b6qFN0VQteXjhI3e2 bcWfgfspdQij4HbtHOza++oHoRhYQjzkFiWaQSswR6yCk85YnO9vxIXGF8w74nrtMjbpd47H BRWR/0AmGgIUIyWolWoSVHGu9f9khN2WEVn3ux2IKZfxeQieClLw5KZPBp7c5A6vYeWcWRd7 Va5Zbt9SuHA1cPZw89/g5AoGAXQecotFFVxc8ETGeeGjCFEAoQkyGXO1e3zLhfUT9c7hTdP6 wL5pffv4eREt9Vfn1i70tj6zTy6qz9N2+/kNIchtVPfIF+MuEHSYWAqnFTm8OZMnaOZw90hw 9CO5ABO1kxyEA7DUBASEx/iSF7grjpIkThFL5N9rRSw+9zjGZ9aoSAH0FWxQbk7G9BCR97CV ykO+duL8G+goXHHn3VXE/fAGDJRpu5ybeg6X5pfwwazeEiORYrucV9PcWGFmaGfGULLPxh8M F0tAGALeomWnFHrt4zflObyqaWqMCvht2n2qMiAo9cfeRHymP3HL8lzBHdyseA3U8D58do56 iux+SliGShMCFWtJcWOh7vmIQSOyU8qcgR1g1GSyAyziDOJPCoBLj2MeIiNityAzGWfKh3k4 DFBCiXk89Kkwzz7J5amP3OHtJay9RYV7MEo8cPWUNW7N97g66wt4vWztVwQRa0WcKx+DwM3h O9yg36PFFhdbU1+h7/4/RodsYxBfRB8vYbaUTYSTxqKJugG3Ct90q9xfTlV3cxkcbIEWIpiv XQZzNJfwat5/7h1TKIPOTbjBrebxb+FdgRhW5uGNwKsqYzZ2yjtFD5GRvRM9SkIE3jgwwGg8 PAwzDjycjOkiInN+J66GjI2y+uHuj7vnXa/BITi/GMx0jLjJBhE3Fj0Yn48xDn6G1wWaDw06 +KhXxeG78JGYWSwKX1vDm1NkAuvBQ+49Gsscki40FxoFKC8X4RtdpKAXeMh9tJHq4VUhlsfK Szh4OyVnEJvlJEdtCJY8j6WHNkVTBVohxzQ1/KjCks3311RYsl5p2FktgodAKfAB762NKo9T 7iMHfpqUYnlmOUKSfTVSq0vS28jSWOthxwpOGMStdwaFbyeIWx81DT+z8C1USREn3q49cKui ioNZTGhAlprQhSRhVhsNh2L0A/oHNnkaQm80JADsfhxxEXmhWSZwag55fVSV13+YirQgTvOt 7nNmJ9CmCUICrdhmfqjMM1Jl3k2fTJl3kcOtj2Vm5/sQ3MDKZAExYXtrqV6hwkftmy7lb1GX vYUdwqzMqioR92+o4cHtCCnaEfbUH2C2ENmIkT8OHz6jMY9k+2upKCCswEPupESNrHywqXvl z2hROV71oazz+vZF57Z79sYGfdxYxRDi+DBHw6RjXPReGmMhgf3Y5G1WeP+5jR7Bj/hruGkb cpX1By2NWTZv3UpoafmwwiyP3zTNhzUPU4nqaucTyib/vK2nbQtajojEB0vAArvZtW0+bc/j cYlBv9ERhl/PrZFrM7n1FF4MfOl7Ahq4KG9vsZfPUak0ecAE8V15FnPma9aY3DnazEJZJBBb Oc7ewyntPR5OxnQRbX7hGmOj7T16SjI9Jyu0HptViObWetXPWBv6lbbGHZjBc3wmb5+ZGbdQ U88X1QyFRF3PIPydGb8MQXIRK3xNzqxDKel8TH2SAVu7lHRup8Jc1i//GjGSVImMeoeSYuQU 64Y9zwF0wgJOi3FAkjaFUabFY14hTgkkPfSpdgIPucM+8eW4Mik4ZstDdIWCv093qVqPhsmW IfHYZAAIPLzaHTpf26CztfTL4d7cfQTbX/XZJsTc6HXUl01Y36znCC2MI1kjhmwAGLp8zqLd xxuziS7tJj5wsfSB2TaoyPh2LZJA6XVf4x8DRchGXuUuy7/h9tdeiLZRMK3wbKuIBLcgsiKF wB0PU+FnVJJA1KyH3PP1DbmYupMzQkxsBcDaw0Z4mKTXUe4lNwYD0OY8gW3VYYFwwyRBCpPc nIzpItrMJ6mVTl78HphkYPltZXQlI8KMBtVArpPqouUN7rmz8Sab2RszMW3T9/O1RaHMYKST n+CNT11al8Z4q9WU8FMvjPHjTRec00fTPXQ0NoQxqm/tV+Yjvu2ksRt2cAkVvEQhwUVDZv6T TJPZRnj9LrN7g/ipD/651t2zvTf8ZAOIcIjWpHYbo7BDajunL5Hjm+cF1L9Z65BHsSEToNUx mUFAyShsSJtiBtOF78aGghIbeuhTIQQPOdTr+8yaPg6vDa6rXiAcfHZqo3hMvMnbZWfbMJnE eLPFQX00LEApNCgMn90ZZRs+FVmgz3hcfzsnIm3CmMgEiK8RG2XwvGAFrhYP/S+tN+LMTEtS Hzmqzd9DbsSwC9pMuDXGdm7+mPY8iF8xAS4LDOhoV226vmhjeB2GwFx1m+/2kg1uvSvihPla Fz6NTEtTkbnJbUQPhI990XoH89CmiH1JBCSYeMh1pu7QRJkCK+ze2sgK9ES6yeFc1pvHYO9A 5Tzt9o7ZiFVNZBwWGcddZpS4sSKAwwTigsGfMZhI0GaOCYUgbRcmkqSYyE2fDBO5yf1veHII ej3kwvt2VQJRTXvrTKVnvo/aEVamXdlAzivrkDMF0eZEtqe9Nb7IQQfykNswpoY3ASWQnb6v tnJIB/OONImhWHlbt6lUnFRzmFV9tPCw1t6bzm6BlgjjqG0ixEe9BflrrJKPv9tXS1rP6wNU BVQqUwm5qw8XPPZfxIW/n/vKzLxzHTHrZQqfiSewzOu+5hjY6oqxssu5Q9Im/gmBRd/HWTUV pVXTw8mYLqLN/FtjbKdi87ON115g2SVTQ+bKJvUNNZgbY6NIjQnNfDQFyfvdBMtEgNXQqjfG Qtlm/dCsVsE5QlZ3q8MjZK7AyukhB66ds07Fg/9DydAVvhubbCiIHAQi1SpiNnIC20mlMbLA PUFsh3g6uadNOBSM97Z7N1RWpFDZTZ8MKrvJfdu7ll/bPN5qYRLlzca87VDuQq6ubOLai+h4 Uf0GIqCGvHrjsqjwua/rC+MACG44yKBWh6ddBMp7As5BD7mTmz7cqs8w/OdtZcXaALh0RlQQ e32dnG1lOHwinl58zNtlvZ+V22gWhn6l4BkGHBIaPGyEB0AKa7uMW29OQUSbfsgL5vLCuBFJ SolIPJyM6SLa9MM1xnYikhL9bbiA6l83iwvo20z+YPm5qzkyY9O2mA7Od2k22mKQ6wkYvQ0C e7wbiBwNbVmxceNj+yxBf51IYtUlBcidG66kTQrgGXvMX0d6dpCHPtWG6yHX1zMyRSuCZ1Kx NMEqoE7qwbdFlkrwCXnImdgAhAn3dR9IXYUv85dkUNpoX63mDOk4ya07LZpFeAcNx8Nr9tZW LsBG5W5r0h1Pcx2+mVq7yD19TNFMKBfn7VVIw17DcASFKgUcGbK35qYpBJ89MqpJ8NOOoDqx f6FSRKvmqXepfhphVwyu/WeQRuNh59TW5MWzPlODXoRRKEJzkmKCoYcTLI+2tJrMezjbxFh3 1sLQCE7V0NIt8e5f4c2VnMMZmh5ym0fCBNdMMqw6ua+2amTAch+5rXMLCTKfJd9fY/UDhReF fVhpjN8u93peBd+8FNRE8Da28wAQAU9VOMORwpPLsYdd5PqzBmMCd6UAD4OnmZjIh1XnqBGn /oHCx0VvS8Ed5rVNyzumOHuRgWHDOw5mK+fht3JpQPDe6SqGyrC758OH6SsMCPGQG2EbkbTZ jJCfy7aPTHGbj4gOS2zNR25OxnQRbTbjGmM7zUdnmCbclM2qx4NYl8pgn9jkzTaIDb1lK/Ea upnNZ0ptn+cSfOyeFhIUfcfcLw+5van74EzK99dqIRSk6DjJkav7QkpEqPtqq8zgnDl3WwnV faFSqCK1t2YCFvb26rq6n0+aEXGJkihuQRRGIRolXK3Ay6CGE9cIzThbs6J45CRS2jxeznLX uV5D2y/pWaQe+mQQ3E1ukMeLYLA9uy64SVZBuU0PD7aUOsaQl+iiHXh4g6PkAs1Mbl7Cx9Np IAK74Z5GmzOFOoCbHEE5/QKjjd3kEOmZg24Xd6ZIW2eoSZ0J120AXrpVKuSwP6fF5vwNa6Pc RucmY7B91NYXef/dtD1dTV9ianJcryqstFsuFrN3h6c27q2vUALnTnZnT+FB8MENSgoUNb63 QVKJjL0TPvgRoipJUdDvacJDbTe/aHmP8ZdvyYRq4jwLb/1sCM8pnwQZ8gwFm5un4OPMCok6 r5scQVA0FtPykPthAl3K18qeQBGUH6ZGLSJIyweXwai2O7ENbZ48nBvjP+qQkx916KFPtQw9 5N712OZoZdNR4TCo/mhB0K3Xa2uYA21jhB9f3Q1OyupSstvK7hhzdjJlclItzjGJCPNau3z6 cxNANR+Wg7e5rBtHHg59LHCeBLOKvbD33MMXdXNpm4Tx5N+C3XZQLwxpY1USE5+63ChT3Rcs qT4YqzrmwzfR4bQwD7dZ8xioUpEahVmmXKdhfQd5/jf2QI6V8X/1py2wrq7ATAB30tiQ0u1Y sbQrzkERwg6+2Zz52jBGAtCGkjIl47EBXKQWODcjYzqIKMStm30Dvnba36obazBrF0tcY9HI eW9/2wzmAk/lZsTiYMamYwK3JFH8WutmHzUuIajhwaqjqNmREYDomN5jk3ScpYA2mZ4J6bJz DHdT0rPvPPTJ5LKb3LdEzjoPOYIMRhbLdH+daVyCHnIvbZbKytqkjd5pquAQwOcCQqY87GzG 04fHyxLSMjzUCbL8MIHSQ+7QFINdTvPNUq2L6NQKcnO0Y4NW17Y6zmZy3+F83tki7iyga0wg 76ICvGaAWlfctcNffUmiHgyilaQHmpuwkCIAXXnW3topfMHVRpkylO57WoYyFRDP4iHXe8Lb l4KAgzwDy4SHg3WsmuOcIBLrnENPbMXYPNg1cGNMaK2iUt/ZfJporWCUUZA2Q3O6SdsXojKT HxQkcxOqFMZo16shRnE/+aAf0rp68ASZHOPNXS3vw0HChz8IqEuV+Xr86P0bmug5gcfmeKiy zjYSG9yfDg6SNOAUBwESDYbI9aCt5gbXe9NK0p1VGLx+UHtIp6cR4aWR4FCR1kOOIBNZgkfR Q25dY8hJ9FaI7xvbXhfUVrQJGSzhLouaW2/NSfVWNydk0nkUOeeIEMXyMCmBozXGdirKqztb gc0EpUAZbRNuspjVVRW8jlCbBuDhkCDrAPOEneQw5EJIiRvK7Q1RJsDeWioK8Fl6yDnE1EzC KAtjdT8w1T77DQQPxRUDW1xbS3lszrgiCsWCwPc0G7n07HKAVCaWC8i8HWObULS1I3ItPbbt j59Cz4gMwKuPWh0L8rNw3ZSppLGbWh8ye/ImgsaeDtIiEjPvD0x5SlwF3FwiCCjQssDF4nrg F4EazzIo1uPuHQItnoEUclODep/SnaW+Wz9ptXHjGZnbkrrBffxwcqdWovfUVwLmrXtSEJjS IP6P+ai5IMv/AfmrkAUNCmVuZHN0cmVhbQ0KZW5kb2JqDQo4MSAwIG9iag0KPDwvU3VidHlw ZS9MaW5rL1JlY3RbIDEzOS41NSA3MTguNjQgNDE5LjUxIDczOS4xNF0gL0JTPDwvVyAwPj4v RiA0L0E8PC9UeXBlL0FjdGlvbi9TL1VSSS9VUkkoaHR0cHM6Ly9ib29rcy5nb29nbGUuY28u dWsvYm9va3M/aWQ9ZEh5czlPWE1GTUlDJnBnPVBBMTAyKSA+Pi9TdHJ1Y3RQYXJlbnQgMjY+ Pg0KZW5kb2JqDQo4MiAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDEzOS41NSA2NjYu MTUgNDIwLjYxIDY4Ni42NF0gL0JTPDwvVyAwPj4vRiA0L0E8PC9UeXBlL0FjdGlvbi9TL1VS SS9VUkkoaHR0cHM6Ly9ib29rcy5nb29nbGUuY28udWsvYm9va3M/aWQ9VjdlcUNBQUFRQkFK JnBnPVBBNDk5KSA+Pi9TdHJ1Y3RQYXJlbnQgMjc+Pg0KZW5kb2JqDQo4MyAwIG9iag0KPDwv U3VidHlwZS9MaW5rL1JlY3RbIDEzOS41NSA2MjUuMTUgNDA1LjA5IDY0NS42NV0gL0JTPDwv VyAwPj4vRiA0L0E8PC9UeXBlL0FjdGlvbi9TL1VSSS9VUkkoaHR0cHM6Ly93d3cubmV0c2Nv dXQuY29tL3doYXQtaXMtZGRvcy9hcHBsaWNhdGlvbi1sYXllci1hdHRhY2tzKSA+Pi9TdHJ1 Y3RQYXJlbnQgMjg+Pg0KZW5kb2JqDQo4NCAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3Rb IDEzOS41NSA1ODQuMTUgNDgzLjY3IDYwNC42NV0gL0JTPDwvVyAwPj4vRiA0L0E8PC9UeXBl L0FjdGlvbi9TL1VSSS9VUkkoaHR0cHM6Ly9wZGZzLnNlbWFudGljc2Nob2xhci5vcmcvZDZi Mi9hMzdhMzJhZjU4NzY4ZTc0NDBkMmZjNTJlNDhjYzQ4M2JhZWMucGRmKSA+Pi9TdHJ1Y3RQ YXJlbnQgMjk+Pg0KZW5kb2JqDQo4NSAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDEz OS41NSA1NTIuMTUgNTQwLjkgNTYzLjY1XSAvQlM8PC9XIDA+Pi9GIDQvQTw8L1R5cGUvQWN0 aW9uL1MvVVJJL1VSSShodHRwczovL3d3dy5zZWN1cmVkZ2VuZXR3b3Jrcy5jb20vYmxvZy9X QU4tT3B0aW1pemF0aW9uLVdoYXQtaXMtaXQtYW5kLXdoYXQtYXJlLXRoZS1iZW5lZml0cykg Pj4vU3RydWN0UGFyZW50IDMwPj4NCmVuZG9iag0KODYgMCBvYmoNCjw8L1N1YnR5cGUvTGlu ay9SZWN0WyA1NC40NSA1MzEuNjUgMTc1LjcxIDU1Mi4xNV0gL0JTPDwvVyAwPj4vRiA0L0E8 PC9UeXBlL0FjdGlvbi9TL1VSSS9VUkkoaHR0cHM6Ly93d3cuc2VjdXJlZGdlbmV0d29ya3Mu Y29tL2Jsb2cvV0FOLU9wdGltaXphdGlvbi1XaGF0LWlzLWl0LWFuZC13aGF0LWFyZS10aGUt YmVuZWZpdHMpID4+L1N0cnVjdFBhcmVudCAzMT4+DQplbmRvYmoNCjg3IDAgb2JqDQo8PC9T dWJ0eXBlL0xpbmsvUmVjdFsgMTM5LjU1IDQ3OS4xNiA0MzEuNzYgNDk5LjY1XSAvQlM8PC9X IDA+Pi9GIDQvQTw8L1R5cGUvQWN0aW9uL1MvVVJJL1VSSShodHRwczovL3d3dy5zY2llbmNl ZGlyZWN0LmNvbS9zY2llbmNlL2FydGljbGUvcGlpL1MxODc3MDUwOTE1MDA2OTVYKSA+Pi9T dHJ1Y3RQYXJlbnQgMzI+Pg0KZW5kb2JqDQo4OCAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1Jl Y3RbIDEzOS41NSA0MjQuMTYgNTQwLjkgNDM1LjY2XSAvQlM8PC9XIDA+Pi9GIDQvQTw8L1R5 cGUvQWN0aW9uL1MvVVJJL1VSSShodHRwczovL3d3dy5yZXNlYXJjaGdhdGUubmV0L3B1Ymxp Y2F0aW9uLzM3ODk5NTNfUGVyZm9ybWFuY2Vfb2ZfV2ViX3Byb3h5X2NhY2hpbmdfaW5faGV0 ZXJvZ2VuZW91c19iYW5kd2lkdGhfZW52aXJvbm1lbnRzKSA+Pi9TdHJ1Y3RQYXJlbnQgMzM+ Pg0KZW5kb2JqDQo4OSAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDU0LjQ1IDQwMy42 NiAyOTEuOCA0MjQuMTZdIC9CUzw8L1cgMD4+L0YgNC9BPDwvVHlwZS9BY3Rpb24vUy9VUkkv VVJJKGh0dHBzOi8vd3d3LnJlc2VhcmNoZ2F0ZS5uZXQvcHVibGljYXRpb24vMzc4OTk1M19Q ZXJmb3JtYW5jZV9vZl9XZWJfcHJveHlfY2FjaGluZ19pbl9oZXRlcm9nZW5lb3VzX2JhbmR3 aWR0aF9lbnZpcm9ubWVudHMpID4+L1N0cnVjdFBhcmVudCAzND4+DQplbmRvYmoNCjkwIDAg b2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsgMTM5LjU1IDM2Mi42NiAzNzUuMTEgMzgzLjE2 XSAvQlM8PC9XIDA+Pi9GIDQvQTw8L1R5cGUvQWN0aW9uL1MvVVJJL1VSSShodHRwczovL2Js b2cuY2xvdWRmbGFyZS5jb20vbW9uc3RlcnMtaW4tdGhlLW1pZGRsZWJveGVzLykgPj4vU3Ry dWN0UGFyZW50IDM1Pj4NCmVuZG9iag0KOTEgMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0 WyAxMzkuNTUgMzIxLjY2IDM3MS4yMyAzNDIuMTZdIC9CUzw8L1cgMD4+L0YgNC9BPDwvVHlw ZS9BY3Rpb24vUy9VUkkvVVJJKGh0dHBzOi8vamhhbGRlcm0uY29tL3B1Yi9wYXBlcnMvaW50 ZXJjZXB0aW9uLW5kc3MxNy5wZGYpID4+L1N0cnVjdFBhcmVudCAzNj4+DQplbmRvYmoNCjky IDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsgMTM5LjU1IDI4MC42NyAyNzQuNiAzMDEu MTddIC9CUzw8L1cgMD4+L0YgNC9BPDwvVHlwZS9BY3Rpb24vUy9VUkkvVVJJKGh0dHBzOi8v YXJ4aXYub3JnL2Ficy8xOTA0LjExMjc3KSA+Pi9TdHJ1Y3RQYXJlbnQgMzc+Pg0KZW5kb2Jq DQo5MyAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDEzOS41NSAyMjguMTcgMzkyLjI5 IDI0OC42N10gL0JTPDwvVyAwPj4vRiA0L0E8PC9UeXBlL0FjdGlvbi9TL1VSSS9VUkkoaHR0 cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtY2Ftd2luZ2V0LXRscy1ucy1p bXBhY3QvKSA+Pi9TdHJ1Y3RQYXJlbnQgMzg+Pg0KZW5kb2JqDQo5NCAwIG9iag0KPDwvU3Vi dHlwZS9MaW5rL1JlY3RbIDEzOS41NSAxNDMuNjcgMjY5LjAzIDE2NC4xN10gL0JTPDwvVyAw Pj4vRiA0L0E8PC9UeXBlL0FjdGlvbi9TL1VSSS9VUkkoaHR0cHM6Ly9lcHJpbnQuaWFjci5v cmcvMjAxOS8zNDcpID4+L1N0cnVjdFBhcmVudCAzOT4+DQplbmRvYmoNCjk1IDAgb2JqDQo8 PC9TdWJ0eXBlL0xpbmsvUmVjdFsgMTQyLjA1IDkxLjE3NyAzMjkuODYgMTExLjY4XSAvQlM8 PC9XIDA+Pi9GIDQvQTw8L1R5cGUvQWN0aW9uL1MvVVJJL1VSSShodHRwczovL3J1ZC5pcy9k bC9pZWVlLXNwLTIwMTgvNDM1MzAxYTMzOS5wZGYpID4+L1N0cnVjdFBhcmVudCA0MD4+DQpl bmRvYmoNCjk2IDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8 L0ZvbnQ8PC9GMSA3IDAgUi9GMiAxMCAwIFIvRjMgMTIgMCBSL0Y0IDE0IDAgUi9GMTEgNDYg MCBSL0YxMiA1MiAwIFIvRjE1IDEwMCAwIFI+Pi9FeHRHU3RhdGU8PC9HUzYgNiAwIFIvR1M5 IDkgMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L0Fu bm90c1sgOTggMCBSIDk5IDAgUl0gL01lZGlhQm94WyAwIDAgNTk1LjMyIDg0Mi4wNF0gL0Nv bnRlbnRzIDk3IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2 aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgNDE+Pg0KZW5kb2JqDQo5NyAwIG9iag0K PDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA1NTE5Pj4NCnN0cmVhbQ0KeJy9Xd1z27gR f89M/gdOnqRODBMAwY/0xh0nTq7pNG1aZ9qH3D3QEm1zTpZ8Ep07//fFLkCAEgFFPQG6udgS TfK3WAL7jeX55bprb+tZl/zww/ll19Wz+2aefD3/snr8+fzL82Nz/rm+a5d1166W59dPNx0c +mtTz5v1xUXy9upd8uvLFylJ4b+yLGiSJqIShLOkzBhJs2TdvHzx3z8ly5cv3n55+eL8A02q 5MvtyxdwZprQJKekkKcVVUXyMvnyIM/58TpP7jbytskdfqv0tx9fvvg6SaY/J1/+9vLFe3m3 f718kbz/9C459wzi7arrVg/+cXxYrbo/Og62Mw5WFkQUCS1JmeEwkHpN9Psv1x+36T4SjacF yakH7f9h0f/1nHmZE1HJZyXBs4QKRmiZ0BTotgQfep57OphLKyJyNx/P+CT5Aj+vEzo9E5N0 Wk04HhXwleHXXWYfQVImBCkyH0lnYaHKPVAUB/mfdFpOSApDJWxaTAQe/WkCn1P4zOBHGpIs wRgp2Uk4IJjwQiVyxXB5cPZ1khY/TYPCcsn40jfCnQWl0FjFSMF7tIpUuWspHHCWmyJz4X5G UDpiwx+G5CkjuXftOZkgcsDQUIKkwPcxEw44y/NY9IUHEoSSLjm/fqyXIOY+vft4laTnf6+X d8mkWZ79+Hb6x2Q9V1wcUlakcppK0kB9jSXwV1iCLZFSqZigjPr5KOnvwIdnXHrxk9BwNEMc D9yr8HBKCrjhpPBnk3tg6xr43NTws0s+Tc+yyQoOz+FHs2iX03xyB5/fJFdwTbNp7+D3Eo7J v8rz8c+JVBm3cJOVuWkC5103syd4hHik7Z5DD5OnFSmrk3GVU04qL9xryQQc9SVRDAiNzimh wod+fW/4v5nKp1nPfglOQF4QVvgIIOHhKlJ4uR2evQUjnPrg3k0zuWLySf0I81kavTD38Wlz tT6u0aL6tzwNDayr92YRfGpwed2b1bVYwce5vFvwBZFVJfGO4TVQgyR9lBbQ9VtJwD/eRJN0 IiWMjWiogAEF/CjhB5U0UPUBD+XqMBpnlfxWqQ94KDCdLM1JxX10Bp/NTIoq7oVzeRw7epjG 1cOsAoWxTw+zqHrYjR9tdrrh5kZ91bfwsQsOn6ek8KGP/YCj0TJpK/rg2qa7DY5YFISXpxtg mXqfZnIGNy/LEs38brEJDl6lhPLTjbXiJKt8cM1miUv1TRLc6mG0REHpBkZb8u9o7AVfrIxX hFEf8ntjic7W8PNZ6otHXLWNXMd5eNnBSobWppscsBAWbYMEdclf0VxeLFDhv3ptrAUkmhhF DPZCs5lZs3lRJ2iSd/irXqApOVTc8iveA/n+4XWiAha5UpnMKE+Cxmho6yIXoLwOk9UuHcbi 6jBQsSOy/vHPL8D994aH1NgUEYwfqjjkpOQABvE4DOq13oAsOLy+6z/9GwlEl7DrHmFOgRPx 5vx8Dhyru7rDJVbP4E+/oHe4VtNM/hkViTyOX/RULpVjCNdrq3c2pan+HlPDsjKDMPL3hhpc PEP4GqTkd3BjKF2eUsLE6YfM0wxi6Ptxo6vh3ik/+eipNHW+z/VeMZ9/f/FncRY/5zmh1WEy yY7BiIwCftEqI5lIUpKVCHn7J/cQRFQBn5cYZN7npPCYTooHP5aT4oG7Iia0cNU2D2DqKGHc JRjIW5oIXmIMBdLHpv4mxXp9B5xS18SwF7OClMJH/T+XyjardESkSeAnEgmxxUwroeS6QV3z ZCwjCB/iuCulT24NF4YmKJ1qpaTCMlM6PAdv3axMRLIJrn0yEArUN/Z2Vi8W4WM+0koW3tkS XO5l8szKh3a9Ug8t352FYB0jz62VvlLh41ybAxhYwyfUzqKtKOmesnEi5HOtSFBrCYN7ORpA SLorsI12O662RfDlwyg4PR5Sw9stDO0lD9x/p9lg6Iu58WOuGrkOH2008xk+PuCCXmKENLye TwUYWB5CexcruJIXJPVyZzCp5ejVrAaJM4jy3vWeKXKt+axEGWZOuuQSjuGR2T0wrf2GDLTe Ik4zXBj2IUjPUBrSLEpMNMtzFCXu4Ro387wACuFrHj6AnQG0hwLrCCtaAoMLaSJRz/AhZawy xiw8Lq3Aa/QMOngoWkgJk3vhDvBS87hWnshd2YuRH2+DHW/Cu/FYr+Gh5AAOFVH9+C269rrv IDy0jNJCh7Q1MG9m3XcrWpTLDhLM8ta56PtLH42Sv/0+T8o4PIGoXC4OfFaGgQJLW7JUmjLf dWqquNNdumd/MCMUojRD+nalo2QkTyFRsUvUuCzsKCipbXLmwzpOl4+wKOXS/XVDSWNGzuBW Oepdu5LflpvXyeYZNO/DDXxfbLRzNZ+K0KRBBINXHtoQ9eZm3XxrwXXrWrRGl1NI8welImMp ESLww/hV30auNylOJYLUO1mZyVVHSZaZVfcv/xwPkfaEWraREsRpLgrpzAiHqk9hYoK252Rc IHYsdlGS0gceYOKP8NTc98BdNbc4p5b4s59fR0+uMRHSY0yrAwftnAqRsgd6JghKKB3R9QEd Wuv4DYMWqP2eegcWv5n6m2aTrMCLtFEK9AxUBMJercIQmwYKrbpkbix9VTal/Ckw91VW6TVe OCThdlpqb2OBhP7W4pl3xu8GZ1bfyDi0NXpo1jdX1V4Yjm+BSFXdBXKwT7DZS9EZUX7fM9w0 uOnF4QLhexyHTJMQORQJ7ZsnPIUa2V3CLh8fF9JZa2c1PPUONQk6gMtkXuNTwwiDslZjVIdR zknlIQ/LXVGaJRFwQZj52BIlkBMLjjIHnnzqKfPhfZXrAlcPPtiuPj4G4aShTMFR89AAMw7i mRz/tX3uG+KpSxNIGMqMBZL53CjB1i9sKYBulATLJ98aI7VwYMvgQ2JVDpXSJ3uMrMJKAg/e p2sY72flWYaG5tLbTgsftNYCOmakYqIzjFAfF1h0UiKtMCkHPJQET5pwISWDd+CHSPIQCbE9 kpymkBcbSfLj+O6Ay7ky99x4T3PQGx1MvgCawYVf5qRKvfjhRbQWmW64oSSqbzDquZCj1xHk UcC9jFDGI63hVBxE30yZxCuTVjOGEIhJa9vV4YkscsIqH5Foz7VzVUYMtlhzA1IfiPrdmn4r I/5RsqMhGT5CnnFc5W5Cv9lSkfZW1YooB3or7oRfsT4ESqybQZEJWsTh65gYB1fXQ/MNFmYb LvbzITQNAsI/PhqkQ6AfrXUrrG3ebaaZ25RfmRzEveV8rBUOxeb5OFbwvckpXaOnPsG2tYcE auWvP/856RTt4ZcUJbzwUR1hBXOoFvTAuURfhLKgyjvegXSA2i42rO2KsHUlAyHh4wU6u3bW WsHQwkTvhQBao70vbKe8STbr29h9FuNbRFjDzLsO7HqFmY7ruBkpFIcyUebf0qxknVANngUC h7E82XLoZUZZwCam0RTYkWMqH2of950SHOE3ZQionPMQdYiJGqLgyW+iQj42HxdtXT6huXiv YlPtppnHqGRNCfcREAGNk4ydDo4VpDgdmopZnAxOrzQ3nBLzs6ZPEhqLFkVvvUlQWTfNtoS6 sxtjlDSyZtyiuYMr2q59UPtIm/AlTqDKcnogB53rNFLKWi/TLD8gWBksY+iBGybI36jaEnxA XntMftbeQoVRpOEDH3oMveLFWry9+lWeeZ5Y0f3NRru9007aIaGFutq+f6qHwmDLpRdu6E4O FPty2xootzifa05rTn7Das3wcXb0gU7FJV7lEAXzwG2bSk+mvBPSG+2s1RZQ8mjrVtWkhrmH boQKtW956AMD92F7Y7v0RKtINreWB9LcPUUwvJcHbjgVmO7q4PVDlbzeD3uINA5RHiMNNh/7 aUboyKT9IU35+wsuf7Hy4ozJ31lxcSbg97s0FYX8xy7O4O9C4GnppfyYy99c/k8Hf5anZmWa 0quLswzO4/p2cBuqjvXnwPd8ANWf28MNr9eweJk8VMDnD/JfdoEfc/iTosAgZnoAH9Q/oFSU ClHk9m56EACIxFTqeyrU7frbwKWiJ/4tosIlYkDbO7xxpm8Mo4KzUqFowpFfqj8jTy/Oqh/w XluDx0vfGRw1BKBTWLrY7q3Uqc7RA2dyPRQ9XEmk2CVseyj9XeAUcQkoF+rBXZzR1EG0njuX b+WfUs3P/ilp2gFMc2jrEbyzzxrmg7B3689IFUlwgw9mUoQO/+vFkWK5lFNYqFLTxvpiVi7f bTmrVlvpqrIGClLmw5AdiN2mnvJRr5Dj8gzu/FgJySTPyA6RRyFK0/xeHC8ZWAij6mEsEFje yl/lZC11FKU63TZT9sLlEjN1KtGOag703XEZdxeV4DBUpY/M8PkIKioi4sA5t6SDI+tBU1N2 M1OmLBZLOqIzaI6UAzcJD/2mtugGtycFg8i/h2BL1qfrz+FDlhUpipM9Gajc9I/0sU8A2d0+ 7aLBoW9UJRz8UsebTYS8Rg7JUg9xbXi4EprdeOA6KRxSa9p+XqPM6HkSnJZSQJ+fU00DXhZ7 ho5bIH4FnYJuQYuxar3rLdJOkyzj0MTCQ9Bx5rRLHmaZIN7xH6K+QhQo71FfOQZfPOqrQ5f+ dxWtDs2ZKsUCYScFUNSUcVXWdGT40wmdyzngHXwEvIowP7MjKGEVcT0dHoZcTwenYq6nw1NB 1yh4fqPGjWZTxutxumm0exb6kNUdtB3RneOUhMV44IPNEdpoym/3GO+dTaW9em/MEVeUUWwF GU2O0REFfLTZam9k56dJf9lPU5ss2x+3HMetgep5cI1R5gdPbmdflBA7OfZIcLkY0nGk5srW qtbGx1vXkvPyGVSxqpFoKnBlummKJ+hOhqcE3cngtKA7GZ4WdDHw/ILOjYZSY9iTRnVNGgq4 yoRBE1NNU282061ABQoNs0l3u8RfV/ePyzOTp2k2qEVQwmsBAZPnnYjH8K5GMkn3TcWz19sk R7DnM55ChxQPE+2eWiXY1UB01gbIfTSMW7QzVbcSnkaRYjXCYdPKKUJDbBTaI0Jh79L3RSgq UMzKN+bYQ4zkPCNZ7iMqVkb5ZHBqzQ/QSJrnBUKqT4hrLZzBAsQFZutIcCuO9R6VxzhrXI1E godxOFSbfXcUvXi6wyigbkNx7OY+Z5oyIxk98Bk6F1iI7Vd7FliaOpI2kw8qyHycvHGhFoKI 1At7XJsNJ57a8+fB600vqAlcHl3O4zaDCgi6uuHjmQkx8Pwiw43WL7FNp6XyQ4yS8jwSd51w OeB44H5rpa0RGhGKBb0MjtD4M4d2Yx64Wpl5i0Y+0aT7bWU2PA0rJ5vfUTObSmmHA3vfd6Lq qwL6vQcDVbKME9jiFUWT7ET85FL4C+rlZ3i4Evb4euBms2k5adAGP9j3Dx/jlQKDesVx+Erh gpE8d8NBIJMWqj/irD5ur50nNiHK0420rIh3pt1o1yK480D9mCcKAQm+h4ZDzKu425YhtedI jv+I7WHQ7tCR/HnwHd2VVFaZl4JYzsrJ4NDy8KA5POo9dZCuzbpb0QtboivcFbq6gVhwGcJZ CerqMJ46Z3fcrZxMVK7c2UfYnt0su1b1NmjWEWon5IKX0tVDQDS7Ogqef3a70bC8t17gZq5m 0JpC22dmY077KxxVDjgUs/Tb0yFWNrduuXxMbdM77YPdbapznj4FmoDqcJWGqU2gbmXjbl3S Lg1Q1z7gLWJYVaw48Fk4V0XcdrmMlzA399eJh58ysKcm94GrxzNTk0ZX3ySqS76uMwuuDqTo 8lET4Y0bbM/g9WuD0Mq1YdfGBFnVvsdBR9968XrQiWG8961e9v05l30I25rQgwC3yssNHJp+ qa2VHgpezJKCu+HhwiELI8R2jT3qgpbYzNGnLjrFzLMInQUr1QvAQ0G0/iUevIHRMTdJ4whE FCX0pvEQcWSszVkQim+uPB2Ty4wUPrjaLE+v1oPFulb9okxDFp1lWjQzzN+LUUFi0mKnl+1F jXcynvVTn5IYiILBI282XW3SX4sWLrP5/G49zewNwjfK5kpEHPSInCIiyB4Cr4ig8K7NXcLw XQY8U43hPh7ZFcfVKCTHjRVO7Bgx6bzCGicP3k3f8DD89pHKh7r9tojwiTNd1eUZcSxf1AOn Or3ttLnve7UWfe44NEmSBVVxCPfb4G4kSzOoLz4V91laQH2xB243Ia+25GE4WSflfzEVAapB wq1N0oMQnyV9Xb6jZCq0RUU5uBqeoQwafQ1e6LpI0PGJ0bwEKp24l7OqUKsljXkpkHk1qglt FKqI+8H6jo9mCThqLRZ1v2Wvb2nSW7/zOKtEL9wSYlfjCLZ3IyeGZPKJ493aR89lDg3MPAQd oi8jtV/WvibNBfR23edrJqZpd6xuBR4iYnUrOBkcVpR50OyLTVqT67KfhqHElanjeQxOYVmQ lPpINE1R264Z7qgZFmE8HZ9nc+YR2R66wr9Lg2M7ESecfX/AKvgLwFiG6eeTDTPLobORBw69 iUE/l/Bv0s1LeL/QYavPKQrj7peAd6+Pq4AhuLBsu9YWjKn6pfAhaZ1vcZMRTVM60VS5pXo5 1fNOfkOHb23B9p0N3w4jwMHXqLJBT8MdxpUJ6kSDEtCZmQnLPly+Y00Eb6WiZIWTovDvcE+x UuVE3OZpCe8yOgjNJRh43DJ8Cq9aGsdDP00zHSRqsSD4aVGrfuG2h3SEvBUtCfeSFE1KuOFU OGzR4JzXq8DGx+d9QxRTgzyMiOnzKu35WO9tbgTL2rhsdiu7vb2VOPotetaMd7ZY1H0qjZJT YsuxUV6nx6Da4EknOlpdm4S5qeG+HHwvXJTYa5Zn+AJHN+ehgfW3DUFJPFsNG0lbjo82RKty +WixarCufXFUFS3R6QwVP43QTwCC9MJHR4RxQ1Sq8OF9NW0yt7JmtjoA3t8QmiR4hyPzsiBC P3C16d2DZ99FkNseFLfJg/EldAEfdt/f3sH/F/gRvrW1PDP3PrFDNE3c3QoVVJuNwwSgaWDt lJP5orlBlv4ePv3LQN44KYgd3aVS/0sB4hl9NIHlwYOF+2HQ6JgP4ozm0IPyB9pvakGvt/cr tJCEaR5sqQ/Wsw527BjTAf+YvMIIZDs3a2Kr19src92wNxa8yHEnR1XbFi/VdnP8vlyz7unv 2plqm6HegKDeoWR14DYtoApvzPCPm3rODjfSqKHe2f/n8HiMQqMA91xPA71zY8/EKymhYw/4 uHS+G66CPYZuuPahXdT9uyQWz2hKvGrMTN9tYq3Kc179HL7wBMISGfVQqTQlttJrsb0O7icO 3j9FGtXcQ8FOu/MHUxO16GAFQSPNZNtuRQNSUrtR+53tsgdj9dmkZqFgZNCbyULsRNS3iw5f by/o+77pOcbpZvXChgztDb9pmXSm32b01NeohK6lpRm8XNjNx/DVw/DOZt/kNna9S6n/D3Eq 9/ENCmVuZHN0cmVhbQ0KZW5kb2JqDQo5OCAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3Rb IDEzOS41NSA2OTguMTQgMzM4LjQyIDcxOC42NF0gL0JTPDwvVyAwPj4vRiA0L0E8PC9UeXBl L0FjdGlvbi9TL1VSSS9VUkkoaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJh ZnQtaWV0Zi10bHMtZXNuaS8pID4+L1N0cnVjdFBhcmVudCA0Mj4+DQplbmRvYmoNCjk5IDAg b2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsgMTM5LjU1IDY0NS42NSAyODQuODYgNjY2LjE1 XSAvQlM8PC9XIDA+Pi9GIDQvQTw8L1R5cGUvQWN0aW9uL1MvVVJJL1VSSShodHRwczovL2Vw cmludC5pYWNyLm9yZy8yMDIwLzcyNi5wZGYpID4+L1N0cnVjdFBhcmVudCA0Mz4+DQplbmRv YmoNCjEwMCAwIG9iag0KPDwvVHlwZS9Gb250L1N1YnR5cGUvVHlwZTAvQmFzZUZvbnQvVGlt ZXNOZXdSb21hblBTLUl0YWxpY01UL0VuY29kaW5nL0lkZW50aXR5LUgvRGVzY2VuZGFudEZv bnRzIDEwMSAwIFIvVG9Vbmljb2RlIDU0MjIgMCBSPj4NCmVuZG9iag0KMTAxIDAgb2JqDQpb IDEwMiAwIFJdIA0KZW5kb2JqDQoxMDIgMCBvYmoNCjw8L0Jhc2VGb250L1RpbWVzTmV3Um9t YW5QUy1JdGFsaWNNVC9TdWJ0eXBlL0NJREZvbnRUeXBlMi9UeXBlL0ZvbnQvQ0lEVG9HSURN YXAvSWRlbnRpdHkvRFcgMTAwMC9DSURTeXN0ZW1JbmZvIDEwMyAwIFIvRm9udERlc2NyaXB0 b3IgMTA0IDAgUi9XIDU0MjQgMCBSPj4NCmVuZG9iag0KMTAzIDAgb2JqDQo8PC9PcmRlcmlu ZyhJZGVudGl0eSkgL1JlZ2lzdHJ5KEFkb2JlKSAvU3VwcGxlbWVudCAwPj4NCmVuZG9iag0K MTA0IDAgb2JqDQo8PC9UeXBlL0ZvbnREZXNjcmlwdG9yL0ZvbnROYW1lL1RpbWVzTmV3Um9t YW5QUy1JdGFsaWNNVC9GbGFncyAzMi9JdGFsaWNBbmdsZSAtMTYuNC9Bc2NlbnQgODkxL0Rl c2NlbnQgLTIxNi9DYXBIZWlnaHQgNjk0L0F2Z1dpZHRoIDQwMi9NYXhXaWR0aCAxODMxL0Zv bnRXZWlnaHQgNDAwL1hIZWlnaHQgMjUwL0xlYWRpbmcgNDIvU3RlbVYgNDAvRm9udEJCb3hb IC00OTggLTIxNiAxMzMzIDY5NF0gL0ZvbnRGaWxlMiA1NDIzIDAgUj4+DQplbmRvYmoNCjEw NSAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250PDwv RjEgNyAwIFIvRjIgMTAgMCBSL0YzIDEyIDAgUi9GMTIgNTIgMCBSL0YxMSA0NiAwIFIvRjE2 IDEwNyAwIFI+Pi9FeHRHU3RhdGU8PC9HUzYgNiAwIFIvR1M5IDkgMCBSPj4vUHJvY1NldFsv UERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNTk1LjMy IDg0Mi4wNF0gL0NvbnRlbnRzIDEwNiAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNw YXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDQ0Pj4NCmVuZG9i ag0KMTA2IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDU0OTM+Pg0Kc3Ry ZWFtDQp4nMU9a3PcNpLfXeX/wPKXm9myKIJvOntblThOdq/WsS/S7V6Vkw/UiJJYnldmKMv6 94fuBgGQBCaTDDDnD/K8yG40+v0AL7/dde1dveiCv/718tuuqxcPzW3w6fJ6s/318vp521x+ rO/bdd21m/Xl1eNNBx/9valvm93f/hZ89/3b4LeXL6Iwgn9lWbAgCrIqC5M4KNM4jNJg17x8 8e+/BOuXL767fvni8gcWVMH13csX8MsoYEHOwoL/rKiqMC+D6xX/zY9XeXC/57cN7vFdJd79 +PLFp1kw/zW4/q+XL97xu/33yxfBu/dvg0vLIr7bdN1mZV/HD5tN92fXEY/WEZdFmBUBK8My xWUg9gLpd9dX/xjifSK0JCrCnFmg/RES/aF9Tso8zCq+Vxx4GrAsDlkZsAjwVggf+zszO8hL qzDLzXS8SGbBNfy9Ctj8IptF82qW4KcZvI3x7ZjYJ6CUZllYpDaULtyCKg+AYrjIf0XzchZG sNQwnhezDD/9ZQavI3gdw5/IJVpZHIdlfBYKZHFmBRVwiUn4h4tPs6j4Ze4UbMIJX9pWOBIo ghZXcVgkPbQqrHKTKBzxKzNG8sLDhGDxhAx/GmQSxWFulT0jEbIcYAhQWRgB3adEOOJXlm0R Fx6JEGq64PJqW69Bzb1/+4/vg+jyn/X6Ppg164sfv5v/OV2fEBV1zBhHLeJ8CuZrqoG7h/lF OmsC+LvcwN97kNd2US/xs243v4hn9Xp+Ucz282S2hW8383y2A9ntgi18UcNdcr7Min/Fv79D QYcLF5t5OlvBjfDPI3y7FgC4Aoer8C3cGi8Q8O44BLxLuwhOMkcGgiR5GhaZjSA3gE7TPTUA vcF1O8cgjaIwYzYM1gKDDcBGMn+GT5A8HKF0dgtvxUYAKecsoYs654gWUVjmNkT37sHxnbFB ew3rJx5Bnq27AGiDdGh2xHYlUWTHXyC/EVs5xrIXqCwK43iCZo1ig7yruH2BvA5vcloCbmvz 21yIRItc366l/OGPAHu8DNfSzFmkPqdlL1BE7vDi5pZkEMQHP18gC8OPlXShhGtEbHQhv5Oy C1LH//tl1t8BsVwABg8SvXofINmbGn6FTKn26GkHN267RnxU0Q+aZdMhWgajeCrzVBFYUcu2 mDzNkf5lDvQvi6eIgQzF3DbEFfgLY8Q+ceq+AxohfVrYoYSzRzL7j33wE77pmjdy12r40XLP +WYj94H0RSM3YbzTqzljdOHnRinmJWxbiZDUrt3hVbueXWDnicceSaw4Z3TPChGETCg971ud 0Z44hg8kmQ1+8Gp10n6b6JpwbzepbHRtb2EpSJBlcwOigRT7+kou9j+DV7C091fw96P8eNXi RZYrNQ6XSyTr1+yCJ6DXafrGtNBe4fAYKvk9xnYBjjNsYoG2Iq5ZKyUgX225bqt7NunaRbtF LY12CTRbomm2IY2BP2/mPZl/dc8o3FuM2XH0MymG2I9jJvRCzp3Nopzg9dOHa6DfO8lvCVDn jXtrBv6tDQn30GIOxwbt3xOJkgzDGcg1JkUcprkNlWmkeDI4jBYt4NDprKVvh0uWnox69+jF yYtjFqbZ2SgRxynEbkZwEC5StLi5cw43ScLIAtfHMpM8TKyCRRsO/tRaKkJlWsiHRK8PnXuD QcpnX5VwgD+Ar0YR3PJZuoRcgAqr4zeO7pDxMLwDDPFDGeIhL+ZaiKffDz1E4bIWR4V8fvRL mYfxNAw3uLmh++AgDbPShsERxiZx4YWyKWKUoMjzzBRbvecMBCa5nN1yDtsAmb4OTfwC3cBm 7zzmYwkD+2PCK7iAe5dliRrBg+njIlrYSOIrbLSA06XIGr7dS8kkke20mE9z+Ln6EMI3cILJ zeoFXO3vIJwWusR1yiWOIN9pWftjrw7GAfD7q4/fBE8PlGJyjlNZhen5tj+pWFhZSXALznMH ep+LGsbTysWmjBRyBmjem55a5B59wW9vKU+F0jowKpciohNuBP0QjYpgHmF1PDE714amHAly r3J1nh5klEXGSma0NHOIqcS1tCYUl6JBSVReZUy7+z5TKQQmIDPWOldjCXej48y24CP0fuop +yD0Pnd+DEHye1AQsSHWDWTsphQ/jz6k0a+JwfI+a9FuZCZCuRuWbNMCE5uwZaaN7O+gck+N yFpUBJWc4AcShz4rAQyDv711Hz2KnTVT8MQ8lhlgEuaJDaD7eD9hecisCzyCdTO/LgsnxzRs P+ixbJsdN3/c3KE1Q8uCrMi5q8K3ipE/waunhxq94SF7A8et4Ir29pbfhsCkGhhQNpyRg1vF 508t3uQhuFV3xJv9Svf2YFfBhhlJNCjtoPUnW7FEQ68XakTZxmRZ6hs0GEu+LpbPnpVOHqlw zE4PU5jgTUAVyXmRIAvT2LLmrfSQUCXgEtplcy9MqCcrFzFTjEcajHyaxfIRlCsRSHg5fbJe UTjVCDxI4Ba0QXQ5pvuf57kWMCqDqbavC5QtHLgCYssn+fiLqZcpfQmTp1kJJugLU2Bf2+5Z JZOJzfIe5LSigay57TN/O5NBH9UTO1jog9fdzCqu76ecdUtRMLlosA6KJqn4gctxHkvGURqm zIbQEYo595q4zPIq5DeYdL4AWf732/eYVf/nO6DMG+iCyeS+oT76ghm+5T4Y7bAIfoDzyOkQ yeWLvspHgc1EsWs62eI8ryn26d0O/IxkFKFpzLyWURJlQKzakW6iO+9jvcjx0dPl657Zu0AV bNouQOni9wAxzGffyMJaOU4I4q2WIAVCVXgSgqwMWWVRaWMamxHrv9Dplg/JRhI1XLNzIcrj sMxsC6ql2VL6TItL+iKm5pH2i88tS5SsIcu1A80xSvKOSSniM2A7NiKQc/WS5hEYUgtljlAv hVe/L0uKsJjiddDxI3sPuqG9acFnA3vkWkJSBj0RRvS8Z6zSAtKKFtJ4UwZmcNK/dF4qicCd skAl7+lOurCy16OWPRbGxNZIEfd2QYg78gwFpl+UqRmnVVT27FEYB9f+fJKHFbMtfZrSu5nL bJ5rTIoKmqQsmDT7AJMFz70a1GONRmjRXO9Rwl3rZKFioGlF+CHusfNq1+I8jAtz2FCT2ywr 11i1zvSqtaB/Ya7FNM6TSjHX0DGzIe2cRmAqi8QG7lCW1jn3RXlYVjZMvnEPrgrz7Gx0TlgM FtcCzliTI94kyVo4N2lJnoSpdeM9NGBmYWkFN474HobNb/jqq9TZHdAkF8USPWJ07SwlFTpL ZyJRyp2MKv3D6irvxdKT9mTYOXuMXZKK0TUmVYmawYQJdA+wgnwvD8o4KkJW2GjgXhmDTrIs dFRBcd6gkaMZMEMW8tju5h4ao2Pu36b2RXcdpfZuZGMB5oM87HWZwoiUlcsS5LHX7tdfVjAs ZYY7iC26jXPYVYHZpnPxd8U/+j0uo3rRshXZxddB39StB9r48jX3It0bqoKFSfb/IYNJWYLi t0DeSNZ/UBQYuKgHq/7NPnRvsPIiTMojuceUTCi9JhPSKjXlUN/3jdS37V27wNZWLNmIrOIb 982WaViVNmx8mW0LuPoRhUqvpPYNIH3g69ymRdATZ8FHFiQ49UUYryocC+oCkQUJqui8ljUS LDhrxY++jOA8UuCuKztyA01sXvll8yIxpeS9MZYZnN66/IaqUCqJL9zWZ1UyfeidRWNGVCtT lVN+QBV8P8y3jrO45uLYQnWF0FXL/UbencZzZOp/J1P1/GrXipNVYGOO2znj2IqLucEDLJUl YTJFDDTn1Ue0xz8gxbAWjuXyBibXytnuM5bg35xe+DYhR717FuS8jWBY4N3t5qJbZoWLpwGe z+MmGtmuMigDX0wLvnK0pF2orls1cSOyLtrYStUXvvu6frtsgnZPZaXmrnXfM5JXkDGw0GM9 Sp6i//EsBbRdqcTgKKHkoBvNhG6aRiGz8nLtAV4Gs2gWeKe1MprhFZAuOJs4pBk35AfoKd1R SqG2KwzWVq+lKZDjPtz9GPel+5LdlBmT6rXsSKd6G2Il5+Ceg/5V8xvwcz+uyTFdNdJSqcR2 39zWO+i1EnVNIOiDUUeDauO/leKxQB9tBfFPKYrRSg+ouqWqJ8oRTSldjbJxcpJTFSw7rRlI NEdiVQQ/2Q5cKTHedWJHz6EdSiJTtuso4mu9MIq2anL1QSvkyOpur7Rpj5ETafeDWm7ic9B/ upV/lhAqiEbcZYMEHHBRbmYiNRyhdm/QOSn7vFWra4dtZFP+GTbIkug4aN0+tDmshKyQ0Wk3 sWpN0+uJCOJXjXutF8cFpMgsmB3jOjkZ+bW6TklVQvnmgOu0de4XlRkeUmQBvUPtRLMvy8ZD eIulcQtwD6OLKeQczgYOZ4vOBi09Ly1Jyi3g3E/9ZNWB1WkO4dJ5QxAr+Efno2sZQ93IAk61 q26UxVB2wn3zbAwz0Mlhug/Kbs4T/BGUb85F/ThNIKdtU8SghZ3X0DNoN7PKUZ+AaH0ULUqo Yh9HW6M5dDHofsAcFmiubebQuSWE40CsUK/RicQMxXZZkyN+0TsrPze/cWeGS2G7w99Ae3PX j6O4t5pljvtmRtSDQ1dWUMi0wIPzSKbTOstlbZzSEYHD9/AacxHKD79+jZ7xt/D6LXroFX3x 41sO4rRTHuwjhsdR0cj9fidvk6wI4yliP3G/mEcOTzgXLVJmKk65/YJMuet5T5yvwTkTm2zd syL/ZVbacPXg42A5xAu4A6GMBd6nPjO3oSJZsJbzcF3QUpuJNsahJZzhbT+WVmhTaXoppU+D ic7BlbyQR5NUbnocxIDWY2goWJVZAxGxtns4ik0/gSUgX18F9b87Q3kBY0oJ0kFNrQgUODmc b4cQjJSHLK5bag6cw3Q2eDwUY9EZ4VVVGJ+Tnowl6NqeDR7FX2cDJwKws8ETyskMTx2jcay2 sSoQea6AcxsMzm+cHUkyow12MgVtt8Ex4jdG7APouhuYNSJL+0WS+aZdwixBRxN3fpoBjEh5 HyTg3lKc2wjiLbtgBqe7m8PKEFaHbmhgTCWqjXOqYMXyiWfaDzuKMzWhGUa4WsNzNQ1Hw8x7 T0xUr/qf1tLuH+zHF6n5R46UpWmaupnaEOUxHDrPVBQfnslhnTbKxQzp0ttMJIykG1KsY8oE 6tgic5e8h2xGzGzYHaNv/I6ux1UyDcWhfzDj14Bgf3h0Hvbm/JPSAvrk0qMBXpGESWqFd9qx WkZ4OSa4raR1cnyYJbPObIB9LLQsw9TGQ1z0qE3mtOMuLMcBchpaoHqoGOB57RZwHioG6LKe DRx6rGeDRg7r2cCRabCA26i2l0eZ5N6JAxGK0SHHzRabuXZkyBs4tk44sXCks8qPrwxVc6xW Hzoy23SiuHCAJyP8ygBrg9pYP8dof3gkF+HbArbJpPRMHWR452XQtSsv2fS0KKHN5LgdN9o/ vycExEVsSsZNjjbFp2H4OtrUgoQ33XIucKRbzNCugaqjphL1Sve3VZ/HqCdLDL2PprFE44GH iZPKuhgPR3NiG7IF3ORoTg+j9zE88cO64GME1+/sPeBnOL7yo0xa7jpkrkW7JT+ku/womx3p OwcJanPfZ4ZWx4yghz5TYVR9wDtgVM3gjHN/4mA7SlD3DdCpjDLpCR3KhvbNH9+4z2DFRYFi bEZ+WlymcHGUpsr0NDedsIUugmj1d97IWuA4lwVnD4fWcxrFVniHJnf6JrVezKgbUNUAZOWA jjZoBseUvLrv27FU+yCc6TQ44nXq4rzylfSHPgDDMZjiSP6tXNQfPkteMdArH+dS5LkN9WOU tpMZp9xK09j45IuP5I6OxB9J9zNkjKmzsoXDeaDYnVOtm7PC6cVuc1q9gKynBVkfafUozPyA O6C/zeDGo/36KSZ9CHLiCZb2Y8TORYI4ymGw0wLud1qQp6eKezhSI6ps2L2/AqXroSsIusCs W4DeOske9RfXnehDUfKJ7tZO/VBMxI58+rqjrLXr3gpoKbJuqTibQs7mblVpWTyaiCJu/YRq 1ZOuuSjlUEW5XkXGuOaxLUI7fN/PM796zRCV4bQ0BkR4lK6OdH0S7b3Xif+EhVFmxE0/U6H2 ALjkt7cQhVhaS6Rg1wSVEsRUYOjlVFWRTzFjdYyd9zvkyUrM+owR+7nZUxvJTjsMhVwmJJ48 inbx2X0aNy7BNbJg5uHgfgZJai/gDpTmLfCgX+b6w/cf1HSTpummx7+SON9IF3fds/PTvK8m EucrlbQCna/NDz6ruWdqz1th7w81BXiYoBJP2rKsH4c89hst1ds/vMDDo5yqFM6qPm7nTbIZ +52WZXkBgmCQzS3N+cBJ0tRl4CE3wj0vZkPBQ2qEEp7ng4cZz/OBo8yPF3h2/8ACTs/8PI/y KKJLQM2siyE1Dx3mcQL9G+ciSRxjH5EFXK9knbskOQQINqBa5opUe9u1dX/iuYeoIUvOR+4y Ay/QAq5P3zn3tfgF1j0eZjLVEL21hdX5AUD4KIbjdsBobnw9VFSYGzoPFhELY0SN/4fIvdo3 NJGpP7VzReR60JyPvka02gd30sFQU8jkQNZS5QzPGeiahf5Ir1dvZFYOxwiUGzQ6brW5a7Uz Aty7CXHFIN4+QJ7R3omve6pWUDdMUtA+UZiWkQB79xfLLvsdnGFwIFsql4H4XzVLTnt8lg2d VRRgAYYGPIdJXB9FmBhyeCa8/Nnh8wATVtg5MEs+ORmAsk8GLsRp8bnWTeF+OI9FKDVmjDzM IsaQKLSAU76Nh+pvmlnB7mSPp5zJN6Vp3ftW3NSw4nzELzIoPVvAgbXFHo1TspLOk5B5mNn3 zY83mMJBxNZd+ThnqaG0Oq6tnJNKcDKZlUjHOCx+p+AgRDVkX6+aNbTfU6N9++X0ZikTBpwy 0KlqQcG9lawKbIKywPNnu3zAs5svMzQyUGP2H7X+Uf9eez8Xj4YRZzlrMyyjI1NIwG7lgdCQ OuPh11J/6tB4pF7zUF0THOYIWXUkwY3C5nfchcdz+TRJ9j9r9OYfuwcahGj3zW2weKBw4B73 7c3pVQYzgyZwXocZLU/8aQY2PT3QQxmUwZCpGT49sEI+e6ZPCU8fsIYvG/UYLp3Tm6/YmAqF +0W7b+eJdjJmP4/hfMg6g3jYvCj13DBRrml2WtgoRm5IuctHsrl3EliYsXOxGGSjIxs55COu nJt4ePJddq41piwDD8gMTTjpilXbLlDPcl3KZ5eDF+3h+UUFBIZH0cGofT0/tzIL2TRn9C9K /vcP8Tu5R9JAl5JbpdQG35OaNQNb7GQnKJplctLVM3mx7i8Ouhw8rb7GJ79poa6H+IdB5dmM 9+CZEx6yrHlmAQzjDvQAvH5837nKYgyfGGoE71xEYTKvtEEziej/ASWU77wNCmVuZHN0cmVh bQ0KZW5kb2JqDQoxMDcgMCBvYmoNCjw8L1R5cGUvRm9udC9TdWJ0eXBlL1RydWVUeXBlL05h bWUvRjE2L0Jhc2VGb250L1RpbWVzTmV3Um9tYW5QUy1Cb2xkSXRhbGljTVQvRW5jb2Rpbmcv V2luQW5zaUVuY29kaW5nL0ZvbnREZXNjcmlwdG9yIDEwOCAwIFIvRmlyc3RDaGFyIDMyL0xh c3RDaGFyIDExNy9XaWR0aHMgNTQzMiAwIFI+Pg0KZW5kb2JqDQoxMDggMCBvYmoNCjw8L1R5 cGUvRm9udERlc2NyaXB0b3IvRm9udE5hbWUvVGltZXNOZXdSb21hblBTLUJvbGRJdGFsaWNN VC9GbGFncyAzMi9JdGFsaWNBbmdsZSAtMTYuNC9Bc2NlbnQgODkxL0Rlc2NlbnQgLTIxNi9D YXBIZWlnaHQgNjc3L0F2Z1dpZHRoIDQxMi9NYXhXaWR0aCAxOTQ4L0ZvbnRXZWlnaHQgNzAw L1hIZWlnaHQgMjUwL0xlYWRpbmcgNDIvU3RlbVYgNDEvRm9udEJCb3hbIC01NDcgLTIxNiAx NDAxIDY3N10gPj4NCmVuZG9iag0KMTA5IDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIg MCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA3IDAgUi9GMiAxMCAwIFIvRjMgMTIgMCBSL0Y0 IDE0IDAgUi9GMTAgMzkgMCBSPj4vRXh0R1N0YXRlPDwvR1M2IDYgMCBSL0dTOSA5IDAgUj4+ L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsg MCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyAxMTAgMCBSL0dyb3VwPDwvVHlwZS9Hcm91 cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyA0 NT4+DQplbmRvYmoNCjExMCAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA0 OTE0Pj4NCnN0cmVhbQ0KeJzdXd9z2zYSfveM/we+nXQT0wQB8MdNpzNO3CS+adxc7Ukfmj5Q Mm2zlSVHou34/vrDLkiQkhYKGwN6uD6kkSJpgeWHxe63i8XxybKurotpHfzww/FJXRfT2/Iq +P34cnH/x/Hl8315/LG4qeZFXS3mxxcPkxreel8WV+Xyxx+D16dvgi+HB1EYwX9ZlrIgCmQu Qx4HmYjDSATL8vDgt38G88OD15eHB8dvWZAHl9eHB/DJKGBBwsJUfSzN8zDJgss79Zl3F0lw s1I/G9zgq7x59e7w4PdRMP4juPz34cFP6tf+c3gQ/PThTXBsmcTrRV0v7uzzeLtY1N87j3hj HnGWhjINWBZmAqeBo28G/dPlxdn6uF8ojUdpmDCLtL+jor/1nHmWhDJXz0oJFwGTcciygEUw 7m7AQz9Hw8F8NQ9lQuvxiI+CS/jzImDjIzmKxvmI47sSXsb4clPZLxiSkDJMhW1IR25FZTtE MZzkp2icjcIIphrG43Qk8d3PI/h7BH+P4Y/I5bBkHIdZvBcNyFhaRQVqxXD15vT3UZR+HjsV y5XiM9sMNxaUlhbncZjyVloe5gm1FAZ8ih6R+eJuRbBtqH+3SB7FYWJde6QSZAIyGlEyjEDv 20oY8CnLY2m+OHBAaOmC44v7Yg5m7sObs9MgOv65mN8Eo3J+9O71+PtsPddaJEYGu9c3DbAD abmC8lBxlBaYAy3AkrKogctQZgRIoyQWCFOuTNVLdELJTtXmZxP+0mdAyWOMh9wm7uIZDPLd ZDGD/6/cC09FmMQDJ0shIPa6DpRqsu0V+nYBW9ESN6jxUTyqb8dHYlQG8Oc96OlhnOh/xlcL rTo+KleB+nsyuu6+OWZ8dAv/3vs2frNclXP1K3VwNT5K9U9MH+CvdyhrzKLRHN6sX+EX+0O4 VhspfmE2w4E+VfjJG/gDpcJY9HNVe+vEDHG2Ggv9geIeJOFgZs/wk/9yvfK5EGHMbQoe8Ny5 n+eeRmqbFkGSqzWxbZHO8fGhNkvXGlG7mxRWyQM0IrzawiRJwe3YaQu392xHtpAU7s8WWsSd TCbL8hGWQwXLSsUU8L/F3L1VjJUbEecDp01hQfq0iomQofj/s4rFRJm/STtGeNDpqILAEb49 b0e7L/uYiDCVNlUPQEDi1z7GIsw3rRRYA+29y3eu9ZFxdK9JuR4cUybQI7WIw3hcYwvh8E6B 8igblUt4XyNGKsQ4HlMcsVDygSqgIJH6hYQynZKChPrhDFFx8sY5KtQiERbRHlFBizuZTrWJ Wo0bi/JGGZQGCwCYJbynTZB7bKj1ke9NEXEkgaaziPs8Aj18XIKBTUfT6h6s+6wkmI2XDkNk oZADZ02tiMzviojUF+JtnADXB+Bw7UDyMLFL9bYYLJPEh653yGrqzSayLA8jaRvENoP3UnHK SRfMJu7iHtc/WoHqGp5xNQ3gBXK72gYoF4Vpn2OpfchynI+ujA8CFqNCO6Hdmqp2vmbyLOTp QJRQayb3umZkHoUi3RoX6AW1eOF8C0lCYZfra9XsmGaJVrMGZ6JxL9AxXhjM4HtnypttELU0 /mlZI9wuSg0e/HRVPzuHkIxh0Q1TGcnaeSIvWwypqDGXWwM7PV2AVpwjSH0+zaxSvSHIMskK ghTtalQTQMaDRskV2GOEzqn2VqtiFhiHpIu9LkqEzSO8W02dsxyxzMNYDlQWiR0XlO8O7KiQ W/BdXuzpRw+xTZJYRHsEEC3utKgLA4aPywVApS6nuIEnPoIaAUzHvuYeR0mYMZu4PTquOYRy w2ZNrgJPtHe7CqQMc7adpnathzRRoaxVnDfk22anEI/7KPpjHUlVAR2lN1vnI1J2UCT7U0AW hXlmE6fh/8sEUP8nLPlH+JsP+MfK6coHzpqEf8v+Xy+P3v7qHv5ChHJzYJicFprq/unSvR+a hTKziPa4FGhx3VJo3MuOga0gSaQZ1Uv4lA5j0GCC53E/Tnquah1c6HDoofu+B380iYD8GKY6 Ek7CL5x4HOb5Lp/inS9mjBTtEU60uHfoOyyMae1C3br6b+meFFBfEGzg3Ek8eEqfsDwNc24b 2EDvgxxw4gfAsYjCRL5Ek345Zxmz7RAUVpbgHBfWmXNnPc2xrpOU7HFh0eL6xNIWDdA675i/ mkJqzBf3rEI6NlAjJEj80rBSjY+INc8Mq3Lp3PjKMLYL9oaRHfPcxoh7TzaCXLVlEHWwGIse y4CuA2Z4lbVLNSH6sjQ6BUwmwogNfAwkMP1ynSLPqPDvgyeTZRHnC4622VWYukc/YFZOjGPw 1X2sIyHU39uslQMfW8XtL7TiHGpdh82arKfzy82KLKFivg9noA+0Cs7hr1QBpQMWyd7gT4kD 1ySWukbiQ+He8VWBELNN1H0yLOHAXVgnanww9/NMGVQN7m2iKeznNnGX47ypVXIfx0RQ8L63 aeYCwmjbCl2z2+4ZoTjMrLKHmC2/aQGhIEAyQmY1OzdbDSFESvZotmhxHy6cB1IsYWGS2AR6 sFYSEt62+RXGS77SRVxIWSBj5Z6virIwTwc+WRLsftl/oQw7Ee57wIAycFDeaxHoDeN7FAfb lEWdVke4Zcgwjy862nQzK+c9sJcZ5PmHqYvEqd8ifSFjmv0xvOr5ifPYPmchZAFI2R4hS4s7 L+snxAJi5C+DnBPM9l/1yqZNTSJF2s+6Kmc/1PwwbZEQcnGqYQeERERxA+dvP/kydbRAb7ix zM+Cm7cPZhucmpK9fuH7p0rndR4ALcUMi038FTynScjSgSojweOJx2/BE+dUkH1+BsrxUaiW R1ah3gBkmaMFQNqmNEmevMc9mtMX+AU8rVH0EdZueLCb+U0WAhuWDlQjCSq/JysEy4C03NjU jtSPs1Rvah/dhxqaryZFe4QWLa7xbpArrtxHmizJoATCItwDdxDDcT6LOGvYkXmIOpi2poMe Mgl8v7k8EWFRyBYczk98bcW0QG9wt8xvP3CnhXuDOy1OH591X0SVpVDSvrc5NrQcLW7j4MME 9kMPfBkXUEA4DMLkYvabc+W5AIpj1y72i6cyWlK0v2VtEbefZW0R7mtZW8T9gpBHb67ZzAoP RQYp1AkPe7gk4P3mcrlCn9gMUtYB/6unM7GkaI+Ap8XtCfC0cG+Ap8X9CiWQf+rKRjhZ4Qnr g54rhXXuN4fLUwZlbJRWLnw4a3FilekN5PYpVtgBoly9zI1hEYVxbPdAy/4hil6zHz3API5t s724RZrwDqx7tXQ+XTjPrgKSPU4XTn/EzDZdTZrOyjvcwdyzWeqTSuowIJOr2m+KkycRVM1u geD03FP8ZRHobUlb5odeC25b9VOx7JqOnJbXCPw5LnfM1SBJtUl9OU+6RCHjA5VDwsRvcpCL nOIPLt77CtMtAr3BxDK//plaDZD3xaprAXIyuzHnhRrq8lYznc4jP23DBmmFxIffpBznKRWS Os/DNUfHLOK8ocM2O+okDGwj2qDoin7gtp3TeixP4EDt3vSQZ0CfW8Tt8QAlA/nDZk2uAr95 RR5LKk69bA++uD9DrDtpWuR6Ww47prmxHDDlg4fH4FWvqdY3OuUEH7FoHV80FQ9QSu6eYEgk 7ruDFEgiym+ykTNBEAy9M4mXP/s6k0iK9ggqWpzVxvaPG/6MRlcbWjC8y/ViGp9NMdQnOR+o KxI/fvOK0AR5K+5YK5b5dP7WlwtHyfYIIFocVbtA+/XOM28Z1ORbhvWN6ovEw7mYBLt3DXsq JFT9ZgLjnFGxz2/K7J+4D0YFHo6xyPQF0R1ThLLA9oT1Ce59ZdeQw3fwqcuwhymDRIantJJu PAq1G9n3uXsu2H8RQDPW7VEJQXXsFS96OFuykgS7u1mEvbgT7row3QbXIuvytsRyMLcSVTxr lQilsgIqJDhUyi6U9K/YzagtkFXbuXITF7XuB7uYQa3j5xfXK2+NUcRYxWgZ5AuDHEJatkOa Y/ULzqEW3SLsAh74stK8t2PBmYDejY5n+aX5GSnDWG132GIIJOWBMmz6g9f/xJ+02AvhIoNi b6YNtTjJZve9tWbaImQvVbStmTYp3F8zbYu4s3m9XFw96Bxa00jb/QjyBKK5YTMmceCJc9cw gBNXxMEA17u6cvegszwtTbsb9CmEchUUJupSHknatIWri1kAFE/TUO5OB+hNwTk24V4aTzYw rWS065JiddtfXVWx87SSspvKSSBn6yerpGyn8qNp9brvYMYTCDBpadfupeVwiJqWtmxret2T 3Mpw256hB5XKDNxdWpqG7lOg4I1tv99hb40O6brSC4mp5kqNI9PDE9iuV4B/XARPVa9luG4v 36wVx/PhcPI9tczHeakEz3K4ycMGSOBrVnXZdS6dG9WhPZC9EnJzzEArqtB9TPQXSqN297cQ aWOcqd1q+7KF+45H6vdhzZoadk10l2Z2+l1zD0Fxg48ZU+gNKKCZXAcKTWm6DzPh6ERmmxMM v1xVK7hJAew4b29BcE58xGir6FGYleXcZjFoWmSROn2GpzDps4POzQkWZVrkF3BH4QbiXQ8g S6BA1TKAzgy5NgRRCilJi1ht8DSn/2gu6+jagelBaU+j0GSu+QBk4k0WrVlrjgcvoihkVtB0 F5IUzquXhXJbI+vTcj9RlobSvjrMadJ7Ly0NhPJeuHVtOGc64ehYnOxPt+qTqdXqru//Gsxo gZ7HTcF4v0uzzoEV1+PmYpxq+soL8JvNT3fU2ML9wgz400fn1Gtzos0i2/lMlZ8Cnd4t4roO lwh/HeiAA+fpZCyLU2A8LKMJ3YvLQc6+dM14DEvAIu5kPm4yveVXk385CdpwAs4K0jdIdXdA wWoJrtqsMX0HlL4kqlxNdc5vMoYXQd27WOqxq9GoyvrZbEbrw7gzCWg6wHW9j+YZXPdq0d1D 6za4t82MQfMVi1zncQPse3FqEzdFH0BfD+ZjE7JLdr8r8Ayu/rWIoy530LUS68SMXONlnO8C 0IbdOkbn1khGSMgNewIkL+f12k8mGcVGv+yqc4qYU9+PreK6Y6FmzWun4Lk9Xr0ZGZv4eRtA cO1Md9Nn12OkLqdt/6q5+WdNZ9wo16Mzia0rkOvARUu9b0eii92mXXHkmrPT2HGwm7iigy50 vlq3uc0nl+OkT5P0ooauF3vv4r75WPR+CP9WdTHG0liSwNyH0b3sG5rQ/dpPOQKdfsLv8Tzk E0yyvT2uYQb8OHlA5m3T4JS1QRo46eFE73x47eEMHsFCO64E4dU8zMZtrcuGJ86b2p1qVXoo SsyB5rfMb7owzoEm68qvxsvegM6dAcisrtx3HpDQC8UySuf7a5zi5WgWcbPiGTkpvUAyUwjj 2peBi0ytg/hijFu5UvrmvRJAL8QIlxF6VvRotB8IyH0ww7hqDZFxRZ07e3LHkNAsbTbQh+VX 462jHY3Y68+Phk+Z4qxnvFtbuxZbdruKe3sTMbij0jKr/o1DeTcMfdLCDxPZGMA4C7cLnr5l /3zsC4zF6BOSA+qaI5dgLOEmp7ZutlksAbaPLRr2wPlxeqQv6LE5v+iWZdiWgpbmpUtvkluk XZv7i5usVhOZanfoyX2xlUSemhyL++0gxgMjtLRZqfsRzzDhMmlNYB1MjUrwjam+NEwoy51Y DbdrCwkdjW0A6SygWR3TW0MpFCv39jqNkMAkR7N1LXTX3Hx9jFVdTLSp6bKJRV0Eun4JfmRu eL+rnn+l1I+NAONt78WPwWQJVTKAhroub0yLzH53wvs2QaYd+t7VYa0aJk01AIYQ5bz1GQvT +0lvtr2zVHjnTFeqq6MN49vXlfuAGMq5wVCQCnjlXpqEQ120NPf5IZFifoiU1qN8dX/+G/eO aYTJfVL8rQ+vO7Op1oPTneNuRkozVhaCcXJfd26tYhGme0MxB0p7byjmwGjbUGzZDZ7wVVNX 8Nc66fE0K4FPvunY4QJZ5dYYJbtsEXpiaId4b+0UusgDCqf6Pq8fUx1JKum0zqq0FpgyoHz0 jw6Xa5uO2uGBSjlivGOYNtmba+0jJJbmkb0qmFs8VT297WLwpgawax+jpeQ23W6FL7iR6J+5 tfBJhsYy5EWnCKSbNnhY4/zpzQ5CJ81+lN3EG/2orT6jlfIECtVWtDdfncT4Mm6YBn3ds/vI UsMi51jzuQmLx2beIL+5qbro79Pd8+pqWTZz9XqRIIPwVW/1SPXUgW5iBw9w+2F3sOiWRUd8 T9rb49YzpWLHjYyGcpp2vfT0wB/Mw6jqtaxPC7hHT0fBeJqEqbSp3oNLmkM6wyJuPdgeRAx7 IUJFApl4yyD1ySdtizquGF/3kOh+UFkKLegtg2p1tdmj29CiXhZsFsO3NsfSp183aw17Cc+p MWKaxIRl0i3bArtA4wYG9zGZvW2NeW4t69yszHIGt9R31Xf5ZjnvegfYtfqmdQLeD7kd51gR SytuX2GhigeZbQwTw5XrHcUYrwLdiMd1RbVmdNaFVHjiWW+spdpr3HdXE3ECnhs9/JaXc54W hSPrFpke7A8LU4uw/nbWCzrhMaE3qBWwntdoLRI2iqHuU898GQiInogTOmu3tgeaUOivRPcV JUyGMqOHQ2Vw/we9ccA5DQplbmRzdHJlYW0NCmVuZG9iag0KMTExIDAgb2JqDQo8PC9UeXBl L1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA3IDAgUi9GMiAxMCAw IFIvRjMgMTIgMCBSL0Y0IDE0IDAgUi9GMTMgNTggMCBSPj4vRXh0R1N0YXRlPDwvR1M2IDYg MCBSL0dTOSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJ XSA+Pi9NZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyAxMTIgMCBSL0dy b3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1Mv U3RydWN0UGFyZW50cyA0Nj4+DQplbmRvYmoNCjExMiAwIG9iag0KPDwvRmlsdGVyL0ZsYXRl RGVjb2RlL0xlbmd0aCA2Mjk4Pj4NCnN0cmVhbQ0KeJzFPV1z20aS767yf0DlibqyYGDwnU2l yrFjb65OOd9Ktffg5AGiIJlnWlRIyB/763e6ezAzAKYp2prh5UEhaZDd09PT393z/MW2X123 yz766afnL/q+Xb7vrqJ3zy82d38+v/h61z1/296sbtt+tbl9fn5/2cNHf+/aq27788/RL69e Rn89fZLECfxX11UaJVHRFHEmojoXcZJH2+7pk//9j+j26ZNfLp4+ef46jZro4vrpE3gyidKo TONKPlY1TVzW0cVH+cyb8zK62cmfjW7wXaPevXn65N0iOvkzuvjPp09+lb/2P0+fRL+evYye M4v4ZdP3m4/8Ol5vNv33rkNM1iHqKi6qKK3jOsdlIPYK6V8vzn8b4/1IaFlSxWXKQPsWEn3T Pmd1GReN3CsJPI/SQsRpHaUJ4G0QPvQ5NzvorzZxUbrpeJotogv4ex6lJ6fFIjlpFhl+WsBb gW+nxH4ESnlRxFXOoXTqF1S9B1SKi/xnclIv4gSWGouTalHgp38s4HUCrwX8SXyiVQgR1+Io FChEwYKK5InJ5IfLd4uk+uPEK9hMEr7mVjg5UARNNCKusgFaEzel6ygc8JQbI/3F/YRI8xkZ vhtkloi4ZM+ekwhFCTAUqCJOgO5zIhzwFLMt6osHIoSSLnp+ftfegpg7e/nbqyh5/l/t7U20 6G5P3/xy8n2yPiMqOjAD7TUXwFI6icV7OKFddHKaL87O30a7bgsvV90ueocvYimz8MQWiz/x CD9KQThQTPMqTgSHY3sF4K9OysUWoHe73YlEdxf1iPdqd5JLjOQybuBtewcP4/tLeP8V/nhH WGR5LBoO4d1JtrhDmi4B4dW1d/BS+KYVBx6XvDpJs8UtvLoJQ4GqjvOC3bJIiniE3p2kyeJz BHRARLpb2B/gMLlXUoXD/28Jw2aB766JxeQGfkTug4VcwT/gn7XvhWR1FmfsQrpLQHcjee8L ISnRwq3dStWG6PYbwHK5gefWmheBN3O5QFx4u17jo0QGWtUV/KUVSRgF/dYXTTFgIe97piRB IQXafKW0DrNA2qLrYZlbjTo+8gl5rG/X0bWkzb3exaW9pUEWkcJG1dwqACSdunstL9byQJQB EGnQjGYQ+fwegK7WIKv66AMyfQfoIHFXt0DJm4HvkX53msE+r4h9Bk6qlHDG5ZCAI/4xu9Xi mpF18MPJSeolTRqS87gzq6XcOc2B3SdEb32SpvRF/EncbDqufeybeHmRofHkJp73vcol62cs 67++l1yOxCW6E+s/A8LRfnhHR7JOw/IwqTXFOT3yUbfrvAsDaUemLA6hZI8EKrd9Co2kJzIc /lEipCTyo4aHg43HRCp+7ydZJHHhxg3s11SKGzBgl+2td8jSjsgFRxb/C83KuGF3od1qe4rk DUkpSxWPlZbky7FiJGGC8mkNWnujDTBblsDvm7OlTpx386QWaKC5V0p6AdcoF136B58lOTo2 R9pXiLEIhoPfKeKjgkDR0uI+4D7jP5Gahr3YjPebFJaWQR+9i8E0jQsWbf9KIM3jpGK5H3Tn rbYzkQrK37iD/wGr2//sG7myiAUrCdrB2+nAsDbm1pWx1PDEfZ0ZF2HEuKjibG5BdkuJY02Y 4dlfbzQm4E1KO0PJ9vWnIKce5FteMujFWuZcDLaQVKsWt+87Ib7FU0oH1omof18tbeKqYqBZ QpsE9NWgd8e+2f1g0ZPcXLZALfO+Vd8djg7JdTpALYkROGBGvRNc/+5cWaJMca5VqZ2GQgO4 Ii3dADtLLxAfGFdsiCeQTLwNIwPyMnajDmYIRdFuNwGM4yZOGYqZMMKVJhkQpN8CRb7q7cbP gAdKerDV5AwjLpUcSgvwBadIG4fVO9xS+nw1C9iOcGgCoKeVkTNGH3xEhvs8BDzwww+alCS+ e21AkQtC7iR8CEK2GhlPyLDokSsTrgNPzpxF/ujupPuOjvwzClSMBcDgh1p2oMJj+Z5c6gkO S1j0Rht8d2QpftHPziz5JXxKUK0jZgmUFp3Sr3oBV/pRG9cwzCVtODGP5Y603OovQJVW4xsL +XzJoRGdQlw9z1EkBHCIEoHxWDcFSFtqJrrXPCx3R7FJe4Obt0KBgLLBO4pVGqfsJsWDoP+V 9L38c/5bBIji638MeKqsnPyT6dOSS5YS8C7VH73DMG4M3J1bUfCGOHxjjK6eAoDqYCsF02qN oU/Wlfa0lvdAKSCROpDTqDbpSTqmyxUJl+VX7zpASM8w5chphUJm538td33Q+cZ/6HZ9ewnv 1iuIY7w/jl1aQj7JEdq0RNTZ6kobKk4n9ryjLUGOXvVfdQzt7XYD514J5nII+UZ/LOC7Z+dv /zjRZMK9VLLYv/GYp3FdcIv1HqoTeR5nFQfOlcGf5LXSkHmtshLgN30HWsIDWpC7ZfCStlw6 tRDAjEtKQWI7f9xOuUCXkkg1A/udFGq+4VXSWeXW+lg/xgUvTTNpozLgfrvtt5ure/Ti+hW6 7LdR/0hz2YUFuFNJwaHRo3nWBQCbF3GdcmDPVhibu1qjIr7cfEFRfA5Obbm436IgkxJOCrF+ s0QnbK2qMbwjCrH9huWKMxCi52/9Q62xIIWB6qjBeDTAJgcj6TDmdwmgLKhcFLkrrj/L90/U oZ2IfEgdDmaOVPsVrw19ayMh4iLjljfSuxHhhJZXj7ZoYZz5NhpCnx0laScZs3kOH/yXJaWs y8X4x66HAOHWf3Y6j9OGW67/QHJdxvKbDLg9iW8wikwc2U5+k8XaYh593UXa9VRJWu07+DcJ kyQuBbcW6T7mQWMTZSpckdxrvex5vhwiBb6dyEYKRRYZk+y1CjLKIbo1SSM3qqDjC2ZxopuT fF8xh5UzYqztbuffVC3ruKm41QaogUnRMj4InEsD5CE1QCEN9qyZofXf97AL6KhSPo8Ugdpp 3+xXYwyDQSVA3CIFXcyAC5RqBKM0F8dbI1giLEnPHmlZOZMq0u4sj7e+rI4zdg+DOtZQWpQw K8VCVvTbngUoaZImJLfiH/xHzpI9h4RN9KNV6D0xlUEd47FWrrJux+Jk8BNLFhxZPddG+c7S 8N6LRgsoiWDQaXXp2CiRoNxGU5tZ21FJrBtbLbvds0jHwZk8QwvfmqTXr4c6PWMKlQErB3Mo 2s04AjzSEXbCq8AA3SfJuiBJqrwQeyT2i1vtwJAth3vx4pEesrPKTcTs4TbZ+L/rssPPwFD1 uPwuiG1e1ElcV/Nkp8lz6ZCxZ/h1ivY4g8C4+j6AosnSuOGA75f8Sgo8LLW0cACBQmXCS0pr eJdnUnlk3GqU9zkqZdZOuillbvY6ZEHEUCbFQsbuAmVKwJ3GRMl7g7+jUNhObFAGfvkBTtAz +Sg8rogwfWzqe9thnXWL1dKd90hG3pSQMmeW7V8GSs83ZcHZFQKoiOqQRQNK6JQNNBrsq1i3 N8S34JFWdc4iMW+Me6zjR72ye9bsCK6ZOonJedRWgXfDW8QFh6T36ERaFhAwZsAF8CqquGC3 4Bxq3q1Skofkwr3/QG6DxvieU8FYkVaV1kdVKZIvvg6p9Wkh2qdxOdIKSkhKK6NNymq3pH+9 pBCBfNr8AhSiK53gW0glRVw1RzuUeSJlIktyXPUXuVYqfdN1Cf3q06iNRpcokd1oWZP0AwPZ XjzTzBM82FoUVVzPq9eQa9adSgnOlkG1CT1xRGQyI6huux/9dzmWGF5w43pAuLDwEC5MHYhV OUXpMmxKniD2U5JU9c+PS57NIcqzLziI/plEuiD8Amedb9vBUCTr9SqMJwC1yimH0l5pHCAe lO1FBM+DMeWpqgvsy99f/9Mpc89f/e4/1p7DGIljcYyoKnQu3OAo70EU2Y5LpT9qBUJ5R+82 SyZ9uJLFzOi1dhddUevYSLWZAsrDhHhMcxq8VzrDieQW8Tf/4AqexQ8QvGVgwSvyOJ85KUEF rxNiOMHrBgfCRZf29t1HzXVTeWICi1v92R4RaQ6BKV9fru91cfqoEFE+hWXLiMjl2N22ai9V 4WU3BEBHKDYjxQHHHiuwl7OU6Dif6loWVc/37TNDDPdBHtuo33CYsdLV+xEr0hxP9EGM5Tpj VeAzlgoI/h7zjDkhhjtjbnDOFL9dcFDvC9v7tzVw0AeD6+OUVzkKZyOr5+YQObr75DP1oqBY s28lLY9BWR2NBTJRQZUQA07Sqtor//ABfPXyJLdsmb5D0vbRKyzpXq8+GT4yrT+/g6jr+s8b XSb2YRQYVsXzAv4ZZQ9WzwcQQAXEcg6iuEv+1GHlD8Qjm6M6V26IweQPA85q7ad2oFVL+rjT 0YFLeXQNO5Hi0uxUW51R4JONRJnOHG0HkTXqWzIq95JA32CT0zzCPwlRjAr4ld+DTO7/4OZZ XBUc7aiLhsJdnU5a6DZ677V/GBZicLFkc7hgDjSEZymHgtU0g3FLbN2nljtVwlTaI0+2xkzT 8WZKaytbTlt9oZc1nJC6dtlGFGmjxfURVpfO2HVacGqpP2IPqMZDPb5ue1tN7m3fXHW7H0Nk uERRQmiXWa+d+J6Yq1P9XZJyHjgPtBMOVTw/SXOnwjLOuBnFpPRPAb/9pwlJOgyCB5vFymmv GL5K5OeF96MAY6lYnvEfGobCXw5aOsTWFSlLTcoAWhznAjGIHKDGm8BqvCqP7Ea4IYYTUm5w lGihyN9QS7/yHxJNYHwDg4I9zA7MUVKD6GhvdaqfvAUzwmaPNTHx4AfHOzLWiSVTcO7GJ62A yB9ZrVc9pp6Gn9Smbk7H49scmuoBgVgvKvgwwCyuFBKFhzGas8Ev6ORKGGrryJeA5LfHSwBP QtGE/0R2mrBI+D+FWQz9gU5w9iyqNkDtdBIXNbdQYkfvg9BSqMgsj0bdFAahsGt0T28Yx/C8 5+hzPHpuhCyDdh5hdI6dvBzKmywX33ZxUJo0VlDobsht0/i7ey0zpWRLbdFmJcmspqnWErKf I21d2oNAwEg3Jpajy2oyrtEuOmCDrCucH0RDDxHHv0XoDA6dbd5biQRkbpltMmh1u450RqA0 dw6t2KnbMULKUq/eNAflXUiVcZqz2HgPpqkmEgZcqCYSBlzrH1wBVcIMuElPHRk1eH4o8YjH LbpT7jCx3jCDxfKFwQ0MdDZSaao3GYf/rKJ1SHEgho5xF9bcKDVDo7QqIYPW5maigMLMPSt5 jQsZ5vfgOAgV8AwwhSaTxyxnCQt9thkaQev2fpiyQuyBIW1ov80C2Ip5At05h51Fp60YdBpE LjKYdOYueR9Pq7I0pGpLVXLc1d4KNQ+Omtsxd0eGiwdV6zuwkok4b7hV/nBGsZHTZvEWREJp HSMSGevuh3ioe8ZgR2tm3iHesKA7HXQcfZO8FL1CIp89PM4KqJSDdxYh+YwgIsoaaaRLyI2n NBrNZnT6VzP4aatTm/R+7b9tVnETJBPmhXJrcjXQk7Q8uHEYmyyjIfpdjebaKnMGV9ruOvV7 xFKuwTkjIKPcy5QZeQF1aueX1TghHRx0J9ZGWmOI30/tnCELjRNxLOtD7T+NA+DFFLaB5PSq obFLg+Q6nU1rDLXN0vOp5mbdYfTUs92tCZ1zydCbSW7WiDPVSt3pKVkUFVDiaFoEYUE6wxjl 25MAXWJZIXm+4mgycUIG2eBqArHWacbC6Sg2CpIhv7ieWvwtFWlOJr5da7hbrMIIwgyQBRFu O+zBahO9Q6tJrAoxV4Pw8NQhcWbho2kbwljMks9jrkNARNRwwbsTl7AfC9bxRHpk6WlAb5IX xlscyD670TMxZ36bTY7a/PPECRwF2qXaqS18h+lnM5HGjOcIs/FVBVfKzOfqOOaFnc4mpOT8 vLDN+Aigs+6/t6DCdhdmEYfYZT7GYfHELSroPXWJWN+UAEIkLERGgGmupfTyASNfBj1aqlMz VZG2DTnee4vLnfeDhCCKaCqwGBmisJ1/3ktXCyjAZLBQQ0HIct3TsmdkxGrrauIrXT18M/m3 1Jtk1SZ8NdNOjRQ01QRh5E5euIz5UE5ulca5YKE+1AVE1t9fQ7KZYhAdmUdDWcLIQSCvQu6Q slbku9feZV9Tw0goZkkUxeUsuACjGSsWFfLZDa+uB8NnqDQ9pMLT95lMKzyTboz3Ge7eDc8c eqEYRHLtLAh5wAMFN7IqgyEfDAqHKNGgI90gPuVwR0MqUTdEFQXw36EK+W4G5tUk9t/dsj7x 502Qsw3tWwWL3/VQSDvrWm3XKEFDTPSQTlrScBiZwrf/65bY/QbpZ+WRjzXrkFBX+v9OB2it WeRaj5IUw/ARncN5quaUubttetPZgM0Z/FBpq5gdZJ8sY2zcvWfBHRtSk9CQfUvZsKSQvmOa cYGEUAfUDXFu0PnPWuBNQgz8S03t6eVAsDVka6FpbF0OZLdM5Qv/zZcVNMBzCB8i2wMNa6sL 3EnRZCbukMRC/sv2xrz+B6KJh+5H/0UHUrAdikKICYWi/Jb1m6I9S07pUKYxQJUwQJNlNH7S ClJR/JuqfUwUojnsuitXb+TOHpcK0ipApb+0kr5nq5xM7aOleA9TVwJGFu9H8ywAQyueOgj8 vgCPY+QAFo5Sge6MncZhuE+aM68MJ7qYpt9o7Weu4JkpYc3YMyetDsJpRRI3xWE0PITTfPRQ sppXQNS6nIl1765mCRd1s+DMpQ/GqrJqVnAblyvIaZEKtBIDASopMxZP1+VucBNWw9mMJNUC 36cqpAMoUg7nB0JBEKnW4fPJ/WjcVNv6O3JoJi31+h4+pLKp99qCMRv//+bRqxORJ67rGh7I xGE9++xyRnVLmsm/3I8chxGLV5LDMYK3BsE3lp/ejTqRCJj3y6z1EKnko+uUrxYXIplfTmHu 8kofewPEXO8K9KGdcMPVjI/Aya2Qy0sQj0FTmE9IX7xqe/91VHCZ5NFWnqY4/P+bVz4khbql zir4xqwoIBN0NEIU0iDloFGo4JW6C+DHaWkJUgHU4SRdOirFvx6lCvXYvklh/zgn3/dk2H/Q PicYSQFGcVSQKz+M1E7x46PplBc/KUx/Z6WPCCV9XGDDCR8b2iEn8ELro4d7A71HECu4s+xI 9EnzBiYyuKHRybwwQTz/ThjMn2Ph04wxmh+s8m3KA/owZPHAZvu8pvqPUZfnqV3aOlxIpivF jEmiCmJXpjzFgqqChI36gSGA6IwHjAtbbHtxkFTeyyxFBvMDDuIUp2Dx0Qa3R7BQtQEnWbJg ksUFN6BoscEdIlteLJcUvd4N1aJ8f6p/RZzFTX00EqUF3FXLQCPp8uKlPD2DdMEmLaxzyKg+ Kq1mzXwqqFe6wx6z28nNvYom/HczmAzjBKv8zs3gs7SqNBG/Ptuw6TC4uRAZ6gGMq2kXqpoK 2Q9626m4YyTK/PfNwmTnwzbfJTBEoBa+QWAU9fy+XCMwHn0VHiswXHADCgwb3CEC481GxxtN XABkxqpf/avz7xvkZZwdjShpjnfZM+BIRryxZYRxD+hmAVVSIgVBbU/rmk4UwRbgL5Tq826z CRjamx6NZgKG9rJbZJKdvsHWBVxpyIBtr4bMsBaCr17hLpxTeKenweOVlXVVaduN7ubZa0pV Tn/Oe+9KAz47s8ggbdU5C+4QmRy0VQbu2XHEWV8OtV1bHd4cavkxIjpJihX+qwRTAXesc/iN 029kSmHXKsRT6knJH9Vd3FGipV1bo3/RgWhXaxMPNgPzzGfbIPXGEOiuU/cCQSdKXY5a8eNm 691OEFUR5wVH3CBjVGsWXMCabgG3gVYcYCl3KmdYe5K6KceZG4prD22MwGXvjXlnxuZhFDzM Nde5yOOCYZ1wNaN51oDZ4AZK5wbmYk4u9hlXF52dv/UvYRucHnAsZoaxVBUrmNxjO16GqJRT AlyUrqzHvktP4QUyuTX4v/VvZQoBvogbPf9WpihQzbrBmTFPVk9RmPrFtGjQAXcjYjcveS9t gkuFjkdw6dPBqXOBi06TOJU2VqARJXUap9w6z36D7b2genPvecYaLvo8FoVFmsQ1e4J0wHq9 ws5/u+HkC/agerdXMsiyMuj4v8RVireDie20m4O2MkHloyPbcxGg1KSqWXCBGmLl0d4DdDbM wbsoz6GolIGuldfduPaPSjBCpFGTksPF3fbdjHID5miadumrIRw8b5V+Zje0q0Zf/21gJRSM M4sK0HVWw50NDDibVkvKvalJXhsd2CV6OEY1Dn3CEPrRI+S9D6TLmgzGXDgXAKougSu1QNft Akz/aDAD5KadY4wS029Ls/CQXU1dj6uCEPfBUTguCTwr5w5izzY5Xhn2QMfmZO6V//FrTc2i EqrwmgE3Gbl1PxSFTkVfZG5ahFYHfXFTgFk/VQHcyOA7uqkrRJOfdOgZ0NPuExK75P8Mgy0+ UqP8aWE8U3Vm+oiGvmEW5/NGVzqaihLHTbWnxay951RPgIQdwWEWOMH2z0ByiSGG/744+YWK BeeyyP4Njw+ChQ0KZW5kc3RyZWFtDQplbmRvYmoNCjExMyAwIG9iag0KPDwvVHlwZS9QYWdl L1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250PDwvRjEgNyAwIFIvRjIgMTAgMCBSL0Y0 IDE0IDAgUi9GMyAxMiAwIFIvRjE3IDExNSAwIFI+Pi9FeHRHU3RhdGU8PC9HUzYgNiAwIFIv R1M5IDkgMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+ L01lZGlhQm94WyAwIDAgNTk1LjMyIDg0Mi4wNF0gL0NvbnRlbnRzIDExNCAwIFIvR3JvdXA8 PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1 Y3RQYXJlbnRzIDQ3Pj4NCmVuZG9iag0KMTE0IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNv ZGUvTGVuZ3RoIDM5NDU+Pg0Kc3RyZWFtDQp4nNUdXW/bRvLdgP8D0SfpGq/J3eXHFr0CSerk cqjbXm30Dkj7IEu0TVSRfBLdJEB//M3MUiQl7ihKtGvg/KBQEqn52Pme2c3581Vd3U6mdfTt t+fP63oyvS9n0dvz6+XD7+fXHx/K858nd9ViUlfLxfnV402NH/2jnMzK1XffRS++fxn99/Qk FjH+FUWeRHGUmlQoGRVailhHq/L05N9/ixanJy+uT0/OXyWRia5vT0/wzjhKoiwROdyWGyOy Irp+B/e8vsqiuzX8bHRH70zz7vXpydtRNP49uv7n6ckF/Nq/Tk+ii8uX0TlDxItlXS/f8XS8 Wi7rL6VD7tAhi1ykeZQUotBEBmHfIH1xffVmG+8joak4F1nCQPscFn3WOqsiE6mBtQLgOkpS KZIiSmLEu0P40Pvc4tA+akSaufl4pkbRNb5eRcn4LB3FYzNS9GmKbyW93WX2ESjpNBW55lA6 8wuq2AMqISJ/jcfFSMRIqpDjfJTSp7+N8DrGa4kvsU+0UilFIZ+EA6lMWVARaIyCD6dvR3H+ 29grWAWMLzgKdxTKQpNGilxtoBlhMpcqHHCXG6P2wf2MSNIBG74YpIqlyFjdczIhzRBGAyoV MfJ9yIQD7mKWpXnwQITI0kXnVw+TBZq5y5dvvo/i8x8mi7toVC7OXr8Yf5mtR2FCNjpQg38S x+rEmdS0PlocZfddkDNY0sIN+q3D8h0LLgcfw1A6WAMP4JJECcXyVaaK2Hp59bN/yDoHxj4d oWCftGTATVbT+wpNfF1O0ZzXj6vSOwZSZSI2hxHsUq3Ej2pp/NyhWioW2VDrQaGAH4pek2NZ MgANQVzBwz5aCAbwGml3g3uFNM5LiGc+4FV1U80r8P01vvk41oAOXEwWs3ES2+v21nrzbrF2 POmbCJlroc2BTHMJkvQgSMp6OoccxQZYvIsVBJBydI8aVgLr9GhleQlcves+XOLlLcVXePsE GU03TuHJfFSBctaP47PMfliuowd8U67G2egdPl/VdTnDC3r8Bn/tI77QWzBhUbWO3lczeuio VXEQL7NCqJyhfhiyHQstTyjmcELb8BZYRsytFuPmyrKVvpnZ98ZelPOK2AW8hNdJXc4/4k10 /wLYSytTR/Oq4XPZPr7D5Qe8WoHs2yeWePt0ib81j3A5LbR1dWd/Gd6sx81y08Iv7fMbEYBF E8dZAVZOMwiP8mKPoFbrcSNJvat3iBoR2WFaI0czYA+Sm9kbkSq6zXK7k2e6+pO+Qbmtyrpj 3o78P27YY7VjOsFv6P36Gdkfy14H3+n3K1IFeDbfsDbrcba+b779hDIWHT315A9SHVJG+npu Qay21pHIRKGZtYSB4sJDhV1w++Q4aRbbiigos+9l1hBJGW6ZLfmT2trxD2RecJXrYOIGyZIc JBZn8Nta2Rjr5dw35AziDcmAhpjnEakmefINuFDAcxZwKymakmq8Uu2V9I1LgqkPh4p3w4wB BjhlBtyAYDPKvWOggPkcAt6FO4GYVkoOXGPtpysbFTUWxzcKuYR4mhNya3NNz/QsvCNglDAs y/2LGFg0xUp0iQR/QDrJiXVKXld/kq0j4z4HY4cOnTxz43ECBEQJi+aEfMYUkbXOdhDb+cZH yURk7Cpt+QMMFaddENU6QHLID+1LLwJ41rp28Mm9J+7b+95bj30fRgc0lvVZg3vTIlpOwKGT VlpM/CNiNGLArTrGGE1YEMbLQmqUDyv0tzaz+4DyZc0QJGg14MLGXigCM1z88oGCV1xVupkC 4JLkosYY5rh6k0u9iwTtt5sQ/8az0GS/3eB2s7ZPa2216II+K+v+U59C6JTDuBcuzydg9rsY eo0qLbfi8fl6if922WLzJFlFWmj6tMJ1JrpKEgnvS64xjTMHrrkroVchE/os1UIN0Xq+aJMd VBZSk1WbwpEmVfNyOxmyxbXqllKpKTa/8DcWm1xy22I+dhkG8yu+JUsaUaQcvZ2pIL0faoWz RmH9gm9XFlP2zyC6k0IzyV3WL7TsISBAXgbYFyz2t5sctqHAjN7fk9me3lt5840N3Gk4ZAZR ASvlvr1ZAjEtq3pNPSKMB9XUe2Qi+V7dBmyhZwSMFCpmMfBudSFSKSQLzjt7MWrXLLjn/vUM E1/DweNU3jcOqaK4lEFiHoG2P7TajlbpoStD1lW59m7jY0XJ0xMtuoxTcilucLai10VMGDzp Ub1q49EZMITc4LQMlKNJHGvh0FuCmWlrtBatSWVrnUEskIqLPYuzVbcGVGyY1uJX9WqRNrJI dwrMXWoWLA0DlctZflIYSrHLYyvyFZZ/1VYKUgwLtHuq6s8iW5EP5Q5U4ugw7A/UeqF0FzpP 52RhZo3r0H2J37Ql+vmYJb8Lohon/K4tTTd9i7n9ibsgSaVUMeUaTiZM1lhDeWyTwgdrs5bj Ykfudhou9u0EOyyZlVzvVk4hwobB27sjVUoJkzDQDshedNC+dhbnIt7T1/be0o5FUrBgjytv 72mhM/BCtdAZcK/LRbmqpuPUNsir42qtTvB5TgUmN/zjiq1OeEUiDMveG9LnWQR++hLMF2QI 48YaVLPZvLxZ2mqsb6QUfGTSA9fcpXJpyIJBWqRYad1bTPJsgrByUrCQ9yboviNeSfLCYOI/ yJda6IwDZ30kJa3VtLbVK+t3W79Mb1/ZvK4LS6z31iDW1K1KwnhXkGIIjhncd8rn62jiHb7O RJ4/2VJJbYQ0HDhbnLGt8zYDqqb+sQB7JhM3FtSOhl8uqB99pPF2wjYiZmCHGJIxUkhWvihK nbQMD9OVQEMtFYdC4yjGTXAI/gLtEsn7h3GAWpdKjdCswFN6Yk3jg3fIEBWlrOw/a6vwttZn hd+7acYyu2GRCJAMSpGy0g75TR4iA5W5SFiZP3aM11k/BYBPx1OwoZn8lD6daZdCbZzdjmMZ J0m/BBOwtJpClAJrM6jmbuXAbXOKdMD2n+oVtm1Xdpo0hJlKcFiZQTC0U0ikoiV1M8f/9ITM cOqcAXfTjOyF6lInumAZ/bbx/PX7pe0yFKM/WrnsBg6oYuC/ThkLozi8qJqm/A/OyCQTKQvV e51CJsUeIg/ImrIwWVMeUyMiTUERhgWUH3+6RvtwgVLwjX+BjCUW6BnYAQyNwk0YDLj9s7e9 tnxXBSSVwVLa5iYqqc/nZVcn/gpjvDCTX1IWlEG4yfEf0CpJ8bMbnB03rimC+sq/8uCuTJbU A5QnD1pyUEokw001l12Dpass7x+rDpSfu/Frh8psbcI6/m5bQ9MOaAe3SextjLBpCNHcfGF/ xNbZ+62PyZz6CwEiGuwc5YqjyzX32U7/7xb+7SDJos1/u0jtOdVodft+kK3ttEmGG0bGiR5t dnR1/YStMaWXYF/mk8dNMR6+1Hi9M5asvYeEOPNTcAz0bjpwoCBn9aSZSzY9gnO8egYfhQqG ZYIZ4Z6KVdm0TQIkwkUhkpjFodOfRuq8+9xUxJKDHsDF5yJliXXlTOkmZfI+DRCTzD8V4anE rR8MONultO3sO/8z6SlmxU9FaA4r7IYWPHuDTFwpjlL/2Rtobmb2Lumm2+o9Q6Jx9qdaUpnE ImPW9O1g41fZOr7+JrrCKrf1t/V6nPb22e0EDFnXsvbfHgb7I1lSDogci6D9YS0zLMs/dX+Y AXv0eQJcf5iBF6o/zIDb6Q8vHyHAqAP0bFNRJBwOAXrEJsYN2U54aIAT3AoB5nd53Miycy84 5O8Jy27/pMo428PaGzC+GOZjF/wSbc9VvyGOm40D9sSVETmzCAeZGRMyQdWxxtrTgRss9oyS w/2+urqSK4mH67UybAjVa2XAPXGvlcFiuRnuPM4AOhufCgEycAP0WXOW2RR/erF+zsgixTPg nopOHE/l2boVfDYbY4bJFXabblpN225KBWu+4vqwbHI0X7PGUvRrK7j7wf+uxQyrwQxi+7t5 mdNyLYLsEbEmXIFW6WHtpFeqPqiRB3YYQ/OdnYdhDEGicmE4xP0nZzrBTStOcFFAM5CAsU/Z 9fFPpi0rMOC2zECQFqLdJciA3+kTUjFYBmh84ORhyiHhv/kQG5zDZsAdcnSWj2Pp+NadyqUo hkHnduvuGldl2N3y3nCgCQkGowDnP9BGNQbcZ7XsqFbfBbNfdWcT+N/pmRisrjBY+w+QpMK+ HQMucN/OBt6HyYNTdXwcO8c7VTyVb4iXqxO8FSJtOU8SkrpsnP/2pm//1Xudk/11Ix6giB3j vDsDjoicNx2uanxm7NFPAQ5ZwTJSyqGxt4kQZmOOwsyKQafbtlvsnir2HsKxpn3of29hkWEt 5qkkQ2ItnF2StgbcHd+17HdA/R+vkmKSwWAzszZu4h+s1jjSyoAdHCnnfaC2EDm7BG1jftU7 +qWt1Hd5Fy7OnBbnfbkaB9AWDe7OsGi69qNpWyEi9Aa22Dd2eY4jEgx2nf2ftaHtoiuYbQ0M h0r8dIznOw341ljd5fYm3g5N0LLFxgzWEXG5pLGN3vRCewze7s5JPGwvbXrgnafrwMyb45y6 g4fs/tzb1iFW02fbR2kGnHOXmaZ8wM2pzT7nbEDl7mkP3is2NGDIoNUvb+wZCorsgaHb0yzu oqvZGmb50N5jB1nU3kEWuKcYZXbqglTPt5rheQcZK8x9I1BXU+/OMVXU+3eCpyKhoeqA/wms RoclZZADybSGY+LU5O392NZC323kJMwi4TC0KThsNycDNHXjGxtqre9bZK2pqTCTIjL8zzUU Nptw4xcg6qQyPgNuO8SxtN93hwD4N3KwOBjfubF5aMt4q82hFm0dxv8hWKnGNpwTFdImPGoE 9WntP6HMEpEcKgKUUALMAoJDqe1mERPpLMadMRk4/B7E3byTO6X6kN+y2AOaZqdaYWj8Hpum Q9z/+vrv9Pf1X9Hu356vet8NWH0EqtokNCTmRvWQvJ07FOx4/iFuxsG/6OUPby5+vI4sk771 yQ4pMzxem4F8Rn9e4aU02c3A+47WPYouX/z0n8iS6xO4yuj4Bga4V76qLKOu+T6++uVsswtv P2evLn759eKXKIRGMYAP0SjuoAoPGoWHPv5/WCQG1UP4x506cARSBv9TD3g0T0T6ZUhxm3o+ Ayn3xhCN/78UOMlhZ/PVMcviKoZpzHIYYNVdE5RgbqNtZg/ZR/JN9GbYFjoODxNTO96Nx1FG hJ9xcAO7sU1YeybRJR49fwWU/2xLCXiaEJZKkSXT+6qmkHGKh783k5F0aGLhiNqOwliDK9cs xoeIKreF5nC03KfukQapFA/x+QRaG8z+B1kcNvoNCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMTUg MCBvYmoNCjw8L1R5cGUvRm9udC9TdWJ0eXBlL1RydWVUeXBlL05hbWUvRjE3L0Jhc2VGb250 L0JDRElFRStDb3VyaWVyTmV3UFNNVC9FbmNvZGluZy9XaW5BbnNpRW5jb2RpbmcvRm9udERl c2NyaXB0b3IgMTE2IDAgUi9GaXJzdENoYXIgMzIvTGFzdENoYXIgMTI0L1dpZHRocyA1NDMz IDAgUj4+DQplbmRvYmoNCjExNiAwIG9iag0KPDwvVHlwZS9Gb250RGVzY3JpcHRvci9Gb250 TmFtZS9CQ0RJRUUrQ291cmllck5ld1BTTVQvRmxhZ3MgMzIvSXRhbGljQW5nbGUgMC9Bc2Nl bnQgODMzL0Rlc2NlbnQgLTE4OC9DYXBIZWlnaHQgNjEzL0F2Z1dpZHRoIDYwMC9NYXhXaWR0 aCA3NDQvRm9udFdlaWdodCA0MDAvWEhlaWdodCAyNTAvU3RlbVYgNjAvRm9udEJCb3hbIC0x MjIgLTE4OCA2MjMgNjEzXSAvRm9udEZpbGUyIDU0MzQgMCBSPj4NCmVuZG9iag0KMTE3IDAg b2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA3 IDAgUi9GMiAxMCAwIFIvRjQgMTQgMCBSL0YzIDEyIDAgUi9GMTcgMTE1IDAgUj4+L0V4dEdT dGF0ZTw8L0dTNiA2IDAgUi9HUzkgOSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIv SW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA1OTUuMzIgODQyLjA0XSAvQ29udGVu dHMgMTE4IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNl UkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgNDg+Pg0KZW5kb2JqDQoxMTggMCBvYmoNCjw8 L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMzU3MD4+DQpzdHJlYW0NCniczV3rb9tGEv9u wP8D0U/UtV5xn1wWPQNJmvRyiNNebeTu4OSDYiuuANvy2XIfQP/42xlSj1g71CacdeoPskSR +s17Z2ZH1PjJ7WL2YXK2KL77bvxksZic/TI9L07HJ/Obd+OTP26m458mF7PryWI2vx4f379f wKF/TCfn09vDw+Lp98+K/+3vVaKCP+9rWVSFbazQqvBGicoUt9P9vX//rbje33t6sr83fiGL pjj5sL8HZ1aFLJwUdTitbhrhfHFyFc754dgVF3fhY4sLfNV0r37Y3zsti9G74uSf+3vPw6f9 a3+veH70rBgTTDydLxbzK5qPF/P54nP5UA/4UL4Wti6kF94gG0h9R/Tzk+OXH9M9EE1XtXCS QPsUEX2SnrV3wjZBVwHcFNIqIX0hK6B7TXDqeXFzWF3aCOvicjzQZXECj8eFHB3Ysho1pcaj Fl4qfPlQ2ANIMtaK2lAkHfBC+R4oiUy+qUa+FBWwKtSoLi0efVvC8wqeK3ioOMmySgmvHkUC VlkSqggeo8PBs9Oyqt+OWGF1ELynOHzgUC2aapSo9RKtEY2LuULCWXGKVhf2C0K6LTF8NqSu lHCk70WFYB1gdFBWVCD3bSEknEWopbswkSCMdMX4+GZyDWHu6NnL74tq/GpyfVGU0+uDH56O Pi/WB3INHN8mzSkp9MMIXBzAhztlUENGDIr8MWznhVEE+Gkk+A3Fq51QNB4/f74KnkviGX68 WnhKmVt2xoAnpRaagjsaHZjy/jKsYgsI5LOby2l4XsDzM3i4nMHr68XIlncY+kemvJneFuE1 Xnr8E55uyit4NTs/v5y+n49kVf7OzofWUqg6UW4x55QMzqnbELftmzaEjcZvkRVSB1X+Asvn tAAJTW7h+Vk4UpezxfRscT86cOUtiHYKYivg/HM8/wbPOVtMz+EJvjEbSV1ew7v48sXsAv7d w4H2IxDDjFxwk/CGXp15N9ItFXN4+O1ukHIiMlC6EV5SQhhm0zG4cKbWFByaIgrlcjG7AfYv p61FB2u+BmEuQI7sQtCVEZKkil0IugqGZym4szkwiraCD1N058XsGv5drAxjMR91tjVfn4pW 1NkaN9HeC0kSvZ3cDYVrpLCkXb4Hbifgdsj3+UoqRyGohchm2lddaINHPCWEOHBaFNjvmBnD WXjqSbgQ/Wx2t7y6e8bMmA1BneQLKfuA+gZ7dxng25gXlGn0Fjy6HkScjciF1MxXgQqPvfnp Nf6/aQ/79v1fV+KbzUHk63A3H7mNqyfX4ZS10f4BD62m4FooLVfvfdPqhzsIqUbomhJCzKx+ GXVWg3S2brbBFDd9XmJMjtO3EQinuCbdrJSDAmypQ7XNboH46W8TTAgu+eNmqEOdpgjlj5tO YgiKw8UMtV2PQaH4biu6s+naFCO6biV3uZii8CDsmhB2Xbm2+Pul2d+sFmZ0Gnb5msZBbUow PCyhjsKF6jZRm7E0TTGkabKmYpappKiaz6FLZ63tdN2ISm6XHwLsSGereghYm6vqIfByVT0E XE/Vg1VOcNoGFqLuWbeWa6h8lucdjaD4gTpoWfmEd3IWP7XQTaL4YtZrchY/2taQiv6lih9D Fj/F1Sr8PigQMP7errIQJOp2+QZ+1o602q2y6gOzTlo2s2r+jLqpINASKsiQUWtRNxRcPKNu yqPgKleg7IQ0mns58mH1oy2UytdhWc+UNmvjoE6MV2wYTa7azBCNLEP23hjssBF0bDjgJVSH 68y6yxmDJjtfak+9RN/5sEzg82Sz0ltoFxM0Pws6+/41f1tDVsJqCnSz7FsFurtpWs04vStG UsZKtXD1xbJQwFfv2/rGraxy+aGzD6tMcx2qpuweX4elx1JCQD9fFGgZ6PitpXyzCoAQOu/X cb/l4Y7fzQN5lYpTiTsYpm2Qn7w6Zod2GrZzCAGxR2DjaiFJ78WCY9mOxapjgquT7VanPBFN G9ggfkjLV7iUTn8FvbfLKi6wX638Zl1zwjKJfjHjr3+kCqHDUUTyRyrlodwi4HKGSN3ASkfo 4gzzHGyABodlx3bhApJpdh+QDreuCTiMiBiMzmYYVNf9zocZHj79KkNvqIYGNUHfKRYdAggc tn0WbY1XwjcUsuKHs6IhGMWdydrVGHffsfcZlJUwA5Pm1rGSyGZtNEgjwURT6AqYDlYvU7hw UeNDiK+gbS2lgjGlNeYDBhzBQNqHrRn4ePtVY3JYmzr83yL/z6//jn9f/1ns+FufuaX4QfRp G4rjmqIvQe11TqmFMr2KSK149url89cnRSu173glIm0jnKKwD2J/vASowH1lKQIO0RqK4+c/ v3n+cysBZouow/peU/AJFuFzWoRyMGL0CX704EhuP4rTlyC1JqfUpAOT3qKK/mO2aNmgRcfJ YNZEYFgYEixlsIEaO2JRReWE+QuoIk7GmzyqIHhOUAU1ZMKhCte46Jr3CFqQjQItEBTkilEK inoSld3SQuLme9D4TdvrHsBTIqH6aNV4x0uR8VBCUhJIMH9q847F/L2LLvCPaP5xCoI2jp7+ +B9cuvOYJMU5M5rDJjkt5zzmH4c75UZrTB9zzMlVVfXYC3P+rysLixYBlifl18ZDzk1gHmIa ++T1k1f/PXn57LjIHK6SVBoNV9SePku4qm00s37EcBWn4OPaI08IoXjnLjw9Wj6BlidcxcG+ 4GqdxH3U/KmhABbzd/ZzyxmqMfdJZEWaxjCYFGKW1WJ7J/jFMNVE2pOVgUZsHG120c0twNiC GRnYS5RVqb4tfoR+9T0OEbBT5BpoSscpGrg+RNBq/H5PDG1zP27+gR3YKyEpNfOz6S1sEcfR 3reDqrgNXBwdj+qyGyoOup7cjto9UanL2QInLM/CmziQhPpH4+AmtxvfiJOb4pscPedIM38Z NHQldvbyN9vmMP9sCiMd7EIsUUPSrBzdNpdkBzjp06iwV+NAnQ1hr94WbU+/b1vFQ8hQSsOE GEFGiobJbiiHdGzwloh0NvrjkeR4CLA0NWxMEsCRcDAIzCqYBCDA3r7lRsONZgKN3bJkbXok mWJZZMeYw7KMhSmVHX6XRwFxaHZ1uxCzSTRu1pyHOJ4GFp3iJnvSHMrWFkb4d5VWeeQfx+bX dqsAgtMEBZCdaA4FKCMaQgHMcoAv1flewJzKJmDz6DoOxm5ZXRxPYi1qWWSTl8OypEnKn/Jo IA6eaSGNg/Gru8GcJI4WbQwOgmsc5p9xuMPN1khshqRvJ2kIWUZ5oXSigqNGT7YKOYw+BLn+ tJg9K8YyjcDtmxPhsI04ajcnst5KYa8F4AvaNH4enjXMKekdPPfPxgyye9MI7yj4FLsne4QM dm8ak5C0Zwr2BHieYE+AjbPEegIslz8TcF861qfpN2rzZAOaw+a9SaldMtl8HJzdDFubJzhN UADZZeRQQK13lBL56gkCm1v+nbIJRhPkn7NDil+X2Rn0x5kcIA6eqxkr8caJFGiCInI2Yw1s AnyJZiwBnKcZS4CNc/VHCbwUZefsjxqj+1MtZmFoCW0bAjXlbgss/cPYl6Tw/poGbia2/e25 yC7wQLhQaIX8m4AjtoH1t8VReCLL43AoZcdQ2o0tw+I3eNPC91FVWVzdw+bjJZ4O9zloP+rs cgb3eLnGE++Km3BQwZehbAnIPgAfdHuVV/AlVg3fN1Xt7Q3Ci+3bGwyUknGmRykp1sLR7Ixt S3bOAzfA3XnTkI19SQk3t1QBqBYmaF+FSLR7X1JTfbW0TyMbqA2Mh8DdwlSEhR1JzzDopoKJ GRqaF04FLVV9cOQfLx1wPyNVU3Rs53rDwEJu4UiwWMk3DC5UmJ6EO+SWZDAgmrmetWsQqjEh GpFmlBCMqFYhhx8rqLl3WTezG3ucL6WQs8SMxwIL5z0WmKokjEYmKTBveFLgwgQd4yyQrR8T kH8yo8EtvgyJ1vVamSF1IzTJX47wlGaz0fBEdXRZwlOIFX63dedx4zTsjJ4VylswvDgd4zyY nWvFMfMukZTAE2yQ6rCy2GBto9l6BsPTbhdgTnsnYPMsWzt5zOxaCr6tTFDBnVN3fpwk36h5 U/1rFvN2IR3rc/UsCliaQRw8TyVHgWXgTpsdgMx41vZIc0OVzIYtLXpRHHa72TsMTFXoRXEw 7roUfsmFBuNGC3HfkWjs0Uj1KC1XvO3Sil0GmiWtSIox0bhL7VuxxN3gs2r7h2F6h3SG4dYG LiZwe4Z0hoUm5TE0kajMcEHlnoQ73BwIyhSf+sSbp/KmELN0Bh8LLRhrjzSzdCF7jKZ3ompY jHIOSv04dEqMorZ0WWKUgR+8+lK5YRw8U25IgOXLDWnAPLnhTlXmyQ3jsJlibxyMP/B2+Voc LjJxzZKw9VhovoRtl9VkSdiSHD8aDKmRB5ZgGBzX9yhg918eu4iTxW+FbRODEMJu3RhqAoNF N8rAPXkH6CZT7zZOF7tyukyQkEKCcqiBBxblSAMXD1FOpj2rOGH82sEN/F4x5IneccTM0Ztg M8EIcw6swP0zYhn2F7XC1i7ilLFbYVe/xdFyTXYQcIfMYN72SDKTc8XBcu0+x9Fy7j4/En8W btGRprlo0Mg5HSMb05tzf7nQ0dogQV/eAE8JJUFXOUcFJNxP6/PIYtk9jg3r1sIWso7euH17 NHgomtV4eRyOGA02WUeDmTnUpoEoT3B4Nw0U3sK08a9TGDcGCrd/+2MoCd7A/Y4IEvg59jW6 eRwOf2rsoylr0CH8KE7alPVA4oyv4Lo0WUT9jmNbO/ZrHl1AMD7hl72XtP0fSC3Upw0KZW5k c3RyZWFtDQplbmRvYmoNCjExOSAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9S ZXNvdXJjZXM8PC9Gb250PDwvRjEgNyAwIFIvRjIgMTAgMCBSL0Y0IDE0IDAgUi9GMyAxMiAw IFIvRjE3IDExNSAwIFI+Pi9FeHRHU3RhdGU8PC9HUzYgNiAwIFIvR1M5IDkgMCBSPj4vUHJv Y1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAg NTk1LjMyIDg0Mi4wNF0gL0NvbnRlbnRzIDEyMCAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1Mv VHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDQ5Pj4N CmVuZG9iag0KMTIwIDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDUxNDA+ Pg0Kc3RyZWFtDQp4nMVdW3MbN7J+d5X/w7wtuRtBg9tcNjmpih0761PrXZ9ItedUJXkYkWOZ FYpkyJEdV+XHH3RjbuSgR2MOhtGDTNEkv0YDaHR/3Whef7cvVu+zRRF88831d0WRLT7ky+Cn 69vt7pfr28+7/Ppddr/aZMVqu7m+ebwr4Kl/5Nky33/7bfDi+5fBb8+fhSyEnySJeRAGOtVM iiBRgoUq2OfPn/3vX4PN82cvbp8/u37NgzS4ff/8GbwyDHgQcRabl8VpyqIkuH0wr/nhJgru D+Zjg3v8Ky3/+uH5s59mwfyX4Pa/nz97ZT7tf54/C169fRlcE4N4sS2K7QM9jtfbbXHuOMTJ OEQSMx0HPGGJwmGg9KXQr25v3hzLPRJNhjGLOIH2JSr6onmWScR0aubKgKuAa8F4EvAQ5G4E Hvo693Ko35oyHbn1eCVnwS38vgn4/ErPwnk6k/ishj8F/nmq7BEiKa1ZrCiRrvxCJT1QHAf5 n3CezFgIQ2ViHs80PvvzDB6H8FjAr9CnWFoIloiLaEALTUIFZsdI8+Tip1kY/zz3CiuN4hNq hCcbyqKJVLBYVmgpSyPXVhjwKrdE9Rv7FcHjjhrOhpShYBG595xK0BFglFCahaD3rhIGvIqY lvKNAwVCSxdc3+yyDZi5ty/ffB+E1//MNvfBLN9c/fBifp6tN+IqeN4hmtmwoeiIphjsQYm/ o1GG3wVtTpqExg6843EumaTg3s6v1OxxbYxuAaNd7da5eRzA47dzNbt5F8z17AFetFou4WX5 3fb3fB7NDmi34NcOnt3D6xbw53azyec8NH8o85nmfduN9yHJWDHOB6rQtay4h2Ul7eZ0rCpp /ukueHPoidkHMPx5AArN9vB4YZ6JZ6siXxSP86totgcdogIDeP0SX7/D1yyKfAkP8D9Wcy5n G/hf/PP16h7+eYQn7EcghjIzxUap3zFKYbwXkVLD1N7huGBSUnDj9osTTrFEU3CHubRzuIVf nw7BA/yLal97l0THLCUHXqx2MM/r3L8G4oQJ7sYNruDDkyTB42s1bmu7sBPjQJBrq+urjIZL mSAn+w6mNYO9iBttaXebZxEk50yQs1yaXuMcIvo6vwMjgYvvdzQNB+/yRGa7kSrxP/zIbLeY gjMLzIwfLVxW28TFFqzgxpg2nJYcjx0T+RjH2vt6VODQkrPj3bQqkVxS+UqGPcpvDqzVYa4m QNccXHwCHdf4Auf2cV6ei2B9cQl8+gDbIN/Ux+HdvNwVxYd6xdiH/u1jecqblcG70ftivbJi FUEGIrcth5EJRpDjwf8R1+7e/k9q9Zx9hHeW7kFgNn21/c1vu//h1AcbELdsgPcBcuOxh5wa 4dKo2nok6y0I9tn8jXKW4/Zuo1XEeExJ83VwQCkeyrmuHvbaTJga0faTPq3sYnHbm3pK/zLn olmE1voYv9k8+WlbO2+/1pOdbebqZO5Riodp1qVKFEbBbkVZd7Mz3Nj/8in3hwk7oq5zXm9K 89u5GYyO+cz7qcZDzpSghBpnx83idOCZoCWi8AZEKMJDhOISzE4OvC89Ryw5aTyuY8nirlx1 PO49FA/NAUTCdrkZT6E/gTdV6E/AYeh/8w7DfdXE+CbAB8v3++gT3yWQ4BpiOUKi9RZIg8wy EduNkWycHXBKEIdMkxIM2AFqSupAa8GUHEcd+LacQoAlIyTzb6gFWCYCzb+nY/xtcywQcJZ8 gd2wQy/4mIApXYWU5l6A4/dPT3CIWAmJx7GVTjh0vi41H4InwGETcBl6YY1DBYpPL6X3mAMt T0g27qhwwkUsvqDe4xQovd59cFiA94uKXt01TtxUUZYUKUTehEg29FhkVeiPkVZklwX62O9L flrM3t68A5YuquOo6CQk8O2GqxCygE7BIfXDY0ue+adulEqBD7/UooH4XZNnViuUsptzneFE Rc1EFdsLxeraTEnKOyLmjT3Z1ZxuQ6wXwHowkA5F7NAhVQhoeYdgaZ7clvHlBukJJC/yw2Gu yxN7tf5cL0urlPdtFqClknR2j/+DVNd9xX9kGHZbGRbZGvdfuRPglLIK1q20wF3NThcBStOw mUEzHJypIjDYurWDPtlBoGw17Y3a2dXvP9lq5SzWkXNn63XCcd/TzVOmE2q+v6rnclUc5hMQ J+VqM5ZLdn3L/HeYvF2LsgRvotwK1pLtasL5zi6XFWbQgLBoH32+nSCdosFyi30q2WJVGIG+ qgiOowO5UmtN0j7UfEx7YZZnNob/QWPH8W//fHYYMxlTo/Mf+cswhQwGgTcgwNCTBhjGfUzi jlhvaqqSzCbGEzlWPDSRGCWXd3+Wh1iiQ8A1BqIAO9eKuNyWDKiqu/oImIqMjdDhd0vcHEWL NR6uuIm8u4cCs3KEDHv/cGnPkP07v5Kjr+2Gq05k76y2eSWp0tODtKGgp0j2ppKS4+ugwExL s8xaC4608ODlqBM73wTO6C5srWlJKq7dt9E3b+CcGtXSuycchoyTC/ZjTSPsbbgCh2T+0GSw Cv+uuYkEREQJhCar9Bt/xYyTd/wYWRwXPIRASkoMgfb+Q6BEMnLev/KPpoHev5ShUkkCmR0C zrGvdk10USefcIdm3otVtIx6VtxUnrbZd1K7+YqsyII6stvXugG2tApDfZ/UPEIy0S2Uf8eA G8tN6uDINU+PFgdGa95jiBCXJiFMHXWWSzBqssZ4oJxErhNwphACuIXb1THy3kY6ZXBqwxH/ AYIwtlnxgcvEFSBEUwYIMuWMd9mcPz1AIOTyTryWAQIB5yVAOPaiWm57lwZycCrOpHnLT+PR lztqjvG0QnL823G6VGbWFgwbnLxeJMUenrA0gZy9NJJ8/6+y6uKkIKZVtFONf5KjQsYpXLk5 ndCmlhOGWgAVJi315lL2amEMwgRJKA11G4SEAwxCPKVBEBFn4Vl2KvFTK5C4hDIqO5UJS1OV 5db16NT1MWrMWUTAesjbJyfnOiTt3VBgZTyj6ZhJamSvPWNFCZMJgbXPHnITF33a7n/1iyoU EoB+5+638mO0ZsIgaHD8oP4qDThT9oXv/9p3sSX1szm0e9PyNAaT4rc23wUXGaUqAg8ivVBy gTuSce/YcYLVNMRYR++TDp7dmATcm02x3y4fy1pkexHGvwgCytj4wCE7L774uFBFnhUcwv5u 6eFL3ydmJE2sScJZh9Smhn0jw9UIGtlm0u59g4IvGpKg3v2RFGoWCbh2Ajvz7wmZmEgn1EBt ve0njOptdnRjyauKWevmP7cmmHs/TcBrZBSCErVTt10lPaNWEIDOZVngXsVRq6LJEO+qtK/1 kS1fh7782jtvBrdOQ36xJSZShXbMDXfXqKPcUKV/3ko6+q83kRJyxoRI25pKqvkBS+Y+goC4 4GDqkk74hpM8AcEbRixNKWnx7kB7u9jc/T1I9eFo/RUZZvmXdXoXR7W8wAYC/iMiN1Dv3pgk QOSRgmqWp2rOGjoRSyEwLMxQ0M/TpP/MRIOdcUv33qy4cjF6ZxehVpnCnSAGDiE0IOCoGx1t a3pSrFndTbnSR5dT/BtOjoV6hODt6qHUWTw0ZIOWfImtIWpVW9SfNJGRkcpsUUmNzZI2zQEF t7Tu7Vh8y2HC74SUw/+wYwXMbO+wSz7ON3KSoFV3I48O/l3nCOdQvEcgjov/nXDm2CJVa504 mxiFC1VJdaHKe+FiDDcOL7WeVBRiKxM3XFVc2y6shcXV2udNJSUwqevssWaMpzoLtXQ1VtCW 3zdyqPqR8B5hRSwRpAisIptPr0TA5ni9x8sRjgUUTREAhMD2uMVsTPNJ4u3hdH4nSHUpUiwU prTYZfptgmoayZTulQDAG7fuONaxi30BzQ2gTnuyQMclHjbmwdD2qwkingjqbAi1uIzAcqIw J4YEfd/02G4WaxvN+IbXKXQ7cKt/4t4SMophfomhT9DZIGWa3AhdS27mXE+SQIVYMSYF6TZb 8+BSxKQJ8j86brw1YkNPcZiDv0/CuU6lKbwXchX799gibB5HwJEe23SJXK64I4/zWPN+yzIr HpWX9jbVTXNLHq3X9c2Eww7tLAbvq/foaS0y4O65aOXI4a1N2t+8316OWG1qGrI5523CH2NS a8TLCv7Pxy87TqPjJXyUevWxoQ0fbZlWUJWkNHEWfsQKjsa2YLYjxmoNtYWFrUTIVsjtFJmV tcWl2aEEdbSJVMZ9HYf6X7Jw6ZaYuYsyPaFicY8cFBs2gftYLmZh/qObyLGEUjPlIFu9hDsd FIrgeG3YBb5a1sSVky+5mXN1McWLUGPDU/dw3+3RdBTNTSYczAQst5JwzZEQw/+dUaVZQo56 SLZu0j51PEyZ6jbeOfVMfGslkSxOSHTvSy+JmAxJOO/d6lLOpLrc6FJpc+BuuFbZvr3jlzf2 rVWR30pX3DW+S9MA50NF72HEmPkvnDWxEQSt7kF4b/oG7Y0STcG1ssfNOWAr5vOgrg57rI/N ZaMx133WykgvzHHvTvNZSsDW74GJXtYlacbV8B6TCGRS3UPHkTW+ykn7IkeIDjo5BPZWqmXd V/k0vIaKItsO2Cl4S/EL2+bIZv8n4MdCwciV2p5042D6L7GPMTt+IdNiD4k0Zqm6ADMcCWzF Q8BdihnmZnqTiJJiguSehqwXAXey/6xhOjxioIGVqqLlzWPkicTiw7zajFlh1+KP5nPy32CT WrNli3PbF5D8e1paQ5udSylSQCdgTcH9PKtrmfPa7DoJmGg6XlvCdQ1Oiej9kJNCwJU0Aq4Z J1JOjm7so2nGBC7gOeGR50ttVeAEOUsJJB8xboJ1855AjIEjImRoYnZ6CTpv13+3sdeWqjx3 E8t97z9glz2GqU2H1B09GlNUdRec6ESCrwnoMlEn17wqkmSC4EUJSgbvm9jAQKjkRoMl0+om UTFY6KPapZOtgY76XDEIGA14vwPJtYICHreME9wzi8H5caO5cm1w+c26h7Zk0PrZuf8767ZL +YXUUDYpd6NN1UsHruVHvGc15sfdettBTrUgP1fGbjVBZk/TOpkgn5fArQJqISZHly0t4czQ vrvaCLkbCnX6B6et2NDEXbC5O68vCv+XuRX2h3EPFTfZzgpQbG0/m7SmEXxLkobQi9AtSdYO ti9YOBgTV0qbw6g5kb4ODvnica5cxb5lTuDkHU3mourfGx9f4Cs5nOwQHIp5mzQ+SVCYFxTt FpLYluqxro+zU1h1Uruq6m3TkvNZthpTl27JUeeipuR6ncOLq0JYYEi2JykHHFe2PuRGGZtj 5+eExO6ZzLKyLp39hE8yAUIlRqhf/If8GqqFHNM8AbuQYEf0LlQ5SmmWjgRV+B+lDCHB9/Qo kac2eDoOlBFXpIGKJEur2zgN1CmXTXU0fvKDmqvUx4yBYsK4YipOwdk+lfqPv/0X/vztj6D+ cT33xE/zlo7Cz5Vbh5zFlNhDkgJUD+axioR6BYcig5f/fPPqX7fBH8E33nQAKRGz2gjIK/zx BxZh728C7FszsODti3//XwAP/A0RGvwo3T/E/h9voigZsbRv/DevfvzPqx8D3Bb+1rmA63IE 6pB1TnVaHrvOdQoFIyMNhjc1AS8UxpRUlF3ytzZUzEj06awfMdoBq4JqjzdUIIcrnyTQ3Qw0 wc/q2Mepjhzny8TN8WA2j9lC0ZBr2SOAEo1myo20ui8dL3DQFLZD9QctRMjSmILutv4bg4QJ RgLp7+hvvgWn9cYM8R3EYsbrNZ7ralnVTxjHlLv6lZ4vE/Sl5OQUn7/BXUjYkZJAWqy3BzO4 EDgR46YXZVMOUT78gLkCr+LEAvYZKc4KshWb7s3dEYgpfqvSMFU7NzjVYWOgTK58V3kYQee4 J3s1H7vdIo5x3yTcICbmc/q8bqoJx1Of03+GSq3g1tM5qqQaH4wUSCn4/uYhh3rPCXqOAIKH kHoiBOgNLnyJIKOIRfEAHfgCVMaehiSgPxhpHHcaxqsO7f6dfEQRHOtPTpQvOOuCDxuUa7MK qlvEyM0qFXCnXxppnoNYBpoEIhVlnYWk8T7zJZDMASp6kQYEkmeZuhizDiSwNxxoq9mDM8HQ pNZwLYaAbHME/mxoiEbbjejdVLthvO2zylT3TJk3KJ0wcnEMYTPOsqQKejsNmyynJaUqeUda UqHg63n+RLfHLcBF3Z7BOpjsgCWUMGBZ9JDiY5YFl/DWcwTqIZfHCAQ9PM8TqIcFHCKQi/GI oPeMSPlgbuVMoFRADRwBNIxaOQ9ZCCyHI5C7PVPPB5ISXEsCyEWseMQ2a4seJBA4qkvgBPAN g5bxEF/OeJwnKDT2FKSSDrlNByezj/aRN1wV9uHSFAN04VJREME9TmUcCAGJqiRlfdk9QdGy gz6McnRD7NMQpXJAUyqn8aCIWR9SwT2WrlSdY6cv/B4jBpS8JiklhvugHYWX6D48v1hmyQoS ayqNShPBmVf3abTPixkDrWQM7dOfHLBfUOgrSIIO2V4ULepje8XS1S2llyMYBWuCakXCOqKX UWAJNLAkwTxj4VdqElhH2W+/GoXzWZDAnjUqYg015RfRqEhCyCYN0egk9smN63fypI6gfv8y kweBXEqD+cUy+1ySWN96njH4NhoSjDHmecspE5T3zZpfVQK1dDFVVickdSz0kj5jgDUX8CYC eMgpSaXgfJySkYTu7X+6E+oWYwJHqfIMnxz3JJa3b5gTe4ZPDXgSz5AY74A1T2V5fax5LUG4 L6IcJ5wgKVM8vAipntaVpJJsPnSlxJmhs6QI6y+Qynnj1colQ+gq9DT5NhKNS6inJtBsu1Xi 6+Orq5F/B/5KzW7eVTc0bB3+4gPUm6/g28Qe5+3vQGouv1VX+207tQI62omqh4D724LaX4wc ub4Kd5w2IMeVppQ2CD7o/wFfn5ztDQplbmRzdHJlYW0NCmVuZG9iag0KMTIxIDAgb2JqDQo8 PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA3IDAgUi9G MiAxMCAwIFIvRjQgMTQgMCBSL0YzIDEyIDAgUi9GMTMgNTggMCBSPj4vRXh0R1N0YXRlPDwv R1M2IDYgMCBSL0dTOSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMv SW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyAxMjIg MCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9U YWJzL1MvU3RydWN0UGFyZW50cyA1MD4+DQplbmRvYmoNCjEyMiAwIG9iag0KPDwvRmlsdGVy L0ZsYXRlRGVjb2RlL0xlbmd0aCA2NDQ3Pj4NCnN0cmVhbQ0KeJzFPdty20ay767yP6D2idyy IMwFt1QqVY6dZH3qeOONVOc8xHmAKEjimqYUErLi8/VnugcY3KZByJzhpio0RQ7RPTPdPX2f 89e7an1TrKrg++/PX1dVsborr4Pfzy/vH/44v/z6UJ5/KG7X26Ja32/PLx6vKvjoH2VxXe5+ +CH48e2b4M+XL6Iwgv+yLGVBFMR5HAoeZJKHkQx25csX//v3YPvyxY+XL1+c/8yCPLi8efkC RkYBCxIWpmpYmudhkgWXn9WYXy6S4HavHhvc4l95/dcvL1/8vgiWfwSX//XyxU/qaf96+SL4 6f2b4JyYxI/3VXX/mZ7Hz/f31bfOgw/mwbM0jNOAZWEmcRqIfY30T5cX7/p4HwlNRGmYMALa c5boWfsssiSMc7VXCrgMWMxDlgUsArxbhOeOs5OD+Wkexol9Hc/EIriE14uALc/iRbTMFwI/ jeFPjn8OF/sIlGQch6mkUDpzCyqbAMVwkv8TLbNFGMFUQ75MFzF++nEB7yN4z+ElcolWzHmY 8ZOsQMxjElSgOEaoD1e/L6L049IpWKEWPqNmOGAoDY3nPExFAy0P88TGCjNG2TEyP5xeCJaN luGbQYqIhwnJe9ZFiBOAUYOKwwjWfbwIM0YR21L/cCZCKOmC84uHYgti7v2bd2+D6Py/i+1t sCi3Z7/8uPw2WQ/EBMtoQU39wyy7EyVc4v7EIQ+Okvw22JkIRWQHPloWB+AYU/AIaO/vqzWI oi8gdAp4Lxb3W/coKNbm+bwZ26iAOaACoXnJQgRChiIboaXOKL64g8Upj9sTC+BUKnFFQn5/ 8cE5RMW8nJMQf3YNjilZlJLgdkhtn5dnyaJ8ul+eZfqTT7DYzmfOpCJHEpUbdRrfA1zEQKEk F+X18ixVeOT6ixs8oIEY8N39Mlk8mh/g5w/qI/xrvYXfr9YPMLNNuX+FXz/dwZ/rFf6DnxRL FulfuCctnotQxtR0rw2qX3CqWz1VhdOV+uar3gD1V6W2xTFiQubq2KMQc74OImZhTK5DdQ/T h43D6W7KL0iMG/doZEozIdFAAruCl3+Xq0rtiRI2e+c4SKGMNEbh8HHhHp5SElKa45CLehyk 6FAq2lSfPcALfquZqdqrb9yvSB6hvmjDEM5/KQQe/x8XP7kGHUdRyEhxZFGLj4YnQpL+nC9s HCVhxClwBYqba+Q614D1UQ6WzljVRLG+voZXJLJNeQXsDqL8Lzzg94F7LgC1K0kolN47B6fg xOQKKLpqeE2fO/sH/GcFryB44I/NV+dIpcnEGrgndpZFSH52eO5Vi2xqzas7ILiiClDb2dWa pProC4q3qtgEN8tkKAobWk3tpIpjgIPKB+ClDZ5jeG5/bg90JTSdH95xmKTUTL9zDy4LBZu5 jzaDgfsxGJTenoCYUdqtaBx3kTIRWbC7bd//pp1dsFPfOac5ZUlFc1Fwb0XkIX/W/LdAmcOD fcmE/qI+3EEj7rBHcYWUXSLfaEVNj0FhtSrhdb/U/4OWfki6449hcLmrTV2Fw0rJ/H25egRQ O0/ST/A0TPNv2iobTQuvNJ1kDDx301i+90DPmQI7E7wvep43d/c2cgaa4CzgNvJW7xvtpWgP ds1CYGBe6dFDNjLW6n3LDcCR1y0H2pgFnpAYbb1W4whtveE3ZNjaWM68cFgchXncX8JnnRPS p2MpSVgox2h1HEv70ljbXlwfytaIMwqPkfEJFrBzzYFJhlRux8GDtwe1bgLcE1B1UlP5tVG8 kP6R1HsOEdeo5VmYphRqXxtfhGbjAl43AbBVgqyGbARcVe1gVOuqMV/oWa2K5nzU/if9/r7V EHHUwLPVuqji8Xm8We/VxxW4xWoUNbPj29dLxvRhji/lX2b9Xr8yj0dx1KoCtTPNtU2figlC w1Xa3CD2m81aiSnE57b1eKG2jhzpxTRNpPpiJg8Ga63bKLRW97CguHOfzcYh6kqa1itd3LZa TKkEbbvIHbF/VW9o2jM/GvHd2h8V8MJdu/sIVRvuuI24YqX23ZptrQJE86ZjxaT6wfpU2SkC 3hqsNKWg0EvxZPjUkHAIX+OYf+Bx8wR+uaw+i16ZLwvntCPRKWPfI0S3UMutEAIk171D7s6s 4RNwSNalJrD9/BCTyGz+lYd6sdWrVpNrL2/t0HatPGVoiRC4IJ0UaKQaYu7IjTlm7kiHgBlV Xw2R6TlqAkSh2FF+Wg3nsaG9ruzJmu9a2nfth8/iMIqp1dFctT4u0mZTiCIFNaeguvdu6zwW ApyWXduWHIHXt5rXnTsMlPAnV9uDfyIOc3LeM/TO2K8tx9Kx3wT82nXSQXhkgHdsxHGMLlrh +jDbOD3N3zWfF1XhXrdkDOARYLfmIKgC9GCUa6Mb3fpR72MGkU0Cn76dVyn1wr13N0dd2w7f 06nDcgZZLgRQkOztpD/r4yYfahxtrBmUCcimMx/p09O5fOKZDIWYySA2gZH4FRhR0rqoxgKD exMYNrgeBYYdXJdzb4xasNl89aIYMJ7DoUHg8sno91qnVCpC4kt8JAmKDzsig6yFXCuX2i6s lGQDWynAL4svKO3ca1BS8Uw6jZ8HDZurZQFWtYO1O6H7plZtSrZOhqKCk8C51SJEjN6vWUxk EyqpV6ES5xLoixIqwpdQscL1J1QIcCMiWN+YHKI1xB2SxabyJGFkCtYsgdgo/8K5WEEHDAG9 7LuCHpoAqM9sDx5hRi21UTXjugbKeJiTQLUrrjD2q57+rfbKZYMDSJHNrdmvouN0wd+vVjqg v1+OnT6wvI3ILrWocu6Bz0NOTvNprdmgNbbdy2uh+FDE02zYumyG5+tGq6naq+XcrRQLJZFm CiSbgM78CmhIRB76u1oBLb0JaBtcjwLaDq7jWX3QLqi/UOPpOJj6GRzAeNdGcnnhJpZmELAh MH77FlG+0OE+MFs+OZdaSjnN05PtEBc8lDkFTkdkVm38ctdoXYTGBTtk8zCjcec8uM8gI2be Stl4O/cZeowTHmbpCK3X+6AIzEqW+0eMMlWvPEQeJSoBdjRuOs5Zf3oIF2FCovDQepQHSdvu 9SERMgoND9pXPDHrhmXyRXGtY/jNKnT1hzYSZgJQPSduo7QYTrQk0VtjSd197zrloWxRn8t1 gLEbnnTNt2pllNFELdAAYx+lGDKC+i8KA+elGDKKIRGeADdVilEH3JwrRSwkZ9+nJCDUq9Y5 czeIHpmsFXtSL5wGXk7pWsTCPGIyx7lxLx5Mbe/ExZxLwBiFsA3R4CwKWcRR0Such6GYgAIn aoncT1SkQFJ2aD5YmCmrJyVJoCMyQaI1Sdb3WnA6N24F+MMJVI5T4a3gkpCzk+0sjzI03e3g fn40B1J9aO2aE0TnHexX+oi/6obBgeFMCir++UYx4qZ4bAL8WvRjNTomJAh/wlCIHEpliPk5 j9gIycKMWM7W8LtzbghDMZYgqaZdc2tgPj+hsiZ5hFr9ichbKh2V3v46CctHeRa9GR6qzzDm RYA7ZTWKhCpk4jz0kCQgIbWZnPicqmcXxe8T7h8RgTCgpEDszf1jg+vR/WMH97aoCuPo+bBD 1ReC5GtMPHOvEcUxtLM41dxZnIYpBc1DrVvCgGyopf4A5WfcPYdBAkJ+ujVV9AvqtB1ce0aZ fItR/kejl2BySu3qPy5bQae6ZR4SqpTU5iQFzRFenno2NMKL5XCIUcIr8Sa8bHA9Ci87uEuT KK7NTdCgOvF5ncW+AuJwX9JZBxdPtA5MYo4RAc6DJIsFVJBOrbuupXVfCcWSdGKq6JTSqRZN sNBDGTXLU+geQeDwqTFpwcny5D5imoexoGBvdP3Bbeubq52ErrGAvlPpyeibxxLNdzu4JgkH DpI7cwb0MnFK44XtUEgdCck7WTIgK74td8V9tj145ucusfVs8VveG0cpZPdSZ0vq7WyxwfV4 ttjBvR4lFIB7pK070an2+PfGh/TNs5MtBIuTMKag+ThbcjQIiXV/o9jR29miSExQkIvNxiQb njFIhnAu2VMM855oWzlXD2AUuLJ10Nuzj/oCcZSpY1yHU9k6SVc7m5WoYxXptvyZyhwG/6Gs lpixcO5mWqW330J2mSdTWS2ZL+lthetPehPgfrk3xeFtDAoE+Lpa/1+5NSWcPqQbNuyk8PIq 3WDrOQW6tcxLrRxpplQ8n3nKrK4FEIHPOPEIOBpjlvbkIz+VaQR2xXUTrzRSyJZ31ERSnp2j AxWoJ0jPkdBtjiQJ52ExCGpLEtwcoei1E4FMY1u0/aIqUJkDXlCb0HqpnFtVudQy0o7HyAfm vHCLQwImAb2T81HnvPTzVDylJ8XQSZfCaRzxAhlRiwv3KUpqe5TVT+Dyyj24BJIMCXAefBo5 aJ8EuLq0fVTe7TzTUYJbgUDiqdgHqLG1ZpaHehp1SnJylzuS+qamO0+t+kQk8Pyx42FcmfpQ 0VUT65V7/7aEguFT0aAQCbg8puRf+ScQACr5a13NPmyy4N7JDxHK0zGiyBmcjhQBdpOtlWrQ lOFdezkSpEgmcNEq2pdOiMW0MvHXwlKm2cSJoO1Q9N1VQdm68+68aLC12pBIW+h6dDi5hp6m 2CCdAL92DQ6aRh6Y7ca9OFZnLjQ+I6B6qkpiUQzRGytQsJFZmumUQC/F83lGTVf7M25hzq2f G7sdKYZrsoR32qr1UAbLOYVYnfaVoyaI6kFbqTVymF9c/vbu7U/mK82y1V3fIq89p6zWMG97 fbd/d3/YJqh3EKwUChBnzEdxhBQU1D/cg5PQaJHcQufgUghcEODcH5s8hxg8AU4dVXLcHypZ DAwZk0v3zngyLVn7ulB5jbKnTY+86PbJ7LooGt0ZfvS1cRms3Sfl5RgDJhbAuS0fR9qRdaLt jSNFvBS0Qa9AP6d8zG05HoQi7v4cjLAHJ4HFbNXY0khW5wDf9L323Szg7dA5ZQrIOj7DfVlX 2143YTDNDZ/NL0w1btY6vv52iV8jnlqDKCqN1W/qMdSEtGfyb+5LQJQ4TqklbpuuIbXhlDre yfl4ezGcgT0yTuFuttsPZ0hmi1APHbhaLsLsO8QFKRLO3WgsylFXsePlPr+u1tns4OZ4NV30 uWITQRAegXYzwOz7KEqzHxxHeeoLdOwQfbgsIzzz7ODet/HIOkkDwz5IiO4zvmI8oE418TgN GQVtdBqAWNcf9gWR8zKUHHrCEFh9F2gpVOOV2GWja5SU2ZKRC+WhK87UCvR8N3WUDdfkqxfv hGB4oQ3FHBcfgoemtWhbSYq0snFf2pJgxcip9kFANXFOgTMNSYuNj6uMJBSSEqC7/in3+osI c3LSA/2lF8nxpR/IOMKD2I4R1qwW+7KOwOcdt77GqlODrxs96xbLHrTr5hyJsjCxeJnuBohU wee+t6J0n+OlawUIjIy/ZbCGtUbVrmHX71JgTs2jCSA+6Dyae3NIDqrRa0FlC0M3N7RdWxzA wF2aoNbQc7/TSrzYPBX67D3z1BlEgsjLqVXzVEAsubKEGQUU5qlVYW0mug+qyzSUJKW4n63E 9Lx54KzarosmjRParsjUeoz0cJ/arh2iN23XCg7vY80y7Zf+9cF9kTwPc2qiXRlSbAJTbfwf UUEjiNETiH6nUwzbbghrQD2fxnzXN/e93R0FmLOT0RJcg5wLckd9ZVUJpQrIlALbV8x67fix +nlTp1B1LlkY9OXvNind6/G8N77O7gd38E7TQjIOVljSsTyxMkQxx5lQF4C5qbFs0KrLLy2V CV0X3nZYxN+6794sWTKu4E/gZ6gdMvNO6He5BwspiyCrhZi4L0WUqx+kgoLa3g3S6WsLAmtI DUg2pqmPvm1IW3AttT62bs7OVUPbJoe6znJGXUB7Dter9iov5/o33p1ETHvAOibNuyEt3Q/C A1rgrFRmAYFWh2B92GcN5yXYNndMCs7BKcqjoNVM6PyshnoNAmTn4hsPVYgJhIQOQ/bQPSyd gOxc5WZJTm+qh7xtjuxiBzdhzSs2stmHFiO7NfpsVm7SGLk66Qgj9eXOHM3dqgx4TtO3Fz6S Y0Nx18gYu5E4uIepWsMlOXDZT4vz0KR65SkdVgsKCKnYzToU9dD6u7lhaA8rBtrLeqUPb3Oy NE2uDtbU1EI56+RGUI87fF+vc8IXIoJyFmJN5hh/nppp60iUgEaZtvCw42VIeJhmJLhOY7zL 1sM9P0zoMZWRpRFcxUsg7kFyCXBiEeA8Ne5hWQw++JPNUZkyihcIcGPN3PTH9VJPow4IApOe HdBv5LUPEniPmj93n0+dwH1+BFZnPuwLRu5+sqynWbct82BmRGwm6VnFo69W1hFmUUJEKB+n B/zzV0zD8HQVM4O+8iRsD8e2CAUFrdMRBDUS9P80boPaAfT+HTADjnzvocpCk6cdPZNMtFlX wUOjCbR32K6xBs6L55xLBneUEYhhaLBxyvTv89N9BZubDZ1zc4ZOsRPRDle7k5O70+/4ay6O GjbbC5asTYB3rX8pRubpydZDKMsjzQ+sR1uq+ITtmnpJykk/R/ks6ScpdzX6sgoUsV/5i4fL LIdAyaHZeHJ22KFCFN6TBNT+5CFA542TGYOrySlwZONkD00jYgqJzpWoWECWDFuednQyf32G OU+gwI7Akb4hGLQ195pKIiF8RyBj01QUzPoSep4yrJBjKQgH9RrzDsihRkM18J/1sMniyAiU y9yG/4TZNVzH49DgEqMoBBqH8kAd45IzcKcSuIzJ+VhoEsAQ0D4uUJOq8+8SW/qdcUBZbr3+ Fc9S0M2yRjX7uHQ8AZFjX6V5y9UwwfnrXbW+KVZV8KP6C3+gsBBSoqaizBzFThm+RDUf3vx9 7hCcix5Sz2U4KI4SaODQeU6keODbRjU46cVDnNql6z6mHQCP6Y8ZCgZ9kQ9UT6lfwlApacnA qb6t855GZ8rDxYHq53DBVrOxuKdvn9nL9Eg8IIMnt6BBc+I3A8JbRMaQNBdiX1HXIDMBSSAH J9c5PKB6HkRlA1HJ7+wwjVDtMec9baLVEhZXj/E/pmXksTglKTT2m0Mwx0JSVoRl9pBCIoXA DJKPi0sL1RwLN+Mgkp5DNQJqMnIDUXeoOEg1VOO7eU+bSKiNIYnVtm4m9eb1ajX2aB4LVySQ zTpet14SwDP6zx2LT5pAoukcSj0aklLrGSnammZwjqHC1TPMJh1oOpVMQmCkhqg0sTSaQadU i695T5tMSBQ2/A+1vRqu47F4KDqJbAfTmE6OhpRBXIOik18IOjkWqlI1omecgn3t0Whg0UGt UA+pT+nhoLotTec5Nn2vEd3No1B0DwcB30Ts0KMa7qofpblrOAiWVopDj2o2QI+qN4BSaKcf 1Syn3kuj0MrxQrUjGo1WjpdgclAzuclBDdqTg4YatMBQf63/82jStOZUM6xZD5tUJ9NMPV3A BdyaqqNQidFgd9u+/027ryzhgiOhK05W5DQPumvYOpQ3C7Yt7t646SGjweiRdeo7qIxXenTQ toHre5LxCV9Muux1G0dG/+iu/XqlQGhrupdYkEzcnoWPwOTHxyawYLs85LgVlCIKE9FfwedL xBgDRpMSUQ85IBHb50xJxOZRkxJx+lFG39CPmpaI048yRxKOOiARpx/VLKfeSlzOdiO7j2kH wGP6Y4YCirFnCCiqrnXWwyZERBKqdQQl5xCXUiHNIxFQciKdiYFz2HmEpDZ79t1bxI1sMHX+ 9pYAbUJqX1LZW6PnBzORWgE0kGH7bs+MKXH0bYslWYaGyjds1LSEEuyghNJDDnjy2udMMbCe vIWBzYBoCp0ZQ/QaRzMwbnEZywozJpqa1bxRtuwI7qRyyJLOpaUsV1K8f2odFyyzQUr1Uo8g rW/rUxkUhhgjPmdKY+DfBZia8VQ3reGL4FOpvv26PMsXwT0qFP+GUz1dVBjP+gLf7oPHbV3n ApUrauhOu7EgthVUdZBWfRXcIG8/amVF8fLDDsGutxjO5thFU0L8DDp+PNWN1KC/yR0Uc0Ne 5rL++aZC7NTzXa+ZZDlcRTteM7UyTEmszw9YGwohnnF451jYKXbaH8Mu/3xEmbeDPD5Y4c/l Vhf1omh0jEYsRGhbgRkZRdxrwiVL8da6Z6LkKcmpRimJlMR7LkourhlXsGMCJyFDMXAYJkoO 6AvkxHEsYwML161HI7jHZojYIOlkgxGgD+4BcWTFEaSdElZap4Gymo1uRuQeegbFpQcX1EZb wsX9hAonCZ9baAvufu3RexzCIgh8Pa5nnQ0q2MhWsEfT1ghUTVsjSG8xPlMtY6xeEIsPO2ge gKK3VO9WS1mfhvfHXVBowwl6nGTs8PStlODpsjdNCGpjRDI4H3k3Gf1Q/PMsHvgjBpltgSlp u+kXcpBFk6C5lBvnvRG4xAzv0YTdJxPLDK6dGgF6bHosXPcXQq+BKZjRNYPg+WnjMtp40q0X AigndJ4zCXcSxmyMtPvsQKkeYNmG4sGU5mAV5dfWHeX8zhyoIYzSU0xWaTqxhRTa7W27Sxry WK+KLncZXhn54rodI51nPaI+NEK8y68YKyyQq3UTIOe9imOGHXX975OWhVBZKvsKV9Ozd1Xs nJcDZWEejYDWyY/rTvH5Va+Lrc4wwLedZkzoB07qfXDfiAnU4zgb4+qhRpKDvjYCZDsn/x/s Rt+DDQplbmRzdHJlYW0NCmVuZG9iag0KMTIzIDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50 IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA3IDAgUi9GMiAxMCAwIFIvRjExIDQ2IDAg Ui9GMyAxMiAwIFIvRjQgMTQgMCBSPj4vRXh0R1N0YXRlPDwvR1M2IDYgMCBSL0dTOSA5IDAg Uj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJv eFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyAxMjQgMCBSL0dyb3VwPDwvVHlwZS9H cm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50 cyA1MT4+DQplbmRvYmoNCjEyNCAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0 aCA0OTY0Pj4NCnN0cmVhbQ0KeJzFHV1z27jxPTP5D3w7qRPTBECQYO6mM0mcpNe566Rnt31I 7oGWaJuNIqkS7dT364td8EskVlYiQPWDRpIp7mKB/f7g+atNVd7ksyr46afzV1WVz+6KefDx /Gq1/v386nFdnH/Ib8tlXpWr5fnl/XUFX/2lyOfF5s9/Dl5fvAn+8/xZFEbwp1TKgiiQmQwF D1TMwygONsXzZ//6U7B8/uz11fNn5+9YkAVXN8+fwZVRwIKEham+LM2yMFHB1Rd9zfvLJLjd 6tsGt/gpqz+9f/7s4ySY/h5c/fX5s7f6bn9//ix4++ub4JxYxOtVVa2+0Ot4t1pV37sOPlgH V2ko04CpUMW4DMS+Rvrt1eXPu3gfCU1EaZgwAtq3kOib9lmoJJSZ3isNPA6Y5CFTAYsA7w7h Q6+zH4f2p1koEzsdz8QkuILXy4BNz+QkmmYTgd9K+Mjx45DYR6AUSxmmMYXSmVtQag8ohov8 ZzRVkzCCpYZ8mk4kfvtpAu8jeM/hJXKJluQ8VPwkFJBckqACzTFCfzn7OInST1OnYIUmvKJW OGAoA41nPExFAy0Ls8TGCgdcZceo/eF+QrBsRIbvBikiHiYk71mJIBOAUYOSYQR0HxPhgKuI bal/eCBCKOmC88t1vgQx9+ubny+C6PyXfHkbTIrl2fvX0+/UWcyQ0YIaqK+xBL7Ip2fJpAJG zIFRg+kZn3yAl81qGpt/FDN4xbflanoWT5YvA7j2slhup3JSVnB5+QD/KQJ4neftD7qbllt9 P3y31rfW3w7vraU8/Pf6EcUEvC2W87X+EV5dLqttgMgu582NvkzPskk5h8+L4hpR+y9cW2zD o3SYjYoilaGUFBltimywvczB9gpyd2MWijFaV0eRwQIt0QyrSHB3SHw8Ahd5lbf7+AE2XE2q YlbBAdJb2J6K9TSZbPBkLeFns3IN/1/omyjzfbHIqwLebKf13Src6MD10jjTlJTU0qqvK4Oz a6giDllKQr2DpRo6GJ5qmcjQyz0+qdhHhbuOyS+vpiya/KbxQUPn4q3Zbsf4CK1lUxKfL4gO YJUYKTGHF3y3WGkr4xbePXrZOKFYyDIKsY/uwcUofuzgyhD2QsBCmXPIWqel5EJ/dw0ujkTI yIW+dA9OhhmjwDk/NXGkQkGCQ0ZC2XijxR8eY+R9POY5yk7Zk50XJcjE2QJFKry9b39RuEZc RiyMk5PRSepTkCkKXL7UUmfuha1rdcozsO3H6lRTPf8C5F6jqtsYywS251YrshD+7xwlpo9o wu04oX0dx2hgX905h6xVIvgadmo4P2OMs5ATC/2oD7hzcGDgn3B12jegoLk/NEJfSdIy39SW mmuo8b4Dg2KsrMpbZCNt1WUNE4PZ31PVYOTdafVtDI1fLz8E7zYoApH1iq9oTaKc++zHKFMy jBm1DG3agrbNETmLaeta/8ZpqMTJDo6Q2t8lz+m61TDllNW6qrXZX7QG/1e0yMqZc4kUM/2D 7GTEiFmKto8d3EYr6WK77rmx4ASDy/IIy3ePTaJCSXJXtzUrrYoeUDPN0T7eelDP2hkm1eR1 a4Qbf8GXkmbalhoBf9MEDGo7Co6qIYP+ItVblC/K6tG9pkxDnhAouRezLEMxa4WW4zr9WEdM aPlOwO2M16q4hfNvxIQHWqfa86K2/7jAjxWawKN+yM7awj7cQdgn1ooVvh/zQJLFYMMM8ZIh 0F6EJsh+DEVsoJVWSDTs4w6dDR5jQtOeAIf5lY0+9Jm2EPXbdb7RnK7180wLguPOnhWXTIUq O3DttvMgfIYBk5Rr/rS6Lb3YHH5G7jSyAlxH1B61WQjUM5r9Ef4daNL29P4wTgfkNy6n/hnK W+MWeY/XaR0kUmLJveVUJSIb14vtImhIkRywfui7cX4MyjgUgsAVUUCE22Doynxqaa6NZfeG nvYQtKFnx8kQg4pC9AO4+TVQFb7D6EMVoI2O1uG8jcgtimsTokuaAD2E8rm5TecDFK1fv25N iM7OrJx7gFL7t4yggHujRWsQ7cbboAVncG+lFPrxpXMXQvIkjO2gfSyUqzCjZBGGbjwZhEnC II86BAn+46zlqmX70tjsK2O4OHf3BVgpBE7uzRSOFjkB7gC9FHvNPiZxFCY25R1r3Q0CBDOJ a8xxbDDds5wdp7xtuEA8S5LIvGzd17eIEaQV1yuj86rpGeuloDCreUgeMrjDSx865Ytx2rLC RV+j/mQYxsgmS4T1dVHMb7vLV60XA2q4y5veFZvAeDXfmyJ1Tl0IEWckdd1nZGUUgztMwDvg yEuvphiPgP/32mKOZUAaY3J2H+QDrT4PoU/tHROIefBSGZwIAtyhpizknbdB5SntGymoiiNQ 7BSV+0PCtaJIJAU53wlnBSs4KDetXKzTv0Ad/Hx59dvPkPeVrawhs7FgxeE7nynZlIVxSi3N fUpW85sSFLgyFEA8D+lYfQNykc7TsSITYUwsctdsfel+P7WvnZJMcrlubbpVkzLt+XDOLaxY pJCSPJUQi7VaI9m00yJdVVX3bphnmUOGop9k8RCbhsJL8lS2ZSN+zP4IHSub2f9E2khT5HCt CO+6/BSpRV5M1TAHgrmAfq3TqrUJOz/ZQ5SeqyxkgqLPq3us/Lvrx8ZnXZGB8yyWRiKlcHHO rEIylJJ2cAfYholP21AqBbVDh3D1fmulu27Z5Vy0C6CaeBKo3rLoIiz3TeymvIGPg+DO4nGa 7sbsqKAM4tKF0voFGa0Amk/TQfRHv6+djx+DqheQrDbGqWp4bciEeDq1WVpDQ/lePkCCeGkC lN+O8UBa9pImkN1lPcogz7/wUtlRn4Y0AdYYngYjP0ws1RT/de7nYmHWvKmJbxFcDc3qAG5D s8Z+6wJ4PcJ9cW/mRmEmqBXuPSFB2S63i4aCdFIG93wRNl7xDt+4FiSMQZSUWIF7k4eJUKUk wbY+gmdCq+4so2Du8lV90HqFZoaB70xs2INJn4WSUbg1cuYsbo4RsO71tH+S3BtmPIaKVAKl z0Z71hhAMAdoZgI6PuoByLPift2QdqWg9cNUjdZCeb4xMdaiZeambnnoTvoRrYmEYtIhtjP0 a8lIsAfzmEFVK4XO11LL82UrAKsAA6B4emeF6YyYHqbafoDz7yFYkYWKxP5zS0bLkXePi95Y LilcjjmGKMiak5GcIkUg9CK4oNbi3iZO0jAhwR1gE6deSxmkdngztreUYdws6aiUgYDtq5SB APdqNgU/ExgesiG1hSomb9BnhAoHDP1vVgvnePEoDSWJ2AFnQ3n1l1gGzQ9P1TW8mtXEA+oh a+8Wgxlz2cQjgzUw+v7Ooxu8tb2YoZUugxqD1rb2KY8TEUYZRRWTkC8XZYUFMBYzv2dPu7df YzSX7aiN+2+PBpdChJAA1ytKQJrcN+6x3tzFtjkaDXVS/8RR+qsTEicT0GtCgNOnfuw557uu 4YGZc/SPszrqVRp1ir+oCe7JtotUGFnKH7utBqYdZ1EteYy91UKuLUEZQ5MDgb37ugAgFgnu AMGeea0LiGEWhU0TjiS5Ka6vuvjpcUrQWh7AI+jtteIEjTaxEC4yHXbQuE0EOd5qWbWERP44 189UXS9RW7VBbcH2CbWTxsvIkgC8A/IM/tbEp2fAQLJp2X5og5N1I7iHPuskgdgoQYlD+qxd 9NGTUifWRjQb4+XbFCGboJu7LDvY9hyuGjs7RAfvE5lc3321qYKEI0FnD321DDo8CHB++2pT EMkEZA99tRF0zljB+U7kQpNtklJLfQsnzoTuHkwAftjo2uZ3AzNNAOLYYOIWnuJqkPPmBKki 1KOaTKF7MmUKemyfFDGjnK8X+wqGCclxkurJ5PKZtBtZh+VjjxSccIhM1qvpRsusidizk7VK Ce2swdm3U7OfhF21ozBgV71lYmOoQxYUQu7LJjiDcBMB7hB97mJwCh12igUmePaFnWJfYScC tq+wEwHu/Wo1D/TZe2PaOlU96ecPUwmXHXkC7U002gdiBy7feiZcdFXRki/S/3i6jeb9qmce JZ2w0sLxj2JpETYj6861r5coqFAi0K91RdaOLnANPYtCJSnoptlm3SQQR7boosi3aKsmmL8z Mhlt3NaV362hwfhFS0v3gaUE8rDEYn50Dy5DmWwH5yXjy8itKrGHpyk6qAsynNfn4Fifky1Y qpCT25l3VSRgpLg39DkEKQngfVsE7Bs881hsVhs5s644rV/kA1dcd8KoC3jN+yUx9bscxmj6 m5dgxCaUa8ZETq5m9U1r5xl/FaZqxUMTsClGq8opWGQvMAcyNuIqKJ17bKO15SxfNH33u1U9 ptSp2FbbRkrn26AyluhNGxgsZ4GZV6fpij+ui6duypmh4NAp6WUQzSiIiwt0tS9NaxtQ/LN7 2y2BCmeC0h7GHyiQggS4j0i2kMOiMyCLe58V0lGKgu/eVI1FKE9H3FiGGQXtG0sBVR2x6Uts D8PYaj5XCRR12ept56YX1BRw9Soa3A9AwDGvBCYe5i1IGENFgJv1SvQqU5cJ1AcPOe4XW2oJ hda0l5wI07jFjEKxN7Nqj0QzWsJ5spLBgEMCMecSkicJuBZWcBjmaqZleSi3TjnM1SZWuts1 XfOywq9nbWgXz02/D70pTi+2mGvr6u5mu+Hgrlz1Ke1qhtYQd3Mt4mQMgbRTsWms5VNGsunO XJTW+4CaRVT7zmN5co+EWu6GyjTjFR2H+kqYwgTbeBxXHFY0GCPN0vq/exrV6Pi0+aMqR+Nq EMxNmgr0WjsNz3mbbO6Z4z0DV9PI6L7raZPJB1O3bwx26XxjkAGULg/dYOp8jEIGWXaCuO6L uGIGzgQB7pDQiYsBJHRCV2iWV+M43/s2C2/iJcEbmBqtNSNESty3eQsYzkKgctwIUaqtHMSc HZ6HZDHDAQsEvH8s5wVO5O6N1sYmdOg231Emmx7f5sZO2/kBeqHYmr6rZ5Z1k3l/ULeJGVba wOmJNWS7DoZpcK928tB4zbwwd8mb8FCJ3e2ykUBNCgF/gWHy7qZF58L155TXnQ6uSR9r80JQ lHefDDcV3ocdLCuzu5jqQCsUodX7vjYmV3HSti97Afmdti/bQ5021EGmKbUyMKict2PzPQC9 dH/zjAK3WzngvnQ7gtJtArZz45NrronIpXopTE8YBa5fgObc48HSXerI7tR7dO36HgLYKbm3 lnKSpK0mqWcn+6omkdAHSuDlYSQAFq8Q4GAkQOyjkAQzzARQDxMBsG7FCs5/IQlHY9u+VKhk Ktam/DMxnl5p/I+4H+Wo/cBa7VyAClL6wkW/1MQHo9ZKE7rtxmmAy92iO+d+A7SCKxK687Vm 5llpBLiehbA1pl87kFpvFVFhkmFicFRfEvyfRkTDrJGMWqA2eWSvcA6Q71k8zrN5MTRtnGpr BU9RxtnBkVbcCy88JbSBzMi1j5NGtf+zbqf8zHBms+xmNj9RHtT1KeOEci8PPmAk4/zNz4hx ySN0YO1AnTcm1IKQMVvmoy/EG/4pnYfnYIgOJ3HwNhPQPMmBgOqh6VThWbKDG+jBVw9wtPJy Megfco1TajI3dpw8TG+W0G1xGMWtHrSLIXHwiD87E8CTBvjYkpHHllyNwCUwHpKEdxzdrfD0 VigS3tEVdSN42vBWND2PrqgbwTMVdQS4S/fgOD4Ph4BXbe5n1f3muHCXFawmq2afw6hqZR8X c3To4k0uM6g5sxdvxvh6nLu1p3iTgO2reJMA90t+XSzqwhZInczrYKmY3JXFRpvVGQ5Cv3M/ CZ3HAg7FYWSwng0X/eSkecEFFtM/FZz0UfClHWTOSQzeuVfzHNrWCHBmtpnFK3KNRYxNEwQW Hp40JCEHQoArd4e8l4XxDTeQbL9D82aWH9c/aI0dc4hvEig5rxmF+fcROxnB6wkBBDhT/WJo O4qjNPnZHtvdNN5Vl5odlfcOGzpwJFTcpZnxp9edk/DQTQMq5p4czVNRW6QRFAQT4Abj1lpi drn6blQYkhvnEJjWmaKYnjGpv3EdmtOoKpL/PdTq4ZMBT7UfUBqokkOVyqJAZ6pYBG1db8cK ZtpjpT0tTxFGzrEMxtLwDxw1mCcHqbS73RJk5CsIyd9ZY20/mBlbzU+MG2k4HyMqcFfnp4sp DIsQS/NQTSfh+eIEuGEl0Q/be1Os4lrkMqwNJbBwHpbhnMGYJwIcseNb51sNBiUTFBr1IMam kMhUU2pW2tT1r6pR8IPqoj7XteXkRTfj1ZR0V83UQec5kwi6jIk19Z7v3JYsQb2UicRAYLKZ /tVeY53r8u/7Zp5i7wEC9UpN8q1oZ2H5kj3ah4wtD9Mcmge7IdZe3VnVrXYworNwX0UsMD5G 4OzBZMUHFRDgPk2AGihcF0X+AIY6MJc2mz5NfUTFUgqRsOUwn3M14TlaYE6eiPY8YmEkKXB1 VuAeBwNVbeexbUachyIFUDR2vHw4pzxNUbzaITp3Trni8LiBfYTf1w5+wmd0QUuaZBSm866O v/eMs26UbhUsCvhnnUzaBlarD/MatS/kvPiZof9tR79Tm/k2mHVpcJNWbZUFWoRF20SywwV+ 9AU853t8Ck3udzhlVsJnFE9x87Bt58UUkKIRisDLfXoCys0oaIeE0LyO3QOjW3zXw6SYi6lR NF4JB2fsELz+B7J7Sb4NCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMjUgMCBvYmoNCjw8L1R5cGUv UGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAg Ui9GMyAxMiAwIFIvRjQgMTQgMCBSL0YxMyA1OCAwIFI+Pi9FeHRHU3RhdGU8PC9HUzYgNiAw IFIvR1M5IDkgMCBSPj4vWE9iamVjdDw8L0ltYWdlMTI3IDEyNyAwIFI+Pi9Qcm9jU2V0Wy9Q REYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA1OTUuMzIg ODQyLjA0XSAvQ29udGVudHMgMTI2IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3Bh cmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgNTI+Pg0KZW5kb2Jq DQoxMjYgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNDM0NT4+DQpzdHJl YW0NCnic3V3rc9s2Ev/uGf8PnH6pdBPTBECCRNvpTJo4vdw0c7nGc72ZpB8YmbY5lSVVovP4 7w+7IAlKxMpKDOge/iBTD2oXi33+sIDOn66b+rqcNdEPP5w/bZpydltdRW/PL5er388vP6+q 89flTb0om3q5OH9z/76Bl/5alVfV+scfo5+eP4v+PD1J4gT+iiJnURJlKosFj4qUx0karavT k9/+Ei1OT366PD05f8EiFV1en57AJ5OIRZLFuf5YrlQsi+jyTn/m5zcyutnor41u8Jlqn/18 evJ2Ek1/jy7/dnpyob/tH6cn0cWrZ9E5MYiflk2zvKPH8WK5bL52HHxnHLzI4yyPWBEXKQ4D uW+Zvrh883Kb70dSE0keS0ZQ+xIRfdE8i0LGmdJzpYmnEct4zIqIJcC3ZfjQz7nVob9VxZl0 y/FMTKJLeHwTselZNkmmaiLw1Qyecny6K+xHsJRmWZynFEtnfkkVe0gxHOQ/k2kxiRMYasyn +STDV99N4DqBaw4PiU+2Ms7jgh9FAhnPSFKRthihX5y9nST5u6lXskILvqBGuGNQhhpXPM5F R03FSrpM4YBPuTnqb9wvCD6e6K8mKRIeS9L2nELIJNBoSWVxAnIfC+GATxHT0t54IEPo6aLz N6tyAW7u1bOXz6Pk/JdycRNNqsXZzz9Nv87XCyNFB2cQvcYO+JdH+XoHNalntCDJle+nZ/mk mm98ky1ELBKSbOSdHJg+Pco1uLzKN1FVoD4ea4wsSeKsIMe4gplcwUDndXUF/6PpGZ80S+3c 8ar6gHO9nsrJ5/7teTVlbPIB5TOPwP0v4foaIwPefzs9SyeV99Fwpq1ZUaNppkxM1sBE5X3a ONcv5UebNi54nJIDrRcg3m1J68dXb15HL9ZwVU5ZMrnDdz7qqSmMVP7AGA534a2XOnG5xTnc VGZawbBlCMMWRRLrO48lPaEdCRcUOaMh87KprL4unQJFw2j9wALsoPHNKSRg7HjeIJXaG5Dk 3sNAUToljnYGWtRqiHdOlNR+8HgD126XdoPouNa9H7tD5+eZgzaAZzoPGTPw8RYNz2gaqt5Q DY3CwmT8CR+4h4d6jd75Du8zuhnVm+gKn8NH8ab6gx6K9uu+g0pRxEJQg3ninZxK4iKjyPkP mUqnITlFbuAqNlNhzAO15iMGwnbeYAbwM/h+XRmvjPNrraqelXOc4AX6GXi9ubcTjm/tBlYI cbdWTcwn/5ymtFbA12JkN+qlVQJYaSCC10tD3bexCW3bpHoMA1AvIP/+RTvWQh5NZ1LtWERB kZuVME0Lkz8p42fN/IEKVdXgXS2RLrqHcUC68NT17i6HL+obIH3fRwDDXtZnDKlOAPGC+c9Q MxSdm7HYP7k8VhQ1/74E6s4DqbmqSRaymkxVGovsa9jiHthirqw3A5QxzUVciLGOPmpyXORS BsAFQa6+aa1BPLaQcZGWBYQ0gnQWQ86eeida6LI+p4jG7Dv/w1R5zBVF8UKHrU+lfrjTiTbL dVnpnQGhp5iRGvW4dN5JLo1TUsJrmFXt7NUjUQUX4UwBFEkQPsCiRRhHkycIsaQ6LqYuBdAB 5V9PX0HAef3LhX/nq119QRH37+u5Lq4oav7DJs+glHOSi87gy4uiQMj2kWbtoi1gWo8nWG3E OpcjyNks0j/exLRZ0Rp0aZNtA6GVjUmbftU+TSflOv0eZ+WQjmOu1/gHjTLtfUgN/MY/OV1T C9q2lUkYnz7TEbRNHbtsksPVd9ErEFZ9BY9YocwrBKCWOtf81KfDq7Z2kQbQ0qWCSZu74kW/ C0+3K7JyPscXBqn2zQ660ei6uCWBn7LwZtlgKTevyg2UT8wUYYtAKtYqt04RFRtJ0RRxKJxV X2nWUAQaHfLOTS51duxkBhaBmBToUr7xL4ZCgPN0S6H2T01iXuIm16vTqGwGiDzHGs4JGelb MKTh3FxN5XDOsKhrol8rAsOxfgEUHL/r3QS+H7/x3RQun/Sl8wBmsIXjLjjwdDbDUm6z6RT9 2TQdKHOD9PH5PMKVAAMaIauzegV8QU6mX9OsFMaSDSfGTqxyBjMLnsdCjRWi6Yc0xmgBB7sA Jkfux/uaQAIgPcGjf/fOhbZANzkwzlQY43wXwNXrgA+RxT3Svy9QUz73wJieiHTktIwB9Mo9 ctUj/4zI1bJ/Fazuyk7z5w5NuTskiJRoCTNEWvxjTQLBZUI6vTfZMhf9vGM83+FbX3/SzAcz KZZB6bnL5sr6uj1x1rsfVrHMKJa+AV/Tr1j5VumEx0xQpF8se/9u5m6wHtSj6009uzd537pz //ddOmI8sAH+8PmT3jrQobtSI//rYELGuaLGuIVK9rmSdx6gl4BRPPgfssxg6Y8ghxFy2fuk 1u90WHkb6WcGyLc4f5dEtul8G91RWJ0qwBSbO5b9u3jvx9qEanBH92HS/s6ukxQWZZxrWxbX bROHdc8gjuFT76uNk2rtPjdj9Y7BcpYizufm+AC0Ig0Ji8LqsRqzhY2AmFysej8NckJZvQep trnSzgpR2dTwD+dhUGMEqFURECC4J9Z2vftzaByieAhQNGSgQAQ5d09KvzJnst/KNgG83+px Md0TlfHzC/h3YycPUhbfNlEUMcupsdz1XR3W+5SgaNJM6ucQCYMQAip7gqWHlx77XG+2hOem 5ijrRe86rZscdLR0ub33BUG2RzXBQnEY7/2vDGYxOa3jVtZHU1PQVvGwE+hVaXaLoW8TWWUK tPQoch6n42p7XpUfEBj3307IYslJut6jWpHGLCXJHRDVsqAYvNAGUIzLk10MvjPDFqILBB0T zITKjQhyW9CxHvhjAd0Lky2pcWLfozn+S3OVApRFjNBVmmMR6sCm9pXmcrsyX/Zg0agql9vF 7bAqz7ri1l2VC6JUDqQSaQJdPs5AeygkfdRaGRbHE0bx3dbKJtzubTcZ5qPY8yudIPiD+Y/a SrB8px65ivOMGiwC4FZfv9UhBP6bhuQNLLB+C7C9f++V8gw6Jgi23IW99zwG22WcLOA+DcQA Y/90dR2vUmroFpkeCcF7JyfNB4zfbFNh3ulm0Ej/EFnuvfcxSwpM6NxiD+YceeGCT0LPLZMS kwMX9ZBzy/IUbco9agFu5XgKzhMFWPvRhcBZjvHFLYTUOv/tKrSViQoqEq0XUOcfXSTQTqMe opv5p6srF2q8B1USMig+pl1SOmZre23xg02REP6GFFQOrKi+tpcAqnWZn81K92Jr6qjQGuCV TFADH0Fr3mE1aFRMFUXf/3BTo/Zucst+/dogaNA5nJp6oXli0DXv5pAAXEzws6U+i159mshg +oMlcLNKbBXlgVb+Wb/+eNcv/sxr7f5aMjMLHXYo//aWOSQWAJdLC/1JTslDJ8PX/pOufA/F ALt1FELZe+ytmiNe9TEQVsWVdAFoZpZL/2s4OgFhBUk2vIdhifYwnKIfoAlfQKJHkDsgwOVB oTKeSxeE54TKgjSREgyMj5nw00TqJHekJlJiqKEqG4Lc/xESSIzwCEig7yjABDTTE+P5nwQd uUxdKO1/PehI8N2Djt4T0BQ22xNUa6OeAZqnE0XRPBQ49Q2DJhwyIIKpWZ9iom6YdHbQRgf+ CN+5HfS1GFx3Ni30q7LVeZToXQcQ7zQyhcBQM1LQV4OOr90tot0CcX9lzN8WJDdmsLJP7/Mx lh3MtDPh3C482Mf9yKDyfQCdFwAwEKyThZX/+k4CuEmwYdoFDivjTFDYzEwf8/vtho/ZstPy rpTbLeMG31ThGopOtNvnAdc6Um0J5CTs3UbBDDKpwsUr+DfeuEp2MNrNHf4PASgY4P4ERwFa i9I4/UoBCDst+9o9+33Vzu7g/bdluB3bd7ThuHvwMBG7qrIiJOzIOZaoezJ370U5jzlNOAQG AIduEeQGh/uYwLB7sM9ObGxdYX2j9dC40HbvysDPba0NX5s9T5/gyzvMNe5d42/6exHkEo7T h4yLVcjjtc0/3HxaDHjVFRPWudbzqg859DK2Gdu1rVh2uskGfry86rYirHf2wiBCbWKJyaD7 lCcUppToN0bzSneMb55gwmbOhqnnwHgTbaZncExIPZ9vJ0F9A9tgC49dsLe4FcigC22dOqzM fcX2PDgbWOtqEzW3O0pjEzDbMF/fwSXMsN3B0ZRYg5qNHasdZvv9Rv4PnwLwUhDi95+yA3aZ EdS2FTcf2uTAqmAlZV7egzisYtijOIS58g4q57CgdZCUXL5fhfT9THFYoHX6ftvJb5pka6Nk 8D/MSSUEMwGO7oOTSghqxqL9n5vDuCZ3vCHyFFINgtxWRIKWHwwB9bxutIF8HsQS720IKuYk V9v+2J7dc4gHXm5FvLZmlSZ96f2tqXUGX9VMWTpc30SHX5oVVQSAIOiHEYVIRcwyShSljQGD HSZ2F6rdZWLEcd3FmHWPROjgAgtqH2xIcQ9vJ7ux0aPaVKY8HiAy+w7NChLaWZFAueTevd3U a1tiHpjGhTkCikkBRQ3B7dPFtNvl/qkPS8/9n66mAHMgeAjQTcMBWyDIBdhViKgWQe6l1n+7 325lE9DtnYS727zXNmuz0HwJJyKgQey6mtHW9DbXH0I4Rve2uzuldUEri7mYRo0WPATtvcSE exfFCmNW2hE7MJF9cNnOzpNycKSiCxy66l3LogMLn2L+MLKDAP1WCtY1iDEecjZY0KOmWfa1 KADzcWiZZiCF1x2M8Rx2W7vOzBKT9HHT5KKqTRmW5gmy3D+9XLsOkt7jLM1FjzEBGZ+b3Cv/ 5DgcyE7Re/PawGZi8kJb5rrs9vdXH6G7bP0HmqsuFuHZomnLX6Uj/KP39bt45dAXmh84FU5T 8HFQHm2iiYQ89fiIGEE4FCJGkLN553weYVOG1p4QWZM2ECkpLh53KqGTnDK/I+Ektw9ZGyGA chzuBnBDgNNQmDiabnBdqMqMItcvu+WuUiHCzGYEsfiXidDpYMKOJhOh6WTkFLjOePW+YxhP XyAYyPxXpwlWpy5yIffCiDSHMy0eoqtTZd+E4fd6SKUPVOKKPNlDdM+itvd+oByQVYKPhwoC 74u2EjrnjmXZ7b7uvd6uhfcxLIY4oSCDZhRO8dC1QG/t5A9UF6oUf8NtBEeF+cUWWcQqIYn6 T3pg+Y8e43yz9L5xXdvVEQeo9P30AOc1Aqsdmuc9uYJN+hRtTAVWCD+iKmlXBjBkgF+DYFkO RkTwsXctyDsepzlhFCcyBB7HM4rcsH8kBJwNG3lycbzB6lQ+z93kBnmC97ZuDifRkcNsRav0 eG0XSoAOzoKc5gANozkU6pTP3N2x6H17YgpH9xxNq2B5irTYAJsg2R6b8Z7TQ7s3ZTNvJ99j 94FO62rY4G/bDfouivIGN19FfYc02Re4VQvne1berZmwMCvvQoArOMxWnChToMPb218MSWPe gV9JrPO/aH1jr3/tXFmaojO7+M57+gVbVA5hI4Bfke2P9R1Ae3jw71lmO1/6LRXeuwOKWPL/ jFgYY/irZQfQHi7AmN+NHJ+St70jg0nbhU5ujDgb7uhAU4XlsA+mz73aRJsKFtTy7rfePvvf ayPxp0sHEggZ3pTCnz08DjWRMNhuexA1pzvycTojc8PBUlujxBt2GPshSfLix8ctAIwJQh8I QTBAXcRHw0t0SJBgT5qLzrbsKwPHg+Hp+WvvzpcxCafmfSlPATyOisUXs/G8bMo+RbA4sFkD r2ZNvTRLvQFa1cXR1AZOzi/k8ajhyfl+qVlH8tp6kcw6DiZzKBqzRMBxxhxWpjM8r0Rlg29p Xwc+2/e275tpbs9f3pU3FeN59HwZdWT/DQwbU7QNCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMjcg MCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDY5OS9IZWlnaHQg NjA1L0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0 ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDY2NTIxPj4NCnN0cmVhbQ0KeJzs 3XdcU9fDBvCLKGGEPR2ADBFw4KJOFBWto1Wsta6qnT9nreK29tVqnbXWrXXWUa3WKioV2VuQ PWWD7B0ICWQn701QNgFLMNg+3z/6KTknJycJeJ577znnikQAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAPAfIajMfeEXEl3F5sm+aT43LzXKz88vKCi8oprddkVmtF9I QRWrI23yOZWRfs/KavkdqcxmloQHPK/idqy7AAAA0CaO78/LCCOHkNxKWbcsfOF+dqi5DkEQ SrpDH0TltV5JwE90P6BHGJ0Pymm3RQGPG3h9oxZh/CCN0W5lPpf94Oin2hTrwLI37joAAAA0 1XWBoWLfh8MUe1qu/P7gwbM3XlbUtvrqcY8vD9CnEh0KDOyA344Ya6kQHQoMtQ9/3qZPpfRE YAAAAJCBLgsMzPQV9uaqkzfwha2Xl2e92LPSua++xvCBJu0FBkFxcuympZMN9XSHWRq1Fxj4 OVGhq+bZ6+j1HtpfG4EBAABAFtoJDAI2I9L9xqoPHEcMGzZx4aeXHgbSGuYaCOlFGdfO7/3Y YfSwYcMcHR33/Ho3jykpzgt2mjBcR1Wph7oBWbTqZ7cWMxiEfme2DLafuvvX+yEXVym0Exg4 j3b/b6DDB8d+93h08KP2AkP1tdWLB0ydf/lhyNVNExAYAAAAZEFqYBDyvM5tMtKiqGnqGBoa 6mlrKFEMVh17yhaIzxpwmWU75llSKKo6+gbiUg11BQp1wZG/BGRZts+QAcbKvRQVlFTJok92 3205o7E4LTG5oJInEiX9sb69wCDIj49Nq6ghW/Y7sbC9wMDNjorJqmaTXfxjpyMCAwAAgCxI CwxVKX/b96Oaj5jtn1BAjr8VWc9dPrYiNC09M2vI0ly/ExoEsWL/wwIWTyQU0uJ9J5hS+9t9 llF3NoGRttzeXNXJpd0edCAwNOhAYGiAwAAAACAj0gJD1J3vDbX6//J3wusHhOUv7pgTxLJT AXzysJ/Lqqqq4vCFfD6fXlz04tlj5xHq/QbNT6JL6iIwAAAA/HtICwxuh5ZRe6lY2NqNem24 3UBVgpi35yGbTA98Xswz923L50ywtx83fvzkCeP76fRCYAAAAPg3khYYHh5YoqZl/O3+s7ea CozPF4iEZVH3++tpOq/a9/vdu97BIVn59B0f6CMwAAAA/BtJCwzx93/sraWz5qxH/SO1xfFH d+9+EJknElVfWT2NMJ6RWv1qPmNtXsiE/moIDAAAAP9GksCgOXD3yQs3G7tz70UhQ1CdtWaq rbKG7uINB27cvHn1wr4PR5j20B0ZmEOO15ynh5YSPXrNXbn3t5s3T5/aP25wPwUFQt/SPrRA 0nCnAgM7KcDj5s2nFXxBs8qtBYbaqKeP/7jrS2/RMgIDAACAjEgCQ0tUg6OeWWRxTqTXx44j 9FSVyMcUFalmNsMO3AnjSZZV0vPCPxlrpqKiQJaoaBo5zFn89UdD1fvYusbTxA13KjCUH3Ee SxCjo1jN7wPRWmAo2DTGWk1zZmqLlhEYAAAAZERQlBR8vaVbd5MKXw3KPHpxyON7N65fv33b PSW7oNFzhfTSjEcPb5K1H/lE0tnswuTQ27fuJeZX1T0t+O/7t7wi2+1BVXb49et/ppYwGz3G TvRzv379ScszDMXJgdev38ulN75VVm3kk4e3bvu0PMOQHe1x4+bDEim3vQIAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAIB3k/gmUHR6YWFhUlJSWFiYv7+/l5fXE+iY8PBweX+BAAAAXYvH 46Wnp/v4+AQHB0dHR2dlZZWXlzOZTA6HIxQK5d07AAAAkDMyEsTExHh5eaWkpHC5zfdFBAAA gP84oVBYWFjo7e2dmppKxgZ5dwcAAAC6HYFAkJWV5evrS6fTcdEBAAAAWpWdne3v749rEAAA ANCW8vJypAUAAACQQiAQ+Pn5VVZWyrsjAAAA0H1lZGQkJSVh3gIAAAC0hcvl+vr64mIEAAAA SFFQUBAVFSXvXgAAAED3JRAIAgMDGQyGvDsCAAAA3RedTicDg7x7AQAAAN1abm5ufHy8vHsB AADQ5aryE25cPNPUDe/gpCqe4G13hZ577fIFt7C0N39m5cNfr8XmVnWkKp9b/OeZ39LKWW/+ Kq2IiooqLCyUSVON8PNjvM5cvV/EYMu6ZfLt18b63yO/40uXbueUSrmSUnH/zNXEwuqOtMmt zb975lpWlbRpn0KhIDXM7/a5c2fO/Pq7axBNNh8/AAC8PWm+Zy00iKZ6aeoYTVnxfy+KmG+1 K1keJvrUWd/deqMnCXgcr/PfaPY0/MWz/aTBYzHvHfpUmeh7K678n/aygVAo9Pb2rqmp6XxT TXF8f15GGDmE5FbKumV+yJXtBloq5HesaDDcNaag9UoclvvplaqE0fmgnHZb5NYwbv6wQJkw fpDWZvzg1BRf3r6wj64WRUGBIHooqeoMd1wUkV7xz98HAAC8dZLAoD73m0OPXnt488amhWOp itTFB++/1bMMbx4Y2MxSz4t7+2gqE4RBu4Ghll5w5/BGfaoSIaPAQEYFX1/fzrfTQpcFBmHJ rveH9lS3/+XWo0deQWWMVm6PxWIUPz79nZE6+ZG2Hxhq6Hk39q7RVSM/UimBQRB4ZbO2MmXk nHWX7j94dP/uwS9nUCmEw7KDRbXYuQIA4J0hCQy6LpeCmjzKyl5qZ2j63rqit9mVNwwMhYlh /5s7UUdD1WmMXc8e0gOD8GW43yKn4VraetPsB8gqMBQWFnbNgsouCwyMtOX25qpOLm2V58cG fz57rLamxvQxgxTaCQyCrGfe8x0Ha+kYOo00lxoYyvbMtlMZ9HF+7aufhXzuwSW21AEOQRkd uooEAADdQeuBgf1y2XDD4UuP1P0b/8sX1gM/3ffo6MY+FIrZrIXxpRwRq/Dq4U0OtlZKYkZj pyxxC0x5/eT8DaOtDUd/9ejOseFmpmSxqdnw7ecfsbj1pyvYXr8dmTZiMFlkYGDw8a5TKWWS ax+SwDBj869e1w8NNDJSUtKyGbfwikdmWz0PvLDD8YPPfvOJe/HnVkpP6YGB67Zv9cTF6x6E pj37dYWsAkNSUlJWVlbn22mhncDAY5TdP/PdRHMDipKS3pARmw5fy6XXFwqLk4N3rF9kq6te 9/EucNkfXyEpznxqYqDZQ0GB6KFIFs3ccrO2ecNC7xMuk+Z9dSsgMeHWN+0FBvaDnV9OXL7x 78hMn+OfSA0MZEDgcnj8Ro8IXH9Yotp/jHeyDL4FAAB4OySBQWPB5hO+r/m4Pti8YKr1cKe7 z1+NhkeXW6jbjRpuajph8uQvXc6VsBm3dnyiTFEbPNJ+8uTJEyaM1lbtYWr/QVR+3SnuvHUj LBSVNQ17G44cO2mSw/h+2uqEitZpvzyyTCjgef26oTdVuY+Z7cTJkx3G2GkoqzmsOs7gvQoM pgMGm/a3Il9owtgh6qq9VHUmxbUxk6KGVlpaVUumkJS/trUXGITVpcXlTI5QJAq78JmsAkNY WFhZWVnn22lBamDgMa5u/0RdjdLfdpTj5Mljhg1UVabOWn+BIZmkyqJlLhuto6bdb6TDJPKr GWNj2bMXZfK3F8SzJwuez589yUhDRVHbmCzactaz5ZRKZnlJWTWLbCjpj/XtBQYhvbiovJZL fqR+JxZKDQzN8StzFoxSHzDls7QKfvu1AQCge2ht0qPYmOU7XhRU1tUhA0MPNV2XK951Q0xN ecqKiZbTVxzIpIlPKXM4jONrpihrW10OqgsY4sCgQNFcc9KVViPgc1lhfx4xUiScd7uSeYLD yJpnrdJv2Kyn0XlkRuAyi49/42zz3qygl7V1gUGjt/WlpynkC7FrCn/dMU+RIE4F0aS/hQ4E hgYyDAwhISHV1R1aR/CGpAWGkpg7QwzVRs5YmZRLIwdrRknqiW8nKKoa3YkVV84NODegX7/v r4XSuHyRUMjMif3QVsN06NK0uomZ7V2SqNeBwNDgjQIDj1l8xWW+IqXPT48TEBcAAN4hksCg 6jB/1aEGuxbPmUrp2dP2/S8yJWM1GRi0jd97Vtzy2dzKypLIgID1s95T1rA461s3ZIsDg5aV c8brpXMsesr7xoTjktOVIlF17E11gvjihB+vZWOSwDDmq5P1R765weeNCOKbP5KkvwV5BYbA wEAOp5V5g50mLTA8v7lDX3fABb+M+kcqMx8NJIhFR70af6Q8Hq80MyPo3smJA1X7DZqfVHfN Qt6BgVOdf2bDPGqPnksP3GNy3vq6XQAA6ITW5jAI+TzuhY0TlVSNDrgmiiSBQc90WnRlfQV+ VuKDbz6Zoaep16eP+XsTp00dP4jSNDDovreyftVc48BQ9exXgiC23U5opSstJj1258BAjsge Hh5dc4dKaYHh4f7Fqgo9KMoqqq+pqFB6EMS8PQ/JoCXgctx+P/nhKEt9DQ0z20FOMxfamSh3 j8AgLE33WzJhoLq26bYrrjwB1kcAALxjWp/0KBJF3Pk/A0Jr7Wk/UYvAwCxM+Nhec9zC7wOe x6SkZBSV0TzPrNXqWGCgR1ylEMS6i2H1h5e1VYXhIc8yiqrercBQUlLy/PnzTjbSBmmBwe3w cqqOxaGbnrFNZRfRhSJBlscpbS3DzcfvRcXHp7/ModGZW2fodYPAwM9LdHOy0+83xPHs/TAW LkUAALyDWg0MrJqq46vGKFF7H3ETr31oFhhyfE+oEcSeB+kC8vhayK+tzv3WyVxR3fy0d6qk XFpgYJXHTDRSHDx7bWoJizzIFPDZXuc3GugYH3+a9m4Fhvj4+Ozs7E420gZpgSHN47iprsaC 3dcYteKdFYUCblGC+1cLFl0KzBKJqi+vnEb0mRxTUk1+tnw+Ny/y3mAjlb62zol16xflFBho OSHzhxiZjJ0XEF+IsAAA8I6SBAaV0bOX7Wyww3n6MCVFwthx+UvJQNMsMJSnuA1RJ/Qsxq3f vG371jWzRpuKN/Ajeu+9V7cpgbTAIORzrmydQVFUGTbRedPOnS5rFvVR6dV/+pfihYGyDAys 0DsXd+4887K2+X7FMgkMXbbHYx1JYFAzXr7OZWdjew4EpdNE7JLv549S7EUZP/fzHTt3bnVZ PsJYi+jnGF/KFol4Aae+JL8J+xnLt+7cuW7tZ+a9xfNZ9SxHPsuXNNypwFATePP8zp3nCnjN x/zWAgP9yblf9uz9TbKGhH1v93wFxV4zlm1s8nZ2/vQso7STnxQAALw1ra6SMLa0/Oirnc+z Xy1PaBYYhDzmk+NbbI3UFQmip47eRKevLh7ZbaypvuSgq6RcWmAQiW9nUHFu66c2/XqTL6Sq quM4f11QWom4QJaBofLU4kkEMSqY1nxMl0lg4HA4vr6+fH4XHS5LAkNLVIOjnuJ1KFW5qbu+ +shSR5WMab166Y+bNsc1Iq/uEg+bnr1zyXhtLfE3o9130Bdb9vy4ZhLVwOpWuGQLrk4FhvIj zmMJYnQUq3kGay0wFGwaY62mOVN8yomWNH+EaStvh+h/0ju5U58TAAC8Rezq0oSYyGbSs7MZ 7IbRsDg7ITY+rabx8Mhj5aYmREdGxrxIrqCz+bWViXHRKTl1B4yc3BcJsck59ZP2BXxWWnxk alZpfQMCLis3PZV8ofj4F7T6Wyyx6fGxMekFDbcY4DBK4yIjc9u7UxGrMj86Kq6E3nhfAX5J Ftl+MoPffCo+syybfNmK2lZWaXQcjUYLDQ3tTAtSCauLs5t/JaSYuOLX71HAqs5+ER9FPhaT UkKjN34um1melCT+ZpLS89g8Hr3kZUx0fHGV5DMUsLOTE6LT8trtAYuWGxkZV9pk72hecUYK +ZHWtJivWF2SSX6klezGHzU3LzkxOiZd/KrcmpSkuFbeTmRCSTXuQQUAAP9mCQkJubm58u4F AAAAdF8MBsPX11cgwDYCAAAA0KaoqKj09HR59wIAAAC6r4yMjKCgIC63+cQ/AAAAAJFka8fM zEx3d3cGo6N3WQIAAID/CD6fT6PREhISnj59GhoaSsYGefcIAABABsgBrrCwMCYmJigoyNfX 18PD4wl0wuPHj2/fvn38+PFjx465urrKuzv/LeHh4fL+ewIA+BciD35fvnzp5+cXGRmZl5dX VVXFZrMxmb+TyA+QxWKVlpZGR0d7eXlVVFR0zQ2nAAAA3obq6mp/f38yKjCZTHn35V+LTAuP Hz8mw4O8OwIAAPBPFBQUkAe/5eWdvaEStKuystLT07PL7iIBAADQVci04OfnhyHsrUlLS4uN jZV3LwAAAN5ARUWFh4dHbW2tvDvyH8Jms/39/cn/yrsjAAAAHcJisXx8fMjMIO+O/OekSci7 FwAAAB0SGxuLYUsuGAxGYGAglksAAED3R6PRnj17xufz268Kssbj8Xx9fbGJEwAAdH+RkZFl ZWXy7sV/lFAoDAgIoNPp8u4IAACANLW1tf7+/ji9IEfJycm4HgQAAN1cWFgYTi/IF41GCwwM lHcvAAAA2sRisby8vLDns3wJhUJ3d3dMYwAAgG6roKDg+fPn8u4FiHx8fLBfFgAAdFuhoaHF xcXy7gWIAgMDu2beIz/V59qa7ccyabLfj4vHqva+dWTNmjVbtuxPyqG1WU9Y+PPaHUEZbVdo hEVPPbjmu9gSqTtZCfjZYQ/3b1i/ZsOG438+rRZgRSoAQNdis9m+vr7YAaA7CA8PLyoq6oKG Ob4/LyOMHEJyK2XdMtft4FKijtHIR3GFrVbi1TAuuMxUIIzOB+W02yK7suzg52MJwvhBGqPN SpzqOydWaxP1FPrazQpMr/rHbwMAANpFjlAJCQny7gWIpaWlpaamdkHDXRYY+AWbHW2VjGZ4 xGZkvMyv5bayyqY8N+74hk/UlBSJDgSG4syw3StmqPRSlB4YXoZetVRTHjHn6+DQpIyUxJtH 1xqoELM23MB9VQEAug45Qr18+VLevQCxkpKSsLCwLmi4/cAg4NaW5Ganp6dn5RfWtBj3a5mV +VmZZGl2djaNyXp1Nopbk5XgM2+Iscq4L8iigrLqlmepUn3vOY20NbGwXfXRhPbOMPDjXK+N HmxuZmv/xaxh0gODz7lV1oMcn2S8Cgh8Ttkn1sTID/+viNN28wAA0Dnh4eFVVTiX2y1wOBxv b+8uuDzUTmDgVuad2LbMVp+qQBCqxmYLVv74omGJrSD72Z+LnR36qvYiCIJKpU5YuDqoQFKc 8cRIW7X+qsA0l+stZkgIvY9vmb9ur29SXtIf69sLDOz7O1Yu2HUiPKPE78TCdi5JNMJjF/ve 2m5EEOvOh2CFCQBAFyHHJj8/Pyyo7D66Zt6j1MDAKd+3eIxiL6VR0xasWbv20zmOGsqKg+bu quCIzzPUFMU6Gito9bVb8PWqtWSp03glxR5DFhwSH9uXJe3Y8IW1gUZP42Fk0am/nnNbNv46 /XQgMDRU7nhguLljtgJJUXHydzfpHPwaAwB0FXJsCg8Pl3cvoEFCQkIXXCGSFhhygy9Z6qrN +PJAGZ0lrsosffzLQkovtdOB4umXBWG/z5o+/bp/NkuyDIFLz1thr208eGFy3WDOSFtub67q 5NJuDzoUGF7reGDwvfrd1q2ffzR7bG9tozU/XKezsFUpAECXyMrKysjIkHcvoEF+fn5sbKys W5UWGIIvu+jqmP90Nyj7tbigK5YEseDQ07ozBgIBt6I4Pz0tLczT48qBNbZ9lfoNmp9UdxZE 3oGhjrCW9tPSiVRNm9+Cszr4FAAAeCPR0dHl5eXy7gU0qLuph6xblRYYXH9c1DARoZF5ex6y RSI+u/bi/o2jzPSoFIrF8BFLvtwxxZba3QIDqSjovKEmdf3FoI4/BQAAOi44OLi6ulrevYAm wsPDS0pKZNqktMDg/vPn6vo214OzuE3xxTNb+HG/b++hbnLeI6mWy+Xx+QIha7OTnrwDAzfO 596FS26N38xLrxMG6vrf3Y7oSPsAAPCmAgICWCyWvHsBTdBoNDLIyXSthLTAkB96zcaQ6vD5 nswiulC8vrIq+vHJcbYjfvHOEImqL6+cRujb+6SVCsT3HKGH3D3SV0upj83suLotG+UTGAT3 9zmr9NL+4XYYs0YgEvDLchK/fn+AWp/h96ILOtI+AAC8KW9vb9zSurvh8XheXl5Mpgx3IZIE BmXdie/Pdm5s0QrX2GIRl3563WxlCmXgyElznZ0/nDXRTE9da+TirEqOSMSPvL5FWZGwsHP4 0Nn5/emT+hhoU1V76VqMCM6VLEnoVGCofnBwm7Pz1swW2z60Fhgqrm5du3DJ3rpAUJkR4jyy r7Jm36lOc5znfDB2iJkiRe3rw3ersQ8DAEAXIKMCOTDJuxfQiuLi4qCgINktd5UEhpaoBkc9 xbMEayuKr/y4YVQfTQWCUFY2/WjF2ojMyroTHDx22dntnxgZ9iQIJaOBk/ad/e3c9tlUXYsr wbni4k4FhvIjzmMJYnQUq/lyzNYCQ8GmMdZqmjPr98GsSg/+ZtGU3uI9IXvpW0zYc/kpE8sq AQC6Rnl5eVRUlLx7Aa0LDg7Ozs6WVWsCHre2JRaLV3/PJqGAy2ZJHmPz+E1GXqGAzxYXsdgc rlAoJJtikU/k1z1RyCXLOK1swNCMkE92gMVvcosoIY/Drq1ltxzmBTyOuHKTazKSF2JxGj8m 4PPIh153rGMfBAAAvLkMCXn3AlpXU1Pj7+9Po3Xo9o4AAABdJyoqqrS0VN69gDaR3463tzc2 7gYAAPkKCAjgcDBLrFuj0Whubm75+fm4/zgAAMiFQCDw9PSUdy+gfWSoCw4OJtMdttgCAIC3 j8fj+fn5ybsX0CF8Pr+wsDAkJCQsLCwvL4/JZOJ+YQAA8HawWKzAwEB59wLegFAoLCsri4uL I784Ly+viIiIjIwMMkhUVFQwoWOwTRkAwJtiMBgIDO8uLpdbXFycnJwcHR0dFhYWAB0THx8v 768OAOAdU1VVFRwcLO9eAAAAQLdWUVFBHpnKuxcAAADQrZWUlERE4NZ+AAAAIE1ubm5CQoK8 ewEAAADdWkpKCvaFBgAAAOliY2Pz8/Pl3QsAAADo1sLCwioqKuTdCwAAAOjWAgICGAyGvHsB AAAA3ZqHhwePx5N3LwAAAKD7EggE7u7u8u4FAAAAdGssFsvHx0fevQAAAIBujUajhYSEyLsX AAAAbxMn0ufRX03d9/CISnhZIxC29Zyasky3+/fj8qs788KFKWGujx4XtT9zUJiTEPLA3a+0 mvPPX0zATXzuHfaiUCZ3NS4qKoqKipJFSwAAAO+K8s+HaxBNKaio9ja2/vi781mVrY/R2QFn DHsobrz7ojMv7Lr/Y2UNvcfp7dUT8m5s+UCp/1iflPJ/+lL8vOTH4wyo8394xP6nTTSWk5OD bR7/S3jRdw84frQ+sUT262IYxeknd33m6Og4e84XoaklbVVjV0V/OXn+o/g2K5B/JzUV+beO 713+/vuOjlPnLd/pHpbG5vDb7cDL6HtLpy2Pq/pHvQeA/xZxYDAym3bk1wbnDh90GGagQGgs Ofqo1bMM1YVJ1y9ceJZZ2ZkXzo72unT1Wg69vXqdCwxCoSA/7u8PxhqRQUhWgSE9PT01NVUW LcE7geP78zLCyCEkt1LWLbP+2DmXIHr0UqJQzMa5J7aeB1iVZXs/HUcQRueDctpsiJ69+QOb noqKZEukXj17qGj2PXwnvM2zhBK0rKRlk8x7UqwDyzr3PgDgP0EcGKxHuxQ0fzh0uC7VdMiK jE5cB5CNzgSG2rxj+z+31NAytRtjILvAkJCQkJPT5j/d8K/TZYGBm7Nu3ECKxeIsZptVcuI9 188dJTnzJyUw8Lx/+YwgNP535EEeiycS8LN9b463oBhYT39e2PofMBmkk4Juzh5uQraLwAAA HdNGYBAVLrfVMbCaGFEiyvE/YzftoweuD76c9J7JkCHngjPywq6P7G+21018OSHL44SJicnR eyE/fbfA2pr83+Gfbj4Sm9swvaGqIP7k7lVDh5JFg2bN/cotPLnucY/TqwYMGuadLf7/u/vm 2gz5LConbMucCVYmJvbvTT9315/Blcw4aB4YuFFPf//iw/fJ5oYMGbPr2LWMirZPUqQ9sBg6 bNvR36Jj3YbJLjBERESUlEg5OQz/Mu0HBh6jPNrP4+HDh09DwkoYzX/Lyoszgt3dyFIPD4/0 wopXE2mYJU/vX5g8wIhiN5csepaY2/L6QfS9U1b9+g4eP/On9XMVpAUG5uOjO+Z8c7iS1dCG 20/LNQ1tbkcUtVaf9feBrbqGRhPnfr39kyEIDADQMS0Dg5DHZSb7XTDToFiP/zaPJ8p0P6g7 0MLJzqa3uaWNzdQn6RWN5zCkPthLHqT07te/d1+TgTbW5qb65I9Tlh0tk2xrxC6NW+k0jKKs 3t/CysZmoJE2VW/gaN+MWlHTOQxXXUZTlEfNnGHet7+FjfXAfoZaFHXDjZcDeMJmgUEY6XrY Wl9VU7c32ZyVpYmqsuqYFXuKWW1cq60pic3I4wsEVYXeMgwMAQEBdHq7l1LgX6OdwFCe9mz1 xw591CkKBKGko/ee0/KniVV11wKEAm7w73vHjrDSVlIk/y4oFMqAcTNvREt+6TOeGGmr1k8c muZyvbZ5w8LQ68e+O3U7sYCW9Md6qYGhFQ8PLtHqPejPqFaTLeP+7l377nnn02r+2OmIwAAA HSMODNqGditW1/vf8mVzTAyoClTjQ67RZA1xYFAjTN//+kX5q0lfLQNDH7vZXjG5XJGAVhDx 4UgDPduJYTniwdnn7BqtXlof77pYQid/5ETcO2HVm7rswCMyCTQLDATR095xc0xepYjPyYh4 Ora/gt7w+TEFzMaBQcDN+ai/uq7ZzJveyRwyjVTnnV29WF9Ff+/dOOlvUraBwdPTk8OR+6Ua eGukBobafJdZQ3tSVGd/vu30mbN71i8xUFc0dfymiCVOzIycYHt9wtB66rajJ86eOfPDZ/NV eynazt4jboie89vZH0eb6ilZTz179uyjkFQpO4e+aWAQFseOG6BqNX11TtsXO+ogMABAh7Wy SkJLW2fk9Lm/PPSvkdSQBAbljVcadh5oGRg23YirP8j/a88Clb7DH8aKD22+m9PbaPDMiMJW BupmgUFFwzaotL5QEHpxg4amzY3n2Y0DAzf9gTZBrLwYWl+Pkxc5daiB3bJD0id3yTAw1NTU +Pr6droZeIdICwzpnsf7aah9+v3vrx/gxv/lQiWIPY+zyR+KY9w2bNgQnFXzurRmg6Nuv0Hz k+pOUDHSltubqzq5tNuDNwoM7NKEL8YPVDO0+zOixZXGFhAYAKDDxIHBYtiXzzIb5ObmVlTX 1A/BksCg8393G3YeaBkYjvk2DPaNA8O3kymWoz9Pb205WrPAQNWandaoNOPJfh1V/X0PYhsH hiLvn8jX0jEyMa9n2k+V0rP/vF1CqYlBhoEhPz8/Ojq6083AO0RaYPA7u1Zby2TLz9fcXrt7 bV9/8pdtn1vdSSgOh5kcHvDY1fXK8V82L3XUV1fsysDAywh/ssxxkG5fs1N/x3P50nO0GAID AHRYW5MeG3QmMLg4Uc1GLU2ufL1hkpBXlp+TllMkEAqbBQY1zSmJ3Po2BJE3tmiq9D/tk9I0 MBwlX2vZ7svuTflHN84arZBhYIiPj8/Ozu50M/AOkRYYXH9cpNqT0tvEfEBTa055k4GBU1m4 dcWHw21thg4ePHPR4r1Hry8crdllgYET8fep8Va9e1s43A5N5kvP0K8hMABAh3VtYLi8cSpV 0+pyQFZdEbc89dPxpiYfbGZyBM0CgyKFevjvrLpgIeDW/rjQRtPCwT+N1jgw8Iq8yWO3GavP VLyeQcApzzr+49Zjf/i/nUsSQqEwICCgqgrb3PynSAsMnse/1tS1vvas1aGc++z8GkLb5l5E zusLdl13SYIX9+iYma7isJmr/NveAKolBAYA6LCuDQwFEb/bGaipmNht3n345MkjCx0G9aRo 7ruTKGhxSaJHDw2qsfH673efPHbkf1OsyTZX7HETX/ptFBiEQv6lTdOUFVXtpy89cvLkycOH nUdaKmn1Pe+fJ/1NyjAweHt7s9kymTsJ7wppgYH24uHIvmoDpi4PTSkmUyuPVfj3qfVahPre J2kiUfXlldPqAwOjuvj2oZWqFMXe1tNi6gZo2QUGWrLbQC3Cae2xkuo3u+s6AgMAdFjXBgaR gB12/4SjnaWyMllLSd900Bd7rzIllx6aX5LQmHLq7DYzAw2CUKTqWi9ffbqwbmPqpvswsKpT dq6cbWaoR0hWqfWxdNh1/lFNw7WM1skqMNTW1vr5+Qk7drIX/i0kgaGnirGZhVVjw8ZcDs4j f8PvH1mtrUbRMTIZYGVlaWGsTVUdOG97WQ05cAtTnhzVUya0DIwtrazMzEx0DIxMelO1zYcH vJQM650KDJUX13xiZbUgkc0T8auvucwm/yB0+5g16aHVmF8e1S0gKjm0YIbdiK+yW7SMwAAA HcaJDXzqH5zEartGTWmGh7tHamHDefjaipdebn8nFYrnMjKL0tzc3LLKG5YZFqVFuXsHFtPr H+GXF6Z5e5O1PMOTctivD4CK06OePPUskSz7ej3pkRsfEeTm5h4Qltlo2aIw/0X4E5+Qcuar h/icmuTI5+LpZV5esWll/Pb3yxfx2GWBbm6RacWdvPlUXFxcVlZW59qAdw439JKLeUuD7S8G 5ZLFHGaV7x9nFjsMtzA3t7Wdsm3/8cySV3OG+Vz644vfjx9nZW5uM372V7ef+v51fPXgYRNv hUnOidVkb3KeZLtsf7s9SH/8g7n5e7earHqo/HXlfHPzeeLAUJ2zadGUVnpobn/0YaykcvH+ j5wG2X3e8nf38dHFA6ydwmmd/5Tg/9m777imrjYO4JcpKFOWIBS34N6jarVu65514K711Vqt tS7ce9bRWlt31bpQcaAiGew9wwiEvcJKQhISsgfvTSKIEhKQhKA837/4JDfJIeOe3xn3HABA c6h7lUQLJBQKX79+LRI1rssXAAAAAJryWQQGMpkcFham/jgAAAAAaMfbvzfNmL2HrOtiqCAU Cv39/alUGOsFAAAAQL1SU1NjYmJ0XQoAAAAAtFx5eXlYLBaupgQAAABAXSKRiEKhREZGBgUF QVoAAADw5REKhUVFRQkJCYGBgW/fvn0DPomPj8+TJ0/8/f1haccvj1gsZrFYaCAkk8l5eXm5 oAFKS0t1/bkBADRGIpEUFhbi8fiYmJiCggIul4veoutCfa4UdUpmZiaaGdB3Fd7JL4BIJCov L0eztJ+fX0hISHR0NIFAIBKJqaAB8vMbur82AKCFEwgEwcHBoaGhlZWVui7LFwV9YwMCArKz s3VdEPDppFJpSUkJBoMJDAxEG8tCobrlQQEA4AtVVlaGngmLi4th4WJt4PP5eDyeQqGoPxS0 PDweLzo6OiQkBM3S8AMBALRmBQUFQUFBdDos8KpFVCoVh8PpuhSg0Wg0Ghr2cnJyYFAJANCa oc2l0tJS9HzI4XB0XZYvHFrdBAYGlpU1Yu9goHMsFguLxcJsPQAAKC4uhg0Omg1a+6CZAfq0 Pxd8Ph/9dTAYDF0XBAAAdIxKpWIwGJji2GzQqIDD4aAz57MgFosjIyMLCgp0XRAAANAxHo+H Vl7QQ97MoqOji4uLdV0KoF5eXl5MTAx0BwEAWjn0NBgeHp6VlaXrgrQ6+fn5CQkJui4FUEMo FKJxms1m67ogAACgY2hUQJu6MOu7+aE1kZ+fH7RbWzgSiUQkEnVdCgAA0DE6nY7H48Visa4L 0koFBATAvJEWzt/fn8Vi6boUAACgS2gLNzw8HKYu6FB0dDS8/y0ZlUqNjIyEXiAAQCtHIpFg DF23UlJScnNzdV0KUK+IiAgajabrUgAAgC5VVlZiMBgej6frgrRqaFpAM4OuSwGUEwgE/v7+ MGAHAGjNpFJpWFgYdIbrHPoRREdH67oUQDkmkxkREaHrUoDWjP/q5Ar7AYvSmZpv2ZETcaum D7C3t+/aa0pYFrW+w4qTHw6xH/A8jVH/M0lKUsO2r5g3wMnJ3r6j+4j5Vx6HcPj1xWxxdrTf lsWzejs42Nt/NXjC8pvPo8Ri9UN+vpf+N3rUyjSYTKQLpaWlaGCAKyN0rqKiIiQkRNelAMqR SCQYMAI6xXu6bzbiPJnI4Gr6mStOLxlqYGjVs9/AgTPXJRcrrYnF5KTwhSO7IIjzw+R6dxcq TcPN7GtnauXoPmDAwAH9u3ewNG7bfvc1f4Gy6iUn6tG47tbtbJz7DBw4cEC/TrZmbczsf3+W KKo/MkglgljvG26OJk5uc5IrGv+PgqYRCoUYDAbWGGwJBAIBFovVdSmAckFBQXw+X9elAK2Z 1gIDl7S4l7Pd6K1UgfL7xUJhlM/l74Z0NjY0UBkYeP9tn6Zn1PHMiwSGWFIlERXHYSf2NHQc MCu+uO5vh/P78iFt2/f+yy+FgyYEMT/d/8HIzgadxq7NoSvdI17KZVCe/7Otu72lkYEeBAad yMrKiouL03UpwDu+vr7Q1dMCcbncwMBAXZcCtHLqAwO3LPPF1YvHjx//y+t5QcXHh+Wkhvz7 +xn03suXL8flUt6NE9BIpw/94m5nbtFnEnqXd2hmnfEDkf/530zNbCYv2/av5xyVgYGNuf7H nqsva9/kc9yjncuQ18mUOgczvS+cOnHf//0NEu7drTMNe0yMzWcqe3LaweljDWw7/3Twxs7p thAYmh96GsThcDDXseVAm7GwimALRKVSY2NjdV0K0MqpCQxp2GsjenU0NdRHEMTAxNSl58S7 oWTFXWI+8/buOTbW5kb6erJ7DQwsO/W9GCxfgiztiYmxAVJt/mGfOn0B4thHt++HptC5gvB/ Vqgekqjr8oaRVt1GBWSor90lfOaxxQMsB8xMLlba401/ev6qXwZZIJIcnN8BAkPzS0lJSU1N 1XUpwHsxMTEUSt0oDnQsPz8ffilA11QFBkFZzIzeDjbObp4X7gcGBt676NnP1dx+iAdZXv0X hN/u0g4ZNm/7AwwuEI9/ePw3axO9wXOO0iRVVRxK8Jtbo1xsbMeuQR+YkkdT0cXZuMAgFVOi HjlZGE7e9KfyQYbaJMK015fszYwWH35UqW6TZAgMzU8gEGAwGC5X4/NnwKdDayWYWdcCkUik wsJCXZcCtHIqAoM00Wuvtant7us1Pfyi2IfbrPT0j2GKqmRzEUOvXr2aJa/npRKJSMhcNdiw +8gfshTdmcykWT0dnRYcVluCRgQGqbQs5c2kbh1s3KdE5Kqr2qWSnLB7I11s7AcuzFCfLSAw 6EBCQkJOTo6uSwE+UFBQkJycrOtSgI/FxsbS6Y3ohgVAC1QEBrH3ge9NrV3Xbz94utq+31Y4 6OmtPB+gqIA5HBr23pVTx45t+3Ht9MEd9PQQbQYGfsjDc4M6WnYc8HVwltrl7rm+V/e5tW/r Pn5ObEGDpt9DYGhmPB4Pg8HArO+WhkqlRkVF6boU4GN4PB6m+gBdqz8wSEV3t88wbtt+1ITv Ztc2Z87Fl8niqip6RuTUIT0Hj5q8eMmSHcdOevslrBqurR4GqZR578RqJ1urkdN/iitSOn3x PSG/5PqehVZW1lM89hEpDZ2+BYGhOUml0qSkpPT0dF0XBHyMwWCEh4fruhTgA0KhEIvFwhYS QNdU9TD4nVnTzs79VnBmzU1CDj2dSCypQFuFnAc7ZiEdRseVVCrmJ4g5+bN7aCUwiIX0R4dW 29hYLd/9TxZVTd+CkFd8ecs8a1ubTacekZmNaL1CYGhOlZWVcPley8Rms4ODg3VdCvABJpMZ Fham61IAIA8MHSclUlnC2kQiiVRaQXre17Zt9zHzX8Xko7dV0pMv/DSzrYHDLQJauTMveoxC zDs/iCjgCYXFhSlH//edvh7iOmROimJrlKYFBolYJBK9W58xO+DvDu30l5/0ZlbyaxdR8i5v S2XHVh8c63XQ3spi459veQKhioPrFgMCQ3NKTk4mEom6LgVQgs/nBwUF6boU4ANkMhkmloAW QB4Y6rLpcj1UNiMX989OO7M2NTcbtjGftPOW4pEkzB8d271/hIVj1/7drex7j40qlE9waFJg KPEc29fYZEIa+qew7MDcAUpKiLicea34BeWvdXOxd10qmzzHL1w/ylXZwT3uxObLD86Ybm3W c9jWojrFgMDQbLhcLhaLhdkLLZNYLMbhcLouBfhARkZGdna2rksBgCDsvyMz6lryg1+qbPcH sYCXHv7qwNol6G2LFm199NqfxXt3gaJExInH3125Er1n4ab9fxGycvG3D89f8j98mnwLocrc I+uXrzjxQG0J0nzPzZixKjiv9mQD+p1dP82Zu0cWWZi5B7asUlLCGau8Y/LkB1Mu/m/VsjVn StE/aalb1ixRdvB6/0zFpeVFhxYvWP/rtfI6xbh/fPmK/x3Ng/WJtS81NRWaSy1ZQECAQFDP Cq1AFwgEQklJia5LAQAAzUoqlfr6+lZUQFdOy5WYmFhcXKzrUoD3YmJiysvrtnIAAOBLlp2d HR8fr+tSAFWKiopSUlJ0XQrwXkREBGRsAECrIhaLsVgsiwWbiLdofD4fj8dr/Gk55flBWN8P BSWlFXAasPu8hnGpAXhMbMYn9KJURmMCcqlqRi4peekRGIyv71v/sGQ6R8kU68YKCQmB7VwB AK0KjUbz9/eHqylbPhwOJxKpW069kTL8L3e1+Gg2clvnzn1XHrxGZjbvlIkcv6/szL7bc79R D5JKxImvTnQw6nAek1H/MYLwR6dH9e1qZWiIIHomFs4T5m+IJZU1sbzorwZmlQAAWg+pVIo2 lGBw/LMQEBBQWal2PdXGkQeGduMWb75Q7fyRQ/NGdDJELNb/hdHsa6nxKYFBSPT9t7udGYLY qwgMJbH3XM0R265jfjl+5sK537fOHmpigAyatau4CWs0Kqb9QMwGALQeDAYDPe/puhSgQaKj o2k0mmafUx4YbH69HlL7Rmll+oJe9p1G/dKsG2Q2MjDQcoj7fpjtYGU6pFdXA30VgaHy3i/f IXZDQ3JZ75Z9kUqubP7azKHHozjqJxe2oqIiMDDwkx8OgApCoZBKpWZlZRGJRAKBEBMTEw00 Tdcf8mcpNTU1LS1N16UADZKTk0MikTT7nEoDQ5Ww6Idhjr3nHFLMa7m5c/Kk3/6OvH9+tLv7 uHW/kGiCKgEd5/XXyhlT3WS+XvbD3qjkmk0bS47Mmzx8vmdk8NP5E75F7/52wvyrPpFCcU1j XJiA9Vq/YBZ614gRI3Zcf1bIkjf15YFh6o4bibgH00aNcnMbNN1j19u40vpKHnZj78Dhkw9d fxl959c2hioCg4RRlJ+WWySWvJ+VEX5np61N5+shn77RJJlMTkhI+OSHA/ARqVRKp9PRH3ho aCgOh4uMjET/zsvLQ79pFAqFCjRN1x/45wfNsbCT9WeEw+EEBwdrdvMCeWCw/uHU47xquUlJ l7ev6NZ14B++SYpjzq7oaj1ywtfOts6urhMX7SfzeNgLm8wNje0cHV1dXV1cnEyM9PqM9yBR FTMJCzcN6mpk4eTa0dqx41dfuTibmxgjVs4PY+S/UKkk/uXZnrYmZla2LuhjO9q3MbGce+A/ oeRdYHAbPKarswN6l3NHO2Mjw/adFmXVs6stLS8jvYguqqoiPd2pMjDUIeKeWNnftstQfPan f/PRkznaAPzkhwNQQyKRoPVXREQEGhWys7MrKipgqAu0QPn5+bGxsbouBWgENDBodhqDskmP MhM3nymrfFdVo4EBMbFYcfaR4pIADjV1Vq927hM2JZXIhiy43PIDHkOMbNz+DVMs2iYLDIiR 6ULPKyUVYhG/8s2l7VYIMv/4a7RyF3KLlw00t+k84h4+TVBVxWPm7JozxNp1REAeTxEYTK06 HrsTgVbkHGbmkXXj0JJcjVSzV13jAoNUHHNnj4WJ5eLDj5syYRE9vWt8eAi0QmKxGM0J/v7+ 0OYFLRz6RYWVZz4v6enpmm3YygODSb+xs358b/mEUYONjYyHLtpeJK+r0cBg5TwwpKi6Z0Mq FQoEQhHaCBKx2Yx0AuHI8ontLLpe9ldU2bLAYNl5GpH97ngeM22yMzJu2V+MqipW8sP2esiy U741lbVELEKfTDZcIA8Mg5af5lS/Tn7I3w4IsvlRqup/oeGBQSxgB/27x85A/+sV+/PKPz0v oA1ADAaj8StWQGuDnn7fvHlDJpOhSwG0cGhDFY/Ho/lW1wUBjYC2ajW7z7WyOQwiJq3s8PIB bSw6XsTI9kpAA4Ot66R4Rs0BkrLCiHO7Ng4bOHjQoGGjxowf1NPF6MPAYDNsfU0S5VWQprgg 45ZeQp+AGX4FQZCdD5QtQl5n0mNB6D8dEOTnh2o2RGtgYODQsy78ssjeov2szftyaU1aP0Eo FOJwOPjtgKagUCgBAQHQTwU+CwQCAU22ui4FaBy0kgoMDGSz1fTSN5zySY9VVTGP9tsjVj9d CqiqExh49Nz1U516jl1x68EzHC6EmFXg989m6wYGhshrBgjy6534mnkYIn5lSVERs5KvzcAg 5bHSty0bbmPvvNLzOq3JaydwOBz0VK/ZySSgVeHz+ehXCDp4wWdBJBKhX1e0oaTrgoBGKygo iIuL09Sz1RcY7u6e3MbU/tDjxKo6gaHA/w8zBDnlV7O7bOWRBf0a2MPALY0YaokMXby3tHq+ YazXwQ5WjsefJWsvMIj4pZ4zels4uV16GquR3VjRVmFYWJgmngm0RmjUDA8PLyqquz8zAC1R aWkp+o2FJtLnSCAQ4PF4TYU9eWAwm7xq5/X3rm1YMcHcRM9x+JxUquwb8lFgoCR792yLuAya de6vK1f/ObV2ej8jAwTRczzyVLEdiarAIBXxLm4YbWxoMX7BhkvXr/9xaltP63bOoxaSaFKN BgYBMeD19evPS/miqipx6uP9BnrI5LX7rl6r9V9e/y8yvd5rNlVLTk6Gja3BJ0NPv5GRkTBv AXwW0JwQGhpaVtbUpXGBrigub9HICUfpVRI2Dg4jpix9Ep2rOOajwCDmlV/fvrijpak+ghiY mbv1mbJn8/oOZpZrLyhWAFMVGKpku1dk7F481qm9FfpCxsZm7iNnPwjPlN2hycDA+HPJWAQZ EkrnVPFK9y8YquQ6EERJv0pDiMViHA4Hu0iAT4NG/YCAAD5fI31dAGgdi8UKCgqC7oXPWnBw sEauw2KXZb155vWR0OhoKvt9D0Z61JsXr4IYtbs0+KyEgDdPvby8Mbj8kkohs8jX5yk+XnH5 Bjce++Y5LrZmpoBYyAp+5RUQmVnzBCIeKyEkEH0hHx9MIaV6PkZl6asX3iHJ+TUvwqFmv/Ty ii9QsyMki5z05PGLjNLa8zqEmZEBXl5YqkBcJayMCnzz8X8o85yQ8ylvIIPBQN/8T3ggACi0 pRYVFaXrUgDQUGlpabBR8ueOzWZrY2sJoBaJRILFUcEnQ9MChdKsa64D8MmkUikOh4PNrL8A ZDI5NDQU+jabk0gkwmAw8PMBnwbN+dC7Cz4jVCpV48sLA51AP0Q0MwQGBkI/Q7MhEonx8fHw 8wGfJi8vLykpSdelAKChEhIScnJydF0KoBlozVVcXIzFYouKimDStbahzUM/P79m23tFIhKy KpjyfXLKmczKWrt3qX8kg15eUdnQrieJSMAop7F5ur3IWspnV6D/qFDS6DAm5LLKmWw1IU4i YleUo28ljUZjc9S8M2Ihv6JcfnA5kyfU5PJc6OlXC1dTSvkc2Vsn1kKOlUolHBZd9hUsZ6j4 BkqlQga1nC9WUwA+h01XfKEZbDVfZ6mUVyl/YSqNUcFR/cRoIblsVrn8YCab2/hvEKgXBoPR 4LI/oCVAq7CQkJCAgAAKhQKNXy2h0+k+Pj7NNhjByIk69NOaXt1d5Rd0mH3VdeSq7fsjiugN +nSLIof3tJ+++24DX6ss8eVAZ6uf/gr49OJqQOWDTTORDmPCChiNexy3/OyGMS5TN7N49dZA okrag7NbB7tZGhggRkYmw8YvehBJrC8eMQoTD6yb18PMDH3f25h3nbVmZ2IWvXFFqp+/v78W Tr+8p/tmI86TiQzNR9nMoHvj+jqgb0U7+2H+6fVeWJcTctEJcX6YrOKNEmeFeM37ZrAD+hkg hlYuQ3acvldRWd+HIIx/dW3myAHt9fTQD8Gx55i9F7zla9ErxQ+6d3bKoF6Wsl+KaeeBk49f edvwfxCogLZGw8LCoE758kgkkvLycjQ24HC4mJiY3NxctCWFBglYvriJhEIh+k7GxsZisdhm W5ePVxr1Tae2Ju0sR0yc6iGzaNqk4VZmJm37TSUUNmD4qdUEBiGHem/HQmtDfVWBQcS6uX2u sZFh/xGzli71+H7hVCc7E2PHAU8SlKxzK6CTVn3T2cTUfvScRcs8POZ+O8SqjZ7LyBX5LA38 jvh8Pvot0sLpV3uBgbZniruRyVfTFnp4bDuRo3xBdSER82iIa3tEZWDIDr/bz97YyqXfzMVL PZYsntjXWd/AaOn+B2xl+7Ek+PzevX0b266D5y1d5rF44ege9vqGxj9fwvOUfQhBt3c6W7Rx 7DUSLaPH9/MHu1oZtjHffy9OBLVc06Bf1ODgYFi6/AuGfsRo+6WoqIhIJEZGRqLNGT8/vzeg CXx8fJ7IRUdHo3lbIGjyutLqCYIv/oCYfrX3hj+lQtEaFVeyyl7ePmTdFpn/mxdb7ZmwFQQG qURUFOv305IJjg725uZtVAQGdlbA6G42AxftKqLw0LpaLGKnvP3Dug0y7de7deu/JO8j9lb2 G88+o/FllZOAUfrf/jnGSJtT2IKm/G8KJSUl2tkdWGuBgU1c4N7RYcquSuXbrEnZlOJ/T28e 1N2xo62FysDAvrJ+nL5VX+94smzAQCqpKCStGm1t02tSZF7dAMw8PKePZadxb5JLBFLZWFJp ati8QRYdRixJp9QdSyrfONKx44D5ARlUWRnFwtyol5Pczb6atIlST6FBA6H51tfXF7bYA6BR 0B8Og8HIy8uLi4tDM1hhYaGW++gqH26ehbhPSyn6YPhDzC77ZU7vMUv3lnHQljX9jz0eB/54 zqr+NXPJhF2b155/It+YTBEYdt2hZIft3rXaY82ao0/eltU/RaE6MODyol/s+2H16tXr7r/E 8wTVzbmiqJUrdoWnE59c3u7hsflBcJ6oSsqrZAS/ubVt5Qq0Vffbjl1+idnC6vekNN573eoN zyLTEn1u/IzevX795Wd4uuD9aUfIZWH/+3vtqlXoK/3+8FUZX3HXu8AQlJUX+fDPnzw8Nm78 7W04SVTP6LWAVbZxlFX3vt9dun9n9tiuKgIDtzzP54lXbOb7KxklIuayvsjwmSfrLsNRSop6 +PQ1mc6ruYWa7t0DQdbd0sBi7KmpqdpZIFRNYEDDVUlq6IXfNqCfxuaT52NzS2v37ov4nAj8 /T3rVqP3btmy5WVUGlcxG6ooevWyWc4WpqZf9Ufvuvgsvk7NIcKc3mzt1G2158UnRxeoDAw8 AvbVf5jo2je9PrnCzGXI6+S6V5hyIn28nwbX2p9Owr3362zDHhNj85l1DmYFeD18HZ35/gYx /Y/l45D+CwtrfYjgE6DtI1gOGoCmEAgEERERRKKaxSebRpz9/BCCIONX73sbn6v0rMdjkBcO QIYvOFLT5Kogvu7j3G72Pvk6mfLAMG7hhv5Olu9WtdQ36DPXs6ieIWNFYJi3fpWL1ft1MKf/ eqVc0QWc6mVk0GeJx9em8tsPvSng0jK3Tu/2waqZlk5/hL+bSp3pc9DCpG3/oQPavb+77bht NxT3cuiZu2b3eX+Pnt7AVadoHGF1YOi9eOoI0+o7TSwczz9RXlOL+Gy/F94MpqSKnrVYZWBQ 8tiiEDcrZPzGWw1ZrJPwZLc5ghx+o4EehrCwMDpdY9MhalETGCLuHXBub1LzlptY9jr94t1C IsJKyokVA/Rqf5Rmdru85etKpT0xMTaouXn+YZ86zXsxyR8TnleOBonwf1aoHpKo67SHe3u3 b0Jz1A+xibn0XTO72g6dm1qqPgPw6dk/jnV2GP9jKQuaxp9OMR4BC4YA0EQikSgqKkq7e0mI +f8eWtXZwcHU3NLWzm7cd4sPXbz4FBNaXvluQKQhgaGNabuZ284Si0oKcmJ/Xzsd0TfecB6v dEBFHhj0jIwcfz52O59ckp8YvGn+EH0ju8PP5RcAygKDkV238TewqegJhCeShv67zcbUbMWR RxmlZZSiouCbxzu0RcYt/5MuzxfywICYOw46/hCPHp/y9vpEt/Ymlt+myIoqenl8ibGh4aIt V1IKi0sKs65vm4MY2l3EZ78LDPr63b9Z8CI0DX3gswu7vjIz6bLgiJpBoEYGBj674OiC4ab2 A18kqT8ZlqdiJ/Tp2PHrdUVKh88bAz0DBwUFaWdFcVWBgZ39dpiTRae+3/6HJaDvagLuzvQh diauY4ny9VMz/M7ZGSLztt9KJJdQSkqSn19ztdDvN3FXsWwPFj41O2hqN4cOM3eiD6zgCFQ0 NRsXGCSCNO9Tpkamy44+4aj90MTcoCvb2xi23XItWFUJFESsx0fXmLRpf+hpIsxhaAo2m43B YKB7AYCmQ0/7WCxWu6N7In5GctLz27f/t3LG4AH9uzg5tbVy6D/p+4AcirhhgcFp8sby6gaZ sDx37sC2/af+RuaKaXmZcTXi03nvAoPByGWnauobDjV8hJne6B+vyJp/ssCgP+m3ezXdE7SC tIioGAZPtq0Gl0nPTcRP6IoMmbNf0f6TBwbDBXsfVVf04meH5xuZ2PhkyWqvdd90N+81O7/6 laSVFLTdnV3GfhcYjJzOY9OrH1e2ZZyrQ88Vatr2jQkMHHre+c0zLCxsfv7rLU/dNYDUjIBl o9xtXfvdCc5r+nlTIpGEhoZqZ4NgFYFBGnNnu6XZV2ef1cydEKf6HrfX09/tnYn+U6zSbPT9 p3JkxeOxKkpzE+f3New+8ocsxdwZZtKsno5OCw6rLUHDA4NExI33+bOfnUWvaRtJZWomXYgF 7IA7h3vaWA6ct7OkUk1mE/ErXlz4pZO11ZhVJypgH+amKSws1OCeyAC0cvHx8fn5+eqPazyp RMxhs95PIaiSDYTkEQh3z+7pa2foPnVrIUvUkMDwwaRHEe/YyqGOQ2Yml9Burp1S089saDwu rZ5JjxtH6/Uet7WA/y4wrL0UWKuEkoKchL/3bFnu4TF/2uRhbh2MDD4KDLbHX7wfg/b7fbmR STtvUlVVSdy4vo5uS44p+7/rTnpkek7rYu+6RM2qMQ0ODPSCmM0zRljYOy09/Ux117ZUKsgJ 8RrVy9Gpe59rOM2ss4TGSzwer53FUuoPDFLR470LTMzsp8xdsqra93O/tdLTW3k+QCjv96CU Zt44vG3N8uXzp08b3dfZ2BDRXmAQixiPz/7azdaiz9RFxBI14wtiIe363tUulmZjlm3MpKpZ OkNQSb6wdZF927Yzfz5QQIe40FSxsbGwPSUAmsLj8bBYrDbO//T80NEdkFk7H9TpreW/PrzU wGzgK1JpYwODVMjdu7CX09BZKaXs2Ke3PKvt3XeNojwwcFYO0Ovz7bZCgZLAQPK70cXeZuL3 G44eO3bn+auE5Kwlg1p6YChOCBrjZmXpPPD8y3jVz4f+7/gnRzqbI12/XhqUqbEpBzQaLTw8 XFPP9iFVgeHu9hnGls7L1m/1/NDj0ByxbIbqa3cH89Gz1x04fPjG46cJGfRN3xhpKTBIpWXH 1481NbOYvf5MsbrJCDxO5t5lQw3MbFZ73qCquzKJSUvYMrM3Yu6w7exz6FtoOoFA4O/vD5fk A6BBISEh2ljHScgs3Dihi3GXr30IubXHPMSC0gsrR+p3HBOSWy5il/0wrkPX8avzGO9qyfC7 u21N9WoHBttR62jVZ1p+KfHbHgbDFh0uU9ZQkwcG/X7fH625s6LgdW9DvWm//Sc7r38cGMr3 f9fbdugaMv/d+YSS5jvArmGBgZv/8wQ3087jSdVvm4STMad3h7m/3K7UZmDIj342uqdF53HL ApNLRGrWARRirm7rZGXx3Q+ncplcDQ7hEolErc17UTEkIQm+vMnc2vWsD6HmJg41y+fx44TC iqoq1pV13yIu03K57wb8+ZSEMc4G2ggMgsrCU8vGWnTodOQmnsFXM5bHoZN2TB9s4dzzr2ex LIGaaotVGrv265523QbfxhJ5MHFBE/Ly8mB/PQA0Kzk5WStVgFSU9vKcTTvEofuQzfsvRURE EAiEsJdPN6+bYNsO+WbNqTKOWMpj7Pt+kLG57Y9nrkUR4jHeV6b17mpkpF87MJhbOM78+Sw+ Lj4y1HvN7IGIkdmeB3FK61TFHIZ2ti4/nrgcHRcX8eru98M7GrVzvRIor6s/DgyMQ7P7mtp2 O/MAl0AgvH5+c/YYNwRB3Cevy5fHAFWBoUqM/XN9O2ODSUsPYKJi46KCj6ydZGJiedKHpNke BiGHQUohZBfLFtqS8Iv2zhxs5Dj01psgtMA1UjNyePKKS8CmEpMJBRRZ6bk5/sO7WLtNXo0N ja11LCG7sLyJfUlok01ry4TKA4PDSO+QqNplJqSkllcKeeTQCd1sO7gNP337DXpbdOijn6YP aWPu5pvDQd/z6xsnICa2B2+8jSMQcH5ey6cO0tNDXAZNT1JccdqkwCAqySIlJmXJU6gkweuQ ZRv9JftuRsd98CFQKhR9DYICUmpKar484YqxlzZamFusO34vvvaxhDQ6V5GA+TnJSWkZRfK+ BPGDAwssbBy3XXzywf9OSGdpdE3vViUmJqbZFqkDoJVgMpmBgYFamkiM/XtHPzsrIwMDPT3F 1Yf6Rm0ths3dkE5VXIYmzn11rkvbNvp6iqkIjnsOn+zx4ZDE+GXbxvRwkB+gZ9im7aSfLlHr adkphiS+/2WTu6OR7OXQ1zI2Wfu7D5svryTrDEnEvzjV2Vp+JKJnYGjUbeDXI3vbdBy5gESR ncJVBoYqXkX+yZWjjI0MFRdVGhq1+Xbz3wxZza3JwFAc/cDdAZm64xb6d2Hkf+52RkgdrsNn psqrxVzcBUcLZOXvvujfb8+vMTeseywydd2tplT2QqEQi8U24QlUkweGumy6XA8tRO+O9jrf zcHSQPFV0NNvZ9Vh9flXikfmRt7tbWes+Cj1DYw6ug+bMMTBxm10WJ68Hm9SYCjxHNvX2GSC rKXKI++Y1kdJCRGXM68V35P8tW4u9q5LZZ81J3vFEBdlB/e4E6uYNZQx3dqs57Ctsj052MQp nSyUHdwfU6iNK1i/fBKJBA23sF4TABoXHR1dUlKipScXVhbiHt48enQHav+xy7iEjI8OKEkJ vHxw7+49+97GFXBK0s4d23vbL0F2R0X+pTOHb/rGc2hpF/d77t176FWQqoUj2MWpF44deB6e Tc8MP7rf03P/n1hCrQ2SyhJ379r5OLx2X4owJxF37BharsM3X4SwuOzIZ9d2HfojTXaxQxUt Fbvf85A/8f3bkh78cLfn3pTqqxilUkmC39N9np579hx4ga+ZUiggPL+148jfee/71Xlvb5w8 fOK+mqYOl3bvn1PHb7zg1+qOZhUSzh7eceN1DPo3ORErfws/duLSrTJ5+KJnhhzdv+NRsCzQ hHlfVnbsjhtPYpqyizzaXtPaBAaUKNnvtpJCHzwZnftupSNOcep99B3ZsePAgX9i02pHMHFp duTJk7J7Lt3D0LncFNx/e/afjsqRLwjMK/n3zNGjd3FqS5AX+WjHjmOEktpjIqy3/5zb7XlV 9rGzi65eOKbsfT0elKb4njAenz3+7rNm5Jw7cUDZwafjyAz5wdSbB/ad+dNHdmEoLe3Qfk9l B5/PYDbTJnFfmIKCAu2sRwpAa0ej0YKDg2F2EFCNRCLBHsGg5ZNKpYGBgdpZXgyA1g79fREI hOTkZFjhBNRHIBAEBQXx+U3pogCgOaDfUhwOBy0gALQE/XGFhISkpaVp5xJ78NkjkUhopNR1 KQBQT7Ezr65LAcAXLjIyEo/HMxgMXRcEtCxMJhODwXC5MJ4OPgPx8fFUat092QAAmiSRSIqL iwMCAtDkQCaTof8ZVMnnOr569Qp28AGfBfSsFRwcDKOrADQPsViMxgY0peNwuPDw8NzcXLTK qKio4HA46I9RJBKhuQJ+j1829PMVCAQMBiM5ORmDwaBpAT5x8FkoKysjEAjqjwMAaBQaDOh0 emZmJhoe0OQQGBjo7++PxWL9/Px8fX3fgC+Xj4/P/fv3z507d+HChRcvXui6OKBeuj5JtDhE IrGwsFDXpQAAgNZCKBRSKJSoqCi0SkpMTISpsOCzoFivSTvbrwMAAFCFx+MlJSUFBATAhBbQ 8tFotLCwMF2XAgAAWimpVJqcnBwVFQUXtoMWLiUlBdYWAwAA3QoNDSWTybouBQCq+Pv7V1RU 6LoUAADQqjEYDLhaDbRkis3RoB8MAAB0C40KsbGxpaWlui4IAP9n774Dmjj7OIAfew8BERAQ QcW9UHDg3tXW2lqtto6+zjqqba3WUfeso9aqVbStVdx7sPceYa9A2BBCCAQSsifvkwQRJSSx ggH5ff7S3HN3v4Tk7nt3zz0nX1FRUXa2oufTAQAAeD9IJFJqaqq6qwBADtkDp5hMproLAQAA 0IC2xhEREequAgA5OBxOWFgY3P8LAAAdATqI8/f35/P56i4EgDdRKJT4+Hh1VwEAAKBRUlIS iURSdxUAvCk9Pb2iokLdVQAAAGhUVlYGA/WDjkYoFAYFBQkEAnUXAgAAoBGbzQ4ODoabK0GH UlNTExcXp+4qAAAAvCI7lINuDKBDIRAI+fn56q4CAADAK7KH+7DZ7PZYdnVxVkRcBkvQ9h3d RQJuCT4pIiIiNjaFzm417YgE9OSIOApTyZntqmJCUmRkRERUQiqBpTA6iUXCysLcRLTiiOjk rGK24gWLBNTyvHjUNiYmr7wKhh9SXXx8PJVKVXcVAAAAXpHd7d4+o+9yHv4yH7OfmV3X5mlE jHvw60BHMwzD9Gw8wggU+Y2EgoR7O7th9ncya1tbkEjIivY+6jHA2UxTE8O0jCxdFq7dX0KW f++/kE9/cX6HWz8nYw0NDNMxtxuwZNOvVAavlUXzE56dnzW0tyGqUle397AJOy4+5sA1eRXw +fzg4GAY4BEAADqa5OTk9umO3n6BoerHCS56xoM3/HL06KXbZLrcx25y426ddbJAu2tFgSHb 76y9kYbNwGlbDxw6emj/qqn90e591oYLtfJSQPSNn7sbaDm4zf358JGjB/Ys9uiFGi/Z94Ah LwaUx1zvb2nUo+/IPXuOHt23c9KQHpraesd8SmBYAaVKSkpycnLUXQUAAIA3oe1zenp6Oyy4 3QIDPXO+q63tgv1C+V01xRRC5o6Vs2y7WwzrY6swMNSdXjpGy25iOoUn3Y+LhVz2nk97mfb1 jMhvecqlevvUvpZDv8DX8qWrFXNqiRun2ZmPmJ9FYrVc9OXvxhvbj3qURpb0JxWLK/FB4+y1 5v9wkw2JQZnU1FQKRf5ZIwAAAGpEp9PDw8PbYcFKAoOQQ4t9dnXtnEkjR46cvny1d2Ai7dWp AjGtgvDXH3sWjPeQTJ0+/dj1F2SO9LC/OHjMqMFm+jo65rZo0k9ekS1OBvD9jmx0HTv7+DUf /9NLFAYGPomQk5JX1vwln+PLjR1G+WS23GHxSnMyM4sqX70gYt/8Yb52v+lJpbSWiyYVpmdm F3Gkp9WFPDrO52w/I90tV+L5cD+KMlFRUSyWnAwGAABAvcRicWhoKI/XyrX4/05hYBALnpxa Y2WqZ2Rq0b17925mRvpGjj9cjpQdf3NqS7Z+5KSta2hhhSZ2tzAxwvRN11wOkkwlPHews9LT 0tTUM0KTvjkV0KJuUUVmeh6FgfbVsZeWK74k8SYBZ/s8e9sRs3FEuZc5XsOjEddO7uE4aVlB TesdJYX8h+d//nz+tH7ONhPWHyyvV7WQLovP50dERMB9vgAA0DHFxcVVV1e39VIVBYbajDv9 u+kN9lwclVOF/kvGh62d7ahhMShBemSf9fiAMYZtOBdWxRc2iETVKX5DrLQGTtxaJgsHtIxP XG3tFh5UWsHbBQYhO/rPrRhmsvlSmPK7TPn0hwfQws0OPs5S0DlPxGPt/3LwwIGWeiYGQ2cs Schu8w/5Q5Ofn19QUKDuKgAAAMiXm5vbDltpBYFBFHNli6m56z+RTffai4tjLjtoaG6+niZC B/o8dl1dHU/YIBAIaJXErJinM1y1+o5dXcCQtm2HwCDg1D0/t7WHrvbU9aer6pXkBT6L8u++ FVYGRnN/vMzkKe6UIOay6plMeknsi1m9rGxHLCHUcpQW02XJTnZxOPARAQBAB1VTU5OQkNDW S209MIgFt3d+qqdn3H/ISPeXRgzpY6ChseI3ydG9iM9LjvH5YfFsTw+P8Z6ekz3H2ZhqtF9g YNbkHV0338ai+/yt+yvrFd/6KK4nZ/y0eEoPS5uVB36vVjbCQ/O3HPHHNxhmeyOlStVZuh4U FcLDw+F6BAAAdFhCoRBtqNt6+CZFgcF7+8e6Vn12/vqn9+ti8WRRg7g4/Jq9hdmX35+8de9e cGxcMal+4wSd9gkMYg4jd8Mng0ysHTcevin3bsrmjamV8d/M6GNo0/eXiz50RWFBzKTX0eis 5mcfCp8ewLBuV+IqW52py6NSqbGxsequAgAAgCKFhYXZ2dltukhFlyQSr20zM+ux++arvQOt FHfqwAH/rOqGhrrflozFnBZUvTzQZJWEDrFql0sS7DrClsl9jXsNvx6EV9pvgU7CLRvpYNZv nE8SUdmZBfb3Uy1t+s9LpjR2nhSyqo4sd8dMhvoXqNwDs+vB4/HFxcXqrgIAAIAiTCYzICCg Tc8GSwODxdCTV6/dau7hswIKS0jDLxntaGzZc+X2U+i1a5f3zRzUU6vHuNQaIZrx9s/zME3d pT+evnHr1u9n9rsPsMPQjn/EzDTZ6fx3Cgyc9GDfO3dDpOMsCMIvbtDR0vzixzPeN5uX+CSn QnanJCvhxZNHT2OkOYV/b99CPUPTlbvOvdb21vNiquwewPrwB/deBCTL4lHCzV/sTPRdxy66 cuXWrX8urflsgp6u9vwdV+g8ON8uH3RgAACATgFtrjMyMtr0iT/SwNCSpfPV6HI0OT/y8dyx Qyz0ddBrWlom/YaOOfk4WTZnVW7QJ6N76elJphhZ2E1asHzFR33NXTyC86T7+XcKDJW7Jg3R 1Z+GR/9kFK+f4iqnQszhpE+mtHHpqv4O1r2WFqF/0rMXDLGV17jf9aRSaWPC3G7Gru7fywbN FLJpd06s72NvpStpo21i5TBr7SFlHSS6NBqNFhYWpu4qAAAAKCcQCHx8fJhM+U9SeHvC0tTQ ay3dfkioahyWh1tbHvnkruS12/4F5eRm84rqKvMePkRTbvlEpDJ4vNL0cO9bjwhk6UAGvNqQ x/fuhSsfnZKSF3Xt2v3iuuZdE9gp/k9v3AiQnEFgUwOe3ZNT4bX7WcQ6aWNmzOP7dx9ESs4w MMlPH9yW1/hRQY3sE6MH3775+EXiqyGHhLzyrNj70vccEJOt+LFWoLi4OC0tTd1VAAAAUAmR SIyOjobn/oD3D4fDlZeXq7sKAAAAKhGLxdnZ2YmJiQIBnDwH7w/64oWEhMCI0AAA0IkIhcKs rKzo6GjofgbeGzqdHhoaCiMwAABA5yISiYqKivz9/YlEIvq3ussBH77c3Ny8vDx1VwEAAOC/ YLPZMTExYWFhxcXFEBtAu4qKiqqthREqAACgs0I5gcFgZGVlhYSE4HA4PB5fUVFBo9E4HA50 cgBtKDAwEC6BAQDAB4DH41EolIKCgtTU1Ojo6NDQULSF9wXtQN1/ajVAUSEoKAg6MAAAAABA ATweX1hYqO4qAAAAANBxiUSioKAgHk/Jc78AAAAA0JWx2WwUGNRdBQAAAAA6NCqVGh0dre4q AAAAANCh4fF4AoGg7ioAAAAA0KFFRkbSaDR1VwEAAACAjkt2QyUMCwYAAAAABchkckJCgrqr AAAAAECHlp2dnZ+fr+4qAAAAANChxcTE1NTUqLsKAAAAAHRcIpHI39+fz+eruxAAAAAAdFzV 1dWxsbHqrgIAAAAAHVpGRkZxcbG6qwAAtCN2VUWgz5OLEtceP48tp7NVnZNJfnjrH5/4PFVX VFN87/pfkZkV/7HQtsHPj/JFb7SSwVV1Dk5dbPCdK1cuXrrkFRafKxSp9Ay+goSntwKTVFsB I/zO3egckqr1ANAhRURE0Ol0dVcBAGgnvLB/9o0e0MfU2BCT0DY0tnQe6vbLwyiRKo+mrYj3 cLWeu/OGiiurSn82wt5844Wwd6n4nTFvb/oYs5kQU1anSmt6adraj90szfQ0NTENDQ1zK7uP fzpdxlTyYJ3adN8Zw2xdFx9SZRVxd444d7Pa4hWhSmMAOiaxWBwcHMzlqpzDAQCdibg6ydvW UMum74gdv/7+ROL2uVPbh7vaYd163YgqVz72yoceGMQcyulVU7UNTJZvPvvgwZOH968smNpX U7/bFq/QVj8cIa8kK/jrUb11MExpYOBz6KnPL7t0N8YwMwgMoFOTDdkkVuVAAwDQ+bCf7V6I 2Yx+lvrabVBlmf5DbLHJy/+oFSpbwIceGOjF8VP7m07ZcJErfLkZrM2Y2Nto4Iw91fLaC5jV z45ucLE1dRoxws7OVHFgqC3N2bliQXcjbJz7WHMDCAygcyssLMzNzVV3FQCAdsJ+svNzrOcw vwzKay/zGHcv7Nt7zruO08Cpq1jqrj9hybHqlyca6Tl+I10sFh64K/mPNDDM+envF167+rgY 65uaDl+y5llqsbCVw29ZYNhw/tE/+5cNMDc2NjZfsGw9rqC2sTn+oYnRyMuP/l0+tbe+vu22 62mCBkFe7LPv/veRo5GBvr5+r94ua456VfIFsuYFPoe7m/XcefH64RWzbdBkS8spS7eE55Ff rk1YmhK4dv40M2NjExOTMQtXvsgkSVfUGBgehzzbuXCStb5+9+5O3+4+X1kjp+eGWCzicbl8 QfP3w9k6xdzV/Xu5/TDqy9OWTBv286Hb5QWxk4fZKQ4M2QEXp4z/+NTD6IKQC47dIDCATkws FkdERLBYLHUXAgBoJ2JG5pNeVvo9+ntsPurlGxaWkVNY9/pPnlNH/GI45rHwEKUpMGT7DLY3 mv/LLcl/pIFh6GjPHj3t3SdM9BznZmtqaOY6M6KQKnd90sBgPGq8m52tkydqP3qomZFun8kr M0lMyeScezpazu7j+/Qd5DF58uQH6fXkrIDprqYmNi5jJ02aPGHC8N49MR2Dby9HyRJD/vP9 pvra5t2t7V0Go/buA530tbQdZu2QvYHy1CeT+5obm9u7e06cOGGso6VRN7fFmSRGY2CwsB3u 0nvgMMmK+vXsrqNjsOz4ExU+MVFN4i0Hc+PZO7zl3mou4nNIFSQBqo+cMkVZYOAyaispdGFD Q2n4nxAYQKfG4/H8/f3VXQUAoH1lh9xcMMnT2srKUF/HxrHfhJkzv/7hUHx2KV96Dl6VwKBr Zn3iUSJDKOJza2P++sVQB/t48/V6eVcypYEB0zN2uxubw0ft6eQ7J5bpYforz4dImksCg6bz mDU4IlPWPsxra78+gy74EdhicYNQSEx6MaI7Nnbh0Wrp3loaGDDHYUuCCZL7CxhlKVtmu+oZ joinoSjE9No0VVPf9Nd76fUCoUjAybh3xM7O+aRPbmNgwDQnrj9RTJGsqCj2/tie5j1n/FSv 5KMS08mZ/xvrYD1wRnie/ET0igqBoQkEBtDZ0en0+Ph4dVcBAHgfaktLn9+/emzfvq9mzDA3 MMDM7I4/wHFVCwzDV/3WtBwRj/XjXPv+U1cX07lJD/7++aVdu70ojYFB/4sD95utuXqhk4bH olO1DY2BYeEJ35blcbncSnyGz1/7B9pgoz7dS+ZIXpQGBqMtf0U1NQs4vUxH3+gRCgXUzPkj HG2mbpV3g6g0MJgMfpJV9fIV2q45zta9lhQp/IhqCmJXTe+DmfW7FJglUPxpNkBgAF1LRUVF VlaWuqsAALQXHpP84vbfEVmkV1foxWIBj0fNj1s7vpfF0PkZlUxVAsNrnR4FnCMrRlsNn5NK rPp71SzsJW3dyfhWOj1u8NRw9VxfxGwMDKvOhzdN4tJq/r1wYJprz+6Wlq7DRs6cs8DZ8o3A YHX0aWZT+1eBoTJ58hDb/kuOyHvfLTs9Kg8MuGdnRjtYWA+e9G9CmVCVbuAQGEBXkpaWVllZ qe4qAADthU7ETXfSHf3V8RrOG7dD8PyPfK1tOPwZnsylVSwZpeu2YDf55bE6Jfl+fxv95oFh wneXm+YU8Vjfz+np7LmEQBXUlBakvJSaSuC87MOw8qRPs3VVfdZLY+S8A1WiloFBEHBuk5Wd 64mbgekZGYVlxCpS8cIhqgUGStrsYT2dPt79qqeBmJeDi0rLLue/ZWAQCXmR/x53srN0m7E6 MLNM1Q8XAgPoMkQiUVBQEI+nZHASAEDnJWJXH1nqgZnZ7b8dQKlny26gFvH51cTEb6fY67rO SSHSBQzKuukOdh6fpRMZaLKQz75zcImBNtY8MBj1npFEYqLjbrGIT8I9cLLApm+4TJd3S6as D4P1mFXlTDZamljAzQk41h3TXHbST3KS/83AQP7Bs09391UVPMmyBHxO+oszPQwwt/m7K6Xp RVFgENQcXuSm3c3FF88QojcmFtFLgocYYR9tv8N9u8AgyvP/08FSb+ra4wWUt+kBDoEBdBl1 dXWRkZHqrgIA0L6YxXHujhiG6Q9yn7Nt27Y9e/b88L/lg/qaoZe2XPBloR21gPHHummaGDZg xoLte3Z9u+Lj4b0Gm5rqNg8Mjo5ONoOnbty566fvV/S2M8RMXbwTy+WuTtaHwdGxR7+JH+3Y uXPb6kWOxphxr/Ghsj6EbwYG7sV147V0DGYs2bh7z57VKxf06GaACus7bVkxTTJZUWBoaMj2 P+tgrNHDyePbn37euX3r+D5WWI+Bz9Mob3VJgk8v2jjFFTPrs3H7zj3NHDt7qVzaRbKemPH7 8T3/+qe8Oae8wFBXGHvi0J6H0YQ32kJgAJ1aUVFRRkaGuqsAALQ7am7ivv99Pty5p4Fkb4zp GloPnzLv5M0Q7svBB/ilseumj7bW09bU1hni+ZW/391Br/dhmLX1wqnvPrfQ1dLW1hs0esZl vwx+K6O9yfowrPvtrx+/dDfQ0dLStRw2cd6TlKrGhzO06MNAyY/4Zs5wQ8mo1fr2/UdvPXBs 4/wBZgNmJpZJ9taKA4NYxEm4f2bC0H7aWohu/xGTL7xIlxb2FoGhFHd7sKkG1oK1q3u8dCAG UuLtAT2w2dv/eXNOeYGhOPisrSm24rTfm2uBwAA6s6SkpPJy+ccIAIAPjEjArCgipKXhkJQ0 fAX1zcfHsOsq8SnJScnJxBqmgE3LSkvOJ0rPCfCZOZmphPIaAZeWnYKmp5ZV1ilYEZ9dl52W UlpVz6VXpSUnJaVkV1Cbnefn1CbhcMVVze9uFNXXVkgLSyWUkvlCPqUkD5eaTeNI+iZw6yqS k1JJda/uhKCTi5KSkms5TS+Ia4glaD1oTaWk2qZlUksJuDQ8g9d01URIJGSkphe2HASfU0/J wMmRmpnD5Ms+AGpmKi6vvMW4j3xWblZaZsFrz5Pi0slpybgiMu2Ntrx6SnpKSilF2W2dAHRI kZGR9fXw7QUAAABAqwQCQUBAgFCodBx5AAAAAHRdZDI5OTlZ3VUAAAAAoEPLyMgoLS1VdxUA AAAA6Lhkz5yi09/s9QQAAAAA0EQ2ZBOX27K/MAAAAABAIxQVUGBAsUHdhQAA3o5AIKisrMzI yIiPjw8PDw8MDPTz8/MFH6KYmBh1f90AaCASidDjEYDOhc1m4/F4FPXj4uKKi4upVCqTyeTz +eJWBlACAIB3h8PhSCSS8nYAgA4ARYLKykp/f//MzEwW620edgAAAO9AJBL5+vrC9QgAOgWB QIASflRUFDwnDgDwnqEjlODgYHVXAQBQDqUFFBWys7NhjDUAwPtHpVKhLw0AHR8KCXFxcQQC Ac4HAgDUorS0NCcnR91VAACUKCgoiI+Ph7QAAFCXxMTE6uoWj10DAHQktbW1YWFhkBYAAG8Q i8UsFgvtx9Hhf15eXkZGRlJSUlxcXFRUFNpoBAcHt7zbOiAgAL0YGhoaHh4eHR2Nw+HS09Px eHxhYWFlZSWdTpd70RNtf9BcAoHg/b9HAICK0O8U/fbRD1ndhQAA1A/tshkMBoVCQfEABQO0 E0fBICEhITMzMz8/v6ysjEwmU6lUtN9ns9lcLhe1f+NYA+UB9CKHw0ENUDPUGM2C8gbKDMnJ yTExMShmREZGogWipdXV1aFmKJaglmhDpK53DQBQBYlEQpsFGGABgC4L/fzRXh7t1lEw8PPz QwkhPj6eQCCgfX17HPLLzloQiUSUGdAaUX4ICgoKDw/H4XCwIQKgI4uNjUVHE+quAgCgBjQa De210fF+YGBgYmIiygxq2WVzudycnBxUA0oOaItUXFzM5/PffxkAAAXYbHZoaCjcRwlA14Ei AcoJeDw+LCwsIiKisLCQyWR2hI0AKgwlh+rq6uTkZH9/f5QcysvLYUwYADoIePQ8AF2HQCAg k8kxMTHoWB4FBjqd3mEvAaCcILtaipJDTk4Og8FQd0UAdGnomCIkJARO/QHwwUPBgEgkop0v SgtVVVWd6JYoLpeLsg1KOPHx8Ww2W93lANBFsVisyMjIDnuIAboAftoLr017zley2z618pl1 vv8e3bRp086dJwur6ls2yAx9emrbtk2bvttzwruAotJ57/qq9COb9xMUHuwK+dzYR94HNm/e tGnbicvPKUyVqi1N8T1xyIvEUanxW0E/cAKBEBwcnJiYiHa+bb+C9wUFHvQu4uLi6HS6umsB oMuBcdWAunEe/jIfs5+ZXdfmR4487x3zMBkHz8jCmubThLyas2sm6mpiTYysXLx8MhUvkV1D 2rloGKbhHNZ6H2FGVfbWOa5YM90c3aPyahUvmVaS8+koc7v+n2a26Z5QJBJVVFSEhoampqbW 19d/AIcGAoEAvaOQkJD09HQ42wDA+wRZHahbuwUGQfHqEb3M+nwRnEYglBC5guZn4EWpd3Yb auvP+OZQUHoOIS836NLeQXa6jiMXple3dguhmJQfvW3hJD1tTYWBQXBz9ydGBlZLdnvh8giE 7LSb+1fbmmIei/dXMuVfAhAJeAWpLxaN7a+podG2gYHJZOJwuOjo6Nra2g8gKjSHYgOBQAgL CysvL+9E11YA6Lz4fD469PjAtiSgs1EeGIQ8VlVZSUFBQWklmSN4syc/m1FLLCqSTC0tpbN5 jd9mPrMozXeas7X1nK1oErmW9fq3nHFv13KXySsKqK/Ozz849LmpdV/vBLnDl/Fxt72G93dw GeK5bFo/hYGBcuCzSR5f7ae9vMAi4tGPL3UzGDg7tVzONRG0V79z8OeBLrYDx3326UiTtgoM 6EeNDsP9/PwKCws/4P0pi8WSDTgJg0MC0N5oNFp8fLy6qwBdnJLAwK0uOLZlsauFIYZhpr1d l/94Nv/V2X1hftjNzz4aY6OnLZlqajplxbbkGukeF/9AX1er6aLA5wefK71yH/XXDxZWLn/H lMubyPDesGLxoT/Ty6iPD8xUfEniTSL29a3ztPtNTyqlyZtM2v/JwnV/3Kqo5ez/3KZNAgM6 EEhOTkbHAl2hM3NTNCKTyequBYAPGZFIzMjIUHcVoItTGBi4VT/OHaSjZ+gxa/GGDRsWzR5j pKfr9tUJWdNaQvjYnhoWTqO+XLNuw/r1Sya7a2hoeK69zELTyClb1i1xMjc0cnFHM3r5Zio5 BKWVLPSwcHD/DN9KXwOxSCQ7R/G2gYFeEDXKQWPMsgOUVs6gNC25TQIDk8mMjIzE4/Fd6qAb HftERETk5uZ+wKdTAFCv/Pz8oqIidVcBujhFgaEw6LStsdEXW/+oqZecIeDWk7z3faSnZ+6d JrnxIC/48uzp0+8lUrholysW8+qK5/fTdh2/voglnZmW8Ymrrd3Cg0orEDJJJ1fNMjJzOvEo Ren+5q0CQz0xZfOskfpWw19k1yi98vfugYHBYAQFBZWUlHTB64xsNjs2NjYlJaUjDD8FwIcn LS0NniQL1E1BYBAGnVljbDXIyzeh5KUEv997aWis/jNWtlcQCvnUSmI+gRAf6PvX4fXOVpp9 x64ukN3zqFJgENVV5J78dq6Zkcm604/oHOX7GpUDg4iUG/Xt7JGWPRwP300UipTvwd8xMNDp dH9//9paJbdjfMBQVEhISEhOTobMAECbi4qKYjJVu0UcgPbSemAQC278NE8Xa0FDY8VvYfyG Bj6DduHgd8N7mpkYGPR1c1+6Ztd4Z623CgxVecFLx/fV1rM7dDeYJ1TpqFy1wCAqirnu7mRp 6eB2NSxVlcU2vFtgqKurCwoKqq+X26+yCxGLxWlScG0CgDaEflABAQEQxYG6KQoM939ZqG/n 9jSljPs6gRDtDgQRFzdomva+GVPC4vH4kicss1eP1lE5MIhKk+6OcjZyGjX3ZhRB9TP4KgQG TtzD406WWsPmrY/Kq1Z9yf85MLBYrLCwsKqqqree80OEtmmpqakwvAwAbYjBYERERKi7CgAU XJIQF4ecczA3nrvlTIl0tEQhrzb6zolxQ9yvxlc2NNSeXjQGs/FMIUsGOGCzaiNvHeymr+Hs 8XWe7HYEhYGBXZk029V88OxVcblVb3UsqjQwFMV5u9mbj1+xv7yG9VY9Cf5bYEDH1OHh4SUl JW832weNx+OhjRuJRFJ3IQB8INDxSEpKirqrAEAaGAysp8+bv6C55d8G42sa+LWHv/bU1zcY 6DENvfbJR56O3YwtxnxTLekCKQg+t0ZPC+s/evqnCxbMnO5pY2VuZKBtN2xqcqV0R60gMIi5 Qae/wTDM1WPGaytdsOJaSK60RZ33nq2LFu8jtphVXmCovrB5zcp1v0mO8EX1p1eM0dTRHzVl 3utL3hheIOsvRDqybOmm7X9TWyz5PwQGlBZyc3OTk5O7YC9HxZhMpo+PDzzmEoA2UVRURCAQ 1F0FANLA0JKl89VoyZAITHLZ+d1rh1sbo9cMDJyXrtuWUtq4T+XWl575YYGFhWSK49DpR728 z2yaaGw79EGKdPAlBYGBUfrtzEFyVopZbfs7RtqictekIbr60/AtZpUXGEpX9Xew7rVUcsdR VcJ4Zyt5S+53PUn2TFjC3G7Gru7fV7RY8n8IDDQaLTQ0FK7Xy0UkEhMSEuDDAeDdZWZmVlS0 3GgB8L4J+VxWS2y24OWdBWKRkMtmS1/lSHsvvCISCmRTOFw+OsqWLurljGIRmovNlTd4kVjM 5bDlrJTF5jWOIC3mczhoqS13NrJVvN5BUsxjS9Yklq5U/oKbqmoQS+bn8FqeEeBLy1XhdoqX 710kio+PhwGLWoO+D7GxsdC1A4B3l5SUBPdUAtB5oV1hTEyMuqvo0NBHhDIDXK8B4B2hYxMa Te5YtQCATgD9hOEkoVKRkZFwZATAO4qOjoZBGADopNCPNzg4GG6LVqq8vDwpKUndVYAOoSDy 6rCepq9znj5/7bXwNO57Hkm9JGSgs+3Cg/dVbF5bln5sy3I3GxtUsV2fyT+f8ibVKH+8LynD e7Cp6/3Mlj2s31p4eDiXq/SBPP8Rg5T797G9k8aMkP5F7Id7fLrn3NWcGoZKM5NwU91cvth/ R8V1UTJ9Pfs7/Hgl8r+X2wZYD7YtNu07O56o0kkbsYAb9+j8p1P7WVmZdutmMevzDS9weOX9 udnU42snuK38VUETRnXhpf2bxtnbo8/d2sF93S/nCytU+9hBp5Kbm4vHt+yS2Sohrz4jJvjQ nv9Nm+aGjPts8WGvG9lEavMuE8Fe26d+8mWq3D4R7JoTWxfNWrOvqv6dNqxiEYcQF1pClmx5 RHz2me8++mT1z2Vt90TvlthsdlBQUDuuAHQehNCLLqbadi6DxzYZNap3DxMTqyHn/DLfaylF AY7djT/afUuVtnx6/vLxjkbGVgNHeaCSh7vYGegZzNnwO0PRb1FYlho5f3QvDOt5K73m3ett v1Gb+LS8r8Y6GhgauQwaIv2TuA8d7GJkqO8wZ20JVYWIUhHv4Wo9d+cNFVdXlf5shL35xgth 71LzO2Pe3vQxZjMhpqxOeVsRL/bfvd1NdeychowZM3aMxwgrc12TPuPvJSm6lV7AqXu0b5m1 gY7r4kOttmGW71zkbmRg2nekO/rc3Qb0NtLVdluwo5oNHcU/NLGxsVSqqgcOQh7l8q4VPU30 dfWNLC2tEHNzUz1tbZthE68G5zZ1Lr1/4HPL3kOjyuQtglW1Y6nnoI83VdDe6QmYOb7HnSz6 3c+R5GoRj7Vn8TC3eauK6t5lkcqFhoayWKz2XQfoDKSBwfKHq1GvXuKw88KuDO9uPGzxsfd6 wv0tAoMw5doPOjqWm397UsmRRARaYcr3n/QzMHN6kCV/ZFcBhx3x4LdZI50M9XXaJDBwOJx2 S90C3JVNmJbVNwduFJBldfKpVQV/Hl2jq40tO+Cr/DTKhx4YuFXZX3rY246eH5dVLRI1iIT1 sXcPWhjpeK65IPfDEaMWJel7N31mY2qkra2pIDDk+Z6yNTNf+OOlEqbkdAWLlHdyzXhNzOh8 9HvqSC+5T0Eo5PP5XC4XfcfYbPk3DIB3p/pOEB3IX9s1V0cLGzD+y3+exrOlX7KqipzbB7/r Y4YZ2gy7l9j4RG9FgaGNRF34CsPsZYHhvcnIyICBrUCD3MAgUfv95J69xnwn20rGPDp79lEM szjzt337Tt15SJZuSzm0wkd/e+2VOHP/eTzr1QUMus+fZ49ffsZm1XhfOI8mn7/gXVbz2g+T V1/je/MamnTq1KnIEkpj4H4ZGMQM8pUzZ/buPfbXg8g6jtyqBdmBdw9euFlV/+okdLb/6Z4G 3Q77FMhtH3J2m6GJ1ewV22/s/axNAgOZTMbhcO+4kFZId52DPyFUvZbXBHTSqsk9Rny6ncxC +Yd+9+Jer7vhzJefOpdCOH/q8K0Q6bO2XwYGNjXvz4sH9x4+fD06VcGWsSkw1BUmXD1y8ODB o2EJzU4uUbIO7D+fXVEe/RT9Nc8EplYKJPejCXJTAs4d2I/+iH9cuJhWTm06L0vNCzty8Hhk bgUR53caTT5+/GlcZvPTImKxKCPk2eGDBw8dOnQ3AvfyTTYFhqqCiMcn9+799dc/Ugnyd9Ns auk/544+icpvdtjP/m6Sudx78xsk+/3s5cOMbXqP+/XK72OG2SkIDMWJPsd/88ojv/rkq3Mf 9sWwNf8kt/75tQGBQEAkEtE3KkQK7cvCwsLCQXsKCAhAwUyVv05lxm0XHc0B8zajL8ZrdwuI +JlPj9kZ6A6eu4MsXVJjYCgV4dP8bt3yvhcYXMp8uQoBOzHs+cPAWBav8WvLY9bGBPp5e3s/ fuxPajFKp1BQnxzrc/Om9507/rnFjcNfFST5/bJyHIZZfHfC66kvjiUSJIU+ehIYSaPXR/o9 8IlM5TU75VmVn3T37qOmL3MdqfD5gwdodSGRqQzO210WIZFIycnt+xMAnULLwCBms9N9Lw+z s193zk/26zi13MV2zopFw+00MazP+K8JdEFp+F+uFma62trSAVU0dfUMP117jNr4lS/fNNLF 0HHMtDH/Z++s45rc+gD+jNHNJFVAUUQQBcQuFFux8SqKYmBfu66dGFeMa3vVq17sflEaRoyU ku6OkRtsY73xnm0MQSeMKziE8/3Dj+ypsz3Pc8731O8YyqDRYDMaLaNqPiWuUFBkcStzghdY 9ZSXkeEdKSWloGt68nUUbwtfGEbNd55q1VtaClwKJS2rajXnvJgmHXBzvbqy5k2cyCnD7Ph3 z95EZ5EYrMi/V7WLMGRnZ7epA7QtsJKe7EPQMg6Hbkdn4b8oEZdbR66tIddxuPU0YvFiS2Sk /akKYUlcm+Jh3ltp3hF++wxfGGxX7Js6WB+NRiEolIySqu3GS5VU0bmEQBiW7t5pZagojeKh oKi05szrWkHOlvpSBm2+brOdphy4m1IH32XTa4tcVo1RVpJH828/Go1WMhj8OKmhrM76cFxV XmXCjCk9FeWl+OscySnqLHF5LdhKJxVdWj9ZSUEOxduCklVUnrH3fg3PNgXCYLnZaY62gpwU 79lA9+ht9shHvID2pIzpA5TNZ58QudAgrbrg4d37Jfg6Nj52UovC8C1pnmcwCAK+tfiHiA+V Ss3MzMThcEASPn/+DLJl8AmDwQD+wGazORwOnM7WcXh7e4sXkojlc34pgsgee5cuYm8Web9d H+Xelu5JvEePJwwGA11OXTDspYxCIdKqaibTHCJySLy7SMFvsRukN8GpiAgUgluLT1g7ZbCm Ci+alpyc8sAxMx9HZzSW9nVlyYdXztLTUgQnQaOVjQZZ3Q/IBC/+PzuGN8axMh62rZBB2TlT 32j8bxklFaeWjlAcsjiH0FjFot/YOEnXZPancgYvA/S8PcWqnwI/11XH9JywfGtCdRvaj2tq auD8U0i9cAyDnpHZSCEjhg7tpaE82flonlB6gTCg1TBjftvsFxmZlFZMIRVttu2j3m/MjRdv IiMjAwLcZ1try/WyeBsvKKx5woBIoc2nLH3hGYoL9N21aJIsgjjfDufwugJrDy00VVTV33jk RlBkJNbjwRQT3Z5Wi1Oq2QJhUFLRslt10j8y0s/j7+kjDBFE5XVG6zJMTPWzMdPtP3lTiegW iS+0lzAA38bj8T94ku9CrTq62lZTo4duX1PrkSPX/H7Q7cOH2JQsirAZRxxhUFVTH/7bpg+4 sCC/l1tnjkBk1Y48jhb5U/KFAa2iorNg7bHAkLDAdw/njx8go2J0E8svJXnCoKTTz/ro7Y/g dldQOLGvT/VUUpi2/qx3eEQkDvfo2GY1WWTqhnskfn7KFwZEHtNvw5m7YH/3m4eteinJ68zK 5l2bjb21RUUWbbNov3swLizY99CSsYhin0cRRQ3CICNjOGTC5X89wIEXdzhqycmYrbzQ6u3n sMmvjyxTVtE/+z6hlV3L4tokDJTCGIcJxuqD5mXUtvMIYGAFKSkpwBNSU1OJRCIcq//z8fT0 FGs/RtmxucMRqSFBFaJb6T5ecJJX7HX+A69RDgiDnJycpl5vx+OuD93u/eG8QFNGeuiyExV1 rKbCwKKUHV1iiZbRWbT+wD03t1uuu4yU5A1GL4kv4V+CS7mzbbq8jNLoJdsePHx05/JhS32N HkOXF1CY2dGeh514LQxbz9157/GJLBSGLAI754MLGtH4O7zB2zllOGtddZvf7wA7IWUFjO2n rqZlsfPsX25ubvtWT8PIKdpsuc4UW0fr6uqCgoLE3BnSheELA6gDqqh/QU1JQV69z+BD93wF MduAMChoG71NbhgrzqRW+rx2C4jMYdVzORw2g053/3ONqmq/m1hBnGSeMMhjBv0vs2E4QV1Z 5CgMMnX9PfB3XRF2kBIyYZ1rtbDmXJAY/PT1+0Jg3XxhMBy/Kl9ovmkfz6ohyIH3OS19AS6X Vh7vMMIYo2/hhmu9l61dhAHU+/z9/Wm01uzkR2BQwny9Lx09Om28mQa4I/Ly8lp9Zq3Zl06i ccUTBo2RvxUJB3TQSxNt+qOt7Q7jGVxGHZn4BTK7QRhQg2b80diYU5PnbiaNstn2gPcNecIg NWHTvcZvW5AQ+PTF6xISv8OdySSWptiZIMPmHy3j78EXBtT0LXeF2SvzxeG5Mgo6nnkg3YU7 pprKG05IEQ7q5hJyQQ72KauyQRikMEffCQt9ZvHGsQY6g1Z/uxhBUzgsSsD9A3rKMrabLldS Wyt22yIM9Or0vQvGqKn3+vN9cvvW8+l0uq+vb1xcXMc+QpAW8fLyEqsBh1q8b6YlYjAzmyJ6 Fg7u/i4Morn3Aa8CDoQBUVDfdgfbsI1Burt3OoL0f5lS3lQY8AlP+yHIrD/ekYWnTH9xqZcy ZtvfgeD/9MKQcX0xAybtaRyRmRfx4sgR19Qq3t5NxzBwvggDyJbzZvdCpu94zK/mcWP+3a+h Zfw3Ngv8391luZJavwvvMxpOx6x7unU+guj74cUdyksikXA4XOv7Qbo6IrokuOTEiICZlj3k tY1efuY9lkAYNA2nxhGbHleXivP688yJ3bu3Lpg+vYeUFNJcGHqM2ND4tNNq06frIxOXXQcn qAm/gyDI/mei5l98M+ixMPS2LoJsfZ7y/eSzskJeTx6kq2lk+iAwXZzv2y7CwGKx/Pz8fl6t kEZLCQo6s2ONoQpiOf9IWR1bHGFoNuiRRXNxGt5rxNyUcsI/a6c3tmpKy05M+86gx83jUIMn 7SliNgjD2uvN6hfE6oL/gZrPoUNbHJeMN+UtRdBcGDTP/O/LLfa5uEJGXuktuD/42ImD9QY6 uIj6kt8Oeqw5ONNI29Ah9/s/DJ1UdGOXA0ZVbsSGK5XiTAMWVxg4lSnB80b1xej2dnkZ3vpp 2wKFQgFFVXl5OexukCw+Pj7gRW59Pwb+2JxhiJRFcIXo4caeF1crKPY6597QwqDRZ3BQ3peC mBZzH0Gkjr9LbyoMya+OSCHIxrNuz4Q8vXqkdw8lmx33wCFFofeNNFXXXxU9pvp7wlDPYd7d M11/xLzEMgaXTT4wb+CACauzajmgVvfnqqGYvhbnbz9tvNzlPYvBO+saIO5Q3oqKik+fPom5 M6QL851Bj/W4B7swKI1tt3lz878SBjadcPUPWwNj6/n2Tjt3Hn3wyvOJ63oNCQhDne+T46a6 yn2t5gfnVnHEy37bRRioVGrHLVhDLIqyG6TldObDV1H4uSzSy/0LZDAjfLIq2ioMXCb16NLB utZ2SfjawDtnlgpZ5niyRLQw0NdYowbZ7CigixCGvLB3Iwb2HT15rrOz8+lrtz39IxYOkYAw kIqyN8w2V9UwcP7zOZkhnryJJQz0WOzfI3or9TSb+ioymyX+ygRiAEoouGpwJyEgIIBKbX3K EW9NT1dHBJE78T5D1BgGyoG5fZV7WfwvkZfhfTtLghoNhAHZ5RbXVBjC/94MPuxrNvQr1l54 Cw4pxN3t20N1803st1erb0EYwIsc+aC3tsnNgPS6PK9+cjK/3wxh8acIHZzXR1ZJzWzI15d7 FClu/MZMPmLuDOnCfE8Y/G6sV0Njdt/jtbN9JQxlsc/7KiK7H8YwGtaPYT0+ME9RPGGgZH0w lEXs9j8iCzP4nPCnC6fNvuOT2kZhYPn9vddYDzNt5dGEEqL4eXq7CENNTU1ISEeFOaJX5ziN 6alqMSc8p7xpBsVhER9snYbWGhWQXckkla+ZoGUybUNhbcNXT3h/tqcKuqkw6M/a0ziHgkko WGAhZzV3f4moDJIvDNLj1l9trG7RCOEj5FG2m+7yeoe+Foba80uHYyyWpAmHVxELIsb1Fk8Y yNlrxvVXHbyoSNgSz6EXbZszduOJV5Q2CgOpJNV5Sj/MgNHXXoWLawv14ggDO+bDJSt9jPXM TRF55ez2bgPIyspKSGhtoAXkp4DD4cQM7U7IeGckLWUwbVNKKan5LAlWqseFXoqyZjP34oWz JOR0jJ/FCFfi5HITn+5AUJjbuOJmLQwvD0shyNWgysazcTksCplMY/Bewcq4lya6yrP2/9v4 +pMLI3asWnU/iNc5G3pzxfeEoZ5R4Gipbbv3n9AbG1CYYQGC6AxcznmnodrmtpEFX/q/2Ew6 iURiil3jCQsLIxBEDiiGdC/4woD5/boP6Qu1gR/vjB2grNTL1D2FN27hK2Eoxt3SQCF2O+4V VxJrCHk+j47210AjMvp/fuDP6WtRGFi0yvXjtVV0Brk+DqwgkcryojZMscAYDPZMo7RJGNhF gcYY6fGrT2aVEJqkvOGN46+UV0ci1bG/aXZoF2HIzs5OTk7+kTO0BIcRcX+PDBrpN2b2pYee 5eXl4Ivhk+Mvn15pqIGY2u0pAi86lbB7vpm8Vp9TLwMqSbXZn/2WDDNCoVBNhUFWXneD69s8 Ym1F6eeTm6chKPSmWziRJatgDIO0hpHLC+9qIrE8NXz3XFMpNOa8B38ayNfCUHlgiolyb+tX Ubm1JFJaYtCWRaNAdWnQjE2F/EEuLQlDPfPdycXSaGnHfY+yKwnEyuInJ1cqS0nvfRLfthYG LunJrvmIhtl9/4SaprefUico4rlskP2SRCyzKEoYOGwGmUwSPDmc8tipg7QGzliXkFfV5MQk Ko354+7A4XCwWCwMJ95J+Pz5c15enli7sujPT9qDV9Js/LJ/P34SNEtUlKa9dNk5QA1R1Bny POpLHAYEkbGaueNzVR2nnpEa9u8IEy1l8/lplXVNhYFUEjXFQNnQcrHHpxzeM1pX535haw9N nf3/hvLOQitYP7avgrrVraAkNodLI+Rd3DQDQfTeZPDGJKW/Powgag9DeEN7vhaG+nr3CyuM tC1trcyGO5wh0huWDU1+46KloDLVySW1jKcZdfmZJ1dNRNQG4ErFMm0mk+nt7Q170CD1DcIg Yu15ebWeW+40dKJ9JQz0muz1Yw2a7Ks2Yqi1sozm/n8Fvb0tCQN4egtjX4/SV/hytIL2ptu+ vC3iCwOH+urwQjTq21QrOJ324BsD8ZqDDYIMCyV8PbC5XYQhJCRE/Bhx/wnu8xPLDBTlmn05 tKzxuHkxJYI6ESv5yTEdtJRwm+qmnYf6N++SmLhovbme8Nai0EOXnCipEz1qS9AlMd95RW+1 L1ebd+ABUTCG8JsuifAnB7Wb3EAdI1Ozvir645ZkVfF++xaFob6uOmOPnWmTb4UasuJMZR2z TcJQnYkdb6T47e3XNhkRyR8kXvrpmakOMmPfg6+PFCUMef5XwO/kdNEL/B97c5OajIjXYca6 B6IjgrWFgoICGJO/8wBeYRwOJ2Y5yKLhb+xbrqcsL6egqqOjB9DU1JCXkdYZPOa2TwpL2BTF G8Og3XO67XQ1LR1dPV11VQUpFYNzb2N4utl0WiWHEf36mKYSWkkNowvOpaOjJKs0yv73zCpB Cc5N87ttpasup6yuq6uno4WRl5NfuP8fCot3lXw/V/Doq2pojVxyIp/ytTBUJX20NlREy8qf 8shv/GIcZvWfm2yU5GTVNbV5V+uhoaik7XT2BUs8BRAsWCn+DwvpwpQm+fy+wr4pixcvPn7h QlhKMb1hXft692u/r950MvdLxYhLKU659scmB3v75Tt2fQhILUsN3eq8/PhDf/7Wqnv7fl/9 x53G+PtMasnpDfbHrngJT8Apz0m8dvwguJaz8w7P0FQak/+alH/euMbxzLMvnSNVab7O9vb3 w4q+TjSD/PjiXnsRLLv+JpZ/LorXlaP29vvTKF8HUs70u25vvx6X/9+zf1BDDAgI6Gjf5jAZ +OyoB+ePrlnD+2IrnPc9+BhEIDXpUWDREnzc9jktW7LM8e//farKjdm1Yfn55/xfj5B5YNva M4+DStKwO1c4LFu26tZj35rv2AKgJj967wane96fM3Ev1jg6OKzYdf/jJ4owvEx9cfiS3xbf 9PqibWwmKcLrgTO4N/arj117mlNc+PH20aXrDiaU8CY/4GNernBY/Tb6Sz/u5w9Xlzgsj2qY 78Wlkao/3Lu8fOlSB4eV1x561jQMPqeH3jtn73wkvarxOat76rJl7aYr30bWwKf5//6biNu/ dtsfmfyck5AVumOt/Wm3wG++au7xPeu2XXrd9LOKRI91K+yvf4gH//e5d3SxqAfr9O1AcXq7 WyYsLKyDPRPSBsArHBwcLH5LO5teGx/sfWH/ShsbC8DYuQvP33yVWFjVdJCL7+1dE2bZB8fn ntgwd6iFxbxF6577xDa0czWLwwCoC/d6unbhXN65Jk3ac+p1Nr5JpsShZ8R471w/y9LSYsQ4 +1N33uGFK1AwyaV/7V5ibWUxbdHuLCL1wuZps1bt/bKWBKPExWme9fS1ec2rSpTawrf3Lkwf Nw5cbdRCp1uPQolix26KjY0FrivmzhAIpCmFhYXx8fGSTgXkF4PFYgHPFDO0IOTnkJubm5T0 s1bMoZRunm3a02aVUBh+DahUamBgoFjTSSAQyDeEhISUlf2klQUgXQZQR4MT0zobwN+wWKx4 cyV+iKzID6cObzTVQYb9drTql4q9ASpH4o70gEAgzcHj8cC3O2hCJaSrAgomX1/fjlsMHfKf KSkpiYyM7Oir3NkzBUHQSj3Mrvhltes83Y6FTCaD7I7BaH3deAgE8hUsFsvHx6eqqh2WxoZ0 KzIyMuBwx84Jm83+CZEx8jPjAgKCwmPzfqHeCJDdAVuoqKhofVcIBNIcoNnh4eE5OTlwehFE fDgcTl5eXmhoaEdGgWaEPDhsu2RfPrn9WzCIRamu+x1tbW3nLtycUERsvpFLJZS+un529cyZ trZTFq486BGeQRMjJkZxsvvyycs/E1vYhVNdlHH39IElkyfb2s5auf18WFLx9yOzcfBZ8dcP 714EUmk7Z+Oha9FpbVvkhU6ne3p6irnUdfchLS0tPj4eZncQSJsAr0xNTY2/vz8MuQMRE/DM AFUgEomg9hoWFtbBa0bQ3hyZh/SelvLNEsk/DPXO5kkIIiUtIyNjPDkir9mEAmZd8YH55jJo /lYZGWm0lLyq3unH4S0XMDWFGc5TBiAoo8Dv11yr88IdR/VGSaFlBGeWQilrDXgbLVoDSpM9 Z5trSqEbdkZLoXoYWGMzakXu/D3weHxQUBBse2+kqKgoJCQE2kL3gUql5ubmxsXFRUREhEP+ K4GBgS9evLh48aK7u7uk0wL5BQB6gMViP378+P79e1AGEQiEjs91O0wY6FmOg/R7DN1UKOLE rNCb6xFEZdXp5wVU3jJ0BUFPJ5ooavabGF78vWKXmxb2bMFwI374jRaEgX5jw1g5JYMDD4Nr OFzgJdFPz5toIyZTtxTUftt8QTs631ilh/mZN9G8BgI6ye/G3j4YlNXiY0RaGwYagXuUmZkZ GRkJpwPU8wMv4HA42OTSHQBPvmChEJBrpaSklJaWEiH/FZDbl5WVff78+d27d6GhoZWVlZJO EaSzA56ZkpKS1NRUkOUGBASAd7DjM97WhYFRWxYb6AOk1z8qtor6dYFeUZIR4uXB2+rvn1dZ 21DQkks9Xl4f2UsDM3Y52BSdUda8AK7zvnJozubTFZQv3fI+f61T1+r/KKJEVBLo/pcOa+no jJ3tdNBhaIvCUHVrx1qnEw/pwutxWZRbGybJDpwWV/htu0HZWael2/563xjlmEMrP20/HG21 pJjYtlYdDoeTlJQEcs5u7gzV1dWg7BAzaDbkl4bNZoOcSjCGB47kb0cYDAbI+cEP280zE0ib oNPpubm5QUFBHRyvqRVhKEsOWDVntJ6SLC+Cq5buhLlbgoRLz3PY1MB/DlkP6acmzYsaqqCg YDpxwft0/oriaa/lZdGNsS4XnfzQ6ggJr8trNLSNH38S2XdQ537i0PEXvgXVlHcnprXcJfEV XBb5urONwqAZ8UWtx1vj0MpOLLSWG76shNjmER0CZ4iMjPx5C9F2MoDu+vj41Na2rUMH8isC HvKoqKjo6GgYHKYj4HK5GRkZIDOBJgZpE0QiMSAgoCOXkGhRGOry144zklVUm+t88Pr16wfW z9dQlO4/64Cg6K1I/miBQXoOmXXo0l/X//rryDI7KRRq1PIrvK2E7FuXDg3WUVOzmg0O9IrO a7kQ5VYk2Q5S62uzOo/c4n719W0VhurED/21kIkbLxPEGGKQE3jPAIOed+gx9b+W+eA1DwwM /AnBGTob2dnZ/v7+3fCLd0OALQBVSExMhMNUOpSwsDAYJRXSVkpLS4ODgzvs9C0JQ8q74xgF 1S2u/xN+wMDdW6Mkhb4Swmv0yA1/uX379lh8Y6ZBXmUpbTzaOVtQ6NckzjXR62l/stUUMAnp G2xMlbQGPQ5v/e1okzBUpPrMMu2l0sc2rrz1FoPCT8/HGvTQMl+U8wN2BrLQwsJC4Azl5d9G Je+asFis2NjYiIgIaAvdBMFEb1j57Whqa2v9/PxgGw6kTYAXEwgDifTjC1iJpAVhYH88s1Kx x4CTN594Cnl8849eKNTqayGC3jUGg5wcEfjh/ft/LrvuXjZeXQHVRmFg5cX5rZ06BKNn4Po2 hiHGgkZiCwMj3ufhdHN9ffORLyIKWq4JcTnUiP/dGG2oaTJ2hkd8OwRVIBAIAQEBIF/t2i87 sCMikQjsKDU1Ffa3dhOI/NlbMI7czyE6Orqo6Jv1sCCQFiktLe2wiILfFwYuy22vnay0fC+D vv2bYmy890Eki7cgUu4Ox9mWA00sBg+evczx5MXHc8zb1MLAjPf9e6JZTy2DkW6hySzxghiK IwwcNjnw3yP9dTUGjfnNO7mVVgsWk/Dh2vZePdSGT18Xlt22IAwtIGi29ff37zDTkzDAFtLS 0ry9vWGs+25FUFBQ92k9kzjg5QLZiKRTAfnF4HA4WCy2Y6qrLbUwvDu+VEHX2j1BZKWb4XnO EcEM8U2vEnb4t6lLgp3sddVYW9Z8yhr/1DYU02IIA8Xz2k5NZcR2zenk0taGRNTXuh1dgVGW tdt+pUCcUQ5tpLq62tfXNz4+vitFaQCqAIoMHx+fhIQE2LDQrQDlV2hoKOyM+GnQ6XTwonXb cdSQ/wbIoiMiIjomrnhLYxgq49yMNeSs5m+NyeZdmkktfH5mrToaczUMFPGEi7+NQnpY+GdU g6e5hlD07ykntBSq7/Df0gQhmloUBlKOvxkGZeN8pqSmbRbUqjAkeVzU11D87fgzBrv1JovQ R/t0NTHrr3zsuNFbQPMEAwLT09N/9YZc8BxWVlaGh4eHhIQQiUQ45q1bAYqtgIAAMrlVCYe0 J1FRUbARD9JWioqKOmZFCb4wSCv1NR5g0pSRU17F4uvZtIcHHVQV5TV79gGfDeivr66sPGjJ 8Tqe8HI+PT2kIYf06NkXHGnUVx+jraevo6g7eGJ0Cd+HWxAGDuX5gQUIwju22UVNRp1/E8ff o/LSijnmQ1blfHOoKGEoPTRz4phJu3ldfayKg3aDUFLSeobGzc88/X2yoJ0kf8MIqxmLz/Ia VZkla0fqSUnL9e771c7zwvDtPDewrq4uMTERaENmZiaNRvvlilpQWABDCAsLw+Fw4FGEdcxu CHBF8AD8co/ur05BQcHnz58lnQrILwbIsQMDAztgfiXd6+K6Pt9iNeE5P5wyvabK88EF+1GD wWdmZlOPud7Kr2poi2DSKt/c2G9tDbaYTly46aVvsNtpR7Nh09wT+F0MpHRn2xEjN10VcU1y 8QHHKSIu2meoy0uBFFVcWDLd2GR59jeH+vy1ok/fCRHNQlOU7J882nrs9kLecXHzx1uJOvOk t4mCkFB5aywG2c47xVP2EtzYIQNF7TwTh++Q0EN0Oh1og4+PD3C/Do743Z6UlJSAqmVwcHB5 eTksL7otwBbg4ok/HzKZDF49+N5B2gqonKakpEg6FZAfBVTPQSUdi8WCHDgvL69zDm8AiQSl Q1xcnL+/P9AbYKowy+rO1NbWhoSESDoV3RFQywC6Dtv0IG2FzWaDUgYuGdw1EDTyAwMMDAwU TJ7qDIUyk8msrKxMS0sDqXr27Fl2dvYv1BIC6Tiy+Eg6Fd0RkFH4+fnBcY+Q/wAoYsDDA/6V dEIg7QbICsrLy5OSksLDw4OCglJTUwkEAiimf1oWASQBuEpxcfGnT598fHxAMkDRQCKRwJ+l pe0QlQLSBQgLC+uqE4Q7P8De4WpukP8GsAUPD4+CggLonF0PUHCDwhqHw/n7+/v6+kZEROTm 5pLJ5HZveQAPT1VVFZATLBYLJAH8GxMTA/Sg6dRdONoKIgCUVuCZlHQqui/gNYThmyD/GSqV KihT4HSbrgqHwwFlNyjTBevWgTId1DJALQ/U+hMSEoBUFBYWlpeX19TUgIeBwWB81cUJjgUf Av0gEAhAA/Ly8oAbxMXFRUVFgbOBJ0fQkpCTkwP2AfIgUkjAyYOCgn7WN4Z0XjIyMoC4SjoV 3Zf8/Pzk5GRJpwLyCwNyeBKJBGqgfn5+oBAR1EMlnShIR8FisUAtj0gkVlZWFhcXgww8MTEx JiYGKAQQCSAA3t7ejeG7vby8wFMBPgwJCQFPCPAEYAvgCQHmAAwEPDZ0Ol2cMVRAOYBX/IRv B+nkAM+E3aASRDCjWdKpgHQFQAUT1DRBiQCKBiwWGxoaGh0dnZSUlJaWlpmZCaqW+ZAOQNK3 /ScBlAMuVw0BGUvnnMvTTWCz2aBGIOlUQLoaoNoI6o8VFRWgEgpqlEAYgEikQDoASd/qnwQQ TiCfkk4FRJJQKJSAgABJp6K7A4QBhmGHQCCdGZBH+fr6wjng3ZnExEQ4gEHi+Pv7/+qB5SEQ SNeGy+VisVgqVcQ6I5DuAHgA/Pz8YCwOiRMcHAxHqUEgkE5OZGQkDAjcbWEwGL6+vhKPJwaJ iIggEAiSTgUEAoG0hGBKpqRTAZEMJBIpMDBQ0qmA1EdHR5eXl0s6FRAIBNISNBoNi8XCOmb3 pKys7NOnT5JOBaQ+ISEBxm6CQCCdHxwOB8MCd0/S09PhEhKdAXAXMjIyJJ0KCAQCaYWUlJSC ggJJpwIiASIiIuAIls5AWVkZjNMOgUA6P3g8Hkam7YZwuVwfHx+4Zk1ngEwmh4eHSzoVEAgE 0gp0Oj0oKAgOY+hu1NXVwRGPnQQOh+Pv7w/fQQgE0vkBtRs4jKG7UVVVFRkZKelUQBrA4XBw kWsIBNL5KSgoSEtLk3QqID+VwsJC2G/eeYiNja2srJR0KiAQCKQViEQiXOq6u5Genp6dnS3p VEAagIuMQyCQXwIGg+Hp6Qm7ULsV8fHxJSUlkk4FpIGioqLExMSOOHNdefbTK+dm2o7V5WE8 ZuIyl7tPMgkUsQ7Gx84ca+7o8lrMa1Wm+EyxGnDggWRX6657d3CF7uB5n0pqxNmby2LEet5f ZmdpYKDbs2fvBY57/D5nMVs9jEa8vG3a2A2XWtiFTa8NeXxxrtUA8LubTJx65v77MgpcFhbS FQgNDa2oqJB0KiA/DzinslNRXV3dEUNKWOQc54n9FRQU9PsNsOQxeEB/fUVF+X4LthUTxSi8 SiJHmmjPPuAm5uXKE9yteqtvuRH4I2n+YSjPfp+D6I4PKyS2vi+HGf3MRU9dVqun8ZAhlhZD TDVUZNRNJ71PaCmOFptB8jy7TldJ1mTJqe/vxfC6ukNPTamXIe+XH2jUS0Fe1W7PLRoH1ssg vzygsgmHwHUrsFgsHGXXeaDT6f7+/u19Vlbcg+2IlMayg3fTSwXVAUYlPv3y0ZVoKWSVi0/r q451dWFgVKYtG62vZTkjJL6cza7nsGsD/z2oqiAzYdNt0Wvycbk0fOa5vQ66SvJSUqgWhIFb GTXeULPnxBUpOTwtrymK3zHHDFG2Saa13noBgXRyuFyup6cni8WSdEIgPwNwu728vGAQhk5F WFhYbW1tu56SX3Saz80sb9YBwawtXW2jNXT+H2XUehad9P6fc/++C6sTPgv0yuz7Ny6+CUnh /SEUBhoh+8E/rucuXnwRldjC6raNwlCTH+t22dXV9XJoXJOlaqrS/jx/Px1fEul1/9y5m0GJ 5WzelFJ2VgL27z/Pnzt37u79f5JLCI01cEJ26GXXvyKy8KXxATfB5r/+8opObbYKOJebEuJ9 6cIFcKX34fFC/W0Uhoq8cI/r585du3YvMUd082ldZe7t84dfYtM5TT7bOkHdZMROkd11dfiU VZYq2oYjTt+8ONKiZwvCQMgOczl2/GN0vvADqtv2qYjqsOhqKAyQrgCMEd19oFKpWCxW0qmA NCM/P7+9JysxPz/ajcjIrzn1MCGv4ktBxeXUVJeXVRHZ3HoasXixJTLS/lSFsCSuTfEw7600 78hT3h98YZjsdHDu8P4yMigEhZLT0Jy980YVTXTNQiAMy/bvGz1AXRYFkFJVx2y55E5i8gvk 1JcyaPNNOxbpKckgCPrA2yw6udR14+QeGsrSKAQgLSOjMWD4y7QywdmyPhxXlVedMs/OSF0Z DTZLSSmp6a9y/Z9gK4NSemO7HUZFCcVHQU1jwRE3EoMtFAarHRsWG6gqggPRaOme/ayfYcUL vk3Omm2qYj7zeLWojdSqvDvXruXk1bDwsZNaFIYvkIrfvX3y5x+OA4yNVp17weC0fgQE0vlJ SUnJycmRdCogP4OqqqqYmBhJpwLSDDKZHBYW1s5jjynle5aOUVfD9DaxHD9p0u97T78JCEjN LqQyGhoUxBEGdQ2MxdxVL3z8PN0fOU+yROQ0Tr6ME9k4xRcGaTU17ZkOez18/Dye3pwxoq+s mvG9EP4EEJ4wqOj0s9h7+SXwVTyJ8/nd2d5K8jYrjr4NCMD6+Nzeu0ZZBpm++QGJ/xvwhQGR VTdcefgq2P+F6+5BugryPefk8q7NCb63Q00OPXrW1udevn5e73fOG4Yo9XvyqbhBGGRlDUxH nrn9Chx4aoM9RlZ68KpLrTaocdiUD6dXKyv3OvEqtpVdy+LEFAZi+C0NdSUFBSmVIdPehGXC oeWQrgEoRHA4nKRTAfkZFBYWwmXNOxssFiswMLD9uwUZ5ED396f37h1v3UdOTlYajZbXNlq4 5VgendfkII4wqFnPzxdOOKAVx4/pixpmdwzPqGezmPRGGExugzAgJra7icKLE7LfDJBCTdz5 iHd6njBIjVt/p7FTIyfG+/5Dt0J+PwyXw6FUZc0biAybf7SMP7qCLwyoyetvCTtUmM8O2sko 6Hrm89Kxe7qZbO8xicIrcaoz79y5E5pe3iAMKLWDr+KEv0DR+tH6uuZrilv8nbgcetjTE72V pcasOV9R15pciC0MtNIkb+/3b55dXWxurKI90D0eRtuAdAUEiwtQKOLNt4L8yqSnpwNnkHQq IF8TGxvbsXNdabREP7+jGx31lZGhC4+XUdniCEOzQY8smovT8F4j5qWUE/5ZOx0RIi07Me07 gx43j0MNnrS3mNkgDGuvNwv5UkMo8np02+X06d1rV9ia9wCnai4Mmmf+l9S4s8/FFTLySm/T efM9Jw7WG+jgIupLfjvosebgTCNtQ4cW4lwwyCV3/1jZQ0126OoL5XQxnE1sYWiEmIUdpoVM WnmNCIcOQboEcXFxcOXK7kB8fDyMK9gJqa2tDQ4O5nDap5+7piTafpjhhotetObn4zBrnuya I6s5yi+7sq3CwGVSjzkM0bW2S8TX+F87NlfIgoUHi0QLA2PtMJSZzfYCmghhKIjysLEcOHLC tGXLlx88f+m1O3auuQSEgYzP32Fvra7Ry/Hkg2qqeC08bRcGVi1+jY2OxdzdeDg5CdIlKCoq io6OlnQqIB1OVFQUkUiUdCogIgDC0F63hlaV5ThKR33oopiCqqbKwGXXuu2chdYc6Z9dySSV rR6vaTp9UxGpoXM9+aNrb1V0U2EwnHuAKqwUM2tKFg+Vt7DbUyyq1BOMYZi45WZjHZpe+2m0 Imri+jvk+m+FgXTRcSRm8KLkKqrg2rXF0Tb64gkDKdNpTD81y6WlwmASHEbp/iVTtru8pfyf vfOOi+Jo4/gevbejI6KAYsECKKJi74giSlCJ7TVq7C0RNSoKauw1GmssYDeWqIiAtOMOTqr0 cvRervfOu3cIgpwcypEDMt8//Mju3O6zM7szv3nmmZlvFAz0WtzmuYP1rJ1OBkVR2B3u/EsT DMWYez+4e/0VkdV8hFSMmdxPdcLyMwSwehOgV8BgMMLCwsCSj70eNBoNZsR0T0pKSmS25KOA HXtlCwIB2U1aePVxNI1G4/P5lKLcq2fWWSMhmxlbSylcAYOwY/4gdRObU6/jGHxuVT76R2dr CIJaCgYlFZNtl9/Vcrh0Uv6pHe4QhPjpYrTEfnhjDIOCnu3Z1ygmh0MrSd3nNRyB0D36Stxu fikY6nynDNDuO+ZNRg2Pzy/BJfzi4wrfeujsTeUiedGuYGjgPvVboKCotNrvaRWDxWEQn59c q41AbAtM/kYPA/2JrxekP+ROTC6H35Km9ZWEQtEfbVdbkigYGhOL608qLsTZQttqjEfEhzoe j1+fF7f1h7EQAhHwsgCMSAB6DXFxcWDJx14PCoUCqzZ1T2C5DpcOkUiU1fWC9i3qo64KtURR 2XrMnA/lJHECXlrgfiNFhaZz2ms377FpPSQxyXP1IBPtT+cRisMX7i//yhLHjUMSHv9baqbz +W5zd10nNsYQthmSQAfuNlT7nNLIaqBdX62+rotxeJEeaVcwNNDrc7bNHtjiqRBDlwbUiQz7 BsFAxEVPtNGE2mBs54wVx5JUJTwcbALN9r395S8lCYbi9+fhB195JqTxz/gHh/oYfM55RVXN pUee8sFKj4BeRFlZGZhw1+uJiIhgsaSv8weQCzU1NWg0WlaOPgGHWZwRffnQrqVL3WAW+Wy5 /CSkmkD7nIJL//Dy2uYfPOctWHj+IaoG92HDioUBQeJmnZC7Y53Pwdvvi1ODf17k4enpfeb6 y3oK62uWkYqwW1Z4//kmKT3s9tKFHh6LNlx6Gk1qHs8oi53v7n7+9Wf/CY9NjHp+2ccHtmvx rhM3swoLnp/39Vj+S2qFaOJE5Yf7XguWPMY2r33UkPz89PwFC+M+LdssZBCqHl886jl/voeH 14k/n9WRG4c2WDFX/N1+9M2ua47fpt/1W+2z6kRNG4OrskPXzHNri8+6HbnihRgIeTE//+h2 4FZ4m0ct2LN5+brjD1seq/n4cpmX29nnn+pPIY9dmPjOf83SuaJs3xkYkkRjg1UYAL0KOp0O RiV6PeHh4VwuWHGumyIQCNLS0nA4HPgMAQBAdwaurN69e8fhgLic3gxcxLIKxQd0BTweLzQ0 lECQuNwgAAAAdBdycnKysrKkpwP0TPh8PiwY5G0FQApcLjcqKqqiov3VhgAAAECecDgcsDNR L4bBYERHR0tPB5A3dDo9NjYWFvDgYwQAAN2W9+/fy3rjPEB3oba2FsS19hTYbHZaWhos8AgE ApANAACgG5KamlpSUiI9HaAHUlZWJrOZ/oB/hfr6elgzhIWF5efng/giAADQrSCTyRgMRt5W ALoEHA4HtzvytgLwbQiFQiaTmZWVFRoaGhUVFRsbGx8fn5CQkAjojYC94QA9CLh2ggUD2Iiq V5KZmQncRz0XgUAAKwcKhUIgEOrr6+sAvRHZrdwFAPwbwBK3qKid7d0APZWkpKTa2lp5WwEA AACAXgLceQGjEr2SmJgY4DsCAAAAgKzg8/mRkZEgwqr3ERISApYQBAAAAIAMweFwhYWF8rYC IEtgqQALBnlbAQAAAIBeBZVKleEmOIDugEAgCA0NlbcVAAAAAOhV8Hi88PBw+F95GwKQGVwu NywsTN5WAAAAAKC3kZ6eXlxcLG8rADKDzWZHRETI2woAAAAA9DbodDrcvoCdDXsNLBYrMjJS 3lYAAAAAoBcCty9UKlXeVgBkA5PJjIqKkrcVAAAAAOiFZGRkgBWceg00Gg2FQsnbCgAAAAD0 QqhUamxsLJgr0TtoLE15WwEAAACA3gkGgyEQCPK2AiADKBQKGo2WtxUAAAAA6J0UFxeD3dN6 ByQSKT4+Xt5WAACAboiQw6DiiRR+F/iThUIBk0bG4/FEIpnHlxBFz2UxyAQCHk8gkuk8vhQD 2Ex6Y2IShS7pYq1uzGbQSPCN8QQylSHtwp/gcZhkErWDiQFfQKVSIyMjwahELwD+bLBYrLyt AAAA3RDWswMeUJ+ZWSSmzC+NQz2YMtwEgiBNY+eovC82vxOUp7xd6ebaR1UVghR0zBw2H7pe Q2B95Ur8AvTTRZNGmSgpQZCyft/Ru089pNC5X0nMTQ2+OX+cAxKBgCBVs0ETD1x4weVJn/T3 4KC73aAFGZRvekTAJxp3uwZbHPYC6uvrExIS5G0FAADohnSdYMDvnz1YWa3vLC8fn52/F+EZ rc7lhY7po6ZtYjfLa7HP0qWzHPqrKCnP3niRLEkFFMXdG2Giqmc5zH3xEp8l3tPsLRQUVX48 +IgmaX3Bj2/ODkSqIq0dFyz18VnsNX6AkYKS6tbLkayvSwYhn/7q7F6klrI5EAydoLq6GvRM ewFVVVWpqanytgIAAHRDukww0LK9BluYzNwjqVln/XPQC9K0ufE+iybq+wtpVbid8611LR1C cto22LRr66co6No/Sy5nCoQNQgG5LGfleH3DoTOwpW134CUHLLDXsZr0Jr2KI2xoEPCqs9Ce jjqmLkvz6tiSrOSXZ6Uc377AwtjMREcJCIbOwOFwIiMj+Xy+vA0BdIrS0tLMzEx5WwEAALoh UgSDUMCrycFc2LVpxYoV20+cTy6pbend57GZ2KhHB9b9JDq7ffvrhDyWQDyKXZX40zIPSx11 DauR8KmLL1NbqwZOLir07ptYdotrYe7sQhra3MKUt7UwNex10LsPLQ8FH1+hZTkqOKOuTWJ6 /D/P/o5J/3xAwLy/00Np4PSkUrKk56vzmz1BZ6Dzib/e7p1nBARDJ0lOTq6oqJC3FYBOUVhY mJubK28rAABAN0SKYIh/cMgSqQY1oaY75NSrnMZTXHrd8RUjEVALtIz3vhC37Dl/q6koNh9e FPBaYve+Jbd+maxnMeSfzA412CeXDTEYNBFd1NbD8CV8JnHPPBvD0Z7ZNRIDJKiov9/lUETW HVpkCgRDJ6HT6VFRUWCZ6B5NTk4O2LIcAABIoj3BQCt8N8ZCx8p+clBoam1tbUrYXbdRRur9 JmeLW9X8sHNGSpDnr7dSyyprq6rSXlyz0lEYPmNvFU/keqjFRc+yNTGdtxv+IZnObi96Xigo Cr9ipqczc8ufVKlNjYCT++KkurKaz+GnDKmJ+UzUdV81JY2t12PatUAEEAwyISYmhkIBmdiD SU9PLysrk7cVAACgG9KOYBAmBvnqalmeep7UdISf9faoMULhtxc4uPmlVBfExsbWMRrgHiWL SqktSV80TGnA2DUFNHFacvp8OzNzr4D2by/gcwrjHjib69u4Lo4vJElJzGOmvrk0wlhnyOwN OTVSgi74XHpM0GE7pO5IT99qmvSBdSAYZEJeXh4Oh5O3FYDvJyUlpbq6Wt5WAACAbsjXBYOQ 93S/l5qW8ZyFPv9rYsnCqXoIxMpzUaLZDEJhfV3hrcO//rRihZe7m6u9hYoi9E2CQcCnvb91 xN5cb8CE2eh8fPuGCnjkZ2d+sTXSGTrLK7P6axMwP8HnEm75rbbU1Ry/dANOcrjjlwDBIBNA 6GNPJzExsb6+Xt5WAACAbkh7giFol7uKroXPum17WrJ37xN0Idwe1KS+HWyiPX7+Gj9//5tP nqXmETdPVP4WwUD887eFetoarot2lzC+nqrRFmHtsZ8na2jpzF93skqKWGhgMQoOLButqIlc tfeveo6UxM0AwSArkpOTgU+754LFYsEq3wAAQBLtDEkIUH9u1tbvd+ZNWvMhRn3hm2fPPpZT Gxqo19ZNhSznFDF4jdEB7PrUiZaKHRQMfC7p6pa5BkbmO079XcuQ0qhz6BUnl0/WMbUKuBlO ZElafKEFTGLubvdRuhYD/3ieSOV8Qz8XCAZZUVNTExcXJ28rAN8JGo0GUSgAAEASYsFgMu4F JiG9JVm5BAaXVRE7zRZpNtjldOA7+Fgi5ulm99GqWoPeFjEaGmg3N0yD1AwDboWmpKdHhD1d 4eaIQECWjnPTG92Z7QkGYXnMNQNVyH3b2fikjy3vWkVs9DXwqgvzMzKKxGMJgtSnAbqqCkv9 biWmpLVInFNHbfQ1cMvzcrJzysSygx9+eZOuts7aYw8+tkybnkdkNq4JxS7OyszDVbVdIAoI BlnB4/HCwsKYTNmvHQr4F4iOjmYwpLn8AADAfxGxYGgL0vomWrQkwofHZ62NdBRFyyxDCISC hq7JqjOvG39ZHB842FBZfAZSUFQyGzR66igTw8GumBJxO96OYODiz6x0lXBTyPDXWxhxiurf Jg1TUZsmmsDJqvR1GyYpseWp4Axx4tKfBlkaW/kUwf9lFq4YZSkp8cDApFJx4vy5+lp2zjsq 2xgFBIMMKSoqSklJkbcVgO8hIiKCze5Q2A8AAPiPwUt/d3tXWw4e+1D8aaUjRmX2/VP+8DE/ vyuJ2S0naPNrCuJ//x0+c+CPe6FEJjMjPGjvgRPYQnH4Iqv69smAw4HhEu7JJNy/clzCTXcd fJNQIk5BDblyZs/ea6KdCWiV184dlpT4SHROYyw36cnJI4eO3hcNu5IKTx/1k5T4RFI5SZy4 /i+/fScvvmqrC8ICAw6fvCMtmhLQIVgsVmhoKI8nZfwI0A0JCQkBm4gBAAAA4N8BbnHi4+PB 7LweB5/Ph5WevK0AAAAAwH8IOp0eHR0N+qo9CzabHRERIW8rAAAAAPDfAoVCgRn9PQsGgxET EyNvKwAAAADw36K8vDwxMVHeVgC+AQqFgkaj5W0FAAAAAP5b8Pn8yMhIOl36HmGAbgKRSIyP j5e3FQAAAAD4z1FQUJCRkSFvKwAdpb6+PiEhQd5WAACAfwk2m11eXp6amopGo+H+XUhIyFuA rJF3IfcY4LcRfgnBhtc9haqqKrjqkLcVAACgC4Er5IqKCiwWGyHm48ePlZWVZDKZyWSCMHWA fMnJyQH7V/YUysrK0tPT5W0FAADoErhcbkFBQXR0dEpKCoFAgDt0QCEAuhUsFisyMhIs4tQj KCoqys7OlrcVAABAxsDCgEqlRkVFJSUlwf+RtzkAgGQaF3Gqq6uTtyEA6eBwuPz8fHlbAQAA ZEx1dXVwcDAej5e3IQCAFBgMRkREBHAydH+ys7OLi4vlbQUAAJAlZWVlkZGRYI8YQE8Bi8VW VFTI2wqAFNLT0+G6Rd5WAAAAmUGhUKKjo8H0dkAPAo/Ho1AoEGDTzUlOTgY7gAAAvQaBQABW 3AX0RNBodG1trbytALQHFosFo5wAQK+hrKwsJSUF9NQAPQ5Y5UZHR8vbCkB7wKKOQmm79zsA AOh5sNns9+/fg2VwAD0R+L3FYDDAydCdAWOdAECvoby8PCUlRd5WAADfCdx7jYyM5PP58jYE IBm4P8LhcORtBQAA6CxCoTAuLo5IJMrbEADgO4HfYTQaDcLquicCgSA0NBQMdwIAvQC4d4ZC oeRtBQDQKeh0OtyNBTOCuyFMJjMqKkreVgAAABlQWFiYlZUlbysAgM6SlpYG1h/uhuDxeCwW K28rAHKASyXnZKahRGA/ZhSRWNyO/pJDTU2MzyzuaGASl05I+RBXUEX+TkNlA7+uIBOFTaOw O7yUHJdZlJuEwaBiY9H5xbWCdp1wQg4Nl/UBjUah0XEFZVLmMzJIdZlYLJzvcR8yqkisjtrT ARITE2tqamR4QTGC+pIs1IcMBk/2gZQCHrs0NxnOivj4VApTwhtIqChOhcsAFfshJY/CkmJA XQkuGS4DFDrhI47R7ussFPCri/ISY2NRKExKVgmr3ZdCwONW5Od8EH0p8en5FWwwut71wD3Z sLAwBoMhb0MArSgvL4e1nLytAPzLCAoxT5e7T7c0M4JEqBma2k1b9OOj1KIODU1VYsfYGc/d G9TBm9WmvXLoo7fpctT32ysD6A83z4NMJ2DKSB1JzaHUXPRdYtdXR0kJUlBQ7D/Iec9fL0hf aTEZtbijmxdaW2goKECKiioDho0/8jSCIVlhCEtT366aM8ZcTQ3Od2V1kzEzvN/GFctqRPD9 +/ddEMDMenbAA+ozM4vElPWVhUl/nxpqpQtnharpmKj8VlsJCIXclH8uTXUcZACXAYRQ1+/v vsI3q1hyeIaAz8Q8OO4yxEYXLgNIUdPQxnt9QGmt5Kzgc6lv/9w7amA/LQQCLgR988E/bj1N pEmO4+JxCA9+3zjS2lJD9KWoGPcfuXbPFQYHTELpcgoKChISEuRtBaAVubm5cLnI2wrAvwq9 MNROD1LTNVqwev0REfs3rFlgrKcOWYyMyO2AH6DXCwYuJdDXE24exs9Z7+9/xP/QjhG2upCG 2eFnSRISc/CnVk1CKChN99weEHDE77f1A/tqQdpW11GFbdOyqpLmDjNS1ern/et+ON93rXA3 UYd0B8zJJspgCX24UxYREdH567Sh6wRD7S8TbFQ17TfsO3Lkyv1qSqsx66rkh9Y6ELL/2PX7 Dx05HLB+joOKIjTay69W0sh21rvzfTQRJkOmbjsUcMT/4Oopg+Dim7XxMlGSCkAH7TVWV7R0 dPM9fOTIoX3ezlZw4qWH/qZJKoTXZ/+nq6JiO2HRb3CB+e1xszdBKChvvBgJJENXw+VyYQHc xWsEETa6Wui0Rs/GdqbnhjvoTMZXXEml6Bu2evp7X+R25sZvTi83tugfIqGSaI2Q9+iAt6H9 9Jh8wjffg11z++Svo0YMFT2VldVK31PYws6un5CYmNilk14p1bnP7t9pyd27z9AJeVT+v/69 0SqfPrr/PqWo47+oLcx89/AhbPOjFzFleCmu44rslOD78KPeffIKU0PtzluosN4d9oH0ht6M KOLwGj8JIZ/PSUcF9tWHZq69QZZaMr1dMNBKE2fZ649adoTEaCxHAbMkaoSZxvB5AW37t6Ts d6P66U/beoXNFWWcUMgn57yy1IImr7nWdnvIhHt7kfp9jj5J4Ir9DwIeB3VzowaksP8lrpOP B1NRUZGamtr567ShywQDJcPDzszM8yBfgoeF/mDHXAjp+D6P0HiWz2GeW+ukbTbk+ce2NSf5 rI+LovnE1Fq2+OUV8liMfR59dQZMiMG1rSHxu6cNQA73yiZwxBcWMgllG6eZ6Tl4ZFa1dYBX rxqKtJmysZDEFSUWCinlaT5jjJATVtdQOzyEB/heyGQyrBlg5dBld8D/z0FHXcvcaexnXJwc jfRUNYwcLoRlSPxNVeqzueNdL0QUd+bGqDu/TZo+B10uLZ2QF7TLXaXf2IjcbxNOfDb+yjZ3 dRWNgfbD4Yca7WCvoaAydMr6jzWd+ooxGAxcKJ25QvvkR/5powO1RhVpYuW+8RiuTuYdlnYp Cu1rpOW270HHUvOi7/o72/XRFrlDISU1A/sxs/+OzpOYVMBnvL38y9B+ZpqKihCEUNYwdJzs 9T65227Pwfj7F0/I2jWuoFXrJ2AST+/0WrbrHJ7ZwKHW7vZxWrn7ZnMHjV6IXuzm+suVd6I/ xILBbfedjxF3F3i4OI0bt+zI+ZQKwtdG+ZsEQ3D0g+M/uLq4uLgeOHGprJ7xKXlR+BjnxS/R 749tmefkNOPsq1xeg6CmMP36WV8359FOTk5z53mcfxZBaVKYZajrk8ZNu/wy8u9Tv06HT0+c uOX3q7m1zY2zgFiec3HftnEuLvBnsubg6dQqivhGnwTDu+SEwEObpjo5TZnifjEwhEqXUBfx 2LTc9JTiKnKLB2Jtn6Jn57yjsk1iLoOYmZZaXk/7nJM88o/DoDHzjrcNZaDWlqamZZOZn/Vk fd7zgRC09nay5Lz7FtLT00tKSjp/nTZIEQx8FiX+9a2f506BS2PGynUPwhNbuAqElCrcrUsH FrqOhc/OnDnzxL3gWrb4rSqOGDd6mJ6asrK+OXzK9waqtTOAX1eUm5RdxGvxVmHu7EIa2tzC tK1kuZV5WUm5rb644OMrtCxHBWe03TGZU5KZnlZY9fmAgHl/p4fSwOlJpW1rQjbuY2p2y6AU PvHi8snQiB/KibIMPgFIRCgUJicnd6UPXCQYBo3Z2fK7FjLo8U8PIzVV7Kbvxct9+uD3CgZ8 1ouB6tDENScK6kX1PJta98dWL11Vw1230d9vi1CIQqFoNJr0pN+LWDBoua07+KCJ+9eurncf qa6gteL0q3+1NL5FMJAynlvrKZkPnu537TZs85mt3ha6ShYO3nnktiYLS1DXzTQU+o9e8PvN uw/u3zu21s1AXcF+5pYSutzfNokIaqIuaagoDpu1/NorTFl9PQVuNVsvk8IiVfwwEhrjdbiu qeanZAXb99H0OCDOPbFgGDfb29pUXx+JRBqIav2+E9fk4CVHKIkFg+7MH9zN9DXg5Eg9HWVF hbHL/Cso4iYi+4my4uC580foa+sbGhpejKmllKcsH2+mpKppAP+NROpqqEEaBodeZzTmJu71 IR011X4DrHU1deDz+toaigjVEavOND4AsSxhlWtfJWV1kWFIA3UVJWv3X8pFgYViwWBsM2P0 UANd0Y201FRV1PX3/hXTkSzjlEQNM9Ucs/qPDmhcIS37lYWmgvveJ9JnhQn5MTc2qCuonI/u rJevcfZ614j/dgWDkPfPmZ8NdVQ1tPXgXNXT0VTTtPrlRmyjvGMRS3bM7a+koqGHRMJFqa+l Aanprrv+XnQ2/5WFKVJFUUFBVQP+4arToVLWguFzTv/kiOzvGI7rQCAcj717Xh/TkbMSK6QX Aodc+fNkU8uJy3B46T1ZWlX64tGGNvN21NNB7OO/AY/HCwsLo1LbuutkggTBIKZy+SADk4GT k+oaiDjU8cs3C8pqwm784Xf6NLqohlSScPLgoZBMkRbF50T7+fnFFdFzU14cOwb/91xwQiGn 1avBLc6MOn0aPnXy/uNwWtOSRzkxjwOOnsgTe8tS310/8vs9fAMT+/DqUT+/Py7dLW2uS9sI Bg6dGPYoEL7cqVOX0wra6uFPUAow/v7+qVWf+ybsgojh/fQW+D367syCK5nIyEgWqwulslgw IHfejG11lFW4dLiJlcsWmcdzt8c3CAb228M+ikYjX6d/NvDN6aVamgYXo9ruvkoL3DwbMhuf UPE5wurOr1O0jG0fJn61NOVO1F3/kf36Nnp8Bgwft2LTpmPXH1cSP7UIHREMSirqP194RuDx 2fTKvw+ugq+z5MBLie2pWDBACITVqUfRLK6AVVdwctN0BKS1LVA8PUckGBRMB3uGZH/yeLy/ vE5HXW/37XiKUAjXF/lhd2x0oPHep/Did18sGCBkv6lBcaIxRHxG6OLR5qoaY5NFXxjn4Z65 CorKW8+E4jk8PocWfu5nCNI68jrnk2CAIPsFW1KKSHDSpOd/DNbX7OO+T6oG4LKq988bpmPu 8CK5SlraBgYxd8skW+1+E2OLpA8XVn547NAHaTd3L6nTI3QCgSAmJobJ7AqvXXuCgZjxeJC+ 6lDXxbHZIs1TkxO5dlZfhMHQD+J3P/OFvxYEbbgQWcvlwybWJ78dZqg4ZOL2ssZak5w+387M 3CtAuglCXuqDg9pqOt6HOiDD+EzMlR0QpL35SpR0BcClPA9YCUG6Ac8zpCsADv7KlnmKyqaX oktBCMO/RmVlJSyGu2btR8mCgVMfP8FYy3LoklxGQ2HIMaS94wavGWpKipCCwbW4iuKYyyYK ijueiGZ95r0IgGuVSW7upnqqohBaCNa/2ptOh35qU7mkoEOrTbXURaG4kIKyiprToq2VYu3z 8qiXmo7ha/FQ5O2dYzS0px08uEBfTQm+hqKisuXQqU9TxJ601oKBUIxZ4mKlpqIsupyCoqax 1Zabbzq46mIZ6raNgd6qM8HfnVmwYAgNDYUl3HdfQSqSBQOnbKWT6YjFxxqb2EsbHB3WnAy9 vG+AgYH9opWZ9ZwGVs3jSwdnOzsaiLCZMW9tOLbZK1XpO9nResqm0FfXXO2HwqeH2LsevhvG /hzBzkE9vuw5wQU+1b9//5XHbuIIYrUmFgyzd92IfXrR0dbWwMBi1MzVD6NLJVkt5DBoRDKV 38Idmh16to+6/pHgts4xIZtOJVDoLde+igvcbYjsfzNW6gCV/BAK6FRK3ocPF47tWubtPWHE CC0NLZ3+DoEYHLdjgmHAYn9u0xfMZxDXTUYOnbGplMYtiI+418T9B+GUT4JBZc4vt5o/eD6n cLYxYuzyC6I2VSwY5vm/+Fx+TBqRROIKRFFPpIrSxHd3XaygUQv8asQfYaOH4afzoU3phW9P +iirab/IgxugnCXO/ZFjfiK2uBOBQGCIplKKBYO6bVBiU6EIibtn9jfu/2Nxu/lErc45uHyc spb5/rsx7PanVsKfc2nS1nnDVPT6n32dxpXmXsKh7rj2M7ZwmBmZS5KStAPAgiE2NrZrvuV2 BIMAc2Objp7drZj8piPCYsxVS4TClqA0gaijz4DzH+5wwYaRqyuz4l7PsFMcMHZNQaNTs2OC gc+lYx4e7qOm7Lxkd0GdlN4Nj0V688dOUxXlKT+fkhpmwGXUBR76n5GGptvOq3RpUYwcauWF zR4G2vpLDz3gdU/fYS8FbqcSExPz8iSPCHcOkWDoN9Qn+EMzmNB3QcvdnJRUNX38n8BtsUgw GKj2GTLm3PMQLDadxOG1FQzqegN8T91GYTEv7x3sg1SzdJqfXi96nbKCT/fX0bSd6vP4TSQW G31i0yJdHe3dQUmCNoJBQUGnr/Xo40GvsOjo60e3GGpCwzz2lFF5LQWDUEA74Gmvod1/9e4L UVhs1Nu7niMH6JsPf5IkvefNo9Vud+9vMnByaPb3B5E27lPz3T/vCGLBoOuz73pzeWDfhx9c 5W5nPzEw9lMlc3qFja7j2FF9LRxGOy/ZcLaaxXjmv1xdRd12iL2zs7ODwzAdNYTN2IVp1Y2f f/lmRxtFDaSZudGQEaNGOY400dGENA1vxIp7f0J+TOBvfXXVjCxsnJydHYcP1FLTmr79CpP/ STBYD3Hs17e/A3zZEQM01ZS1TWZldaRPxqGd3TBe22TQW1wHvDFs8p5FdsaDJqDLuuOC2zwO LTvlQ2E15XOdx+cTKiriX92ZY6ff1/V/ODyrI4KhVdAjj3V05Whjx7lpVfW3fprVHK2ipDI5 5ytBjxtdEYMnbilhfhIMP12KbnExRmz4k22LZo0bO3biBNcJLk5IzS8Eg+Hv/3yORwo9s1xZ TfN5bkNDdfLkYWaDlh6V9Nxtgx7Jv82xNrZa2k4UbHHKqx8nDkP2tdsVFMts3wkgFObGPZw3 0sbYbnTAs4T2m20+lxJ1y9/GDOkw3SMsQzaxLhwOJyIiomuWbP26YBDyHu31VFXVHjzCaUwT jsMHqCMQK8+JevcCLiclPuTXpW4TXFxcXV0njx9roo34JsHAIpdc3bvSXN9g5pqd+V+ZJtkM HZ9/bP0CMwOjeVv9qintqwUhtTZj95KpJgamKw6er5M4QaJFYnwJduP8sUZIi20X7hK/Fj0P 6DKYTGZISEgXDEyIBMMXMXZwz11VQ9Ppx19ziKKepkgwaCIW/f5P82/aCob5vwXRm96gv7ZP 07QaFZIpGmz44+cxOqYjniZ98kxyqLWhL+5FJBbCPY8vBIOymt6lN+WNPRIhn31t0yRVU6dX 6VUtBQOvLnogBE3ecovcVC3XYl85WejN2XWn/UVi2NS6C1tnqqoZ77zRAZ/b16msrPz48WMn LiAdSUGPIiasOVRU/+nzhwUDQkN/09XgxsaYgc9ZMtpsvNf+/MZoDTbl5NoJqgZ2t2KLxedF ggGhor36xKN6Op/PYaKCAowUIE//VxzRGkGlXkM1TYdOe4Ut5ora+cpjq2dY2U+NgVsmsWDQ Mra59DIdvhGLVnZh51wFCLqMkTbsK+Rh7uw30zXw2BMo1R0q5LPCLmzRVkeuPRvcPaOoSWVx E80VZmy+Qf2ym8R5d3SZksbIVzk1sGDwdlBwXuTfPIWNlPFqqIVGS8Ewy/dO8y+FXOaeBbaW Lgtz6lgFce8Dm7h3P4zcFMOw/mJLaUr2GYwYMX1vJa+tYBAmPTlhbmS6au/Zx0+eRGITcQXF Sxw6JhhqUqYONx/oHdDiwQR0ColKZwm/VTAIBcXoNy52Ria2E66ESvlGhAJ+9rsHQyx1+o5w e4SRMt+Bz8M/uLjeTFtlrLdvWqXMwodqa2thNS6rq7WmPcFwz3eeCtJ2z4k/A1sSFITJrhE0 CEti7vYx0PHedvL+o0fhmLiiSuqmCcodFwxcVsm+Va56SGPvHZfqpHx7QhY9b5OHvbaR5YbD 9yTOpmyZmFjzYfXMAeomtvsuvaFI8coIKgrCvMf3VbMYcuYBBogFeUEkEsPDw2XtQxMJBkML l+0HPnPu/MXQlFxe036vYsFg4Pfkc1hyW8FwNvLz6POzQz+oWzj881E0QrdtiqrtmP/hJH3l XwgGLb25+S3OFrw9aqBhcTokq6VgIGEuw/easWxnQDO7Nw+w0O3nub+djgK+MH77wtEQZO53 JZzeucxLTU3t6j0+xIJB3cV9VXNx7N+/03P2RBVFxWFz15eI22pYMOj3GYWRYAiXTK7/GBfn 6zleXcfmz8jGHBUJBl3b+flNtReLkjvLEprsc4nU0EBNu68LQavORUhorMWCwXn1+WYfQRn6 qikEbXnU3lK6Ah4rNnCfibLi6MW+hXhpYVlscvDFLbAB0zacktbBkRt8WvUu9yGQ8aC/UBkt TeQxSw96DlHoNwVbSuTR6tZNtbCatKyoybkf/udGHRWopWDQHuZd3lwEJfEjLaDxK84QJD10 YwxDv9m7moPV6jKDrBAIz4PPRBn6pWCo/XWirfG4Tc1z5yqTHsCas0OCgVO1Z669solDUlNU u4Dy0UUPmrL+L8Y3CobKpJf2ZtCgORuTSkiSzrciJ+yqrZGCg/fuvFqp7irWQ/+lSHWd1QGP qdIGOL6JLpsi0dD+kETCnV91dU323Y9rPkQuTTp7+PC7LLgMSOeWjoX6edY2PSijJHK4YUeH JHjsWj+P4dqmA889/iBVqDNJ+dsnD9SyGhkYli31w6NUJS537Ks7YGxwYoXUGhRf+H6urZGp w5yYbDyIW5Av+fn5KSkpMt26/WtBj5+Rh2AQZr3w01c3Pf46o6VgqAg9Dt9r+ET3xa3ZfObx 1wRDRdz9aQMtjKxH//EmlSNp9nLHEQqFUVFRXb2LqKQYBgGbSb+4cZyKltlJUTSaSDAYWs1I ITUn4JflhexZ7WVlbmVtPdhlwvQJowaqtBYMSOefmxuUloKBHHcNztLdDyXNn20T9ChVMDCI Bec2zddU1fHadbSUKCU2m1qT7rdsqpY6cuXhP+rp3XEw4hP/Z+++45o4/ziAH3ujyFYExAXO Wkfde1T9WfdeddRRR9VSrbbaVq3bilpbXCBDBAUngoSw9w5LRsLeAUL2zvG7JKggMTgSQ/X7 /sOXcE/uvklI7nP3PPccitalBvQxQ3SNrGYt3eHm5ubr63vjzPFZk3rraCIrfvWg8tBmHu3U +nEaWjrTtjh7+PpcOrFndK8++vqarQODuXn3wbM2/e3t4379z3FDrRE9y4u4Apl/kZLAoGVm aTFl3S7P27fdzv4y0kZP13xwQLokI74eGJjn1ozQMjD97shlH1/fcyd/Guwgno6y3/RvSyWj COUFhmY06c6vprrqTl8tv3jLy9vj6uqJjhpdbNxjyt+pS0LIrjw8fzhiMuDPf93u+L7y4Cmu QbLPZDeWBT3wjSSIHyqgE7eO66dlNfKCu2frxo9x0dKrC5m1BQ/9fRPzxaclmwj+jlYG/aat veXl06qtb2Ry8Ydkf+yzjB18KWfEY3NLYOg25NxNz9Y1+95/UlTPEjblrRzR09DMZuPPf2G/ 87j+x6xBNpoWY9IbhOJ0dOB/iIbOaucL3r6+l13+GD2gO/ZW2gybSZBeFCIvMAjzAo5qqyNf bznqfbv163o/o1gaBzmZYcF370ZI/igEUf/uwP6Klv74122f1o0f5bVMSM5KevroweN4yTlN /r3fl+roG3976NKdO60bPy1p+YzTowL8n+LSJa8m78r2yXom1juP/tPmufs+q2F14s/4JwqL CklJSUSiAiYteUG5geHU6gHdeo3DvRikJGJVn9+9asbOsyy+6LXAoGNgE/C85bI6VMT3+3Wh kfmw+4Sq1oGBlX3bAEG2Xgx7OdxGxGMW5BLyy2RdY4UKycl3h/Q0HzxpTWAy8cPPy3C53I9w 2ynZgx6bm1P8jlggXXf8LS7gtcDAqstbPc50+Px9QWGx6ek5ZdVk3D87u75dYKAlu2kjyG63 5JcZlEuvzyFkii+Tf8fAwKjP+nH1GHMr+y3HPRs6mMQepVanbJgzwNJugLPL/Y7OcHYK2UFu S8d+Yd2ti5Z4vC2ioWVo3XfQ+kMXaxnSgzlRQ5LftH49DTXV1dQ1rOzHuN5wdWw7hmH6d8c2 zR6hr6Gurq5p2bP/7guP6QLZ4VM6hmH9b8fnfdUT+1ZX19C37uV4yj+NK+0TaTeGgRTnPXmQ taQwzS7mNrNXrF843tZ82DdZ1eKvcLmBoZnPabhzfJO9tZm6mhq2JfPuvb93ecIST6n0DoGh OvPhlxaa7fvRLPqPSpR8s1Qn33GyRL7e7479vyjyWt+uGu0b230177lkz1aCd7E2RtafD8b+ /+D4Cn11GT10X3/n/iG9s9hnWTlzPEpJAkN7pg43JPPOFEbdnz16UDdd8RumoWHUd9Co0/db psSszcfNG2GrrS1eYmBiPXHBmnWz+5r0/iqsQLKflxMYOLW/Lx0pY6OImbNbnKRFzaFJg7V1 p4kPOZgl2yVTO7bT8+xT6d9J2SbHnhZ2q8TvNe35wsHdZTXu55kqHQJdONfEsGXODUrqWGtD WY2H4irgHuIqIP1Tr6hQ1Hhy5QaGBK8DFroGY9cfzimpo9PJgZcP2pgaLT7kg30hvRYYEHWt Af/bmlZUQqeQY92PYQd0w+b+XMEUtg4MImH95pFWJtbDT3uGkul0el2d/8kfrMxNt1wOaV82 j1a1fYp1r2FLw3Kr6K0w2e8ZdKlUanx8fMftPozMwCDgc1x/mKBtYHXyoXhn/VpgKAu/iOWo 44GlktMsIj6XfGBOP02j3lfCpKNk5QUGTn3qWDO1oQv2ljSJ90aoSBB964CFSY9zgXnvFhhE Tb8uGGxm4+RyL7nD15fPKt81tbdZn5GeIbmdtB9CFgGnnhAd6uvrjvH2e0ooev1DQynLeurj 5eHlnUaq51IqHvh5haVLZjJlkQMD7oSmkri0isfenl5ePinZMi82acGhlD/yu52QV8OozvP1 9vT0fpJR3GqyPmqJx61bsXmte6SEtSUEPz+srjuhiblsHqcgIeTWnccVVHFgoJVneHv6ZJa/ +rquyon28PQqfTkUBUWL0uO9PDw8PW8nZpa8fLrFiXh336C6Vyd/eGk4/zt3I9ufL6TV5vu7 y3An4AlZcgzKri++f8cdlyL+tDeUZPjKanw3EE+V9KEwqnN9vd1jcsQX5D6PfyqrrTtOcnHK e2toaFDaAAaMsDQ9TEbRPv4vRyFyG8ujsFfE3f327WBiResx26Kmmvx798RLAiMzGDxeKSHC 0zugoFaSj3gUfICvX7isISI8elSwzDfBJ6VQejzFTgt+6OH5TPy2sxufPfKT+SZkt+zWmbH3 7965GyV+r5m1D+7eltU4gNQgfTq00NteAU+SxG81rcLH21NW40dVnfks4ieNxWIFBgY2Nr77 VMkyKDcwNHNqzmyerdf6OGLconxJ4a8FBl394YvnDXpxlKJmaT85LE/yjdbmskq0kuA3ordB q/XpjliwlSQrupKenZE1eBCxWHDk/V6p0tLSnJyc93vs25MEBv3xi7aceOHPP/9cPm+EjibS Y8LKoiZxm9cCQ33e44GG2NHcpIO/HTv+h/PC8Q7q4utbrY/6S98yeYEBFXCv7Zuura4/Yvry IydOHHb+tqe+tt3UdSXUd+qSEJUHn9bWUB8+b/OJNs48iSVJzjVwUh96nzjhViG+w6OA4PUT Vt+klXvaNr6AJ3TayR7BJyU7O7u8HP7YwOeCwWA8ffpUEbeZoF/5ae0PB2/JOVtUm3F/w+pv feNf3fWBnPts09Jlt+LFZzmqku4tWbLkSfarSVcS755fteWnlJKWAxg+pzH26c1Nm7BW3/52 2b+4rqVrOzng3Mq1G1Ilx0nSMQzZjCqXo3uXLFm16xfv0nJGy7AE8XV/J1dsP5Qtnb6hWVhX mut67DC2uiUbN55xi6xrlH3hXuaT80tk2XTmPSduio+PV/J9PcRkXiVhbWc3Z9UPEfktPS+v BQaUTw84uaOvuaEGgmh2NRk1fpXL7wdsjI3XnnksWS4vMDSLb0pcc37noj7WFtiG9PS6jp6z EZcjyY9vHxj4tPMbJ6rJSGd6648/lXQ4NF1eOQlBRsRSWM2s6gPzh8mKcjI6YgBQOOyAKzIy UqmzqQDQ2ZDJZBwOh/2r6kIUoP1VEp0Nm82OiIhQ6HDTN2yoqSopNuo12fn5VPar/u6K/KT4 xMw2V0LzWSRCUkxUVGxaOpagBMyG5ISYDKL0vBGXmJYUl174srlIyMpKjCLkVb38jZDHJmVn YhtKSEglU18O5ackxsdml7waH8KlVcdHRRHJ7UYzigRFuamvFy0Wk1/WKMl9gqrnhKioNJpA 1Czg5GUmy2ocR6pR4k06AJAiEAiFhZ35ywYApaivr8cyg1JvnvhxdP7AUFxcnJsr73JCAEDn h31b4vF4Hg/608HniMViYZkBC8wf4eBXeTp/YMAOgJV6k0oAgLJVVlY+evRIqTePA6CT4/P5 CQkJiYmJTGYHE4F2WsymusrK+k7bp1heXp6RkaGcWWQBAEqEHUlhCaG0tDQ2VtzVhx1hqboi AFRMKBSSSCQcDkckEuFsm2JxOJywsLD/bhj7rGChjsvlUqlUMpmM7SPy8vIyMzPT0tKSk5Pj 4+NjYmKio6PDJEJDQ4ODg4PAp+7Jkyc+Pj5//fWXi4vLo0ePVF0OeCNVf3l8drDwnJiYGBgY mJubi31tohKqLuq/jc1mh4SEKG7WC6As2J86diCJpQIsBmAHktgHITs7G0vR2HtXU1PT0NBA oVDEs3AwmdhHAwvVfP5/aAYI8P6wgyksQGLREUuJcXFxcHEEAK1hnwjs04EdQOHx+NjY2Hjw vrAX8N9//7137570R2wflCaB7YkKCwvLy8uxw1jsuwjbDXHb+k+PJ/lPwF5h7HXGEkJjYyMW CbB3JCIi4tmzZ9ibAiEZyIT9YZSUlDx58gTOFgLwGuwbFTs6xvZlTeB9VVVVYbkL2w3V19dj P2KHqLUS2F6JSCRiO6mUlBTsmAVLZWFtYQ9R9em9T1xwcDD2OkdFRWFBLjMzE9sRYMkNDh5B h8rKyrA/Gzi/BABQOKFQmJOTgwUDOGkAwKcB+zgXF8u+RzcAAHwIFEUTEhKUfVdrAMDHwWAw IiMj4RAAAKAMXC43PDwcLj8B4NOQmZkJI5kBAEqSlZUFd6sB4NNQV1eXkpKi6ioAAJ+mhoaG hIQEVVcBAFAA6a1hVF0FAODTJBKJ8Hg89j2j6kIAAB8KRdGQkBDoZAQAKEleXh6JRFJ1FQAA BSAQCNDJCABQkoaGhsTERFVXAQBQgOrqahjGAABQEjabHRUVpeoqAAAKwOVyQ0ND4eJKAIAy oCgaFhYGMw8D8AnAogIWGGAYAwBASdLS0urq6lRdBQDgQ2GBITw8XDnDmIXFyc9cvQIpPMXP VS7gMlPD7rq6unp43K+hyii+LCvx/s2brq5XvfwjamjyC0CJKdF3r193db1++2EMhSOvqUjI z4uPuHP1qqurm/+zZBpX7oqFvDJClDdW5a1bkZlEyGTg8yS9z5GqqwAAfCgURaOjo6lUqhLW zQk4PB+xmZnbpPA0Inh2aadFV10EQTS7j40k1rdeJhIwHpz7vk93Mz11dQRR09I1GTRm3rPk Upkr4rPrb/+2zsa8m66aGoKoa+t3+3LKisR8sszGXHrl5T0Lu5t21cY2jKjrGpmPmrmxoPoN 9/Di0fwu7h1gZaKFtdXQMLFyWLj7FJn1Yc8bgP8gLpcbFham6ioAAAqgtAsllBYYRFU7v+pl YDHJ5fb9+6GxVHbrEwgoCX/ZQk/DcfyqC7fv3g/wv7Bzkbmh+sDpO4rp7cdpoEk+v5rqag39 esu/fv737/me3vy1oTYyduUf1az2Xa6ioIvfddXVH7Vot3vA/ft+3r8sH6+vhcze5drIldE/ mxfkYt/FYODEBd7e9+/7eqyfPURHW/vQnRyhAl8HAP4LsKMSHA4Hd0UE4BOApYWMjAwlrFhp gYGa9U1/6+5Ljspaxri1fSbSY2J6zauD+VvOUw0t+/mmtu9FbTy1aIRGn/+VtzrwP7t2kKHD mLD8pnaNa/eOc7AYs6n6RZ+FkE05NL+vweA5WZUyTjK4bB7axX4ivogh/ZFSEj/ZXmPurlss GF4KPjNYYFBavycA4KNisVjYx1kJK+4gMPBp1T4X9k/oZaGnp9dj5Pgj/wRUM14uFFVnRzp/ v9ixmzG21MbGZv3hS0S6ZL+e/8DE2EBDTU1NQwtbtPJkUNtxBKiAx2Vzea2P+eNu/WRq1tst rv1dM1A+l8PmtrnH99NT6wx7jnia3b5XAuVxOJzW4zFE7Nv75mv2m55aJqNDh89jY61Fkjr4 7NogN+ceWjq/BxTAGQbwuZH2ezIYjI6bAgA6N+zjHBERge0MFb1iuYFBQL+8c7aRgZ79gOET J04cPqCXvp7pkl98pDtveiVh2XATA1Pb4eMmTJwwYURfOzUt3YV/3BOPGyyLnD5ppKmetraZ PfbAw7fi+DLW3gq7ce88B6tBU5MqO2goxqxbPbpLrwkrntd3fPqUVZ3zzVDDAfN2V9DenAIE 3H8PLBk8oI+ZpcXcX29S5Q+SBOATFRcX19TUpOoqAAAKkJSUpITrnuQFhurEG7266E5YtC+v Unx43lSZefTbLzSNbENKxHvqnMenellbn/DPoQpEzSIRrThpgo2G0/idpdJQI69Log2Uz3h8 eouhvvmuK7gO44KQXX/nl5Xq2pbH7qV1GBf49IqL2+Zo6Ni4RpbI6WQQ8dkXdkz7+ushtrYW vYdO8A8vFMH16ODzk5aWVlNTo+oqAAAKUCih6LXKCQyiqCs7jMyG3E19NdiyMs2zl5ra1uvJ rQ/X+Xx+Hakg+t7FkXbqfcdsJklPar5dYBBwKA/ObTVGkFk/XKpjdBABeIyaGweWGyBqy/64 Q+d0MM6ASy09vXmWoY7BxnOP+cK3SgD0wuQVg3oa2c3OrH/DVRUAfLqIRGJBQYGqqwAAKACV So2Li1P0Wt8cGFCB9/552uoa+gaGRi8YGuipq6mtvxDBF+/rmQ+9XeYMtbfq1q3P4CEz5ixz sny3wECtSndePFZP12zr2Zs0TgdpoaE4ZuO0IUZdbPb848vrIACIavNw84f36mrR54/bQW+Z FqTPOcNzF4J0u5FY+9YPAeATUVVVRSAQVF0FAEABUBSNjY2l0WgKXau8wOB7cKGOxaC/74Wm tVVSR0ebhZn+J7p0tTx8NTCVQCgsKW2kMbeN0XrrwIBSyuNWTO1j1fuLw1eDmB2EBWEtMXT2 cKvuA8b+5RvD7mBIooCY4jdlsJnNsBnuQRlyz0MISJlJaYTiVpM1iZ77HUQQC7dkmPIOfHaU c0gCAFCN8vJyRR8CyOmSQLP9fzczNtl64RGLK96joyJeacrDLSvX3EmtaW6mnF82Guk5p1Ry ZkAo5FUk+9gbq/cZvYFIlzxabmDg0Yq3TLCzGjjRL6Kgw3ELtKrUlcO6dx8xF5dW3uH1C3UF oXP7W9iNX55CbOzo4kjeobndzRwm4vIbxLfpQEX0moIf5g3QtBgTXabYVAbAfwCXy8Xj8aqu AgCgGBwOJygoSKF3oZIEBmOH7T8dPNzayQtp2E6TU7VjWj8tXcMpS7div/t535rBVkbq9l+X ii+d5D88ugRBkAmLth06fHjn9jV2FobYjz2+mJYhPZ0vLzAIUtz2YI3HL/n+cNutPksvkzRg hN78+/c/3CWzQ/ICT65C1NRnrfuxbeNzsQXS8wDUh5fOnTp/jyJ5Ojd/mKGhY7hg009tG18k VEkvq2zwOnHs4tVgaah5/vSifVcdC4exzs6HDx/YO/OrfmoampvOP+6oewSAT1NISIhQCFcV A/CJIJFIGRkZiruvnCQwtGfqcCNWPCVCfUH6nlWze3URz/CsrW05ac6yJ+mV0kfSa7P2LP7K UBwTtM3shmw6cPyX9cONbb8MzJbs5+UEBlblvrlDZWwUMXN2k54RrTk0abC27rQ88XoKVo/p Latxz7NPpVPfl21y7Glht6oY+29D+vS+FrIa9/NMlUaRwrkmhv1H7a2S/IAKBYn3zk0Z3tdA 3EbHqs/wHefucgVwjQT4TMHcTQB8SrD8j8PhGhsbFbQ+EaWiMKm9NAKZ0dK3L2A1kbLSxb9L y6tvord6LMqm1REI2JLUXGIlVyikVBFTUjPJdMlEBkJWYWZ6BrFK1nPgkvIyZWw0Ka2cLB0A wa94np2ckie+QJPPysvOkNU4o7qlG4VXnJmRTiCJt8qjZxHSZDXOrGdKnw6nIC01M6fs1bgF VNhUUyzZQFpecQ0Pjq7AZywmJgbmbgLgU0ImkyMjI7lcmGAIAKBI8fHxFApF1VUAABSpuLg4 KiqKz3+LeREBAODtpKSkKGF2OACAKqEoWlpaisPhlHPPawDA54hAIFRWVqq6CgCAgmGZob6+ Ho/H5+bmwjglAMCHy8nJwY5EVF0FAEApeDxednZ2WFgY9knncDgKveISAPB5yc/PJ5FIqq4C AKBEWE4oLi6OlIiPj8c+9XV1dQwGAwZGAgDeHvY1kpeXp+oqAABKh8UGDofT2NiIHSOkpKRE R0fj8fggoASqfqsBUIqysrLs7GxVVwEAAACATq26ujojI0PVVQAAAACgUyOTycnJyaquAgAA AACdGoVCSUhIUHUVAAAAAOjUaDRaTEyMqqsAAAAAQKfGYrEiIyNVXQUAAAAAOjUej4fH41Vd BQAAAAA6NaFQ+OzZM1VXAQAAAIDODqYZAQAAAECHQkND4Ta4AAAAAJAvPDwcbmYHAAAAAPli YmJoNJqqqwAAAABAp5aQkNDY2KjqKgAAAADQqSUnJ5PJZFVXAT4OYWG41+5fXIopiu+EEnAZ EX7nd+/e/fPPJ5+XU9o3KEwIuXjgANbglxNez6tZ8tdWnYV3Oei8e8+es3eeUASitymAWpV2 ct9xEvN9igcAANAhAoFQVVWl6irAx8ELP78WsZoQV96k6DXzn55ag0hZDX+UWd1mIcq6+sMs Qy3kJX2Tnuf9kmSvScgL9TxoraXxsrFF/6mP0ivlb55FrnReOFBTxzG6XkFPCAAAQFs5OTml paWqrgJ8HEoLDMIq58kDtS1nBqUVFBSVsXjCVstEJc/OGWrpjFu6/0laVkFBQdiNYyPsDSz6 zUiuFbRfU1NR8BAjnf5TlgWHphbk5fr/7WzbRXP06nPUN2wZRdFqYuyeheN1NNUhMAAAgPKQ SCTsO1zVVYCPo+PAIOJz6ivLi4uLy2pq2Xzha0s5LGp1WSm2tLy8nMrioNLf8tllzyMWDbHV G7cJW1TTyEDbPij45LZeY5ellb8aWxtyeVNXY6srkTLOG2Te/aVXry+90192k7F2jDPuM3pr CVf2M4r3/OcLR5veQyaumuwAgQEAAJSntLQ0NzdX1VWAj6ODwMBvqrh8cP1Ac0M1BDGwdVj+ /YnnDS8XikoSAlYvmmSjL+5aMDQ0nLBiR2y1ZDEpyMpE/2UPwox9nh2OkEgPOGppZHk+tER+ M5GQkvTkZB9draW/B/BkN6G5bVm7/LhrTkWT76HJEBgAAEB5qqqqCASCqqsAH4fcwMBr/HP1 WE0t7eHTFm/dtm3l/yYa62oOWXikkScec8iqyZxmp96lx+BFG7/btnXrqqljtDU1hi4/LR5j SM7Zv2t9PwtjTZuh27Ztu+if2MFEYPTK72bamTpOzahH5bTCX9qsqampoa42fLtLNUNG54WU SCgUSVYDgQEAAJSqrq4uNTVV1VWAj0NeYKiIu9nX1GDmhuN1VPEZAh6z7uH5pTpahldiarAf qxK9Z02b5h5ezBaKd888avm6ESY9By3PY0gezChcN9JBf/q+tyiBcmXX/K5dehx0j3m9w6Ot lHsn9+3bsPibMTZm3dfsvdjIkt8cAgMAAChXQ0NDUtIbxquDT428wBDn9qNpN4fz/nHlL+TE 3+qLIEtPPZOeMRCJBE3kmuKiopRwvMfpXYN66NgMXJwrHZjwVoEBZdSXuu5f2lXPYPVv7o3M DgLAi5IZ13Z808Ww57nHOfIbQmAAAAClolAoCQkJqq4CfBzyAsPD4yteDURoZeHvj7jNzUIu ++bJH0f1MjfU1nb4YtiKDfsnOxm8U2BoLI3fOmMQgpgc8ghkthtOKUd9RsAAa8MVx+/LbwaB AQAAlIpKpcbFxam6CvBxyAsMwec2GJk53YomctriiedNEmb5HNIw6nklKIuB/YbPF4o4zjPM 3j4wVGU/mjrYtMfAyddwWSJ5IxcExMSga9ceklsliuqk2/0tTDf91cF92CEwAACAUtHp9JiY GFVXAT4OuWMY4m85WhhN2ny0pJaO7dJFAhrh6ZUJQ0a64EnYn8nNrTMQi1ERRDKWHrgcWkLA uZ5dtbs7zc2UzukoNzCgDOL8Qd36TVwaRqjs6MyCKPbadzqIvvP1MCpd2IyitJqig6tGGpg6 /CMuQx4IDAAAoFRMJjM6OlrVVYCPQxIYdM0mz/lmcWurNz4i1DXzqZe+n62ro+M4cuqixYsX zJvc29zIeNiyoiZec7MwxcNZRwPpM2zygsWL58ye0t3CxEBP07T3l7HlkvMFcgIDyk9124Mg SO8vp7TZ6OI1/z7OlDyY/vD0wcWLfy6SnFVg1z1fM9ZO18hy8tRvFi9aOHl4Py0dvQU/Xm7k SFfX6HFw96q1x9tPTgqBAQAAlIrNZkdERKi6CvBxSAJDe4YW53DF2GJ2Y82No7uHWxurIYiO ju2CtduTSBRpB4KAQ/57/xIrC00E0bbqN+H3v93++XmuoWlvt9hy8WI5gYFNPrR4uKzBEUbf nQ+VrLzhzIIxCPJVGqflckx2RfpP386xN9BGEI0uPUY6X/BrYL68rLLqx9GOBl1mt59rDAID AAAoFYfDCQ8PV3UV4CMR8rmM9phMvrDlBk+oSMhlMSW/Y/MFbToQREIBS7yIyeLwRCiKrYrJ ZLU8EBVx2SwmW9bsSijK5bBkbJTB5LYMVED5HDaDwW59iymRgM9mistgsbltxzygPGxDTE77 +1EJeGysNKG8ARIAAADeH5fLxePxqq4CAAAAAJ2aQCDA4XCqrgIAAAAAnZpIJHr2rIML1gAA AAAAsMCAotD1CwAAAAB5wsPDORyOqqsAAAAAQKcWFxdHpVJVXQV4TyiKCgQCHo+HpT42eDtc LlfV7xsAAPz3pKSkkMlkVVcB3hkWEkgkUlRUVGRkZLhEBHg7cEt3AAB4D7m5uSUlJaquAryD pqamxMTEkJCQrKwsGo2GJQehUCgStZ+cAAAAAFAYIpFYUNB+5jzQGfH5fOzNCgsLq6iowHKC qssBAADwGSkvL8cOVFVdBegYh8OJjo5OT08XCAQdtwYAAAAUikKhxMfHq7oK0AEej4fD4aDz CAAAgKpgeyKYHbqT4/P52HtUXV0NM2YAAABQoeDgYNgTdVrYW5OdnZ2TkwPvEQAAANXC4XDQ Ld5p1dXVxcTEQFoAAACgcng8Hqay6ZxEIlFYWBiFQlF1IQAAAEBzZGQki8VSdRVAhpKSkvT0 dFVXAQAAAIjFxsbSaDRVVwFkiI6OhtMLAAAAOomEhISmpiZVVwFeR6fTo6KiYApHAAAAnURq ampDQ4OqqwCvS0lJqampUXUVAAAAQIvnz59XVFSougrQBp/PDwsLg6tXAAAAdB6lpaX5+fmq rgK0wWAwYmNjFXo1pSDj3qlpS/fkkBmKW2cLRl3Rld82TZs27ZuFmxMLXr/5KYdGDnRz2Tpv HtZg4ZqDD6JyWNw3BiEhjx579/KW+XOmzZy54fDpZFI1X/SmFwGl15V6nDmyZtasadNmr9x+ PCarQiCE608BAEBZ6uvr09LSVF0FaKO4uFjRNwXjhZ9fi1hNiCtvUuhqMVy/XxYgiJqGpqam 7eignNrWy1BR07EVw/U0JUs1NTXU1XUMzfe7hsrerwtYd85u6qapoaEhbazWxWaIWyRRZlta Teb2qQ5qauov1qxmYOpwK4Kk6GcHAACgBZvNjoqKUnUVoI2YmBjsfVHoKpUWGPhlu8Y66vRe UcRsv0yY47MfQQyW7r9GZIhvr1kZ6z/3CxMjq2H4UhlTf9Rn+/ZAkK9WHSiuYDSLhNn4a0Ms tQfN+U3WCBuez89zNDTN97qGkgWiZgE399GVQVZIrzFr8xqgHwcAAJQCRdHw8HAYjd95cLnc iIgIRa+148AgYDYQovGBgYGhiclk5us79Ma64nhcMLYUj8eTaigtfy6sutCHN6f2tdL5YgG2 KDG3UtjmQdyYa8fmbv61uOFV+InzcDYztnIJK2tfQO7T83PnrgkvedlpQt860rjvhO/LZISL Jo9DOxb99Dfn5fZQoafzbH2HseH5jfJeBgAAAB8gOjoa5m7qPCgUSnJysqLX2kFgaCQm7lw2 uYeRrhqC6Jiaj5m5AfecJu04QEX8+Dt/jhvh2E1bA0EQXV3dfuPn3iZITv6TgqxM9JEXZuzz 7PC0SOytfVhg+DuyUk4bNrUu/3mC59nN9pbd916NfKtTBqjw1r6vDfuMiyyU/QQBAAB8uKSk JJggqPOoqKjIzs5W9FrlBgZ2lfPcoZraerPWOV+8dPnwjuVmBup2U3bXcsUH8Izy+FHmiHnf yc6n/7p88eKRtQv0tDQG/O8P8YqopTcvHx1la6bdf+rly5cfxuR1sHNvLFw8xtpi6IICuVOF BWOlSozY7lLL4L/V0yuNHWCJjFxxpJbzNs0BAAC8D2z3VFkp74gPfEwFBQVlZTLO2H8YeYGB iHOx6WKw+lfvF7/gZ/nvNUSQPwJLsB9q0x/v2rUrpujlOSjWnsmmNgMX50p3+ozCdSMd9Kfv 67gEduWe2V8YmvS+EtLBeM6CCK+bN88e/mmtvbbW6Pl7yig8+e2pJXHLh9kb2IyNIFE7LgMA AMD7IhKJhYWFqq4CtEhPT29sVHhHvLzAEPHPTpOutgcueAW/EOD1pz2CLD4eKN1V8/ms/NTY oCdPPC5fOrB+mqWxxjsGBmH187hd80eaWHT/zSOczX+7ATNC/pMzW031LY/4yOmg4edG3100 srelg9OtyCLhG6/BBAAAoACVlZVZWVmqrgK0UM7twOQFhofHV+hraFva2Dm0te1iKBYYeNSa gxsXDHPqP9DJaebSZb+ddl86qsu7BAZBXtyducNsjc0GXQ/P4ArfYXhtY9bDgT2Mlx+/L3Mp inLi/U8NtTN3GDrnfprsqy8BAAAoEIVCiYuLU3UVQEwoFOJwOCVctCIvMOBcvjM2dfSMl9kP Iki4ugPp6ng3uezF+IR36pJAC6JuDLM16DNmWSChXG6F/LRHrnv2/FXWalqn8li3PqYmmy+E yGrPifX63coIGbv8QGopjMABAICPgcfjhYaGqroKIEan02NiYpSwYnmBgZLz8MvuBv1nfptU UIdiEYFbE3xlr6lG12PBhVhFN7fOQEwGBKSWC7F0QK/1O/u9oa6GtePMDOn8CHIDA9qQ+oWZ 2sgV+0n1HQ9GzPD7yQBRW3bQvYbMa0ZFNXnxy8fb6Vk5+aTIuKdGcaybQ1eteQdu0DnC9ksB AAAoA4qiWGDgcmVc7g4+spqaGgKBoIQVSwKDpr59n35OrQ0f5xZX0Szi+p/c2tVAx6y7vaOT U/9+9t0M9fvN309mYQf7aN7Ts6Y6SDcrO2xRnz72phaWPa0MuzkMiyqVnAqQExhEnJAz6xAE MbG2b7NRpxFH3OMlow2abu5c6eS0PFdyVoFPqzqyarS2rqFdr/5Ojo721qY6XSz2XH7Cbjnl UHd6xZwvR24pwf4rbDy7dgyipm5l1/bpOE33SihSwqsHAACgRUpKSm1tbcftgJKRSCQiURnd 8fz463ts23P68lq0uKeAx6Dib19aNnaIva1t//6TnI+eJ9UxpSMIhXzao6uHRn/V29a27+iv N3g/Db331xanweNvJ0ruWcYs3jtvfP9Vx2Rsk9NwYstsGRu1HXDgeoxk5RTX7xba2s7PftEN wWssuX7ihykD+tra9ho6foXrgzg692XvTO3xBVMdB60vxv7b+HztrFGy1jzOPRZmhwYAACUq KirKzc1VdRWgOSsrq7q6WtVVAAAAALJRKJT4+HhVVwHEp3oaGmTdPAEAAADoBNhsdkREhELv pwzeR0JCApUKsw8BAADopIRCYUhIiKKu5hNwmbXVlW3VUqhMwccPJEJuTXVVA+0d7vzIY/2/ vfsOa+rc4wB+2BsZytAACrVqQbTVOq7itXVUWltFW4tWq9a6Z7XWipfW3Sriuq7WUVCve6OA kIQVIGFFCLJMGIEQRjbZi3sIMoQYQKBQ+X3+8DE5b97zJuF5zjfnXTXV5XWtL69gS9paYkgh qalm1hWu5PC65N0RCAShUMu+jwAAAEAvQSKRqquru6SqAvwZD2vkVTZeH87afwMnbNfOAF2n 8KnrAMtPd11rZ3Hmc/zaeR+7mpqiLTa3G7Fo4wFqmeB1hUWs3N1LZrlaGCN6eo7e43eevFMt 6uzbi4mJkcnaWAkZAAAA6EFVVVVEIrFLqtIEBhOvyZ9912jhwgnvOhgZOv58hdAlp2ivjgQG CTNlipuZhZ37Jwu/RZvsN9nLwkh/5OztVdrmmyrEpWumDDW3tp/1uf93y5fPHDfUyNDwq19v dTIxREZGwlbjAAAAejP0OoXH4xWKdm0mrJsmMNhvvdBsASKFvCov8iM32+Gf/ofb+RO0XwcC g4Jwao2hhVvQHZJAUXfJlrAZR9f8y9xqYGiqllGI5fEnzRGTb4MfCOpumqj5VblLPrQbMnY1 vRPLCIlEIhwO12YxpVKJluTxeNXV1Uwmk8Fg0On0EtA+lZWVb/4NAQAA0EhKShIIXnsHvv20 BAaUqnqjz0CPj7fXX33DTm3c+N8HZaTItQsWrDl8opgnq1XJSnPjjwT8tKDO6kMnbjKqaxpe zLq4Y+N3O8+Vlz7fvWUzenjTlt3JuQxV07ABVVVh9uk9u9BDK1euvJKULZBrrtyawOC78wq3 6NlPa9YsWLD058NXX2jfAllZ+izxVkQ8T9wUmXKeHsWY2e5/omVqP4tKvHkzjM6vv6OgktQU LH7PboTvTxWduMWAXv3T0tK0HpLL5ehXQ6VS4+PjIyMj0WhHIBBSUlIyMjIyMzMpFEo2aJ/i 4uI3/4YAAABoPH/+vLS0tPP1tA4M6hoB9vyv7g5uP19+2SVx5FsPh+lfTnexRBBk2OTvaUI5 5c5v9vp6zcc9TJr3A+NlZCjd8IGHqcMIzyHNxkY4e+EL6uONujT9zkQXs6ZDZg5r/9Asdq0J DB9Mn+eJsWg4ZogZ80M7f2SGHf7a2mrARZKurQoY5MiAnZvmTHrHZeKnN4md2pa6oKAgP7/l 1s9CoTA1NRWHwyUmJubl5fF4PJjMAgAAoGehF6MuWY1BExj0jM0srBtZWZkYGvhuCapsGBaI BgY9U6vPth8t4/GFIqmYQ/Ufa48Z+yU2K4fP5zMYBat9hxo5vHeNVKYpXhcYEAPjj5bvyipi syro57YvRhOAfzBWWTdVoXqVj6OVo2fQFXwln8+kJS+b9O6AodOI5bL6wGBq5bB+/y0Gn19W mLBqzmgEMQglt721AT0+dLiz/Rj//XydYwpwJ5a7ufW3sEBcJ82/i6N05nNLSUmpqqpqfCgS iYhEYnR0NIPBkMvlkBMAAAD0EuglKT4+vvPT+jSBwXCgh9fEJmOHDsFY2g9atOsPvmYMIRoY rJxHRFJfzghQyoV5z1ILilmqWpVUKq5iMC5s/9LS2uMMvkBzvC4wWDhPjGe8HIAoZpGnOCLT lv3BR3+Dv3jsZozM/imkpmH8AKeclv6MwhUr6wPD8Nk/VjXMPKBGH7VHkB/vtPwh/8rnoFKU pt/zGeLgNubT6Ow2Zo7UVBVTqTmZyRGLRg5xfudfYc+qdJd/7Uk1O3o0TpFAw1tUVFRBQQEa Fd6sQgAAAKD75OXlUamdXY1f2xgGSXF+1ncfu5jYu4Uk121agQaG/m4zMriNBdRSSXn0tXMr vl08b97cjyb7DLQy13s1MNiPW81urI6f94kLMnXRKbQCXtIfCILsuK7t132rQY90wjknBNl4 47XrYKsUNUk3jnq72g+dOC38WQc6aAqizrjbWi0/Et7+lzSHBgM0MCiVdaFHIBBERkbCko8A AAB6LT6fHxMT08lKtA96rK1NuRHogNisP1VXf4vAIBdVBS4d7vCuz48BB86cuYwnZkX8ucWu BwID72rw9w6Wxu/P2pDH7diEkZoC/Ifu9nP/c71Dr2okEonweLxKpUKTA/ofSAsAAAB6uaSk pE5OPXtdYLj/2wIL4/4BV1JrWwWGMsKf/Q2QvQ9pqpcd9dL/rppi0r7AIKLjPc2Rf68KZjf0 O1CeHPMaPPzQ/awOBgZpyM/zHO0cVu6+UiXR3REgxx5bZmc36nZ20weVcHmHo7XtujP4tj4e 7TgcDoFQNyK0oKAgKyvrzSoBAAAA/jbob9uEhITODLHTBIZ+i3b9mdKARCKeDfphqJOJ3fBJ CUV14xBaBAZm6mWMETJu/o7ohKTkxPDjO/0HmOsjBoMOPnimOa4rMChlvAC/4ebWrmt/ORuf khIbHuLr5eroNTWpRNaRwKAWZN5ysjSYtHgnNj45pUkqjcHVfBbKCmpuSkp2jWaVhurMW8P7 Gb87cd6Vm7EpxOTbpwOHu/TDjJ4RXyh6sw8tT0OhUMTExIhEb1gJAAAA8LdRKpVYLLYzQx+1 LQ2NGBkbOwwedfBean2Zll0SNaUBcz4wMaybV6lnYGBuMXiu7yxbE7st5+M0x3UFBvRaX02N mzvaycTIED2Rvr6BhcPwvbc1q1a2PzAohZe3zdZv2eq6KZpL9z/RdE5w/7vw3wgylsCpu5qr lfLYC9ud7CwN9eqmguobGDuOmHg17g2Hf6DxLDY2lsfjlZSUvG4pBgAAAKC3YbPZeDy+fgDe G2AVko7tD2zh6t27xeymRZYJd4/9FhxS3nx2o7D6ycVjewID9505l1nAkTBzTxze+2cYSXOM //jMsYPnHjZuIqWQVoceCbx4m9hYgUzAenL1EnqioKDT2UUNAwA4L478tu8KtukOP68k5VBg 4GNKq7kMcnHE9VMtG11nz93YfM3ESgnx1sXAwLMl4qbeiur85Eu/7wsM/CXozP1i9pvvASEQ COqHjpBIpOYzKwEAAIBeDr1ywZp4fxsajUahUNCE1nxmJQAAAND7SSSSuLg4Ho/X0w15+9Xv 4sFms6lUKplM7unmAAAAAB3DZDJht+W/QXFxMYFAqF+HQSwWt/0CAAAAoJcpLS2NioqCzNB9 0M/2yZMnNTU1ubm5GRkZsP4zAACAfyL0+lVRUYHD4RgMBlzLupxQKKzfKiI7O5tIJHbJ3uKv ISec2+g8am4qg9/lVbMKktd/NdHZ2dljxMdPMxktjnJLs4O3r/Rxd0cLDPvgi9/OP2LxpFrr QUlrykL3rJs81M0Zgxk/f+k1XIZI/tqRtyIW7eyOZWPdXJzd3KYsXH0/OUemhD9RAADoSRwO JzExMTk5GQ0P6DXujWdPgHroB4h+jIWFhQ8ePIiNjY2JiSGTyd18G0eGD16COPkk0rldXbPw /LrpenqWHp7e3jMWEajs5sfkAuqyya7mlrbu73l5e3sPHWRvama5MCBErO0vSCmu+n31zH5m Fh5D3/P2HjnYycbcFrPnOknr3l9yTuFPi3wszSyHDfPyHunl4mBt2X/wmSiqzo3CAAAAdDuV SsVkMkkkEh6Pj4yMDAedgOaECxcuHD169ObNmykpKX/LyNJuCwzSojUT3zX1WsbUsv+nIu3i RkTfdsOxhwxJ3c0TVk7i8o8GWjq896RAy8pUFamX7BG9mVtOVFSLa9Wq4mdhU9xMPWcEaJ1l mh120MbAeMGvf3F58lqlPC/p2uj+yOTFJ7ld++4AAACAHqJWqyUSCY1Gi4qKCg0NjYiISExM ZLPZbb+yU9oODDI2PTzkzOHDh0/fuFvIbrlsF52aev3UMfTomTNnSAVlL/tOuLTTQQFjXOyM hvqgh27is1/tU5Fl3L+0PTiEJWxauYJ8b5+jlWNwdFHrBryIv7x9+8Hn7MbCnBWjrIZN21yq rQcj48mZnbuCixqaqZSVzXFFxvv/VgV7ewIAAHi7KJXK0tLS8PDw8vLy+Pj4oqKi7jxbG4Gh KOnW9A8GWxgZIAhiYGo20H3yBXxJ/b4eKoXk9oFvMA42JnXLcCIGBgY2bu8diNAsR0kNd7I1 b1wTc8bWy23O8Yg8sdzWZuD5JF2blbCKMu/eubhj2VTMsPePh1F0j0tg5KXcvnF288IJg0aM u0IohUEMAAAA3j5qtbqsrCwuLk4gEKCZoaKiottOpSswyFnZSya6Ww1w23roUjQWd+P07jEe Vvajvszn1g2rYOeEDbNCvGeuvvQ4EofF3vhtx0Ar42Efba9U1daKWQmRV2cOczb54EscDkcu YOoeQsDPw/mMGPDuzPVlWvovmoQHfWNtbWZkhHgu2PGMVq37jYVsn2FtbWporD9uxUFqedcP 6QQAAAB6idTUVCqVyuPxsFisStVNo/Z0BYa8iCODrG3WBD1oeEJRELnHBkF23MlDH3CopLNn z2Yz6zoG0ISjUgp/mGaP8Zz/vP7iXFPw7Yfu5tO3ttkCJTdn4Vj3fs4jrxJKdJcsy8I/fXrn yrm93uamnlOXZJfrum9BTY14+vTWpeO7PPT1J/htLWK9dgoGAAAA8I8mkUgiIyPRf4lEYrfd ZNAVGKKOr7S2dl62dXdwgwO71w5CEL/dD6UvW8iJuxd69NChn9etnTPexdAA6WBgkOfH357p 6WTvPiI07kX7G5167RcnM7sfzse3XVStwp9aY2U08Pcw2BkcAADAWysrK6uwsJDP58fExHTP TQZdgeHBfn9zU+uxU2bMftWBa0R5ba24/Pm8SV6jx02dN3/+ll/33AwjrZtm15HAIMJe2zsS Y+s28jM8tUrZkdU8uNlhXhibr/ffa09hFinUycZqU3vSBQAAAPDPVFVVlZycjP4nLi6uMxuL v56uwBD/x2Y7uyHHI7Ibn1FK+dS8PCZPXFsrjfx9CTJgLDa/sj7HKMXlS8fZtjswKPAXf37H 2WbaNwFpdN0zQeRxl3bNnLkyndXUAZH16JCLrd360/hWhaUPgjd89vmW/KYFHdTE0O22Fk57 72ToPAsAAADwDyaXy58+fapQKNLT00tLS7vhDC8DA6GEo24BvebTov7l2s9lrO8jUpFSpZbW UEN2LbRA7I7FlqAHQzd8gli6nsfmydRqNqsweOt8UyN9x2FT0+onOugMDKqyWHcrZPq64HKe rOVZNZo/yH28zwZBpi0/QC0Wq5VyatL9qV4OVi7eDymc1oUTLq63NjCcs+lUeYVcLRdTcP/7 YLCV/YiPEgoF3fDpAQAAAL1FRkYGGhVYLFZCQkI3VK8JDK1ZOhyJKkQPJ13d72xt2vi0vqGJ z8bTYnndTYUyYqirZfNXuI4aZm8zZHRMoWZpSh2BQSm8/tPnWk6KWK0MjtZc+FmH505EkPHp krrVE1QyYUiAn6GBXmM5MwePY48axyQwtk0YbtHPN1/zQFFTeWzDjOaVWmA8rxJgQ3YAAABv ufLy8rS0NPQXdFJSUjes46TIvBfk25qf/90MZm3dwkdSasrT3d/7f4o+57f20q3HXNHLJZDU Kskz/NUVyz/39Z27YltQSm5Bws1D8+YvfUjWbBshZhzZvHzuzj+1nFPK/WPPOi0n9Z134l6G JjDwb+/9wdd3ywvZywWflBIe4f659V/O8fWdvXD1vphMerPtIVjnf1jpNz+wrOGxvIaFu3bs +y9m+/p+sXTTIWJ+pVIFyzAAAAB4ywmFwtjYWDQwoMmBRCLBVl8AAAAAaE0qlWKxWKVSqVKp EhMTi4vh7joAAAAAWkJzQnR0dP1OoHK5HA0PdDod7jMAAAAAoIX4+HiB4OUgf6lUGhMTk56e LhJp2dgRAAAAAH0WhUJp3hMhl8uzs7Ojo6Pz8/OFQmH9zQcAAAAA9HF0Oj0rq+XKxmhsyMnJ iY2NRZMDmUxms9nQTwEAAAD0ZfV7Vmo9hIYENDkwGIz09HQcDofH4+Pi4pKSkpKTk0kkUmpq ahpon/z8/L/5awUAAAC6FpoKIiIi2ryBgBaQyWQikYjP53M4HBaLVVVVVQnah8vl/i1fJgAA ANCNIiMjFQpFT7cCAAAAAL0aDoeTSCQ93QoAAAAA9GrNZ1YCAAAAAGhFJBI5HE5PtwIAAAAA vVpqamplZWVPtwIAAAAAvRqFQqHT6T3dCgAAAAD0ajQaLTc3t6dbAQAAAIBeraqqikwm93Qr AAAAANCriUQiAoHQ060AAAAAQK+mVquxWKxKperphgAAAACgVyMQCDU1NT3dCgAAAAD0amQy GWZWAgAAAEC3Fy9eUKnULq9WIRFyeAKFqhu2xlarJSIBh8PhcvlypZbOFIVUIuBy0QI8vlCu bKMBSvnLwnyRuN0dM2qJUMCvEcO+3wAAAPqOsrKyrKysrq5Vhg9egjj5JNK5XV1zbVnao1kf YhAEMbMb+SCt5SISzOf4dfOnuZmaogUsHUat3HmCXiF8XVUiVu6eJbNczY0RA4OBY3z2/xXB lba9FZeAkeLvhRk1fzsbduEAAADQZ3C53MTExK6utfsCA+/IwvH6Bk7T/Pz9NwRSGK9shCFm kqYMNre0H/Kx31f+/v6zxg41MzKctHg/R6alIrmgaO20ERbW9tM/8fP/eoHPKDcjY7Pvj0bI dZ9fwjm0apIBgkBgAAAA0KfI5XIsFqvu4tvr3RYYxLTvx79jNm4NX8t1XRZ3fAVi5hp0l8ST 13UvCJm0Xxd5W9h73MrU0owibLAFYrzs6ENBjbxWrWaXZfh5mg+fspWh1HF6ZeKVQA8HJ2sL IwgMAAAA+ppu2IKqrcCgUnIKM87u2rxs6dKNB4NINKai2QACpVxCTnq4b8OqpUuXbt68+R4h S1Q/8bMyc9NKf4/+VobOnuihoOuJr945UNCSsSEPcAJJU7fCswcHnKwcg6OLWjeh/HlMSMht ek19PlDJpcX+71iO/Dyg8vW3GHj5UePdBy7ecdxvgiMEBgAAAH1NWVkZhULp0irbCAyZj46/ 42iGNDAyG7z3Zmb9+ESlTHhy7QQjfaSJud3ay7i6Y9RwJ1vzxqdnbL0sbqsdd/f79bPDXEnT FYdKyU/37d0+z+cdzATf2ymlryumlJVumjxs8ncHyujUBRAYAAAA9D316z126fJNugKDiJ4w c7iDo8fYC2EkRjkzK+bmvEnOJpiJpPK6C3BFSoizEfLJqmPEQjqzvDzr4SVPBzOPcWvp6A9/ pbSyMOmr0W5mU1YzmUy2QKy7H6U0PnSYs934xQe5unoZap8cWojB2JqZIR7TlkQmv9BeSC66 /bv/AJdp8aVcaTUEBgAAAH2RUqmMiYmRybQNDXxDugID5cEB536OAX/FNTyhoiedckaQ9SHp aAAQVRfFx8eX8xVqtVpaU1NFf/7dJBuM5/znfE3ZmoJvP3Q3n75V9+nVKgUzK8zHbYDrmE+j s6t0F+aW5eXkZBBxd2YPcXIbOROf2/p2hCo/7tJojNt/bhAVqloIDAAAAPqszMzM4uLirqtP V2CIOLLcytxu+txFKxosWeRrjyB+ux9K646rOaySa8GBq5ctW/DF51O8XUyN9DoUGNQqEfH2 ifdd7QZ/+O+IzLL2N5ry8DDGymbDWXyL58VM8lcT3CcuDWKL6nDo2fPHOYycu6WMLda6EAQA AADwthKLxTgcTqnUee++A3QFhgf7/c0tB/gt27DjVZejnytqawVUwuhB/cbO/GZnYOC5a9fT c6oDPh/QkcDAu3x4+QBLk9Ez1lJrOjb1g58TPtLFzn//vRbP52NPDbFCtLHbdT21Q6cAAAAA /ukSExOrq6u7qDJdgSHlasAA24GB15ObSvNLw+/dSyti19aKbu2YiwycmlHBr7/Yy9g5X3ha tzcwqCWhP8937O/4/S8hDKFUZwvl4UFLMZhJkcW8xqfiLm1zsLbfeiGhRVFGZviaRX6N5nw2 c5CdSb+BQz+bs+R/CV2/SCYAAADQmzGZzLS0tC5akEETGPqPuRKdRGnueW51jUzKTPUbjbF3 H/X7X0+yKJQM0qOdC6eYmA25/qyqtlZ8Z+dcxMRux6n7ZAolIf7xKr+JRgZ6Du9OSmFqKtYV GNSCzJv9TZGPVuxNTM1sdtYcRnX97lrK6hIahUKrX9OZnnhhiIWR9/RlD8NTKVnPHl04MAJj jXn/k4RCkaawgkkreJ5T3Dp2wBgGAAAAfRkaFRITE7toIypNYGjN0uFIVCF6OOvx+WFO/fT1 9DTP6hmbW3+9/7ZUMx6gMvvRyAGG9Uf09A0GuHtPG4/p5+YdXaCZQ6kjMCgElzZ9oq3jwGpl cLQmBrEOz52IIOPTJXVLLagUkvATayxMjV42Qk/f1mPs/+JpDdUxtk0YbtHPN7/VeSAwAAAA 6OO4XG5MTExX3GRQvoi9tq21gF9j89n1JaRV1BvBe3/ctm3XrpMEcm6z16qqi1OOHN6Blj5y PqxaJCpIuB2wc29MToXmZdXXjx/8+dwjLeeUCe5eDNJy0m0Bt2ILNG9JFPPXyW3bTpQpmoZq MLNjTv2yc9u2n/Ydv1XCbb6RBP/RyUM7d51vPcVCIWRdPrk7ODRM1Pa+EwAAAMBbCI0KL168 IJPJXb1SNAAAAADeKkqlkkAglJSUQGYAAAAAgA5oZkhISKDRaG0XBQAAAEAfhmYGIpFIIpHk 8jZ2ewYAAABAX4ZmhqKioujoaBqNJpXqXtMAAAAAAH2aQCAgk8lRUVEZGRmVlZVCoVAmk6FZ AkY4AAAAAKAFuVxeXFxMJBLj4uKwWOzTp08jQPukpKT09LcH3lr/B25TTncNCmVuZHN0cmVh bQ0KZW5kb2JqDQoxMjggMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3Vy Y2VzPDwvRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9GMTcgMTE1IDAgUi9GNCAxNCAwIFIv RjMgMTIgMCBSL0Y1IDE2IDAgUi9GMTAgMzkgMCBSL0YxMyA1OCAwIFI+Pi9FeHRHU3RhdGU8 PC9HUzYgNiAwIFIvR1M5IDkgMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdl Qy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNTk1LjMyIDg0Mi4wNF0gL0NvbnRlbnRzIDEy OSAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+ L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDUzPj4NCmVuZG9iag0KMTI5IDAgb2JqDQo8PC9GaWx0 ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDYyMDU+Pg0Kc3RyZWFtDQp4nNVdXXPjtpJ9n6r5D3yU bsU0QQAEmUq5yuN87L21ucnuuHYfkvsgy/JYdeWPlTWZzL9fNACCIAWIlI2GnVRlLFEkTwME Tzca3Y3T8+1ufbNY7rLvvjs93+0Wy9vVdfbb6eXD479OL78+rk5/XXxa3y9264f704+fr3Zw 6D9Wi+vV9uws+/D9RfZ/798VeQH/1bUgWZHxhue0zGpW5gXLtqv37/73b9n9+3cfLt+/O/2R ZE12efP+HZxZZCSrSC7kaaJp8qrOLu/kOT99rLJPT/K22Sf1rTHffnr/7rdZNv9XdvmP9+9+ kHf7r/fvsh9+vshOA4348LDbPdyF2/Hjw8Puue0oB+0oa5FzkZE6r5lqhpLeCP3D5ce/9+V+ IRotRF6RANoxXXTUc6Z1lfNGPisJzjLCy5zUGSlA7k7gqef5h4O9tMl55e/HEzrLLuHfjxmZ n/BZMW9mVB3l8LVUX4ed/QKRGOe5YCGRTuJC1QegiGrk/xTzepYX0NS8nIsZV0d/n8HnAj6X 8E8RUyxelnldJukBXvIgVCbfGCoPLn+bFeL3eVRYKju+DrVw8EJptLIpc0FbtCZvKt+rMOEs v0T2wsMdUZK9bng2JC3KvAq+e95O4BVgGCieF9Dv+50w4azAYzEXThRIMV12+vFxcQ809/PF 37/PitP/XNx/ymar+5OfPsyfqbOE7kZXNCJbUFWZ4PKXfQp+eBHbMx9cdQAuexEc9cCVIhc9 tLxSP20/dZ//W3Py/KSc5fDP97/mkqLE7Nvo0kg5aD1NnPhdIS2U5oiuuAdmvoZ/HueVHAjy w1oeY7Pd05xJ8eQpT3M6u4UfFpuNOvAIX7bA2+r83WpOyEzqajiyfIA+VXe9ge/ra7jZ6h6O 7taLzXr3FW6RSbX3YE+yMPo8+LTerf+Ao6sMrlcCLnaLPHZ30Vq+4BRroJJyACaNLp4KrCkQ wfY7sqE5i96RAZYkyCzJRFKW9MNhsaSDNo0lS1SWnCIOFktO7ooJLHkHXxdfoa/U98X13PCW y5l1S5lLOXWZn1T6zuqM3QPcQX1c/anocrWdGyqVzPvVnviHggfg9RVcsllp5p2TwvD0Vv27 hKNwE3mOOn23XgK1qpsMyHfxCIhKyM16uVDC8Va4xvAvAOwWCqwV9tmvdYRnaF5WKs3osYe4 p7FAW8UeU4zkRTlNnlZLViNKUj2oaqKS1CPyxrZStVcPS3ie7lhbXMnhoE76rPojW8C5MLYD QwCu0eMJEAH5K/yJro9ZwXJCpnVi9CfICsnHtAeOycesaJTtERcu6rslp7dySB9+DP/85RLG mOLJb8HVwTULrS01dp/0uFdjUv3TDTHgN3OSGrcrIJsb+0kd0z9cW4p1GHPxlCkp1CkLe61+ u5aKss7vgW8XAFTpt8eK9ev2YU6HpIxga9K84b1ORbXI6ipnIiFcndfR4QIGYIlsABKa83T2 nxcNy/zrwKZZfxTV+psgDZbxN7UjYs+QzcWrT8A0W0eZunZZfYRZtlvIj/HZqpKHyOs8ISpK NZlM82JQwRQvR0ULEBeNQFzcZ3tqJinkyK6HbfhO3peexeYuTvKyDCAivLO8Usa1A5cXVSUU pv4UoC71Ra28xCcxeUHZjAsVvzcakddkYm8Y/jKmfZ+/IstV0jqn4hU6pGRFXk94EiGirt15 IUyYDvGuvKwl3k/xWZfkhI83RNu5d60pq4S6sTYyTPburG3cWdpK7PWNsslNqyo1C9Vm+r29 ZLdV2seZaGZXcO5q9wVs69UKUEx3vOY0RdNe1RQ5qw701uKzmlnf2o7Qahf0tzOdeLROjq2e 6S7Xj2ow6Hk5nB1dy8LALXivBZg0WsozWXS4gK5jqLquErXHa4qp6/yIaLrOhTtG15WYum5U KCxdN6E3Yr8rhZyu03HgQ/r1+S7SMVU3Klbrj44Nz2tFWMnHQVkVELE0Cjyces0Jna2067L1 cqqp3Lhqp0dp2c/2NkbbAPCtHRJejXM3FwcVs5nmXcGHzv+/eBM6txKdhzY4/rRjW7Vus1IW BHTanyjuNdKUamQ6gqGydMOUKo0LF1ClHFeVaoUTfJaoSnUEG0+9jgEH1CtFVa/pe8Oo10m9 8Uqqbky2VtWxmdf55moAmAPIaUz0aZu0FYB7kj8+WnClFceAW632tNuujFKLLQmrwV/4Cl0g iYTRceCR6XFllXCzr4NHZ8fR1wYrBqG1o41SpoGclauHqheG34R1IC8Qf4UJ+SBoqp2Oj4gf OVSrZBQTNWBTVLg2BS3axiSanfsA8ayHDu0Y44GhGg8jMqHZDlP64pVMhxHR3o7lkPrZtYbD CG46uyF5BxizYQR3wnQfFNRnO15Gp/wDa8M35ZfHruQpb23KTxpIUXmDU35HsBRT/rhwx4tG ivAzgky7A0shUgNTIv8v5f/i7ITJ72V9dlLKv4TovwVVfz983/5+cXZC5V8u4LeiYBfyc6U/ c3lNBb+VZyfcPYfpa9iP8tg5fJd/5X0EnFOd0Q5G3QIuZbX8vzKX1eo0wrrT1R24QbnQf9tb sMZI2ErB9Xf7O9OSwP/yWAOnUIPq3lboxrHKNJLqDlDnECO8UBIxtwFCI/eONV2j2tuzizNC XWkHrVDwHwzkxT4M7TfO7XLdd10L5G/c6Vr5ZGNPT7gYjjbUSMmqgDcuHVyZ8+hwATNc4Iay 8abKSbpchgAcUjCbizYtmo1hRrNNEgcpnG16V8SOZzsYkh7drpfNlFOOSa3tktB84fD92Haw 4a6s5WaC4uGgat3T01x2koo27q6BX3aLnW6oaybKEw4sC922BuC+efj6Ad+8Zrm8weF+vbbR 3cvNQ7s29tl28eob23jnTBX4rTJXVlu9nFXNvrFJDnedW2f9OBf6bhswpz3PSp3WZdYsrYNo tdBuogcbnRI/KlLqBEJ7/YQamlg0ecXTwRF5pogNF1B8Nar/iQuak+Z11rTGsNG8UqPA+7rQ hEciTMw4HZMnOwGYuq5VbYBvsfxTo73y8/raUgrMWY0WUHPW1VP2dKs8H1YVVnuZZKA8Fa9r ZXBIIy63djFfKdXdg6S7T5Y8F4+SLHX6zNJq1ylapvorKBnzakqDpRp1Ov0FFEx0T1gB6Wej 3RNfqcH6wwTgyAqgwVUAvIBI2oQrEH5EPLJ34NJExBE5L5ZW9yjwvoIpsRTMYVFSKZixDhkq mOhh90RZiWNi9LTanVIXJl+9maLWPEHx1ZT5kOs21zSqbrRZqEzM+N4byiDvcbQ31Jyvmwz3 lXv0dR5Y0J/y7uyXp3oxsMgnjA39WOPHizI5lxiwcRqTmNUCfIbTXgqTYO9k1EWWhpO9bnBU RHSNzomQTZyokbp+sa9OCQYzXFyzrJCHmqZWsDd/i1C8JUqNK0+jBXSxfMWogAXFfcUv6tiK XzRS74cQ4w9pqfP2GljkQj7oQsmhXDW9I+CwUeXXGFMq8If8Mr7zkyjn/JFSYdhFBOJnjpbj 0uqlLqJLRx6pecTKqolldHIkldjrOkzDsWqGHYSJJiSLxEYLcQpyRSheVjnfbwXaKoofDmsV xUGbsIpyaT8hZdVK7SPqaVIhzK3kBUf0yH0byREIa/ItpmgDU4UVrcA1VGmOsScr38R6t7jS 0wXlBvq3dVEojC8b7c75ZBnKW9TJAOq4DHB2XLfi2tCMdkagY1z1OXBPU4totwbX0VP8Oj+0 hsKpqQY6YySnLCEczevor3GI+2IUQzngR5GWa9Mk9aN4EfH8KA6c11U+IDxM6qtrKGkbkAjB fSH7m4Q7oBldK47uyJCTZBESaAqRWv/7VBJlhkO1h2NYFm0H69y33Qn9Qm3BKm1KQISglDo4 WvdD70DybkW79fq8Bfd/QWGSOWzBaEoAQvRgkTeiJw9u9KDEaRLCcYiAjgwX0kG4dW2YJKom qS/fj4img1y4yToIKdFf66CARFg6KNgBr6WDAgINq7z2VBBQ7h/zVgsFTfaq0zYnQmmOVtvc djrMaBrrfBhoG6+dPyicqO6q1qIH4efy3sIfoY1g6XNSQimbVC8UJzznCdFE3sRGC3Esbj0V VheQD5GSY72IeBzrwE3mWKRsb8OxfonQODbUAeMc63NjXA3sZmNkO0VZnWgMnejytS011Rl4 diMAs9Kozv6yVrSlA2aGGwps5RXdgqK+bKFDUc097KKmlvcP+LryRuno2h6rN5G6waraekp7 cWrsBxPpb8L5beT/uUlrgOh/ofMT2HmXeFDQM9GmL7T5GibHwDlF5RvYdAi4VW0SDIZZFPUZ KdyEDWHEoGduCkib5mClNSkh8Ltw0h8CyRk616Ho0iAkjHDQbIP5IPPEaRW09kOlb2dEip48 pord+h+Z14OmlDtvB6pZWtAvT/KJDxMk7wuP6gwT0qCKjRbSkTEKpRxYB4C8l4TrAAE4pHUA F+2odQCkiYheB5gkFdI6wPQeib0OEM3f3+r1oaVvw120xr2zm0SokNUu1cHWvRpGRY460xyX WGNFU3p9aWcn/fLHr6qEzQvOeOdeCzxxV0G5SYsfnJRCky7o5PG1lwzSHw/kLjau2mNGebNO rb0sI9Cf61k7SrlrV9UzA5zmCa36ad8wUYDENLdV/5WT3ehR+YzvWyWMaYvD/vajtkLIs7Iv VV83vsRLf9f3uvND97xtuui5fb50KHjV2TuyIyrnOasruAYoBmKLfhfpruuSb3tCmGTadpi4 Y68xD0cL9PpJRSaq6DCLBi3zgCcFqCb6rEyAP3iSuFqw32dthGNHwnueeFVEwrh6equtL2Hf EI/WjhD6d61ydOQ7INy1PdxVM+zPxtoQuMyqs9C2Rb/PO9XTGrgt95+45RB0K99CghsrSyjq OfJwu8521Dm0Rrvi4q9EsFo5RBzhcB0isr3R4UImeYw6Q4dMckJyltAk98NhmeQO2lEmOZLf ypjkU6TCMskn98gEk1x788Gc7kqteBeVxWGDPGvruHZqwOgza6orIXTd9K09adUPQe98bx3X ZKBKqsGSc3yPAFGpP6kGNyMMAozTwamdliPDhfguRkGHsJueNg0s6yZ00/sR0dz0LtyIm56m CcdJ1gHaTR/ogMvWn+1u9rferRe7h4mkoskPqMUhP2fDSscP6a47LnVODz/Gae/x/L/AADwQ RQix7aEec+zP+AF+arf2ADBCPCGTxkAAbS8mKbr/FvRusqYKEW6qX8e+haAm2P2O7QusjYmn RzvL6t5L+XZEp6sKIhcCosSnK8OOfrh2DuUp+Bg9YqOkuaAhQeJv2VJWecl7cKhbtpR1LkQ6 OEqGgwjRVsKtAUJFBQ6dlLaSFxHPVnLgJttKqGFjyTrA2Er+DhjYSn0WrvokbCISvHzlTMOU O3LfWupMDKN/p1tLc2LceActJmcqGd2oaCAwK9CF8RU7L3MeQvNGu0VPCC6Ttrfm4fb2d/l8 S3ZMxaHE6d7z2ZttRE8WrCFBJwCPYLsUkKATgOv5fytc24Vw8MEGBIlvu5AacFw4XNtFRdin g6Ow/WRkuJDtEqN8zQG/NuXU553H8msH4JD82i7aUX5tpAL62q89SSokv/b0HnmmX3vPwFgv dIpQNdt8teGU2qzRZbXUfmnlbKnql/HBLtW+Jc9hULla7awwgsqpVBeiSTZoaU1yShLC0bym seECPFbGKMdxYA4mL9h3uqPOwbyIeHMwB25kDsYS+av9EqHNwfxwgzmYnm497dZzM6Ua1N2L bQpIUq14SLYRF3l/stf4qFMxnMubdhOIljvdcAj1q59Hew7Ng0R6gpKew+SY4cneGQYplwnR KGjWuGghGo1RgcRHo3WpaJQWyZb9aqH8m15EDBap1ZvqwB1BoxUmn8J29uBY9ouGsGcRGXZ8 j09lO1tOEaN8ql1azO+BtwTnTdRp9nxPJmuhiwyrTFjZUwZ74bHeXnirLkptGLV23xLtszfM i6Qn9TtFGt+CQbfbrq4CpYq/OymUugjs8naQU3k43Dr+TL5W+zC7bUCdWjdq9+V0cKVyHMSF C1E3VgEVM8wKkWwVwlC3FxGPuh2446kbZzmipe5EPdFSt78n0Kg79rwTSozQUCv2lUT0aW8F 2w4E4BFm2U1eBlv7Refim5T8bafSbETf5CybVlXe6WfZ3/ptdf2SIrgx1SFsreLxQbdKP74G KwjYOS4s6itaMJgGpINTG9VEhgtpMKzyK2Zk1MzjiMLUYH5ENA3mwmEWUIcxKEQIblxX4kR1 G12Zqs+Nrgx0wmtOc9rS5bXZHmKTLTv+vu9nN+o9OsDjrgseqJX+7oZ9B3kg0/P6Ja6vqNQv qM9Nhk79DmwK6k8Gp6k/LlyI+nGrwpTSJCySuu/9iGjuexdu8uQFNYQqIBGW+z4AN3Dfd1sa XRuCNbkvLgX71iSD4eYuGcNJurjLvmP9c3vroU9d78st6bR+ay51wcOvDkbEdA21/pPBQRWh 6HAhdotRz+OAYctVW1Iatl5EPMPWgTuC3VJ41VP1RGtu+nuiZ252PMcszZ0wl+cm5OsNA0U1 z9ktxPzBneBgr/uZ1wMHu0U+xsmuss6/tqZx35P9BqxOORAatvdIAv71/rbyblnb+OYpq2Fq 4sqHOkKl4UNTwql0ichwIQKPkf19gMBLkbMyKYF7EfEI3IE7nsBRfeupeqIlcH9PIBN49Lpx RU5IqC2HVEX0ADq1NUFAkNb53VU/dxzgqpuHZnWwyMmt7OLO923jY6zz+404QCAMO73/o0NN 4f5Ihaa9H1HRQtoFK9fejArZcbROql28iHjaxYE7XrvgeqP9oqFpFz/cG5kedGVEusLefe+0 Re4Kkox6qE+cfQ89Huo3M0+AvV6b/WeDzc4ubAJ6Tgen+DkyXIigYyT4HkiSITXxORGwkmQC cEhJMi7aUUkyHMc9rZNkJkmFlCQzvUeiJMk0gwW9bd/JPLliOdC/utZXtjy2Yc9qKPI+qacm G/Ha175U1augnf6yhM2op8aphGU13kjtw9dUP4ZjqqZzU4W6cq/SvK6Ov5rXzkq10s16p9Eu 07kNANobY04V8bXazekax9lVVuDId1uJXc6C03RwtABXXmS4kLaLkhLqaYXZ2ZhwUAv70xG0 jY29gPEfktnX2EWbsnFvp/rOLyRXIGxsLCBJ/FixEKyBAuYmx8pxvtTm/NP8pOkY+6Ld4U6z z9Zqs0385WwCG9YlGkOkZlBAIBlapaYIUdECrEKj7Jd+wIZmFdQyS2ZD++GwbGgHbYINrYgE M0OzUquQk6RC2P5bTfkmgf9yP4jDOFATI7zDgWPw6PI42cOceUwc5hjaI8nkR9ijE5YOwWh9 7Gz+g7Zo/DiRBtwZyV4IJtUsrxPC8ZzERgtRJFbypQ6CIxTsr5RBcH5EtCA4F+54lsTky6aC ii6T5ENxkoOSd8E79+PP62vLNd60jyBJHdpJbWyKCOU6Oq40eZmb1eIJqLWty//sSlJhr0LT 5IUIdUXyevmMyveSJntLGG2AxJLBMaKIOi5ciDpxd48nJc3LtNTpRcSjTgfumdSJFE1sqHOK fGjU6YIfQZ2tSVZN2BllIptq+7Pzo3Wn2k0pw2yq6yuHQpzj0xvsLhh6dxD4piLKv5AMjqp1 hLhwIXrD3ZicEJKLPb8iKr15EfHozYF7Jr0hbUVi6G2KfGj05oKHgwYeW7d+t+S+Vpvl+teg gNA+tzG7HdmoO0D8ADfr/7v1I5xutt3drPSq/eYpu+nvJOpdmHnpplTxOa9qgi9UVkCV/8ul fJIou5OKZG8VVLcnsdFC1IebGUYKcDYnpT4vIh71OXDPpD6kapWG+qbIh0Z9LvggcsxEQHkS cgdr7041bVs+bXfb7qXkbIPcCzl1fXkvshwdx5/67qzb71Z/wr0RTDtG4dVPNZQZuN9SwtU5 jw4X4jes3DDNb5CMmSj2U9ObFxCN3Ry0Z5IbUpSRJrcp4mFxm4vdUdv+ikj80Agehj9ug2mY 5m4yNcvWzrnh+sqEsjVB/6VrWh5zw9dbaKk5zKf9HYuQIFvDdDrR6wyLSCI2Wpy3SfMoWLz7 LqB//nIJz1wxzLfZOfwJLtj18rW/kbMZZ5okjziZgounDEa+TlFZKvPiylXyZnPb1U0XWqXH N/yknEWL3eqL8hepi7+xci1VUuK9chXpaIrderNp3zwFslGjePlvK41bVKTdHmS7su/NEtZC 720oxsrksz90IWOv//Aqnov9h6f7dPdFtUW3rP9I4MOj0yhnAUNbfpv1Uu8jbE+Hbh1bRwC+ iF9KvKggFcJpKWpp76KB7ZVSocFEk0RGa82x/wdro4QLDQplbmRzdHJlYW0NCmVuZG9iag0K MTMwIDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8 PC9GMSA3IDAgUi9GMiAxMCAwIFIvRjE3IDExNSAwIFIvRjQgMTQgMCBSL0YzIDEyIDAgUi9G MTMgNTggMCBSL0Y1IDE2IDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2IDAgUi9HUzkgOSAwIFI+ Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hb IDAgMCA1OTUuMzIgODQyLjA0XSAvQ29udGVudHMgMTMxIDAgUi9Hcm91cDw8L1R5cGUvR3Jv dXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMg NTQ+Pg0KZW5kb2JqDQoxMzEgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGgg NTIyNz4+DQpzdHJlYW0NCnic7V1bc+O2FX73jP8D3yplYpg3gOROJjN7SbfpdNtt1tM8ZPNA y7SXjSw5Er2X/vriACAAkgBJeQHZzTQz8YoSyYPrd75zAXD+fNfU1+WqCb777vx505SrD9VV 8Mv5xfbu1/OLL3fV+dvypt6UTb3dnL+7v2zgq79U5VW1+/774MWrl8HvpychCuG/PM+iIAxw gVESB3kaozANdtXpyc/fBJvTkxcXpyfnf46CIri4Pj2BO8MgCkiEMnpbVhSI5MHFLb3n9TsS 3Ozpa4MbdlWIq9enJ78sguWvwcVfT09+oG/75+lJ8MObl8G5pRIvtk2zvbXX48/bbfPQesS9 esR5hnAWRDnKU1YNVnpR6B8u3v3YLfdXSkvCDJHIIu2QJjqon5OcIFzQvqLC0yDCMYryIAqh 3KrAc+8zDwf5aIEwMbfjWbIILuDvuyBanuFFuCwWCfsWw2XMLvuN/RVFSjFGWWor0plbUfmI qIhV8l/hMl+gEKqK4mW2wOzb9wv4HMLnGP6ELouF4xjl8VFaAMfYKiqgMyahX65+WYTZ+6VT sQlt+NxWw96E4tLiIkZZ0korUEFMU2HGXeYSyQfHGyKOB83wYJFJGCNinXvGRsAEZAhRGIXQ 7sNGmHGXpVvEgzMLxJAuOH93V24A5t68/PFVEJ7/rdzcBItqc/b6xfKBOivjzagXLaI1ICTI QH8NIXj7VWifmsSREXHBV4lLDOLiDGUdaYiwn3Y36vNPHJOXZ/ECwZ/nL5cJ/xQDOj1zXigS opTMK5X7FiExKvIDmmQDbXAFf+7gzxb+1Mso4T80+2VKC0nv29NG+wBfles1+6K8X55li4Z+ l9JRyz7Xq7KpAvmaHYN8uJddiluXUch/+VTDO+H+dLHawguYyGv4rd7BY7fwE3tBAyX64Lqx kixGGM9rLF7O+kqvbvMFyiZqSHjJeduINrpVz7AmXtPaR4tL2UKf4U+1D+S31XW39aqHDhA3 g0mAB6YoONU+N7LMpWidDVywr3mbrOB6VcFf6Hj4n/ftVnUzHyK3S0oaXHd2TLloGnUq4xOa 4pB+lRxPXBSjxLk4i7KKPCsrynIouTqasjKL86WsNGkHKavEq7KaUypvymqO8OcNQ4h1Ve6b gCIG4dqCwzIHZLsWC/YMWFpYXn2A27fyTqWH2jvYNwyw7iWuMbgXmMWAnd/wgSI/h7walCX7 RWIbUwk9ZciKWTZlwItL+E9cRVYratnKyjnHwDTrD0GfAz7NQxQdURpV5q6lWQAw9gyAFCmS 4+GfUZov+FPCDkK/1Cv6zSiUN/CbIfsFxRWNQjMUmYI8SdwZIJVf4G52/W+4h9+9gZ+atYI1 jcQBTRfgeQuA1GGxl0udwI7Qu0JA45W8r6XEmXoXfbt4GeH3sApVO/jLb4fKwAtrRhU3LWa7 x8c8QTg/1oxIcwL4eCxhOcCjU2EWdEw8o2OEwQl2NHg0i/OFj5q0gwASewXIOaXyhpCzm2TE l+G6aAVBxczeskNxx4WiAPfhbpSPCjjra3jii8Rd8VhAgXfEidH6XwxeDGjHK9nAEreJdGJ8 +tCqKY1PG7XCE3BphCmKyUTH1bLjBs6N6gpqz367pE1gaOazVmVzz5Xsl1Z5pyO6273vI6VM POvU2qszIuUe+qOJwyh0Ls6i3FIXys1QiSyl4zINSEGfGNgv34Vhln/vWL9lBYpjm0T3vUTF DCoYoiykM46Vg82/zjd9ZfcalJ17FRdlKCeHl8sDAQhRkh9ekNdbyaAVzX5JAaZu6v9U7lUf Ham0fMcaNlFGEHY+Si2TG/tlriSn/xzPsWkR54m56tJmMNfXkrlGPpnrrFL5Yq6zhP9EZ2q1 33Z9jZwxcRYGWTBw9VtLrdjX9+0Vt+K1OMtG8ss3794Gd3AlPIwiRFWvK3NIj198hCc4g4E7 4LFbRWpocbg39BKu7jlhZaXfKBK0XWZDOtStCGdD7i34ImRwcaShn1JYKo4pDvcHtT8wJA7A EBvmRsrBiRQoMvCcPHHNcyIcUW1pFuhh6mPC1KOShkJCMiaSfxoHQp+QSI3WJJssmvsmKXKU F5Nyn2+AxyhTiplGpbRzwU5NW5MLAKSGqDkDHQ389ssoFQBzJXFQizAzu/mztLyUISYRsb6R PkZuQ1NznF7liybYcUt3u8zNUM1exH5hYvqyNWRW1v5VGwXSXbJCEtz0u3rnvvn2cW1nMXNx Bk5Se0fO1Sute3dUseSaXhH+iZw5lnXVwnMlfgcBbVMFzbZvlMs+aX3nRDe/ecs7V0gJ5a8Z 7jSaT/hJwKrLjicujxBxLs6ikDLP7JwO73DoP/DGzs3ifLFzTdpB7NxrjtysUnlj53OEc6Vk ZNMyV81GpzcSXJr2wZxfMz+tcMNy8JPYNKGCSpDIUJNB1xqchvIePXdApR9w0s31kPAlF8bE hBKcwxxKbfZI0WPxzuES08mRHm9y4CjvDwWv4uKIuXjcirPAZe7JU9nSgCQxZFp48VS2DN4o 0R+F18QZeA7Lbk9Tlt7+g/N5EJG038hGrtUD6iNYD1Ml8mY+TAn+mVJ5LdAigFXj3ONBlwAg mEWuVMaC9LYYsJ8DKk9cXvMciWq/X1L4v2FEdx80XBtA4lpipKilJMMjiP8UGH8cyxwVU8uX rPZcIdXX9Yq7rWrWTDZllPXjmps2+8OggXLdyqo+QyP2zLe6uVet/G0/oVhaW7q4jpnWC32K qB0Ro0hpy/V6y4OuPcOz+aSZGzLkp/nm5FAyWEdkUd7pdaIfnz2JfqfEuBjp96pu+pHNoVXG Ory+YzHkirGpJqj3wWYpuZHIeSeSauSaSa7bz1ow+Y4/CuKI1o2mWSbfbChg3ru5XiZ9l0IL B65deSl9YLKFB/ZpAK1j8l88fmSdjxlcFEBx7FXiiMko7K3KQ4DiK7pZNtVaS5OA7tU4L4WY SrpbdMgA389W+ksGjvQ9sGeR6kBLoSWS3StfhBjKxQARVP6EkMYAZ+3eY5CGESpwpyH9kcTC AUk0EV22Ig7nGcon082MKwxcrIezlyujVKb1BYcopj+0wVX4zC2/N88YRrypryQd6CYr8qyX Uo0/Zcld8rsDZXgJjyYZsQEZ99ipn1ZAIbbS/JygL52FWv3UdZhNrj0/wAmKblMe1sUuVpEY 4guiiyl/zoqjxBdIxILxZonu6bBIFOmIm5Mm8AbBcHj19lnwijkR2AKEZPF2t2U8U1t54NyU IeAcdNw+tlHlKzVfpK9gnMCw9+4kpDbPiDj3NhZ3gerirC6xdiChiBPVN4NFjkOUhPU3iWS8 dy2rl4teAuMi0Kt+YmS5HklXVLYbs6ia+iODzUAWrGxK9+79nMOg236yDW5fmdXt4E4jlGfH G9xmcd4GtyZuenDH8wf3rfvFnBS4i3kFZnxDBU3Lq05A805SAH19Ge7masjY6Gee2wpx1Z3M 6KCTVr2eMxPgGvUlZcKC4vD1dCXjLsLAByIjFm409Uoav/0MY2X2roX/Wndfd1bKtQUtTJXi BuDj5xXjJEQJnugyC86JfOw+xpGZEMcNxOsWVXcyUDD0xCiOqqwlCC3kvGk7/dF9kHcuCzp8 ZEL5mkgPUdMEoqazmvNJ9DtscTS1jOvv/7iANmNRtmewNxAWXiLJ3dWnvpWsOmKt8iA4t4fO vJafdsoNZkyAoFbwhXTOlPJZPhBXbDrzmFcJgggfaLJYwBYT78tUkzxhFrDWqB6VqpOM7hGl GmYmC8mbUjWL86ZUNXHTSjVhStV5UVKMouNVPM0g+W5exSecBxotdk0h4gTleF4pLXRceByr Gyj2YAV8b8OToSLXXfqQauOFfZOMsW+3XW8DChfZ4aaEyBhmLsvtPJLHIkoSiKeaJfqYMaRf QaNnuAsTWijTzsLJuIWpU0TunZtHOG/AJaI0pGFPB/VutUnR7TLTlmHYszKU144r551KDuS0 LriUUY3mU1VpydWP799P81S5CIzBQG1Ro2KijEJojIR1gZbcWa94iEisr4O7vayCC3GnBh7R wlf6tECLLDbYzl7RwijRH1po4uaiRTwbLW7Z8BMhJqNF6R8u7tt3yRmTjUwYYQUQA7joFhqz 6jR3wJOADBIpK87UlYNt0twvIgNx0wWBgZKpgeI+q6eIYFOwyXI8iV5LC2XSmgqpm7OIOyyc d1sOu5lNlsS94DyENaGTgtkuvyKdoeX2Ikdz/YnDi8QBnnCy4rFjlie0685VY0om8BmBT/x+ k6bs2/j6NgDANdib+2vUlVE/6iR0H97GOYq6nepRC7vIGR/RwkluMDy8amGjRH9aWBM3Vwsn rrWwnrLTqtx9s2O8mKeeyYxmXc9mB7LyTXe3UW27hw4rp4yczWGRWPgEgDom43bV02fkWg08 YoGLhOgRLIgw5MceEwuMEv1hgSZuLhakTwsL7luvVOncE1XEoM4m24jHWiam4izIKp4m1w+Z 3/EArt8bCt4491TBnkLrwShKngTnniyJL849Kfj/nPvBnFtvW4961kVO6UhALYGBMhXT8BVe myXcV7BtlnCphVPH6Vlzkg86s2k8+4B0kg/2Vbs9nLbHp8x5aPiGeOmYM62VwV7fUbPErGWv ZOx9td62oW4tZ1asInn85IKEFJAONN7tWm1Y6oCGRwyFvvWjLXAKuZ2zSnirEJSjKWvrNRsg mT4+5Op8ngkhTZKK561qu824N0hIBIcEzKqP6z2lXaS8282TBGcoG2GmPg2VKdneTJZJwV2w 9BJy1C2WMQhdibkqFtJxatHbkJn9wnOGeKrODHAsdGycjDQ8AQ6cknETaiZudxF+iImkhcQ2 uCKhSSwHY2vrDeqrt6H1OD75AN0kxXBszWRDuQYoTws2WoBK0lEDzStATcj2B1BTgg0A5TzK 2dmk7W6ZjiSAmvAm73MxPhlY6HRNpT88b8Fuz8QZBIcnW68zV/UGqNxbWNms/hyeQvi1ggms IJ2Uy7u0dL4MLM1yOL7w+BMIDheZMQK6aWrCYwgJ7iX6Gno/sqFIgqKDm0PdJEc2gT0P4DQn KjdEtLZhxORff+MAyV0skhqxV+JkhpvBWDAXC1xG0DaKpP18YMFcJAlbFysmYSjNjeMsVjRL 9LZYsSNu/mLFCy1TvheO07xznFCv+DoY5/ZtBJuOOG4u2yDztf2wcJzFOdtI5ViZ6BZxvpxj urgJ59iFdJ+PGHu9Ixp7XErb24LlafLlMJwX/SY5E3vDp3UFi7KYKacdDMD3MTwbOyySF4Jo p+z0jm6o2d7BHnYgCEEJOe5A26j3mygZZ9mRw7Jmid5MCF3cwHDojXTTmB9ZnnAr/akqkKHW HPGtNQ4a+OXlMu24fcX+LYEa+vpy37lHk1hPk2r3Z5hwB7vfxS5hW/k7Hgm2CeQ3xykmWHLZ I00go0R/E0gTN2sCxX+UCeRabSQxbAZraU9e72s6/eTW9f305rGJ7N5Qw7CMy1JYD/tasgis 46FtQwS/mU4xToeHyHkFBJNAf3igpM2Cg+Sr4IDvZS43MCtZBvpw66CJ9ILuHmdbpe4eeNw6 Py6X71yovUgJ/CCr8lGhUz/UwROyHvkMc9Gp9IEsH/SqCXBpy7SIm8FyaRZjEFVTG93BXk7D 7JBUSw6ZoCx2v+2foIOtdH95FumHp+s9VeobX04lfXo4XDhEuNPQHhHOc45JnESms8S8mcpm cd5MZU3cbFN5JOzwJE3lO4WY4gBD57sUYBTheY1pSG6RU7gXpBhvkswGK6Mnlj9+DkscFZDd NyNDpD1VHcbQZu6x6kX/VPVBpMtjdl2cFHD+oF5Fj4frukgTGUO+kOV/Hg35zOK8IZ8mbjby jSxoGUe+S00dj2wL2T21tejQujOeiTegdexuE6UjDC3nEDpZzMHxLP3zUjpcTqE2MZMmesP7 BZ97Mvb2+AAE25fnU2exTXEzs2KxnE5uSmYbRem2x3QElMb8HBQ807fMIoY8Tm0BwfulUiHt VuVTx9beySLJJULuw9kJxJNn9dad0hF+lifBAe20FHphPAK7i/SaEWCPKF0ZGtG+cN0szRes a9Jmo/rI0qSj8VnDBupdS15t0qYmJH9SkcbB4WH1ldw+pPUD+goUJRmclOG2s23zw0XSgt2p FcGOcwO71adXyyzRm1vLIs44LfQ4kft1PixlXC+O7mar5QaW/1sO9eH+8HdSPW/abTvmHQFP PBxDh6OU6VW3Y842VV2k8YxMVRIbvCVep6pRor+pqokbcUGrqfpHiEjJCeRcR6WwmaSlTdVe XFRJls1WptB3tOwxDorEIUHY9UizTVDPe15GODS5QryRTbM4b2xTEzebbuKH0k1j5Kcu2dTW 9oLl/n5xFhLPelix9SWYGZj5cM4VQ4dC0K4+H18v6H4fRzjrJHLdj7bB73cfxygpDB4tr9rJ KNGfdtLEjWgn3CeSD9ROfPxLp4PYDcE0/lP78O9ERsfG/7x1371VEbpFyE6l5mXWl5r62f8U dEaSux4AtnnjK1GPH3UI59Qaz5P0MG9geWdskehh3uRxv4Lz5w2iQ/LBWapdzzJ9ZX9DAvAI 593x+5HRt6v2FZ24CvdJ7oNmB6FxbSFjpdbD9dfHST9x4949l6I0trWrhxUnBBWpTZzYjEUw xZLtNvEUFlWKsRcRQ04LX7DIT28Yjau2I8zDBlA5rMjQiucRv3zlSQr8CtOjOZAEfhkl+sMv Tdxh+PXg1IER/PrEzUy2lqvvQ2WJODZyy1IBKI9mRRDlgJcoV6sK9bR4d9timL4hE53dJv3f wc/Hn/lFQhnCkK21sO5+t6UCUp51qR5ntK88Rz6j8wgN6+BzQhsFepvPmrTDpvOD4+GTdESF nK9ljHS9DlbdjENGvDUXlDpEpT3kPm/fPDjG0zBV4ZWKrrQTw0MwMQO24raPbRPDRXqc3cTN QnjsiBauUaA3A1eTNmtifJ339ZHtW+fDPGLHPJrbsB+xNxnTao+UJmBa1M9kzFGWOh5X7WT8 L+MzhhcNCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMzIgMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJl bnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9GNSAxNiAw IFIvRjQgMTQgMCBSL0YzIDEyIDAgUi9GMTcgMTE1IDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2 IDAgUi9HUzkgOSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdl SV0gPj4vTWVkaWFCb3hbIDAgMCA1OTUuMzIgODQyLjA0XSAvQ29udGVudHMgMTMzIDAgUi9H cm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9T L1N0cnVjdFBhcmVudHMgNTU+Pg0KZW5kb2JqDQoxMzMgMCBvYmoNCjw8L0ZpbHRlci9GbGF0 ZURlY29kZS9MZW5ndGggNTI5Mz4+DQpzdHJlYW0NCnic1V1fc9s2En/PTL4DH6WbmCYBEiQz nc64aZLrzaXN1b7rQ9IHRqJtXmTLkei4vk9/2AUJgiQg09ZSTfOgSDLFXQC7i/3zw/L4ZFOV 5/mi8r777vikqvLFZbH0PhyfrW9+Pz67vymO3+cX5XVelevr49PbTxV89fciXxab77/3fvjx lffl+bPAD+BfmiahF3hxFvuceWnE/CDyNsXzZ7/9zbt+/uyHs+fPjt+EXuadnT9/BlcGXuiJ 0E/kZUmW+SL1zq7kNW9PhXexlbf1LvBTVn96+/zZh5k3/907+8fzZ6/l3f71/Jn3+t0r79gx iB/WVbW+co/jzXpdPXUcrDcOliZ+nHhh6qcRDgO5r5l+fXb6U5fvPanxIPFF6KD2mCl61Drz VPhxJtdKEo+8MGZ+mHphAHy3DI+9zi4O+qeZHwv7PB7xmXcGr6deOD+KZ8E8m3H8NoaPDD/2 J3sPlqI49pPIxdIRLal0B6kQB/mfYJ7O/ACG6jNS4hnzGXMRj5H4Rzm9iZxx+Z7BS0DJQMyY nzoZIJ3omMVOUp5UTC6/XHyYBcnHOSlZLtc3dY2wp7eKGpOrkvCGWuZnwqZxI66yc6R/uHsi 2FCjnkySB8wXThW3TkIsgEZNKvYDmPfhJIy4yrEs9Q9HMoQG1Ts+vcmvwZq+e/XTj15w/M/8 +sKbFddHb3+YP21LidUsmpyFIvKF8BLYJQeG/jt5X/79PttKZKOYoRWwUuxPxiPJcQu5lPUH KBdOJEhTvUPC73wweNLss5kPL2jq8R1T77IZbgYvvXfzo2hWLuF1Cd+sik/zeLaGt3/AS7H1 ruD//H5+lMgBZbOv+PUGXstzuOU9vPXgXXUJ98krD4zdds7l+sKv5OcwULfPq9yD/y/xw9ar NvgLvAx+UFbFUt9OfV1/zmbX8AY5q7xP80jRvVE32kqm4ZeJ+mWRAweLS/XF0xaBdMFiqVm7 FuzKsgxHQo5WqGXwqSWJscTPeIcxAsF1qHs4rbrLbULuTodUdyvF6dTdIPdUdWcTqPvdJcho Uc3DUCm0uqzR3ahWVjQKxp+UrM9Drlio+YCbfNIa/oe+urEUV3Oh/rRsWSmlyteXmdYG7YC0 NORKE3Pux9Sr79AZNq3OSPXnB1UZG8HpNKal9lSF4ZPtjwXshvj5HHapW7ztylu00g4X4G53 gfcinyWeBX4WPjhLyEy5lYpcrYHxjQyl7pvdGKcAB3A4/YukLLmEl1r/+DT6VzvPYQyRzSH0 T7qKjLko0itgAualRy7wk0DIV+Bjc9H/5ldDI09eSTF66Z2ARC0WIFzFdn6UoXShmL1qdhVU D/Aemfq8IrckQsatKfW8OYQtIhC2MBkOImNqNYLIZ8NYbb3XnFlkLUt3kaM39jJeBXNgkPMF /g2lrH4/kC+08zvCnyPRte/bSxDEXJpodGzAON8ajo0yeuUirwpP+y8bZRizoQt0V6Kp9OCb xRp+e60tabmRv0D3yIh/tMVVoQ7eRJIrb9rIqfJgCELtLEozyuoeboH3QW6RahshIT2T1WZo jdpt0bP6M0MntboCEifRA6trTKRpEzzYtwROXif6rMedGlsXTitu3eWi2NKHW6G0JnzcYL6J WU/DNmB1MfrzL2cgg69hEl9Ckjk2XAac2vad8iD0fKuPN224gPowiIIhSACNTPpRQY5SWpXX chEv9Le3KiMgjC3Ctfa1euJvy69I93qeGPfC65SeS4cm0r83FSc19VQNeKk9vFoPyX2gKIJ9 adQCgQ2ITNcTUjOpDqmutamDhIocQlHA4K7n4tuQQent6bDXqfmY4ylQHD6jwV42jjhGkwPn 25OrbMu2mE79BOqf+lHcGdF0zkQ8rTMh4tTifU/lS9ipTeVKGNRGexI7Mit9T6ITKba+hBjj SjQmSV6aPN6VeKTvUEqDN8EuCLZLyj/tmjq0QEyUP2EpCkokDhXAhZxDAsVOcQJNkHScA7QL v+lQk7MDZdasw449o1MudbGgnzwf5mjyWxR9Wgc+BaVr8pvdLUe5F/BalTn4PtxQ6wJSpUtd zECCmB5V2tjop2ITvgffnjqzyQI/o5Yxh2Ym02omjy3B56SaaaU4nWbaybk1k02rmQY7U2km ef4z4H4UPsz6tBZhowLtGxVQCPWjZa+O0m7Ly05wo8yJI/AnNw6pn1CLucM4pNMaB8YPhgyo jYOV4nTGwU7ObRz4tMbBYOevs203qb6HivKOiL/2nsmdZxkRRc4VJlbDbOIYMmQ22MFkQaSd 3GRRpEFudBhZK+KJzto6pa9NhNURnhFRfsZ9pL7qDnE4HVBOWW3nnRTaomiwOrrG0qSHkFyT EmrE/a5U91P1/hXuPuRxIk8Dn8fUy+YCp1CA0WyVsEDGulL2gsCW8+nmTskFMcA8s4P2mV7l Nj97o61n8RUzasq86r8rv0TVBiBfKpp8KfnGkaJrZuecfKKYpJNxFzlHVtqJVTGitjbd/Ulp SqnmtZdlxl9UHiYxpcrlZuGTfAfhIvDD7GBzy4UUQudS1uAhFLMX2ugpt7atUNV5/hcqhB5h vFqJvivnR3KdeuaK2jWWkUSWusZID0AKhB+PXECrrZsIiadQDbE02yw5JKrBTnEyVEOH3HhU w1uFanirc7gtjk2DGqTX+D+pDNTWNEYEPfE0uYSLArK2w2mMhRxMfDCn0UFuKqfRJPeA0/i2 j2L4tdg2uJhbvY8r46isJZxg0hUybSs1LgAspYk461c1352+927gE5Q8W+BXuSp0QVc5jXXg pD4oPwIt93Ye1j7pVZv/kFwho+Un+KRKreW6rUB2q8Zm5qQ7Hoy9gDP6ekUiIOVBLAku9ZkI cVanPuI48dmBIJ8q9WGnOFnqwyS3A/TZUx5TjTD2uu5WjVXhTEkYeCJ1RZ3aDeWxH/KHh6B8 SekkdRR1+xkdxhbcY6gNKscfurjQ1hq05pYXcDEOu0ZVL0D1U+mWblQaZi11y2pXltritJhW g3bXfXZkefBKFXh8mUfG3RAm8uLPBSLUkhXF4Mi6l2WMAeRj7V9qRNvrJkUFsf4wd/wFCKgZ 21YIdnIAjQ8OeOBp5Ee8M3MTWs6J4ZMxj3w+HMVkjoed3GSOh0FutOPB+haz7yc0IKndjoJ5 pKvrYCgo3tLQFq1H0mAldnuFp76uFLJMzFbleblQ7k9pAsJ6seVa61P9p3SAiwTMUF2tWWvI fscYZj2fZILIDw/OEsuGS6EoIEQ7XBHG/CQ7qCtipTidK2KQG+WKDGAUvyHmWFUuTPm3GXJq X0TG1tIYPjiG7g7env9YdmIMi0lQGqdqMCso8YgabpxfYOHEq5SNUBlr207XsQUu5+VbcBzC UMfd9gIzjh49s9HWKukjwnS0ZDFRqemuFX/ALPb8wLK6baf5RT/c0mUtk1zH3+udA0KAyqXk SElti5ZdrZCvu7IXZlZ3htuifqzL2xcdUbJ4WWKW35hjkm+fnEynXPgoy9pg3rbwRVn1T0wO 3TtccYXVKwsE61ZeCbBdvWeeq/1T6M0oNZx70xM30qU36qfVpQYOdFxwU8/0nS0Mpr2Lyznv ZxDGJ86dUYpa/G9gQdN0d2SmzNmVttGFPtJ+S18iCSBYfJAlXLm8KlY9wOmVht6DzSl0IGfa kHm4M59UVyrwgxx5bYHVaHWQU4v24KigAcSuqaEFWlX0+Zsg9LO4M1MTOk0UiNMdEpgIP31w EFbGKAB3oS1pIa+EQ5mxzSV9s9diWsmlKPZ2cuVFLamA8YjJaSeBnyR22p7UxjDEvi9+SE84 A2fMRTiIOEfKe5aQbZTTGBA8jul+B6cyT6Xiv5/vmw6z0OZB5ovYLVlHoVrp/Kq4qx2M+pvP 5KwIDjVTBytjtI8C0WZbH2jcI+coCkdENlbGKDA+kRyfpRIYBQJ0tc+V2DNj0qMlJC3mJLaf VA6IhSH3uYuWjHKIqcXMTY16ZHECMBsHsbPi6mYFwVmFnoL3Ky1xBg1oEhdx6WKiCwLnWQpp aa4UGqnaDxoxYIJHmR+H1NP9pb5NLA2pFzHhB+CKRH7mhX4k1JXnf9vVJotRQJOg6Zq9Xs8T xNqQa+mAnDSeceSgB7tYwENGsYHaaEuaqXuse6vSgJ6yEw5y/96iT35R0JONpQiPHKVV1CiQ IZKxCL63iJq0Z9kQgSB8mI9Qve47JwPSaaKW3k5776Uf0KuX3k7ul691Rg87xEiDVsh3d/Q8 JKHcFEeO2SoIFCgOWwJbyQEPoRMr9f5pg+xA+w4nQXqEkPTTAyc5RFwWRrJPgdaj2a+Q8Wzz KAqJri40EJgtPq7KP7d/a5ODumxiP2kCSdg3qtOeuvVdE5VvVMWC/HxNBt0ODjX3cvfwg8RF bqnzlaoWhZlFo1jegjY1GGsFBw3ErD0w0PaHivQ7NhfGwuQbyHmSJzCYHNLhJjJikR/GLnIq fawysLdNdqsqlV1bkZ86ihI8LHywsSfoBTvIrUooUGBzStFFqlLX+ZSZZPI2w6iuL5vUxFPu J6mTOjkeWe7PEL85yJFPLaRNIyc5YSi2fNdqdvsHbvwhM76PWihO97Re/XvRNJkjb1GF7SQc AyLPpoYJHsc41HKFUv8TJ7n2DEO7xeGJisfssnH3mAP5tsTReLu0qa5mtWn21bJ3aABS5Lbm TXVnE3LMTryDX/rpSVPcbOzkHoKSqF1dIaxWUFZat9WjTTNlrRL3byeMu01jwYMUHnAwSFNf 6RLcqrhqq5YGCkXXO/MuVg+GsMViYF0YbOrdWC8W5hmtjTotUXTvZ9QD9RU7kL5OBI+aZDcP hlOkzWEORSjTozLdU/x20QXWYP8ys8p9bum2BNxOs3yQXQ2GkN8bzV9namwjbhfOLJBR20jG IdpzcFvDp+wlZuwjo+pvCJuqFBKjPZpQrBB/YcNDXTdnbHaIC30PpVRASOsY65jIlgJg7ZaY xKrwg30q1+cp67Zk63k9t/cdVbdsZvOQzR4TNrbxYbuAV/OmFGzgiVRrkqsG5tsGkaiZCofT K+IqyQFp/6L3rw4b7YHotgeceRL1Qv1M1F2J6mZEhTrLnY+yC7gN5ttiBQPgE/TJrVdWWCWu 053+iHUq/g23uIOrwazyjYa04Ne4qnVLJg/RA9rEdY1jKHbOguLDMLCla+17FqqvwbajHWX3 AKgBAIIh9DqsAXG5E8B/51qgDSRPH1iEcuYr20kdzckwLuWupRtjLCgwxW6RiqSxGJ5sPlmt VB+xnPwkmAx+mJuwNkVHYqQtaoFDj7BFAwRX4+Zq1IyyDZ+kWbhvUG3jvBNfb8E/SUE+7+5V xmj65heGYThfD497KiPDpaQOz3Q+YnJzAyxq4qq1punJ7ShtrhfyQeemhefVNtz8hXgE1Bue 3qEYHWkE+21CBgCy02JxO4+GxvH9Zo1o0A7kdFso97fYeh/wjc/hD4Ecw+/wS3rwNkOkvWON x1gjCkC2W/agOa3FcyGeBTgOnrqoXZJTS7D9gp2akqrTYlUsBtFTLTLm2XJylHgEh8btrL2g p5ZIMnZi9EmbOAARt1NTYcV56xUU+rlATUp1AqgkTw42+Iz5aeagNnXulkEeJTzUUBljUOGx U2szo+0Ry+Gz9/blQF4Zu5aWXIlYFEOW6lCzG+HzKu3UVIPz9pFZ583+u9Gnn8gtFgM9ci03 /fDVs/Ls1J6U6DXdJepIIwyh+HigqYlCDk9TtFOrewKuJylMQUSVuGSy3jM7HuCutdiZHJjG vw5if1jWM31m0xUtFyohr2L2Jnv69GfJ7UjgMYjHHNxNm+kM5cyAG2Kl3ZYdcHIWsGL51swX GwdNLtszKzqXGHdSib7yyMmPqkUAy7aPwMi81Xy/33QOI4wR1ImMBk+EzzMH4/SVliSFxz3Z qe2KydsknzKz2GxxCZreKYEbWZ0JGnAkLvWYAAKQQbsPO7WDV5DCjMODHmzrtbMCQ95KLoEW Qg5u6KMVeAati9oER+DxGcoOcvnWU911zZBlqZ9t0kq/FTM08IKpjR8cLo1dvNP723LjDxM7 OXz0sQLwThBphOB5j5MIa+5konNZtZYm3A+GXZHf9Hu8EzyQ1p3bhR50TlbqJJ2rcdPIam63 /cjozInr6K6xyRgneFel8fRf8/hq/Su37588JlP6cYb7mgFn08/06kHajp7+JJyH5EaEtkS8 G2dmMTNbT6j2q1PE1yFP8Entdj6Hj5ffO0sVAB0HudaWIhLz47w9TLpuCpoLRGAq/7PA9PRj o5KJnD2WBn4au4Y2QZ2cQ87LQY7ePqcxJL0c5F7rEkNj+1o78YRoEZ/FFxlWpOkzoJ4AbnSD MNBSqv46IDqNWqv85+PLOF51r01a8aKR6REZUzQOmYp28k9Y4KAfHAuwJ4hjdCZ0ktzr4HDK 0UF4zO5PcfjZvdwss2RDdm/+baVtzy2ZHG+ZocG3DknpUPfpqwNkCeih1lWjXcAJ9q6wIhR2 OQZGSwW10xdV630T++ZHgO6lDicFHsWxT+hLemr4FFQ7tTGKQnJO2dJEre6dGwaZJaom76GW Bjuo0XvebAe1E3RCRugM7gDYvGUydbE8tbIGz24UHEA8hHoYlV1XHdga17/ZjkVnN77uPNTW 1RvkT2z5Ui9qluABsv6qPtDRiNwLj8AoO3gBn4Y/1r8FEIea63stK/TVSHhYUOzim97F5hkk CRzk6ocz0p8xhPwzc5Ilj5EAzSack2pDlnbgXC2Qh3wiOGPQ6MzBWc/TAQFckUscjzi03DrU WvBIhsfh09bCPDfYC0voT/Rx6FtyqFmBLgfCKQe/3GAPs7bHLXqLK/q2T1ItZbTg4IK47ROb 6lFJtd+UCjzifSC/yU5tKr/JTo3SbyJH+ESAgzjQLIWZgMSRnVrz5KfegTHDEUxMP7BzXLzb 1087gmIU/JXEESTX+BiejWafqb+Mxyk1Ph4mOf4Uh9POyjfvb9rZnsrdtFN76b1H1Egnt0PO QYLH1O0c0Duekk6WOKj9jK5NRZ9Xztw06UeYcTDsdmonN0aX3kWTZIVDpwfz47jIoJ/+gWaD J9j72U4NNf6/Kj1ZF6roPbgwgI6ddgb2deD+D3dsxH8NCmVuZHN0cmVhbQ0KZW5kb2JqDQox MzQgMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8 L0YxIDcgMCBSL0YyIDEwIDAgUi9GMyAxMiAwIFIvRjEyIDUyIDAgUi9GNCAxNCAwIFIvRjEx IDQ2IDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2IDAgUi9HUzkgOSAwIFI+Pi9YT2JqZWN0PDwv SW1hZ2UxMzYgMTM2IDAgUi9JbWFnZTEzOCAxMzggMCBSL0ltYWdlMTQwIDE0MCAwIFIvSW1h Z2UxNDIgMTQyIDAgUi9JbWFnZTE0NCAxNDQgMCBSL0ltYWdlMTQ2IDE0NiAwIFI+Pi9Qcm9j U2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA1 OTUuMzIgODQyLjA0XSAvQ29udGVudHMgMTM1IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9U cmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgNT4+DQpl bmRvYmoNCjEzNSAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA1NTkxPj4N CnN0cmVhbQ0KeJzlPcty20iSd0X4HxB9IicsCPUE0DsxEX60e3tjPaNtKXYP7T7QFC1xhhLV FGS3/n4zs6rwrKIgsSAfxgeZAIHKrKx8V1by5M2uWn9ZLKvkr389eVNVi+XV6iL57eR8e/v7 yfnD7erkdHG5vllU6+3Nydn95wpv/edqcbHa/e1vydv375I/Xh1laYb/iiJnSZaoUqWCJ4Xk aSaT3erV0f/9Jbl5dfT2/NXRyQeWlMn5l1dH+GSWsESzNIfH8rJMdZGcX8MzP5/p5PIOhk0u 6aq0Vz+/Ovptlsx/T87/69XRTzDa/7w6Sn76+C45CUzi7baqttfheXzYbqvnzoP35sGLPFV5 woq0kDQNwt4i/dP52S9dvA+EJrI81SwA7SkketI6i0KnqoS1AuAyYYqnrEhYhng3CI99zs8O 9atlqrSfjsdilpzj37OEzY/VLJuXM0F3FV5yuuwT+wCUpFJpLkMoHccFVewBxWiS/5vNi1ma 4VRTPs9niu5+muHnDD9z/JPFREtxnhb8RSiguAqCSkBiBNxc/jbL8k/zqGAFEL4IzbAnUAYa L3maCwetTEvtE4URT/kxql/cTwguB2R4NkiR8VQHZc9LBKURhgWl0gzpPiTCiKcCy2JfHIkQ abrk5Ox2cYNq7uO7X94n2cl/L24uk9nq5vjnt/Pn6XphqOjBDK3XUAG/uZkf69kNiujqz/lx Dqge89nbuTQftvjFFxJbvKyu5sdytpqzzFzf4tc7/Hp1t6JBquQC3qXXlvc43jXIOn6Vw1e3 +B89vp3r2Vd8aH1BI94lCxyPhqCRfzrIBnmowGWZZipEhj+JADiva8SH5rVZ7PAzofPOTeoG EP9iZuCmTm8saIrLFSg8esHQdbF5wP/u5mK2vnM07b1up+tmXwEWzHxjqVuYd1cJwjnHB+lb AxGHpueaAavkbLXED/f1rXX1UIP6NIMRCR6NdfZpnsSmteU4laWcD0j9GyGUMsReIIa/N+w1 Z2J2hfcWVYJ3lwv823DF53qZ6JImiBRYXdSsu7CsRBeXsFr3LTbbrA2nEym/XeHaGN6kp5c7 +pJgVvBkAe87yAt6pcUGJBeFI3vR4wI3oyeyAUDJDdD1V0K4Qe4j+Apnp+7lRvAaCV1vVvRd zRKGC9Zf8OZ6if5SLeupIVHsdWclrnhg4X2+Xk8Dskk1IC/RXvfRIim4smwRmSC5BFMdhPzx 7DQ6RDBcnO+f6+oa2cCquMrIwq+oYP5AZjPisrMPKqe7a7Zd7BoJuqkVT/WabixQNOnuRSM5 7oW8/XyyJsmoYHj7cEuGq61RvKUV+Ne1HgYbJa2GiE05Ab6zFiHK1aqmQskEjfMfRkFtEenN ZrWk+4CrEfXXtQqyJjP6QkvF0iC2U3CWzAU5/E/hrGnsCoSSYoBAiINrFW9ZODJKjEmiihcn sgnran1JckCiphqGgL/0APpCxFnJ+hof6JvzhZGUpCJ7ZbwtY6MaoaQZXsBAA+vQ+Fm5BdpG 4EvtJ5BsLtFGWBOx2JDX0HUErXdTfdvW8v0vYvuHuRFYuk9S+08rE0D/u9ckLGCaL8z10ngl nwmRRu5RJ0ywRpZtMo1xU3+N0KRvFvfOPhuyqNpG8ugKukjLLIhNGp0/M5ZKHgIXXxwykZbB 2Y3wAPiUHoCGqJsPozN/DPQ+MT64bvlZ3ZBlHQwGnBjFpm5eIlkD04i/mAUHpRaA5mx07Txt bucqPg6cAQ5BJNDOtYPKvit8UccL1jhvjYECHbRzBr0x1Y+NhurZutabFalqa1m285xiABwu vt3lYOjLEAWc5nfaGOdwd0sMGvb+J9KwOpe+2PrbzpjBFZH1LjbsQqaiCAKPPlVYBtTfAXAt qbhohWAX0/iAjKu0DKFyVbsR30iTUXDdmO0mdnZOgfMPzlbkzrbZBZ4/3cGNwsa2+F70heTI RezFFpKrMmUiBO7TDOdp1vALaf2bvrOC9Gzo4/UjdO1HsOk8CgxcmApOZJh8PhheQQrphdZJ 6Cwtg2zR13/kSO9qBl9WmE1rEmGW2es8k7nu+suDZMq+bJqB303wxFauIOWqCBHgdXxwRfpy UmgthxapGEKjOOKhXlsjjZ3gAaQyb2XpqvjhncadmQB+Vw1ftQOy2DjAkyqIg4nmMF8aGyzI HQtBNUmd+LzOgO1UCGiT+LWMERt4CbFSEHp8ApcQK+UhcBhb2FSZSWKsXFoa/rvs6DtPspcs PmWBgGRPzvp1cyaHxaSMe1Q6BMHi5QgtsywtgoRu5X8Nf5WPBgJjMuxTaUrFfOm3ro9tdjPa eyexkxhlqrIgMovN3XaS/QXGyDT5ofYc2m5QL9sxPWWpTaxGe0TwSGuTaLCHs3UpgPa2TfuW cQ1bu0GtPMDXxsvACNH4kib4XPUBNWnvOqI+1t2vaIPrDgJtzCnKnnsuCAfHpI8Ld1I91Dph Fd9tyQoMTvyLNZV0yMyThg378rKbd3R7oovPlNUHOhYtF57XxCav46lev57AFeeZJovlnXb0 XCKHFS1C0Ebk9sSkuT1W+lKObzab+Lt6zKQA/BCfaTyi60oFDnwIR2OpbNK/1oT4weytIdHQ hNDulilLWKwbZeO+71eH9MKqJjW6wcSbmH2DmNmWOZDW/TF6rMhkylho1iNYVE7Dooxlqdbw XjnM4WGFlCmQYodJrPQbTM79cKfwaCF0DE0TRDFxqaOVqe7osY/NMHWEZeyuXuktp2jvdO3z 2awgNJngi8ZKU5rna2+D+t5u2RnD0Yo/WwBHp9FEG+aXGuZND+ZEm2NuzYo8hQEe3x2LrqZw 4zQA/UXSZywvUhkkQMMT4BfKVqLJhP2k6DfIRrhSRSczqJ/GhB02qbdK2/4Kuq0NAvuckOgB FKnV77lKksuU534UqMaUNGg6rKY+FK4A/zXIoNFdLClgmkFwIwyYmtaA5ToVPvLbCt/JDJgP 7oQGzA/OGLB+DeBBtaBN9q6OULrFEXcJVX209nFMqnF51VQGnp3GT/FnyH8BOgyr6A8GJ9Ms D4H7aBMZ2hBoUW3rOpiHrtk+3bkKFOdExJfPDPdaXoowUohUBdfhY5PhsZTBzY6GGZvMebsu T3u9rfi7CLCkQcGNTignuBqCnnIA7h+USCEjK1xxE8nSU13OmowVJVbXk+T77cZkYC6oP8Bf mB/DUt9RygdxB+8jNhYlT2UZwqLlFvk8lY7X+lJeiigyMtV+jH1eSnxvIcvSMki0+N5CJnAn NgBuhLegp8zIKEkum7/aalTBTdBdjr/XRVVyAYzX21autbQ2/qE5cVCnu/elTGrV8eDG8Z+t wTrpOsdc502mzJmAh4smzT/3EUyUT+tycpHmKuhyislcTh/cCV3O0DRh4IJm+iY+aAGxdxGa 6RP93OiboyqVLITbYR51fFMJA5QhXM0xo+ib1XisWuQvxqYiK9MiOMdBTOK2o6ZxLoXKsSQo gEz88ASsAw+S+u8UjkQ3SQI85zDQ+HPMSzz9EpK326Z4AOxvvT1mjiG202IThxUyzzC1/FJU wTMvOmgLKFL4p/FNKP/nD60mMxmMY67o6QdhknV8HcggXMhUCKcNsgzA32y6JzXv7q3eiB5C Gevhx+aR4GWQZm0fAp42gpHEZwG0BxFMac7PRg8rhNYpK0NojPAIi2k9wizz54CNRygn8wh9 cCf0CP3gPpDImJNhJmLYdYrB9har1kGI13UCabhpSs36hzI9hS+tkKVdQtsK4zyihjiYr8NV GNPvaDCFewYBGg8kbaIsoh/6sE3GweAUyfML8a8UORlNP7hw1NuwUNNMotbFnY4STkubh6Iv jxKa4qJR9PLpv3JS/SeLct8mjJpK/3nhTqf/AuDeeAI7Ou/UTu821Sk7twkzKP9a4wtl//kn VbPYrIzuHoStT7E3nTyu3eavU4XVVe9hw/dYmTsoBxylaOMfL6di2cAi/Jj8UNdy1G1I1lTt yC257I7Egh58PU05qGWUPPelP38wzuW6WlC1uA1X/lVnNMyWmnVIKbW2+gHRfA1MYZaJLGm/ UiN6WxoK4wNzuG3qUMxZcrTVROsmJVmz1d4KmCDjxPcesQeZCs1oTBOQifogOfWp9TDR2ahP PZn69MGdUH36wZnMWf9MDSXhV93mHbY8eb26S7YmR1+0/bSrVokUBr+e1gPHtpcBDWw8Vhit w67Nk9eu9rk3gtGCSxzCKN/aXW3aFlzUB3pvG/1+Yz/mgfqs/uZD7+CXyyOiDo/vIpXkIgXW yHZMiV+QXaZFkDEm40OsQx3mTqy9W33FTMnC1aNvm4L3XtWUC2v0mCN4aLknOJ4qseVcYD7x i61VnnIWAjdGjU7aTMkWKj0HrxgtHmTCJN73IAZcXg7ZG9Q68Aujv4cVp/lAFzlIVhD2YaLl g8cYeGchcGcV5WUv3XE5mPaPB7dm8GKhS6ycDKEB0o0YLOd44BZldntDrlVsNDhE0wULoXG6 25LqWAFs4z0dH+rGeZEoVMrLkRzgFYsYpyMAM+6RCew2qr0lEWKW2hRHYZqxwuWBpOkiUArq zhDA4OB14D2Tk+NJ2QCwU+s0gNdxuzV2BdjzMDM7RCHn6OyNm6+XDyY6gmA5QSuUle/QAy8A mc6oTtMDb99cD+uB13NR212B6iPKpmFktWpaek3SEo0Dv6k8NFfrYxc9F9tsSa+XV8bdih0A cpZKsW/B99X8hFr21NEGSK2O0bSnboeycwH+RIcSsbqVD3XBMzv3wL2JG+owiNxVCOsJmkxl WCjqBYdROctN+ctyEb+dljmA/2IzLTVWVAbAUZCzsZvJyenOdAbsc/P+zV3Z0lGdOph2004S BXOjWi/vjWZqOh23s45NBnTdPHBfC6EZz5wzJ/Sjh8lSY5j8UgskZZmycfIaG7KmNiMByGYp 231GErRK2yZVE11xQXwRFIxNfGga44gAuPjbO6xIyyCx4xsB7N82FpzXI5zoTI+1TkJgYdf3 8Aj9kG/dto3Z8mv2oltdnIyXFb27RI61RQG0nF6MniUzIUsA6K5JcN3Z/g69IkzjO3Sagw88 3OhOJ1AKLZkfadfoduzZ3Tql3DI9zz+YMcmRDAEvqOCEW8Wn8Sv8gdJ5CHBrd/J7Ne3DDcIg fv0D1cEjItN1/RWc4/6a36T2u781dQfkhrUrUKaQ+4KH0Jug1DvD7dwAuHb76OjNy4xS9QOu O06YzdibSeJRlivsSRxAodfG8YNp1t3vGKiBNrYgKLYuBUYQIoRd/G0FbN+uXozvuOApHwvO 6/xMekRJZAyp0ceLfh3F/CRMO0+0i56oUqkOYxE/L1ZAkBEER8WBt022ymUe6i4x0TWDxjNX LzV5JgvSAn5w+2p/oqsjSfGAH5Hv1nxXSmy++1KrgWUvTARZcTcN6blm6KYEoPoOC1kvJfph Go6p0QAerTrYdhM7FM8/a454S40Zj9tdyXonMcLvvuu8G7+6FQLeXI1kJavzTxuFn1sdDw6L yuGvzooED/aqZAej4E5rgWnvPM3z5Lq5UQhMOuOh5RwuCswpor4TzF0tAUMNn+obG7iB5zvq 57ETDPgqdih3ZSDh2/aG0Hhj07rBsDuKG4vrVMFYFpS5grcdMuYGvG1RNdduFmao+kpb0Fev jr78BSn8DVeHKwUUkYAjUIfx5Fcg7L8vYc6IZ48t04qCqcR81iwDpgmxL8yFF8Sx6KEWCfZ+ lTCyQL9gCfQ7+eV6cbliQifvt0nIO4lx0gHmBTJU9PbWQXoyIKEWaWnKLBgKEbObKOCOnoEZ 6O+deXGMUY3sx5FLzF0EcDzHoqxrNFu3c4yljF09Hlbz+5DmMWoADdI965uJFItrONrgPsq/ rv64X+9GYBejtMaLHbjLZRFCD6nJGACtPPs+XjxjlNp48dR7qPiYhufCIiI41dnznJIrMIq7 gY0cEgEhq6a6CtweErSZaK9A8CXIa+6uN3it8UiovaFAesC9MAO5CwMG3nU3RI4GatO6wamC yA7FC/RPLSBzAS87TMyNDd4gPM21m4EZqb4iQI0eP/q3nPkzFTUaDC6Npub4G9ICQliNqpqe b6vqYo+q5jHqKnyyIAA/Zur1lBwIAxWd7KiAtpvMJFXzdImOsRfgm4VUVMsVmMWjIq0tJqyg hkVcw/JrZGyOraJzd2PT3ACe5OQsCJYTqwBk2XlCwDKr9g2I4BTdcFDqG06uvh/45zI3tkky bgiAI/KVmhRr3mFtme1j7VAHDhwOBMYOh7A4gRmV4s/QxcJXCz3gh+dFqV7cQx7UIbgXDPsx BHB/lJfLllS5FYMxuku4qW/QMgO2IFUbJ4ciU6zofWOQzlJFTjziArzH0pKTBjUw3A0GbJAI RpURHIJFqajfg9buCr1ubKKfuxvIlqC90bM2N1gpU6w5oIZE9iLXVhv3vuR4PNC9V5TYRamB A5YENEIDJscsknI3qEuBshi7CzOfJUmFj8Qia0j8dJEB7HCdBZGKARoQAjHJ8L+2xPA9EiNC Dlx3OORB+M9AGpPayUrMsqN3NEx2vsftDx3e/nj8MOTgl7W75yDtT6qOacQ90a/sufmbn7P3 NZRpb6ncJRo/+/qFepGeqH04w14BPIT08QjEpmoarQrsYh1ArDmjrEIZIPtIGe7L6p3OROUG aFGKMjSdMVw70VYA6i4eRMzK4C39Z6qz7C8Abx5G4DxRcyzMZIJ38iRitvRv0UfEGKznGTuj rh81diqjLnW43wURB8KwN4D8GZ5O4sgeHAISZZofKOGuMOrBknvmbmDYw4gC9gbW3eeSLBpj 9RVu/BX0du/rnFwL9yrIf9ECJbA+SLdACabT+hpbzOsaa3dlJrXH4pUHWDw0tdzYvBzDQ0AH 9BWEP7pj8OQegydD+ZT2YAYOwBhn7QQXmKhjWtLZSe85bVe3+6igyJBFPgRBqbHJQwDBEZpd huzkQUiV2LMxgFS3+GnQDJG2pT+7U7+eNvqPTylkRQ+YkoRXSxWa0rDC34tXyIgegheEcGjZ /Xidg2Hc/4PlXjwnso5OmEChq+FvVI0rpWo1W7mkI5HGITS/Lf6tLujz1/17JzuRxZXgXpfS P9kE1CN44VTzvRiD40QWVsra+/IsyIjmiLVj7n7h6fGphGLhCEoaKJ4Nf4ZpTx/FET+Auq9f T/MzSGWn4S58+jSv99kbcLbJS71h+TixQtsahyiMkuG+VYBYj3lV6pCoVurS2nj8CRudYMtB OuZZFB0jv283SoVsaHswA8gAGSQGPbW6oNrBs8AeBmroaH54fJ1UyIYegBSE5ZkOIrW+tNVb yIja7HWDLLIfk3PbuAB7lJgSg82ifToV7Sp8zbClTGIKAKpv1BphNaeGAqBeP2KK6wwuT0kQ zlEL04kwPjPdW7BfAGZ36YzODhX3/LicXa/ohxtNnjdZuOEurMoG/LB8F3He1s0R1ht8cwWj wVd/2LI0TtofULqmrLEek2RTIaN/wBooJkk/+tfAJyv/D5A/rQENCmVuZHN0cmVhbQ0KZW5k b2JqDQoxMzYgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDIz MS9IZWlnaHQgMTMxL0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9J bnRlcnBvbGF0ZSBmYWxzZS9TTWFzayAxMzcgMCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5n dGggMTEwPj4NCnN0cmVhbQ0KeJztwQENAAAAwqD3T20PBxQAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAABwbmKuAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMzcgMCBvYmoNCjw8 L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDIzMS9IZWlnaHQgMTMxL0NvbG9y U3BhY2UvRGV2aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50 ZXJwb2xhdGUgZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA1Mj4+DQpzdHJlYW0N Cnic7cExAQAAAMKg9U9tCU+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4GXY1AAEN CmVuZHN0cmVhbQ0KZW5kb2JqDQoxMzggMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBl L0ltYWdlL1dpZHRoIDQ2Ny9IZWlnaHQgMTE5L0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQ ZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFzayAxMzkgMCBSL0ZpbHRlci9G bGF0ZURlY29kZS9MZW5ndGggMTg0Pj4NCnN0cmVhbQ0KeJztwTEBAAAAwqD1T20Gf6AAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOA2i10A AQ0KZW5kc3RyZWFtDQplbmRvYmoNCjEzOSAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5 cGUvSW1hZ2UvV2lkdGggNDY3L0hlaWdodCAxMTkvQ29sb3JTcGFjZS9EZXZpY2VHcmF5L01h dHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0 ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDc3Pj4NCnN0cmVhbQ0KeJztwTEBAAAAwqD1T20LL6AA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICL AdkVAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNDAgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9T dWJ0eXBlL0ltYWdlL1dpZHRoIDM0NC9IZWlnaHQgMjYvQ29sb3JTcGFjZS9EZXZpY2VSR0Iv Qml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDE0MSAwIFIvRmls dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA0OD4+DQpzdHJlYW0NCnic7cEBAQAAAIIg/69uSEAB AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO8GaNAAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjE0 MSAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMzQ0L0hlaWdo dCAyNi9Db2xvclNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBv bmVudCA4L0ludGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMzI+ Pg0Kc3RyZWFtDQp4nO3BAQ0AAADCoPdPbQ43oAAAAAAAAAAA4McAIvAAAQ0KZW5kc3RyZWFt DQplbmRvYmoNCjE0MiAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lk dGggNTA4L0hlaWdodCA4OC9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50 IDgvSW50ZXJwb2xhdGUgZmFsc2UvU01hc2sgMTQzIDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUv TGVuZ3RoIDE1Mj4+DQpzdHJlYW0NCnic7cEBDQAAAMKg909tDwcUAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAA8GYL/gABDQplbmRzdHJlYW0NCmVuZG9iag0KMTQzIDAgb2JqDQo8PC9UeXBlL1hP YmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCA1MDgvSGVpZ2h0IDg4L0NvbG9yU3BhY2UvRGV2 aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUg ZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA2Nj4+DQpzdHJlYW0NCnic7cExAQAA AMKg9U9tCU+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgY rqAAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjE0NCAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1 YnR5cGUvSW1hZ2UvV2lkdGggNTYxL0hlaWdodCAxMDQvQ29sb3JTcGFjZS9EZXZpY2VSR0Iv Qml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDE0NSAwIFIvRmls dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxOTI+Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVPbQsv oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAADgZ6vWAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNDUgMCBvYmoNCjw8L1R5cGUv WE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDU2MS9IZWlnaHQgMTA0L0NvbG9yU3BhY2Uv RGV2aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xh dGUgZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA3OT4+DQpzdHJlYW0NCnic7cGB AAAAAMOg+VMf4QJVAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAADAN+PoAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNDYgMCBvYmoNCjw8 L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDEzMDMvSGVpZ2h0IDM5L0NvbG9y U3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9T TWFzayAxNDcgMCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTcwPj4NCnN0cmVhbQ0K eJztwQEBAAAAgiD/r25IQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AMCFAVOhAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNDcgMCBvYmoNCjw8L1R5cGUvWE9iamVj dC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDEzMDMvSGVpZ2h0IDM5L0NvbG9yU3BhY2UvRGV2aWNl R3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFs c2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA3MT4+DQpzdHJlYW0NCnic7cEBAQAAAIIg /69uSEABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA nBrGgQABDQplbmRzdHJlYW0NCmVuZG9iag0KMTQ4IDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFy ZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA3IDAgUi9GMiAxMCAwIFIvRjQgMTQg MCBSL0YzIDEyIDAgUi9GMTEgNDYgMCBSPj4vRXh0R1N0YXRlPDwvR1M2IDYgMCBSL0dTOSA5 IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRp YUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyAxNDkgMCBSL0dyb3VwPDwvVHlw ZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFy ZW50cyA1Nj4+DQplbmRvYmoNCjE0OSAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xl bmd0aCA2NzI4Pj4NCnN0cmVhbQ0KeJzNPdlyGzmS747wP9TbkhOjUuGqwzExEXa3u8cbLdtj aa9w9wMtUTZ3qcMibbX/fpEJFOrAUUUWSrt+kHkkkYlEIi8ksk5fPuw316vLffK3v52+3O9X l1/WV8nH04u7+z9OL37cr0/frz5vblf7zd3t6fm3T3v46B/r1dX64e9/T179/FPy9fmzLM3g X1kWJMkSUYmU0aTkNM148rB+/uw//pLcPn/26uL5s9NfSFIlF9fPnwFklpAkJ2khwYqqSvMy ubiRML+e58nnnRw2+YzvKv3u1+fPPi6S5R/Jxb8+f/ZajvbP58+S12c/JaeeSby62+/vbvzz +OXubn/sPGhvHrQsUlEkpExLjtNA6jXRry/O33TpnoiNZUWaEw+2Q1h00DqzMk9FJddKIucJ ETQlZUIyoLsheCycWxzMT6tU5G4+nrBFcgF/zxOyPBGLbFktGH4q4C3Ft31mTyCJC5EW3EfS SVxUZQAVwUn+e7YsF2kGU03pslgI/PT3BbzO4DWFP1lMsgSlaUmfhAOCCi+qRO4YJj+8/LjI it+XUdEyyfjSN8PehlLYaEXTgtXYqrTKXVthBJSbIvPDMCOosNhwNEqW0TT37j0nE0QOODQq kWbAd5sJI6A8y6J/OJIg1HTJ6fn96hbU3NlPb35OstPfVrefk8X69uTXV8ujbRZwsbs8cjIi KcB8jdPAPbpIBLokG6mLX6xKmUVTDmohRY2ZSg2CWkIqEPk2mWSaLCKqXLLER0VkXIRKq1t6 cL25hdndw0S/LfPF/gVqysgESAHIcg8BZ0tppJYndPEe/kijVS3WQMON/BzJ2q72krC1oqtc fFh/BYq/wfvNw1I00PjiFv7sd3EnwKQPwdm41XLJMY0gx8zeX1qSJXHC3l4XwM4vwKp1sjzh i7Pz98kvD/BqdbM8kQx9vFuelIsH4Nf/TGKXgzLCWcqpj7S/4krDnyukb0myxTWu5y3Qt75a cvW1ej9NGl3UVSSlxEfdTxL7dvUNeLQDqULuCaUSJE08NjWUSV4JNzVoxNCGSS0UGy+Xu9LL hb/GR8dSwXzooq8x5Xmaebj6cfG42iVS9orFerf5DKt6awTxSiobFD6UyDv4/EHpnvqzrYQj iz/hm80nEI7NdrOXQvND2QkJtrqFsa/M+/2S6KHwLY633qF2W1+iwkpWUrXhl4+bq2bTfoeX qwdEtd43CO4kkdeGqm/weSOrlyv4Bt/v0uiM1UpHxlYZDSidzW45w84t8rTiXuyar2gattIG iK4WgYVBBn0yi7pGViHD918UVKUWquEu8PoeIWAVN3cAhuKy2iYABIr1AvUW6lUElTZLrcUH yQUwWIVaJGmw5IgoZzf4ExSU/Sy8YjIgIcLHq9V3wLzabFef4MV2jXOxZD42TYX0bAsfTcDJ e6DmQW6GZhU2wHdNoNobSPt6e2f4vX6ot0BjW3yjwUiz7Ilc/kxYk9rcAFYlFSAhol50FKSH eqvWeoO31AbMALQE11pic43ifAkJCJj6rYF8RMO+2a9b40U3UwXob/ck1WSQFNQ721qt3akF iE1LScBkummJP/OSpVXhwYZrgNK1T2Bbd6Yff0uTtCJPNW9GOXi9bmxX2gnXmkLp2M+NxUNt qnTgOfDDEtn3D6hq88XlupbZaV67YwZcymxVemaQRsfGszSn41bHFSWwOaOEvODACqfB7piA 3Hi6RK1VpZXu7lKtNLo86118r5zJmNhHp5Gn2EiF1CS5DytOXGrdSpkOZWXQeqMcS8mdITKp mI+c6PuDyB8UXp7PEHeVKa186NArW+8fUR0oGzmDEeMp8U74bI6YRwYhHnStKGElDajWpJ0o wngDsQmripQTH2HvoluSjMNJjAedcq7BPrDGsY5NgVz4yit64GhFxygKtJ4BvTs+YFAZmyZY iG+7hEhLrx4cYbz4PClkSB1yaVMFBzXtsV7ScuXIlBOpmcmL5K3yx0CelKuMAZsMC65VPIch +FQX2ZXvzis4G/AQe7Y8qRbnks73k6M9Z66do6rxMopI5XpTJ1RB1iSvPqy/GimTAdUNSBjh inPJvmbuNLPjoJUzlhZeWl3CJnEWJJVqJMkziaxMiiIluQwnU97G2JNJ4ZHJMUNp4h3US/gK fg1pO9cqS4fXoU2m4SSZ2gZunBdLlXwgZHG/XamE0wlzeUvTqJBRVwmuJEQhdk4NhGnzoOlY 3+7dCYRpFFRVmlH5a5IBO1x8QPN5bztmE/lPMzjC8uD1HLJJrIRXcPKhsersx4DU5h6pHTWW fwqUEfT13CL0M7j3m3tctFpj9lk4lQApPlnlI8CWlMnoGPocLnSQVldHw3fX0fFWFNLqTzZN qfchLRPSRrFxMiIjXPFkU4TTt8wruU7lR+oEulspSaCQrphIL+cEzlvHseefVu3RK/kOf1Bk aQnKjmNhidQ8pfoDNFz/ZcT3WuWp76XKoz0Awksk1DdAzQf1PfCBVF0IQXlK8/YImcR4KEg9 EcVv/KrhdptQL0CNpAEAJF2YniMh5OSKSlsCAW5vQCcXYU8iPJbX6S6rlEhI8J/MGZXatisT C5nwUAYAOj70mLYjiSBSTImDhkGjpvHp7THEwTJs1QYGC+Rv5MJTB/kvt9vkxrezj8YGmyh3 YOuF8v61mkgAJRQS34OrFQMTh6S3QzZd3u1UZAzTETYyV5gM6TdU4cOhcmw6Ga1S5mK/HSJN xQS7snqKhWZMpIWL95CR/6LSMVvk96fmXLpzyrG+ApYHCzYm0silMGYuYdQngQ/LPP5e4yxP qQtp/OmxEmyjjcl3coKVO6Fzk4kEiQziLAdBdt5pKiaCge0gk10pp2pekwKnflWbpNfA/K/m 3GvzHYuptqBrysV++wOWQx8/R1fGGTj5Nkm4NWMjowwCGBvZLJqfCzRoFjJb80PRzV6dUf0f aH5poVjloDO+5pfRA3WtdXzNzzEN55qTX/PfN7UzO2mKdeXUPgHNn3f0U1NtMWCrzXmaTm3P sYNqjTbEVWcVsq88OpKiKaRPV7RpemNKcVrVZM250BnUijmCg7INc+4oSoI6Gsz9xt7EMpDh lWMi4w4z1CQfGhnr11SoUqk9VP+iJLaOyLRMan+7U+XTVAKpw+MVDtDIr6mhq2W0K/axQwe9 2HmWVqLNo/Zk8RxeElMoMhVPdBHNdV0g2C6tONtcmcBju/601CP9aRh0viR19VCrWGP/wwiX 3qyqgOcSuI0jbJPdWtUUrXfJR3yRMkCFd2r+wLr46PqoYnBiZrNoVMrEJBEkvkAyBL8O5EI8 PzcpIfg6lAkxv/dlOTR38Cshx8msNEcAQmNpQQCaHlA/0ZEJUPMqLwBFuLk/Sie+GxdjxvIu rFzXHGbOqt7CvrsHVdA9+vWmN45CTWiZ5rkD9XB6Q+HTUjzEN1+F/6jBBpWGRX2nuN+3DY/E KbU4cy1W0P07ElfF05L45uc+Ho9LARTBF8xBgctsmdLNBClb/VA1KsZBMpkJZ3gcl3AmN33u IrxViqmouqyNnTKjhsiRJsby5iKLgBZxijdsDvQdIsuC9BFBGi1S/JbuSEREbjHmQBSbuZDE K4UD0flqv4H6+GtTcdQv4FxFpyWXtFQOWlQwAWLZiq3t1U6Mb9J4xkpON8aJBL9GhyjRBZXl LGUu6WjQ75a60FuXa4O/rfbNJYatra3prWecRiRnGcQ3NpFuF3mwzGwiNWCsHcT476tEJkCQ zEmAfblpKh4Klb/zb+haW5Ic6sDdBxDNxTpQ+tJ9x8hcRxgrE1peO28f6fCod2HiXyD3om8p yHhC6YrLrbkj17oU079xM5OgM7iLThyMgIiINwERzjxvB0Try2/qTsLhgVD07VFBsZ09h+j7 sKSpcOD5iDzoxHWR94WMhoRrhrEtqsjyUawMho4QVUkNXwd/RVVZ4aMGMfFjB6YVvvmGaUXI jLTiyA5QK8jT4+hYskuRJloxDLE17OoB0KIJabOMHATSRF8SpAmc2zD1xL2ktAB8eFrrT4t2 hN0GqjnTIALOdHG1YDSuOhL3jBSAcmYDZ72mweXPghLsJClG8a2nTwIvWC+p5+yREPe+fZmn RenCbfesmdaFQbp0TjzzdGCw8bxDV2h/L00W3lqdp/1CgVWLNvafTPuEFbR+2GDvhM8zUEBJ BcXJNgXY8+Hh7nqzBQ9D9Xj4gP99lRRZPR7wtCDXPR4it3igAm7L2iTGbiXBCFzpHxQ55z73 FTTHUT2CgkvlyzIFLvJZx9EzXD8lXG4hB437h+aIBBC3bzCXKuVhrteOvqkd+7ZNkUMfHJv4 0IGI8qHrkDH6dRgCFtSm6NCzO18mZup1FFKg/2fRp08Hq/9Xsqn3Dyfgs7SDsh3kWKDBhA6O jCSqvgOXX2a55EayEu7y2PQMyD+cPQWXuUnB3DaM77aiUILzfZ7LmlQ6o6VwTEwVB6h05za6 MFL5g4xYaJMTGLcsSywkfxF/j2YZ3Ja0ZzvGUvguEUwVLZLBcQqnGSi0hhWmnp5M9QQdKEtI efRRznE9VZ0V2ZjOHCX0k80ZRkQ2LrtRYIQbzhV3zSpYZFxr0N8X2OPkDHa0o53g1K0FTROr 4cV1yrivKDuSjGdVSphLxulsMt5DOaOMW5h6hj++FMq41oF2BnGvILC3MXnFvbSk/f3ZHJKe w0Hj4BI7Jd1XPB9H0lmFfXIdks7mkvQ+yvkk3cb0JJJuo51L0m1MrqoKPH/S0v1uBukmOfRV GFxWp3T76ngjSXeZQ7M/h3Tz2aS7h3JG6bYwPY10W2hnk24L01tU29FbK5GCu/HFn1lRwGGh jenlfROVbS47TXn0zn37coatKzLYs4My69q6NEbj4MDWlWuSV66tK2bbuj2UM25dC9PTbF0L 7Wxb18KEiaT/tm8Naen+sMznCDHgsnIxvLBO+Y7RgNqbMGICmxG1NcCtSV+t/zTFZT8nqoNg u4IDG4NC8S+24trc1kmYpncjpj5X0dc25ylzUA7eRunoGTBZV1bQct7GF39XltQ9saZmR2Ub t/fLORoyqZIwG3+ri6WzeqfpoPxdkaebYuZDPTGdowWaVao+mu1WlZ2Ck5G9KmfJvDIJ300f 9PthRkZbcjw3tPFGn6C0ytBsxsbUksurVsnZVVO4+fgFi1T3ier5g7UwaxUI6JK1ys5Qr6+M 2mlhWN2aT3vBRT6hC247tRy9oRWr8DLK4BI51f6s/dqxL28nBdA/y+jcsdL3qy7VKvbakl/e LfXC7Veb7hHD/stSb/P12qTn1ftGA5jxW32y2mPMc/pEc5FS4WCEkuTrph4V78J8Werytcdp kta9Z2bdOgrtBX3oEfuUq8JuazYfovt+vKqgBMDGFF8jZwSbhViYnKW7Uv7msgkk66UiZj2a kt4lVKzYWI3ijW6EqhIfEmOjfAHbQ/i6ulK5mxqH4BfV/r65G4Y7rg194uhGWd8twJ9tt2t1 MnhvbrLps+v4J3FybXnlmHJ8FSVjmIw4MLlKW4u2xjZNoPWZqaW445s6CVk8CVcYF1i3OITJ aVRj1M25WrPJ+I7xhFYZdBfrW9VWc8gpvHDhFRRaFth4pz2ow4kJdroDkyoWe3tnOv49bbdL ig3WbLJmbnTJS8BnowVsMNG7pg5hC5RMVPaeTnYVc5Bg+mlid00gBjuPUew8FpkIuL1PhIOI XQJZpNX1Hu0OVM+pVp5f0BWKzgy4tVu41gMkYL1dgxa87Mjle3XuplfqEiF28ZuMqup6my5P f1HoTya3M+zqpFLP26QCnzbivfVJfXW3Y8bShDsoVw4MNJPtJmTr1qKSkeM7fk4jRe41Lnko CshY9gT94LZ600iBtGnhoiVwk5eJlNQYocExHbGmvhrLUYMFyJemU5S4qr1tgoVruFev7FsR E5GW+EQCG2mAZ3JlRKExwqE1pcM887YsHTOYn3zo1p4JB/kfoH5OJaNUZJZcG9/zwW5Q1Wpq egpebNMe2r6tG2yAOm06cKmBs4NWg5MS2s6YPSPKERLsq4sZNVhAF0DTAZde0kXc6gax75bw VOSUQ9n0CE0UG3EJVwgHtU4MRHiH0MYUVKnTcML9LPCdD9CpcKUS9Bhi5CN0g692ZXCgANmk wq1nbaTflnDkIVn1aW33kZiCEDoljd+43dtl0uwx6b0XJegO562wURCwsgpC207rbpnUloIH hwFzktEaRCgGWEDSY6qK8DgVPn9Jg4AmZPY4UMMNjmEzDlytsqFKuIEVnhp0bwJfzgyF31pQ 0J3b8FGyjFAbBla/7BLlwDcKSi8byhOySfIBMjL9BfEDaE57AWoWGgDgYA+m5k0NgyT2YfR8 WuPwPkzPD+ZZ46URqVhoYIv7CnhGDOVNNeQFCieF/H1HNR3WG3cKCYRAv3sHCcMeJ+LT/toA 95i3u9iIsQJn8AytiUX7f70GRp17Pc3jsEHnrwM5pX0pxKd9qSFO+U7jx4wV6EGDhZk27W/q OyMq/bl9XJnKaPNpv9GLz2M8ijKal6geDuBq7Q/U8g7+wBBXfYddY8YKNqLIXVx11dJPwySU Wbcw2XUtE/EwqKOfrJAm0VAVh2qk2utBfHx4j/mytEPj+I9jKHWtD9RyUaGquc7sB28dj07+ grmW6RBfTdrJjAY9MQUx4IkFhqk9MQUy4ImFxtGemAIZ8MSacUKeWHBqLW8jo4OemIIKe2Jt orw+FooBMqARhDanvd9rDvq+rzljvgfGdEHqGdcgSF4PRE+lNQrvgfS8qwyfS6l5zHopzf6W HMgyBsfyF5ZUWFhCWXawc6MQAus4GyR+KJ0WHCxwfUrucgfxb99hZQB2anbcyJuIVHo5EHZa WOfq13rYM+G6BQ1Fp7GoglWlQJ+wWXqoz9ckLnEJmRcOLrlbCw13aT1xPAb6cbPddvoaxV5q JV+kgjFac+g3Qm7a53G7tsF0aO33IzqBDq15qx8RH2pHhMk1d09WHm7JOokNLOd4xmTx4RBj yrMhY6ogBoxpYJjamCqQAWMaGkcbUwUyYEybcULGNDi1lmkZYUwVVNiYtonyGlMlC+opOkYS 2qz2AtRoGoCsY3NsS1cIkKk68mYExvcbC985wpix/KU5FIs14eGzXSEe1X12EmoiGQXOq4V6 0MgSOCvI60B8yMj6Mv6jBhvKIdjUD+QQjkWnkggHMUuF1xqhjq+HmOV9EtGYwYbSCDb1b0wx flMfhdp+j00LdHmn8gks69Eq4lypTn03dUs7VSu5BWvZr8VuOlK6sxamnzp6AyemobonezGR I2UOUtQuXW5NsG3oc//Vl2mUUFZCMaJNyWAiRSPUcfqQZHnzoGMG8ztUtICjL1uyhu4LTUQr 4KaHjdWbVjkaDx4+2YiCF7bj0gBFqweqHp2g0Aj5oNrhvjTv4ECBzApeWexTjX1JSKHakrz3 plaOQchK91Id4g5mRR2Ke7xBBBhwBv2D1L4gQgy4goFRtCeIEAOOoBkl5AeGJlW7gfVAQS8Q gcJOYIsgnw+oF9/vAwYAFPP8AJovLQBgTM+RVFNuYJBGp7PZGcfnbNaeh5xdxUd6Tdx7nDBm sEGvKRc9YzPkNR2JTntNFrphr0khHOc1ce8DDsYMNugjWNRfmFsX7bbE2k1oX35EL+K65SFB lqBVzg53S5Xr8/vSBNf1Nbfc545dd1015ZfByK1bOv4u1uo6Sdsp8/kz07gGlwU7tek7Z8Ht NGQ0E9B0y0bWbgJ95bovg4tWXwzF6Grb5J26dfRF1x3s5Ygizwie5ZU72DfsDSp847xB7jtJ GTVYIL1G4F6bvWPGeoNHohUlFH/ZaP3u4JGIcmnbHHjGBevTUFcFuA6HqNLal1IIR3iBvlz+ 4EABL1A4GNZ1At95ncAj8DGozBjPJZcTCM026gxTbdgtByQEgj6eBmmcvC5Q7acExlFengZp 3LwOkHFneJPzIg4o9PM0VOPodYCM11MPVXt6XSjl6Wko4+p1YWrfiLcTcRZRitlqjQO+nh9A 89ALUDOnAfD7egYm4Ou1xxnw9VRKTrtLeZ6K4L4bOIYKDzbQUkM9Qbtzsm3aQr61t95ElAWc TPRQjvD2FDptKgfZNVDQHR5s0G/pE+/u3fq42iX3PtN/JAVwrY9bK1Y/g0Zd1fsGjkjHoan6 jx1c/ykdrb06jGk32ELju1LVQHhw42k/MG0SrMCHvFiTaI7SwAtF97TuMAupwJ3XM5y4nFRq u05+LzoetWh9PH1fvEkV4SVM5P0WnwjUebhR1T9dRMceX9XnbKu6uUHYfT92/eCpNBbfuu1k N66nW03EWqWC2FyMPjtKMV3Zx9OO0b6ZveF6qMo09DL8Lp5imiKHx/RaeEJB4zzbD6SptA7a 7+roFJ/P8wl3wXazr+8SNFFac2yNwq76tlybq8xqlfRd5nvztPUb8+Ct3vN/zCHD40Y/nctx YbqX+G+Feo4T7ElM4gQfJmozacSNZe49VouxbmUFt/xaFGHRyn++PMNeWL+9jm35OINOuxbW 2FJJeZ5yYuMh0S05+u4WnhfJS2MG+3q+U0thhFvbDu169J+DZ/JNqp0SfvZvP79vNgwOjU/Z Ev5ilBgCU5QQCbQv+tZW/t78aaWzkj32/8FSIE86pvFZGvuJfpjmxQp4tMWqFOrUGIqXpvmY Kky6aVtc68GXdlbFnK1DsD7omfpOb0cNFsiqYJ8xy6UamVQ5FmuuEg59rN6cyrF4IGZwzM7X SnMitlI4sUWfFYS3aIBFR7O722hGn6Sq5bewD+aKFEI+IgjzHScPDhTIFUlyHVLuSw8dhcIl 092Y+GVMfByLccYGxM5sFKfmKMtz4BgGUdkoBRI+cgyOo7NRCiR86NgaJ3DqqKHCx47NUKFz Rw0VPHjsEOU7eVRLjAxoLXLne166GTQGQNVq8XLgANlPRQPgw6LXW0GElzuAxgB40ShxUBBh aWjQgDD02WpgeDkkMEHWaXkxyPDLHrIGhpdDIqWAghLVnhi3cBkYXnqFbhQQaob/BdNqqUkN CmVuZHN0cmVhbQ0KZW5kb2JqDQoxNTAgMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAw IFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9GMyAxMiAwIFIvRjEz IDU4IDAgUi9GNCAxNCAwIFIvRjUgMTYgMCBSL0YxNyAxMTUgMCBSL0YxMSA0NiAwIFI+Pi9F eHRHU3RhdGU8PC9HUzYgNiAwIFIvR1M5IDkgMCBSPj4vWE9iamVjdDw8L0ltYWdlMTUyIDE1 MiAwIFIvSW1hZ2UxNTQgMTU0IDAgUi9JbWFnZTE1NiAxNTYgMCBSL0ltYWdlMTU4IDE1OCAw IFIvSW1hZ2UxNjAgMTYwIDAgUi9JbWFnZTE2MiAxNjIgMCBSL0ltYWdlMTY0IDE2NCAwIFIv SW1hZ2UxNjYgMTY2IDAgUi9JbWFnZTE2OCAxNjggMCBSL0ltYWdlMTcwIDE3MCAwIFIvSW1h Z2UxNzIgMTcyIDAgUi9JbWFnZTE3NCAxNzQgMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1h Z2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNTk1LjMyIDg0Mi4wNF0gL0Nv bnRlbnRzIDE1MSAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0Rl dmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDY+Pg0KZW5kb2JqDQoxNTEgMCBvYmoN Cjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNjc4OD4+DQpzdHJlYW0NCnic5T1Zbxs5 mu8B8h/qURqMK8WjeGQbDaTP7cXkmDjYXaB7HhRbTjQrH20rk8m/3+8g61CRsqwqxQ9poB2R YvE7ivxuUs9e3G5WF4uzTfHdd89ebDaLs4/L8+L3Z++ub/7x7N2Xm+WzN4sPq6vFZnV99ez0 0/sNdv3ncnG+vP3+++KHn34s/nz6pCor/M85K4qqqH1dKlk4LctKF7fLp0/+5y/F1dMnP7x7 +uTZL6LwxbuLp09wZFWIwojSwjDrfWlc8e4Sxvx6aooPdzBt8YFaPrR+ffrk91kx/0fx7r+e PvkZZvv70yfFzy9/LJ5liPjherO5vszT8cv19eZQOuQWHdLZsraFcKXTRAZhH5D++d3pb328 R0JTlS2NyEB7CIse9J6VM2Xt4V0BcF2IWpbCFaJCvFuE9x2XXg7No76sTZqPJ2pWvMO/p4WY n9Szau5ninprbEpqbjN7BEq6rkurcyidTAvK7QAliMj/ruZuVlZIainndlZT7x8z/FzhZ4l/ qinRqqUsnfwqHKhlnQVVwI5R0Hn2+6yyf8wnBauA8S5H4daGYmjSy9KqCM2X3qS2wh6j0hg1 D+5mhDQDNhwMUlWyNNm9l2RCbRBGAFWXFfJ9yIQ9RmVeS3hwT4RI0gE84QXKYgsvtXaFlKaU slCSALcgi2enN4srlIcvf/ztp6J69rfF1Yditrw6+fWHeSv09puM8VfM7i4Jwht6G6Dn5JCG W9yryzP6u7qZn5jZprien9jZBe1qEGU3uNEXNOL/8ONyc/fXYn4iZ4u7YvMRe1Z3cz2jrs/X OMOnuZmtz+cnofM9PVVge3GFU1Pvci6q2b/xq80tzUYDCOpygX83n0CeMHr01eaaZ9xebROx R3sUfNvsWV0h0DPiCOFC3LgGAqm12CzLqRGSWu9AKLPmWu36A7ToAdDjsEWtrXAFV6V2/Acx uPjLPl+DYg9fezaRegOE0mWt8xMIBftMxu9Bg3m9PYOvSm93zABgdR2/Rz6qrRm0sKX13Rmq SmwPcaW0uwipK3gFrjMJ7PYtTGoQFrphFrBGyK0BIOpr10dkG8z9Q8Ir4XVD33RWTZfnO0YE nuZHRJ61I5BnW4MiT5pBxJPtQYGi7kx6e1AjEWE5CF0YAxJe4nJwEgipI/lJgShyAnGfufIb HtdiYaVrt1fQaGAJO9Jpr14PN/U4mPDW1QDmHhokwAtC5B5+yd0KZPdc9wrIAfKvcpLvQECy UqVPAbomLVGsLvHfIIDhD0ngDaoUVFqoTkh7tN9ldcWhCBqfRhDVoGaNNjlMp0mZZGDedvRl cTkPnDknjbsuttnhQTVD624edeoZPUntifFWTpRiuM1+n/0VlT0bCx/xza3O6J+p+RZXLUg7 1YPPJF8hH7atE1b2F+DdtEy7bN7sef+RL3PDrRe0AGnC5b+jIfTTgPfQyeu4XSvtNwylxexu 6rcBI/FtDLgxNduVBe0iEoD+mDUrbXmMvRnfd0XeW1dKvX6HzP0Z2Zxw2UbuTpmBmrUKDwbk S1knAKVCLVtqQR1TLRhXg2brIESM/t8XL/Elv/nbz1PzQavS+SHUycWuNqUWQzhyajg12bgD OM+LF5MrL9KuA0ifGoWx2kwN0oLbnAA5vY4EmzPBRDIHiD4SqmebFTpuV/D/Yr3afGkc1NZ/ vWqMi01x9wkH3KRsDpDeoqMPwBE+jjQzVmFQaGhpsEOcsgBAFSGRXQtgcXcHhgHxgfUM+O23 +KExBjafO8TRrF8a4uiR1Tn44jTnevk+wiDnfXk3tajTFbhBIkF73lhGJ0/5CBChu3udC52R invNlUdewX5OmWtvboHFjpfkaj20tkaCDWHbAdhhaHQkIHhMJOC8hR20/CfHkTbL86mhekux hAf4T+iyg1caAOp7fac6sxzunSeLNAaS1fCdFCfgaQrLjuabtwNOjQCoLPnj+3KpHzNqgw8i Gc1pIg/prznYQ1/vivXkng+hHvp6V6SneT4b6KERu+I8cYp8mIdG7IjydJBIRnDCu6Nv2rfX YeOOAcyn/IDAiM4A5ER/TKC0HUOkbo1hWnrz6K0x27EbQYEexEArkHQYEs/uJ3NP7GbnXDti NxrfkAHk+7qha+Wj7RR1eXTLYtSZ/bIb1nbBz/sXGT/nQTWu6JGEE4iZyWZKmmxzPQ/TfmR1 e5PxZEfRrHAl+gTNL0/fFDccmA7IRu2Cnj5bAP/C75drCssT1cvbqPRbR3zXRNPSIlCQAy26 k4vgOPtl817WS4rzLClVwEH/2+g7srl1Bcqmtb4Q+7sbenukflYXZNOd8fsynff1maye1WYZ 5pv4PeHmUQnaJl8Q4GP7OgEoZkiAVH77zI/z1mTkkMtiU8CLXi/IkgtGYmsDo7k4LcIa7XOZ eusfECneo+fNHu2QEfNFx1mF0m8pytecAMN1EwIxC+YOrjESMMvLZietFxtmKtk+fyKiZFCv KJ3FA8Minlwi+FLUCfwTpvg4QOCd1ilAD7AoUMOITnoH1VVCHeaHkGURhnRMi96gVmtm52EL IwzpmBjdQR3lKvr5pP4osjTCqI6p0R3U0cGin1XqjWKLI4xqTY7emFZTi37iqIcUM1u0eZ/2 Lfe/T9lf937rdPh2RyowD7wzYIf1yF/jO4A1lzK8OgCQBX0YnTEZ4+z+Eanomc0YMg8pnkoZ 61RYYKp7bPUURu6YGNXOobXxMIz8UTEytCkfhpHIFVNMg5K2KAEeiFIunTkJSlQ18FCMcgnD B5ZTDuJxgmoDpdRY/9TB6ZdRJYgpSFJhnGwIafXhE1vvmOkyoKDL+YmoZvI5q/GPpKKLU1Lp 6yUqaYoOsjVCZjGMfjPXNMM1doEt5cE/gK6heTSSipA0GVKxzzvMRfenWVVVVZqeyfaudXfI +DkF9p0NLO0Q7TpbRsO9Md45x9am0eg1reEVCDD82AshD4THbYqLXr0NOWLPR/E/mVwBhe4T xO7D/1wc8UFrIoGU1YCMLgTG0Lsa4ruqsu77MRzQCWC+hNU3BJYwvUfy2ss0WbOXbfaTnJfF htYUvfYvPWdvtyGOidU/m5WVMMYbR4dTkov150UDo1mmlKhct/FMePyPeUyiv2+dq+s2qk4o AH5Tc0y5Gq39IceGsd3RkMC+Eg95Nw7YNjESWkn0Ub7CUtRglfoUY3lhvIQ3/RJfeiqkMxa0 EaUzCdBbaYJDAU+6VY1D63w72L/T4R2nIlMuu3aYRBriMoJDSXGeywNMJc6xlN99LXG+Dex4 4nwA6VihlMlXloSVhcdmjs8rzPVXPgGJ5c2OwqSENkI9tFVehIntmLvm0bKju6bWFZZiUNOx Lbchc4mEh+BfJwSKIGNPgNvUi0nCfnRq6v0oRE3SaxvY9GtMgCmbImtGp5YumrWyvaKmRsPC BCk02qRDqGT4wgHevFEV/IGrdjegN3Ax/eYkT3KI8fTeBrhW2k+4GHI7Z4rIlbApXWxojYGh tl2nO/W+qWUa0vT7xug0pPvqNsbC9QKrsoZwJzfuBTwATu4Q0k7jPiojVlFvyB5OHcIZuycM PGC/BhskWJB4bvX4S0paUYrUq425TpMqY2fmdyUk13rNheKwy656r2O4nlWKhHXRXTRsjXQy iEmXmgX6hozAUEHdJNI7lPZz88fad7UgR2JI2X8U1xT1mxqewpKnCZddTuhPkRzYJfSl2Crs PprQH0A6mtAfQPpKQn8A92hCfwAp654FQf8aBb08hg+kSye+BumydiUs5K+wjKSp8NTyEBIJ 7etGynUkm+kVHSVOvjaFvRjObM9OxBgkBtLbipkmPN5okX7UnGVso0EYXv4kUOekbltl00r3 cCR2/QlBBb3THo95xHhV3M6V3zojcd3UcPcX/LrVQECUfSxdJGtPxs8A76l1wxRp2rwr7V2p Kv2VXOkBsKO50kNIW65078xAN+4yNT5gjOk6gc/Ap8bt2C7t6Fi7QbKCT0N0/Gpa5JNLR49R ryHa0zvWYHCDCz/d0sjsIzlFbcEOG8uZ0pqvYWINAB3LwhoA+joG1gDsseyrAaBX5MUN6/7G rnCQtClw0xtPQpWmHgJ6cdPG7FdnWEBqZ5ilag3HVy/ARnFHMLKcR2/6K5DuJYbnjr83JDxQ iSGg6TMcIBFd4mU28d+OUcR10ou7WA/eXA6zJpt0YO71T0P7UGpPFdahsHdxpLTtgJw1W718 U81W3XirIrFFpu8ZUvGxe4ZvE63jx7dhLYiVngprTzGet1X8azrCuELDnr760HE1gunPdgkx gwimdj9605jAGzwmSB+jL+J6rshd0VZk9E1l2zkhGat9Vu8JufVqM+8eJ2wt6bZOfXUBK+ei cXcYGqf7eB0yuXwSkSuwYP7rZok1IabPK0apU2TU4Pj4L9Wo0vbs+5smntfzL4ZV3KO1lEIB MIA/3i560xpFIthBValqC39NhZW6TtXF7YenT4ADgEENJrWQxWXTVhJLeI0rtTbQMphStLJ0 4AeF1tnTJzUeIPWxYw0dqkJDL3TUIA+UinPFFkPCp7lDAy3e89Ohg2rbw1zaWeRaABVa8HRA JnTA0wHX0MFkhKligwDBsx9DdXPxGRkruahZK+QNoPYWXsG3ypZTWmwnYbVZA3PTZyFlZbPL TsMCdrSkFYhHVxiLF3Zqr0tdnOG1nb9dLj4swbYtfroucrZ7ruS1OxkDYiADuz1VhQocJ+ZW sSpY4AVcIuRXQGCdviEP692cyx6EmN2sFxyVae43e7v88xOVna5uaYwEHDeJg0pJsnJVoGPI Ukaios2QtUdtpMzVRo5iNt7FZ+FhX9p6T6w6YqpuxBQsNhRWlaHTGSymrIePusBjGYDOZadD glgr8E6bGl600JgWcYqqbEILVrZ0Fe0W7lhjh8JPoQOv8rEiztW0CBQ9TR24UaBj3ekAOGgA 01y0qXAuAhVa8HRAJnTA0wHX0BHoCHM1rTrADqLqW6b/MJkkK+hgoSTo9I5DhA0u765I0rtE Uq7CBUh0jmYDAY6AJMKQiVhCYpuI2mI0EbeJ8kmZtCCT8jx+2rQXFn3ZY2vnigtGIS0rg68n g/S9e9s1e9sI3NXWoMr1laS9rcCnRXUqBN7sctnpUHRNnqCTcjX+Y6BlEZPQOuOTWiAkQgfq S0FX0oYOXOJ1nCo2CBA9i23kCbTXbVtjviDMo6mSrghgQusMkbTMEupYYwfhGToCDWGupmUC 5Livv1HaD9vTeDzUxT2NvKH7J1x/R5tdOzoXaFdAPO0Omk54F4TGXtoYsIX+ukJtNdgbryld QZ68nV2Re7fe42aoXCRzDKJYwO2ziN63iVXrR2iFr0vgqygNWCCkoC2JeWkBP9JPsW1KZwvr YLeDcoB/wfBEFWF1bOF6sgKRDR24niwrJu7AA9x4DIfnaloIiR7mdu1Lx8+GtkVDOc5UG7yJ KALi1hlJRUKFO+DpiCl3RCp4rqbly75y/jZpP1Axc3+rmC3dVC/xFuS+u+B27GSVcxdgNvCl w2wB1i49h5fk9yICDk8Hhzu5htrZzE7navZmn8vdcpb/WAxBxqKdlcaQ4vcmRiyG10cmMc15 AyMxlZJOdmcw3YeFuZr/0YgpPJWeQQzcPQpFquDvWXT39nD1VM5cHIut24XtvWLbtoiErQqO eO3jxoTp+jt13XTwZnZKkH3Qe7j/FZOQdtyEpMCD1gZT6Yi8EnikXWOVLcksgWW3GNHQuPOw AyiV2FGxUBN4rQ/oeg0QqK0pfKFV+LYitxMcVUXxkiCV/96VTkci+XGoO828abfTg0bBhkac dGgEXLYdAAEvIQJVTmDJgrMSlqyPLRD3Arw2MNdDByKGXl8zQqBHaONcscWg6GnuEHRH5LrT IdDMjHOBmQlGZATFLY5pETLcgXoq4ModkQ6eq2kRqI6S/obpP9DaFhSg7CjqCtta0PCOojbV LkWdM7ktxlxpNmAAADDuAf6oV6Vy+LTDTN22THxBZa5m18lRiu6d3y/Udc4QH4U+sAw9owz6 94l0HS1xITGmT2aeZOmDik3EjnXTocF9t7zwQD5hsGa7o/OI0qXpTWHRXVDGhmh23FCPBv00 xRMZeOJqsCY9mA50Mw5gFTswZqoLh+FwbNV4vtML2Eg2tnCjGsrjh44grdvxwhjcqGGu2GJQ 9DR3KIOnddedDliuRZwKA/hFBEQNeDRiQm0MkgU8qR1JoGmaBgHpCLhvkvLDRJvFmWgvwgoF PQ0wK0cT614wwezKWOicgc+pljAbgEKnCxiwn2SowGaWwNkKExep6CD+/zykaYUOSYw9BFnO yB+FrbaogTLYnuyBVc7CH8tDi6/TYUXz5BFWnQ0Lj8G5Jl2ewflejTA08r2owUs8zOLdZeOn Arj4M2hgbGitMOp4iR2+NCDndY37Hp7WwBS0d5wMZjEZyNhh0KnBDpTw8AjygQS9Bg3rYEQt kZ00wiHqaCgrlTP0j0M2ZYofkcyMxa9bi78WGIyTCl9Lpa3gwLqXFKYFJcsINx3kgihPNiKV 7XAYE10ZblEa2yGnQkdIY6tmPOavKxfnaloihqZDhzDBaG06dImSOcyFKSdfRFDcwrhWQIY7 MLAVcOWOSAfP1bRMMJib4Pq3S/+BJr+iBFlr8hNYTVe/mZ5i3JU309koe3c2hPUQmxldYINO FZkP2xLyVShhsizM9wgu1dkQ+ygsa0WJkzSWfCcTXZqwh+9R5+4lG4eho5vtMhjep2lqubOa CFYXm+sVpkQuOx0KFxwG3iq2On24f97FFiWaKRQSOjDR7CmaEscD2ahgw1yxRaDw6dCB/DD8 dOigktk4F3ocmORmUNzCpwMy3IFPB1zD+EBHmCu2CFRH4nzD9B8mcYynmzUbS1xKWQYaeskA syutV+cscZxNuzgdwMIA7L4mmVSkgdG4NcON8oYuverY4pK7btvfaBzUzydxz9nl43B3aKnl cN/DMK9zhvlIlkoMZSvl8QTg5JZ5nbPMR/JS0DpII32vwBya5kZUWLKzn40qtWb7oWfg9r/a ZZsrzde+as+5SQXWq0fz0uIlF5QylBRvBhNVCe7w9ASQLckAxVWEJqqmX82lDkrsa+CI4ZQl XlOL1xfbENdJmeZHIvvxKMxY5XVjlRe0+0CKAL6sHemHJ9oQdOzgsLGUthNjxh+WqrohaGU0 Xt3ShqCVMeRLcAeGyLDGieeKrSYEHTuECtZs0yFwT8S5MKSMCopBcYu0g28i1Ja1g22C1LaI dPBcTUsF2K12/GbpP9Qe9/1cOWppL1Mx+F3J8jpnkHemwysXPIa0H1AUBtuoqnNR7IfZuiZn jY9DEctlhDg00G7EQHarCj3t8UJsEFdJOvB1RakglFcc0sW6H2CAsuAvcrTAIV9wGXJxpYZv 8J1UlrOL2nO01dZh06AUtCFIzzELTz+NrkArOpuT3Ucim+Mqj0VlRn4bOa3GZt494K2TQAPy sT6nJn5gSNESg1gbYb6ZHMAKGYcdoK9qQQzRMe4kFN1fzAW/qA19qB/iJxSVeivMJWZf+5Ho fjwKc69c7fZqPV0DTekORXordHA2RFWo4mOmRFWqrGUns4KfdCexoviiozjcCgzexKlCiyGF 6jDs4KDyutOhMLAY51JEY4DEDXw4oKIiByKm3BGp4KmaFidBOlr7W6V+Io/WeyzVTCSXdrm0 JusW4vGKJsvwQFdGVQ4rsjL5mjfoZ71G97Xn07Yn4R7i15qsAzmKgNrijyAcnnAyWRdxFFpg nWCtZjp7c1gJsMkV8o9koKKk/WF5JhNdG8WnPNo4V9NBsSnl6BdAQtxKOcqKtHEu/K1C5ztx Lo3Wd2xjAqSJmMVGDHKFdhPjim0KS4VpOGIVgTQRrohGE+GKWHJHpICnalrbEb5vkvLDJKHD RdkKQgQqUrE9u6t+yGSTCVg0peN0jmT9/tsAUK79ztjeqxfP219NOCSyZ7MJhjGYY+bQ6xGR PZvNKoxjqGS5kgySJW/dSCKXK+sex7OKfpctg9w+PMsFmMehJQTbI0m0XtzcrOcafy4Pefd+ rxWXMxpGrjhLJSmHxT9tPNepLeU/UaA5zp7HDkpiaryH3VEcBrN8YNaTnDTBmKtBYRkdO9Dz 0AJPL4eOGrwBNGx4rqZVBREWO9AjUPx06NBIWpxLUQVlBMUtlLwBGe4g95Nx5Y5IB8/VtAhU R3F8w/QfaEhb1Imt/kColMCyqLu6+mNXlZbNGXz96bjoYv894ei6UPwZPj00o0hdvH3eXHVx mPrI2X+jEMe6A1gTGcT3EYW5e0xH8pOu2EMZ44Za7e3ynxRHfFjprs1ZDuMYyIHfDKb3SUNX dS4lO/Q8AkdlOjuoDShtZxwUBlqwRjeeT1AYyKYoCdmBAhSCIv3I1Uiq8nQBQKXx0AJ2SEGG rI0VTQp/L7ymqApbsErSD4CgINLD3M8RiOSg4SNRlgkguakixVU6UDjIJBmqK8PoV01JL7w9 WxA3uG4aTw9iiqsyIaAmHVUHIf3hCgAMlOEUKo7A4BvxQxEqeD8gejQgh7PldlMS+VhE5V5p W+mSOu8q8BdJJV1KJmqufhcc7pFhxYUOJXVQ2XhvJQjdQUfnEdCoeNSrMwfd0SL5uu91p/j+ 0cCnqu9djJ8qyT+YBzN42pQwo7ShvW7aStZoK1CHw6DdVrsdr/nMavu8pgybox836fDjMQAn OaEDJ6T2uOTaFyRrnKrlLbfbt4GXFeNRiO2OzhNGodPancLgyfrh6ngs4EmOtBe71HThEmpK 4GeotrSxNBNeEN4pwh0kei2n23XbwqMBFNAIHbVDX3jd6aD8AZKBwh9PGsBelxViHlr0dP9r fhSN5bYhyroLyMkuFDT+ONqCGDuObgSCuHWW4YUZqIn9c8F43IaPY0mDPJKYr9Z2K6psd1Vm umxMsZ0rwOFysH0uMcRCQgw6adSefInZh/3uE02imLMvx6CIj/kcinsYvS6bQB+BFNacZPmG h9VuOj8Vf0EXAZ4VzV3giSsi/5q4GD5Fjc/m2sevApArTg2o4Wv/LtpiruYnQ/NXVkLrxVXz 46V8fSX1/rQHhbkY1wgKMXeCFUBpClNs/38BPtxiDQplbmRzdHJlYW0NCmVuZG9iag0KMTUy IDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAxMjg4L0hlaWdo dCA5OC9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xh dGUgZmFsc2UvU01hc2sgMTUzIDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDM5MD4+ DQpzdHJlYW0NCnic7cEBDQAAAMKg909tDjegAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAgFcDx3sAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjE1MyAwIG9iag0K PDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMTI4OC9IZWlnaHQgOTgvQ29s b3JTcGFjZS9EZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9J bnRlcnBvbGF0ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDE0NT4+DQpzdHJl YW0NCnic7cExAQAAAMKg9U9tCF+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4DO0fAAENCmVuZHN0cmVhbQ0K ZW5kb2JqDQoxNTQgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRo IDU2MS9IZWlnaHQgMzMvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4 L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDE1NSAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xl bmd0aCA3Nz4+DQpzdHJlYW0NCnic7cExAQAAAMKg9U9tCU+gAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAgwHY8wABDQplbmRzdHJlYW0N CmVuZG9iag0KMTU1IDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0 aCA1NjEvSGVpZ2h0IDMzL0NvbG9yU3BhY2UvRGV2aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9C aXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2Rl L0xlbmd0aCA0MT4+DQpzdHJlYW0NCnic7cEBDQAAAMKg909tDjegAAAAAAAAAAAAAAAAAAAA AACAewNIUQABDQplbmRzdHJlYW0NCmVuZG9iag0KMTU2IDAgb2JqDQo8PC9UeXBlL1hPYmpl Y3QvU3VidHlwZS9JbWFnZS9XaWR0aCA1NDkvSGVpZ2h0IDMzL0NvbG9yU3BhY2UvRGV2aWNl UkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFzayAxNTcgMCBS L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNzY+Pg0Kc3RyZWFtDQp4nO3BAQ0AAADCoPdP bQ43oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AADgxgDUTwABDQplbmRzdHJlYW0NCmVuZG9iag0KMTU3IDAgb2JqDQo8PC9UeXBlL1hPYmpl Y3QvU3VidHlwZS9JbWFnZS9XaWR0aCA1NDkvSGVpZ2h0IDMzL0NvbG9yU3BhY2UvRGV2aWNl R3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFs c2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA0MD4+DQpzdHJlYW0NCnic7cExAQAAAMKg 9U9tB2+gAAAAAAAAAAAAAAAAAAAAAADgNEbFAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNTgg MCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDgyMC9IZWlnaHQg MzMvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRl IGZhbHNlL1NNYXNrIDE1OSAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMDI+Pg0K c3RyZWFtDQp4nO3BAQ0AAADCoPdPbQ43oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODDAD0r AAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNTkgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0 eXBlL0ltYWdlL1dpZHRoIDgyMC9IZWlnaHQgMzMvQ29sb3JTcGFjZS9EZXZpY2VHcmF5L01h dHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0 ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDQ5Pj4NCnN0cmVhbQ0KeJztwQENAAAAwqD3T20PBxQA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwL8BabQAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjE2 MCAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMzEyL0hlaWdo dCAzMy9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xh dGUgZmFsc2UvU01hc2sgMTYxIDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDUzPj4N CnN0cmVhbQ0KeJztwQENAAAAwqD3T20ON6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AIBXA3ioAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNjEgMCBvYmoNCjw8L1R5cGUvWE9iamVj dC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDMxMi9IZWlnaHQgMzMvQ29sb3JTcGFjZS9EZXZpY2VH cmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxz ZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDMyPj4NCnN0cmVhbQ0KeJztwQEBAAAAgiD/ r25IQAEAAAAAAAAAAAAvBig4AAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNjIgMCBvYmoNCjw8 L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDIxMC9IZWlnaHQgNjQvQ29sb3JT cGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NN YXNrIDE2MyAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA2Mj4+DQpzdHJlYW0NCnic 7cExAQAAAMKg9U9tCU+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA PgadgAABDQplbmRzdHJlYW0NCmVuZG9iag0KMTYzIDAgb2JqDQo8PC9UeXBlL1hPYmplY3Qv U3VidHlwZS9JbWFnZS9XaWR0aCAyMTAvSGVpZ2h0IDY0L0NvbG9yU3BhY2UvRGV2aWNlR3Jh eS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2Uv RmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAzNj4+DQpzdHJlYW0NCnic7cGBAAAAAMOg+VNf 4AhVAQAAAAAAAAAAAAAAAHwDNIAAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjE2NCAwIG9iag0K PDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMzc5L0hlaWdodCAzMy9Db2xv clNwYWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2Uv U01hc2sgMTY1IDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDU5Pj4NCnN0cmVhbQ0K eJztwTEBAAAAwqD1T20LL6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4 GpKRAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNjUgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9T dWJ0eXBlL0ltYWdlL1dpZHRoIDM3OS9IZWlnaHQgMzMvQ29sb3JTcGFjZS9EZXZpY2VHcmF5 L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9G aWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDM1Pj4NCnN0cmVhbQ0KeJztwTEBAAAAwqD1T20M H6AAAAAAAAAAAAAAAABuBjDbAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNjYgMCBvYmoNCjw8 L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDE5MS9IZWlnaHQgNjQvQ29sb3JT cGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NN YXNrIDE2NyAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA1OD4+DQpzdHJlYW0NCnic 7cGBAAAAAMOg+VMf4QJVAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAN49A AAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNjcgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0 eXBlL0ltYWdlL1dpZHRoIDE5MS9IZWlnaHQgNjQvQ29sb3JTcGFjZS9EZXZpY2VHcmF5L01h dHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0 ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDM1Pj4NCnN0cmVhbQ0KeJztwTEBAAAAwqD1T20KP6AA AAAAAAAAAAAAAIC3AS/AAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNjggMCBvYmoNCjw8L1R5 cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDM4Ni9IZWlnaHQgMzMvQ29sb3JTcGFj ZS9EZXZpY2VSR0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNr IDE2OSAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA2MD4+DQpzdHJlYW0NCnic7cGB AAAAAMOg+VPf4ARVAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwDlUYA AQ0KZW5kc3RyZWFtDQplbmRvYmoNCjE2OSAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5 cGUvSW1hZ2UvV2lkdGggMzg2L0hlaWdodCAzMy9Db2xvclNwYWNlL0RldmljZUdyYXkvTWF0 dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL0ZpbHRl ci9GbGF0ZURlY29kZS9MZW5ndGggMzU+Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVPbQo/oAAA AAAAAAAAAAAAAPgaMcIAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjE3MCAwIG9iag0KPDwvVHlw ZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjMxL0hlaWdodCA2NC9Db2xvclNwYWNl L0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvU01hc2sg MTcxIDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDY1Pj4NCnN0cmVhbQ0KeJztwQEB AAAAgiD/r25IQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAv Bq1AAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNzEgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9T dWJ0eXBlL0ltYWdlL1dpZHRoIDIzMS9IZWlnaHQgNjQvQ29sb3JTcGFjZS9EZXZpY2VHcmF5 L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9G aWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDM3Pj4NCnN0cmVhbQ0KeJztwTEBAAAAwqD1T20J T6AAAAAAAAAAAAAAAAAAAHgaOcAAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjE3MiAwIG9iag0K PDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMTg4L0hlaWdodCA2NC9Db2xv clNwYWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2Uv U01hc2sgMTczIDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDU3Pj4NCnN0cmVhbQ0K eJztwQEBAAAAgiD/r25IQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALwaN AAABDQplbmRzdHJlYW0NCmVuZG9iag0KMTczIDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3Vi dHlwZS9JbWFnZS9XaWR0aCAxODgvSGVpZ2h0IDY0L0NvbG9yU3BhY2UvRGV2aWNlR3JheS9N YXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmls dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAzNT4+DQpzdHJlYW0NCnic7cExAQAAAMKg9U9tDQ+g AAAAAAAAAAAAAADg3wAvAAABDQplbmRzdHJlYW0NCmVuZG9iag0KMTc0IDAgb2JqDQo8PC9U eXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAzMzQvSGVpZ2h0IDcyL0NvbG9yU3Bh Y2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFz ayAxNzUgMCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggOTM+Pg0Kc3RyZWFtDQp4nO3B MQEAAADCoPVPbQ0PoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB3AxnfAAENCmVuZHN0cmVhbQ0KZW5kb2Jq DQoxNzUgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDMzNC9I ZWlnaHQgNzIvQ29sb3JTcGFjZS9EZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJD b21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3Ro IDQ2Pj4NCnN0cmVhbQ0KeJztwTEBAAAAwqD1T20Hb6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AHgMXfAAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjE3NiAwIG9iag0KPDwvVHlwZS9QYWdlL1Bh cmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250PDwvRjEgNyAwIFIvRjIgMTAgMCBSL0YxNyAx MTUgMCBSL0Y0IDE0IDAgUi9GMyAxMiAwIFIvRjEzIDU4IDAgUi9GMTEgNDYgMCBSPj4vRXh0 R1N0YXRlPDwvR1M2IDYgMCBSL0dTOSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdl Qi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250 ZW50cyAxNzcgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZp Y2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyA1Nz4+DQplbmRvYmoNCjE3NyAwIG9iag0K PDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA1NDUwPj4NCnN0cmVhbQ0KeJzdXVlvI8cR fl9g/8Ngn8hAHE0fcxmGAXl9JEFkK5ZyALYfRtRImoSiaHLktf59uqrnaHK6KK7YPVk7QNYS RbKqq7urvjrn9GxdV7fFvA4+//z0rK6L+X15E/x4evW4+vn06nlVnl4Ud9WyqKvH5enl03UN L/25LG7K9RdfBF9+9T745e2bKIzgf1mWsiAK4jwOBQ8yycNIBuvy7Zt//SlYvn3z5dXbN6ff sCAPrm7fvoF3RgELEham6m1pnodJFlw9qPd8e5kEdxv1tcEd/pY3v3379s2Pk2D6c3D117dv vlbf9ve3b4Kvz98Hp8Qivnys68cHeh3fPD7Wr10H31kHz9IwTgOWhZnEZSD3DdNfX13+ZZvv I6mJKA0TRlD7GBF91D6LLAnjXO2VIi4DFvOQZQGLgO+e4UPfZz8O3UfzME7scpyJSXAF/14G bDqLJ9E0nwh8NYZfOf66K+wjWJJxHKaSYmnmllS2hxTDRf4zmmaTMIKlhnyaTmJ89acJ/BzB zxz+iVyyFXMeZnwUCcQ8JkkF6sYI9eL8x0mU/jR1SlYowWfUCnculKbGcx6moqWWh3liuwoH vMvOUffB/YLg6UAMryYpIh4m5N2zCiFOgEZDKg4jkPtQCAe8i9iW5oMHMoSaLji9XBVLUHPn 7//yVRCd/q1Y3gWTcjn79svpK21WqsVossak4i0JUrBfQxX8eJS2lxZy6jTT5IKjyAkLuUTu IXexfpzOssktKJpqUTonnrMwFxTxobo5mlwc8pwi98NUTsr/lHNYa13eTGeJkvaMT36awCsX P0yTiVJFoIJd88VjGUYkX87FwOM0lPFoJ4zH6qWUIrd0Ti5ReofR11VZ0zqoHtRuruBnfGGN e14sYc/r4Fb9rX8Zz0B9P52p0xHAv/WUicl99/eywA8HD/DhR/XRG/hTuQjg5eZrMv0tT/Db ZiqaL5rjJ/H3E/gd3/PhHr6nmt9350+/bQmfDRTiucavf+0uOdUZcRRyPhBxtYTF3BrLVz89 oPymLNLiwYXhSp6nzTLPUPq4zPK36SzVr34VKOGZm5E3W6g3ZN1+Wn9/LymQauj6aAmWhlxQ 6z5iS2zmjDkwZ5Y1pJFCXcrS8hzQ1wB2gyz/fXaOGu9vX4NQP3NvcrgIRUax4J6cZGGWUOTO 8J76tnNphljXzoJ7O5chICbIfb9CNVc9dpelWLhX+iwP05RiYUfceIN/cG93kpAJigXURb/A 6lErV2vgoUQlXi5B/SgjsXEuFsEUYs8pnrTmnC+epnFjRW46RVh4YCaJwjimmCmWmrZroinf QxR35Tel1OsSzQGocTiosrV/ShKVc8ggOVNu1mgKSSr9t0fu7smlYU6euV6u55cXwcUaZI0W tr2cJ875yVL0wMeSdq4cUIratTpqeP8R1KEYcPEolcWzRmWe7BHLFF8DFeCemsJqnKCGy/y1 g8H/RZ2zDdI0Hi39KAMeKTTCCOa0BtxU6xJOYsORawYED3lMMGDgU9dk1aZA4MZKtvM1PPhh MieIrtQy1x1k3zLM6KDUT3AMVs6tQaRhgpUnD/hd4SJKArZY+g4k534guY59JTmqxV22rmAL 7hufr/WrNFAotI8J+1MXd3hNA62+E/22get6WS7KOSC/2ND7DRibl+2Xwf+1pd1MpeGqFZuy 1wu9mhxQgS8UDaOgVvEcCR1f+QX0CIm46md9yrrV9r52UeOX6J83wbVaQlkajjFCpI16tbrr 4IJi17UxSVkoyL36zD05GTKK2gEHVrgIidqcSPD/lRjSJIwHMZbPoyjNvnAcFU1z5XJTFN0r 6JzvWSAipSs87w/deV0UtXu3MeZhPtqaWRyHklPkXr69nbJoDfcd/KIdTIynZp0n8+4o3hmz GLdUgCGhNkyxdnnhnmgu9xA9zq2308vAo92zyAK18k37Uz2dsTbE+ezcmkJehOTmHepvMCVa ZS8WvSFpwp+Pik28O5URbf9QaVPy2CHzYD7Nmi/Bg3anj1dQ4dGqH7vQaWODAL/+X8OjrfKA QPTQ5Vh1wUw71NLWD7MQ1S1a4XmBwZomOBpOcw93P03BJyFYdhzZlJ6tEmrNMY2SjaA/m2Sl RpkkvGm/E91tXdgFkAWEmrqJztoYaNLhdgbcq3ERJWEUUxtp1eLCmxKPZSgFwcteHa7VLOSn cHMaRT5lzAgeaD/FrYqmwbLyozjfcz/co/MM0mB2gqSa/wQMk2SQf9nl+DDjo17Dndz1S8Fe b0XN4GTcwxE2jHZ3ZjSddSeZxzb8oPN4Tdg73/Uy312s23c37qXrGIlCWKmwSyiYwZdnWYbl OO6TRCKKoRiC2B3nSSIIvfCcInfep1LxOhewdfoi4xY8w4vvOnd/mMyxWRz4Dr3BO1ZnL0y8 h/capwhjCsjZ3TD88AncLog0D2uY3qG5LZ5hGVpuA+VY4MvvNvcgSSWJd84DYCyNIZ5g59Ax yos9ozyWQlx7TJhnpegP59nJ/RGAnn1lYyI9Owf+oJ6d3vewZyu0r6naA9bgvYV7T13JneTi IE+9R3g303jXU2+T6OCqY4w2OdBV/yT0tdoi5slL38ZJ6w4DmcVRmVn95bkOhcs8TGJiyR7q DAVU4tmp2atQsBSnxX0HIAqrajOPsvOrlKchoyTovlgCemVSgtq8URtws4rKSIN0KFthjriF HM6xhEwSDBc7lQSBJRK/WCLORZjHY2IJO0VvWIIg9wfAEsTKRsQSBAfesARB7ztI6tbuiXIG tUrjLZLLMGcUvTMIL61W6twtqjlipWsPfngaAVoiWNBoCb1YrVlfAEtGXqPLZVsQU+ti937t 7yDDEWccgoe/pwwHwbJje5V6tlfqhLJRUxx2iv7slZ3cH8Fe2Vc2pr2yc+DPXtnp/VD+B7dG t1uBF+S8WAfcXkYycIgiPzQ//ZFOb/opZwfiOAOfY192wLVqZhF4EgThfXkI57WyWZhSfDg2 EZnPWkJocmZD7PINOttr12JT9yvOSKLOd0kpUhYR5KBfmqU6Q1MW83vn9omFkpave3OoICgt WR85TcbQqycovgLZAWLXV7dJ5J10KURrZWp7w18oTdUxnsQWrSxWHQBfVEbFqtLEbS9N8yEn eMLxBjQXmGNt1a78dSuybo/UPsMT/IgVwNWv+LfFszZVzs+FgJYygq9FBZW3tXsTzoSE0leC rPtVijQUFDWdr8OD8x480OKp7VBSxj6Bn9Eqcfdd6wJy0gRXHprkE2jXJsglnfXFESxtQzxc L3BvH7vbNtfRbt0cXQZtk6V4XVTXNTIUObThEWtU+B/xXnmLPC2bkgRp1rQQgE7B2E25NGCh eUrcF6AkaqvIVaD8evVX+FJVLA7ZMAIMV6RX+rZucM2g0u2Z2QBeaAWGjX+WiL6P8Rdg7+yL UHbiuu+r0JEd5F2birL226DJ1TGNU4q5m+10UndOW4bUC6ldXeFq+pvMup/ENPHQdaN0uMip VRzQxZD7hMoSariHbJ0tjOEOKGnnpXdZFuaSZMC5XlfunYhIch+w8bOqse9W9g2hiKVIxMeS F4N5O4htK/q5uNG0chO+4V9W7RwN6KrIJ1sgrqsuA//ckv7Cb9lVPxmpfVr7hbHlJhG5rYL6 ord/6Akh1SKAPyKnujxJU152Pw4W4Un5ykzYYhtaV/Y4WNtS4LlH38Vi3czMyDwdcJjzkGcU j+6BC0+hN4sgRxzwru332KD18Jy3XoZWJF3tG57VxCBarDVegONsb9uDi7gp9QLKzcn+6ov+ 1LfXAg3BnXlB/JzFlNniJk6BwACaeZicEZNLMYyrVlgL3P8PoZ+pUHB9UoqXA+wmczERjd7u mNlCBN99jx41DpJx3g+ZJThSjiDtPvySh5wmd+b88EVJKBOKnGHhOs3tDZswKfAe2Flxr7ol ODIEtRegSWYqbKPd+BClrXGEOV/LCCU1uKfs87mlztAmO3NZis6mfsCvxo/9t/u+qi4fOsaB q95JHrQ3V3WTNpgDqcUTfK7JVrVk/Ohu5WlYfEhXutt9ITMcFYrrQ1Sji+laUp1beN0iTuXr iKHOTtBQMPx3OLj2WNIZJLhJ2scdHBs9CAkKitwlNi0Vd23Lh5jwz6bHDvCwcpHkiPrsbLzH I7tULoQ+vFBbqM+t+mGJikHd9Fgd22IBnD5rzYGqJFM/uOYWmi4kO3CPrAfX6wwKoZzD6OhY jofQc5JQvLm3wjyCQhGCnNVB9NCKD+qNYGHgYOAAH11drK3cszYwzgPDObBDcKW9kcaMnR/Z bG+NhSUwtJSg7r52WZmWjFzsoDuqbgx/1spehwOkEbnwXNotRASFTWPJRwgBEfSD5QPBlV5n +DmgIotgPCfB05F15c5D9ynERghedUjAQ8JAubcpqeaLxYei2x0dz3ANNhnfs2rdGlh7grhC rT3ZJQr1AglWC1w/O6ebaPfRSrjNz3gZL6bcZJaRhF90jLwkVQlmPLiSEaIFOzmMGRsZnKoA d879kWOZgEEaBBfVAwi+ySE99AHaWu+B9FnjxOMIokoEZwbSS+xAr3WBzcj5IYm7F7BKF/Es 3G+GZBE8LYJYsme7LAXWHY91/KVkMASBIDfK6F8Yi5BmtLiHZtiPvk8ZDNV/7Rwr506MRMtr Z6qz961i6sJaeF+qm+0ShO3B6WamwMxiJNtAx8ic9RGufiJ9H9HanvgJybfEHMPpGrSxHKbT EoJxn4zmPIwZRe4QB9zFTD360CrtHO8GBgJz7sSZe5iShCIjSHur4xiW7a16y2BJ1/aHHyZd pm0WDSvfbFOL4eAedtVPvJhZAcNWU0qow4c8eEP8EUOfyM4HRpnNp1gYhe6NkhmGql9RsOlH wSsXPRqmC4jqLaMqhqri81BPju4FwWhTgJMb9TfuaweTKGQUA0YtQNd6dtNalcoDKM4jDCDZ udmnG/rB+LNkMBm/nwdjSZxD3AFTRXvHG7+UJ3JvhnIcvU+I4hAz5GKIHn21WBbGw8TKOV7u dRM1V/K9632XslMlav9QbRjH68CSnCN9i5cOjPNZUTg7nJCVe8dNDxslyO1cgvJX3JP1FlB8 uZ6LuAmwL94dU3CURHagOK1XwsnEIcsD4Jquy2b66i5nzh8Al0X7yPlquSTI6cfjjAYC7SW2 zQe3p6bsP+dHtHUEhQle2nHi20n/JnY304/k6q/SwAK5c3edbnaW2Hzzj5zQfuSToWw9o5DN lQnFn6cxzoBLZE4Rdd8YCw0dWbxvkSMOAOXqnZzZmcGnj6LXeeJ+q7lMwXwSUrjQlZPK8Gxd Hg9t2dikPNre8xQLAD6NvRc8hSTe+HsvBIci9L1777kZPmFQOjTavotEQpiLoLc9CA7tj/PJ VTLi5GZ7CLTJKIYybIKc62clOhkQtQf6pbEtXOgN+tnJeYN+dnIeoF87bWEnDm0Av9TWWmWM CHZt/TIZCjGawOE2gOW3k+vAbGLE3fyD2baTwFal8kmA1UTYYpefDli18zcWgmHKceM5xYUH BBMxmCFJ0PM0hoyzFLzT8RbJtUtgp3e2Wi3U6cMRZImPEWQ8wWI3K3m/oDxle9Y9CjCLIgTI Y+20iHAuE6VktqcUzYSXMUURQkM7B+5Dz9DaQQrYNTBzMQmNDFNzKYaPqxknW2ol7TJb6iER lHGK7UFIruk5mSPf1XUfz+o7eD+4L7nFoniCRQ/N9WmY5RS5g2dVkM80MGs6QL5FXW26r9R5 1j5DspNs3RV/2iQ07rzUzUoQPKMk4etxpDKG1CRBVEt058FfeDMenPOhPhBnox07CXF2ilqv KzzlzLlg4TDf2Eq7m0RqihuPr4dOR0Yw4171RRmMvbdT22pbcN8ZzYQgF0rVajnX/DzkyUE8 mMVmm6Du+xSL/mxU4KW2E1G25tG2jvpT+ySguTn2C/qr2KSqn7s0iVZy21UanqDVOAcNkJWg qO2W0+xIbs9DdCTp4LpXyRy0kn0B7iOEsYQe45E2R8Yp1OLYqZ1jwUHzpKGuFsZUgGJ/r7Af Zc0jy2j9EsM1bamcPkwlsJ41XM/xQQqyGRbXV0I0vThbSAKW1BVuQAIVFYIuFb3rdEMBE7f1 7Z8HwySsRjpaepXiRT8rvKkF+WnaTiEyjVu+O29j3lSXNkNVmw8jMb0OGKaC71xUc/eJkFTf XKvA3fdOpQkMGLdTu2mfhAbz/KRRhmuKb8Zx+CGKqvUqnBeSw1PtRpKIlAnaqMMloo5VZgzm aSebttLR5Yx4tO+9YObmhipoEQ8fnnb4E9FMbX4S6CIo50WI+NQfglUPratqD0nJKO2gjvJ9 hwqa+aDOk10s02ndsRadZRBMIcg96PkVetz41izU7XqYZpSP84Yfhgl+O2/0CK6+K8C55YdS NkaK65BSL6/Tk2E3oStwFyQ8waVe1NUKdq2ZMvKy6yS2U19t1qXvRLs2ELBG1X2nxm7goAeQ /SE6CETu0TuhUZ3ZIHejSwuPgY5O9eEKs1zTrLx6HQOD9GBj8byCK2Z/bDkRqbEFaYwdCLpR 8kTMYiZ9jSxPOeSgiNUccpW8Tldk6j+WOMfuw2O3410rvARGk9pujV1uhiFbz3228yRSYxTQ AanCahNscN+T4b5rALqNeZcdAzXMwOUDVZ5sjzjcyXYvcOweLre/VW0jRjOPr7gG1hb4SGWj 6rCfKNA/NeZXPzdFJgxsObGJ5XJqjp+7U0u+34lg1kWlMXyr0vxcZSktPl2xWJgHpJ/N+FIZ 9E53bndGcAk9xGyXlOvl98MO+kp47E4qll0N+qA6FJXrXAdNWnQPzwmShpp56Hqb9LcrgWZb t2HQ82AfjdWs7lYD5eZP/WAq4it8R6eaHRQ4F+CjO9Vn+55IbVUqIFsTf+X75pJ27UKG+7wV +HpR75uub79d960vSyqvA2xnZ33rbobldo21xYx5eAggjrEg9u8A88O9zihkjNsQpveidufu BYfh+8Rq3A/dz7AylyC3kxV07huwGFwpgrj7LCDLoBTLSq4fDnL/6CvbOdo6dbaT2lPf4RIO z9Qhj9Tr3AYP8XsOk1YJJvcrV+ejjGKo8hnrdAh142Nye+ypCxgfsAdKubc0EkAowaLRa4hQ QZeTrnVMGY5P1x7XB759YVLOoI/NrlFmZnFKVTtPrMYigjETY52bxspGzBYvgVRf29bvmnAq cHY+Qdn9I6cSfOwTQU77h+fnsNz+IF6cn3SA7+J7Hdy9+O5skAqBPwMqBYWnXEk/kUmC8xP3 Ld44V2OsfYFOqoRR5IpNcNsBe/QGxeTDxvlQajCtjBSxDQP/D+X4HEQNCmVuZHN0cmVhbQ0K ZW5kb2JqDQoxNzggMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2Vz PDwvRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9GMyAxMiAwIFIvRjQgMTQgMCBSL0YxMSA0 NiAwIFIvRjggMzAgMCBSPj4vRXh0R1N0YXRlPDwvR1M2IDYgMCBSL0dTOSA5IDAgUj4+L1By b2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAw IDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyAxNzkgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9T L1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyA1OD4+ DQplbmRvYmoNCjE3OSAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA3MTg4 Pj4NCnN0cmVhbQ0KeJzdXVuP3Dayfjfg/yDkJd2LjEa8iKKCIIAdO9kcxBuvZ7B7ADsPco88 05ueS3ram/jfH1ZRd7HUmmmy45w8GJlutapYJOvyVbF4+my7W38oVrvom29On+12xeqqvIje np7f3v1yev7prjx9XVyub4rd+vbm9Ozj+x189PeyuCi3334bPX/xXfTb0ydJnMB/WmcsSqI0 T2PBIy15nMhoWz598u+/RTdPnzw/f/rk9HsW5dH5h6dP4MkkYpFicWYey/I8Vjo6vzbP/HCm ost789roEv/Kq79+ePrk7SJa/hKd/8/TJy/N2/759En08tV30SkxiOe3u93tNT2O729vd48d Bx+Mg+ssTrOI6VhLHAZyXzH98vzsxz7fB1ITSRYrRlB7iIgeNM9CqzjNzVwZ4jJiKY+ZjlgC fLcMz33OvRyan+ZxqtxyPBGL6Bz+PYvY8iRdJMt8IfDTFP7k+OdQ2AewJNM0ziTF0olfUnqC FMNB/itZ6kWcwFBjvswWKX76bgH/n8D/c/gn8clWynms+VEkkPKUJBWZHSPMh6u3iyR7t/RK VhjBa2qEgw1lqfGcx5moqeVxrlxbYcZTbo6aH04LguuRGB5NUiQ8VuTecwohVUCjIpXGCch9 LIQZTxHTUv1wJkOo6aLTs7viBtTcq+9+fBElpz8VN5fRorw5+eH58nG6XlgpdjnLZKyANTBf Qw0M02Nnh8UHaX05pqt5zDlBdySSw4dplhI5zLeL19vb5YlefACFs96U0fKEL94s5aL8bXmS LT6Cilpv4cPyenmizBTAx7t78wQ+urtanshFsYvg98UWHi99D4Cbhcbzo8mLM7uF3OS+OIgc Yy56Ks4yit4rI+mz1/6JimyC6NgcHExPspiJqUEWsHbM6soXFwUsph38cwsfbj95n2Kdg+sV ZIpd5HIxsaL8L+BcxZwc3f1SLK5ArMVmg1v4PW7aCPbxeskEzEG6WG0+wna/wO8ufHMolDTW 72gCEco4FSlFrrj3TzDLYkESvEaVuWSJFTXKuNjdgry3xi/0vtolNy8g97r3wUvjaabkat/C tjbGRfZsCwgDxdLYF99MGWN/RBGY+eecIre+gZHi3qv34Kuz149lwquPkBqXbszwHWrhRh/3 fAVQJ/h9ucKPP8CH6xUEobCgcYXDM95lzLI8lpxiubgxKwx3ln/CRr2KjCJcovFaXaGD5N0z ydCIBpgltWiea42Db63IWSwYxb41NfcrHMH6PSoDNErIDw7p9wCKWsV5vmcuQTld2aVkt6p3 dWHmVZEr6jBnzKmgGVpfN7lXOOi+ZarW1adGCKOo4TPQXSb813w0nDfew6k85jS56bApWt9H 92bT3Zv9ZmVnfKsTFUJHsVgzikn0+NrJNDFcVu01Qod4V2QynWDvsIDbSU6jQ+wmd8DidYEV LCxYwY1nSWIVPBhW4SAbEKpwUguAVATDDpwDCAcduOUFowaZZX72sTusT+nxhkAR8jhJCXIt iHBR/19QDCHPYsmCTLXLUUlYLClB+3eLEhOfU2MjAATwkvBPG94MAASzCAM4bxKjbCeXJqq/ RiYn4uzaAI5j0tylRHy7YTqNE06wX8eIvmnCDygFW2tI30RTltBEvQ8xNSpYK9JQ8tSayldn 3gkbitxNGJSxb2qCY7bLq1C9GnGWAoMzo1TvDjCz6ICbCf/+tgmpcnLMe6Nv79CIAI+Q4OYr o90s+ITK7aKNAwD9vWrR4LulOgT1OQKgwESsM2qcLaCgaTwBFH8XsRnHtiGCfSkopgME+0mc 5RS5OthXf7FY3/gnfJxNDhbru8l9ZrG+m8nPJtZ3sxcs1neT8xzr86CxvoIiELowQYQK9p10 w0X7BLm/TmHCseRVgQsEuWDoAjU/x4MXCA6C4QsEvZ9Ra6KLky1u0HJu/FcmqFiTHASoTEji XBxvBeciluToJisTbozdcmEK4MfeR+h1okGD6dHWAS02uPndGedaacgQyWZlogF9NKlKJWNS qJ1kc08lfiYZZ6XZ/Fym/yBR4jy5ebAL70+K3Qie/t/FbsQ4Z8RuIYqEckYxFKAmKYcwkFp7 f0pMSjATKiYlyP18B8sQV6OoFfmSsc82GFVmJp2J532+qnfVIWUsNMWP/7hTmg1DUVsHgcxZ qgAyJ2iiXmicgM7i8c2F1ug0ubiITuDlWmsM0Tbes05QfJQRtEPMMSAgKUUODIQxG0tmbUVQ lIMLGWtyuY1RDmsyMgrl8I875AxjQb8TQ+AOIizukOqJGgMZDHZwkA2IOjip/YVAh+NIq8Yc nNTCQQ7uyTki4uBkIBzg4CT3D/THD3MTnERNvKgoogHGqDQUE7jJPbu725jdY8IPGOt7/64t xBl5mAXspKah1P5Im1MYPzqlxmZPGXwKU3khk1hQhPuoTVUKkoatBNE5VII4DVfPIVt7j9dF nkEx7bFmHI5RUlt3hO/cgbAr30cdHDNN4E86ptb8seGTlKH/RbkwAldB/FmEjSZ8cmRkz0FA PSAH/Vf9GCAnQKIxySnGA8QeAg7pEeTaQ1T+K/uMhwVOyJHGyY2FYiQ597EI70lT64a4Wfj9 CpZTG105j0UERqiEcQw1KSTvCBVYVi4ocj4cMxdRkcaMXPD+xyh0LEmRPrtrUiobo1PegylB vSMeFCSlocAuqVRMTlAQEwdmxU0uDNgFhwhz0k7cNEj4LsL9eNegX5358g5zpEJBdaVnuRMw hwwLc5jtNioRaXGONBjO4aIbEOhwk/sLIR1HklcNdbjJhcM6iPk5Itjh5iAc2uGm96b8D660 VdP9wX/jASiv4CQHQcorhDjeCjZbXpOjCwoImL2TkpTn1HF4T6+yOGWEjg8NCagczjkfa9ZF xmJNLrK2MIAABuioEhz8FUSVMmRUKXNbLENZ4zpkP/fuyiQm7iLtYx2CfwZAAReuwp5DmzIE aMiQxlJR7NbaxztIwNGIuokGwCRSdEnc5Pybq8TaDze58n4FqddRw4TPIV7nuUZT5Obcfyyb cKj6JsihX/ufyrEIlJ8WIoceDgQHD/W2m0OL/uNm2/zhWBtGGjopsQ4Gdth/GaZIYkauQf9D FXxiBdgq1M4iDFAECsU/burecQCAXzKSnGccIA2DA9jOlMq4AY4qtH8vq2pDG/naoktUr55K 0CaPLoJo3Xztj9EDGHaJVVduhrBnnO3wVHkeeOipXw70FXzXkeHhzov5DP+vLJe6UwfbhcVW ddbEatJi3f60gNKgPrR+B3x1C8fwwYo9bf8aHh2sC9XXu/tlAI9KamwlTAh+UxYfQvjENEX/ Z7UTBb43QS70RrP7PzXxR5Y/Yp81WFioZiKM53FK8dfbaN7LLBOacLWjvVsUpjAOI6i6+qEP rIQKhBYnseZmmZgom2cjvl7CAvjfZ68wL/LTS/+2IIPgmCAeYMXhxLupMf/U0jglJNv3Db/2 P1IB03o8wUrsBEmQe4bGxPa/RJtn8RpUM5hbug7SDASKexWjmBpbcu8OOhcMCtGONQlQQsyy yZ0cwz8vXsdiecKqkzbvFjD6L17CFLR9ZOB8DToCtsSpNQajQ2wDV2dXrnad2qhdCUcbLptn 1rtPeBfA2PcoELRrEnzoqaS1p5LX5/eLL+Dn75bNS9B6AVOIvF52PaBAazw17mtKYMD3d40g fh2Wie3Ky6VDCqsrGHcJztyvLfcWy+zUeU+Kx/xiA8i3sd3bpbKzjJ+21TbrZgZrSUadj/PF qmjOEm57de54TlG5is/Nv1NVWObR36/MiNerqzB9Aar5gAPx48Ks9rBEubUDLu9tIrnKJ1up 3SKgBI+ovhwBocBBuYQ5VXn/5wGUQqZwyokQiKvQxrvGE5rHimQhQF1kCggIQa67UFfb5gSF PUFzW2sLlIfZXb5jGynQ3XOzZrfkym0XG3Csaxt7OelAO0mo2LzgTzCUcCg00xQDAQJ+qK0h qHXspDGSfIHGUrlPpV7UVrL032O9Sl4TXHZxAO+UFR6aJyjP62Nsvhs4HNL+P16H1MIlvYdg 4Qv4Hj/g9knvFcZ4DPZYSw0KmuWctdYRkeigM9Up57GsBKxE/EPWza2bOD2jYKoA5VIaQ5xZ 0nQFtVlI6DNlChLVQ7bO1tfrTYEmf/MJVm61HH3XJ+k4T0gmbBKrC75W/vSX4DAj9mW+/5I4 GAzXiNhd9xgcpzr2HxrHVH0Y0zxzUXvzPfUFaXjbc8SFY55ICsjU83DMMKhaIl0wTmDAVLOY SZI4LhackUAFayxJYkZRt5P3pX+aeZxqimiA5ASnh/i4msJA5waOJhFjMJmgyIUpDeZJCmVs BE2X7vIOpWhoR0wwEKCpG4MjhPOm1GVGdVBsWGo5Bxuu4xR03IJBmgQzoYIigtxcSNOZMgwF NB5LNBXQSJCrbWBlkn3TTlOosT3aUFO8MndqB4w98qkYp3oqDxXeiAyOAx9LPHBQNmUPEU/e CW8GvcsnhCVtVOi9oiWN2fGEJeFOQlKjTKCL6jMAF2t1mHEX+u0EF6Nd55znpKoMYE51SvFq Ex4gRMf9vAerCw6XJhCUA2gnCUgNQQ574VaZhJDpdOh6KEguAlxMoeF+smPJWJigR+cTMsa1 XrqKTh906Mi3smFYZ0Cw3QMyvZdEaqjXJyjDCrwNQ9fYIq5oDdVCtTcg/Ap9wOMZHc2VHeFW tlqXKubKDQwsoHfsO4mVomgHgNoF3HBOkAvURU3zWFAkj4WMcoZ9uufJ2RXS5SGRUdgreszW sDnDrLvyIAd8jlrwuj1SXeygdP/BEOWHBmrc2viqV5l63SbT19dLbV/XD7RKa+5atBK/scXJ 4G3+Bl9M1aO7T4Be2p+pClmz6nNXlphDLxpE1fo3H53VDlggUNyXGxiACFBOV80sz11w8zBz ZQUPPLfc2joDHAzC49IOu3VH7eB3UXVqU4/rAe6XTE1KwfJRbDDJjmUb1NwPIoRmqVXlBq6G IYMah7ZCAocw6KE3VASf2mqXtoqkGltzfa//EIRjfoiYtQAhCIvzlCLX2f4WQP5QG027Pr4a 3+s7vl+jf/tUmDXO8HL3IftuRRQCkM4oFna2g8QDNN5UU3AbM1kNNFi99MYY5GqWzLwibibu R/j0Q3c7yq4qH+l7SCm0K8Ct9NNG5x+UkrpZqlAZ7WrZJHg42nlyj5DyRJ1Pi++MjqDuid17 093NhGFTC5e6lZ0p65VfrS8atb7BSrv3tRD/aAZxVq4+Nkujq4uraAXZx9/YLNwmui9R+6+N q/wW/6fNzCfwzy+2LirA+SJQhe5ZmuExsSSkyyS0c8c/u2kwl/KPJpn7vF7gA0ekY0/w73al mBDypo5IZDUdOG3gA9UnX/qldv/F3XVRgS2FXU3eoZQEAA1i8AGKXjgAGgQ5jIz+sKnN2iJX qmfbaLjvavHd1Hvv1j8kkMMpWYLLbZMZsM7Oqqw9JbtWZjs/Lxv9YKtotx3dou1vrRo4b3zc onHr7hq9srVFj2dTbtm7hXnjy6bI8ezdMpAOhgvJR7sbjsFLYQ/Cv137JqzgIkGC8tsOYO89 1M7M8zThX7yTg8NUJLkQtQicmlBHW4ZV61p03JxGETZl3IH6ZTCZQV8ngtuiUp/IyqXRGx87 qjVqz5x3ynVsQak9er4zYYPu156bn3QUUVWb0g1s6+5++OWqbHbiA3WEd/e2au5B7lOFu/Qm QJcPbIBHTBAV+MEqq7q2zcmK+PdZNIejo/P2nNNnCXSdeqVtlYRu+o/hK9DVbxVfqQBwbJ4v 9V0IjNA8n9CMHNNr856bTyE7QgwsQClABtkRgtxQBVYicHhIjfoDR6e612KuCvSvi8xoJCHD 3h3Lhf/eSrbZESFP/31FjI+STIy09sp+9D9QTcs4xEDh3jlSrufLvMK9vBuIhKM5PdIwZZJC jw6CHMAFskYL0Giit/8TuvyRPbu2WaPC6iIef+DxL+9H4xPo50Fw2oIr1vEKdYasMkcSb5h1 pYo6aUD/Rzy0xHJegnwvAdEH2UV9ENAxVwhgqSEMjsar6WLRBZ0sLlfaIHFn3dxQt9sQI92b nhk257yt80IdsLQHmcG73EY8gLFIoQSKGFpvy723eWf1EHAODyiumvF0wTn/neqw5w0xEv++ c24iDYraHBc10C1BlU4Q2Jz1MXz5aOsrzWvgcwdjCTYZHTKmYlg67NCmvmOqOomZJslK//Qg UCfpHbZ9XfQYE7AM3eTOsE9rcVn7/mIhvj74YIeTCwi7yVF/j8jd1ngpyM9VuY2WmIXO0U0G k3AiDu0w5mIL7rbJs+NNBs8s/uum925xe1fLYH17U2wOLOBzcSAEdk+YN2Ln9g/azYub7aHG aunHft5u/V80ERfLKgVX3RTcYMe9RJb/ticKeroQnAbqIkRQmwKFqqi0cYp6/YPhseZyn6aX r9UCAc6aKEaNALnq5ODDsKDw/MCEEF3JgzBlpMdaN9z8ICPJTdSpEGvKuum3g9P6vUtuBglh /yWfKVQ+HkuAEircMopcL3oJdIGElHCBBMGA3bGIvZVV8ZNv+pmYUHSh7gWBDu/8eJOsjXIi yLXpgFv/+YA0YeQ4gTDLbOss/+hfZWgzBWechgImikHw6K21JL6BahZLmh2kXyWhPsKGq1Dp uhrgpHu0ps2xoVKyGTn823/Vr9FEFM/+O+tlOmYUtQDVxQnuCBc57OcuJS7M8yv/J3ExVCYG OgDJW1NdGaLtstfEZGzavPsUmIgguB06W90rFCCp100Y9JKm6AC1a/p9i3d5P9qm4QAFwX8/ VVUJ/kWg/kYEDy6Q1LuNl4AnH2tvQVVlQpK7q1NHuCQc1U8tOGixsl9xOe0i7yeeZM7R83Dz eVuHWQGMIravJehCkjyQMbQ36s40hi30jJsVJ6rc3DY1uba4GDRPu4LJym6sX42qkv86ht0A LtxcvXbbGL4mlsO61lZLwNshvSH39lz+3YKru7J5n3dzJZTCPeWW6RyEwUcnWBmZaME92dD7 QI0BxkOhlhE5Be1RCXpgSRPBuL0chXunbVwGTY/1YGBrRM+ijORQeWrzrAdvYSdtOJTKqbGe l9d3G0Q5d2X0BsOl3z6ucUuV1+XN7mBQccSP4ALugQwie+2kl8EdDW563yTJc/at9yEKBbXM R1tecA5fZxS9F1hStiui11goegs9WteYAjwsre/iRKaMWujzlFvQjmB4J924EztxKXGvwAcN x6b4WHvN9snWzFl7ddM/+h4ErWNZDkc4ibG8MBM9yiLChIe53goqtjmjmAlQII4VbVPz2D+G 2DmSMiPBHKY9BsFt6/3UZwOb/miD5r50AVoFUsM3tjFaVdhh1+UHHKhdkxctsN0EWE193Whd p7Zc8oT3GjL6di65ht5ehHgCNCtMEK+btVSduslHmyXHvZEWwIBGW5y713Tx/tD7IVzXVSYK km0EXUgo6wPn3EWUJ9Cbw0m0W3F2YP8oJ2UFuUxiuEZt1qXbevF6CQEFhjW8uqoTOi5aJYpt 0s3GPQfdgXuRW0VjnCfGwHvCEGKLKsf86rrEA787G1B4HlQVMRODcq1pQzPNYmkcJQWWWpot mIAj3Cc4XPnUafQZr6p4dzCfSSwtgPt38uFlyxgA1PcjvCnHIfxBlHVOUx6JrSM5ZraMkBVV uBIN/cpJ0XHqVNqcd9EjYHkCJefECF4U9gZ3cOsbRV95f2Zd2iXdXkRbLevoHPT/NS7ju03R Lv7KhtrVvd7iI4kZ0Di7MX9QzlKqPBbkmMYK4TBi5lfGZX7wEpBSAf5riWZZzPXeFUDV+M94 Fb0AZKqhgJLg/9VS2pkfO3yHUTWmSlBEL4pmRVkMrMV3T8ezdxgfClp4MyVcYcbP6MOjss4W N8jUxi956NTIKPLE2jl9tt2tPxSrXfTc/IU/sEGJ0USwjJM44/APy42VAiY+/G3WE1ksVP2E hGydHD3DkhTma+o1sJey+olqLw2fAZFxNfkaeKSlZMTK1JhjDnWv3dckiXjsU1Y+OInIUDuH 3YFT39cjor6vmWi+Bx76jwyMKlwBrmqDxFic8gnFQB2ymfMu2s3N8bwjS1nrEvwwaiw0vu3o IKJwk1viIrrfllqC1ZLbJzGq5nPWyyZ6Othfd7iPs1Tgt9vL7l9v9piix9IHOHI+/fZksKfL elbgFbQ5N6wcq4LidbHBumTuPNCOEWNz6Hi9g8oz3sVGil0xDuQOkxaU6IHlfuRsOWy55cMa gX0rkKrunfMuOqGksE3WePu4OjCdqLobB2XTHsVDmmRg0+bu4L45q/VwAgH9lJ2yT+yxUxOv qeyUfWKPnZp4TW2n7CPTdqp9zYQFsiJHWq3Eu2MiH6i5JR+o+WgfAD76zwysEMP7VColLmSc qokVTRWsznnXXiskdOspjq3QGF44iGhthUZE91shS7BaUPskRiXgZr1s0grA7u1w/zArUB/q aQG+1hQMCy6Ki16GtF8a3MWLK0SyU9loz+bu7DmU6qzm5lP9oM3LA13bB7YCJO01Z1X7tOqS 6G1T7gHGY7deNfnbgZWZvPyMMi6HTQLPGtd+chJ6t6l1hDQWaG1o64su2hPsF51kdtfc5g+x ttb2u0pmUF7dJHfxvj6X+7E9LrXvgrlq0oBkc1KpuhvN7wxIIdC8z52BGcAtp5JKftYKZMHk DE7/8TO2zMJ9+zW0z0qHd/O1/2cXynXTBqydDXtnTdT0fGmzT+2ldfaLFvLvLMzi3jbusv1i mt/a1WirmCd6UEBCSQz1Q5BlICDwY/OFu9/Ls3xYr2ifhqeQ/jnvmvDyNNxgMDZPP98hXNe5 nLugAYtHkYbKIYgw5lpGp3dnzPEeFMI+sce7m3hN5d3ZJ/Z4dxOvqb07+8i0d9e+ZsK7szJH Wq3Iu2MiH6i5JR+o+WgfAD76zwy8u4TBpVszMYY9yP3ku/Z6d1CPRjp344ZKB9Gsnbshzf2+ naU3D2EQ++D6yZftNRUt8/5cuwdfyXvZhJD4ul1rUMZ+l5xwCdoA31V/e5jABMuh9HWuwPZr f8vGrBhf7APsp941of0lAvbD9fu4EP9RLKQJovczd5DTBhg1VUepta4a2AD7RGsDes909CX1 msoG2CdaG9B7pqNVqdfUNsA+0tiAPset7u1E1qOn7MitxCcifPKBmlvygZqP9oF9Eb4ZT6a6 eU81kYAS0zjz9Lv22YDqgAptBNpbcdzm4JHk4Voy6SK/1x5Ygp184aTs9iDO0y+bOLWaxKlT doQafTQdVBdjQnuMi282zFRzFxvjgogDCSkGW3nvqvBASAAq6BrRTGvcD7ihXT5tYS+hKsVG bNd1UFad9dGdd1e98PNOyGjPg1f17pDBHxOxboGNE7ftCSELMXiXGy78zHzeA5nt+Z/d79iH pnsrKnZHsfVvTesw2/q0jW67rV/WK1sHV7Xor8ElMgfxyGFwmUP1/mgce/0QS6/NN0/qnj25 hsl37cs1jFfuoxyRx/Fgcw2zdbfTE0nwOsCpaDSpLgycjEYnXlN5IvaJPdHoxGtqT8Q+Mh2N tq+ho1Er8iZbreT4+2SynGDqAZScfWBacDQX7QMUFStY+8C0XGkq7QMUlUru9olJsbdU6vy+ GtUAtIQmqhWmH8K1/H+TciWuDQplbmRzdHJlYW0NCmVuZG9iag0KMTgwIDAgb2JqDQo8PC9U eXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA3IDAgUi9GMiAx MCAwIFIvRjMgMTIgMCBSL0Y0IDE0IDAgUi9GOCAzMCAwIFIvRjExIDQ2IDAgUj4+L0V4dEdT dGF0ZTw8L0dTNiA2IDAgUi9HUzkgOSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIv SW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA1OTUuMzIgODQyLjA0XSAvQ29udGVu dHMgMTgxIDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNl UkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgNTk+Pg0KZW5kb2JqDQoxODEgMCBvYmoNCjw8 L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggODExMD4+DQpzdHJlYW0NCnic5V1ZcxzHkX5n BP/DvC3GYTb7qL4cDkdYsnxsLNdaCbH7IPlhCA7JCYMADAwl899vZd3dVZlZ093Q7sbqAQLY 2ZlZWceXR1X1698/nk/vDzfn3W9/+/r35/Ph5uPx3e6H19f3D397ff3l4fj628OH093hfLq/ e/3957dn+Kc/Hw/vjo+/+93uqz98vfvHyxdlUcJ/w9BXu3LXjm3R1LtB1EUpdo/Hly/+61e7 u5cvvrp++eL1H6vduLt+//IFUJa7atdVRS/J+nEsumF3/UnS/On7bvfhSbLdfVB/jeavP718 8cPVbv+33fW/vnzxjeT2Hy9f7L558/XuNdKIr+7P5/tPeDv+eH9/XtqOetaOeuiLtt9VQzEI 1QylvVH6m+vv/zLVe6W0puyLrkKkXWKii/q5GbqiHWVfSeFiV7V1UQ27qgS9vcK5dOnh4F4d i7ZL2/FVc7W7hp/f76r9q/aq3I9XjfrXFv6s1Z9zY69QSbRt0QtMpVfbihoIUZVq5H+W++Gq KKGpRb3vr1r1rz9ewe8l/F7Dj3JLtdq6Lob6F7FAW7eoqJ2cMY38x5sfrsr+x/2mYhtp+AFr 4WxCaWn1WBd9Y6WNxdilpkIGVVoj9yJtiHqMzLBYZFPWRYfOvaQR2g5kGFFtUYLdYyNkUCHd Yl7MVEitdCCvL4TsTDHAAJA/W7miyiE8inBh3b3+/uFwB8vhm6//8odd+frfDncfdlfHu1d/ +mrv17wsXlr7Rht70oBRDivZAkC5BCzsX9VXBfz4w7eFXMJ6/Ucddek6JcauqASqBG7GquyK RlixTSN7oWXtWCF2zGOGtqGqy6LF7Tg32GppcuDVmLg7WHvfwY8H+HEPP077qtEPzk97MTfq Bhp1TdEOmEaf9q/E1eHL5kKHshi6zIGzhbimaNA2Kls/SuxT9j4fpSujWv0A80Y9vD3dHPZV eSV9GIBA1RubK1l3Jfh5iJJqVBzOhw/7V4NUVmpxkH3TXT3tJUbD3H6/N/+uWqH6bScdls/w l1L48Bnac4bh9NGNLvWGGmLA6PgOSBQ7xeDejcfTe/hHaQZlgs6aYLx6C798eRaDmJnZlsBk bo+D6iOl5ekd/FRq3h7fgnb3++7qn8qP2VynXkIgphO+4Amhp72W2vdFPbDrXY2sd1m80AaI ricWoL8+gPnCYX64jUy4ToEWfIHcqR8HGV/Jv9QLBsG1EmXR16EO738FPd0W40BRQEPqjqJo ayERLqQoy2ZONHMO5CuiDrG0xvu4oX0DkhXrGjQ9tF9bmPIK4phmlXjrFETieX9ACwwmJWE6 wbgDJC9uzUmbbhU8L9THoHOkkAVmu14jIHb+CD+PO7dCHiQAVFeHp/Pj0YOIARD5d4QgCgp6 EgnM+6c794YCGQ1Sd6AhYMvpvFNr8/H8s5J8vNO6b2wv3X/Sy2on5jLg99GhmgY+6LIA9JQR FdKrx+fTzelB2VnpqjoYR5RlCtdVUwxjQmMeTLRAv/4Sk6VlsIRixUJJNDYvQpFFoi2I5K4x U/yw0CFXuU4v++qHW/T7ounsY7n6dbWYEjhkQRjAiOjtYzMgJgQOeBAG8NwLkLapupmKFpcc A8ClKYlupDavxrbGJgDDRqAEVkmUwCrhCRQ4Tmhm2FiW0G152NjR2EiyYrGxEt6Bo7BRYNi4 TLzFxkg8j41aYB429gw2kry4tTVtulXYuFAfg42RQr8UNm7bnFoOjnJMNCcK4T5aQE6CmInc OjJwk/9mIjfTwsPmvaNHS6kSvPPOWRSyLR0lOskeKcIDrBaYBbADA7AUKxZgoxFxEcAuEm0B NnehSgKshIIex1f1lIJX5HWDruopBa7I6xZb1WMCWt3rGLJquxLIihJYDVECq4MnIJFVWrOD lggwZy/xxVMmB+uIIyvLikLWTpqlG8vZPJsgaxJPlwsdJP4OKaE0nkrUMAJhAPUjZ7AKy+Fn McOXpnKALGiofdG3jXr6+CH867sLgVbSQcz1US8NtyEKWgxzMKgSf0GYdvoJqDUs6pjuvX6p 029rdFWLTxvAiQqb3jqVFGidd09HYKoY38N7nh7+7Xw4azlo7Pl53+VCXwo21vdNPxZNRtdo rAV1bm7vbV72s1P0+GvXooDyHhT/Cf4+Plow/jXQeBzXkaeMQnvN7RZ6OmF8RfbO/X3jYtjj QUeyHirSALvcUo1c7uoqtFQOvg5uzsufbc3OQKz6k8OLAFgBvkG8fLw5OHMZz1B1qrJoXAxZ pUMrB1rX5S9hSaSVQGEzmCWEJzOotY/FED0e3NuQ4xRiShBAWZIBjBwRCKij9xVW46/3KoWs n8PAK/spRQCVmkM/jkNM0otQh7KsY5JJM1Jc+qAlfQd7hqa28phs2lKWIiYxHpfWpBnHcUYi dXUjRT2Z+w4yQiSeQ0uaISQoyyrhPdTdlEbQ3kPbgOJ53kOFFSZyeLHug3R57Xpbyj9UaUD/ hhRkV0mF2GDgpXrvxeYFqm31gNCvnuiR68ZoeZluDFZuyGLGQiXbdTneC4ZNC1UTI+SmONVw 52Gh2LYqRn5YZbtoYabCuGsi4a3dPLpirOJ0Vi7XB8dUuWjqiZJ6utnBv9KOWG/9sPwcxMa2 NKML9soNhDH/T3lgSsK2doKNm30ztRPlsfLumdYjzz3DqnE5vFj3bL4qLvPOFqlgvbPMhTly zhTYdzqKT3hfsObrxwJGecJ7qvD3ndve2bxYP8Z+TzOEHMBbiEgGp6S0TsKnqbspizmJbqa2 L+7ToM+tlp4A92lCGsanEVWAxFUF3Y6PX6xAlsOL9WlEQy9dqFOzTKx1ajixM69mUx3GqqjK DB2SOxJXiDV+VCA215HSAs0s4oYLVpvKYsZCHT9e1hRcVuhn3BpOvwX1l8OD1PdBou+tLVW0 F+eKNNqqXXu3B6jkENvSlhuhaZpirHgjWIegU9vkvGd33FofqIK1vD7xZvq1crssO+gNlMgW 0hXiBwHJAlb85t2vjwKwctXYVEMVut/u3iyeY0SKaijGmUoXeH5efze01UmJttS1kQDpE06i Vll7VdyqiZWlc3gRTuII2ZZ4yc8uki0W3ZbSKanz0SbpHUqPxqZ6rOszcxA1ReAghjTeucK4 BGGFz+7OiQIfLMgrpagGp7NzFic6e0ctSD5FVLrt2upKa2/0oFXoc6uuJwDuUxqrSUgjZjQz l1FOpCo3C4ZVfDNYsQ5jU80G1Bu1cEhfDc07LZInvbRGpOTx7pKSl5l2wuqNObwIZ0m/HOhe dMGa1+Er3nrRI4xOL7lycqtA6pvTO5cTcLsc5O9qm8Pxaff0USVlprmfuZN0c783VTMFJnrj hC7XnU+H29P5i0tXGMgZvM+ElfU8HG1ql0YuhEPPGyZ1jHS++Z2ruC7sOO1g1yWsDFvkSJQa WSmSmqtgEazYDEm8YCxKkSxRwWZIcteQJAjKNZoBQU1BgyDBJfCweBD0fCgQ1FQkCIaMUBBU RsfTJthjq6x7jidNAhI6Z9IOErVbCyONKOT4IkY0XQhimLEgKMeVnaQzEMSSBkslWhiMJLIw aCSa8cQajKm/MNzYZS3Qn1zWOGD65LbBf/H57Xc+nE1XKk4Qcs8Cd12BUL8egd8/NfGj2woi 0c/L+Mkl5k9vgeL2qAoUNx9BtN+Wf7iRGGeYKOrz6cYdgwvjLlB7eohvmllAwG9lN7Rj5042 8XtGJArvfK2G8QRkUwJXAJI9ikfCHRjnhsje5WP71W/zCTeNHt7uxWSDD/TKL2nkZpS+15hv ZDlYVPXlJ2UyME+D74BZqpSQ4NdeoFSOA0Sdb9pgkA5t0VQZqv77X69hIKiU42/gdgxbPHQb zfxveoR+cgcz/TCAST7J0sGwee9+e3QpvWAfczAjDk87pYWvYqp39TTQVczf38EydgBBuvTn 1fr28R7yh7BE+S3Qm4+BZqjhvWzDsr6lUUS7Yyy0UCd8WGZsciVCxkuSKwtl2+xKLionHcuq dxmEVO1NPyZqb9j7Lgzpg4xdsvbmOaC1N02C195CFsnam7GwehIY2LeDIDB6BhSg54zIaDIh EnOimS/ZV4EzVlUFNXqJsz4cK86PbPvGTciZH5k8+LpYnvEiY3m8F6nl+bwvZSrqbA/Hi0WF QPdVHmRWakO7Hecj+I1+k4rB6ERGg3QzfI4dXdgXWaap5fyp8i2D48pC8UPRXiCeRxWthst0 U0ONOtTCsOIyFolZuSRjsUgFk7HInqgpYGkl2nc9lbEwFGTGguLi3BFFQmcsAj5ExsJQURmL CSMsY2GMjqbt8edWXU+Apu0nNHTavhUSHxuX/KYPatX04ReaF4s1XYVjDbd1dKHocVC7PWLR POxogTaJytxUwSRkaWbkKcE+abgtEMYiBrKtIONOHRWXDOyNCGPyhGV4I8Kj3yRobkNAgWKd JYV6LbCkOpMzv3UBlJlcidBRNyKovZHz2xDspUE44i1rSC1bMIyJhvDYpgWaBDYznpl0PMmL Rbd4OC9Ct0U6WHjLXRCS8NaXHLxpChreCC7OKyoz4M3zoeBNU5HwFjJC4U1bHc3I48+tup4A zclPaJikfFVDcslntduOGNZMTp7kxcJb08+m5BzeEGRbJnVs1NiKpaL5/4VyDIJGcngE1QJ9 rojsGi77TzJj1/1A++SGpCVJ/4yb8QAFUti32X11WZcdvEpdTsSmoNcZXAaGdU8YPLwZT1+w EFxYN+8I8vKDFboObSFaXtfnslEl4bAl5IbZZfpUxFJF2hoOALGKbC9XwFZZVq66dPq8Oz3t 7tyMPO+Us3D7s95C62aMGs1HVc84Pj3trV/mh9isgqOHHXjII+XHuTx5kHAPjsSoMtN77ae4 st5HV3tDq4Fu/m09pkVTqwpQaNp1KRGth8tPk4s4c9CF5MWl2WMEuijNvki0ybJng1/SW5TO jA34EW9RU9DeIsEliCh8Dg3zFj0fylvUVKS3GDJCvUVtdZtZN0YPWoU+t+p6ApN4D2isJiGN mNFMvUUxqEPUeZsYG/rYC82L9RbL2k3QS7zFhVKttxhJxbL8S+UYbzGSw3qLRmDepsmGOWJC M2OBOdD+Qm8RWcyX6gMB88Drc5mD6k6W9M4Pzb7Ua8zzKUcmu5N91+XqvhRjVdTUMeNnvvty eQNqCeFVM23AKiQ3emTtx2yY0wgkLxbJo9XhEiRfJtoiee7ClERyCTRVRSK5pqCRnOAS+H5V xSG550MhuaYikTxkhCG5sTqa98GfG3UDAjTvM6Gh8z5C2mZw+AT/o9KZ9HEEmheH5KIf3QS9 CMmXSTVIHkvFLg9bKkcjeSyHR3It0IxermuY4w80M3b1D7R/7rzPOljN+hJBCEo0EmMfIcDv slxv666Dt5mDrxffbblCr05dz8Tq9Vz2aEXRUDnH/PTOUkV0eodVZHu5Kr3Dyv1l0jvbtq0e JJr1fNv+N6aUFjbZpJTCJifHTWqjrmAK40tHmN6RJeCrfdv4xloP7VQykCWY4ijJi/ONY7y9 yDdeJNr4xtlQn/KNBVw2OjqvVl0hN/WNDYX3jSc01ovEubhoagjyonMi52wOYdooRTU4na1v PNXZeqRDmFuKqHTbtdWV1t7oQavQ51ZdTwDqTmmsJiGNmNHMfONKcvV7ZRr15Td8ONNFUYYZ 6x03pZuiM+8YdVgXSjRbTGOJvMeqJQYROmkwplTJcGMXtUD/599muuLky6tnvuAWQ7GV5q2G QowZ5r2w1rrwhjUxvWBN/pjfsAaGVWpoJ0Jfs6Y7QPjvy+TcsDZw/sFCyzZyros+37I8GmtF fIqHnI5M0Ylmxm1WSqxfSzYrLVTC7FbKXtKSyCy7sxmprJWhILNWFJfAl2tGJmsV8CGyVoaK ylpNGKFZK212l5WKjn4QBFZhT2HzVvHRjwmRmBNN0bkZ62LM3ZAr6BoUzYvFZrifmNwV46Ga 25+7UBObZQo0ycRsIzBvf65g6kU0MzbSZ+24BVIH+SUKtDe55jSx+Sh53Ty6ORZBmHV2bsYW vgHz/+CW04V2aqpR7SkO7bQKiI0eWXuGBVMyInmxMBwtEItgeJkOFoVzF6kkCldtMZC7QAwF jcIEF+fEKRIGhT0fCoU1FYnCISMMhY3VNcg6o/tW4c+NugGBwuAJjdFkQiNmNDMEHsoAq+hj XoIuHZGsOPxthoZez+b4i0DvIh1MHYnVAdtOvFCqxvtQai7ea3lZx0AFU1QiebEoxPbas9SU yPOdbEDdJy4B/aKLUhgELbJRIwdH2/I28lHtu7kNqFtAFyo19JDAZpVCLwFdKHYss2yh+xS/ A3SZdFH2xdDw0jceAKKCL3vwYmcXsPg71zYfklAkgBvAQ42WXQBqx3YL+3LaEj4ZNwe8hAul lc45UtxixZIMVlxdIV5xL6krLJJsygrZa33KbQJUF6TbZChIt4niEnjcgnObAj6E22SoKLdp wgh1m6TRh8qdFA6zDu65zV3gHFAKbT1NQVsP1cM/x6QEM9dnFjHrejnm4HOcjQlkUT2gqcge CIWJuX09TZDVITgRVKmqaItVEOViA/8NQw+TqJVxXFPvBqhy5s049b2rppeTtb+wUNtiVaBL VJJ2bBGdhIAFJNCpi9aatZK6tmhFLGoHfJuq3l3f/HCVuNVkrdhez524hTGOrRVVVU3RJBtY SwiD9r35/ttnEKv3kcQtvD5+erhVSSXpd34HXuXxH59P6i6q46fj3fkpXci5RJ8hoU9TayCe 6/Pbsvyq+t3WrW8aGfbHVn+O/m1EqXZDxIY2rjGkopRRHw6Px7sb8Jxit3GtFqIZ4IZztsHJ ZQSrjW6zstVzV+IaTKASmTrwCWKIp6P+1sNObRq6hZylTggGt/z6m9Z0rVNGZ+eP7sG6Dk5F kP2oXNF0M3R61qV1gx1EOtd7o0PGjXWqG1FUfUKnzVtfy4nUjVjrj2qPpImFTBj7HWSU/wFt h9Tz6dHTHe1Wqo11bJoaSpmxjj4jrIrch6ejD1xNJN6Fe7XscLTJcTW8YB9Yay/u1APwvUpE 68Hni8nyH8xvX0sTRGO3dRnkxv0W52nWTrm6TA/WOA+1WhLUy/ghmFxwsOrvNgsOfOj7YpWw mt0lKlWp48q1RP96GGC+zqfP4S0MqzUdk5BYS7e4Solc57wlJUl7twlJ6wZbUtJYtKk2rfMM U5LqtijjNoG7Jhrtrv1m+y5rKpCGjJLHvUYYuJzmAbBFemx3N192cA2BWYUfNFpqh66qwKNT e4EeYS2Wa28lie7OsOysW3wTuouqhk+1xLqnJp0U11VFLWNY6fuqoz1DYSrPgsqxYJXgLGZG 9YTuA3xHQ74B3/2ZBx/DMKje/k6u9nOTXSA2/UWvlNQUeF8kCKKlUMyoPn7Migmz9hI9ZLxu xIFjWzZ856DXN2Zxw3unhmtS20QDruWofjyoq6NhU/mDKirqQxtyXjiEv7aDv7p6uD0olFc+ pvZSwEWR0+Lz6VHRlGqCRDnMC5qQ/KDUCF8fyunpyyTNurrpa4h2Lulq0amL/I28vixqvqPR yxMzeOHdDLlOGajGyr/Zw0Y68NLe2d/Ofluj/xbb69iaKzXq+6KBt1vokjD7qtxDyL5uK7At KwjeYoF3+lzF1uJk+Fil2peV4+3KooVabd8VNaQF1Qfa+7qU49Wmz3JIzMqmSfTKNqepKhV5 UWzstNEkZtrMiYTUB0YYwccaVJMog85J2qZSo8JzKROy8qisgXT/KY3mO91M23EK2yqcwuri KUAHZJ+b7RBpwnEwHcJ8/azFKrY5vNBFEz7+B7YR6nNbE1CGneKAyd8U14nPRq2SOrRFn5Ca g5Zanhl7jMk69GhNDjOiyq3KZaH2ZLks/3Obpkg9+aa3TtXoY12wi60LvuOttlqdzoe3upCu gua/u6K3kvHzrQ6aP+zti/MvXBg5+uyh+yZE8vyhurZg8gWp8wlw/ymxYXqViWEjUd3nm5iH Xq2HWmu4UYMeXuJZ4Q3qW7V+RCP+wk1aK1Ro5SLXiNU2TeNTWxctjT2KgoYenIlz2ICCAR6c iwNyoCBhx/Gg8ER3gpI0u8bYtAclsKqiBFYPT1BOpk8KS6p+GrZQQxwrZeXwYrGkkUqHQ9wf 3712v1UuK4dDyyIlRgm/XUIJHlm0uCAYoAyIHnDKYYYjC9zMhFlw2Qeb1+nTqy9HBPokd6o8 P2YBda9wyBybghSyfWgQye2XOic+aphGO/QexePT5qY0XQuLMPnZZ+6yHRxql/axqmWFinFh 80JBA8xrXlACvLVAF3lRExM96sSzIsBbbdOJpuUy7F6iQQuf4BPsRLwIsoX6iKUFymoc+wiz NYkD7QlNAHIYm8AHhF0gDrYnRAEWYnwCr0eSWOCekASAabiUCVm26boLXBQXB4IogdUWJbCK eAIbBuJRYCmyo8AOq5zk8GKRu+xn3ikN3XFBbZUWFrojLXjs1vIyo0L0pFMOM3aBT9twFXgv VMiAd6AQfunMwWf4kuDdxxi9hzqHwWm9u2Bb/WsZMtUVr3/0ScFFvsEYOC+DKTp/1jWcJrow enJFD3x+yB/rNu4DjtLLjCFatUuQnRsbCBrgtUsmoV2etcCsEBs9CMWzIlBanUGKNc/bxrtC cls1Rc8P1IvQueq4gFpR0AE1zsS5ch0fUONcnEvTcQG140EF1Nr2RECNElhVUQKrhydgA2rj r5r4k74MssOqNTm8OFiuRnFJQB1X6VcpYVA5UoIFZSPOhgmMAdHzSDnMOFAOlE/OzHUZ2rd+ c52OU01UG11e5Q67pi6wCi/mMl/fNfuk1Aa3n09+c5P9km9nNuY9OmAKtlcdzloJuJPj6NFd a/6T2tegD1C5a/R8jK5v48MRfWVvDA0dA6PpAK1kD99zPc+3NB6P7kSXauhxen4K9pnNu3Sn 7JifHPDwvrFhmmaAI0GsYf5lc7mqZM7K3XogNEKV0Fm5yVqD6Xozvs32Tz37FudOFrYDnKWy nrQj01kyAnUWgF4ae/TME8+KS2lEq/qilMYiDUxKg1uaL3KaSsGmNErBpzQINoFzzac0CD6B u8mlNDwXIqVhugBPaeAERlucwCgSELApDVjphXU1RFeUAzG+sXpbDi/Wd+orsrCNpjCWSTWF 7bnUHG9JyzMjijMZVr/JYsYVtkPt/wcK23+3e8WT4O8L2EMatMO7c8OY3B+g9n7YJ3dn6OwC Nnep6vzCkr/bC14SyukDEbO8AgY463oIrkeoM3rIGkf5jsrU/q6X8EPJyhCaQPeRvs4FLPPJ OoXpO2Ttd5Oh8eeDguT01av2vmXsWpdVdmnKEjbEZttle/lqF3y2fDVzDt7etMeqv3Ot7kAS 2VHHOLkx970+CNXFscbzDFAhwT3DDllhjp1MNs7p02EO8Phib/7+6AblT95O4bkTFeZs3Pi6 V18ezW38J68Nveb1Vz9euen0fjpp2R07btVT9mVWvOcZDI3KXWasVrPFNnfVGpYsWh1cprBz uIWuVz/uHdJMo87p2DUzS8YqIkJDPX/x4GPhmjNW8Gn3bOvyMYnWQzmjnAOC7X/IYMXGJJHz 9AYNPBaJkdFalZASjL68qGeJcBv15LpYl4Q/1VAyOWNNQeaMCSYuVi7ZnDHBxcWMJZMz9jyI nLHpBCXJd0LYHpTAqooSWD08QTmZn6m4R654VWYpt8e2KuTwYuOeWoDuaNyDJ4kXSbVxz0xq Ttyj5eWVbnus+p3FjMWpQPvt4p7tyqtR6DM9R6tzoEOYAjUrWheD0Q4ipc66nJ2rizLe+TL7 NkMFtxFk25dHKq1HTqmxx6r9GawIpBrhEpV4uF9SalwkGb5aOq62ZBo+GqhiUskzTUHmzggm ztsBCjpzRnBx4AsUVN7M86DSZroP8JIjTmBVRQmsHp6ALTmO0rTwjbSckmOP1dBzeLHwAR88 40qO/mQ9uod3mRK25DhXggUTIy6v5NhjNdssZmyRa678/B4OvRCfziflbDbTZRuLIXawXk8Q BVmpFypfC/VFxUj5+Re3bEnmRt9D0U6iK5tgCMij2D6Rm7BR37wgOSsChdt3uiAadmC4rUVs d5ali7K0ScwVKg8ubvQOgWzXxkrIyAjqTJESm7e27+atTX9OFfcsth6RcO9YlWg6Gk4vFqSH /rPbWO2FyRAUuz1GYFbRENtPkcGK22EVrQ6XeD2LBOsNVrl4kPZu6qoQdG3QkND+DcHGOcmK hPFwCD7OP1QkpI/juRBOjjE5XhvECYy2OIFRJCBga4NyLetCl4D6csmA1b5zeHFOzjDA5RvZ Tg5aKlymhHFyIiVYJ0eLC1Yd0oBYcTWLGYeKkfJzJycBkp3DSLTukQind2pHUhBGq9z+5yAF S3kkzH4qvFASRtgb+SHrLC7xeYIZsRe5sdiuU1s7ZmI3b10Hl6QHYkivI1Ec21ifumzg7tN5 s1GfY7EY/c2jZ7Yu3O3Ss2Jif0OLc1BNrjPYjoQMVpy/Ea0yl/gbiwRrfyN3aU76G2OvMqKU v2FISH+DYmPdUE1C+xsUH+uZaRLK3wi4EP6GNrlzFuJ7NnACoy1OYBTxBPwlG11diLyM/IBV tXhOnK/RydW7w9Px8YceV4g0yfiZyAzPQgnLy8QPWPEigxWXhw8Uf740fPJzwqeDqp7ffnF7 qQ+fbS5GUZlvL9+o70m1k2J0sjhPHDAu0FV+ke0a+MzIeEmnm2mvpOVk0ges+MIy4vLokdKX LPALxOokeu4wu2TV7xs40Est+pqCXPMJJtYPUBT0ik9wsdCoKKj13vMglnvVAYn8t31cFd2A mISnMKugoiCNhmlhH+My7KxTFLRNMSH2MS7EDlZFQZnciYiLBZbCSUl1ShaRGsD/DfwXxlEN CmVuZHN0cmVhbQ0KZW5kb2JqDQoxODIgMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAw IFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9GMyAxMiAwIFIvRjQg MTQgMCBSL0Y4IDMwIDAgUi9GMTEgNDYgMCBSPj4vRXh0R1N0YXRlPDwvR1M2IDYgMCBSL0dT OSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9N ZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyAxODMgMCBSL0dyb3VwPDwv VHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0 UGFyZW50cyA2MD4+DQplbmRvYmoNCjE4MyAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2Rl L0xlbmd0aCA4MzQ2Pj4NCnN0cmVhbQ0KeJzlXd1zHLeRf1eV/od9O24qGg0w36lUqmzHyeXq dMnZrLsHOw8rciVvhSIZcmVH//0BaACDmUF3YzAr5+P8IJNET3ejB8CvG41pvP7i6Xx6d7g5 737969dfnM+Hmx+Ot7vvXl8/PP759fWnx+PrPx3en+4P59PD/etvP7496z/9+/Fwe3z6zW92 X/72q91fX74oi1L/1/ed2JW7ZmiKSu76WhZlvXs6vnzxv7/Y3b988eX1yxevfyd2w+763csX mrLciV0rik6RdcNQtP3u+oOi+f237e79s2K7e29+G+xvv3/54rur3f7Pu+v/ePnia8Xtv1++ 2H395qvda6QTXz6czw8f8H787uHhnNsPOeuH7Lui6XaiL/radMNob5X++vrbP0z13iitKrui FYi0NSZa9Z6rvi2aQb0rJbzeiUYWot+JUus9KpxKFx8O/tGhaNq4HV9VV7tr/e+3O7F/1VyV ++GqMn9t9K/S/Do39gaV6qYpuhpT6dVlRfWEKGE6+T/lvr8qSt3VQu67q8b89fsr/XOpf5b6 n/KSajVSFr38WSzQyAYVtVMzplJ/vPnuquy+319UbKUM32M9nE0okCYHWXSVkzYUQxubCglU cY38g7QhquWLzhZZlbJo0bkXNULTahlWVFOU2u5LIyRQIa/FPpiokFnplDyFKVKq59Rs6tud +rdWAkXR1OHCunv97ePhXi+Hb776w2935ev/PNy/310d71/9/sv9uOYl8QLtKzD2BN2qotHo priUcrmc7V/Jq0L/c+1/qs3E1j+JxZvdpstQFbJFdcGtKaR6V72TWtV68LHmFIg505ihfRBV rUixPhgr/qANeNztX9VXt+bH5/NpX13d6581vOn/m192mvp4v7d0j/of03raC0t/3n3Yv2qv Dp/2rzpFP1z9aDg+Gap3+vnT4a2muPuk5RmOh70orz5qCsP2dN6dA5UON3p1Pp9+1P87nT+Z xVsxNoLfud8+aNLTre/D3dFIedi3V3+DPhWLwbHRsnUlir5KHB2XEFcXVbN+MNbqAeGnQFcW kh2KEhmKKaxw/bu+aFtM/z8+6tdlBpsbeXcLC26S34iq6Faab/QBv1S/mQfaEtYnJb1WqNJJ +Ecr8O4XfLNdj0wzLEeTdiEGYyTkcTeETLMdQROCWsmvJfq8M6BpNvabNDdqRFeh8uWcP0/h DADvyDQF7yjsI07heoFTOD1GinI6mTTRHNyqphDW6LKaxgyzCVAx0EZwYoGtNn4TDMAkTGs5 cMvRRpSlng0LZXhQM9Ls2GPMWDOQRrHCNVc6a393ofrfAcs+eU4asRRWnXcq1LgFYYed/r9R 6PC8Oz8ZgnvN63mvkex46582CHjvEdD87d5rpJiq5rf6x09e18Pz814pcwu6YVizycJVp9yf 0MLHg16db374HDLbQY/HhcgYrluz/A3myEXVkEI520NEjwt3V4quqBPkRHDcyDNrNzP7GgbF cUYshi/m3ir4zhBswTt1uZridgBJggJlaCdQGWMQeHaCxmWMQ+DZCAqZx+dR4DXWNS2jdcNO YO1ORazdqeDby8mAjwGu3gQJoy6JD9aWQVyKFQu5shl9vjWQK1HIzVLHYu5CGx5zQVwQMhCW 7BjQJXmxmLBQ/udGXWwZzuuW7AezDs+6pbeLYLfoE77wZ0ocuqJsIob86Qfd7eN5L4S159Po HxjTOizs4iHuzr8J405oJ8P8yTz2MIbXEIVrz6EFAuev4Fia19W66czWAzfgLyBI/SlBUARN QaAPJYl51TNwSnBi8XSh+Co8zZFsATXVYnFA1TsSPQGo0E4AKsbA+1amnQJUjIP3NUw7Dqjj 8yiggnl9FLrsBUrglEQJnBYjQTkZ9zFQFWXRyjRQHRhQpVixoCpkXhy7zDRtUseC6kIbHlRB XBqoCmyzO4kZi6oL7f8BYtmjBhHzu9lkNfuzd3e7mynKGObvR0VNy+lZqXJ+0L8/qXjYcp5u 2SouT/qno9nePert3RZkjiEwD0x5Ztf5yTZmdhyYcgX1en1dMzrdwgUCU4BJYJmDBFYsMi00 X4VMOZItMqWaLI5MakElQz1oJ5AJYxA4Kkyoh3EIUJsM9cbnUWQC8xLIhBI4JVECp8VIwCJT O/Qj3HNjFksxpPBioUlBQlOnQxMa5uVp4bKGCy1YSLLyEiEJ26ROYsbmCxfazyFJxxdHs50J YcW9/uP7fevRyLS0IRoZEodEeqm3yIAsupk9kLUaBlWkBw7yWjwT+XHsT5CF7JAkpHriYlnI zM7WaqYLwQ+27YKkKNqYVVkoswKToAzLGCSwYqFsofkaKMuSbKEs1WRxKCsVWwLJTDMBZMjj DsdMMwVjyPMOxUwzDmL+aQzDrF1xDMMJrIY4gVUiIOAxrKvHGITZXxfYBnsKLw7D2l4pvQbC uCxhnjYQXS2U4ZEMpKWlCQW2+ZvEjAuuFsp/RiBT9HOQiaUI1XJD5Qh9XLXME45qargJU4Rv dcsnp2ZSdnCjXbt25qFP04Nu5zEneZepmc3eLTW7tAls+o4VFAFDEJiSvxPYTn4CKw4MF5Ni FRbmCAYsTF1JolDY6uOQLY6Fth0HQ5SBd41MOwGHKAfvJnSAugggBs+jiAjWxTN4OIFTEiVw WowEbBKvbWV6VIftkafwYhGxrVdGdVwWL08dC4kLbXhMBHGJ0R22d5vEjF27F9r/jKCILcV5 PZJqDW6bSI8+XVpQL/RZb/bFX0BQXUgREeQyhPC/IDvod2o5wNVOg3M2Pvg3F0sLDvzma2b3 6rqOD8FL27GuOzXNV81Ut4qDwJSIVWKJgQRWLEgvNF+F0jmSLUqnmiwO011FRazQTIA08rj3 2Co6YsWe985LRUWs49MoPoNdiYgVJXAaogROiZGAj1ibctzK5gYrlilI4cXicyOzIlY0H5in jYXnuTI8OoO0NHSW2PZ1EjMWnefK/30jVpD5bt/HcoBGFuT/PAotc4BqtcKTgP0sB3jr40ce gvLsXNdSTXJujFxATKMErBiKbokCcUnwgyUBElix8DNXfBX65Ai26JNosDj4KPFkjAjtBPxg DLwzIrgYEePggVnQMeL4PIpBYF0Cg1ACpyRK4LQYCXgMku0YSDG7GhLb4k/hxWJQDQf3wnN8 leKjT/J9XVwXDYo1WVL7xnyJP5eagjYgL21/VGIbzUnMcLSR0gyVQPuiayrT+vQ+/O2bEc/H jxSip0z0oj9GIu60SQAyjvxdgAkmjdYCTIxJteAUisaIn04G9QwW3TxovvceSE5PXuRypxU7 NWliojaIoG4AhczO6XK3FYmupgcwMfzY9oJk771x8gU9jjYGVfXbMHvIBob9lnJwUPRH3UMw qvm+5HhUph7PFBlgN+/FbkpftoOyqnQFiOQOnoNDqw9eNR+sguNjQ1jjW176jcihLHoxUTgV 00Fgyr6vxNIhCaxYTF8sVatAPUeyBfXUVWYV2NeDxjIc7KGdAHuMgRsm0E6BPcbBmQzacbAf n0fBHqxObAijBE5JlMBpMRLwG8KiTg84sRRGCi8W7EUb+oka62UDp/bfKKzHM6FZQntF3i6E pkA9iEsMLLEd9CRmLJJ45YWffyKYe29Otx7xpjhpzq7AluEseowc4tQHZv7iD6dqePzpDqK6 4KDoLAw8qLAyxFjqGweAYFjtz8qbUHHm6aiBDY8T88xW9VKtTqzZ+MUfxCcFdNi+fwIrdvGf j91Va3+OYLv2J86Z+BovGzqgg3ZijccYeFeg4QI6jIOHxYYO6Mbn0TUerEsEdCiBUxIlcFqM BGxA1yg/p2qCcKilPpZnCsHQzNhVvqxnHsubQo/UcU9RBN8YIEt+pgpDqyAlpgK76FuBgX9J WpCp/cJw485yhvqrH9rOFL6An372df9gDqroxo9wcMWms3ZjcOVWdn3MUsb2DNUqJcTVHexm ksct0QBgo0mbQRaNIEwKJ0khEB1DFRORgUlQrMrWTC3y3VSxDD97XPCtHt7ZJwcwUzGG5MXC 1mL6rcGtPNEWuFInfhy5FA8yOoF2ArkwBt6rqbjoBOPgQb2io5PxeQy5rH19bNEuwhOCwqpJ UFhFAopyOiti6NWaqnZplV6YUi8kLw67ml4ZtkvDLvSUSp4GFrqWGvDQBfLStiYrpsQLzYxd ZQPtPy9wYWtxnvpS0deCV/9nBUuzL3h8p//96HYCmQOiG99e2+voCe8+/7XEpRXrG32Eh1UM x+Zcub0+0TORuw2bQY+U3cSKKQNDseKQebm6rELmHMkAzMnLWhSYm37Qn7KgwGzbcWBGGbhh Au0EMKMcnG2gHQXm4HkUmMG8+LYhTuCURAmcFiMBu23Y1FJXS0wDZaYaDMmLBeWm9R4yB8ro 2ZQ8DRwoLzTgQRnkJYIyUwKGZsYu64H2FwPltwHm+WJnd0eTwINDJDaL2CLfrNsYq18mEA15 LHvY0slDjZrhKZgxlzl+/f7jqHZ4VkbLOnxgXIttL6Gui2FIdC10/2e+RadPgD6YtTqwkund ozLMwfx6Pt2cHm3VujrI7TJbtzic/5vO/Ea2cM8nHRbvX6lWn5+c5HBBHzs+8iPrPJPrj/jN 04HJt6E36JGE3kzVGYoVi96LZWgVeudItuiduv7F0bttir4j0BvaCfTGGHgnz7RT6I1x8J6N acfRe3weRW8wL4HeKIFTEiVwWowEPHoroWWXiN5M2RmSF4velfQ+dCzrh4fRWVJt1m8uNQWx QV5ioVSmvAzNjEv7Bdr/U+f93PmWVlF39OmW+dEdEg7h4CoGGttML9Xoo3KHiDmMt3Lj6+48 zcsOGHMBwawWjzHLB+eFjPV7pg7S5PPTRy8C/KbjjYYAay8cTfMMU5VqSjW8YXgUBfkpKFoz FXIoViyKLpaGVSiaI9miaOqaFEdRtfgLQaAotBMoijEInC0hSBTFOAQehhAEio7PoygK5iVQ FCVwSqIETouRgEXRuq+KwRlVOfJUDf6aqZBD8mJRVE1C58vGUBSNe/OkOhSdSU1AUSvPjiLO ZExFHJoZu5SP2l8ORf//xb3bXkI9dEXdES+BjXu/v/JAR5btmX82GTofcLb2sh2UuiZdw3cw 1eNZ7UHA4dm9jcFxD8IxiLkQ/cSDUOPA6Pj9Hh76PCOib/X6ixtM19UIvp1aTJHRtTzAWXNT 6Gnc+dCbDdqnQh2h3Beunq4HXn/WEbLyDU5yKyRTX4lixTpCi9V9jSOUJdk6QqmwEneERO9z z+ofMQzdwhcCEu8LTWi8I4Gz8Q5zHxzsmBN5fwPn433G3p9omJN4p6QP0+WLfkHXrc2NrNHm QadwAqstTmAVCQjKyeSIeUedKFoXoQtRUOOYKb1EseJ8o7qr9LYI6hvVqG+UI9S6RnOhKa4R iBvPtFL2YioskbzYFXjU/R9ue+F4smu/X9ojH4+89e4C4AI8Ob2SRe+KT76kPZmvTKY72Hh1 vzwD1/q20o43MA8RIN4d3qVGClN0iODEAcRyjK8CiAzBgA/JcyuKD3oFE0Q5A9uOB8oog8B9 EGRFA5RDgJ2CqGkQPI8Fyta6+PljnMApiRI4LUYC9vyxLt3hw0y1ygzEifmaKTpE8mLBQDGp yRNcCbdP5mlgk8VLDXhkAHluZ44xH1NoiGbG5SlD7f8ljh6rRzoqus2zVtXX+jHWWtDz50cf jo0AFSLcZZVzr7IpXaASVy6oSBH9NhgHx0y91IIy9FO9NuVlrR6wGUvPmoYp+0OxYnFyMeNX 4WSOZAuUqUtNHCiVyKEhgBLaCaDEGHgfyrRTQIlx8D6EaceBcnweBUowL76jjBM4JVECp8VI wO8oV01qzNQwxX8oVixMVh0RM6G4mCOxUytlROJ3SJEh9dOvLip/0FfQxeTzsAzikgK2hikw RPJiV/JA938pUNZPmPBMxWOHs1ktx5hvAk/TYA5Hpiwz1/p8Sz818zZgAjUSwreGqQdEcGJh aTHiV8FShmCLSqkzLY5KajElwzdoJ1AJYxA4L0z4hnEIEJsM38bnUVQC6xLhG0rglEQJnBYj AR++KcySw7iwkpeNN0xBIJoZi0yy0ccN0N08tCJQpli3nzcTmwIPIBC7F35uNaYmEMON3dMb 9b/cnt7iyqnTQScbIecZXMKhn/roA5vTeXfQf74xt280xO0bkdQOntvjb+TINWHVGy8yHAIb l39QJH7f/XxcMMVjSF4sBCxG9SoIyBJtQSB1PsVBQPk9ZGgC7QQIYAy8n1BzoQnGweNjTYcm 4/MoCIB93RLeLr/EJCicmjiFU2SksDjQ4l9i1qq5bIJFlAqpmVoxJC8WBtQokuRHH03CPl6W Bm4fb6EBjwggL61yTMNUjqGZsSFDoP3FQoZsPEBX7Lw+yk4WQ8X3MfESqCgMwQGD2WcVPsU0 +7ZiLMC2/YrETJvoGKZupzbZBmKgR0oNnIapgUOxYiFsMQ1XQViOZItgqfM/jmDKLWuIjx5s O4FgGAPv7Jh2CsEwDh7eTTuOYOPzKIKBeYkwBiVwSqIETouRgA1jqr6Dz7gTslAtUwSH5MWi V6k8SjILFaKX+WnAYSxPFVFWZkFYqMLCmJWXlo5qmVI4NDOusnao/WeCsQG78Sml0LU5S/d3 ug1qm2WrftCzm8gOXexyqExFpaj1u58ougnRrB4p6aKWqY9DsWIRbTEj1yBalmSLaKlLQRzR hHqZxEf4tp1ANIyBd3xMO4VoGAeP9qYdR7TxeQzRrHkh2ePNG/QCJ7BK4gRWi4CgnMyHGKIp QGmbRERjKuOQvDhEq7puRTxmEQ39ti9PFYtoS1V4RAN5iYjGlMihmbHrbqD9z4Bo7goiHaf9 MFIFcAQApLP+8/aUT/xmlxO10buJ2LgIA45tltYf7VKWdiB+afFKbjOVvg22QI0k2GJqx1Cs ONhaTrtVsJUjGWAreb5HYavqW11CiDoubknI4+IUG+/mGBL6uDjFxyO8IaGOiwdciOPi1ub4 0QecwGmLEjhFRgL26EPViDGMobOiLVNPhmLFIllT0Y5vArChn9tlKeZwLVAsFddAXNIJhZYp MkPy4rYbeaN+hjgt9Z4jfayBuuLIXmcRXnFEgVXCTXt5tqyG2nyQFNpyG3KAGgnHEFqmbAnB icWNxbBehRsZgi1spE6nOGy0ZosZjXZsOx7toAy8c2HaiWgH5eAh1bSj0U7wPBrtgHXx/Tuc wCmJEjgtRgJ+/64akrNPLVO0hOTFYkQtGCcdxQg85slSyCajQoVSsQHkpSWjOqaeCc2MRQfW nP8shxMys0Lj/X/nnekpCR55tq4rXU56Yupt4AFqpOR/OqZcB8WKhY/FyF8FHzmSLX6kTrk4 fjQlG3YACR12EGy8r1EmhB0EH4+0JRt2jFyosANs7o8kLMMOlMBpixI4RUYCd6YBDztEk5wU 6pgaHiQvFlRkz+QyCFBhc0RZmrnII9AsFV1AXtqOWsfU+aCZsfs8rF0/X47oeS/axco+SQqh q3xenyv1tC6JyPX5/DTu8MXyUHVwJCHMQ/maJqbDkWSUPpg9yQxdtn/unYqOjie52pU4umbq pWOzYarXNngFPVJ29TqmCATFioXXxdRfBa85ki28pq45cXhVzg6VjLLtRHiGMfBOWM8ko1AO 3vXoyWRU8DwanoF5iWQUSuCURAmcFiMBn4xSaJEannVMwQeSF4ukZZMfnrG5qSzNHJIGmqUi KchLjNOYuhA0M3bVZe36L5mbWhed5Vm4bmozH0MLb8MP0CMpPGNKRFCsWPxYDPhV+JEj2eJH 6kyL44eo2fAMSOjwjGDj/Y06ITwj+HiordnwbORChWdgcyI8QwmctiiBU2QkYMMze0NvGqgw lSNIXhyoyEFuDs/QvFCeZhZUQs0SQcXKSwQVpqIEzYwDFd6u/0ypoVVYkWm4Sj3WNFPDbcIK q0cKVvRMnQSKFYcVy3G8BiuyJANWJE+gOFaUMnT0o1gBJDRWEGy8byGnQUcUKwg+HlZlGHpE sWLkQmCFtXkkuxMQlMGnsprXGpJxdSzDb3pDGms+XJWAAJMTzMdy8ulvSGTtiwsKCDBBwVgt gy+EQxL7AgIxy7xYQFNOPyRGOBFUZmDPZzm2Ya846f/6vtMzqBmaopK7vpapha5bjfSy64qO +gA8qhK29bpGJYWtDaJToz9gDHVqFwvNVkn63Fe9FLXTfCshzSfMkWqEW8WqxbWP9nC5N7dV lFDLaRXtoFSIZD7R/vZPn0FsI83EW/Tw+vjh8c7cN3OOlHjaKlbKShd8XYr9xsStf/14Mu7C 8cPx/vwMCcctKvQRFSrZGVdgrsKvy/JL8ZtLd7iq2qJevt/PMZL0Gtx3EVFf7F8NV+boDZy/ eYZtdu1/ffVwf356WDoIW3Wpa3BPuG5Hly0stXGZlVQO2oWeF80JqiOPV0Ecn4+QhN4Zw93p a5faq7Ga+Fh0DKqJm0oqR19rOX6nxsZeiA6gedGNL27s29WpBeNYf7Wvg6w5pC/M73cX10rW KuKrMOMeTT10Y9c7s6woM32ji4X+Vbv7JpyASuxAeHQFpy+spE5x1jElfwk1dVwt+sNzkNjR scr9MhTqgmEC7/3mpDfdoJNQvB6Gh7lt1A6NW3eYAX73b2kxssZAuMID4a3zQS+EEWssY6/N gtSfIoJS1gIsT7NGJRG/KFz7eeVQLAtoHd7ebYS+iERZdoXolhK3+UwxQULqLauFoG2vNSqo 0Ym7haBt7lhMkBTaG58J0i5SXYGL9KvLvy5pTsgvOmdW2d5gaHf1rPHTVM+CjxtNQUp5pdwn vfJf69XMlNWXsOwpH0etEMrJMRvtT3Df33D1Qa93FfDYtuZF+lGLVie3F/2IzT3YW9Ole0RX F50uoT5NcsW3N4i0FMvL6h1RXE1QHerqa4NnL13Zojdv/Ru1tkY2BxOFxk4GVjGZMV9tmxg4 gMiJCbcgVZCgQN+Kq+rWOHrMe0HzWinM8BcjS7Pzs9A+4n/A9Rfn8VqtO5gUw9XjnTkyaMa8 9Qe08/+kW/UcuT8vNwDT1Y5hv753WqS82o1yOnOn14p3q/c3SunkdWXCmaqeyj5xvPA3W7eD jgkXur/Z6xOZ2o+8dT+dx8tQxrtxXi+NuVGhrtMoLbq2mF6qYdx0s8fZXd2bozPxPc580Y0C NxERnbrLOfTq4aHTI0lJ7vU/3TD04U4eS2LXGCCBNWZOower6Ek2bjwDiR3PcyK9D9eE6pjW JRWYFKjApHMavYNWtxynNCpnJHiFpnfzMxvQfZTA9csTGP7LYxt1S9PM8bGV47pPfwbSEwk2 jhWeX1OhrEaQtp6Ozq9RoMqR0ulnIlKixWzzpTSFbCNSvvhK+VN4MapseQNiOx59QZqdQcxb R/N/Cbzw2F+Y9F+gOpnE+uO9xt/g4D5R/tUfs9cxKOT07DWc732cay+CMgcap7eHQKR7DwU3 pudJ9EmTW/+tQPRQCdSUujmCA1zh93klc3QXlal/3U1l0XtSCwj8MRcg6yXpra8q+R3xfgEo AYstPegGKtHIsCISjXUh5XK6vDn4BKP9ds94ezbTi4Fxjgb6IieRPmHjUKx7weAskNA4S7AJ /EbJ4qznQ+IsUNE4S3Ny3Qe7G73nmT7oGErgNPYEhv8yt1a3NM0cQZsyFUEHomg7x4pF0EbO EdSdRQnx5xVVFjFbB1HWxvZzHXgkAmlJSDSgVdQTeBFfoUl978RCdfLgCb3YL4AnuBf0/d6u LMGHYcFpQ3u63v5mvyO4Ox6ez7vxBkbg5CCwDe/nQCugbzFR1Zl0DPd2t4upCsmLiQALiEsC FqqiOsOKBZbFEMoClhwNHLAkmi4OLGrN44AFSGhgIdgE3ggPLJ4PCSxARQMLzcl1H+xOAAtK 4DT2BASwUDRzYNHfbCYCC1F1nWPFAktdrgGW6NH5bB0csMx14IEFpKUBC1p9PYEXCyxz1Rlg GZJd/gSsmcU7R53XG4OQVLDBVvkss1T6ZuRqaZYjfHa2Cs3yFBgqfcMUN6S2i2n09UsrRq5b 0kBcEppR5eEZViyaLcZtFprlaODQLNF0cTRTCy2HZkBCoxnBJnB2eDTzfEg0AyoazWhOrvtg dwLNUAKnsScg0IyimaOZbJPRjKgdz7Fi0Ux/WZiOZtEz+9k6ODSb68CjGUhLQzO0dHwCLxbN 5qojR476oF7GyRwisXtehzHJoqHro1vwx1Ufrmw3W3PmCTijfz5B9vloQQoKL9097975e4LH y6FSvv9yKNsq6o7YVsNAIcuKdVkVXTO34s6cONZ54B0OQpny1AQd1gw4txKBuCQQouq7M6y4 jwIWiid/E5ArGL4JSDVYHHrUqshBD5DQ0EOwCTwTHno8HxJ6gIqGHpqT6z6YnYAelMBp7AkI 6KFo5tAj6lToESVR+Z3jxWKPaNdgT/Rq+mwdHPbMdeCxR9TJ2CNKtOB7AjMWfKL2C291f7W8 p9ang+bwow8qdnDZ4AgfBgcAySZFJFpkD/DRH481j/PxWhDcmd9vIPMP+4A6PDO8iZgny4C6 Sqo+M8K8/M1i+tIcGUkfY271EXUq3IiSqr7O8GLxZq75KrzJEWzxJtFicbxRSyGHN0BC4w3B JnBCeLzxfEi8ASoab2hOrvuiZvAGJXAai5rHG4pmhjf6XHtvjV3V5k/EcCYKs7PMWMQpF8cq KMSJXp+Yr4SDnLkSLOSAODvMeAuiJdlTuLGgM9f+MmcRlucMBjRsScs6Tc8xcPdxWDBqt58t yDSvvkBI748xg+NSr3GoiqqffL/zX3+81r00M+JXuy/8hxNo8Shnul8q8wYBrPpLcA+KLuql UPxgXIgb4228DSF/CL+lgPcP71I3vYd9teNPZs/WPDx+0HFj999aQ6pln093d26AQWVL895u /uK1Cb93d/cuP1lxn8XMvSimVg78G9hOtreuPYyd8ZvW55+MaqDo1ML6h8fg+ePtPjxJc7g7 3ZzMdqSnTpmaqJeVaQT7Wc7CCJc2tq4+2fNyln4WyAPQ5ddV6r4Ajhm7vTyf91nby3kquP3l RFyKO12CP4YjEo7hEGwCV5x3ukTSMRyRcAyH5mS7D4Y3ausqvn0dIZC+W31ZriHwPoccjTeh sMbDlRgJEBnj/JOBZSck1rJeiDHDTM5II0OLzfi4oSpHy08orOVJSSMNLimFxozo/wNAKvyM DQplbmRzdHJlYW0NCmVuZG9iag0KMTg0IDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIg MCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA3IDAgUi9GMiAxMCAwIFIvRjMgMTIgMCBSL0Y0 IDE0IDAgUi9GOCAzMCAwIFIvRjExIDQ2IDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2IDAgUi9H UzkgOSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4v TWVkaWFCb3hbIDAgMCA1OTUuMzIgODQyLjA0XSAvQ29udGVudHMgMTg1IDAgUi9Hcm91cDw8 L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVj dFBhcmVudHMgNjE+Pg0KZW5kb2JqDQoxODUgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29k ZS9MZW5ndGggNjI1MD4+DQpzdHJlYW0NCnic3V3rc9w2kv/uKv8P/KjZWlEE30ylUmV7s769 Ot/mYtXth+x+GEsje271ijSO4/z1B6DxIonuhshxdpNURdaIPd2NJoFfvwCevXg47K+2F4fs 66/PXhwO24sPu8vsh7Pzu/t/nJ1/vt+dfbd9v7/dHvZ3t2dvP747qD/9x257uXv45pvs5Z9e ZT8+f1bkhfqv7zuRFVkzNHlVZn1d5kWdPeyeP/vbH7Lb589enj9/dvZnkQ3Z+dXzZ4qyyETW iryTZN0w5G2fnd9Imtdv2+z9o2SbvdefBvPp9fNnP5xkm39k5//5/Nm3ktv/PH+WffvmVXaG DOLl3eFwd4OP4893d4el4ygn4yj7Lm+6TPR5X+thaO2N0t+ev/3LWO+V0qqiy1uBSHuKiZ50 n6u+zZtB3ispvM5EU+aiz0Sh9PYKp9LFHwf31SFv2rgdT6uT7Fz9fJuJzWlzUmyGk0r/tVEf S/1xauwVKtVNk3c1ptLpcUX1hCihB/m/xaY/yQs11LzcdCeN/uvfT9Tvhfq9VD+KY6rVlGXe l7+KBZqyQUVlcsZU8o8XP5wU3d83RxVbScP32AgnEwqklUOZd5WVNuRDG5sKCVRxjdwXaUNU YmaGxSKrosxbdO5FjdC0SoYR1eSFsvvcCAlUyG0xX0xUSK90Up7ElFp9r5ZLcp81EmHKrKy0 XC8xO3t7v71Vy+GbV3/5U1ac/df29n12srs9ff1y49e8JF6gfQXGHqGbHEApvy25lJHlbHNa nuTqx4tXmwp+K2f3c50GA6kBbkMhqrxtrdSqbvO+Y40oECOmMUPHIBTOlaMx5F1T6asP78NP 33u73qoV8lL9uFc/7tSP/UZUcOHwuKnl6CXdo7T8B/Wn7fW1/sP24+a0OznIv9VyIPr3/cX2 sMuATXvyoFdcRaqZGsoH9fun2d1bOfSyk0uvSB/6Xo1LqVqfXNwp3fVor5TGevBa9xt1WQ/A 6K7p95f6940ojIn2h8+Kxo/0yg3c2urGfLEDS1/v3m1OW22kn9Xn3WN2bIPYZ6EeFFLyBnmn 9bhyj4A2gBxwd/Lefdyau3wrkVX/FcZ4oa5d7NRP9ZCo/8Fod1P73WwamL1HH24pv1A06cPF J3QtH6GitIp0RV7X7HwukfmcxAsdU93VeVliS9KbrTK4n71bZW4z6T7PzLtOk0Y+TOKpi6N3 pV/KT/oLbZEP0hHvpHwpWCrRww+lwtUfEq6bJR6uwxI/IlBPkXRmUAb2KYPr5ikbUdRShyZU QaJqPyUBWwIJ2HJE0FRKT5JHAok1BtwyfSm4Y+FocQo7GkehxUyIrC4k0dRnqBqPskLkTYnP jopxGShWrMdQdW7C485CBYsV5jEsUkA6W6KOKcD7CiDPPH2M8WrGVSB5segQKE8uly8Oehm/ 3m0fD5leZ/TCA4AI4I+7ENmjXv0tFl58kNB75wgVXAAfS6D/okHlo4MejbEGVzSYAgE4JFq+ RnR9yQHQlcQpD2b6T2ap3GagrVkvwT/ZXcio3o0tl/ExDlPLzF7Lr7Vdutl5lAI9YA1inqSG ASmKFYtRs1mwDJ4W6WDRKXUmjoEpWGYFATn6MoE4yNcDt0aQeGO/j8ONpiDQBudghwjW1Ze8 ccNBoARWS0eghYxprB4UzRRFJMikokjLoAjFikWRsklAkRoFkEWyB0w2DyAgLw1AOgZASF4s gATKkyvZS7vmQySg12ION1zoqVf17WdFrT//nw4sZBgifx6uDTAMNlDpbZyS3agVB8I1F3YZ MT/z4cvWqxfEcEq9S4kb4zjOcxxgLBDmwlfUOBTXvVb71oIeEwgl3Jd6mhatRT7U6TeFhxdQ IgleegZeKFYEvPRgjOkc+eu9MrzGa/O4bK9RVFkkupH3oUufnXFQkWshBSr6MgEqyNcDJ4QG Fft9HFQ0BQEqOAc7RDAuASoogdXSERCgQtFMQaUolFyTACzzgXhoBwZUKFYsqKgHiAWVhg5N FilgQ5OZAjyygDybfqGNJ7BccBIzFloC7Y+XxZxCySiJGaT0gkSmARUkkbn38ctPfuHfXynq zxInsPShSaXZ1OHAZQ4xDKNSh+vsX5R5lWL/Tx8cBgaxHIaqe3crZnnF3aVipK/pbORnB73B /YnfButP1MQzkB/bUFUh6Yd0Q/FwC3qY7Bwz+bAaQgovFm9nK8eT8HaRaIO3qWtWHG8lTFB4 qy8TeIt8PXDJaLy138fxVlMQeItzsEME40Kyz9k2HARKYLV0BJDnG9FYPSiaCd62jbROacxa N+q+4k8tlilP4cUBbjsUbiKaJESunlQPtvMi8Cq5EmerPiaXxVkjzzxLnNGwBGoSM26dD7QX bukSwbL1RqHPtHAVwI/K7lXxqiABqLHSoCLXV0JUnZXnHhwsgkAn5PMoAts6blL4/l6DkokL 9xpophAsf3x0IHYJHgICGCst3ul/cItfuZyktxMKqIF9Dg/OotfZYSME/D5PfAbV2eOOsKzK vGz4EWoba+TWTtP+YveYH1sVuSoMFa/Kl7rJbZdXhNj//uu5eiS18/qV6tNqIJnt/SP/W1BI VYaDj/c+g6HnycxRVJ6Pmq5dPOMxLeN+tBlxTX1r59LkufHPpMm37H8yuZgu4KXpPkLy/1KO wn4/fLD7MMvypW6CaknribsQd8adx7lVZQ9bZXjMbt3aJ/8uVxeome+cSwTzUV3R39hdyEH+ U/926QIO49lGAgOmR+DY86MqB9UFxpqI9VqNfHBqOCjDylkpvLgiRAT/lxQhlulgihDJvkDU f22lR9Hh/itcxv1X7Ov2QdGXCf/VfR/1X4EC918JDnaIYF19SfVszAeBElgtHYEWMqaxelA0 U/+1Ft73Y5KcAiuipfBi/de6slMR8V/Rprdlcq3/OpPL+68gL60CIbDSTRIzdo332i/zX2+c t+gTDr+uF2s91gcjRHqrHeas7lXfGuEsLbNlLep8ELwteTAA+UkVA4GVplJ4cSmM+UP9lBTG MtGQwkieTnEIkCuXCFqXikLMYABIPA6ENMEqirEJ/AYxaoIKiYLFVowblMZUDjJF2AoV0gRL MsHJDh8Mj5cTcAKrsSPAywkkzRQeFLAH7cRUWy9WA0tgxYKD1JwDh9OGS3MsUUAUraoqzhXg UUKLC3o5KdthpZgUXrjuMh6VNzjUPS9kaKa7F+G33whGqGBBRXQQWWS+AC4hQbu1VSDKVtbb MBMO5XI80lpl4LLwfdcxA88CreNq0ery4EiLVZl4UMO3yVK9v1gVLIEVC2KzOfckEFsi2WBY 6mSPY5hcXjkMAxIawwg2gbvDY5jjQ2IYUNEYRnOyw9d2d+24s35d9LrV1153fbizXl2KZIJf zVDnTZO4u6fEqkpJzFgMK3rfP85gGBrqLFTBothMBRbFjMDErT0lVuFI48YutIH+vx8kg80m j/e2X9dnbMLyrtPscpSq5IBtpcWbofV9CGugbbEeAG4jPVaBm1EkcWsLVnxKYsYC3Gw6PgXg Fso2EJe6EsQhTnQuDImm6uA6kavDGDhHqAsC+Wi2znHA03VAQuTrCB5mpMbIDq7m+08ICqOq pyD2n9BEU1TrS48CTJ6hxJLOKbw4TGv6Ou9EGqbNt9uv0sBA2lwDHtJAXlr6rsRynknM2OU1 0P7fH9CwpX2ZCaqyyYuKN0G87j1qEIO2ZI2NbawtWdUT5/tWIZl45FHV1aBXhXBU6/AK9EjK KZZYrjmFF4dW85n2JLRaJBrAKnmOR8FKrawFUVcy13GwQhkErk1BlpY8BxSsDAkOVhQPO1Kw MZ4+xAmsoo4ATx+SNFOgqiXCVsa2Va3Ghj+8WEI8hRcLVF3JABUOT4vkmurSXC4PTyDPPE6c 0bCkaxIzrroUaB+viLzI3EkBky7dsHg/7z0eoDPg1qHRJ81IglBn2w72h8cNt0nFtiZocdNW hE97wDSItK51IQmtHC20U9WoacDbKXbY0vROMinglXdSPswVpeG4I+fIZhLSTDJ6Y5U4dzfV t//cO2dl95N6eEyo6a5fmmYTRaDacVrbjnPcIagjFmrBD+HYpivrXjVysXKRNqid6oN756ZZ 4A/51nDfXwUtPdd7sPSkrUl/45B9UJfknNvqdh+w+yPuRS0bdS3DUzH8+tauRaEmMisXuv7h Ufyja5uCXMzRJ4+Zwepwj4HrmzTdbX+EEknCEuon2qfNqZCfDx9c09cXWjRL6fhLH5gdEO8a g3zwmRigrJhCBcmLdY1nKP8k13iRaOMap/oXcddYunKBZ6v9ual3DCTOOx7RBG4lxiaIpkY+ 8ogo8D7HLu6EykUSoac8ogl8VIKTHT4YXuvt7T4hEA1Sykkg8Q6kaOhqD65KQIDJCaajaDK6 HOQFaYuMZQU0ohmFGpGSkaEiS0aktICGkJZGFfOoKqyc85QzNWMzT58318jBmOWLOFFzqhJW H3mKSurUQkQnCZtt5XXKFFsV/qhDANu8WXW6aEysai+PyI0B81pR6iGvIpLevFVL7HfZ+e7m /hraXHfZ99pT/PHjXtdXdje7WwmFUWx+ilp9RK2q7HTycqrX10XxUnxzbCNUlfRCY1Y4vr2r Wi5wQ0TUa93GfneZvdLWPezV51+0HzhPEa7Voq6qvBH8gKOTDSveHGX+132rmgYDlXz0AmnT IHJ53JnDgLQbdq0ytG2wXxRiGJWbhGSn9iN3j9nhg7uw7gbH3MpuUKAxH8brO5c+9cc/vNro XptfVt7i6KYZOa+riB5HH3FZNXnfYDdup8/L0PfsGhLl9cn3KkP8o1pL9HYOfzYiELtQ9MiK VhLy2phJfKjxDjIfO3+HVLbFJz/CrRXuoCd4rvR2sNbskAkevytfTg52bPg40T0Hs8e3CWo8 0b0aayecqFU/ztwe8zNpVktSHfxzQccfUlnmgn/oo8saVtB74gHrswWh1/tI6rbNq2E2Pbbv 5vHLSoFlIW9rNxOYnUq+QvVfSadlt24ViEmVfkTRRIbZHl9Srw57n0ta9zTFJJXSR46NaZ3H F5Ukn9jYmL7S5cTXZotbCT8u9Xr1an/QK8kv0CmitvsJud7c3AMWgrsmhPLXdNbiQa26m9Ph 5EYtsNXJAZIWRx5JLYQKEecjiU1BXw2oVW9gYkd0xeyXIXkZxSOaS6e7kaR13YznjTJI38O8 +V4u50g9I0FqrJ5RRYXGYHqdnFbGlgly5nUTIy+t4bpiduXQzPB7U6pTMURE/dfq0fbnPl7C rJCAK10qXe843+gjgtVEuL/eQp/YqUXY71Us82Auy2AGy8ilqB1zONpa755MuLlrBXVKwlPu rsk2GIFJTckVs7WG5IXf27od8rqMKP9GbfLV9axL+9vB7/X1x+2czc25UqOuU/stVZAk70KY ftR+n04/die3eh8omn5cKLuRwZqIyX5KArJupAvQIAnIBBKz0gAJmaOk2NhnGkjoHKXnQ+Uo DRWZo2Q4pVFZI8E9xLuucQI7LkeA912TNFOclJ50OwRNXWRyntk6RDPjav+19I5k3Bc9iuw1 fzrKQuEDJpwHMhAYdB6RtmPqxgw3ruwU6k82MulY+fFufHAxFJygAqVeJ6Q+6cq/qz+5Q0cg 8gwO1r916+abt99l9+qTP64Y8iTXO3csxOjlDPABysWZPRRZBcg3PiqW+kBQ/E59guMagnKN PXqim8fT45FAjzZ5XvLSW1Cr2m/6HeAxFPTwPVjUc1UzBTOaGXdawXxaLDqtYKES5riCtZaN Q5pcJMuKLAgZErIgRLEJfLCyYuo9ng9VyzFUZC2H4WSHD3fEtZjNK1kEhdXZUbgOs3nZiCaa oFElV2PRpUVtNbMLiOTFYlExJGERu5l1mRaiqPUtmGnBgpKRlxZd1cw2IJoZ1zQ91/6FPpvG d0CHBwp83oRnz+z2mvS9PYJm+/hPHWX5hGfQDqMT7z/Ddhubh/cLlIOe/Xt3sjGcfLm/UODV nxyyB2jTvtv0cVBU/coffcXAyh5C9FuynXWdgauhVyn5wMCQ9PaZ8N2jbjFJh95Tcxy0P8Uy wN8OgV+D9P0cgkEfxetHRWN1yg7+yK+Q3JyNGbEg2tuy0ILqa4OIWPDYt6pSDaYJguZegBGY FEnXzP4nkhfrA8zm8SIfYJkO1gVIXQnjWC8xqBQ01gMJjfUEm8CFLAWH9Y4PifVARWM9zckM 31gejzpxAqOxJ8CjTpJmivNdmbdNIs4zG6NIXhzOq7dMjudlDOfRbb7LZA+YbB7dQV4iujNb omhmXMAZak+/lefWHZj85ADRN54f5Bfr4Hs/bexLE0yw50CMgPmt64KH+vH+an8BGLcPyrLD qEXzzuGY1sgcDhi+N3Ab7g6OuxAYpqy7A3J57lP2Lo0DYfqNDktVqvVrbZJV4tEP9EhDP2Y7 FcmLQ7/5LF2Gfot0MOiXPNeeAorV0Lj4DknYGhIyYUuxca5TE+RVkISt50MlbA0VmbBlONnh ww0hQBElsBo7AgIUKZopKIraW7vp7Max+CPPbMIiebGg2JZuFlOgyAe/i7Qwwe9cCx4eQZ55 0DgTMluyaGZsbDbT/m8bu8fpwUeSifGj6Uu7HKVk37xVm0Y0oo7eEHfn9wJfw9uF1MYPuU69 19GebVcz+7dsyKhyq60OzpKgFMWPdVaTj0o9sto2aPcawfVpE0SgY8Duppumb20awYG0z373 YZy/+1mZCLII7j0N+8NHb6g/+uNBJhu3Q3G+G/B0/Lbd41qtaivVZjq3mjm6pDVPmT/R+Pr6 DnaNax19Fv/wyUTkX+a2VoN6B0Wo4Ad/Ntj70VONZCru/Y1xFv8q28EORL0VJjiExeUUzJMA 287gePX9Tvujh2w/PirZvFS4DR03nz/yFQa3Q6cHdQ56OrWjhAfMJpPrmOzid7p9GUuXfV51 TEpovzHui7//zFtJwNBois0f867+7rNIN/7MGUXi/eLtYXcdvN5GfWvslu/clsHxvEXyc3af Gyjhz/VxUn1Siz5RfqX1RTvJUkzelzPPjT3qteWaSHAt1Kiv8iqm0dGH3jcK6FhBERcfBIIv x4E1Vj1N4cW6+DOsXubiL9LBuvip3k7cl5dupujIBJchIRNcFJsgPhQdk+DyfKgEl6EiE1wM Jzt8sLzW2xs+HBhKYDV2BFrOmMbqQtFMffmiHDcjUK+8xSq4KbxYX14606522gaBYxuEjXDG QkKPxTJVzBkLoSqpDj3ISzsCqMEKgknM2GxLiiH/TZor0CV+mQVKFVCLNAvg8LJUtlweqzTZ /4p2kuOOtpb0zZMmil1LQV7aK7axqm8KLxZLZ7ovw9JFOlgsTbVfHEvlMj+u8tQzLAWSEEvn 6SOCTeBxTYtF8yyT4xMgYD3DUqAKsXSei6I52eGD5V3bx+xwIpzAauwI8MOJSJoJlpbdkNwU 0mCF0BReHJaWQ+kXoegpcDMcZVNkyxQyh+qFCiUiqpGXVkFqsNJbEjMuWmLN+TtsF8nip79M z2FCUGWlvXvhqwgxe//Gu0ewV1OdNsy7qRaatS70cXehWRPR2ghMKm41WBU3hReH1vMFZBFa L9PBoHXyIhZHawkkHFoDCY3WBJvApePR2vEh0RqoaLSmOZnhG8vjVSycwGjsCfAqFkkzReum 8WcKc+c2N1jlNokZi9ft4Be81NgX7fVYqIsJfkNdUqEaBCYe6d5gFcE0blz4m2TLY7V6oAv1 wjGUZan2EieNwe3C//20may99U3n30uDmW3aY3JsVepG41WgSirWgsS0c+QbrCacxIxF29ka sAxtlylh4TZ1IYrCbakOUqObRgwJ2TRCsXFOWc83jXg+VNOIoSKbRhhOdvhgeoem82PmCQqr s6MgjpmniSaQK4ZOnyuW0jjSYIWUFF4s4KoXkT4hPk5oIVmmj42PvT6JmGvEpXWQtFjiPokZ G64xxoz3kyQGmAaBbc/JuK1khtz/2paSlWasalUIxe34O+swOS2P3/2x8g5I76un3gZ0pGaQ I2tfikYdC8Nqv9sfgmn4m+8/WXmvhXBvlk7NMUXaUZi3jM9m0rQdRbRhK0hKL4p9X8V4MQjb UIYgH+XSXUw3yhexsZAhpXTLcRvjDTD+EVW2jPSldKltKUsnValr6OEQEv14IzCpW6TFKsEp vFgvfupULHLil6mgfPiyZf2a1WLKQrvgie5TPFJomvC9iNFIAUjoSIFgE8SUo9crRiMFx4eM FICKjhRoTmb4xvCRjpOAQPRI4jKBxLvH6tRhKreJqxIQYHKC6a7SpGTy0wuKNMgENKIPrRdL kBoqMkFKSgtoCGlpVLHD/dpjHBCMnlkq+o5eHqMqfdFjVIU6EeqpGh3jBMSIRvKx6GW0KeTD SCaDtE7/D+HEeugNCmVuZHN0cmVhbQ0KZW5kb2JqDQoxODYgMCBvYmoNCjw8L1R5cGUvUGFn ZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9G NCAxNCAwIFIvRjMgMTIgMCBSL0YxMyA1OCAwIFIvRjExIDQ2IDAgUi9GMTAgMzkgMCBSPj4v RXh0R1N0YXRlPDwvR1M2IDYgMCBSL0dTOSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0lt YWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9D b250ZW50cyAxODcgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9E ZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyA2Mj4+DQplbmRvYmoNCjE4NyAwIG9i ag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA3NTg5Pj4NCnN0cmVhbQ0KeJy9Pdty G7eS767yP8zbiqek8WAwF8yeVKocJ068tfHJlrU5D3YeRhQls0KRCjmyov36RXfPABgOmmYi gH6QJXLIbgCNvl9evd52y5t23iXffPPqdde188+L6+Tjq8vN/W+vLp/uF69+aW+X67Zbbtav PjxcdfDST4v2erH99tvku+/fJH+8fJGlGfxTqhZJlpRNmco8UUWeZkWyXbx88e9/JOuXL767 fPni1VuRNMnlzcsX8GSWiKQSaa0fq5smrVRyeaef+fFDldzu9Ncmt/hX0//148sXH8+S2W/J 5X+9fPGD/rb/efki+eHnN8krZhHfbbpuc8ev4+1m0/3ddeR768hVnZZ1IlSqClwGYt8j/cPl h3djvJ8JTWZ1WgkG2l/Zor90zlJVadnos9LAi0SUeSpUIjLA2yJ87HN+cjAfbdKy8u/jhTxL LuHnh0TMLsqzbNacSXy1hD9z/HN/s5+BUlGWaV1wKF2EBaUOgBK4yF+zmTpLM1hqms/qsxJf /XQGv2fwew4/spBolXmeqvwkO1DmJQsq0TdG6hfnH8+y+tMsKFipN15xK9y7UAQtb/K0lgO0 Jm0q31U44ik/RuaDhzdC5pNt+NsgZZanFXv3vJtQVgCjB1WmGez7dBOOeIo5lv6DRyKEnC55 9eG+XQOb+/nNu++T7NV/t+vb5Gyxvvjxu9nf4/UaXeXDq9AyK5/g9Xo9k2frxaw8+zN5FtOf gBUiT0vlh5tcwFcTUbwODTdHgMx6P50FhibLA9CeJ0enwIosrSoO2Ppmo89yO7uozu60aPwC h+phPM/CIJcZ3jo/Bv8ZGliJvMEPLDDZ5Hpv65oD9r872M3kDWxui7/vks1NMrvIz37+8EtY TKRmiSr4sv/ov0brB5pcK2RShSrSJhFpQQ/e/OMQbxJheFMJLN7DnnKhUZlwp1Q8d28n8BTc IQ7gs4lqAk4ImUoG2rt1t91cP8xBB+qW8HOzDo9AU6VNfdx6feeeBzh3SZLdc+xZBnqP57ol uCv6ru00U8OLdoMbBKrkFrVIeO1udlGcLa/h5zW8s1pcwRXFp/6EH4td0sKD+JHFTGT0uSvz Nfhoez0r6I12Pbuo6bsSrZt/wXe38HO5uIav/mfSfYb/7Xfdm+9a7BZr+KNL4E0tWvVz+MLi T/hWfPqasJrjB5ZXgLnGcbeBP3E1i0TrxojVjVkmgOzfwWfsLujX9N/zDXz/3ejtNa3hOeTk ObaiVnBgzLnR4u4BmdVGY/MEf9OqcF+74PgQGVVKgWDcR4d2qIWfQEV2W46gqZmQtJwxXVWG rEKvROilNIpbyoguQ0OupWYNDGBY8gMS9Wq5hu2ZUGtgbHIp0qrk0HmutPUBLAU4QxiAU4Px 2eC00JXsOePlQZayWs7bK7xKcMklnQJQbn/nDV0vdmloJKWs04alieBnLrXyVQoO3CWQ3We8 drjyAxuRLHu25zJN/dPHo1/DQ2vDEzSPLngWHZ5xiQbMI2bJPe4kY+KwzLpOxdQdd2MoDTdl 3i0t12xXy+4J8CJJCcitDYe0YnVh3ljcoODsduF5pQKO5V9CeP5YaRU594MD74aoFVqyi+cp b17OnPHrxAO4IumEqok9gqdZxetHpaMegY6Dd+Mzfay/WJrzrPDeaLFTOOeL6tByi7frAd9f IWuCW1fgJ7sWtZ5u2SLlyD15Sw8mdPO0EtU9ouaCN+330ZMjgaf/xvu91Z8hHOYRmF7RCNjn 48jKpyrLmKpypf+rp2g5zHFrWeRyNzAzo/iQuA5OoQK9rQxy4a+itm8kuxfdYq53QhHNcTQM Cs293a92zOHCqzNCpUXJY4zXBe/cBpBdD7cyog6fV3kqaxYlV/QMEnKxgBtqzCKf2ry3zda4 AvVF7Vs0xynZaXj7RRRpyR7HB0exDQ5Zq1RSneymFLIB0eGHZjWorWW6oRHQVNawVxWBL4jt hwasspSl7vDLVDLNWQbYa1IVUf6i63omfU3+gDiaXVECRpN7vbViFXb/zsiJCfcZ1AhHBj8u 8T9iDlZLxhtMejV5sVZP5oqTMtg94imT/R+eleUyLRpuyQvDkpDhIwsiDaQLb9WptJQcIsEV 4IGF+8BhwA0V0vMIoqNOC8Et80bzeSKGhaECJPwtCoDQuIBjk93yO0OoX9OBF8FPR2pikCxV hreeK20lsIfyEbMPFiNLDvcl12wppV/0S+fwG+noKch+zFZo4Mdv4UVTzuJriTeC7AenhuL2 6acNKB+aW/VeX82pg/tOCzT5/fDPw4PTdszJiLCoMVzFgJso3bjZ28FxYxTeXkGMIxel1HrB JGraSymPHWqvhFWVBuszIalSOXouvXVttGezOvs9Pp8JMczbWe/XWuHe9Iq1seMHB7/+bvDy WwfNslsujK235xhjgyPWiU2wLJskxt0lpKWgY20VnFIyidzRexzB3a1FphWzkoH2OBPCsWNW 10ZowNFOfSLn5n1SdzaDemct7OX8PCYN57kv7uJcLdc0U4QSqXHz8LZ/pi0aP0oxdRBwOYDG 7d+K4Tpd1Pv3SemzDO6HlGjT+VFx7v3YNt7NRE8y8+Wio1uW4CE5djbQXHAXV66vAcQ6/Agf 4eIqorq4MuFzhv/rCwZct7xnv911CfK9L7iJ28GXgyyUOJma8OPgXuImLSpuDRrl2vHKcX6f wZfX7hLk1Q6bubNrvhsixE4IGLj6lRVDGydQElrd1MSjL7d3oTHVN5nXaVZzG/zD4FO+Dh+c kqkoObjBBZYsKoyFebcX8+aUonhDF9ykkmWRSgZ2jKWWdVqxJ7pwlKXQgOv8ACmFp1xQ/Juv r3O+HYI3yNVMBKVXApd38CcxPAjCFMaPtMcTbWRouVp2muc8Od7vyFp22WSpENNFYgYMMsAO XDDy7DaKb1tDVzwWx2nEwZWEXKtJDEYR0kgKCMgw4AZFsfLpiS4dEX2RqrvbzcohgWepxerG pCh4Qyjh/Tzo6zrVBuZNAYmgDDhwcfnC48FlnQKZwyARXqRLAekep9piKQsQcQw4dFgt01yz ijKK/0lqTlUwJxzTcJGVOLBsn2+gXUGqVW9EUJ6LtfHhefuo8eQ/9Izscdl9Nu+OE/MuCk9m XmudMXEEQ63SerrsA/6X8MKhTJuMxYTiFZR2eofKtz/fMjjDFhAnY5CygYvN4GxaPc1qJ/N0 ZPb3j5Ccw0jHbfiQSwn5eQy+ESI8mhPWHDhtJ92ZONTBdM250X7ILWBdPcZ/0yX3RIR9tNrZ Xrvnn/vAmNEgkuHe4PdCAkKN/ky6V4NKN3xdp1W2wYqlgNyNOb7lPHxwsgT/xKnOqlB12nDQ PsZI18krDpwb8aii8bSqTsU0qx4DKhhakePfzjVdBEdFibQuWFyWqQA6bPQmBBekIssgG4eB HJ5TZrlW7jlwjtpQRFEbRE6atQ98TL8HFLTxy36nuZWnUABi3FsTcsAHBh4jhKMxkIbPsirN RKPQbK41QODq/jW14cEpqEA/FaHmhUiF5MDdhQenIBDOMQDX3IXDvzIqxZ9RTPBcVWiv+dEZ 0smU9XIT5YZ3ZokG4kynOnQJBVYsjZHaQO7pZEiWHfl1azdYQ7tkooiu60aZiGDvNaZ7Tql2 mAkco+wHAh0sp28fW8ryMIk+5DN4FV7kY2ougwb5mKzGTEpZFUtx71WAsgQf5sTfvyH9MjDM CmqEeKDI/dsOVVKPekmvx8FMaPKvOcToBNCoapdrylVvPLUGM5GfxXQliSaHLC0Gy+DRNtFg qQ8D7ohoWxkz2lbKEnxMB6ttAm9IXaS1YiFHqO0CX17GAgzvYKjTPGfB2SySZficMyEg3/dU CxV5DiUxDDirWe4njzsBC9fd8jAkpYbPUdAUkIvT7UtTQcuCAwQw8hIErzXARksMdF9pV+Wr 7No7vt43AsrI/MF46Rxhb5J+G6fObmNKda7dSFUzFChNYvl1TxFDKH9u0KU6vM5mFpPKRHXY G+P0saVDqGa1y9VQPkkmTxzxn8u0kr42I0NNok2F9ReEv9Gb/cw2HV52UKQlh114QacJL8s5 cBEygJq0ZPdei5HBkTeEuEj/WUXgujU2uWEw6RNNmrNHahmwNofuhHJXC/Rg9lcJafWafEXB U9QryJU/1SHlZZNmggP3uFxFqLWq6wMgfbwJON0oASe4DVqnkr2HqGUtbwG8DdVwzK+3+9q5 4b7GyPG0MzB2z5grU0xgvrwHetT3IQFGVewzKmBJKxDKlZNNWo5dmZpl2RR/ZSPJsfisyH1B M28h09d2yXWSHaolR/fXYqe/St9Jtxh8X4lZUep4+Gy9vEnzklv7EfZDFbVnD0QXmqme8Tqd tnl7LsC+aQ8DMVbXHgbc+8Vjgt161jfbdtdtoYFPgQXRKHM0gZxrFQb+335ZoqpFjQfg53nS rq/h05rjrDdfyF6P1fqn0Gynbo7cNR/91DHtz6LSqvmUKf5r3cdeh7jrkW1wasoo6v1PJgVU 0R2lFibJ3czxDWlFE5hvX6O+vEHBPAcHnIL3Fp3Rg73Fq4eq6qfJ+CPOcmNQsgF/dNS7Efl2 tbI6OZayjdqBkB75iIUIxNZvDM/TVBkjlCjYQ9saeTXvQIOxomtxHsXd1JNQmftif9Nyjd15 Yp2rTtLEmkR/5VRwjLKZoiRhC60ZNYpD/ohrqaJeS5lDDuhEq15em73zddm6n7kNtfZrYej6 apMMdS0iDGMR0tWgvEak8D5rcelksTiNI/YLWa3Dd0vFK/dwVcg6DJ8ppWUxsFT/Jv0zCR66 gmzrUnAArcKT2I3dPWCaSHee2FyQwy3S4Mq2TvuIuc3G6V+AQ7Thin7LB2OW+JWXWzaWT8Xh ADm2bZx4oKYMcYvyed49mMozG4ghzgVrtHp4u0veUzXUoyWu383bbx8ME57vcwx84NclkWPf J2UJb7STIkxyFLyHA3j7K+jUtmJkxKmoM8EN4eMe1ffQZKfqF7yXE/Yeihkn6BsMCfaH79/D K44+P8AOHrzRX1BxJxY+ZNWgac6A20tzjUObGarvE9rkbH+ijmKPjjQdlnDCP6ZRsrahhAmE kR/XEdeHHKsFMmiuv2KU+n5Zc9iRyNiSaocs6yaGBZprQZ03HBLUKWG3nCfvkS/8muzukbZQ 6zdaJZ5tNZxt8IzWHIocGQyDe5IkNJFlTyW8E6WsUeYy18nRDBzD3pMQmQztf4xs+vX92z1u 6OPajr3/njJV1UgaRGEesqkhkrC/Wl7shA5lVVrdZ9CAbKdCUr7Tp1l4/TiDVrXMBhyhHjcx 1WNZ1xBQmqZhDceyHnSjwZr4YoX1VBfzJuRggeBc0+dn84XLP4ayb81xUbV1k0mu+jCbcjSL USdJTcKVybO5cFqDtd1ipbXtxfnYuEVs+gqiha1jfTdcKgwSOy0j1rSkylq9pKUvsQpzqF8H Q8vNVkl2T6ZvHEnCvXJ5VNkI4ylasS5eVaZqesCjCvzBcTg0GoOb6Oh/56wa928wa94uw9ee lpAKy6AevG5PVAp6PXA7tTKeY2x3NHKYup0CV6uJxpOancN6zi9WO3LCyaDkPiY2CHltir39 mvggIRrHVHwEzIbmCsa4MZ97IFOn3ivEM3drUMBrt7LCthsaaipMjlYsWi0L0Ez+eplbjFYA tfLjEzU3ltoPMvtwGR6cgloNBhwlzewilIjIBjoe/IXTLu1hD+LE6YzoyJLwCjuKRwbVCPZB A0rCoQNx5STdS3/j1BFvCa3BZjJVDYemU9IVIfyYs9sTIdrZgBnCgHM84OELCivIvWUAhze3 YFYIu87w5lYhwdw62SkWJZhb7GbKkQfDhij2EntIENLlW4F6dG/9uLeuB7520oz2deY6svtQ 6uc93iFHd7Y+7Xau9evPseQntgZg0IlgYRXQ/4UBd4SJJQJNqmIiy1JUkMg2jSxPZ+UFiiwz EGNFlhlwH/puUxdoEEUAXmOHawY6wu1TT7aYb/dcxdWHQz9CisEBouMPO7xk22QHyJQ9MqHx AJ9ZKY48eO8dCDERieVM0IZATdnv18Jw4TVekZYcMn29QfjkYgm9dDmgmIl6uPTZpCWZ/rt+ y9BxhjgybZwjFlxZyQvMUmOWF6EYrYGaBwbc/Gk2uI+2e6LbFA6iXTu36WHjChtylZIlHl6v q0HzOdVWSW1nac2HI7ynwR8ArQBB8YlQV4zuRfa08Dja1cpxa0Qq5yn0vc/Ynbeh3wNpOibu b7MSVyt0pDwu4UrGaQBUQM2NOriBZqTRNmIfpFxh5MpvBHXQoLBykhaWi93zhif6PPgN1oox iBwj4EKMfhP+MiDQuaCJtZh4+L/Jslp9+zxpP4XYYGGOH+IzSUAIz97nB1YIUSRMGKUmuL9j fqm9Kcvt4hHvOd2Y8LZG1aSCQy04FYLKqao4O+8FV0DHCwbcW723sM+PmofuknZrMw2/VnJy 1Yeaq+G+bodPRWhAVcLARu8Sxg0Al+H7TmUSLMJTnZbMKvAxMOD2WgOpIX0luL8D25H79ztm OyitBzYlt3jjFMRfSN8oJ6oqVzyCz1HuXAzlANpE8hs2zMNqI8wUwZYvzJZ9LewRXtJr8q1y Dp1pYkKUcW6DqCkzSHfyp8hQMqRTsbA3lQMSjMftx+6HnNhey6TkvmeJyczDrVUDvaT8uGtF 4DvxLEWAqQetGm63ItSDYjiEAWf15i68lSnyAwt1QpnULeCW6KTXPJ6G3NqDJGP5c+GyZzeK 682XsYoOEh41jwBFx5M5H5qB0AgIZldsFjslZsSZi1Q2ELJkUIhlztUZOP4OMQmy4L/0gewo w3oHVqXN7KzySzzLgRY7VNakI9A2tqjNdGIDlezOJHzR4SUdlX/stz4Kr6ppAZA13IKc0TcX 5eCYCh4AVWlWchjQmeL9opJzDLfY6Et7NP8PHyoUqPz48TZDtuF0aYqoU+tjpzCER0srGIJF 67PxiwXwjXudPwqdLn7o5DowAwKvrP/F5D2G5hr5od2gS2UGgFFF1WrJ+4XoWt/Mhkpox6XY 3lLJPnBd46KNx4Dy2teI2zKgx74IzEkP8LVnveuTROeU22vkllumcjPkm+JORWBBokETyr+k wTDYug1BTVKId9Ljvr01ymOL4fHURFaW3AI6zeCHyr6OaMsuwK3+DX4VK/Q8+7EKb4Mq7AnM gAu/5yqHenQGXN9JMThQ6NfJbqnQtBWnb2ORYfd9Bm74KcJaJ2hYcMe4XUOMET7kdhUl9O45 pdvVCzGi29UP7/X9/Qryb0GQVlp3uDDDV8JjIooSnKx+RN6GB1cKyBBk4AX1KHvBqwJm3zDg w/uUVZ2qMg5ZeY34DCIoDLifw4PDOhcGHEli6wxsu46aXYxr+8iOpMLyJ6PkO3nLo9ZOwd26 4sCGtREAamtCsNfNaRtgkzw9VZ0RbIlMckit2qfewgku2yly6wdL3XwHp85DnPMv4Px5Cu77 U0b0iRZ5CaX1HAJuZcy8xYYFMZsAFTWIpZMTAhTAHqCDC2e25aT+ObSjXKiUp4fwWUuDHpDJ dJoD8NMlkB9WMP1CnTioK4HtJDcYStVBFjuq7QnuWJLQOdS/gA+rmRjKWML7k4pUcoDDj/aB kW4NAy38wGiJcRo/tODXL5cltFvzQduL4oYvwoAnuW2NkGBWQAalH9r+3QkNW7NWllwj9Jcr UO/0QuutZpy2EGduUT/w3EtRTo3V6/DqXIM+Zu+y78lb3MtS1KyGarng8fIG9anTnLUsyS3l heYPXwVX5HBM1anWqxS6Lfy32Gk4EtNwKMQBJDwZEaHBQ0YGpzZECARmaDR7oZnGRn0bCWxF YCtp4+hL0B5dTsODR0xNDG4DF1UqOXxc06WPEz09Oz3B62YQMPSAwcK9E6apRD/X18nPnYdX mmh2CoPWgw2gjpsBtdCjC/oGmH4phSc2M3yOOkyET+jOKwj7MbiHHzArM+ia5QUHSpiAArc4 iXSQaNCcbqEFWtwMOKdGHedQOyeOHRDzWG1ptMKSsZQaXoQ1Chz9DDijnxVnKk6cIc9AY2DA h48z5PmBq3RMnCHELPcDcQahMOfkhHEGP8R4cQYG3jstu9cdJRNBUlO8IIPEnpwMGt9HCGrk KBD98CCpfdBXIgdXagXRDgaPDxHCG1iQxsB7MvkKmJ1yh+n84WMsfULfyWgcvHW54OBRtyyg 9O8/UNvC4FEemKKmre0oC2bcGLL2g0PzuihQV7j8HBxyWUKFHnetoKFI76e1pDa0Swpu6qM/ 5VR7LrPiwBEPTaNAXaWZ8Q/G9nyIVAqgoBSAwSe4Jg8+hoohuY9OjM/2vqL+Ld1mpiIVr8lG pgVLAE4+YfDNKDJ1AHJwjRkKHGuWnXZQY5FHSUDGvEcG7DijepQx7R3nFqF2Mq/YPYEEtk2k QgrMH2AAk6XS9ZpFNOdHpUDIT8z84ODqVGQsuHnf+8StPRu66130vea+TBrkKxOooiF71LVs rxzIxrsTOyJjaHSJIVl6idIyaWJGaEkHeWclt/YIk0hL9JT4wY33zjeHnsYULmycz1a+YzYn iabwUqhGb/6pdknCDCP2UPa6+jyYkWEPvTuhd39RWeT/gYNSOW0C+hmmys47HXdg2CPKocti H54nJ99Qaxma6eQlWjMn2uaBzZQwI/Bg9KiK4p6AiWA1Cz/KSDCQJX5wUUaCVceC83pDQsza POQNKbAvwSm9IV6IEb0hfngn9YZkOYfG80aL+r0h2EyJgUe1S30D08juEFWgO8SPSAx3SANF 4gy8qTskf64m4XdPKGg+ezIiz3OBlrEfnnWH/ILTGj7NIrhDKuhoEmXBTNuggt1fZ0hwhH6n eV0eOFu/IySGLZw1B3bcUzRZxMil1U8WLN0xqWlXNpo3mpFla8WcIjZTSknLMOVA9MWfjbbb L9P2cp6aCyfIjBuEjZRgMXpNRatm0pKhbKml4eNYZrZIo5RiijKDTicMZpdDO3c7XXdU0GdO zTSV7pdRRRmrQczMj+r+hN79QjaaI287eTt5CpNO2d1mHG8EKx6mq9GUNppeRqOH7/tUAiyl s4HpyAlkEEUram4ngrdyLfICw8J+cBHyoOtUMuDAp12hR/sqfCKNrNPydKssMlT8/OBcMxRL wZXDE+9i5HoLxeEyJBaHBqrKAxsQfr9VDXncLKO7oAmyv0Tj/Zp7NVOLHQtBb82UhqGJAaXp tK6QIicZdQBH3mOz4b1uViydwqQYLUKo8R+2QQZO7sx62Csr2B/1tddOmCp07OyBVUJjy1dY jnDdTwa13zEaKlE4fj1E5dak5rXjCWf9brQdNYDvGwCEpohKQvt/5mAitAHC7DA/NONJCX6z G9DAGKh1+EumJQUHLXzuilLorfGDC5+70mTorTmKXrzemhCTjX0+QezdCN24PYUqz3MheKBB 3yjFgvNO0xzV8Idmr0pfYhYd6/G2/TzBsXs34VTEpK5mhROqDW8YiVqipPVjG74pcY0qjR9a hNRTUmn84PYkyRdjopGObRv5jhvm2GYQbm97yisObmFoFg3ZKv4F/IftrnQhDjZf3J8x1Q8X Gsq03GY2j0PLmIsITZuhH4Rk1xOlE0zNgjs4f7qKkY/dj5/lLpuTCm17coQfIFqVGCU+0RkU FfYKY8CRx89wwXF59cUwqxs3gq7dp1mMAFZ9su0g0QgzXPOpyHZFwjil3HYRD42QVlkgkM5g NCSwx0iSgfEZJQv5ftRe2jTSotHvNJOZPKer+8GSCI8hTWhjMIzUZA7SMhUL1BnJ7Nrf/WQ2 t5XPwNCpZRmF28OXIuQw+LbmsE2HOvl3pn8cXXG83I+LoQHX3qj5Afvg/Q0UJIoxuKIf3Bms Hp79y6IALxlL8GblFOUfUgRWjqPQM6XBZ94Gl1sSOpgxiLd7EsuS3iMoKFZ7XV2blnPtDoKY /XxAM222n4QRXsslrqsvVuHpFemMu2XoEPSm57du9bLAGligH7EWYwSLP2b95sKQ0acohWsw vVoqBo37QTiTv2Ux7/b6Se45ukmtMnr0tNYteIhNo116kXfbKEcY0qepqpbMrkUYn439bPzQ XHVxiCuNWUWvS1SailoMF1C3hlHAiWlgOhnb6enh1/e33LoyaNQMZBS6cEMcldPn9s1A6lvq +Wka5Xar3oxpRj33BkVx6uj4f/9Jv44NCmVuZHN0cmVhbQ0KZW5kb2JqDQoxODggMCBvYmoN Cjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDcgMCBS L0YyIDEwIDAgUi9GMyAxMiAwIFIvRjQgMTQgMCBSL0YxMyA1OCAwIFIvRjExIDQ2IDAgUi9G MTIgNTIgMCBSL0YxMCAzOSAwIFI+Pi9FeHRHU3RhdGU8PC9HUzYgNiAwIFIvR1M5IDkgMCBS Pj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94 WyAwIDAgNTk1LjMyIDg0Mi4wNF0gL0NvbnRlbnRzIDE4OSAwIFIvR3JvdXA8PC9UeXBlL0dy b3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRz IDYzPj4NCmVuZG9iag0KMTg5IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3Ro IDc2MjE+Pg0Kc3RyZWFtDQp4nL1dWXPcRpJ+V4T+Ax7JDRNCFW7PxETQksc7G2OPNsRdP2jm AWpCJMJgN4cNmtb++q3MOgFUtlvuqvaDTLKPTNSRx5fXm+unafjcbabkz39+cz1N3ea+v00+ vrnZPf7rzc2Xx/7N++5u2HbTsNu++fD8aYI//Wff3fZPf/lL8t27t8m/X7/K0gz+a5qaJVlS tmWa86QpeJoVyVP/+tXP/5FsX7/67ub1qzd/ZUmb3Hx+/QremSUsqVhai7fVbZtWTXLzIN7z w4cquduLr03u8LdW/fbD61cfL5LLfyU3//X61ffi2/779avk+x/fJm+Ih/huN027B/o5/rrb TX/0OfjiOXhTp2WdsCZtCnwM5F4x/f3Nh7/N+T6RWp7VacUIal+zRF+1z3lTpWUr9koQLxJW 8pQ1CcuAb8vwse/zHwfz0TYtK/86XuUXyQ38+yFZrekJlAuep4ykzIBgdtle5Ei/vLwqLzj+ GpKFskzrgmLhKiyp5gApfNrkf7PL5iLN4FFTfllflPjXf17Azxn8zOWiBGSr5Dxt+FlWoOQl SSoRdzMXf9x8vMjqf14GJZuLhW+oJ1ycaEmNtzytc02tTdvKd+mOeJefI/PBwwuRr4/6HyaZ ZzytyLvmXYSyAhqKVJlmsO7rRTjiXcS2qA8eyRDK1OTNh8duCwL1x7d/e5dkb/7ebe+Si357 9cN3l39Mq+RyFT2cgZ5ci/phf1kI9q74xRau6Q7+WUvFEzmomzRvSBb2l/nF1Any1cUtkO+e 4F/8EbnrxY91eKZYnqUtwRScWvHFDZ7bl+5LcNqFOF+cWpDwj1qKLyDJfQYhjBv/hPIZDkOX CBH9fFnh5vS4Id/A3/HFe3NScOuSPbyhuPgV/rJ87058h/O1W7Gf+MnpHj4i340vPcDvwyXL 5c7jP2P/CU4FfMdv5o3TDt6JP+KbemGBXZbq81v81gT+lX+4Fc9hvktxbb9r8wWO1ifx/Q4n 8lsvWSZXpt/Ceza9eYjHy8p5+mcgg0/Yh962kgkFU1Hb5l3j0BxI0SGOD+crBtwt7D+bMyHX As4P7kD3Cyyf3BLcfmRZbpQ6eYp7fLu+7K3YBrErG3gBpcCA2741u4S07K9yl6Yn8cFnszdA Jb+4s0dHcjw8yRPUiq2UR1aec/uV3ZjAJ6U4mro09Lrmubj/ObWwPvN7oSpYVFXBWzBslmxd h16FKhfHmyQX/DBXldRCfnJaXIh/CdkTWigzvNYEO5sODqA9392438kLH1wVVWhO+tn4ZGQh cmGuViydXLdpwSlmHMmP13sXT/TyrE05O9vR5HAWcorcQjd/Fk6V/dMLmEtgOYVmqSzOugJC 9NArIOQ63AFUMqg0hg0K6A5O5tbYCyDSO1QZU7KDA2rvzzAlYzf18ONTcGleCsefWKrkyjUl /xR83XLhhucttW5zBTszefS9tq9InbwBGVjJ13D5pkRq+P2jsRO3RgyEfpyiqtFS9T+ONXmk JrfOSzeOyNnLPpYNxMQ6r70n1BfK9hg+hybdAJZB0t4A1gZ7tTCKgrPBeIZ2qJeN8DqA50JP e6nNL5M4r8FdQgY4jP9BpTMgpUuPdwTEjbRxN0Iko1ekHJB9srCHEyl4UFWJi+WYugPamlzL LdhRpfeDW528rtKmPW4ffUYnD2B0Atjlv2FVy1O2dnOu0+KkdfARbLK0oimedqJ99BgTR5oi 975/+rx7euhQX21Ot2Z8DPCsgJ0/7oF9W5/H9DeqOgOrb8nWjwNekLk1rt13ccUeL9Xlwr8i +qDksbFXXWijUY4ifund3K6VLv84OBDGF21Q7IzRIfXn7lK5oVOPmNX0Dfq20mDf3OOdBhgD 33M3R0MmeAF57lBngA7d7MxTSumhPtMaelfgStfSWZUyZL8Xz+54xJaCo/GbaLZhkZdpWVL7 tgbZTybXAFJHkJN79wirJGyAWm7cg6OXE7EdzLFZcHunITxak6dlQ3G5gCvUoWpiQTaVMAtb wqmUZ1R7cAeO9KO+OBKxw+Mmj+OYDA/ijM3fIC/PA1qPcuX34f2kIi1a4unsJej2yQvideOY dNpdtNfj2ezFBvWtMWhZtYIY5UHCdYMvebZ3MLglXwiHKyeeLbzfAG5/SVB7nHsHcyn6oJC8 OSgqlnxEc9zYRsajwB/fipfG7hlewkuIB+w6hc+z5a3Q36ngOiml41yTogZb0/v8StL2ygnC 64IMboCh55WU+YgSPIUXG/jxX/D54DYcK9q0JBmPEDkQ76wocu97dT4a6ngEh2XyNGspdoIr Hp5VaVFS5OTGo9lvcYjNgBL0TlsPPljRDUPg6Z6Lp4XXgN8AGh199mHsbbSun15QHOObf5Ey LLScaIq0Jlf8m/DkBB12tuOdN23a5BS5l3uDhCyDGrj1X4zgsrjok/5JSkUJnaCwk+pDKc3H uXs49WCi3C6DG0qMdjElYI4xJl9M9t4GYx1jYdxZa3eU0FB3a4zenQWsN+G98xaiJQTHUhcB 32b1iTuCr32aX1tc+pfhVoUmQ8sRwXJbU5wbU18uuFCkznJrUyQ0Rw2D/AmCI0xO+gERVqnC h2noJvCOODhe+2drRmrl/6ORXDMx9b3xrhYe11sdCH4wluaztMtVzC44sNgKn9//wJijgpDS N8EXuqiF/KTWWRjRjXz2EezmUtsS2oSKc+N5keZrEEAaW9affpabVslTKf2EEeFGEGLBXUrG OHpPfuaCa3YGGAm5FlI47HsTVKC0uJuXICWldO6/aOc+PIYnvEzeUowfgeQUUZEcYZ95cHtj J86sG48j4QTvewdVwd/3ycYKSal3FBj7ZGIB07DpxtHqZaQo/uJ4I45v5xz53noykuTU3126 Gnro998Gtz54hh6ff9GO2MsywF4yX75Wgfho2fC0qpeM/TnL6uYvpyGUa4qg2imKJ0pCxtb0 Wn7gCS/eI1qPZsNvEgsMTZ8BBn/G51UhHIIeerQdui/3/WkuhJd40aQFQRx0b5FL7fttBPe1 OLDM72GLG73FRstJkAyWxAnpGIdOG2mIR0uxYWG9VX6Ewp5UaLX3QxtgVSFRlDRjeDFTprym FsHg3AjDtOafbObILFIvhjsDPaPZr2LyIMybiwkEcG7fLNGk3iRUSTGvHCH57UR4/7NcD+1X vOwTqS7U1wReJy0TapaycrVOUk3gtuIuO5spMVFMSQnuf7OC4cX1MxUhG6gAT5gg9xH3JuVC 0zIJcYUmDzla5BY45Hkc8o2QyjlFPjX4MgiOXMiNai02ZPxHiYzKTW09gAHtE5lzManwcmIh B4xr9NOA3pe2iuRL/zZnsd+Lg1eRIS8lbAwK0T1calBiloc5N8wAGje5BcFjJRlqBP9CY5po 3DtetpB/6c1Ed7LKcInc1SPTVjs3kLDGScbgGeQATcJR9T9IcFyOZ03alBS5KPlweU2Rwyjq vfWXw5PPWZqRT6u0lQngPjo4mc2acpSgzfuQUV78vLrqwZU9q1DZUwc8ggsjTL5znYucc6BD bYxzUxeI7NKIcd86RzT3086YYtY+Q6Nn6tMoKbhFIa3UoxbR5wdWkf1AgMdXUcKofqCXYkQ/ 0E/v5+ufEhl9Ach+GoSoZ+xi+D8JZ0RwlKoCgnsEN8HxB1bVaRtnrb253ZgYQZC7RoP/Z6H4 7ZozlfOCC8/Fuq8THmXyx69odG3gOot3f9G5MhoMigClgk/V1NTD2LhCJ+lLACt87m8LRaTn 2sC84ijr/eQOBVs8/l1wGcrZgQ0JL7IBfyWX/rPRIGAlPhitg+fCxv9GncLr2o2bcYiVPVOy FvXMmdao5NJ1Je7IGTx5CLutKbu6380GhOgu/tRN/YuF8X2ZKZ0xDMbuycBD2tRosUTw2QTD RoQz/PHI0JZr1UCCFPHk4Q1l4cBljFxoa2910yQzw6RAT8RL6rybHDKVDr2ZrGDvpi6RC/gL mmNamDu2XKtKGWZ+cWHc4j587mMpL5H/kYPHe4pKXqIzbWhRSfzHT+4daNoGNG34MouibSHT iKDcTWgfqKu776OJDCHXizVIOhcTwWORBWRlE6Rd78StDjDQ7KMGImQNbj8BBtU4csqtj9Kl cwZTdYAOCWNKy0lsMKguK/Fkkf6kgNmNra7SKaMJynP0mDrrctk8F/0+qHfA1RS3c7hUD9PN 8zDz5R2XZh5UWUh+bVRQQjQLj3wQAmZ4sFL+HLqG8bRdQ1lQcyYjnOF7CAj1WjYU4QhlOeKU UtQMMnsFjV2qCMhsUaF08JOPkGUpI1ZHra3PI6+jlsoUTQVJeetSmTJWqQxBMVapDEHuH0Kz P0orS0gMtK9PqwHzctDkaUlxcJpN7iXXMmj7ddwC+45aEzOho6jKNFsrpd8rzYlRK19SzMzr oRPdEePRmuQz9QL1do210PFDVk25qSbd1tj/izr4T+aT+KHOYLtgoRa+PBKlo2cNbWTmnK0U xBrW/OIlPFAgjEheU+sXPq9FGJFZTpE74ki3cfHMosgh6/eMeKafYjw8k6D3VqJnk8xamNC3 upVlbxIoz52A5raf8DTiZ55+QegTbse38pZFiPg0JcX4/wiLH01Oa5BKQxCRP5t03Xvqln7T Bu1kk5NNsNYNi1rzduZ8Ol4s2JS5Ux3ilD0Z0bAMtoKgmSU/rNEEzDWxAspY1JFM1SLnkGPv r6Pz1UBe8VlIVsnXzyZDQ+MeEZIBWpJd3O6NKeeS0nX6omPeNvQjC0M3Km+5WOQtv3tnNuRD gjm4wwTZLXyuNGzs30lCyKMkIQDMKoxO4rGP6Q0Uoo/cIfHJM4iOnlN8eilGFJ9+etebja2+ dTJ/tpOVBqdlb3mDQmWetg3FU/igUFkDvhVlyb3kWsC3vnbFUU4+mas7htdHXJrlfr6OyOgJ D7WW0I+HYMhZFlRlEhCRtWjhA0EMkSqClWVqIxrH2C9YFrI7JZMLlY5NB30RPSjr1u/QeYfC OhEGibJOomDpRc0gL5t4zOApNlApcsaLV0AzEPLi9fup+4TJEQNcveAVUSU0vCKF2uyQxLKC siYtVw1mMkCZIBd5F76LTsbgy710YwjWDNsREOQ6B/F90FWNti7e7S0UQYAwkGWc4q1XaG3l uOWqdiO815FBNc259oQz7FpM7UlElJrzFtqrEZRlNLpzUppV8fv0NGzcnAsDzcdLDc3FGtXk GsmSXIgGNUrRdOElRA7tuMvfO54Yxa9mxzNKfbL4JMHJrEekCpLsgusJVkHWx7muSMEaSIIj yIVvLSPMvPZ8AgDSRkpyMW0yafgOOjX0GiXobq3c32IORPCgcgZpbWdb5Co/oGgNPhPcnqrR WiSExm8IVEEEU5U575y76yIqseydvK1TRoh+677emV8706dOCv3gxfwcvFqCq0hV76yA4BJB c5ikkxncwS2hpyBB1PHbtirGjXH+XzWcFTyPv0jrmuImfLVyJuiQ5MJbOVkLTjtB7saUD9u+ ofb4KyhZp97F6LlQYckGwd0skSx8u4cq5SVFOnzfHGG2VIwih03vZLZ9nxgpSKSOdoAcRGxv IzwR1p7tgOZCSdTkwixAdhtk7BclqeFTiQvhH5TkATlNLjDuM0g4xAaPW3cvyB2iA/4BkBv6 HjVnrXnwU4wHchP0voNZC+M4oF66czJeQUXdarn5DLqyMxaDmbih2mVuh0le5mF7mjXp458L j6RgFP/BAXHOWlSZMbbH66lzgCQIch/CkxNmK7mYzyZX3bi6sl9Vsv9iwqaydY2BBh5MxYx0 KZx6qghlGEXaktyrRn2VU9f5YEeWRKiPyA8ws2hs4uv05oY0KxvRFP9zOsg+aW/ByS+HbM5+ f2++UiZcLqefxC+rzescyja97XRQphS6K27w/KAGnC+Cfvj0QM4AqifIRemI3lQUuR9juGY1 +XTzm60Scmc9Mq7kiAqyy6ps9OOUA8gUZ5tsgG1874xyUaDELHniSfcLkkd9Nkyq9daz2+6u y1qOZ30tBux7m7tpHou+XPMufS+DJKzEXu0dH2NDgsGPYZl9xTH0GlEhOrofMqIq5jHvohpR XooRjSg/ves99GOABCpdAYc6EHu8b2QqVQzLCNrdMIqnKJkCRRVnyYlMAUCM/OTexSiOZSQ5 RBAkeDPLl6ocVY2z58xskGGzSipy3ory02aSbW3imcrKc7+4MwEyI3nkn7o7xDDcFtyJyS2z Eu9Rd/X7ogUyVMquKyXQJAle615C4JdYVtMWfXpxW6d2mP/RT/skQrRH3+QCMYujy1qD6/gG QGuCi96Ybk5I1AwZCB4WZZUEZ/3MGEt/MTu0d3J1YPeY6ZAb3GfJoOqQYG9lWbf+nr22i4hj vcCzLa/lZny+1PNIXTsnuC/TQEd24qkstw4iNCUyw+dgQ5rQF1gYHTyn2AwfVsnyA6uCwhLN K5ldhC5OHAi1KBhqOz8j4es+C2nzH7XMXtsuxMiWQ7ZdXkOl8TltOy/FiLadn95PYNZV87x4 lBbXt7dP/d404logZu+t72LNwhvxqrQKtyA1x05muYAPooa7BAfPIN+ypJ4tPHhW5ZC1GGXr vORKSHMhyAW3EXkt9CRJbvhs+rGpIbnKJJtkUdK83WHj7yvlYm6drCJQY7KdSUD9Xo45WVT6 Lr/ATstzW9rPmiXZyiQ9uyOStcWxI7o/HPpgkLpVRprbKWNe5jEbTxO+DWNbQOYWwfafkuAZ GxCoLZif4HwMXniLGMKo9MNu0bOlm+obbNKeRnveZGH5DPVcttwoIkT58hZqKYgHCj/EAnp2 5hS5CKN8ijQvKXJLqTJKy7BYJfRdrUfv2IpI6Ybdar/zFNmj/bpIggVy06nurbZjpurBd3ty nJ9lfl+upFgRFtJ37CQLyQvZYrIv8fARkneqlFHUTCaTqmMzoQ2nc7sL6QaX1AxGBBHMLY+w nr6jyn6DS9KcpVVJMjP9bvqDTjYNzZdYJE4uUvh8ENCe5DL4WjXabpl2boicpxCjASMI7KKm +Pv9OZRX1WIKnppDKZuTWJwhApqWY6jmTPe+KKqUVxS5A5omNB+NELBne2qtWTI09r1wExHr 6kaM3xYxGpRUkMnoZ+kYdCDEGJAD6ABvMzAhz4gO+CnGQwcIeujmy9ERkwEi9dDMjRYSW6fi HvH3SN4+q3GwGcFr+IhQk4E4irIVXnI5iCOC3N/Dk2vBJSPIyWaB/cq8WUSstW6TwqIzgWYz XJSwzxet7Yz9iu46NMGb9aJ33ejgWS7YzpFYBX8J2ZXuinjl5porj90EqEbjIxDWuq5ZU2vj BN7cO2RWLY4a4ELeMCLHRRhxWEKl25LbdhD7fpFuLFfAtGEzuEWhww/BzeIccD+Ce5lii0tr 57Hp0s+r2fw/Y60tcz7sqA/8sqEbl81uZNU0PPOtcRaNQVUZe2pn+0Sqxr+L75mHO5xldvO6 D7T3CQ/Ww2gVTi3uMeo48iQnLi7teVs2+ClGVMd+ej91cJhOE4L++U1QSUIQlYJKSn0oaZ9k Pc3VqYlv/tlKJXj+Z1tu6IzHKHJPZganFOjPRgMEZ0OoHxBnfj7CGzbCgeXkY0cQ1hWEMQhy N+HxXn5gMfuxF7r7q5D5BaLRxCreYCWUChN8h4d1YWbb+Q4BjNZoyEPgjFZ3xqGsUosbp/u4 C/EGr2tpoHyE4PWTUb86XzI0+baBlkkEeT2DpzcDkRQ8Y1KzwARdd9j1ZJv+DX54n2zltKb1 8O2IZmcp5PzBUxCprpUxLB320/cknlAW2rud1MQQRxBsq+X9qXswbYPnuTeHfIB7k/+E5mf4 ec1VC7iK/5nDo6M1jnT1U1sN0KtMjrS2MX7Rtu6jPYTtKsuZiN3Y/jnyFEEKYeUMMNeOgRb+ sj4d0my+rBKiIp5CfQsK7IV1UtjYM4wiPDzXYC8fgt0IQEgFJScEueD2AviSGaPIqQrFHg7h 7JRelatjauOBtl3U7MTV5sBBPyg9F1s1/beAByb3+7oB6nPtYAUyLWN+MOaiZ5kEO5sIWs3a t8oIzq39Xjfdw2byQoygXqVtRqky1jcl55CudkBhkGEnBdR00/1cFCxWxT6IHXfS7acnKKfY TM9GroQvVuV5BWXexCOGj+fyvIWQop9elHguLwpIj47yhF5yFcTnCHKfdUUaVcyjgS1x7Ctv 7U3wZEyYA9dSOzIroXZh0d/v2hdcEeTCkyvJlT0GGYo82w1yqflq+HhUZMhLMSIy5Kf3D7Rm epl96aZcnre5p7D9SpLH8DhGXaVtnB3wUmth4htB7u2lsgxcu60iggcHQAVCPa0bAAvFdrqH 5tMPkP/JSvoqhdcPuXgnO99GQoZZzShytkriqpqXSVSuU7BMJpOm02bEbX7WWa34AZs0iD24 czVs2+n6emqujm8bixb7Rp1xG4sWwdQz7WKZZRil8JOLnJeHA4TXVJee5dj/Fr6yqobnJRiw jb1vhHyQvsuXKEOFVSMogo9DcIed4uR4TLZJlzVwFj7/w/zDs+pAxzdBt6lDDwV6vgo/axwm 6AISYWIlDFbOqTUIL7cgLbKkyDmN/T09KxoHFVkUXHY4qKM0Ez4S4//0+93cB0Wnsd9/E6Hd HNZ+E4+2EMnBxVaFev0Q7eAtHsqsxWSPMx0dJbZYW6e+JsGslsn3m+D9NlnGYRqcj/DHxXwI OUbNTmyoItVbqsprP0tODguKGtXsQ0uQ8CcfevYWjOBGAk6dRWiQnW6EG9xcBJ86y8sKWi/4 ebEASfDLAAB11pKnM8ezGWHpa4Ql/I/rmzWo0lpUTlOuuklfxWx3qWo9/DxadHichvCZUeJg UqsTPGoA3YZq/xH4aEPwjiYKD8I0LUTdaA4S3QpmmQA373O3yP8OP1a9KGoYJONnNIIfUWYA 9njJxXEjhGWZU/I5vOVRwtR4PzENA2ozdB4adNMVLXwfSXE32GfCKwB8bXqqMBCgP2UGcrUJ ho6BAEMMkzwAkDEh1fkfAydDzB6kx1zKXKNVb520OmmLDky59BOMNeTST+3t7uFxlIEicMu2 GxlQ3X0aZfYktHTD4ZdFjOGXvM6g2aGftfDDL3ndQPfBo9bdewBDTAr0ORvy/PEK5OrX1gMN DybKqduHOd62hFmWidxuyx6TxOrrEThiDzJZMzsm8og4wGer/NA7AyQI28tI4UUoRAZM743p Ln3fvU4CpnqhLFE+/Z0fMMFGo60J/P/v+HCys7Lk9vrOBgZ7J0BkFgjIu6DMFXciyqF9SrnN rIBWG96wl3D1nad3EAN3zJ8xcfQAz0FZ/fMAsh4FauLTsm2j7DlnLDZnbPUCzpGzL4bNvQ6C 23ozqXLH7lHHLmat6RatJzd2evY+GSyuBID82D3roK948TqF9/PwPV2wYJlY9/AzHjJsukyQ g2fML0pYhfCqH+Y9tC1F+ggBxyPP8mvztOLFOcN/forxwn8Evevw9GCQHUnvVyllERvB+/dp GAEhmeDmoVx+89Tvh3GAm7c90VnzWqHC/sxzir0IpWAN1AdF2W2i6pszitz3OiCIck1IPNZe TEMXY2ogdtch2CAybr4ihBm+Ql1lGRMcvwxj+EXK8+YASblIi4G5OBlQZn3emQRQZQ/9iqYT DvVe5jyi4dHBhVsAk8HnasCsa86pZwo/K7DCpNxz3a5CeAXCQyTIeS3DWO0dlFRvxPvXlnnw mX1tlWacoiafW17azaAaaMKdNW01pz54+SU0XW0pjsK3PapwTKOfmvUNHg3UKPuR4xhtricd Yd/vCKP7MGua2JoISYfClBP68/eWYuGuyTNya9bHDmeVB4Y79azuPNvgMjdrIKPdz32EGX7Y T4M6pIsbcjLm681YySEM4ucgfJYfFOGVZ1vdooHZKX5qN+YMOf1jTHG50/PNqZh1Mp/tBN79 8LRQwiP6q64zT+pbN40gKswrFFPlqQdwByPqIGBv5PM0PJoo/dhNTj63WJTaqc+GrCRVYeJY IrZoXdWzfLJoyKy/s6cMY23SJRInMlaMzupQk9iaGUxiASIHmHG61WOGvIYAIE9EQS2dKnXq 55jOvELnCOQoziaWbcrW3jGREbNMX3HwouA9VsSfCOa8GGB1bEugxXiE8FHpEmYQ+jl3K9xM fxp5+M2Y7UeLUe30hRimAXvay4ykjc3K034VCVmu4nuEu2M3VcoPNR0sfNOksiD3VQawZAMD VSfiZvcInx16GGL+hZ6Wu8Zw/h/F+u8YDQplbmRzdHJlYW0NCmVuZG9iag0KMTkwIDAgb2Jq DQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA3IDAg Ui9GMiAxMCAwIFIvRjMgMTIgMCBSL0YxMyA1OCAwIFIvRjQgMTQgMCBSL0YxMSA0NiAwIFIv RjEwIDM5IDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2IDAgUi9HUzkgOSAwIFI+Pi9Qcm9jU2V0 Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA1OTUu MzIgODQyLjA0XSAvQ29udGVudHMgMTkxIDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFu c3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgNjQ+Pg0KZW5k b2JqDQoxOTEgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNjgyOT4+DQpz dHJlYW0NCnicvV1Jc9zGkr4rQv8B4RN7QoRQ2DHhcIS8vDeaGM8mxryD/Q5gEyRhg92tJiiZ /vVTmYlaAFRStFjVPsjsbnRn1pbLl0u9fXcc++t2O0bffvv23Ti229vuKvrl7cX+8M+3F4+H 7u1/tzf9rh37/e7th4fLEd76t6696o7ffRd9/+MP0cfXr5I4gf/quhJREhVNEWdpVOdpnOTR sXv96h//Eu1ev/r+4vWrt38TURNdXL9+BU8mkYhKEVfysapp4rKOLu7kM3//UEY39/Jnoxt8 1Uyv/v761S9n0eaf0cW/v371k/y1/3n9Kvrp5x+it8wgvt+P4/6OH8ff9vvxa8eRLsaR1lVc VJGo4zrHYSD3E9M/XXx4P+f7hdSypIpLwVD7K1P0l9Y5q8u4aORaSeJ5JIo0FnUkEuDbMPzc 59zbQX+1iYvSPY/n2Vl0Af9+iMTmvDhLNs1Zhu8W8DLFl8vJfgFLeVHEVc6xdO6XVP0EKYGD /L9kU5/FCQw1TjfVWYHv/noGfyfwdwr/JD7ZKtI0rtOTzECRFiypSJ6YTL65/eUsqX7deCWb yYmvuREuDhRRS5s0rjJFrYmb0nUUnvGUmyP9xacnIstX0/DVJLMkjUv27DknoSiBxkSqiBOY 9/UkPOMpZlmmLz6TIZR00dsPh3YHYu7nH97/GCVv/6Pd3URn3e78799vvk7WZzSLNmdyjktg DdTXWgK3u815dXYFZzTanKdn95vs7AFeHeFsfoK/evlvftZuRHJ2ia+HftzkZ4/6O/jt7r6/ gRc7eruhH+g+ws/jD/ZH+WZ3tzkv5Qjh3fH+RYrGMdQ0z+Ii44b6BtibD3J7C4zge+195J2d OonTgmPnDmYVuRjG/gAsDF0Ec0YTd7WBT0uaT5xhWqoxun+Eb8IYRpjOAv80g8M1arfwI7/D n/AjB/jDPHINH7b9AB8RNVhc/Ki/l3T3yBVoWKA0rajnyVHbspDHaz052xbYQrbbSxj2tOn6 7v6Nd1aE3DZS/jKs7GkS5T9je4O7N8Lz8CDZwXXpx34HU3czn2Q8MGb18L3xFr7a+d9puYib ihtBN/S42YBNyTgsa6lWVTKFA8QtAceWdtnjTCDQF3F8w0bAdvHMfyb5B33o5n+ttl9MLo+b giOHuw4nhcY9Rte4D+3zgltgu4epupPWzME3hznYy+yCInO4gJ3eZCMcXHO69yTD6/mB985m JSeSPcTe1y2v6jjjqMFGbXGlaHUO+tzCNJhFhee6+9j7GSyyKs5Ljrtg8lOag9IKfY5jtTA3 hAdzQzgYk1sCGUuliVsvGfs2Sar6u5dMRe6g2MRpylF84cwLwU+9m95P8hxKcSttHRQVKDW7 3fbRWBp4eq/UcT2AIrkcevnvNlKavdUyuRvhTyOPJ6EjKdRnDztQiaAry7MRHlYK2/eI01qe 84wb8b/6N5zqOG3CLKiLXJPEteDIvZfSwyjLyYA9whs3cwm89a+mkrhg+ZKmkHeChVTDBUfw jX9yeZxUJ1vmrCCn202O8Qlabc+hgn3QmrfFjdBHn/HBo36/BwNpp7eH90nLyxyBlxNNWl5W cVqye3CMepg4nCByFsd2iMY9zI3xRvwbvEoEC/DR104tugyTOyWZ8e0viEZS54j7d09ShIcY cmSPorukdq5396iM85Sda+06fu6vjPWFm4GORd+Nj5ty5mvUAYS4KFFnuLkkS/7KwBnA63Sc 2+E+AseMDEXj7t1Ipm+14G8/weRKG9psrlp6Vh062uNRD46EwBa3nnIQznP0Eh6sz8m5ntww 74I8lx5tyS6ZfyEhd4hgT+OvZzhFt3IGOm3geD+UeZXFCTvkAK5IGWfsoST4Yhi6q6DYSZLF xdrV+AZ1FiEWiDfsNZ7Xy5PoWzpkadzUHC/e511kJbhXTnLReRILKQMAbQ4g9fMcN9ipBppX uMGcA5W/XUg7HQZ613qnXDQoPNwD3UmpiN7IN/4VjTxTgt1KNtoCQFTfAivbjoArJX4v6bMb BDxQxhYv9IdcuqaUX6g4Rh3xnhfTqyGGyu6FDHeCf0gjlTK1LLhx/gw6dIodDN3lZsJX/qBo wASagXWwBfC2Hf1bgZlch4qZl19s7Wt2DBj4Zss8ATN7VxjyVDWszA7gJqSIRrnJBXAT8ie0 AFlf2+EBLJ4r77Sl+56wQ1XYtW+0L5Fq72TTWyQFAJ9uapZVS7gEIpyhjI5S/j9ZA44Yjjpq w2M74lqrUJZyqGkxrpWZjR/f6aAEiurSBWJPz/gPGErzLS+4MVmxnAcMvVH0hsJwyoSfLPo3 m2Z61A6oNlNsdOjRH6LlIWeooUF18KMljfRKLV7sXVBWSVxm3DiDbZU6AUPiZOTKJhYrahew KLfGMaUtaC3HdFrQTi5VHIxidb7tmzIBrN7NZ0/xG+8kUeu4SX7j34BDE9lNzT5DexVIC+CQ pEJ6ARXDhHczPRVZnAsnNXBH4IfrQA5Jmoo4dZMOMdA0h6xBNzWSz1Pk2Htsu4zr5lRbOC0S iKS7qfk3sAu5e7ixbcF2RsXA27CN0+vZCBuM8m925wXg9qeUYxAqENxEfb41SUVKB+e2wTHH /SoF+/m3grMszjguKV6P63YlxZ+GzUeM2QWwyGte8jtAYzu2VaqoJXykIpeBlHZRuQILZDYd EHJFLT3eIcsqcWye6gDKxDsIUkCaJcOefz1dQGYDQ629v5fONR6sEY4/oh6+GWhq1JpuDmJt Cf9o7HorK4hOnQZ3ybCiYPSDsrHsLQaSzY6O4z6DN71rj0xa+FXjHpeBTvznlGWptPXYFR27 AedgFiA4z9cRgsIKPZMAGT/jd8Ar+n02tU7Hw07KbEfwxKaMoINKDZxUxzbYAZfq24GQm21C YcNt5z//UqQVYMUMB4T9mOkNFKlUgsTNBGbmSTU1BooUiLoEBI+hHkj1iEZabCzRg4lG7DeV cgP6P/0brE2cCI4L7wI0lbo/Zwft33LMCrRTmYVFJIay4VBH9ttYO7YfHgIGi6G4qMmetfZy 6+nFR2FXBbNXpShi54rEKoZxO1K0gFV756EuIKGTlYbeyTWAjJ9qN2ZS2KfsqvsfnRQwCTuZ oPKmrPX+GqXrFnRjfTYGMPgrBDzcjJCVfd8PkEK9OZf6frJ0JufNe0i6QovfzczMPAik6rPc hU8vMid0+Yj3yHAFWTkMEwGyYhIIVjLkTheLFLU0NJlhIwKV5TnauAHsKynr04KbAkL6Wv+H Lk3yuKrY3Qbuq3/tLgiEOtHmSkWDqKKbnNGie2NAQ9oh2fxXYRR7gVXD/GJXFksPCkIw+VN3 Gn3RAWOMe5Rnf8CC3fuPeeQ5pHueasmUDEyzZ4RYXPn4adDyv1KIZ8RiXHxlYesEiqaBPJcT 1gm4KYarE2Do/S9k9peU6d/vuqvoqsVqI9QW3nmBGuM85XjxnsE/eb1BppqFzxhq/+k/qFbE BUfNADSqAHOF0JSmsm4JgWxNASjCEyPlMGMRHm/WthRHr6zk1UVNmF3jR7B4NQux6zi8d6M0 EXFecZMFoYp8FqrQRZJgOIBzqIdwnKphhJC2JKKgq8QC+joVxR42pTU4tAoeQxq/hTSG6oxB mcjZxtpVyAvdz4FT8tCHbl7HO6/go+jpot605CtNqQB4u5/VLOAXM4syUHxUe9SqJo50Isei /FPnLVD+9FqVI+joX5fXGfiXzBz7d2els14VHLkf27EN48AlVSxlt5MsYNWiolAynHvfpFMB WPipJjiXVlLBTnAgJDbPijhnxziJFxQtlS1aFEiqbFgK4fl3a5QcgcRyRzD4C8mM3r1bAfKa YWZv4gYL51bLD++uplTwGccPVRh09wf831bKzL4dhke9bpZ2uDaRq9YCY37dKEFrdIZa/cqx +FsVeCS5ejQiFxLfcgwua03+UQnh/mjFwCiUKTVCtaR5KX93IXwJmeQ1QUjFBgVnzdrO0bMN Ezqb7lU8fkqcO1pZWFqtU9SQhgNvHtTgJ9OH6ux0cqDRXbqXgjoSrY4qjn0XJo0Okj4zbkae 4UvlQX28osD0g6/gqwjs40lpIoqT+nhOigF9PDe993IXXnW7sV8UcWN9ePtyPNDp6eUVpGIz HCFRU7hMheq70T8XdR4LjomXuZtuchUkUgVZdmeEE8wxftXPFRZn2nNApqMy7a10OWgpU9lp EfR0gFIOxGoZjklWq8pG/2ITcyQZ2v6jQ8lTQ/XvLCQNwNHcedvNWmVpy+m3bju+WRgoukAC ESFpFyxza26VbrQ2EHhk2lggFatz0ZemK32D0IPufozULwQyHNIGks5X4bkrO4v+uu+0c08j Jb9f1Q9PXvsy1wjSZ8SUxT3cRwt4YwQwHH9Sz8wEkiy8ZN1gq/+o0286WDHL3rKhBcvkIIMc TJKx+wMbcET4ziyBnJ6urAWK5gWZelMcTEL6qhbCHp33qiTsGMkslX80qMSgGUMuQA5kGlcc NRLQGJvst90bR5pVboF4Ey4T6KSIGhx/ZxDRbJM1XhiHyRnKSogjM0xBO5Qrk7Xn0GtaizG6 LUQefFFx/PrXpGkeJw1H7omKwgA6Pf0iJ8v8Nv+9c2q0hE40+VmSQIdHhlx/pyd/IDDT2nYA 6ZRPIZs6SKlDqQy86R+Ywj4/zKC8e7GQpZ6wcxgEdgOsz03uv3Byf0N1vp0gf9ZAMJEUBSUE kscJdgpa8mq0uEEH2/vogGE8ylJf2gDtMFDes2kU0jj6hMwrPZ5MBXbn+8rX6HVcKNNvrSzk J6uaA/jzaH4MPsfTYzSPd2mtsHX3FAeA8us4rThyT9ejlivpidGnzwQCWgGrz3v9dzfPwjaz OfWSBIgrDmlL5A0W5yxH+o9NPlVB2ijcGOHx67Y6FEgo5320M++TLdweNYRhN5Ktl1YKGMMV oHaFEsTR1IVJ7bjJ2dT9hKcn3M1yStr+yI6R0wuaB1VOuDeQOOxlvd8PkzcBR3TCKZuJOPK1 /R1V9bJ1lwnFWV5bsIWrM8hSfb67tJaGdrmFJaMuTezziUScc9O6YTT7WU8tWcoTH9FWLbwt sMqZvDpf9ZjVwUx17HTxzroMXJ+t4zzCCUOjvohH/cw1Qe01/tid3me0GbbaDYQnloUr3pVr kQioOWAW8xlQbBkUIs6lyfhlUMTFVxUWIsb2GCvzICRE7KYYDiJm6P3wCCflsjvi8f3QbR+O gBa/NEHWnQOE9TAMI/5zgKSzX4WZZie1TC4rR+7dYOSKUSOfe8JoQBu822mJRSoMn3iHZRPZ DFXz3uczLXPARxnWUXJfamfGe6VjWqdQ+XeqdYJWsmXDkUPNZYvsqUeA0vR2y1XVhpVijzP7 a9ErigooQbF9Np0pkdSI2KGog8FrUH3LjPWEzYeKJIcyxFOtsZJ4ee2KRzrTl8Eutq4b6HR7 5EsrcubOPZr3nfKfbV4CyMKMJUByO7b6YsgFaF+BFwecbHQih8ZpDDkbXicbDZF7KnkeezIO s6VVqW8uIFTy2mCTiPB80iA8uTatMp2NgOmmNr/cZQ1P335iezZ/QBNvzPUjh/rGGOaOBkmK fJiEfXUIsxIKz1bCB6v6L41HaGTiE+IXAyu3ZuIoRzUi98ztRs97UYRxfaHUU9qWzFB/hD1R zveEdw1eQMiRYYA2AGgjZvf1lMqlwn8B6lfggo2UnaEAFZcZgDwMuRY3fHsgl/YTToKKqeV2 RhXdQ6NThWaJwdrpraxQ+yJP2p3Fd6m/aMMCEdAOYwWok5gWkMO22h3kWBt4hQKc/TXCGHRO t4CRTEHCW7JoOlsCqiRhk0s1BbbgvBIeYtCMRR8BE+FqnOCKE0m0/e7JizeOdz8ugqfEAXK/ kuHWwljfo5Nxp4B3igZTTh1HlQ2Pyc+sJmD3wVDjXGSQHebO3OR39UFhE6YH3IOBsSIuwXuA FbZbaUzRtmid2W9JPsKbn9GG75xraee9P0cDsQ9m7oy+UdlKU4ORgQY/KW6cQkIbTRbiKvmB tBRl+K769C/Um22EjN2N6XmilGGzLKkIVu6odleSgpPIIdiOUg4Lwrb6tziUobZyVhZSqVUU Bs+oIc8M4p4OnhS6lbM2ZTDGwxxQp9IPojg8aq+MfO/JhtLb3rKj5k36nmo7Cd++cqytw3QZ u2FKZbYrtM2shVrUDG4eWRvCH8YjJvkyXTRpq82HAYGJnd6Ry8aZM1S1mU+yZaiaW+BW+Uid 6pH/RXvYEROw9RJ8UQloV9KF3dvGAR2vpDwMnHjyHqqC9BHpNTOLZDByW8LLmatpL5paLOBZ CaZA+6hqwK9aGVpoyn/UjEz55ybvbB44WRYSm+cwi81Om8Kh4p1Ff1rdlGFtjWFr6Z4RNs9f OHmWDQB6LtN3H1o3i1jWggl6+A8fppA7xMzvC7HixB0dFQVD79sk+V68CA139tJIoLNekBEy nUIqwW7YKVzuSOSgDYB5AksXXRuDD1pX3D4XMAp2IssKeiA5sa+hHV0KO0jJgsgylGFudgLk jhWQfP48cq4wUx00/AVXQOVfxVcTNvwFzQrSk4a/3BTDhb8Yej9QoHg0WmhY5tD0A12OR2Ex W+OOlIgRoHpBfiNtTjdHoqngBjqGnrowUEya73BUVzKDyes/TpjmNSRUMtz4v+2vEOD7BZls J7kcZABDzrgOK7NpmcfqxqV22sqd56FMN2AoYe+qnz53ZmDYuhAv37XLByOrfXzQtv9Zhjeu u6drdsk3N1VhoF+Ry7fc3EVW86OLAM3cBbTZYuZlmYxD8Kb2rGfXo0ibhyAJOyvPcvGW15UA HmGn6PV4m22Iyc2EQGPNPcZgWy0VEJA+GbmkgRaZS3Jijpv8vAc4gypJFtlyB72SBIDIxSWM loDdQLVnDNsBSt1SyLhmyDnFpa6+mYmqIH3B07yCyA/DXaD+ptAKCzSIm+gMbPSfPZFAoIkh PVFlMeO5uz9OSdfepUbWQML3qTYodPdMKo6cgnCHoUM0rVJhhEUWAr4kYAmRQoNnkYwFfPN2 rvYpq4SyDPt2nDq7n69yi8KILSi8EI5okocbKb1LkBJyDBiGvd98JRqEFhhyARI2BKCDDDkb 8wzQkjBlCWM3KVfJow1Wdho1HgNcHgeJ/uw6vCdLuHKBPBgZWIZmKBkjQPQOsIqMncd5dG6U QmR2b6u79/pcBQiFbeqGI75x6lpAs7VT7fi8zuOMo7bueOI9la2GElJO/NmpPMFEb13GlaNa 9qhVSvuogzXzeNU8m/8vl06+0REarguMdWeZwwCYOo2N3XGK8tg15nY+4jK8A0atM2+PxnOl KtHtbL0nag3CdQrLwTZLuSUKtiOq4iTYhSJXZi6HLF24LN41K/UQZahrDMK7QSnSDO6gZ+gG uDYCe1c+NUw8BTcLv+/Pdq0bvLfBwqvgGdbmpztI32XplzPErdytLpDvA6EMlr53OzLNMPH3 VLsuzTDxlyGHcrW974wot7IpvJeVl5BpwnBCl7ejz9NRH0T/92iBL8dzEDQdKS3jrPjC2a+n o4982MfeNzPQ7Y7ZgXY/yHYI0W+zON3ez6S2Fux672adXK1QqVJ0YbP7cvlkwepcMvdUQYqV p8SlKRI0SIUrCCDcWRZhMIOhkHqDuaXALqNVL03uVEsZF/juo2pIQxm0JkeLTEFz3Zf/29jA 5WCH4R9CqLHbP0MugFYncecmZ0UFdH0+rg8BPbeWRjCrqaohDtTeZrRKa0wTACadGn+Rsqih 4ZSVUmlSHq/1LtG/aScSLnMvjW0YUQqhbngwuf/RLGsN+F+2L6HXdkQl0FHJnZcW65z9Sz0U XZcyRLfmosI777ujqFH+uPni+kXbadV3Ft5Zq2kv7boPV38q47TaTVSOOuJBuCigof6bysgD AYihe8j+i6CaDBLzGXKuHDnyeucJpssoyMFk1JJw928eZJCbxrAdq+zt91przqA2qzPhTnsz c6gNSndWyEDopkbqGKb8vaWrcLMGfcJ0wnLzEiB3SqqBkqFmmtvOAKZVGrq1NafVnYFMlavt 5E51IlYQ1INGjRbYkvuO+xWqNOuptL6IUu2p2r2l/GNCaQ13EJxoGdUGFlV8uiA2VKmK9f0K mYUI+d6tSQqdAxnCH/Za6pBKMWbljTEWCeqkeNwixZg+skoY4LHajl7YRUVTz23pi2Hsy6ox 0tbOHIe1NNgnOBRbsm+nDb1srfSlYlRNxOoVObSf6UAN1HrgM8RaDAi7ML0Rip1fU62M6XYw 6UBhNo9oIAnxuYVLU8qRVQdA1VnqfrfJmNN9vKnNDsYf02dWHhn8Gr9sMulVvhNXDTTezqyc RT7wG1O45j2GVEB5JTORc8tMN0g6L5VGhq1hAfckSddNTynDXY6cLE375m5TxGHqmuyDd493 fg6YMh9GHqi9VGcuJ2bhos9OIN8FQJ+rWw21fjIjuzHHxeg7K2QPE2FsWssgnh1+2Hvz0z/v OMCrr4VJBOSkDuuxe2xE7tTSUlmuqF1ibtvg1VKtf7lpk3+tKVdUmiPMgj4jZVokYXK5izKG jVZ97YVmQoTN5RZFE5+02b2TYLhMbje5d1v7Cl287fSyH+A8j7CBrXwa1NsfH+CjI1igIsUO 9Jga6T2VOSkAVXez7D+TOanBbw2xHkzvDnZsPxv4ZNkcR19AtmgbvpC2n3Q5sbmcY+X9kcJV d3Wtqwb9lw8J8HlPNMOZ1OeiYKg5NdakxZtJ17XaYVOSv2S8qCk771YvGJVrt/6DK+oU0zUR T7TQbfvjEsLw3l1H5NChm+HFIPzvLSxQpdcgR1pNG39BGZHtoC3u5UxPTR+n6NVvuhMLribt 9hVkauyzxTYvV1p9ZV+M2L3huZFjdVTzaYvNW8bOlyO3+Fqm/ul2jMG2UFaCheDs4TVrxDBl opEpalmlKyBnUbJtm2wuEK5Stp3dqccWUXZV8rlqNuk9XFpA7Q4zGQGis3gTFkPOSpMDI3WA EBPao3vq0KPsSU70W1M+1wLKyLbQf9psdv+W6dLBqe5FlHyzYkM/1gQtHyHYjk1zAPReUMUS oIClgpvWnJwFvvQPSlgybk6CNGisU36gJQ7z0n+9RJWdcpQgDZhRLhrUg3q6W6C1VpN6EnJt ZJeMnS6PDvIrq+dOm9PLCnuftRAZ5Pk9h7H/BxHuivUNCmVuZHN0cmVhbQ0KZW5kb2JqDQox OTIgMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8 L0YxIDcgMCBSL0YyIDEwIDAgUi9GNCAxNCAwIFIvRjMgMTIgMCBSPj4vRXh0R1N0YXRlPDwv R1M2IDYgMCBSL0dTOSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMv SW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyAxOTMg MCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9U YWJzL1MvU3RydWN0UGFyZW50cyA2NT4+DQplbmRvYmoNCjE5MyAwIG9iag0KPDwvRmlsdGVy L0ZsYXRlRGVjb2RlL0xlbmd0aCAzNTczPj4NCnN0cmVhbQ0KeJy9HE1z2zb27hn/Bx6lHQsm CIAgZzudSdK0204z3V17t4e0B1qmbW5kyZEou/73i/cAghQFKE4MKAfFkii+7+8Hnr9Zt81N NW+T7747f9O21fyuvk4+nl+uHv48v3x+qM//Wd02y6ptVsvzi+1VCx/9o66u6/X33ydvf3iX fD49SUkK/4pC0iRNRCkIy5KCZyTlybo+Pfn9b8ny9OTt5enJ+Y80KZPLm9MTuDJNaJJTItVl sixJXiSX9+qany7y5Hajbpvc4rvSvPvp9OTjJJn+mVz+cnryXt3tX6cnyfsP75JzDxFvV227 uvfT8eNq1X4rHdmIjqyQRMiEFqTgSAZib5B+f3nx8y7er4TGUkly6oH2NSz6KjmzIieiVLJS wHlCRUZokdAU8O4Rful1bnWwPy2JyN18nLFJcgmvFwmdzsQknZYThp8KeJvh2zGzX4ESF4JI 7kNpFhZUcQAURSL/m06LCUmBVJJN5UTgp39M4O8U/s7gJQ2JlsgyUmRH4YDIhBdUoiyGqQ/n Hyep/GMaFCxTjC98FI4MSkPLyoxI1kErSZm7TOEFV7kxsj88zAgm9tjwzSBZmpHca3tOJogc YBhQgqTA930mvOAqj1jMD1+IEHq65PzioVqCm/vw7ucfkvT812p5m0zq5eynt9Nv8/WgTMBG B2rqP7qH2RsiX+XtXfCKlORegElwcJQywjzQ3i/bejrLJuuH9ZRPGnA3G3ipI6BRphDn3Hgs I4ArCS894Or2aTqTkxW8rD8Fh53xnEjpgb0JD05wUvg4G16QmShJJpzgwJulecbRn1XL6wjA lRYxnzZfRwCnaHWzdpfWtgpPK4MA6lOjeXhwjJHSp0b1skVjqcODlUqiPkMNbyxMFoT7FCiC DIvML0NXdj+KeTRAzGM6c3CEPMYJK/bQ+l2FgjtISuslyDyBAKH/VCXWdMYnD/DlGuJEs1HX vk4nHNhRlaQKL3qvE5ITHCQyPnBL5ET7pIOFSthfFy9c8IXERNkNfzNlQxHMpzTVvH8GxFAU bXCMSo5u71gCKHNMc93gqjYBcts7UD2VmKjXdg0MqYAVKB7gEXJiZTWzTRYVXIRcqi3TkJPN Em6Cf6q7ykndrO0H+juj6HjzaoHwHXqAkAPzAhyG8LL+LDw4pfte1geXNIPWivCBa1dWDA/T XAtsFUXBucqJSy8eqC5zrXbVLci7ArXIUc/apP+7uUadXAOOnTqpDxDxutJqGBp147qhjt8v pCr0EdeAz/nKopJMy8mNZWZvB6DFNdK3hS8WVWsuKLTZ4EVzVPh7ZSZoYYumQkuY14PbWHKB KXgPa5ZncEVwJmRZjjmomwvGVWzqUeiSe5FrEx4z9YOU+jDDsFpd27BqnZrUbNPuvFlZhxPe AlWxUHrxa6fUCBDR23ZSfGU96PQEKVqgG49/K+FcvEk+AaPq5z4L+QtD4B2a5FJdc4tOeZOg q0eGXVvk0VirtpmjHZs7RrJGSgnb794OtO0R5Fy1oJFCRw5Nlo3uN8roRuZZYayDK+7x14uF Maahf9R3bhZTyo0t17163XbmjHfeag3Ljer1zhZ5Vs/VdePEQjG2GPNVR8jNlOb6IvVDdHQt usHqBl7R2xjOrxTEbRQvDrqcSx/395uZrwZXYKx0gYNqULfxVjfB4eY5YfR4ZOblAa5eoZDB 9lAjSBT3zlT+6eP0i8qmLGbZlJfKde2j9dsW0oLgSi4pdgs9QINLX6rwlXnAxVTyghHugxuB zEJVHIUXnFZyW14Y31daR6m82thTNuCA+9RnnMSGrphySZgP+0dAoIFIfm3CI2omEtV8BueN 7rhREaDoQ7zBGAhHAnWQ0knwg+UHUrzA0KHSGBM/NEBIqJorHY2aVr153gsZNmPWVdygojvc X1CAB+mSKQjnlc2Slrb2U1+pi5FUfWOdnD7A3ReVSlqLQSS7UvJ5jpJlGUchS6XUe/LR3FjA fwq18w+ACs5CL+GvD4lVuR1Ny13JoUlzkPTFFpk6UkT4Oo6TpmVBOPURibSsLCm98kSpBXjp w+PI2b/MoHHiwUVn/4+YpIWvOyih0gc5QpnDYMDoYzpI+y9U17ovlh97c/f4maudqv+To3Xj 68Kw8CRylpLMy9Fx+hzcxXORkuPJkwtGPHo7iPrb8I2YXEAI85AZPOxzldsyD5mziNkNl5KI 4nhkFukBro5SeNRhdNe/wstFrGCoUpbSMbLzZ1SrrvbcqVdDRzGaQY3hxk5PQVRtTRVOwacO JREeuOGpZOrKzAPNtLzXOx2fZqUb4PmwRQC+uK3nmIPkA9nobzGwNfN6c4Y+/sYKFYP/dreL oH/SmuZBL+u+xWGaHk+VvY+OHXu/xHQoH/yywnTPtCvnVQvy6+jpc3O4y1r9btQZ1WBt7j/o c+I30M1Ydulzh5jm4C0yK47xqP+8DXOd/UFG07Ngvu26S/qa+1Gjuv5ryi0PgBodp3eolYeJ HRimdOIwaEaHzz8EJ1z4+KJliOCfu9pNlwd3hg/5foNTfTG3Tew6/GCHlSSVPoxJcHCcwgad B1z4jg3nhFIfuN/au17VTLtz3+hsFbrSLcTC6NfafradmjJ2UW/u7Kdasrqc6tVyr3y3Ot2V RiOllt2P41iwYpCj0X1tCejT2zgjryIjNPXiEZzqghPhB4fi31pJYETJu3Hrom8caLcPktTe vBo4KGPLtjmgjVdXFlcYisZtCN230EO8G6t7yG7QjAHEe3CGgJJubQzcew/YjJf61nr4/jYr YEbi4WH4xq+6klE3uKj9bVXpgKs6FpmCHeCqKzneSVKLUY5qsg8IMSonUaphEplBp63eJB/x I5Kp+/4JPwnu73mBq+0vM29Xy5xFbZln3NXJx6rjrm/WfdmEMdkYVt3D6B7HCmH7nPkoCK6d VAiS525wUUtUmjOsGY9Fp+5gu6G5++8vtsROqapNcgWOvK53vtMduKpZVLZXvKix/+Rakmif TAsRGuq9Iuq9or42CZ8vSoHe2M2h8AmclKTwCmTkEKvwA7+S0PJoxPKUEunl7aJad/Feu6Ur 62qQBc+dIpk8dRaj+Sik1w3oncBtNxEwi2+mc7qbB4dOZdOMeKU0qgNj5dE0c8289GYItvXD T2CFTmXdkIPTKQs9gXWD60dggcGq6wX3gq3WugEUOgqkEg5rHYu1FM4q+aDp2IKto9q6O+P7 k9WUR1rIonlOeO5D6nCbali1QlNnuHvTGNTP7BaRzq4WFcbERfiVrqzISSndlEQdIsApDRhG uVkYvoBIGUnFF+kMXydRSriHvzHIpBwzAje4169IENsovFS/01WAqaljhxLOMlhx+oLNdbY0 NLrg8yhOyuP5P66Sbo/imqYpRtBh/7/zLXPdJm6bOezDxwntKitzjKtcvaLZYLvBtz55cPJ/ ppe7hx1q0DvI8Qf1aN8wGvcmZ8O3cerOTCkpkz6uBDf3jAk4n+kEF9OrZZzDwvTRyOQSNsc9 4LruT68VLo/WreKAtuzYSQQPzL0a8NQsFsl8tIDfRtjUFgUcYfNgoUct/8OBoD1s0O+yazda 7fR3+5WydbcfbIrw+5FNj6rx4C2znGSZjzBcoEOMx4eBojg/UZTAZf/6kmMvLrFoeTZixitz JosPn8NKdBAeGiC869WC4HALCQfHPHDD96xKStLysKh0nBxkPfXrTiU7PXUKz6dxooHPk0BP fRY+v9cRwkO+PkLUNvfGDy0ibfup8jj3ysBu3NaPU7tUOp4M6kTn1m6HDr3T+GjEogLbC97t YnAG2UNDhG16AYm81zr7zZ9H7JauOwcyiG3B25ucw/qLB6fw0xGB+y/H4jgXHA4we8D9Bwvw b9jEjhN4lEExsf98gX4U0277RerEbFZ8/XgM2sZd+LG3g/rxc3c+qMFB/+D40lcm9Um/xuTb FshHywKhLS1LScZ8LP17eHCqkCt94ML7kUzA0WQPuKdGpxqDiiiBT3Itnb0RvZ292Blf8DO+ eNLRg27wk9ScSnTqRxIGpyU6dTc4u+dk7Q2rBT0Nw/dY5eogeNfZJy4+6fV0U+0/R0m8jePJ c6BgjPpAf+DsdQ7Tc70+5Dr30Rl0guPi2vY6dfPo0W6I2GpucPa/6h9voR2tXi7RrqvvkuJQ 5R6dD5zTHaw14pZIHTxYwTNuIM108yfCKn8G5yc84OBhIGjZbMeyexlEX4JRoTtnPvQibIfg Q3ec4OIe8uRw2uBoZObyAFdf3tx98amk/vszdaNRLMfaNt9p0Okj3V3SEccBCZyw741/YYyi UE6e8Oia1v3h4ldiEzfdEmhb7Q7MQvKjwXl8pL8Y20vfRXSfCCu8B8KcSZaRkeNxKfoEFjyi atYtNOvGxtp4tR0veRtl0gdPdITUyM1zszRcdulehPUCIXzAI6wXZLDq6wG37nL9pd2uHm9U 68fb3HRTP3OQHjOsCCdFmNcUIrTc8HEPXsvDgK8NKebBTMHxUWf+5zXopALLX/38k4XNYe2m xcBy97zDfFFX3eMUBl/afieUJihvTGx2UmY4rDAYQXzBdu32a3Njx2kGkecOY9AzvQLV12yu 8rIwn+KDKb7mjC/prLff52sG/LK94GX/xIvgg60UC263XA8VjcExUa6m9CESS51hUrR/rmfU Ge5EHbyVUzLCCi8WMRZVytQLbmvVrZ/oraK4EkoLIn1o6MTldsrHj1bqPVs5HjTtnZI/+Fyp h67fjzceD1DiHPnOZA5Hvl8madeSMY+5ZCwoPUp3L0tTbEG/CBxy4f+RhxiqDQplbmRzdHJl YW0NCmVuZG9iag0KMTk0IDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291 cmNlczw8L0ZvbnQ8PC9GMSA3IDAgUi9GMiAxMCAwIFIvRjQgMTQgMCBSL0YzIDEyIDAgUi9G MTMgNTggMCBSL0YxMSA0NiAwIFIvRjEwIDM5IDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2IDAg Ui9HUzkgOSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0g Pj4vTWVkaWFCb3hbIDAgMCA1OTUuMzIgODQyLjA0XSAvQ29udGVudHMgMTk1IDAgUi9Hcm91 cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0 cnVjdFBhcmVudHMgNjY+Pg0KZW5kb2JqDQoxOTUgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURl Y29kZS9MZW5ndGggNTQ5OT4+DQpzdHJlYW0NCnicvV3rb9vIEf8eIP8DkS8VizPNffHRHg5w Uveaou65tXEtkLsPtEzb6unhk+kk/u+7M0suKWlHYaJdHXCKJJP6ze7OznuHp2frZnZXTZvo ++9Pz5qmmj7Ut9GH0+vV46+n1y+P9elldT9bVs1stTy9er5p4Ku/1dVtvf7hh+jtX95Fv79+ lSYp/FcUOYvSSJUqETwqJE9SGa3r16/+88do+frV2+vXr07/yqIyur57/QquTCMWZSzJ9WV5 WSZZEV0v9DU/XmXR/ZP+2egeP5Xtpx9fv/owieJfo+u/v351rn/tX69fRecX76JTYhBvV02z WtDj+Otq1XzrOPjWOHiRJyqPWJEUEoeB1LdEn19fvd+k+0A0keZJxgi0r5mir1pnUWSJKvVa aXAZMcUTVkQsBbp7gsde52YHe2uZqMw9jydiEl3D61XE4hM1SeNyIvBbBR85ftye7ANIkkol uaRIOvELVeyBYjjIn9O4mCQpDDXhcT5R+O0vE3ifwnsOL6lPshTnScGPMgOKKxIq0jtG6C+n HyZp/kvsFVboiS+oEW5tKIPGS57kokMrkzJzbYURV7kpsjfunwiR7UzDN0OKlCcZufeck6Ay wGihVJLCvO9OwoiriGVpbxxJEEq66PTqsVqCmLt49/4vUXr6j2p5H03q5cmPb+Nvk/Wa3MJF lyxht27TdbaMxWRZx2ryOTpI6O/AMsYTVbhxoxP4acMUb33jcq2cOTXeXyae0YTag3aYHt0F k2mSZRTY8m6l13Idn2SThVaNH2FRHYLnIAq4SHHXuSn4k28whbLBDeaZbbie2zynwM4/13pu FzC3j3M9r9U6uri69EyCyLQ6Icf7bqUXeL2oYL9OQWvWftFlLpKCZK5vHerv7c9os0Tvkgzt ZlnIpIxYIs2Fd38cyGgfko4XSVnsSjq/05UVeiuSYMtKM8n85Sk+kZPZk28BJ1DkuJG9S9MC Rc5xwIRI8pFYLvXJ/KhPBVaIg69SlnCndSNzo8mSQ6djBznXDmdBQION7RuvSA1Xu/EOXu4d PMZEIii498tmvbp9RmHXzOB1tfRPQZklZT5yxC6m4x6YThjLd5fnslxbk7vSWHuUfPIAXpUW LlJTqT/Wn+OTfFIbHQV/mldrED+HLZqDMsYycD8I0nqCFoC+irPJLVBTz+f1LVCIf2tWhjR4 GzNhxlJH8CXSvsbV1vfewZvZvMZLzQ/d4biXcG0ds9R8i383X+Lbc3jBabp6H8EF5n0UMzZp HXH9IuytSmNx85Xn6RKCJ6WipmvXHz0YLktYScHhgL+DAeOof9OjXsJXK3j5tATewT9UT97Z Bhxebd0QhL05h6VDWpoaFgk5oOWFwnCV4Q9cSPxrtQR+eorb61aWcZroqkap8Wy/mjUv8M8b 78Nq96k2B1Lu29twwGX6fk7gGV0kURedX1/5hs5z1EXUUA/zNBx4BUuYJPG8L2QhUPURcB+Q iRIGHCf0rvkVPh+m712iNS30mI82ZMZS2Ivj4Fy6TwTVfTJPlEP1+d5R3LC1Aw02lAlSPBzm bLl2E9f2BjVI7yudS3KQH4yORek5n6/g/SetSLPJvX92gy12rCGDmaL9CzdaU6NthCYKKBCj 9FCf3MadDryBjzedCqo/wscZJB2sqjrMs3MQzRmDkIeb6F5vf4Uh9E4rznn1DJodBmp0aIYB +bg0plAC1/GBZeBb8zOZCEUMCoxUdWAsw4XJs0S7ZUfiNQEua0mgPRtO0XPf2r++wWWZFNRQ mwdYb+Bf3OBIy73m8AdrMeFXjXeiSu3KUzNyWJzQiaZXm9o2I/SY9KDHmFvsok2hmXHXufw+ TfPih8P82V3EMuGcQvTPeyXfM8DJxdWlf6mOWQUC0Ls3xSBgQI+vAm2JmgBlbwVubWYcjhcr jLUToD9fXMBG9G8lM3CrypEL7uJ9FZj3tfDfNS6D8r4TMRzvu+Eu15oXChu/8M+Y+isK2/82 4AK4i4Ajt0GxswsuLwLsgDJFm2nUsrt2QBZ4B6QQxD3qDnAihtsBbrjj7AA3drAd4Ib76REY Hj2DdiNU8wjet1z/Uwi5n2KoYNRSu7g+D8v1qiiTTByT692IwbiegDsK1xPYobiegPsninnv rgMTxR5Q/2OUDNKpBNzZY59PmU1NSACzEXZv//PM/+bmWpdlbCRHuzZ3EXhz53kiyqNubidi uM3thjvO5nZjB9vcbrh/Q8LlfyaN0kDkItuw4/4dZyGcGZMcGrfYLr4vg1YAKMUSvrsf3yY8 VCKeQAyViCfgzj9jjG7xOEfTZh1d1XOMOnapeTlZLaNLTMytpvXT4aFRF4kCSCxHTomzPMRT eaWE7x3cwRWEvHa5A+uck1gdXq+xg6wVhEhJ6IPZZAevZRM3HNa5P6zrCoLRDVZ6x22MfXUb l5Pa2MTVUr+/NW/1uyd482SytaW5+lG/wftnqyVe4XsYIlVw/mHctDlZyUepEZn5UqmEcOYe P7v3qzGGe2cm21FNUT09xW2Md2GrK4aOis1+3HUlF2v3j3n3X4qkFO6hBk5k8zSDIlZilr2P lKfahGEUXBegh4LOyhQvYAnPoHDGO0GqTCQ5/u0s09PUFFDc7M8zmXFoPskHFTz1U21KOiLU FMM81Hf2zjYDBHcaxLUe+uwj/lxfMYTsafMYC3v3rAEG975oMoe0MDVHZtxNjQUzhugwuR0j D6S2Sku2Q4UBfkSXBHOSL3ZqcJ2WQTI7LBUQEido8p7aYXqz5hSaf6kEe5VTcH2iHBgR2a/n dcOxVVNHJqFpF8Ckmh87yWpKmfwHQUWSsuPNk75BCQoOx103n1bAmjjo3zZUTZdoPwmwcbk2 D7Vw30fZyogk78hZnqSKQob1RzV808YScCagzmLPRPmvHxNCE0kunBXi+vW9NREGBXntyvqv DeSQwiao8u9nQi0iJ2YBjQ80PRL/qfqSJYxkkTF2Z9BqY1B6Dr/7TNuQ2Sgb0qpyfdV8Bop5 GDo4wFowtuxQbAAayFhzp0GE8FzWVhq3QG8OWkLGHGuoTYKUUXN1HkOFqpxcaa+PcXx7of/H Epv/emcnLetYSZHypjexPj3gxAxW57+R1UVmLiNb1NQv9E1rjnU1Qv6tLIknWYkB9FXumjMC WHgK6sMI7P1+k28rj6d7psF7kZniEiLeBFwoGzZLQcQfqfwr085lSoL6L69kieQknBFRd/1m 6o3DaQ1/60Xa2HKt6Cwu0XgwCvmzdZPedht6cMLiHusEP/aqfQr4+Gutfv+MiZwIvh7auDYO 8GB9ikjjwsnHd73037pj0YtqMzr8iTN0lar5SyfSUfR4L6CWaZEoNXLdnQo2UElzmziRMoVS SKrMOD30BNluVTvH9IkT99CN4NKObf6EwDPaUXPGVXINiRSrGnc7QBycRMyh1pigw7+XqnEk DzPNTjiOPjg1y+hZdOU4/eGYNmzRK/0wwpeVRSLZ0SaDp3qzk3ADjw+imf3JtEr7YDPMYNsC 3fDOqRYDsqRIXXXyHKSk7MK7bfbZaI4uvGAvNfJ5jYTfWWmM3qWwBrdvszPPEkVOeGWVW3cs sbWe+lyib6HPBbhTx+I3ybHYmBTl+ocLlOafqhf/BrOAqh9iqP7VqVSQjx03s0516qOyeo86 ZSVsfUqdsmDq1IUbUp268Qbq1DsyM+WUBDKiWu19WF5zj/Z2gwfT3iFWdY/2phbVO1wJG4KA Mx7ADJP4tXdXk+XiqDObqz0z+2lmHBmj5lEbgYfCjPK3BsDwbHoXpvJtB+glAQuJ3Fx88o/2 vLr3IHWJ4XE3MpXNwKh0/RJvZ+zAmgSram0PW8MsBlDxQhUYIHaT3acsq6fIrHJrfQym0rtu ZDzJFUWSf1XMVMLJGfBv5LAcSiNIGaVn9LN1LsCSbub+jR2VY4TuS4teo8VuZdgmBxhzPlSd IMQbuCsKbLtPRI/2SND4PYX2/MZ+0r/hnaV4qq0oRY1hjHXn4+wQGTEURQ4nm7bpulrZKJOZ re0KmEEO63Idl4O/d31EsLbxd+ALnOMZTne9iFXHStsech8cb3OH9/qCZ1MMh6/mtlovVEvF zaBKx/eyFTIRgpqeRrtZpYkXIsGzKR5FaOuwjA/20NOMYbj2GLR3N5EnglF0BvBKJfQXIeBC ucKFgoQetRauLJfpalNYZjQFLPX8LgiBUrGEnJSbQUDZO3CWgQm/D1kzo2/QIoXToQQo5BNN vxjvIS9ZFokgRZb/lAqEvMjJ3daHYRI6EAUSuzF2wsgWX7ax9esX9KYWbG3bIqM6u6THCHsU 9WdnMLjaZ913Ke5NiQ6VD+aH+xTM/HajbYSrcHIwpucuVNcVt8EvAJEvfUj2fttgLTcmwCgd nLIplorMI/2ppWY4rHJ7VNuWRDRrezyFYYlMi2AiHt2uam1j0574k6XuNjo8I8j5Pk3fsoNO qRCtTQQ1/gCtTbDvNAHnyuBV8/mmqeydpCxFAegmaaZXuVlZJgdWfOj3WrtxCTkAO3C/XwoB 52FB9G4UvZVDbZlVYbbi9tbTBObD7Vs1ke1BtmrdnJhxH1adi2llmkND8CMyLXiw2fG4FjzY lIQbFFy0xUDR01dZ+hsns0IJOCXA9HaelXL4E1Bz0zkUAfpgcE4RtBEQQT1idloT4Ra466pX hzOo3+fOOnSruszxjbuuOKGXLoPt6t9JhchPSQ10jJPq43g/nYKA9o57UhA8VArCiRswBUHg 9SkI/xzOEkXBBst3EHib+Y7DjvvR+Q43L50Mc4p/CpWNoAfOh+eJNjSz9yNBDG0INyXot6EU +9gb0m0N/tBOxr/O0ETXOqSCC6ZbzUA78+HnGVYi4cmW2VwbRXJgR7T1z9mWwDO1A1gJqAZp bm1M5JsHUgC3NodW8JDknbYeQCA3tf/YsMggNjxOJDhlpI9mELTW1LpK7mOt1l/xXZSXab4m 0WcLa9x5P2AF16c0coA0W5rhznEDBjglU2D4wQ0XKOLOeLoP9EvnHP3Tk2GbeoIetKYq/25W IfZMQgCJnAEOPcYw2dGUJSynUFc27bTdb8c3GVqqKpKMM/BLl1YJDEpwz6JOYbSuivf4v5b2 iqLrvIsE+dfPIt3HDZsdkvXof7X+QRj5LmSKsXcXOb0Bvlz5P62kOHT7PNYmFEpBuR2tx4pW jYHHaVNYAcrs0jzJSTq+8x8u0MtLwgWITphgCKFebFFjgOpFPJF3tHHyEirkCThnt2A5iK31 Uq1090QPuOGV9ggZqXHvrI0/n78EEbytNQu5F0eCcWBPBt6IYH6B5eEmxH9TeuOIu9ECxLaN H+6G646RgPJFZrzvqqHbHIdvalSOYTYXNZuOuf/yF5apPTMRwJ7NodaXgOsSdmV7UnBYoza1 omFgD7WtgVZaO+EXg5CkOYM0n7UbJGrW8aAIvy++GEYnae9/+1QoXNmmGsqNMgyIyYIYx7ql tncD+v9tP3fvTnmKCuVIyyeFQGuIWL6tPOD4Of4DbDWT6wwiTjm0MNpNI5vkzJ2Nn1RPzRrT 99Pm2eZF22PBA91swzF9EGYjfwOJKNPEb3iY7gG+2PqZOVAgMC0cwLPAvD0x9M2dAb7N8GCH /wA7NBlkFDH+x17yhAkK7mtS2JuJh+NklkUpwRZ3Ux8kSSdKtNeOtTwy1VfmFJzzcOhWxyla Uvc6ZLMaahixNTvapGufYzmI14aRPnnuSkb+7P08MoRtSDhkdhuG9o0ND5qWJHbzEqTurMz2 Dfiw5+I6TeIU7DQCjj6mvBnH916HInOoQ3FTFaYORfFEUNPg32RUEupQCLiNjH7xLQl9MaZs F9S2+clAqXbBU3iUDDHKL6baKTnpbPymhn3f2nT7rsg91yI0ULpdai+Akft2TCrJR+thOt3O tUPmahdogn0iVLbdBRsw2e6GI0/Pe39mZZuPdk72cdLR7hk4c5t+C/95DwWZVDcRxlIxTkJ9 05VhfvZuKEO+SwXhPCeaAIOPGHGQcB4XHA7DuyGHhy0WJuZDHNff9v4CJD0YNTHjTuyHSAgU FEn+1Z8qIex/JD4UGYfObNR0b9Rc2LYHmbPrgQ014WoYa8R2wcmHfWqW/XL9OXp67A/KzO4w mDCt5qZxTZjn43VCXyrXozy6dPqWzPOfXpcod91E4GRRgq9bj86WKfwnSViRo6xwU+c/7Fsy qDYk4AJ00xQo6t1wu909wJKcRrZDW6ATPJD/Tsk5h8dk4voHOGDCtXNOz8dQNXyyfDdr6j5F ZduzLqyXYUq+YeZwDl9CxPWguaYgZ8zRpcW7+Q7F1TwfybhO893HExTocAvXt+3SNawfvoYV u0hgkkSYuh2IcHGKlGnfY709x5mFaH4u8LQEQUOfyTSlg73juA5UyZQmjCKm8+K7kHuYPtdM 60AlKBoGGt2RZu07LW88mzdA64QCGn8SNG5lmgZHP92H2nZPJd/a0Zjh0S29o8rmRaaYu5hp HrGP43ju4wr++wGxJKdmIED3IUnz5QhZxn0872NPKCKVUItHxSJksFiECzdkMMKNR0YjZKho hHO+jxSOcM+BOx4RoquNJMYfpIlODuUlBNwoT2Bbi2JOqG8Gql0aOUjWfrSCb907XU5ROmhc APZnf47wN/jKxFXH5KjMScC+f6otVuioDlCiL6DKa9waOoVZ0CfOMOgpIb9cot+pqc7yX9oj Yk30ETURzLTJtptTFvIL1p0JnFc2iv5l/vLubKCvR8zAtOoKWII8LyBTFDDmur3nAiGunzIK cz6PTAd1MmziPbVSQCUtQY7pWh7gOXtt33QCNkABr4AIGsVhaMEZEfSb/6YoORTREtAbJ6C9 1y1wyJoRyBsdpQPUKdNjNvpiM2js1COtu26vhIum6IDNMELY+NcRUBpzNK6UUMoyEs2pkAI9 iqK1OhmUTBzjKe7wFICxcM558NExnH6qIBMltLTZJmzwVMGDHz5JPVWQgA71VEEC7qqea+Go hg8ExDA/FAiUk6npFRDD/gQDRU5Wzw2aoPB2cbgX7KKXF/iwpXHz4+SZQG1xW5ZhBRTD7LBM DI8DrHu7eyudMrDT/gBWnE2x2YRbazxXXTsf89k8EXbDxGeydY12zkYh2+Zdea67/sNohRPu fDQMPNkFb8PysGHhxy8x3NPXY7S/9lS3RubYByEOvZNyz/P5TmxfhHmnSLNd+ECFa+axaM69 0pg0ab+wbW8MRxum1rq7t0GzwQP3hsU49sk6uPPeXO5GsPwnHyQc8nAP0/ujkKEgN88JNMeT kN8YC6FvYrWA057IhmF6/gkthIQiCPzJv1nOoObUjXaMo5dgoJfU6l9cXUboR5oOK4+9s5mP 6sQS4rEjORgtBL0uffB/QnUqcQ0KZW5kc3RyZWFtDQplbmRvYmoNCjE5NiAwIG9iag0KPDwv VHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250PDwvRjEgNyAwIFIvRjIg MTAgMCBSL0Y0IDE0IDAgUi9GMyAxMiAwIFIvRjExIDQ2IDAgUj4+L0V4dEdTdGF0ZTw8L0dT NiA2IDAgUi9HUzkgOSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0lt YWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA1OTUuMzIgODQyLjA0XSAvQ29udGVudHMgMTk3IDAg Ui9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFi cy9TL1N0cnVjdFBhcmVudHMgNjc+Pg0KZW5kb2JqDQoxOTcgMCBvYmoNCjw8L0ZpbHRlci9G bGF0ZURlY29kZS9MZW5ndGggNjA0OD4+DQpzdHJlYW0NCnic3V1tjxs3kv5uwP+hP0qLTE+T /b5Y7CGOvbk9XBJfPLjDIbsf5BnZFmDPOBo5if/9sYov/UJWkWq1fYcLkPGMVKqnWHyph8Vq 6vrb4+nwZnd7yv7yl+tvT6fd7bv9XfbL9c3Dx39e33z+uL9+uXt7uN+dDg/3168+vT7BS/+6 393tj3/9a/bs+XfZr0+fFHkB/3VdK7Iiq/s6L2XWVTIvquy4f/rkv/6U3T998uzm6ZPrv4ms z27ePH0CkkUmskbkrRJr+z5vuuzmg5L5/lWTvX1UarO3+Fdv/vr+6ZNfNtn2n9nNvz198kJp +4+nT7IXP3yXXRONePZwOj18oNvxt4eH09J2yFk7ZNfmdZuJLu8qbAZab4x+cfPq71O7L0Qr izZvBIF2jovO6ueya/K6V32lwKtM1DIXXSYKsHswOFUuPBzcR/u8bsJ+vCo32Q38fJWJ7VW9 Kbb9psRXa/hT4p9zZ19gUlXXeVtRJl2tC9UxUAIb+Z/FttvkBTQ1l9t2U+Or/9jA7wX8LuFH saZZtZR5J7+KB2pZk1CZmjGlevH2l03R/mO7KmypHN9RLZxNKI0me5m3pUXr874JTYUEqbBF 7oO8I8rWc8NiyLKQeUPOvaAT6gYwDFSdF+B33wkJUkS3mA8mGoQrXXb96uPuHpa5H777+/Os uP733f3bbLO/v/r+2XbZWg+DCdwYME39IzzLnuX+AnQpXlfkDQmYrQ4nRJmXBNp3D/dvHo4f dturdnN/C6vNPvv2fnslis3uPfz5GX48wo/DttK/ZOoTmVq+Vze0LNU0F2l+CY0Psc74qOD1 wPgoodsCAwR8UubbWi3qF3rEQ+76vCxI6IuHiodnhkoY7jk0dHdSDd1l8OvL9eGVp2VD4R9V sHw44RhVvOBWDUf8Q7Gc1Q2RRZ93ItHvoaEo1xmKMjQOFV8sO38cbq/kRi1WwCWE8k1+8Wic gveVJvdh9IuH4hRMSMXAOwrsp9/20Mzjbwc1FvcwBn5fGb5V4U0mtjXU/eUK3V/qeO8PgAa4 kWfVDfT/7jUs5O/3OD+fwSiAV5FaZ/Db7QMu9PD3aXfAfx+3pX5vdw/vZWpqPcDrv8GP/XHb 6N8O+60Qm99RMb7/BkMBfPD0bntVbQCz2rw8Pih9+N4BzZCbn5UZ+19B9ydUdIQX9x+2V41y D7x8yk6g+zO8+xFRUdXu8VF17+Et/I6W7u+0gQD5AK/ir/sdgN1uVcR6p9t5yVAIOL3s1JpY E15/vjvtnCN040/7W7XzgubdO7/DO1fduX5ZuyW17IEZh1uyut/MYG2rvPfn0Bs3jo7OfS/g Bw7jV9/gOFMjstrcOSf+/g59c9L/QIcPnzWj4J0bIS+PdiCfOxgPj9mj2js/qpGvPwrjrtFa ZxZjB+Nrq/dVKdQupqfcl68OJ0UuSLiEFa9aYcUTvl2iKiECN3WVV34gNmue6ltgYf1G/DlT ExIXjwzm20vV28ctDjS5McxBien5iauK3GQvt/UgZAcLjqOf979+AjkYJa0aJfv7y7o50L6y UXvkMty+7EopF2rCwubw8bL5GYJWfS0J6F+A6fcbmAZ2DqyOXwkV42sK/zX0xmfsxReqF/Wy sLoJtcjrijIhNOoVZlPktVLfFDWQg6ZUjsyrMdxsZtTEzIjqMWYH7O4q/dGyDIwa8EnX6VHz 8/6N57MLcGHzTuGSm3gFKWSldnQGUfbKwj7mtYbwWooqugFCfaBsqQY838FCj+vEbgjd8EOF b7Pb2OMm2Ww8cBFRC4j6ByWmoUatHocjxBZFbkJLx2VNKasWV45z+6JSu52mdd0v1QSoYp3R Ep2RpItuQiUlrkDhJvygHAr/ozOvwcuiHb/g+XMFa9TrjYqEvZ+Ix2Hwk2OdaE+9+fFbpKpf wJhS7fyzRhR5JUMZQ6UG5vfLn1cHriVsfYLI7LBSWyaHWre5jA6qjhpUcU2M+SoESMkNqf0J Ou5ffL9dAlurWFaRsITXhnOcZ+ov/IBamwsF3FSYpFdd0OkfYMObPyW9jwu0fr8pcyGnAkKW 2L2UArMm6bfNmjQRgOEFRNEpaPu+80VgBBoj9AicSihfy4kVRSF8EadDdUfZTN+vS0g+s3Yk iFh/6l7Ht4ZOH/uLFLD+cAIIMpMxzR2UQHOnMtZYTs+MgdSKBsDGtMwkTFZmqvU8BWEUkRuG pstFVyHlcuuEPtfDPBT8eP4ykIO6ALJvc1GEIGPEw4CZ4RxzlqCOGZKUkdaLUsBOhnAY7iTv XAYE95SHrShNrubRhj3I1mCaY/f+Pb7w0e1I9T50r5YTCEk202M3sXfb1u5wD7v3h9Nn3Pu4 Pe2QzQEELQi/HU6H33CLjErRwN1plzt25Ae+y7xU1n2uuPw5fWyWGzui9HIT7WTqrCBNG2l/ pWZsIQP2/0AF6sVIVZ33XwVI7Y7UJvSsLsHF2wDqWBrtECpjnqKLzkEVMmz7fxPxfzFOD3mT ZB9NQ7+LQlXeM0Ed32ZiOvFxu82Ad7mIbj9OB3RtABPPnQVUOEcBJprTNhgfmf7Bt1T31H6o ZiRMSwcJhJkL6baM1EBjZkLGXl7TPFyLHjN6sOGB8UNPBer0IKooGq1bZW9PRmtJRuvzEW2w 9hCjwVpjmZEacxWVdkzRxYbqSqLttVgcqj9gHvKzy0jv7ibZbBO4uyFuTw4N+skZxx8YuPdH dxaiwv9nK6jPZwD38BoEzPGPTobvjiiusxZaARoLwf10uHWnP2MWQIT0y5yp1o1+MhB2H8E+ dMP7w+0Om1+Pzkws2cjQPw/blvIbwXfgTOpSwgNHZJDW6UaZ/w/Kkpm1X8RhtfqnnTgMD/cQ Fw8vThkeenxUbaa9aHoeGgWNw3KOnGVuy6yWpVpiyoDVKXUbVIr0Yj8C4S6LvK/HFv340w30 Kk7mP0P5Ya0p9cFN3eE3PaxwKuOPwbsw/4zQUZ8siEKPquFoSr8RPLbcPWZoxVFnG+1n9eC9 xQkMdTiNmumf4R8cm86s4Enjl+jWCo7A64AT43zcxAxNF2LrOJXuTVLGsHE88JwHocnBCp1C WwpaS9wCnBH5DPfUeJp7xhxGpmTjqqJs2bP8R4otL4TRZDnVQUGyXHdl3rUD3QWSNiPMRmRg zGMZxxZpNXYnixIj5jyWcZTSqnHMdS6FOzBt0MCgJ0KWeDqLLIueSzlNA5Meizhyytpk/ai7 EB3QVHnhbStoAdt2J4A4MxnTqEEJ2DCVsfZyemZcuuo7Q0iBc0tmnlBZ5qiiKJeGUVyTXNqv Gl2OaLm0hxjj0gZryMKwrqKyhCm6olE47C2GS4fD2FIrmhrHsmfFgsya5oSn/VsIvEddGass Pg18YEYwFdGtEnhuvm3I6L2w2WUlcYaeMXDMUmVHqUsWcSNHUhnTJGXRXJpnPZniWgqkU2lf Hsdk0s7pDlzuDZ7LSrGdQWY246qizMCznMqjLYXRzCDVQWFmoOJIKVxIx2AyZwZaxDGDicwo 7lFqBkpdihEzmMiMoqNWY6OwJ2WoJhjkmMFUaAiipRgzA0/KaXLMYCIyirSMTcaPpgtdIk3O PUQLmLYPAi49JueNGimxeTY5t5fVM2cGTZPLFstaZlVA83lCJZyjimLMoOo6nhmo7aCpy6U4 wvnYiiBAKZOPHeUIGsvWn0ScRqUmU3TFOALht9WPxqaJp62Q83TOKCi/hQI0vUf/YLfhmS4U 7Ea6P+jY34+SBKjh8AbTCbdQ3+yDaCZBxvzLnKmmV1VOqM5xqPLWma7stS6o/R1r6Pf3Q6ry E+bN3rnGaJoDrrbZjF47cAcF4qfD7eEjelbn2x6x8HzVVkk1NmQfaFWcyZi5ZAphIuObyicn KYsxGX+A0wxjIRAyma+Ao5nMOauN4QUaz9TXRDqDSgsmqIoxGd9ykskshEEmk+ygIJOBuBdh MkaEZTKcmmF7EWUygxqOyViDWCYzsohmMkaIZTIRm6wfdRfq6h3Xg2MPkQK27U5Al+VMZUyj BiVY3jORsfZyeuZMpizztk5hMlTyNKooymTqxi23ynzVvW/dbxyxIQ8SF5hiic3IlERio7ES iQ2VT03RFY3Fnu3pxIaIogvtaSu4k8C3x55VrovWK8k6PojWbmRfwe0dUVjiIHF2LAknM0jc yhXY4SfH/wzDgt5+5zp/SCbhmaRhWus6x4zIqsp7wTiH4LG7+SH1a/jl83DamLmTMmzHndPw fv96a5r5hz6sWrVdsoYjnUm7UvmhWZLS+CFZtJyiLHZONZ+XiedUS0H1OdU5C6sJzBovjcNR SeUEVVEO51lOnVMthdEcLtVBYQ7X1C5JQpxTGRH2nIpTYzdW9ShFTJxTDWq4cyprEHtONbKI PqcyQuw5VcQm60fdhQyHIwVs250Aw+EGJTSH4/TMOVwh8rJEvgNPlTATpaRy6HFNURanHNT1 57M4+ghrgS2Wxo1sSaRxGswGhJgbqex3krJo2FRKioUVYUS4W2qQYXIjg+g4PipCI0jP+BF+ Q24wZfV4Ou4HepO5J2Q9boP1bi3LGJpp0gufyBVG1SQrtbarTN8JmVfcLEAqE02GNYFcmPWr rrWbZ8MsnyMZz8J2STUbOzFpVyrlMfPXEIbYlCIrs5O0saQnsCJMSc9PJOlZiqpYT9mdtQ6Z UKYBDYeI+YzKk6foivIez3Yyd7UURxOfVB+FiY8Kk5Iv0DEiPPFh1Aw7Bhkr0BnUsMTHGMQT n8EihvhoIZ748DZZP+o+1Lxm6MKxi2gJ23onoSnLTMi0a1CD3GcqZG1mNc3YTwkDD0tdqhJu faOnC5V2jyqKcZ+yF7PVkSA7FUV2FmAbruNjx7iOwTJDOeY0vmqW1xWLloTflta+fynaEUip vEMaEg61C31SQqSqAz7xqcCquLYvWvVO66Xr/jeyMwsbYrIzfkO+kMPU5K/Oq3eys1yv/LGZ F6lW5pXFskDzYZaYBVoKqrNA56xVOsIZPM0tYg7jq5VZVTE25FtOZYGWwiAZSnZQmAwViqvX PBnSIjwZYtTYzQRKRMiQU8OSIWMQT4YGixgypIV4MsTbZPxouhAdMPTgyEO0gGn7IIA4Mxnd qJESsGEqY+xl9cx5kOqaNqUmqYxUK9OKojyoamdL4oQH0eznfERTrewjRtmPxko7sCv5amVe VzSAhL21eiVSyqNn+KHGPnoGtMp/xgsOqV47k8zDYY97UIqK7W1n9WDfaXfak9H3MuepCdJP 8uVkyujTtglwt2C9kT11wxdv3z/Y47ZPTnz/jeWEI0F8fMteZWnJ0Df6QSlTraXTNDplg9re o4fbsYNR5M6msG7dA1762sHx+SDJnJb5tFJbCSECPo0zGjNzk861qkgFN68sVvfkTyeyHmkp ENY9fQUcXfd0ztpmuIfGSzozq/gKblZVlC15llO5o6Uwmi2lOijIlsq6gcwmV/dkRNi6J06N 3WagBF/3NKjh6p6sQWzd08giuu7JCLF1TxGbrB91F9JnZrSAbbsToM/MRkrIMzNWz4wtwXce yJS6pypSwU0rirIl1freL9gZ2FK0gnsBts0aedgx3mSw0nhTxVdw87qioT/st9V50zhvZDhU NadQ4TC8sH2y7aCmyG/f7cAq0Fj9hPdbZzdSM3xHP2Kun+weCJileGN2ROeRLuydosyryekl kTy7kIBNJeFeTIKAuUQhOAnN8FgY8tZmysIsKwvRsI58cnCh7yBn1dYB31FEbylOJ+EwwMeJ Ej271KQRvUiBO68sSvRm8yODOARf93KrqBjJxZZiGi52xnqpA6zBS+NifA06qyrKxTzLKS62 FEZzsVQHhbmYGtSy57mYFuG5GKNm2CDJPsbFnBqWixmDeC42WMRwMS3EczHeJuNH04U0F6MF TNsHAZqLjZSQXIzVM+dida+TknjSxzx1WkVq0GlFMS4m1cJY+TU3Phcji84XYBsu5mNHuZjG GhVzcE7ji855XbFoT/jtC57gmefcm/Bj7jznmV6lgyXY73fuW0FIPrTMQ7B7akXAQ+M8Tz9i n/uV8bsGL8f08P2v37sQpw+3U1e3k/X+C+GqosGbUmKTxrm/ghxBXeTCX1vXmgRtMSthmd3N YCv51/WEUB+TIXSSNC7EaYhWxkmjWROH8ilunYpUvfPKYgVg8/GSWAC2FFTXf52zshsOpvGG WirOYXzVO6sqxhp9y0nWuBAGWWOyg4KsUfbCJZY0GanGhEhnSIQ+WRrOOwOciFZjd1tilFaf yzjmJMbZp5AUbkPEKCXsCVmCJcbJrpCU0zQ+7wywMNYm60fdha60y7uDgRawbXcCrmDLu4Nh pMRWfnl3MLB65qxRdDmWh1cFXyZZR4reaUVR1lgpc5vJUQBeWs3dSb4ArQeUEFqUJyKWrW+J uYkvaud10cFD9rlIsP1iHBOK/R453LmEDhQgXTWjCqT9Y/b4DjNo01xg4N5Pc7SZeu9nF7/2 c7iSaVVPlA0+SRT1eBa4I7Omkt2r9I0aClXi+LWrpZ4sptooNoDJcugUZbGsU2BkkaRhIRAe L34FHJ3SOmc5MREH8UxlU6wzyBRgXFWUnHiWk+RkIYwmJ6kOCpMTFcrKgVWEUlpGhE1pcWoG Vl+2kZTWoIZLaVmD2JTWyCI6pWWE2JRWxCbrR+xCXWol8JvA5x4iBWzbrYCuoZrJmEY5JViL NZWx9nJ6ZuRE1CU8OaXC/HDDZHieRL64jVYUJSdFN1tuHTkhk1gL0Cw58dBi5MRg2buCI27i v6mN1xW7BDvgqQhp+IChG06GRnXPd5PyncCp4gFSTbOE1fj+ddD3hxYO3cGuRPhL2N1J1e5W 8Q97DztIuzvYw0zjMveJvhm+yyyU/qDuYG/CV7Cb+irqWBYP5AYvJhCy5sx72GPFcF/Eid38 Sz1WvIh9VYOlWg0bETA4hV/yuegLXKj4pWjgez3+H13Bvmq3lY2Ai7A9JxGXvK+KDfWFfe1j R/m/jUfmcvRIjIgkEHllsQcm5kEi8YGJpaD6gYlzoqomXgbPXJYecRifQGRVRTm6Zzn1wMRS GM3RUx0U5uiiHX9BYZCjaxGeozNq7Ma5nX7VYZCjOzUsRzcG8Rx9sIjh6FqI5+i8TcaPpgsL 8np3WsC0fRCgr3cfKSGvd2f1zDl6KQ3ZjVx23EQSiLSiGEeHLx7vgxSdvBZjAZih6B5YlKFr qLSL3Rs+fcjrioZ2z09rZPXsHetAy4diOsOaAsk89ruE+mg+b6ELylrA7YNn9J4NPWakJN2u 3kTuX+CVxZJnM+PTKraWQur01jn+0nFIwyVdf97wNy+wqmKR0zOcSm4tRcHAmeqeYNyEVVY2 bNw0Imzc5NQMfBOOuNm4Oajh4qY1iI2bI4vouGmE2LgZscn6UfdgQV5+TgvYtjsB+vLzkRLy 8nNWzzxuFoX+9utYWWMTuXCBVhSNm1KScTNaNb8AVsAXVPmo0QCqkdJq5hv+pgVeVzSAeg5b I4DagEgUYyVcYIl75y56yVPv3ztAxNjLvCQElG2M3DS+R2rBzeZcnTu4LXyXE3ez+cIGyr7D pI3XwDiLMLMlqfC7idxZwCuLsghvEJPUYSEOnsB9eRjDUNKXExN4NFxSSXnDX4bAqooylLnh JENZiKIZSqJ7wgxFocUYihbhGQqjZiD1cYbi1LAMxRjEM5TBIoahaCGeofA2WT/qHqQLymkB 23YnQBeUj5SQBeWsnhlDaZu8wx2y5A+pm8hNCKSeGD9Ro6HsqghBIU/hzofV/MRHjREURLIb 0piz+LsQWFWxwNvrhl94AhdiKeEousxYWTZQS+wbO04MQJW7R1bWvM2bYRVrNtb0TNvhG/8H boVa2Gf6UiivGVHeoyehyT1EpkYbudiA1RU7eJjP6sSDh4WY+tzhnJVEhxyEM6mImLf4mwc4 TTFm4ttNnTosREFmkuydIDXpVa+a0l+qatmIsFXLnBo9YYwEX7U8qOGqlq1BbNXyyCK6atkI sVXLEZuMH7EHdWZETu6HHN4vJenmuISJxKXk+4E0Y3ifAnHrWikjvWRBdHJmijOIlDLWj6Y9 bDe6BmGyaIblREoZ6Wgtw/Yz16pBhGlVkhDOxP8BIGTXwQ0KZW5kc3RyZWFtDQplbmRvYmoN CjE5OCAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250 PDwvRjEgNyAwIFIvRjIgMTAgMCBSL0YzIDEyIDAgUi9GNCAxNCAwIFIvRjEzIDU4IDAgUi9G MTcgMTE1IDAgUi9GMTIgNTIgMCBSPj4vRXh0R1N0YXRlPDwvR1M2IDYgMCBSL0dTOSA5IDAg Uj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJv eFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyAxOTkgMCBSL0dyb3VwPDwvVHlwZS9H cm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50 cyA2OD4+DQplbmRvYmoNCjE5OSAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0 aCA1OTQyPj4NCnN0cmVhbQ0KeJztXd1zGzeSf3eV/4epfRK3otEAGMzHXipVduxN9uqc+GLV bl0l+0BLlMwyTSkSFa//+0M3PmcAzAxJDLO7tXlQTA6IbjSA7h+6Gz0XLx5265vl1S77+uuL F7vd8urD6jr7+eLy7v7vF5df7lcXb5e36+1yt77bXrx7er+Dr75fLa9XD998k7189W326/Nn RV7Af01Tk6zIeMtzRrOmpHlRZg+r58/+9sds+/zZy8vnzy7+TLI2u7x5/gxaFhnJKpLXolnd tnnVZJefRJvv3lXZ7aPoNrvFT6369N3zZz+fZYu/Z5f//fzZa9Hb/z5/lr1+8212ERnEy7vd 7u5TfBx/vrvbHToO2hsHbeqc1xlp8qbEYSD3iunXl+/+0uX7SGqsqPOKRKjtI6K95pk1Vc5b MVeCeJkRTnPSZKQAvi3DU9uFl4P5aZvzKizHc3aWXcLfdxlZnPOzYtGeMfyWw0eKH/vCPoKl kvO8LmMsnacl1QyQIjjIvxaL5iwvYKg5XdRnHL/95Qz+XcC/KfwpUrLFKc0behIJcMqjpDKx Y5j48urns6L+ZZGULBOCb2Ij7G0oSY22NK+ZptbmbRXaChNahTkyPxwWBGs8MRxMkhU0r6J7 LygEXgENRYrnBcjdF8KEVpFpUT+cyBBqOkGP0DInWS3mlDdCkEJabcYo0rUUs4t398stqMM3 3/7lVVZc/M9ye5udrbbn371cWJ03qS/JPZPCdgdAGMmrKquFlaP+CH74Ueix8uz14pye5fAn 8ybzSPIVy1kZI5+emti70cGi4t5l68dsuzivzu5Age2yJXy7+bz8sjivzx4XQpOBHLbwcHUF z1aPjwt+tnyAb77AH2xwA4+wiwdUf/DdcrPJhO6/h29l+936an0PEl5uofvd46KUTXd38C3+ 8zckhc3XC8Jkz5bQ7gO0XMtfJhaXWhtlCzq/L657MzgpqdWVMM0gOJRNnpqXukTDE+YlstMs pngpPuEPKkGXin7qAjZukZeN/AMs3Pxx0nNemOdi9RLabUAoyysa70CJQT5WYug0KIlo0Dod CO3S+E2q2jBBc16WvRZ1ndMOF0VB/CamD17nQl93nnMGinCQjwlNtDzltOMjZ9JdgcVbaImY Fkim30iN2HYDI+410gwP9qSVtJ7qogIzXbFMbIeWxhU0iSjo0X6ii75qxC/EL2ljFz2u9zc5 7LFXb3MGagM1s48oD6dLBHhnAbKjBk2S0pt7WFx02J4NdjWqsnyJra9BVNcgt83qvVHw/0Dt +hhVnQeyAUAvJMFPqOwXpBAaPClFWjCERmNzdjydKqckQEeZg8ZagwzGKs3TKlso2S93y8fd wwrMxvITzIK1ltaWfJLGr5X/wK/wx+sbaLy+gkOgsLlbaQTbs/XWWMvdA1rarbbW613qqVUr jKC6cQTwHlfS7jOObYUMpCZdiRN8GSC9fEL08EFKq5KSREiwupZ8CJkMwA6AFSCsqNE+cK0I DdSQAL9xPaItm9JZ0rKNKBIWUSST+ooyXwpT0YYW+ltPSEcSKkle+ioLjlBF0zR4iPrhRWqi XIyu2UvFK7wg6Qm8QEcnpoxNzHhPUca5OALWIcZ/8CV0FJl2L/l0kaYDesgAhsTHAxAy8nML pMkggNQ/j+NHycAAfDQcxNAjNhgAj3EetIzk9EjYZ2bHlUK0gR6naSDBXLeNGojtBFFhp43m daifHiaseAG8CUzFS1g60S3AhzFhvJ8xTFi1VU+pBjBhGcOEB9CVmNAnO4YJFSm1UEfEVQ1i wuGu4pzTNidSYmwvTPgJLaYEa/q4PQvMeYJPiGaUJQeD/AE+Ww9Cx5yHzfSR8mlKcGz2wWoE felzPrD/vuv6WKJE8MfosLg2PYCQuSPjGN44cCC0rPOyDQxkJoHVTOwI1wRN9ZYdShfwFPXp JieDPjmPzL+tf+zIZQABwiZwFNrTM3YoFzUFjexzMQqytRGQ9n9EM9fDIHu4rwGQ3QLXfauS nQsZkFpi37c/xbDvoUQ5FdBjL1Mm0Y6iJ6HkiLyaQew72NMY9vUZj2HfQ8kg9p0snzD2Lbhg II598fEA9o38XJ9H4ekQ9tU/j2NfycAA9jUcxLAvNhjAvnEelIzU9OAjcR4rPCnEG6hx2gZI pNdGDsTpBEbSbaN4Heynj32JPLag23QgXtWOQN9YN6PItyx6ms4g3zje3ZtY2+ZNFSI2ineJ cy4bEREZjukNdjXmoAqIaQTuPn5AuApGOGKhDuKHioND0wb4iUBpwBArx3+3/g3M+AqfSUdf DztInyqaWOMTBDQBwP29AdFPEq48rqBX7BkhhG0P3+2Wu1Xa0evZEFjBhBxx9OGzgODjaVF1 zgIfxJkicgwQrSUyhy+vNogxYBhPpvnqK33GcBrewa8d2IRg6SsJWJXPVeItib2wtw0KuHbl u5WrSZ1trkDckiZCQpwPNgJ5DhJpWYjfkoBIxxEPcRweY3szFs6Z0tcA4KkRe/ibMwpyDqNT 8jy051KTEaACEMkeWlIhE6IcR3R8ImKBovGeRpGUx/f/xZDUYVQkkJoqnSCQAtNMnEAy2PAe mFJNLJpy2zhQItaNPX+QTkjabeMADtIN9fZbKWBOOoHpTiOLS0g3Nt1vZXqyKMtt4oCXAZ60 HInxptoJdAUUe65HTlxXZq+JGhFx3aXdJprXgV56OIs3POdcg5ahzCASi4CM9zQKtoqmp2Qd sKXdjCQGuw4hrPyMHt0x3KVoTUymIrHYxKTORq29L7Xp2GuSk3EIJF1Zo44dSV/JrcEECIzw CboY11cZfGvhDyKsxscmYRt+pKi4OGV2IyyeM/RYAJSWbypgBxyjPL5TC4gKAXEWINRBcmUM yIk/NtkAxemhOYS/VRfNaXTnwbnEo2OVAEKh0VmUGUONB5NsaE7rE8wca9AKjhLyAapWmBaG DSqxWHRpWm+jINXXYjH0eDAlCVNPQEgB1T3MigQgiqBFfoMTEotfTelrFKx6vMfA6sF0JFyd KqMwXCW1cVmFHH/qedzzF+1AHxlrx0se8v3ZDqLOP81E3PvncBFx/6kWcf/fEB9KWGqiBrIi B1qo4doWA1mRTjfxrMjhnvrolIsZ5FOyImORg9GOxrApr3lekxFsSqPYdH+6Epr6ZEehqSQ1 LS2SxCIHU/oaRVu+yGaJgS/voVNst9EBYx70tWl3nos2FbKT6AN72kB4sYob6sOEwsRCKuuA UCxmuu4PGlhKzEXbgDvL56J3bclwK7QPh93Z2GQVvUlTLZMKVUvfVwuzkHTopGzytgyQSzzR hGOKnU8HF9yNDEC3JnMjCjwPpN5EqKceZcPgdssoHTPJVU5ZBsmZvtMkAE2VvpyUkkliwZ9J nQ2Gi3lI8UdzMg8lVEqL6BH6MTUhTnPW7GVTFMaT9CblYdJYmGlCV2Oo1Oc8ikoPJIOgdLKA gqAUkE1hw8kdlem4qgonIt1p44CxWDf2xFi4kelOGwexFZ3IsNdKnXQKN0LdbWRxXdGJUnut TE8GqXaaONhvgCctRzGF4tAecJKaBtTA1YgfdqSJhGZUug0H/NlxVkyDOB2tZqlzvI84vC2d kN9Xt6EucI44xfWoBp3izrB8H7JpQ10wH3acq0aDjvPBsZk2g2Ob1gp3Zl8pxeJr+1QdKDOx Qvz7uMAVrV1t8RJz8hi6lciihIvpx1Q78Oi2JRaJ8An7Nv4oOoTWcHPNp/NGIOp3MEjfFB5H kMvd5BH0L9UfSWdgYEsVScZcUvVxJ88f4uTwJXv7cHeD6QGbBREnEMRzP+H/fl1U4PFkZ+uH BZdPMB13JYPsDFIKk46D0RYM1ehCCG6JWKRzH45CNlRuCqGGWAcXXsJ6wRhAIOnhSJpwXbcJ EX3z7rgVGsrVUZvPo3XcGg1RatAnEhjV0iQ7qFMExiIeZC5qYi5ISRATeVwkn0VSljkPEBIb bnHeyJPTerOCw9NPEJb5FQ7rGGFY4z28ldxsbvJuYg6psFo0xKKXYJyacIlXPH3Cr8QJ0qQ0 K0GBjwR8Cv2cI5nlnH73MYpnO585cLwsd2v4n5y81XVy2rxFP8X8q5NVYh+0AUrLx+waF97j lYwZvkfPVPKhloQg/vMY+FN6SuJsH5rQKWYllh6wV1WssI6vhDYsW9a1dV8XRd18c5xZ9Ym1 AvsGiKVfVi0ND8u52PHqrUCROgK9NrcSQrtL3/15b29EyLg2hvDRATrmLdV+qcwEfvFrqVZ1 tL9SwX6HpMkkhCQ9GSF2Luggfbyb0ddKH5FVvNBhg8mfP0C/66sPpnvLCTK4MhFjSEboxOiV h7fppzout3OYBD1/DQFHqTN/0pcsAY80TCiT5Sa52WRlXtIAB8kBCWE1eGF8SsrDrpI7Xq1x CtSiTM5Ew6EmwCmG2zRQw86n9P1qs5Ghiq1Zdc4ylvsFFijGNWAR13L1YVrMKg9nuBwLEUAu bYBbC7ztHrL/8sMrK3X04Z3t5AVMlskNbFOA1fEHkN6UNyxnPECpFwTi6UmXJDLIJRQhBPIf k5MU+qEObRirbl1zAesWQbU1GSbWphU5ajInFWg2rVoXgCz7M+SkD3XX5G9Swz7JQ3fy40kt jic+S+nPQRyclwFKch6Wu8ykpinLq2fLGkG81HvnGHVtf5S59Ob1o7GqyU+QtBIGipxCcrSq 8pYFKH1ebzYZxpvlaJ0rxjcyymoS0OTx0Y/KHatzGMvrdlwIQUwdyx9Nhal5DUebE2HqPrH5 tIdHqYOpWTpM7ferUpX1/hulkHy9QQHeoh2XdnC9xVL99lpvdUCzCetXVVlZYmXSTmg88WIj pApTSq+taROmdPyiGFt2rv5+8wIaf2uurIdNxdLm37jGwt5vF6fD0hwOk+tAoW+EjHxRxU+h t+DQerCVLeSd/9axeY9QFICGQbhn9kZOiTMtDYbhTs+QW0Alx2Y/2zuEOPSrla1a8JjttBMd upCncmO9nDx8AAADZ+3/ykQLos6n0jF4IwGVciSPLrEr64XGz3YGN1/0PcD3llXpOlD53WIi uLO8nQIKphhJQDozTQ9l4Fvt5x+N1YRwN5hxjlTuDDibWIkR5mlweac3A61A/XVgjFPMQCzB OBXsIAROrCeCHX1i88EOj1LHEpR7wg6x4x+sr8E99Kg9tjVf4b+ksjC1UYzTv3aTCh9X2HaX yciR8gTonf8bUFJAOJO6pVEmKHLn1ioAuMzjLvmI9y/1GVds5ZafYpJLRiDg4FPSWaa5saUv zFWnsOezr0C1spxnWbK2BU3geTsen8y1dmkeXbdApW+y76RD1qxY77dS5ekl4Tltd7iktZK3 eMOxSGbJfpRrWeUGf96aFXqnXczawHT76tuOKWp8nzV7zgOq3w5RTt8a2b01jX0hw4ZCWSRX 9lC2v6gCMz1F2ccy5xMpewYvBGEnUvYesdmUvU/JV/YHwf6g2q+ccMYktW8Ax5Dub92nUveb lPSd5GJE+bed3ObJG+mfXmXWVU5896PZzanxKKnharlP9T96+V9ILxMaV8zezE5RzLErOqkU c8WgYs6JFHOf2HyK2aNk7mslDKbLupPXxqUcutS0tMvNqOPOWdktmS2P4rLbHZ4gJch3tpOj ha9nCb6wioN/pi9BrJNnikSvk2N4VmMKhD9xyQO7sA/hKp5HaUo992PPD7KekE9buwS+MioK Q8ZWO1uDLw9lwYKpcU9KJ6/DeHlm235w1aSDQU0YXPy9tWz1PSPhPJP+UVOrenBh4RefBV7C HWoL2eIuTZ+IR/KGB4bXwyT9kqB2gLaYhpy2rayXUbnDv9YDh3mSLfySCMdugpJDOpk/kvT6 pKwhAO1T+uUMZgwBMyYpvMuxpO2b9MG3psmbOsCB/x6TYym1DAr5B8bqv6DtaFI16kuPVHrx wYHyJEulLGh4Uc6ZPV7SImehOdMqU9hfp6DNp1nyQngLl1N9HtY9j3PXV2+ObbPp8bIAfRes mOMlNkXqhR+dddbkPMDI+6AgjJ7t15jBxJYbGX14sGcTqPczguUqAeWSJyoQMP/+oGZIicDk C5/SnbYxKi/RhOBSKw+xpWmIgfRqSkCrKkRpyikrdoc41SkLYk3kVKesPrH5YJ5HqftiiDSn rMDLJn7X1AoYPBmXcmidsdjt6ESpFQxu2JPuPp8ntcKnNFeA1qd03IIYXG7Jzwst+If9IQxa G+k4wKS1LUSI1anvk/Et6BNfO/3Ady7TfKUbtW+5vVi/OnSs4IBlsc86OexpyjwknV3XKxJ9 vcFsS67g8IK7WO5l7LRp08H9Q2Dt+i8757/acUs6T+61p1XNRY4/vxRzHpjk2wVz8wj6Xl4k H0OOtY/pjP+/A+zaLubqJIq4BZrbs+WNnKwO0JKLa54Jo22Zk3qfDWb9cPcmVCIl6CYjpTce pIQrhD6/U4xHilvsAyCFNgTSZ08DUjxis4EUn1K3dFdikHJQzG8ukDIq5eA6S3E1fACk0LqA M8kJQIpPaTYF5FHquCy0q9b1+admBIqchhjpO1PHK/SmXouUg7LzOetUZnPf5DWitqXd2S1n CEJQgjV1Aqwmp1SCp/AEK5TROi9ZgJK6tW5CATotVsaWAU4+uTgB6/lWjsqzWi30gq2HOe5O laG5ice70YK3kp++gm59/TyTauBNL9ZzVL53P9iP2wCSNmxyc2df9SLhNre4V3PQzQIHUNhJ pm519F/3oMP/bSDvdzj871TXvkX+4Lkswb1BdD2QH6DfHezmCHg5JzPNIrzvr+roVXy1ydYM X06ak2uR3KgTAdTaJsDKFKOe4mL+gHjgDcbdd+Q6Lyj80wzWroASPj7ZGSiV4QFCJjyuwc3m yUTjdTyvE7Vd7T7jWoED+Efrkb7uFlRHrSBvK6wev5JN1JLC6kG2U3n8pGebtc7l6lWEsZFG yEnv3NSEYKnYcnq/OGlVUnU+wbdSs1x3rtx3YtM6EatyNdH9jBdn9SxQvOzuzIK92Sx1jtQs 8ib66h8YTO57Ox4h9W0GRw9gHI+/9GiKE/BN+JRc/42GUfJI7qWldHR0G6s0ezTuwOpUPqPp EzoYQ9TmURq5yOzeu+nf3jAXaB2kDJejQq+xsAmM36Nv6jOkUTZqy9m8vcG3gybaH4TmflrJ nVr2W+dVqjAW61dDFSFhdz+ElukUPykD1EhQhQk+dG8jhbA776+6PnxRiUzJU3wKqDboiWOG XCIGRXI8Qh1UlDweT7Bkb59m+pNDy6CYpEeok7jROnkbYrhY9jB9tkNZMnxhVJ+V5BgLqvHy AKEpECvFPe0BP1ZBoHzvnjyluMsbqXxJ6qYHibzKl8cl2MQqX/qE56l86dN5i4rr7ma9Oc5c +hQrrJPtU0xd+rLiUGLTpxMsfVkhSOCq7KVAEzdrpfp/gvJ7vFPuspq72iXDYvSjkx/cBinu MkarXRKO+d1h51/yYpc0p0GabjTG3vpTR/bUcAPfTuHzkB7XFC28hr5PKQPzXpaYivz68l36 M7/c/ycYHytyEiAE2405NS/Fcvq9il6SGvJpfBbD/heDHndfjD9OLso/vDX37fW40kc9MNvJ 5zU57qNtnVchqQwXZxVf/GGGBNsGsiZ9XuYuS8oqCh5Zn/CrbllS7SV0o/fJkzhLSPH1WUkP EIVuYCFpz5CYinm3o5SCBi/Jfc7AXSYFRqEWIN/bCqe4yxQDo4RDvfohMOq/sT0JGPUIzwRG PTqzg1GP4kxg1KPzownjKCyJ2mSTqRELfTIJiCoXZfqy6xyB6NjEB7dAikTTKBAVSxJR0WkS 51XZdZ9or2J3ekxIoUCeTzd9CdCCw5HbpwQLtMIF2ujYVfp6g4WA2D7pGequU4DYo9P4u4JQ AZOrNsBjP4ad3K1fAvj16b6KFF7vJCeez1l0Hd/z4jN2kqLrNaQunGBpsqqA1AWf0smKrovj ZxViYIai6/jC4FGholH5fyD13BUNCmVuZHN0cmVhbQ0KZW5kb2JqDQoyMDAgMCBvYmoNCjw8 L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDcgMCBSL0Yy IDEwIDAgUi9GMTMgNTggMCBSL0Y0IDE0IDAgUi9GMyAxMiAwIFIvRjEyIDUyIDAgUi9GMTAg MzkgMCBSL0YxMSA0NiAwIFI+Pi9FeHRHU3RhdGU8PC9HUzYgNiAwIFIvR1M5IDkgMCBSPj4v UHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAw IDAgNTk1LjMyIDg0Mi4wNF0gL0NvbnRlbnRzIDIwMSAwIFIvR3JvdXA8PC9UeXBlL0dyb3Vw L1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDY5 Pj4NCmVuZG9iag0KMjAxIDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDY2 NDQ+Pg0Kc3RyZWFtDQp4nOU9XXPbOJLvqcp/4NtIW2Oa+ODX3tRcJTPZ2b3azGYT115dzewD LdO29mTLI8nJ+t8fukGCoIimaAtQ9u7yoEgWxG40Gv2NxvmbzW55XS120Xffnb/Z7arFbX0V /XJ+sX74+/nF00N9/qG6Wd5Xu+X6/vzT4+UO/vTHurqqN99/H7398Yfot9evkjiBf0WRsyiJ 0jKNBY8KyeNERpv69av//F10//rV24vXr87/wKIyurh+/QpGJhGLMhbnalhelnFWRBd3asxP n7LoZqseG93gp7L59NPrV7/Movnfo4v/eP3qnXraX1+/it69/yE6Jybxdr3bre/oefxhvd69 dB58bx68yOM0j1gRFxKngdg3SL+7+PSnPt5HQhNJHmeMgPYcEj1rnUWRxWmp1koBlxFLecyK iCWAd4fw1HFudjA/LeM0c9PxTMyiC3j9FLH5WTpL5uVM4F9T+Mjx4z6xj0BJpmmcSwqlM7+g ihFQDCf5t2RezOIEphrzeT5L8a+/zuB9Au85vCQ+0Uo5jwt+EgqkPCVBRWrHCPXHxS+zJP91 7hWsUIQvqBnubSgNjZc8zkULrYzLzLUVJoxyY2R+OE4IUQ7I8GKQIuFxRu49JxHSDGA0oNI4 AboPiTBhFLEszQ8nIoSSLjr/9FDdg5h7/8OffoyS8z9X9zfRrL4/++nt/IU6S2gy2qjlMs4A N6W/Er6P23dJkhffHyPwpQNiGXNOQdynxjPBOSaouIie4Ozd/IzPYnj58UOspG+uPwwF75FY MF7G7HSTZoKpWVPgltu5VDDVPLdzMVO6Ev67BnG7rK/mZ1kAfHIl0sjpr0EJPMCLUtuAxj28 r1arOeOzJ9+4cJbHaicQuHwLZEHaVFvvkEUSy/RkTMAFj8ucAre7nZ/JWe0fqsxRbLuhXgBl f1Ds9yFaVU+w3+oNLLZ/NEoFn6T1ojJshmu9mLNEs+EGvsCXeqEMlF10DX/tvsLh+vv+b67g nZ4MfoOfO266A2rjxoPNtryHjzcGfvOYQn/Cnz7OM7Unstlquah2sC3tL6tddQN/QcjVHexZ eOy3vqmY8jwWxclltVRO1BBcdQ/8chWEXVhSxjkFGJn2z/DyKVqgaEBMImWhX+J6R7Cai7Va XGQpLUpv4I+wippbrvRP1K93a/gGfv1guAcZ4DO8LK9wXwILadZElnpCbgAJuTacoxcfBuI3 t/jrRQR//WzYEActr+FJwEggXzOFpWfyiVTpG5J+3ldLpDJmJQVubdbAP+AsjRkb5RMUbt/M mcAdaYmLhVlnZBL4dreBrx/h4wKXJvW/NFJql+BESyMVJwh6ZbJACyMz5SVRYI2qU6+d+BS2 9AwmypRDxgYIwdrXv4FAwLWvUZws6hBGJ0hvJw5xCJuzJIAFMHAlsNkUYC5vigX2psD7H3h6 Qb0pJ8RwbO0G1/OmpPGmuLFzvp7n4Ub4gOcRxDBlSkalFELankBVUT0CAVFUoOSqOvlVG6W/ QnMAMb0zdgNOYhet4ffX3lUgU/qkPBnDCa70CaPANZLdO1AhYilON0eRxiXJEripLrT1+QB7 pDMY9c5Z1dpQrJT/YLk0t7D8oHHXrbmh+ag1P3t+DDJPZ4TqkfCbR71DGuuzc3fAMcr2/aJh tPZo/2Ns9w4jtp6kG1PKZZiP+Khk14VZjJ4z9q0h+5dbWKLl4lZLs57M+6z9Oti26P9pbxEt eNz3K7UUrO8jmEV6gNVElzlTQrUMIJfSLC5Sau445Vste3wDzjlGRdyA/c9T6WiIirjB4TbZ dPvAuFDtFuvCBmWzMv/Q4noX7XDN9dZ57O852yUp/W8TUShDjySh920iIDLPpm2T48xMxh2m PhMoLSfxi8v444GNv4QPjdKgtp8LYDjTzwntfQwc/i9k9ZXgHjhRJW2+QPYe53FK4fK/wNzj OrJzGh4TXAd2nNBaYw8jY95NsCIuqFX6/22BlbHkBGFCGWBZmcRpcdAA8y00lEZJOAX8/56p R0z0jxgi/lJ/hgSDxrtJY5RqAr73neKrUrhRgfIAXR1w73+/sySWJUUCe8P7lzQJCFQCsk4T XRnRv6ovYTVAiPwziHoSeRYnxAL8MlvutnMli1bXmkW925FFLElSfEE+1HvoymyR+1bm7aJL TB9G83xW4VuUwmK4n1oD3btoTJQnQQor79RKkzyWGQXO0hSNurA1RSg5rcwsRm/btXdrhCUM Hu6EGyLKnAigNQHOu65lSQHpCwKcd2XLGItLcnaWsvUeu0+gNu5kiygEOIoEuHWboEWBUVcm /Q/ugM7StprfO2KFiDnJzP8WbR8xrXxrEscP/mPRyofOKQw6K3dXL0zm2Fi3/ViIlQiv7xXr XJsf42MWta6RCODrQUBaMHp924SrWtA8jOOQlhT0S527b2kWquYG0tJlSiGxWC11hlHpgV7J inHJhxEv70EbiOAKCkPvuUjJi5iT4CbEiISHGNGI3sxyKM97AV7SA14yUis0LE/NZBrzYfL8 LUbxBNZpM7Wx4/SoxRoALyUenCCgH7dVBsAYz1Ghu4F9QJtxfa38ec9gMyzHJMAep9gdwFK0 ItzAfl4fZwcPwRUYhz3R3Aol6wUF7I1Wkkqy4ctqqdhVqakMxLBA9yDrrTE4tR9RMf02R09D zJYb8Hfg3R3IxUbFKRP6uGLQwUREWkIh0TSudwmCNIyAakQBP5QE8q7CciUGChLyh80aohFt tM2/4c0x8uMG7t/wTlKoyyHA/YyGlndvlfFkBKj/OXIBR4AIcG8e5o2nCuWtxnv3ngVAV5Tk KWW2DoO44PdYtVlLLNGrsUissaJ0kM97TC6PC0bh2ljTxlXxnhNlkBMlgP8Ivk9rLjY70fYI vFvUMk5JSgQw4HMMgLnBVZsw4g4KZvOSgupKk3lPGacj0/Y/XzhWmpJU3kaYB6y3CyiCX16i m+R9zlIo7UbO+ff+wWHqZBqJXTo+C5uozhJx2kS1E2CwRLUbmklUhzzshZWwJ5otVMIClzmh dQmpe5M83EWVNpGzgQb2jltZol5x4maftApQZZmiOnVCbo9vKNB2pueuO35x1eXoLg3hwiRg eCmg/Gl0/QIk3VJqWXTOBDLZ/nUOK+Ocmqr/KiVlgTKKBaywIBzV6EJ0vUNGTewXB9fb6F6n 4nAP9VP2OGx5rX5gBfvQcqyuOwtzESmqKmbHGoL23NseE+5uTXhOB6ODJW/SkoFKdmYgu0nV K0yq/ToL4SBknMLCIkl8ARgpuZ0FkNRZBrrZiQTksaQQmMn6de7/uETOwfUn5h/AF5LgjxHg 3tx3NQywH7wb9azMY84o8N73Pk8SkHAEuEtTiwHZ5CvnPhwqg8t5Xw8MC370roVjgPsnQrF2 wv9OFjKFOnVimvaxp5Odu5WQMiUWOjqDhxdFgXtqt/YOm+FZgVNtKShELUjqL7Aer3ecGIsQ WONI7yXIunri7ncvP1IcSGMU0LDDrUu7hJJ1ermxLt3Hl3vn77yftYdIsTIACZQ7Il6aQi3/ 25MnZZyUFA5XbY1GvcUQ8zdgbTbG+ZXRv03i9ywl0rHerdEcjs0TKAcwfkuU025wuFnWYwZV iNgTJ/HxbgMICEiQ4CZECPKQWYA0LSFc8gK0inBZylTkUCF8MEuZBclSEtDDZCkJYB88AxOY LiSABcyGEhDDZEMJYB/rf2COb7Gr52joKR32AfRoM++8SxCeiV6GMJvplIDOEGb+E4S8iEU5 keFce7AMKhpYBpbWV0gQEpBPkyAkgIdKEBLgMEPVFrWGOkAjsVXeNGp/1bwZlFOXFKKh82ZS QiE9AfxQ3syEnELlmLgEx4TAzg4IbzHZlIZLNuUiZiQmAWraUzSr3OB6Eb5BkTjGfMP0GJI8 g5wfhZadA4NlCJUEg4J/cmf7T4LlBSr7SUvv0mMscOdDqX6Y5KdMg7khBvPaCXC9Xh3cJETc GaOBgGijhSMHGJ3xbxiH+69aPbVdyzqQOmbyaGLzejdudDkW7AaUp+aog965W3CZ222MkG3M zdHJTasK7C5bV70+Xl3s3g4/Q9Deio9WeDyri20su1SCVeMbINjXLmchxmPVmwDWTwInT5yQ fwHTOO3p/G0ESy9dS2+OqzqXfxjmUCtjH9LVx+6Wq5VOxdS1iZXsNVZDG7T63BwQgjAZHmTq eu19aRa0RBR0jX1jrOjx9+YQkR1GVYsvR9a+ObTXdQ3wX9isfKeCXIop4jRw6yOZM4egDypO nRDDiVMLXJxkys64Me+GglVYx+G9J9Cwpeyppt+0lCXAHaU2pKU1LMn7jd6y3gvtGJw4Jeah N7udfg3RfyQn4Qco7ctjnlLg3MneaguUR5Gu1e62SUuDVmt1seuQapsc6+tk08rSaneI3Q+/ GM9Mk917q1+Z8xGe9W/gK7+DFRQ4/yl0sK1TUgK4Uui+j6Qqq55zNwLdMVDm6HF/LGDl2mYE 4ICiP1XfHHAovZte0JeWAKzN5bt5a44+GZvly1LvKNuAWW6CHOJuTjESKD50Kcy9dOXaWOqW F77dbZa9AIn/HtxK/CrzhUA3gPjNoNsfAc6/SOCQSmIUPJdIUET2XlYjOIdCL2rW3sWB4BmU ehHw/KfteAGJsVPxkFCWV0KCezOukjOrXEXvsS8bbFuyAxeHtwUD3SnnCN0j8LvXxrEb778Q SNhKTIA427DUuyZaV+EsQxwdEXhZDoHEXrSgc2v1IfJGH9gde7Q/qcMRuvxoW3eOa++QcuPC 2q6ldxM4jYuSmpxSFyGWlecJ9MEigF5bFvdjZ4JDreSwQzqUBXSNsToy2svi/bxGCoUBBPbv 1HqN94fyX2bFIS9I4KO7BgE+mLK0Wgj0t4+ipAzJaDIrIItEYNlv8JJb7mMvsBNIvIgsLoZR 0erK2HJLtEN4G68KImLAcHIjoh0vXKZbq1wR8AIT6q7tDhbAnsPrUQi0uugm+ImbeRZCUrAy 5iWFQf1PTCbWG2M/Vqv9vj+9TnFdYLHo70n/dkFSQL0XgfiU4Fzg1pQS3KbTBuecEMPtagvc c4JzMlRw7kTTb4NzbnDu4Jx3HNJsZMpk5086GnhUD5LEIVeUlwC+EbUJ3rKjNoGzOAEvIToV F3AhoJqSAFetdBCvM+tvlPi+DWNh5gyViBuTobPiOGhV+z8UBgUReUlh1RTze3fesD/QqVhA SIaeMDFFd016gAIMBo39KEYMALBgaA67AWIdcVuWNnoYYq8uv/Bcln/Wu+krkApkAowQp9/c NQikyvLVdK27pQKV5uc59J0jEPUv91mhPE8CXBCxz4oU5XCICRJHHcDsdINrQ8GKEfOedWwa DGup8NDtj+p+Lu20+iAnFt21Z6HstJG+3akYnqXCXNBq5TxTZQepHKUcg1TU8Bo1Y0AEaQzd 7qqEQZnhQLIMM1rt5gmU0mLQqDqj8AlQB8qgEpUAF+BUqMRjigS8E6S0WMHhOL0TgaApLVYm UEtKzNz7zY6sFND68WR8VOqQoxsc7J21LW9ajdwU4zj8Fyug/dtckjXHGHB1HLUblBqBBboY FPTALZv5rFret8VKIPraVPeVCUY2NU7VoLT3Uom2pzbCrjv6j0bqfadJE+2SuanuPx2c6Hz0 JJ5yxj98tF0ciX/APSlyUDYVMv7hhhhMTRHgTNMT73Wevv1GuO1LUNN4bkWp99yqgPgBgZyb oI5LP5dXnXjrrBmrJ8nyThlRXepIWxMViqBdtANBNewRsVubpdoPftqW2GNLoebKWlNPW39r jClLGAdiUrD/Hac9v+7qshTbNBHIDSuTN/OcKEouDtUkP2hXsnDf+jvIZ2WummT14DfACpau sgqT/ae/8IIpgjguzdf53E2ywK2rrVrh7GusesuSWRZLonplvA32sBo5G7gnXQLHutpluYPk m7kjuFeV3OzC6WXJpsr9cG0yCh7/qY8shYgPQccpqt9HZ+Mx1Q9XRp/0mIcbYjgWdoNz9Dtz Xcw1yQiottE7Ez9ry3OpAEHPSp5cWBqmQQpBm+eFIib4+gEOYkqFekquboCa0lSJeArcCfxv OK2UU/AZUFy53iHOcoKvlHEKsh0SC7R/1Q8yqo0M7paJRZ4BLjlo2mQRKE6r8SxPV+KpWDgp KWwDVFOVkHQgwAUo8cw4NFUk4J2sxDPBBovUrP2XeCYl7EsCnn97hjG44vRUPCSYhPsqCHB2 iaepffNS5jmowCp7lkB3w9aJyi5Tjv3wnXTooq+XT8GEsGBwWsZd4a+Jcttd52el+yYsy17Z p13h2VxN06sEDRBbKYCoxBRDXU3DpYBiLgLqSNknllE+00UOVLqK7JhTc5hwO6j/dHeJ0smN UGxS0U35J5Ds1pBsrwR03XawCWC64ukgAkvqer+ztOdJB9rn0Il2GMg4ffUngcjXrv4k0Dph 9SeBwb9+9SeB+JQQiI87XcZCIHCBpKsCIlwIxAkx3K62wDmrPx3BEPnSYIidEQFWM4GBIJWL RZznB+cXqIZRoKF/iLYBqhkzzAW5eWivmjHTFm6oakYByWsCkzahm5ORpMVegocqwwvU71sU Am4HJNA/qjjujBPVcaYDhk5xfcWmtVz9rhwGdLw3Hy5z7BBJgDu6Pe6xut5ZGFdittVG+WRi hZUZ1J8cgh2iEqWAzXwQcGPWl/txlJ7fV3eXoPoPY2UllFGcnkIcOtOzw4BtVziAHQgtVycw iK22s+fVBl33bslubMXsQMIPlT1KrNGyoGs0KfYTo4NGU1UwsVdIU6XgpNuhE8P+K+sEZBZs vJ5pHvu4DmmEYIrrHbntKYj56MIsIybh771oGPZa5bJwXRb7NgY2FbGyTY9rLeSCXJSxSEjQ R7c7HsBjTMSCAneBhpKyn6BZl3r7UG3UDla7cDE/tsDWiUujIE41d86Q8abBc/JfwHbbnKdQ /ztgPjxGp9ttc2i3zY4li7PdNgE9TLttAthfPteoIj4v25thv3gGn+eQeJw2V+f6B231zBNs tePYlEp7XbY3dyqyvAU+6NcXaEdHF0yhtky7gpfWHyqtEG+9Mf0ZsSD3S9QPpQ4KX6Crrnhu H2JdQ/dkymXskwbLGxNYch810BbfXkj1whgcXaAOJoqP13EyBL3w3+FKKdWcXCT/IV2ZQNSS ADe9LbS5PatZEv95JIZ76kRkgXZUjFyFwE2o9TaFev7Rhj/fWmV1Xf7kyy1ujN1tv2+lzepd 84gX35gbLbdNIC0bBtL2LPAm+BbgBmRl0UAAxE2pAOHgHKqF3dAmSHXuo+8xzS7K2k1fpG24 lwairvpbPDHPUo5pXre6URwHdm8547+PLnS+EHh6qwQtkyBpU2Q5JkDUosRWHP1hrsetTQQL UnLttx/r3wzbQrFlfb9Drw48OqUm6h0+Orp8it7NMTrG0tmn40IxLjGeQYsnYvKuVVEwMxZL WEqoxMgUzDiFzHmcZhbE/cWjGkxMeVaDvQP9QqALBV0IBuhD2j5p7/z6WF8PSHcc6LKgQQ8o ZxGPKQ2hNkADVbBE1/CMU486njLpYfQceMLA4yDmcAHsW6EhBRbKA0rljb54ZNFFEj6gDYIG V186K/5ewpbRP7mDt8Dj+8tw5ByaC62fvQ5SYG69AQv3BCTy4DpQtcKTHkbPQcoUai2JObxX 6/C+jTWdwzUxLLf/MKCoB2wkV65xCUgNbC0A+hdjliI+6eznN2jLBkAm45o7Crg8YLjDhZS4 wT989A45T+PSDXiMr6CcU1mqDVSZxfIwW1H51ynPoieQsgIcuxGuAh2Tzv59QLkj4SpbPSXh EpQ7f7PZLa+rxS56qz7hD7IkLgsIXCTAjuqlwJek0WzXv5s2pJHyeoiW8vtjGIfnjD4GpJTM 2iGNlNofBByX5PZzksQ9Kk3bUYovIWO9PyhVtM+LQ49qF0qP0gs1GKN0+x5OLxzUUluzBZKp 4wqbjuSAlkDdAJhVf0w789ExGl17iNwbsmesKGu4wLuHYf0Zg1d6P1IB3ynPIu3fDMq81Y/h FpRWrO4JsXfxhSOgdRRUuI3SAXWChdLAa1j9EMmoUPSkh410s8La+CH274zHdmXCKbrfpb5F GAI/Jj8DERFdzbRaWSkaTH7Xy8/dKSdzlm6JlaZpG2H6b1McqU9LrXSI5mbe/nAvUoRwCDvn hZQQXGmj0kGJaWWgZVvFqP3i5W4J4n87dD6Pw1Kq8Vw8i9saLd0AbLT0IW6jAs+THkZjrwTc EHnYoDzVBcDv31NWxktB5gUoyecQrJH5DUAt8w/RiwrUTnnWaM104dqc/0UZFC+EIwSYYJNp 1DclLKUlCqPb81LpqX0Tobn8rjURemMs1UY9pjUR9JDOROgNsjSgKGy9PhgFJoIe1ZkIvUGW ohx5lGXLQT+V1kTojzHqVBS29u9TSROyWUOkQLeEFonoAc3crQGAcH9MM6nxMYhub4jcG7Kn /fMEpq1XlvO4lJLeLIKKf0151iHtXwy1WGxCpfiO6Rw4viMsgZdhAHUvxT4GB60ADath5oOk o0J0kx52yApw0O6gBUCot5cikuVwz8YoCT0AgZsX+jDCWzA6owYWQ3MneROZj7pqjdqkmJT9 8GQK655h+xy3/nCnytDyOXyU9rE7PtOF/LF6RxOhObbgF2fo+VnmA5wP2kEaXGNGHNxvVFR1 0sMO2EHFs22gl4LTNtBUwdQoNA1M67ODdKLip1Oedcj+KabZPi+EoW2fSbRx2j3QbauQo3ZP M2TU7hl7TGP3NEPG7R7rOSN2TzNq3O458KjO5IRRY3ZP70Gk3aPWTzSxIa7WJBuERZTYJgl9 eIReCj1idCVoPJoBI1CaldIjxheqAwPE3YPUjOkgjaylHjS+lKPAmjHjwJrV1oPGFtsGJQeg cIgNiXrM+Bjcjv8DQBu+ww0KZW5kc3RyZWFtDQplbmRvYmoNCjIwMiAwIG9iag0KPDwvVHlw ZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250PDwvRjEgNyAwIFIvRjIgMTAg MCBSL0YzIDEyIDAgUi9GMTAgMzkgMCBSL0YxMSA0NiAwIFI+Pi9FeHRHU3RhdGU8PC9HUzYg NiAwIFIvR1M5IDkgMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFn ZUldID4+L01lZGlhQm94WyAwIDAgNTk1LjMyIDg0Mi4wNF0gL0NvbnRlbnRzIDIwMyAwIFIv R3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMv Uy9TdHJ1Y3RQYXJlbnRzIDcwPj4NCmVuZG9iag0KMjAzIDAgb2JqDQo8PC9GaWx0ZXIvRmxh dGVEZWNvZGUvTGVuZ3RoIDkyNjM+Pg0Kc3RyZWFtDQp4nN2d3Y8cN3LA3wXof5i37B6wrWY3 +wswBFg++3KH2HFiIUFg3cNoNZIWWa02uyP79N+HZPGrm11VbM7IjuMHrXenpqpY7O76kSyy n339cLx5u78+7r766tnXx+P++v3hze7nZy8/3v/92cvP94dnP+7f3dztjzcf75799On1Uf/p nw/7N4eH5893L/78ze5/nj6pq1r/N46D2NW7buqqttmNsqlquXs4PH3yn3/a3T198uLl0yfP vhO7affy7dMnWrLeiV0vqkGJDdNU9ePu5Qcl85ef+t27R6V29878Ntnf/vL0yc8Xu8u/717+ 7emTb5W2f3v6ZPft99/sniGNePHxePz4AW/Hdx8/Hkvb0Sza0YxD1Q07MVajNM0w3lunv335 01/nfp9ora2HqheItS0h2tTP7dhX3aT6ShmXO9E1lRh3otZ+B4dz5dYvB//Vqer69ThetRe7 l/rfn3bi8qq7qC+ni9b8tdO/NubXZbBPcEl2XTVIzKWr85oaCVPCNPI/6svxoqp1U6vmcrjo zF9fXej/r/X/N/qf+pxudU1Tjc1vEoGu6VBTO3XHtOqP1z9f1MOry7OabVXgR6yFixsKrDVT Uw2tszZVU792K2RIrXvkv0gHQqYdXWyyrZuqR++91SB0vbZhTXVVreOeBiFDCukW+8VMh8yT TtlTOUXq70n1SB7Vk7Xqml3TGrvB4u7ZT/f7O/04/P6bv/55Vz/7l/3du93F4e7qLy8uwzMv Sxd430KwZ9lNNaBR31ZampXH2eVVc1Hpf176/zOPNPN/TdKzp/ky9VU7or7g0RSN0Oas1Vb1 nMo8XDgFEs48ZWgbRKMDSsbzTgfwjf7nXv/zUf9zcyla+OD4mET1VJf6QT9n8sJ6DnNTNWDW PlxeyYv958urQRlWsXjQqeBwbf69+eXyqr847FSa+G8diTsfnV9vL0VzcXijv/ZO/0EJaT2v LyUIfDKR2x3fWw3qw5s3+t/DpahtXG+On7VFY9Z86a3JSyoZ729vrTPjxeGt1/d42Vqb54+R vUrkpLPpapDAf3OZ3B5e63Z9vOwv/mFa/1id36OxMfll3SP83pOteiQPzuzQVkLBIXfvNci9 l6cMbYNUD5wGvfd+TEJ2qrleGhZaM6cToALn0aTAH74+u+lh0jY3Pym7ujffA7OyryTfWS3S WVm60BY4jFpvwQ9JwE601ipR1BoSrzAieaF+M1/o62rSGWqoddqvKznCP9qFt3/K+NzmR/gc 8uNMQDRaA65A3+Wyd5/bu3wmoa+seog11PWKSNc5EXXxNY2cS3R1Z54GhBLXISACHTIXUHi7 8GOzhIsn9Lr5KOr0OGC4hAtIkNBtWQi5BtNC4G8sI5cyS8IT6j7vbU+3UgcJvdEkA3iUKpbv 2iE81zPQLh2fnuSFI7vECx7qwJ690pkIdgzTkbrYZL0eQpbmJCCHpon3+k+ONl7PQEZRxq3+ pb04ftR/MiK/GBGNMIaTjFpDLZ/1B4FkHhzJmN80BSnyeTDkdGMoxli5/qit3CmKMDpuHvT3 P3hj8LX9EZx4ryjsEDgNPP9F/w7KjtqX97YJGItkxFvUeMDVjzYO+Fd13fXPW/VDSvW/9fOr Xv+/ug3r9vmV1P//7fOrTosJ+7OxP79Wn30HsnJ4fjVo2a/hs9n3td5e/65+Dur3F07muai/ ArlG62vDd9VnV9qnroOfTsZ9x/mi7XbRd51v8huQ0fa74bmIdXiZaaFb2vZ8F8nWtg3fGFtD ZNI3vYOQKbXmx4vQCt3qFz1o6xZaRnBw+MoG5Rv387mMvp3ETMLvSuMJ1wdxPwqpCSK6H/cP 0S31SV+rcE1rcIYbSN+NgPTVKRftKj93enY1dYpHZzBoGZB5wvUMOZO6CJKtqzZ5wGmGbTqY xfn+exRhC00Oo8qbmzKCIw4wCMTBhGtg2JVSxaJr4vp/odRaZsdCa26I5rwaoZMgSNR8TIAo 8nXHoeZjCkP991EKNRIUhOIqokGBIBA0UoDwJfSP+Sh0TxwGVMC1MwhoL+cyriGkDLgai8iF yAIt+06GSbZuqHr8NhhpsqQ0sWBZN7MHnpn5VU7rh8a31csKnSMsMjqOylhqNIMjrTl7qdLh mmiMJFWxWStx/TSKXJ1AUznPzqD1bgItmTyzU2Aj6HXq1qaerDv/8Mx5P8dS+I52UXt3Y/D1 zk2ggfY7bfwNKEDy7klR7SehElgU1GQCcd7+YTYDGLXf0LKJ5icP1mbiEPjaNFV9PtpOMO0y TTef+AYbxTGaq7+Z5u+P+53qlHv/ERD74fqo49abHqv8NOW3enLSePPeB/9gY9nHV8qdQfIv FNth0k+vKLjnGMq81X+MhzF9FKp4GANfGVdHMq4LuaGM1vPZ3ULYUMbdOdrM/oO9k75IQPsx zELlXa2vLvy18nZ2LZK36mTv1AfVto03qbsVzhsAXRQwDSsBuDa0Pr/bXI8ewg1g7zfdX9q7 LffcF+nIrl+QGXFfq19fXfrH7aNZq5g9i/2wvSdu9JAS0AFMWZMalYhFu9Ikdvxi7dkBAJ1Z BbaImaOLG76skAg/fCm0aEcvGzjEsqq1B7DKBAtbosxQxQ5eEs/RwUuZGTt2yQ3Q+thFmAIJ fPACnxOjF0yBG77A59T4JWhABzAgQo1gCCXRCFGMxBgmVrE+iLH9ZD7y3RQFA/3cNjX6XHs5 E7ENIUWMnzMJOZdYjl9kEwYAQuh/8VsBWzHM0cUNYXopk3mPeAiDzoWXWbVjmKXVnDEM2LOX KxcybN0uSxmb+hLvNw1jzloGMB/J2DRqPgH8OaiPAhJQ/Kxpqnc1A70vGbBAjuXbskC2esJQ bLoMXMoCgzZlcZcBtqqUpYxIuebBntw6V+reEQMse//4r2jSLTQ6dHp2ZEvIXA4Dg/B45SKG rSLl6OLybuo7nnfL7EDizY7RauLVT3Fi0hA+xtMu9nWbdeFjIumG72M5FySIlEuoiLCGmDSM FSD5FvrHfBS6Jw4DKuDaGQS0l3MZ1xBSBlyNReRCZJl0xRSQqWmqiboRsMWGHF1s0lUh4Bek W78gLdAkXOSFXZBOveCTMNhzBVZMCLEFiCxlbBJOvH/pJzhsEZxJbDfHm72eimnnaVAmmZqb RsrwVoiVsaXoq65dcddMJO21T7e3pxhdG8+26s7u+A4+g6HRzGkkhvafVIQtjRjmON5c74+6 X7rlNIUb/w8rq/a/2Ckc3T+LSbPZGnwoebTGZuWOvZs3Om/j3YWolMxW6mcUBnD3eO+nRSwl 9rpZZ/ZnrKuxX/Hn7A0fW/UAmRmq6l6hzTv/f8YucZud+zoUo7ngF003RDYZHsOLRktNNioB pyZzEBYMurpH5iGKLV9lKSMQVpgsvbhx5wiLzxsVGh16c91syDuOV8CgrXxkIoatYOXoYhE2 8R1H2DI7FmFzY7SOsAqKKIQ1HxMIi3zdIaz5mEJY/30UYY0EhbC4imiEQCFspABBWOgfqJr0 3ROHARVw7QwCpmByJuMaQsqAq7GIXIgsEFbvQ/QViMyN0DCbZkhdLMLW0+K5RyMsuhRe5oVD 2MQLFmGtvTyEbZiNMrQylhwS75cIu0IPPWRUgCKgWb/NA5982pk1vWjSaa+/9ClaeqEojamt XKG0Pp2PWgc0JCmfFthuGhYz74sV75lfyTDhzD4pWprGFZ/O3vjRjDRiQ+tYtrxe+iw0K/Sq 0UmjS5pv5pkZMiu2qB4OAx/wlMyswTwya5iNPLQydnJx8WzInFwsNWonFzc8Tm0atgazyKxh dtOQulgyS3xHyazQjiWz3Bitk5kaqAwBrTQSLOHMSAQ4i0U8mKBKHKIZiQjRYhlPL06LQ6yl kAY1IxSBWizjEYdS5GlYCwVcm4lYDApqUhkbP9t1fqtLUqyIC9hmRwJul0tSrEjLGG9nInIh soQ2lQH6Nloqo6p2G2YnDK2Mw7ZuVA2c8OU+iWJamVm73rc0m8NpYDBaWSKjxux+YbSxQJH4 f9KKXwxMflvLzd5sdL397Cu5zCTaGy913JnZwuvjjfl+XCu0wBtXHTVs30JbGqhW3xXdpo52 KQssRuthZEczmwAYbUTa1VvZ0vtjlnb/HU27pVZV3m03Bc2lMDAY1sfImDE7AWhlXOJNvUc3 sJYagsybHabVzKsf2FQ9jf0cnxVBFdicaz8n5kUiDdjEiBUhZkYoJRHfUPU0MxXrkyO2p/zy XborgJBwzQ0SbvUu3RfACIG/sYxcyiyT7SDmiYoCUmZvAKmLTbWqE1dyxmKGRPKLfGVe2BmS 1As+84K9vEqbhtkvQCtj827i/XKGBCZDHo83lzbr7k3RqV1nwVf7sKmRKZ3NWEnMfvIEsvNx VtAKResmS8/q5/kK5uwkXRZUqYIq202XhMtvYDCv6qZl6lxpZWyGXnifm6ELjUKC3hAx9wwG e1lFNy1T60rqYtNz4juensvs2OycG6P17Kwe8aIjB8ZWhBwZU2pcmgYRemwc6SEGx1aKHh0z qiIyUlLU+HimCB8gQx/ihTm4gGt7EEALc2gZcDcWYQpzOjlWwq1IhaH0+s3CVMOSuticrc+7 3JSzey55F7kj6tbcu4k7fPIGe9ERSFQsmTJZWhmbvBPvf4fkHRWM+H1RY7Q1Rv2E3TWPu+OD ETALFGaf0PEQNgTt55PmOz/8h5URPFWfFsKurpohDqHZbfbZx2P/+HjZ+YO6dLxgjuC9/wNw ho7YG+/9kjXoGt/CJjR6A69YaQJPG2AwOhiKuoaZGl9aGUsbi2s4lzYKjQJtbLjrXfoAe+Fk KCpgTIkvqYuljcR3nDbK7FjayI3ROm2o3MTRBojQtEGocbQBIgxtBD0UbYAUQxu0qgj0ONqI FeG0AX1ITMejAq7tQQCfjidlwN1YhJuOb6Q+iDaPNpgyYFIXSxvtuHg0ZtIGXkxR5I6jjcQd njbAXiZtMPXAtDI2VSbe/6608Sucxnm8FML6EAo29sYdZpI+2q6t0cPv9P3gd/28iaYoDmbz Dp7CTwut+jF0cWgdP1Xg6Zmtqnu5WbPKgwMYzAQHprKSVsaCw+JyzAWHQqMADhtuYJcJwF4e ODCFlaQuFhwS33FwKLNjwSE3RuvgIAc/eFb/DNOUriOAiAeHmYzPirgaBw4gEsBhJuST5xAP w9ekNDiAVACHmZDPsaQqz2xDmCFKZGwmHuJxfxIlG0joQwIcUAHX9iCAgwMpA+7GIhw41AKW cTLAQXLFl5QuFhyEXDwaM8EB3c1b5o4Dh8QdHhzAXh44SK4Kk1TGZrfE+/8D0xSmRi+c7GHW Gm5vd9dzKDDKo83A5hNzzgkcPqOPjrGap2WNwMquY62SPqfoxEiry6VpCzii0KrliMQqzxFg MI8jJFcHSCpjOWJxdeZyRKFR4IgN97NLDGAviyMkVwZI6WI5IvEd54gyO5YjcmO0zhEq67hh MTYBASL0BAShxnEEiDATEEEPNQEBUswEBK0qQjgh6AmIWBE+AQF9SHAEKuDaHgRwjiBlwN1Y hOEIOU4h2TJrg5IpByR1cRwhJ7F4NNIcgc47lHlhSxRSL1h8sPbyShQkUxtIK+OSWur9Eh/M RolwvhiU2b8jT7qye5GBGnRaDnzg0KHHqxM+BVtRZcKAFCZcLd8IckplQmEspWirQWy6Emyi swbzKhMkUzxIK+NS9dL7zFRdatSk6i0Rs89eay+rMkEylYOkLi5Vp76jqbrQDqTq7Bitp+q6 9gNRbMgPIvSQn1DjUjWIMEP+oIca8oMUM+SnVXlKqsNsCzLkjxWhQ37bh3hlAi5g2x4JoJUJ tIxxdybCVCbIvoNtNRn7LSVTTUjqYlO1funNplTNVSaUuWOH/Kk7fM4Ge3kbLyVTVkgrY3N2 4v1vm7PXihKuWrIqwQ/308qE+OjSaVaUYI6j/ezcnNcKYAn8tMD2QzXOAovUI+Ant9K1CKXu TV3VTCvu8XwBBvO2BHZM5SOtjOWLxVWbyxeFRoEvNtznLleDvawdgR1T+UjqYvki8R3nizI7 li9yY7TKF3IcOb6wIiRfUGosX1gRmi8iPQRfWCmaLxhVHu1Gji9minC+gD6s0fMccAHX9iCA nudAy4C7sQhznoPs2pCEFYlQ73diCh8pVSxddN3iwZhJF/iMQIk3Di4Sb3i4AHNh3EkFkql6 JHWxGTDx/fdCC1eBAD+i6gO/tJBziLrDkA/em7WygylzJr8stLKR1TRtuixc7gN7YWxNXRZM ISGpi83dC99zc3eZTUjdG8LlnsVgzg+zqWgxVYSUKjZxJ57jibvIjM3buQFaz9vqKS+YvA0i dN4m1Li8DSJM3g56qLwNUkzeplVFyCSYvB0rwvM2dCExL4AKuLYHAXxegJQBd2MRbl5Aiuy8 zZQQUqrYvC3bsryNFgIUeePyduINn7fBXF7eZuoHSV1s3k58/32nBMCmPth7Ze3/LhwC7pN5 uvYfXpW5svg/Ltb+ww6CzExeFGyp18WGTReKy4RgLy+TM5V9pC42ky98z83kZTYhk28Il3s6 g7msTM6U9VGq2EyeeI5n8iIzNpPnBmg9k6vnPpfJQYTO5IQal8lBhMnkQQ+VyUGKyeS0qoih uEweK8IzOXQhkclRAdf2IIBnclIG3I1FuEwuRv3unzANTr6BlKnqo5Wx2bwV80fL4nCeDk3a ZWbt4TxLszlpGwxG07Bk1Jj6PUYbm7oT/89/OM9v8rI2bEeAGY/30ej9GlK3mc9P1wCwjH1i lNUt3Mx2XHF1Asaz+xBN/i1s8dvpPNi81mdlH3SDQ7mlYR/TC9Dy40Hvs3gTdZL5fIyIBgBN z1iwawyFgWpb9SexEigebsBiNEVP3k5MwSGjjQWc5VMoE3BKrQLibHgGubQFBsOcPRkzpuaQ VsZiTuI9jjmFhizo5IZpHXRUWuRAB0Ro0CHUONABEQZ0gh4KdECKAR1aVYSYHOjEinDQgU70 RYV9UnZISLjWBwlXUxgJuXbRQuByLCOXMkvaUZEQmacj9VzpIaWLZZ16nD0ld/ELCxXr4GUL RVYn/WRPreagDtjLKzXsuVJDUhmbghPvv7954xP/HBdMnR6e4jL8WHuZiRjh9k4cyXmZSWHj m1rocwTYrjuDobaa2hVD+Gum+y/1lml7WHb0MrYbxU2HR/TFp4VtbsepartN94XL92Awr/Cy 5wovSWXcWyySZ0neWyxKjcJbLLaEzOUfMJhVedlzlZeULpZXEt/Rs5IL7VhcyY3ROq6Ioeo7 GldAhMYVQo3DFRBhcCXooXAFpBhcoVV5VDRSJK7EinBcgT4k5mVQAdf2IIDPy5Ay4G4swszL tGNjXuGcs9myZyovSV0cqbRTv8y6Zmo8rK+IaKMlQi1lHkxTJeSaByy1WHt5+yt7ptiSVsZR y0r8Cqklxw+CWlJHcqilsPGWWtiuO4MhQy2poVJq2b++tOgCrwfZ2QqSM/vdqmGLXkD64gFq GxiLJoZmjKVbOn9rXLwlxrDbed1yd8coq2HYMq2mbpC99jB6eUt4V4uZXoMuRVGx9EJrpH6R R+owi4rWYN522oGpoaWVcai4vAoyUbHUKKDilue3zf3WYNZ+2oEpoiV1caiY+o6iYqEdQMXs GK2jokIQDhVBhEZFQo1DRRBhUDHooVARpBhUpFV5Su9YVIwVoaho+9DPWyUTW7iAbXskgO6n pWWMuzMRZj9tqzq1zjzQa2CqaEldLCoOzeLZiKMiWjlb5oFDxcQDHhXBXh4qDkztLK2MTYZp /BhU/ODPwggrdKvgMyjuuerc7pgeAR/1B/3hHHyIt5clhTX7W70QdbszC16Ht56izIogvfPm xNCpq6fptnHEuT0ZBv3OytQTnEQKDY21yTeJIZ5EwGAmiTAFwbQyHArU15q1a/1HlD4KDfXS 9MfCkJ5pr8cRkOeHr89tVG+G6Tc9hxw+gME85GGqj0ldLPIkvqOreYV2LPLkxmgVeXSCFOEM sbUjRKwIeYQIpcYijxWhjxCJ9BBHiFgp+ggRRlVEmyI6imzlCJGZIvQIEduHBPKgAq7tQQBH HlIG3I1FOORRg7Ha0Wwrq64nbhamAJnUxSKPnBYPYRx50KLjMg8c8iQe8MgD9uwVzYWPKTum lbF5O41fAfK8jihGf/IavmyqiqAc2JY29cipY/OCGfJtr66kqacrmjQHxfXMocAqnF/2S3Db Vz1jqHBalFuFJu1y6m//IZ4VC3SIzIs97j5q+aMuCpsd6Xpel5vWvLQ+dfnex+0BznG5vrkP J9aHgrYESbF1R91Fr32T7fX1T7p58RqkQ15YgLTnydiKtf2Djc+X6TX1oxFxCOBom6JJr0JP hto8vRNPeNQEg5afuGcMU7FOKyMI0LxLdvmMyXyXbKlReJfslseyS+lgEFI6FzGmap3UxRJg 4js+6VVmxxJgbozWCbAb/VQMRoAgQhMgocYRIIgwBBj0UAQIUgwB0qo8fI9hvhEhwFgRToDQ hyYCoQvjEKECru1BQOufy7hGkTLgbiwiFyJLAqzrMJ/JHLMwMmXrpC6WAIWcPRuXlVz4RFeR VVvJtbSaQ31gL+8AmpGpWaeVsZkt8b54TTTDD2pNNHEka020rPFuTZTrujMYgjXRxNDvUMl1 77fpabzma+BzSvlPvPhqRQWzsDDwO2BIaQYF1/6A4ofFCw9NY9XnY7xt0TT+g9tQGY44Djg3 24W4czsqH7zQ8XBtzl+GLsOJryxIOmUM3UqQeOIDg3lHBY1MET+tjF3mTK58fHKx1NBQdWvP sXPbsUuoGx73Dg/AYNY5RCOzPYDUxdJk4jtOk2V2LE3mxmidJpu26gZyCdWKkEuolBpHkyBC L6FGeoglVCtFL6EyqjzIGylqCXWmCF9ChT6s0XOIcAHX9iCAnkNEy4C7sQhzDlGjzywSYQaO 2kszMvsCSF0cTTZTPXvuLmkSnUMss2ppcmk1gyatvTChQIaM2RdAK+MSeur9l5pDRFJtofuN bPT9lLr/B56nPLEn9epZUqK4YZ5yuHh14UGJPNG5O2Wj5gxSCRAcoy22hoHhIMh8EvwyUVbs Ml94m528SeLmq8tAwY+z1367i3GID9u6V1+BSdK16VqUXUtvqFH9aVhpH8uu1mCY6yOfZsxu DloZt/80fRyg7FpsaDRBTgyhm1tLDZm9rVuSi4URa8/PKpK9wewUIXVx7Jr6jq6FF9oBds2O 0Tq7KtIRDLuCCM2uhBrHriDCsGvQQ7ErSDHsSquKhg2CYddYEcqutg/xmVBcwLY9EkBnQmkZ 4+5MhJkJbbrWvCXI7wgl7xZmqwitjKXXrtMlNyi9SpRey8w6fF2YzcFXMBjtFySjxuwQYbSx CTnx/7es+1tMbh1ubFb3K60xeVqiCsumAITwzfk7wu/dhKI7B+zGnJa5WFDFGaAwplIN9MZ2 0zXhshxYjDZEUtfExBTqM9q4RcvkVspbtCy2CquWW6Lm8h5YDDskyaAxtfq0MjZbJ96jM02l hmy6zg3TarrWD3dBv0XTipDpmlJj07UVodN1pIdI11aKTteMqoiUBP0WzZkiPF1DJ/p9mzKp XSMkXOuDhNu2GQm5dtFC4HIsI5cyy5yti1z6vJL9iSnZJ3WxGVu2y9SzqF+LX6OJZe8iD2z9 WuoBn7zBXl7J/sSU7NPK2NSdxq9wJbPUD1jITP344GeyPp/b5DTqiVW24042pBdMFbSnhn7P LQ4wxbHzZ4weHu/9XEmAn5iezhx9e+Gpx1fTzF41EialVk98w0mr0JFemvmKxBEetMBg3jaE idmGQCtjMSu5tvDZllJDY9WuPeZwhis0ZBFuw/PUJWQwmLX1YGK2HpC6WIBLfMcBrsyO5bfc GK3zmz4NNC4Ykwm+GYm47GyVTBAlDt6MxKzobJVeloViMkE3IzQrOVslHFxRBM3zgrM1CFrW m8kE26Dr8B0HuIBrdhBAdxzQMuBtLMLsOGhUCDqZSWzMjgNSF0ts+nzFJo/Y0NqzMg8csSUe 8MQG9jKJjdlxQCtjE2cavz/YJsuIQGBq5eZ4s9dLlC1HHKcFrh6r4TzAUeiHBY6lHzxvgL1M 3mBq0WllLG8srr7caZ1CoxYJNtyw7lEPBvOQgKlFJ3WxSJD4jiNBmR2LBLkxWkeCZvLzDNiU DojQUzqEGkcFIMJM6QQ91JQOSDFTOrQqF3qQIqd0YkX4lA70IcEGqIBrexDA2YCUAXdjEYYN xCRDNmUOthM1U4xOKuPgQEx9NeDrL+gJ6mVG7fLLwmgGDlhzeYeKipqpRae1cWkt8b4EB+JD 0+1ryf3usvjV5Ppbn/wkwc0RjjK6Nu8k74h3kieVPmiOLwxG24qqndJgMKUzxPpNqSOj1KeI b7imbIq09vIO5BQ1U39Ma+NqOJa3Yd4R4qU2TZXFhoDZZ7Y1l3Ucp6iZCmFSGZfjE9/RIotC M5Dic0O0nuGVA25MimV4EKEzPKHGZXgQYTJ80ENleJBiMjytKoIrP9+CZPhYEZrhbRf6JZmk PhgXsG2PBNDTOGkZ4+5MhDmNUwxCDX3zdpupm5fJ8JQyNsPr8+eo0X/Hr9eUOWBH/4kDfLYH c3kbz0TN1ArT2thsn4Tvj5HtJ7v9fVFLGQ5vnG9/D68KWZmo0F+iN1idGGP1vJnt3A+vVDuz PQnpY2mPZwWwl7dVSdRMvSetjWWF+RWZywqFNoEV8m9hl3fBXNZmIlEzFZmkMpYVlr7jrFBm xrJCZohWWUFnFoYVrAjJCpQaywpWhGaFSA/BClaKZgVGVURpDCvMFOGsAF2I7yXCBVzbgwC6 l4iWAXdjEWYvkZCDfgpmsgJTj0kqY1lBKWlzWcH830RAQ5EnQk+jjKknPDSAuVxoYAo0aW1s QkvieDI0TMkbT+2RMjmvJjXbNNybyY8PcxIwe1aOh7A5ZbZZZYo2zxx3ZjHis9tivDcvVGOO aTwxknLSd1y8iGD22sO+mKxd5ThEFHo2mWPoUs94igCDmRQhmHpRWhtLEfNLNJciCm0CReTf 0y4vgLk8ihBMqSipjKWIpe84RZSZsRSRGaJ1ihhqvXhDUgSI0BRBqHEUASIMRQQ9FEWAFEMR tCrPb0aKpIhYEU4R0IX4mgIu4NoeBNA1BVoG3I1FuDWFRlaZr/8QgqkQpXSxDKHPYRs3QgRa d1DkiWOIxBMeIoy5vKoDIZhCUVIZm/jSMG5lCCztFbllSytTt3BM+RUqFcyO4dn5f54xgCqS 8wGjpL5sb7wD1wHNB1c+8SaaYDmYvSNnDoLrm8Y8b+j60pTCzuzLMOlHWeoLjyHGXl5xgxBM NSWpjIWQxdWUSyFlNgFCNjwUXF4x5rIqG4Rgqh0pXSyDJK7jEFJkxjJIboTWIUSlLDfAxiAE RGgIIdQ4CAERBkKCHgpCQIqBEFpVhH9+EgmBkFgRDiGmCwkGwT53Lfef4wRCiYCrkQTHH6Lx mZpbHBRMvSOli+UPfapPv5E/0FNSijxx/JF4wvOHMZdZ5iCYskdSGZvj0jB+gTkMKErUB8WZ ZY/b2911yOx384M6zB/NGRhwuspD+p75UPJIr2JMGSsMRcFrx74SYlPPu5xm7GUWIwim5JBU xiblhfO5SbnMJiTlDfFyz1ljLq8WQTD1hpQuNiknruNJuciMTcq5EVpPyurJ7carWFIGETop E2pcUgYRJikHPVRSBikmKdOqPA61YU4GScqxIjwpmy4kShGwz13L/ed4IQIlAq5GEkwZwjjq cyDC8Lmn2LVhCg1JZWxarpvstIzOBpR54OoQEg/YdAz2opEZHT+m7JDWxibkNID/zysRzCFZ sLcBHcefFtOprgY529bFckGpQag8SA2yYAAGo8EufQ0yZYq0NhYNFtdgJhqUGgU22HDb2sc9 2AujXzpiTKEiqYylg8R5lA4K7Vg8yA3SOh6oHMLhAYjQeECocXgAIgweBD0UHoAUgwe0Kg9m gsWDWBGKB9CHfkzeJ4N2XMC2PQi4IXmfDNtpGeNuLCKXIgtG6Ds9qs9bOGiYSkVKF0cIw1gN 5DbFGBC44oMiR+y4PXGE5QSwlrls0DD1iqQyLqOlQfxylQePl8KfzrQzVpBSAyOyVmYgoyMx 4zIDf5yqsbxSa6APj5rVASDZ+qRY9kM1CyX3gkiUGQq9GEQ19okXLDCAtczp/YYpVSSVcbiw uBgzaaHQpIGFDbeuffaDtbzJ/YapU6R0caSQeI6CQpkV4ITc+KxigkoqddhruHaMAUiQxxgQ SiwjgAR9jEHQQhxjAEL0MQa0ooBmdbRXceUYg1gNeowBdNzKjL37XHo4QPiCkrB5T4YRMoJp qBvuc9yI7SGQoCEuWEnXFpyIjDkGwTwQoimPsuVESFvuzpIBwdcxMLa0XA+xEjImL0QLKWNu wP8FwFMRgg0KZW5kc3RyZWFtDQplbmRvYmoNCjIwNCAwIG9iag0KPDwvVHlwZS9QYWdlL1Bh cmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250PDwvRjEgNyAwIFIvRjIgMTAgMCBSL0YzIDEy IDAgUi9GNCAxNCAwIFIvRjEzIDU4IDAgUi9GMTAgMzkgMCBSL0YxMiA1MiAwIFI+Pi9FeHRH U3RhdGU8PC9HUzYgNiAwIFIvR1M5IDkgMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VC L0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNTk1LjMyIDg0Mi4wNF0gL0NvbnRl bnRzIDIwNSAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0Rldmlj ZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDcxPj4NCmVuZG9iag0KMjA1IDAgb2JqDQo8 PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDYwODY+Pg0Kc3RyZWFtDQp4nN1dW3PcNpZ+ d5X/A9+2eyqiiCuJrVSq4ownk631bjZWZR+SeWi3WlZX2mpFaiXjf784B7yABEBSaoCeWj+0 W83LOTgADj6cGy6/fTjtbzbbU/b115ffnk6b7e3uOvvl8up4/4/Lq8/3u8sfNx/3d5vT/nh3 +f7pwwl++vtuc717+Oab7M1fv8t+f/2qyAv4V1UlyYpMKJEzmlWc5gXPHnavX/3vX7K716/e XL1+dfk3kqns6ub1K7izyEgmSV7q20qlclllV5/0Pd+/l9nHR/3a7CP+peq/vn/96pdVtv5H dvUfr1+91W/7n9evsrfvvssuA414czydjp/C7fjb8Xh6aTvooB20KnNRZqTKK47NQO5rpt9e vf+hz/eZ1FhR5pIEqD1HRM/qZ1bJXCjdV5o4z4igOakyUgDfHcNz7/MPh/ZRlQvpl+MFW2VX 8Pk+I+sLsSrWasXwVwF/UvxzKOwzWOJC5CUPsXQRl1Q1QopgI38u1tUqL6CpOV2XK4G//rqC 7wV8p/BRxGRLUJpXdBEJCCqCpDI9Y5j+cfvLqih/XUcly7Tgq1ALBxPKUKOK5iVrqKlcSd9U mHGXn6P2wXFBcOKI4cUkWUFzGZx7XiEICTRqUiIvQO6uEGbcFeiW+sGZDKGm0/T0msLhOa5V cqU1ay5oRhnS7Shml+/vN3egDt9998Nfs+LyPzd3H7PV7u7i+zfrTufNepfhnhlh91Y33QCq n9ZvoW4L3uUwi7Uuo6scPlB/4Tdqvin9Zdi95zFECgmPBRgKi5RQgs8Zqkx3n15+pmRKAjKd 97JwGyhINSjU/fX6olxdgwQPuw/rC7k6wvd/wsfuMfsE/2/WpFh9hm8ZiPsPvPYAn/sbLfXu yp+38ILdaU3I6ra7C69t7oAQvlxfZ851TYmvNDdDZqThBe/BZzY1V3DpumZCX9vvruEBvO9x zbQYgd4pc4ZEJHlyBYvPUJ7I0Oa0yaOT5UbV+8mGhyJnWk2VDdmS5UQDpqmhSANDcd7Lgm3g Em71D8XsQqtpolcV0NM//uSI71zSpQaMz5/IQisA/UBNlcucTwuPBYQ3613BBjRLvb8F/+XI 60xqTN8apBaQV4ea3+i/8AFZ5Epj7rIsYGkqcl6ZD2Dh5i8zrtfq21w36rt3A6HwhvALYNZx 2VyvZ13vDhhYRWm/oSg8twjR3KLHHqW8f4coBCKikZc0HWJuMR3Sv0FDsAEfz76jkafpdbxk dbotsPAdjUC6O6Atg5uaBo/fZPi17+HDe4YohIluoSYEPoMTjU+AkLFXTWIQVnZ6di78cDdS Z7HSoA+HlWngYejVw31CjGICd4y+a3KZdOUYFXGcbgE27DL4vNFbvSd87SHbdnABccBHfEOm 0QX+uH9c89XpCE89wAaweyGgihvcJA6BxHVwSX+ZhJjgOSMeCY3ChxfSklXOxLOGUrPgGoL1 gjsxlOQEbhh91yRsGDA/FzG8kKgBDM8QWKPgDT2j4CfkVU5AhbFXTSIFh/UwSHgZnRojzBVR Hx5YKxUZWfjx8si6H3i8Wfbx8tiq3z4fXPTxjrE1P/wKC4ORkRXfekFgOTf9g5e67hnc4JXi xOVudRoVcpC8dcNYL+DlsV7oCIAM+zSseyZ6Cu8Y66kxMtY9E72Jd4R70ybCh0TaWwIdPnkD zqSBFqkCWuQ5JnPf/DbmJCrGp7ePIxWBIy076uOnYFovW+y8QUTGagsvh49zfAcOWcWNy2VI 1zUsnEWGULOxHZJ5pxHIe2jij5HpCYb4bEjPtU+fSSbcrA3ArDv4uIYP/POkMdwRvjx8zn58 ON6gUeiwJhrjISj7Cf/7XYO0J/iyf1gLc+UTWp707/jC02PcZjCqcv3c1CDwzQUSspVGmZ6y ojmnNktXLfLdnTdEPTRLPRcqH9F3788bnh5a9bxzaZ03Qn2UKtyRelrVjFDR2PWOMMrqHUNk LggnsJa6XETvRcJ5LjyE9HxbX1Rm97M/6NGjVj9phbr7HfY/uLHS000Prp2Za2ZbBBup6BxS vaJTH4vIG24XH9o92pXmE/8yOz3Yst1jb+F+0bC5NfvJyGyyosgrtUSXMa14OPFQqhsZnyCp cuJrGoh3c9rDf2ag7Nx98bm0hYaNbBGx6kVQ+cbZ5jFDb8LucYtDa/8BzQzRm8p1vxIfA/8e n5LGcTPGqncJC7mmnhXK4l9PJGhevRGxl9Wvi6KsvjlvAXdpKdwYDGnFH1SKehu1etuaDjsj ImntTnujSGub03CGNY6tDzjbt6jtnhptZ6xfzuvVyvV2n6uXIYSGDJuGDna0wuTxKVKZs3KB XqO0Ql0+JKQXFW5Wf+wAR8qx2ZA0V057QcImgoHEp1gWuWBuw1nnuYXFE9XgLjpxVeTUGVAp uteEeTiEApPtK2i3aXxoJdCTz5qSB0SGf0bvHV6oXHr4nqO1Q17cWFqbKxyVy6jtIbF0etuh 9NajsyNq7+jwXqlcd9sCEqMFyaXwUDKxHBDlcd1unoYBHbvH+PwIkZPSw0+NkuMr6xJR+QKS lvonX5+acXS6XZfWtghH41BFfV7L1mVW1pgBxx/KxvKw4U1m23Stn7k3sTaw+7uDZ04ZLAf3 LTHoUHwa/Hq8vulj56AzsT6yptg9t/8D/t6c4Hex+s10kOv122+yem+XYJ/ZTHlW5oL7ltvj 0yn69NRAXDgkE5g1SKERjRxr3E10kqTMiSvPFI2jhVeKH2qXr43ZUBsZtXvbOpfvWjfwp+i8 VSViOIe5+JYcDZ+48lD6dQWt7Rau9zmE5OFXE8eAS5cnKvhsw43RUw5D8WGrvpP7RkB83cu5 vzstSyuMqC5gwK9R21GHI/N+LftaVf8vVtvDEyyS1/UC+fP+ca9fiIN6f9if9Gjt1OMPrXFy YBX7ZBTrHn+5a9S+oWO+nh7XYpTfRHpWb+aKnvFhi7Z75Pq0v9lj1IZeEr4aRJTut7ctiKpl 00Pjj9nJhHXAYgNNwjvNmhLd6keZwK2E05gEZtAKzaAOJd/qC6psjxEtd/G3iJoBHx/xW1xW kBfkUnIV2hU0VSszaeKv4usyRiuwa7i8RNdljBXgwF5AvoxRNHg6lHpeo1FkGJiyWTsIncAp DAc/ekO2tod9fVeOf/+wrqzoq/bOROqIgB9kWhth0/7cPGYPaAhAILED+CptkL09wteH9g36 vmp1OnyG7505wW58E55WYxUQmfnpN3iTuef00Fpg7pqbtiYQ7t6sG7f6+c3jbSu0WvuDxqxA M27gx27daYPc8Cdgj/c4ayl1yvbYLnGtajWNvTMLTLupxSWHNY8n6jSwmPc6DVn51G4uDrvT LvoMJYxAdIhDfI4ZJhQPHskMIzQGrJaynjvEkvWzSyloP8dvbuzt2TsM9JQs0GJCNcD0tfhs n8BvDQLEKfznwairj52aPxr4WNW2zsaYgFek35jQ5Olc8MauA+r9Q6soUhl3mFA5IaNSsrTS abM3ium6uWjhX1sJ/4xCNThyGmJLL8JurYB36zLdhNBTkPWUj90M73r9b9Aznc72r27RR7Pm U3m4jT9tjCvTpRTGihciFViEiIWCeJiJv/FlHPw1CwiY6h2vhv0uJd/GtwYqbQjGEKTon22U sunvhiHWZAx94Rz9aDY3GIjz1Abi1ECynvp18L4JVPnUzfg243BzQntip6/MLJqzRU8S6tLM blmCe94SsuH2jw4K4hTfWQBroMlwjTChOUYkfnnGH5AaRkviacEccBTK4YkFjoSAndVC4GhI LN1oGVBCDzznaNV9m1+dGQLrNexyCE5boIVgQhYeQmdjoXaqlNauMxtE+I3ZxFS91fnY5THv jX5i7eYp+nad5LRcQuyMMUiWcSmhMFCgT53r5hQ/lE4KSFBaoqVaT1W+ljpuAhwitYsA9Wts 374e6nphXaDNnCgAzS6lp2ZxTRDaBsZLukjreAEpCi6lGxNM3gaLqjY9PzPre2dFhdm82yKi l/ENqAIsTT4OrTiT1uGabNHgHGIN7Q1EdEpCI3IfpSbpMrqLswRnpksv/rJUKMzgdSj51oSe GawXHVIjSbhfJtOltChyxjy8RvfC0oKBud6lVE+tqptZuzrPQ/RCEgZRAq1dwtq8Zej6CZtJ n7sDib2cKGy7K4L4XgIlcYlOP9gZRBApD6Vvr9c1UNrjIK8Ny5vDAbuy1mY1UOos/tvbdnrs t8Yk3RjJTe8lUniQAMw8wxIIP+6MncgCj30bz2hRGrRz1Y/ddyDx07oGDLhfPbb71eiKj+ol TwpPC8+TJSl8pBgEVTmk9E7qDTlrJ+VtVwXxoLHb5Y0VK8CL61KCrhs6q5zNx/qitqz5dyCd YoMFfXeDkwT3I4foay7ToIJ6+ieBAhK4w5/sHO9GP1RlItJUpwSMw8/kKVSuIBJPABmebRAJ lQSIkDrLq3Kgz53c2fO8KKHcWZdwmuRZl86P0MCH483+cN7e3KUoie5kD8XY+bN6Xyyph443 gVZiTRNRJ8/qxegG8/j0tZ8gi0/0kmZl6pxZKAwhpjvfOw2S5rRzKUFlLps06xId5FvG37JQ CPJw6SaINNUPVB5KTQKtXCR/VkEFU5eJ+HtBQfJyRn+Semv/xZJoFURIunw6SbTKjP+RJFrj GJGrbYIcWgyWXaDboAAJVx5KyXJoKSIzl+AiObRVLsgiYtUrYcF8Yl0qh1b3K/UxED+HllAw HU8K1buixaiJMuLp4lxgFuYini6HWLI9vEvJFwbE2jAg0oY7j/qLYq8IsszZElIhUkFtL5fS mOMrvtVPQhawzUReSFlihVDzrTP6ToWTmmCN2iZz31hgOo+cvjU2+1UFARST7CfIQSUQTzFJ eCT3Kv4SJWHfPMESuJc5Mynev64T+B4JqtUpuQz8NVbS2e4x26cBUazCcLNJ3oLBK7GXIMrA ZzjJz6aTCChDIyUDNsHjoH9zXU9eY3x0T5jmn8+QZ+eiT7WygMd7jAWjmczE24Nbx9Slih/9 WcJuYoqb+EsJK8A/O0l4QW0Exg4qp1hKrI1ISSCHcVIuHcDYPEI6VRce0QTLqia8tvEmWHlX dqhtMy+3KXyBFc3LLzG8aKX7Uk0T/qAHVmcu3yBa+A42zA/Gm9rp0p9Rtk0RYP1b95gJ3cBu 2Hw0XsEEdRjYjObELwBBSK7IF+hATjhUYbIJ+1OF5qSoDKM/rQTdRNqd6gd6xveXh5dGVzAc rWUOh6nsEKRSiDsdgv2y2qCgMJY/7KWvKwdEd/opKL3j6bIWBMTPM0RaLsnz5i+hPlIczU4O qRlGAxqjduSY0UBrtWqp8FiHWLrJ71AaFu8nSXQPFCUA/OKQt4O72hR8J4tJWelMRk12xtck SoETD6+OuWR9oek7BY9cU0N0B73CeeMwGF8ZSKw2aVMatWdE10V8Fvk5RXWy1o5fp6nC2DGV Vtok+QSGbqkQKky1YJliAxAnNYebhfKhOJOIHKfY6fbjdc0D6Olt9Hg1LvF0gEl24uNJOIKC z+gWN4nPpLClWSuYqiBYMszP8xIEL/w1OKIr7wJK+0zynmDVYIBdJwn3860SxLdWZJqJYI2q rl5IGser4HAy5CR/xooSHDi1FTw+ImUFh5qaNn/zEWniUrBwKmkPJqdEpA6xdFrGoTTEgNQT Lf7CTKfRoNUL0RaFsNInd/tTl8/Zhb/u/onFsw9PTdivBQMhuaIzxluplnZ5D3hdlyQ9KBVR WSHyxyZgHP/CDPUattw10jAzIvqqVEDUiNs/pgGHnSnzccjaltbmvETjpETVMQxZbqKLm1BU O7w4ulkYDx1zGUlggFZwLIxDyPYIbkxwm4SMbf2t3hpFNztXECjlcjI8qkx0kd87rAYjBtVg 7KILja0cqy7wcNGFVEVuatee2yqI4xkmMdZ6JTYLZQGBEi4LoaTCXtg9FtBxM/GiJ48pyGxd YLxzQRE7OZR8hxq8QIsm0kgSw/+H7DqaP0HCcemjbpUpQkG93yEr1oby77vD4RjfaFv6+XG2 bdv28OMEwFchsHSY6Ne9WybJTI9mKTy8xE8yExJKa7iU5iaZSXdK1fllykovaxT9i8twdT6O +E4gqPtLPSKYg9hjlAEPZBQwjkk0YxkFPElGgUs4TUaBSyd1RoFLMU1GgUvnv+8NHDg2CQEI vg5xqVMIwiXp+48SBn7vYP/pqT8rN6IOX49/npiA3IhJMXgndIyCcsHcCEaG9vYFciNcosvk Rrh0U+VGuJRgukkbwW3Om2relIgiZx7SCU4Uo2BUnuzGL5sOUSB4cnj0pP1a6RC9Jb+XEhE9 YIajVdPhD6nHT7ygSkGq7QKjg8ExET5K6Q4vQ5eLS3CJxAuOB7YsIVaNwInwiXWxw8sI1Oxx GUhweBlHW8aUUL3LZeISY1RVMLqXsVg7xJLt+11KwcSLCFbr2OsRlMognjZYRcB23ZbPCmyF jbTxPcaPcpIQELlAD0IRhcrX+m1X7Qx744++yX8YVTk0tfSLsojIm+ZRQ8pSVg2u0Dvuii46 LuQKj/JxKXmqUsUvpttM8qoMhtzNL43XLzPbnLrQ+IlqHxKMgq7guWUNbwoocW/9pATH3SEY cVs+ZymJUcRibCnR/y8WjucQS7eUOJTGc/jovBy+Zk05tircHjhOTaKNFf/UO3kgA4eTSJ/o AacFl+UScofTgmGpsSh96dQOBtUAmafxCc7t4ATqriwhZ46w1KVkHZvwmN213ndzdJpT2BeD ZY59HTtIydo0FX2r0Mkb/urm9pKdanZLBmUGrNZbPjsvOMjXpRU9ZafHZNfrVm5foW0uQirI Y3bfQgYncbCrHjcAO/9KGasQM1cwj6QTJH0QqFBpU/rSmoNr3Cypp/EmJMAgRkAgGMLS1LpP nj5IBcn72Ru+jK7eGQHxTyXRPABaHbIyB8rEqH01BmWYAm/GQlBmSCwdlHEoBWL5X7A3HsEx UU76kJaq9R8b2niRR0/76AecQ+a171Qg6/yN5lX7+AEVFaRbuH3ir48fDuRNNFZoBYmkFl/+ aOFq5DgR9/yCf7XjPqASpWCexiYwazBIY3MpfZHzPqCTiYeZ+BtW/QBZRsCqhJAOlxIESrgJ n3WhKCKfk+0ZHpjeREyAY5CMyZ9z1setmU7J5jVBQDIsvuIcJtK22mtebJeEF5zzoUX+RQ76 KI0F02l/kmMgwYLpUBrmHs/OiTrT9Gk6KTym+5m0yn3TWEfFr7FRIWJO30/NjCgElJKYq5J5 GpUMTmjNhctM/AwKojf+0kdqDvKOUeF1BHkT3SmqWgh5O8SSjTGX0hB580i+qDQlsygs4nYj RlNMy/PsD2Z+1QHm/TBJf9WkiWX5xdWEFOi/6CkbHGJ3JmU5286rPxpbQqKxW5Gcy7NqyTT7 w+cVk2nuTVRkJcFByAzMT7a8UplumcyL0kMpUN0kcKpEZ8/tY4Oe8XbEbLto4RGovaW4p809 cJRoCkgFtIeg2UqIaS0fVd+B48FXF8FKJcNQ73LcgBE9Up1ARqXb1gQppgxcDi6lCeAlU/hb jLfJ5SVF5qqAGL5JAXtxV4yS4mO4C05HWAp2DWilm7ZDQl7QVRs+o1dT0Q8s0FQI9a+oS2gG ioyeZEQ1Cw4jywJVTDGyeAjgVDlmiZyLU6XtxBnFqVBM3Y9V4xczKaDg2pQE6mVouzFJRzV4 O6Popm0nSO69IlxC2nO4eaHilxZW7m20zsOtZQi2XogzcataBLZCRTfRE2oq2FpKKJXrUnoe bJ0+jnlsQ5hoSDLIBRlGay9XlY+BE9VlooeN1UtQ68DI6DksypOgOFrDITqAk1B/z217gsAk LDrmUnJhK8B7/JrUZgjHJMB8chhKgF0lnuU7KWUvdk18eAChFM4nXQi8DomlQ68OpTB8fW79 FTOZa+ds9CpLPCc97qfq6xvEwOcZuSaw1qZtmHcFQJfc7qugtWN4JD3CvAlsWFnlDa77StNG G70s9+cjjkSDjBAwR4a7aYZ1zl4FIlrnUhRmqOOn7VYHEAj0lsmh+/9gPIMUfCo97R56FnsI QYYDk1ONR6VyUfSUnsd4ZkMQGfBWTvpWEyTtsNLDf4L0oAoAj0upB0PUIl5LSNZhzMNLfPe9 OfF0Ur4+AMKiFCL2oKJ60FYlXhjn6f8AuADeww0KZW5kc3RyZWFtDQplbmRvYmoNCjIwNiAw IG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250PDwvRjEg NyAwIFIvRjIgMTAgMCBSL0Y0IDE0IDAgUi9GMyAxMiAwIFIvRjEzIDU4IDAgUi9GMTcgMTE1 IDAgUi9GNSAxNiAwIFIvRjEwIDM5IDAgUi9GMTEgNDYgMCBSPj4vRXh0R1N0YXRlPDwvR1M2 IDYgMCBSL0dTOSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1h Z2VJXSA+Pi9NZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyAyMDcgMCBS L0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJz L1MvU3RydWN0UGFyZW50cyA3Mj4+DQplbmRvYmoNCjIwNyAwIG9iag0KPDwvRmlsdGVyL0Zs YXRlRGVjb2RlL0xlbmd0aCA3MTI1Pj4NCnN0cmVhbQ0KeJzdPWuT2zaS313l/8BvJ21lOCQB vnZTubK93lyu1onPntqrq2Q/yBrNmIk8Gs/QSfzvD90AwRcapCSATiVVGUsUiG40Gv1CN3D5 7KGubjbbOvj668tndb3Zvt9dBz9eXh3u/3159fl+d/l6c1vdberqcHf59tO7Gh79125zvXv4 5pvg+d9fBB+fPonCCP4rijwOoiAt05AlQcGTMOLBw+7pk//9S3D39Mnzq6dPLv8RB2VwdfP0 CbSMgjjI4jAXzfKyDLMiuPog2nz7NgtuH0W3wS1+K9W3b58++XEVrP8dXP330ycvRW//8/RJ 8PLVi+CSGMTzQ10fPtDj+MfhUJ86jmQwjqTIwzQP4iIsOA4DsVdIv7x6+10f7zOhsSgPs5iA dgyJjppnVmRhWoq5EsB5EKdJGBdBHAHeLcJz25nZQb9ahmlmpuMFWwVX8PdtEK8v0lW0LlcM n6bwNcGvQ2KfgRJP0zDnFEoXbkEVFlAxDvJf0bpYhREMNUzW+SrFpz+t4HMEnxP4E7lEK02S sEgWoUCapCSoQKwYJh5uf1xF+U9rp2CZIHxBjXCwoCS0pEzCnDXQyrDMTEthRiszRvpFOyF4 MiLDySBZlIQZufaMREgzgKFApWEEdB8TYUYrYlrUizMRQkkXXL6939yBmHv14ru/B9HlPzd3 t8Fqd3fx7fP1abJeoJuY8EpL4NUhXs/XF8kqZGqB8lWYniX6R8BLLjWmGXrgFlicCLVWUMBe w1AfDjfVfucYrDALsowCO5Y4ZwJLwyyhgH1/qB2DK3jIyPlzPbaiCBmjgD2D+bsHfYF/9pVg 1+1mna3e4dddID5251h8Ct7s4LeP4pdP8KF6WKcrfPRhzeSHO/hTP7odCBMjiOOZXG8SBLED QcCkODWIAqE/yrEldgUUew+S4Lz1YYCbJ2FCAz5PCpjACaFTkOBePxzWF8XqBhniTFlgAB4L xRQlFPDzVowRnHihoMB9L4aarc6TCSagSWQB6n6MCUNL0wzu2b1Y1PfAt/tquxHCIF95mNVM qJblODjORQcZzcHCbTjAiBsmDmDtvhECcfcRxv8JfhPCTjzcfQAO2N3BYyHmuHtckzQPi5jC FTE8CAH8gKY/oISCBr9uEK3HNYj0bLV5QOGDz7afXaPJkizk+WIzyBIBp6TAqaE6B8pj1DtL jZGzMGMUuDsYInJpHWyEG4hLdLhOnePEhfhNU5Luj8E1mACPW+S/SmAh1sy1cyRSaRGakfir e3A85KTKmWFuJA7MjdisiDPQ+3FusIO+jqK8+OY8u2sMsQyThILofgUI75Ue4OolOlda5OEn jALhp7EzfLaaTJANFhp7nHBgNwJc5UXXxIyjXjTD7Esc6SgsYBqUEYQ3FyN7yUKx1ghw7k09 8UKeU+CkuxCAFAUtvkO19is+xI+o77cb6WhlPmyPOIxKCjuU8bsbQAQtIkTROQp5CrH0paY/ yQvLiD/ATFTX63x1jVy/ewfWH5hfv7s3cKKwIPnQgz3FQpZS4DZbYWBs0aGHSYb/kfXeARU+ a07UXFDdAaFu9Q8bZGGkWXUjjGu0Wncde7QOfgHr2rlVynmGnpR5WF9hEEPg807zcB3U79Gi f1BLzzVCBWjQCakusILlfJD086RTI0GZEQI4RXJJyzkUxpuYHg/KTbxA4ICLbAcch+JPOjFI GfzFgzPISFwkEXBGgC8EXus4kt9fSsOjXL0N7oFjHqQn1vMaXQsnnmM034hqfdCoCqzzxjMU +DzIiFzeXYvbfdWsvAP8c6Pdx3ods67iaWRes4BB6Ckz4Hds9YhLRkxUHaDT2aycvGMwYM/7 Q/PsdqDC0IbYAGkR1/pzS/V2VD3E/CyKDOLpxYi0WyQRYo5/BHMCltVBKl7nRlgGYXYCl9A9 OOHWkOBmeDfMr3eTFQmEhhb0bswQvUliAtyrEFhtIc8GpPFSw4ZtJKH7CHAGFVgHj5taPG8k K+ikrGOAyOW4+dQEu6TcUvL6COMZvr6HTg4N5LY3KTXvtTitfsWnILLqHcq9X7Dnz1Jdan2h hGI7ql+kFFEAfrvTQ+lIuvO2S0xWBxMvxBTJEZMPHe1WGoW+tnSl0McHyma6E6NTU+VrkeQx hP2HqP+iZbKBnI3C2+9Daei5ZmRQxyRq7X5PO/nIT/uB+mhYUdkOhfw2YwYqbYd3PfNHyXdS C19rdvytavVnC04tErUezPPeV/bO9Q8Xjk6aUlR0b4ALRyfKKXDPWgZ6qQNLb4N1HE9OiJQf B70/sAdyX/s04bO0DFPCWPmgxZW2x8SDfyHLyLBstRccwTve23eaHYEJu5YjyrEKRtpya8cy tvp12/ZRXd1UW1yRteDeVlwrJi1XP62gcYfw4RUAkZowgT8/rbWd2keygwjQHRExYqNeumvE 8Hgx6lVlRYd30fE0v7wIY5udf62li/TNH/oCpdUyziVfGqOJakTQ/f5kipFQEzTIfuKMYfrT g4ddyQQFvHGYyF1t3Esz8VhOgPR4pyW0kqNfoV3wbp0RcQfopGMK4dtZZ9p7Tjqo7eueDJds TTjQ/eXbNZSGQq81eAaebTniw10NuGdq/HeqT08rQ7pIVHjOojPNrqp4oRNwka6qeiZdVe2a dtxVKdM6rioInraLLlmFTOaL+Y8sjmBrlKCRc/3NYhYyEtwM/5H7y8rLYh7GY4N3lJWXecnK I6D7ycojgPnOyiPA+snKI4C92f2M6m9b79a48s9VySP4SZyFPF6cxkkahSxfiI+SlEFwkaTx RxUj12l+KOqzJs0vc5/llxQoWGaN3iRYUp9ZfmnJwmQche1k+fnKuyMgL5N3RwD3lXdHgMNU rJ+VGnWfXxJzse4o2B7CCFhRMW9av2gmGougJoBA1J6JBgaU9q66fqmndLSkLMMkXmwOWRRD kgIBzlc6mrC8iny5MQolyMjp74agnENmcZinFGTgKIwPszY+7BqBjINJvRilIRuW5iZcMtrd k1kY/oQhF9MeL7eSeFxA0iM1dpAjMkDjPC5YQoicgCs9XN9pjRnGkwkU3Kc15lFILqoZ5lXm d98vzWNYcwvu+5khegvvEeBMWY28DbsOY0Kn7Y/lNBi12ag66AkbjIqXxFuljNDKt0w5AGY0 3ccjZHHQvMk08XXugq9zg50XR+Axp1kEifLjTTjHTB0LuU2D87CrW1jAzeQ2R9zdBDIpRo07 kMUnlQY2wd2x+5S7POSMopja6dcrShvQ3bWISJaYhTQiafOJ6aVsinYutCi5LNWbx4ymRVk4 WJSpyfeSi4SXsCk41jUFc61rYOskSQiIHpZlxukBzliW5lWi+c6ytGbxrkqhU31kY94daBSd fWeVD87NccEkOUXDv7kHV6JcWIhDGCjKlAI3lRAgJ+eTNhKquroTE9qm/hIi/ZPcn85kLKDd xwUHJm2ke9bsTntaFCyHzIPRBiuxH9bN8sy8xdmSJIOYL4FbuwivVTi2kehq98l5AUAG1RAE Nh7qDYQRkZrB4UEXnONW78urt+4T/zHET4xUSyq5+e/eFohiy6x7CFexsCgpcD2b30NZQ0nM 8I9of41TLcYn+JwtYRkKdGquPeiPaO7kmoyf0rNHIkRONA4BePNIzOC8eSRmcHbTJ3HskTiX kykKq6OHppz0Y32f5DirzuiRtH38oTySWcxoPEPExWlCFpck5hADXtIlMUL0Z32ZwU2vy2Nd kiOZ1+iSdJl3jkvifgeEoU9gptkiOyDSBzIj4M0HWoglGx/IDO5P7QNFiSlM+sfwgcy4fSkf yIyNNx/IBG4hH8g80qV8oIXo3PhAZnBL+EBmyAv7QNRce/KBZk2u0dxycWabZbuRlxHkGCy4 3WiG6G27kQBnsrfSY7cbnVdkp2CQEhj/LbjWqU9e5X4ksEgXm6YkyuEkEHKaGqngXtmiL2mE i/oGtU149cp9NbuQBWwSsHM9A1m1vKQI/ZV7cCyMCPp6MR/SMCWo+qNKt7vu2ZyyVqPWK/1a /pIZvJrGaUKnp1NcuHkEcfBJW7BSe8qipEExrGs3PuKgS4nhUue1XOgyHPdhhRSq6ZeabTgk nBy9Dq84TxxiYZJRUNuSod3jDrnF+aFJYEXEyxE5FTxGCubN3Zr7LfPkwl5gY8Ay1Ij16ptf scILTv3onLnzGOAhvcjo921c0ke+dF7AKcZGRIOLCA5UQlHu3oktGNQGEBSaY1V6PpoPUvpi UxTPn1VphOiPOc3ghodXsKFF6TzWX0K5gBEbzzWiLEdZZKbDzzsoSrrwVQgeCycuJYF3NyNA Yfs7pA1OsYvzxXgvhtsDSgqcPtMga6ovN/266Het5wCnIslq/bq6h9/28jCP6XMQ1vG4krZz zNnuHk9D1CWhGMSTlbmqFB1mxFphjl7YT+t1IWzS0pyN2T2+oQ1Em5w2b+sfzM2xQz+rBrl7 QlWhKeh8icRhaUVzqlbbi6eXkDgpZ9bHaY5xDgE2Am7nZJzqBubCT9w54Rh2sw2+c/jY4LSc vfQ5blWDvFOVPjrTRJZszz9N5bdK1oZ31nN3YaJYUNV9Ch0UHIhLe6rKRq/CL8NbzbLk3JTN 1ZOEziv2yjCmAEt/QJ4FAkcnNaK5az1fJH38ygFLlr44MoqgVIzAXO+E5L2NEDysoSOOQa1K SfcLPPOw5V9EGEYgsIR1MzjzfSsJd4/efSAdBVRb793vThaQ1kvg5uFcdDzggAA369QW1xgJ 35AzCqN2w+o3ZJtq+14njKjgC8qGW+05V7X7k1DTDGOqZhSd1+9CegVYpmZwg2NFamElPwZ4 NJA8llKfMN3dovckKVliysoynhj3HzBL+nig4YFvu98x6CUX2l1fT8mo2a08XA6GV21wyVbq nBHnMV28gJAYW8uPUri19mJ3XjI5cqnBhH68axRmO/i+YuZ6vCDY3zUH6X0aTudYSTfqe5bK 7E/CBnVK/2hiD1G9Qjp5Znq6z00qMDeJADcnrOH5TE44sy1ZtDbPDNGfVDCBg0BCApfPbSHA cXXmXW4mEyrGAtClxgrXDEEc1wzOWaXhMBaU6lyquG82D/Kxeu+VndcGaVzStvwiSYRQqM3K mRNmXKguDj+ypPbyqABva6nUXgKcr9ReAtwkw3mIwoG4NmPj7EDbiWHp6qtWvZMrSL/QWUp9 T0y8mtlhjRIhv0i1LxSxw37bLMYzrkAXpwTRabysxJjLgmm8ZojeEggJcN6ZVW1j914tCViz cs7de6kleKkEfTxXLOa4K07Adp+tmwu7JV6M81gRwZEVBLiZcTeZsss7GbviyYyU3bxz65E+ 7ahuJHjZuxLF04or0rCYX7bofvOlhHPiCCz6HqTnBGECh8kE4WaS+0GiXCe2DsVM237J1Exi dL5SMwlwc1Sok5NgaCMWpBlbrj6NAOfLiCXA0QrU/fUPWRyy5YYtrWUC3BHWsnOZwsIyp/Ay 2+U+kveydLGpgFKDmBwywYHO9zXwAjwCB+e8npQR3KZLgJttljrfQInCvFyMCIylcLechQhH +oUetlPiBckhXkis5PhD+brzpINRUbs42sri62YJrK0lfV0jRH+WtxncMoIyLhMIMhI4uDcK wLtiFLgvJSgTli9JBChRsBPhyJiEc22WQSLcUuSACr3cQo7pOIt7TVaiplhIDsAF8BDoMINb ogxbBXbMCHgL7CxFXhXYMYP78wd2hFLjZD7rl63FJnD7s4RazKPzFmoxg5tjwbk4B9HCgUKc nriN4uKMIi4sSXjeK77B2xZYjI7xELHnIXA9C9fnsoYJclGGLCJBn337xgheDBfpUOCebcUY Zf4k+BlKiLHVC1z/cNxEjTeAHfbO8YJ05ZREbAZvJC5OyiFu+EmEVWzYBOje8MPghp/zqkip G34I6H5u+CGA/fDrDmPuv1Z4K4tggvOuexuDF0ZAlswcq3H+XZTum+ryJAfkMZTzDvFC5SGz 0FRNx3PgA2mjNlqmc7Fzvanw3zaz7M7PzefCV+YJhTUqzCbjsMnAQzvnt6B/C1u3/gMVLlwU wo69JySooe/P2vBRyXtYzlvdStv9onePaOfatx3m9G0hB6dNgH+2VVLqsTnD5oXOepSERizw +3myyhQh4RxiywRx3RfC8hzqHglwJ02I89rVpAjzxQiiVmRaQiR9CG1wIf3QLJQXIg7CjTJh eqfuRuxniyr2e69Z8/WDUIODewrnrYLqUUXwsnFGzgDjjtfg3DqMC4gCE+Rzb4wmMfjOBLg5 ct1F8SzNRcIW5eMbet8edH2eFFZWkXgUQ6T925NGQYzWXbwVDfBd2UCqinonuIZ10rjaq3V7 ZU05fasm+Kc1CM7d/kaLWVnQUO+A0wuJRrXd7FX9oqyzK1TxiU6jbEvtQKG5r3jgPIWMaGKS vEjanIL2TrueKs28kxF622SgUzPV6DM/klBYbvbD1WTRQL3D7PrmElh1Panixqqu1rxbodYk vheDvPehfp4OHKhb7PEG+1QXNLTM35RpSZ2t64frZoOjcf5VXdxF967zWz0rbZauJj/C04V0 ++uGUUd1oYNlravrPml7AiKusjxj/7m9eva2iUMiav/0kwqjJhnuxRrffDqscTmoi2DBIJVm 10FLlC4lyyEhh8QPqjvjJeU7rZ5aljlrxHFkqiHF2Jx5zF9H0fP4rK0eomq1SCkqe0gDwDs3 CXAW1gwaHm4td8mWvWVZWmpspO0tC1owx0CuGVidTUNgCuL6dsn3AwShvh2vbm9WSxuwG+xX mIqx93tpaDmvT+JlgXa6mcgt+9Z+atfVuoWjg8bQ20rOjvI/SpRm/dKwsuP84IEA7ZypyT7o yZZBa2iEzW9H/NMzJpSeuNdyZF9tHUSojetelp+aaeZn3RdpGKXULHmor8WSOQKcLJwF1mgP uRL8+XiUMXqCO+jhfCqGLutCVIUy/yIjqToI+lf9M8gG9+11Lrm/aI/d8CIa4pKFPBvh+0Kg t4f0r0zVGQpM4mQQWBp8cr8xH5dhSqLo/iLeJBEmLAHNOPKs2fF2jUkqWmYUKue5x8Z4fMoB EAFvjn/spArTRAjxQhDnHJYWEfcUEgY2R8oV+2uAITk4sA+W1yM8DF4clLGYqH2DNSr/WKiQ 4DVufuL3pJFX8NIueAP3q39U1qhYgtgrNAWZFYOhUKOVGsDXeLWrA1y5n4OXwgy5wu7PO77S QAzOoSqTooZplgTMNA8Tjgm4eRHAiX2cB0zMdhficDKpSr05fSnsDehDbB0EjhDLIwEJ9aaC LgUWnL7Z3YxIdx5oVepqBD2iXId4sE+VZQ1YlqRwX+sU9agqq1md0WOAYgRhrRNjMMSiDyC8 7+rWLwN+B42ONlhfO+8+fkIOrx46/D2cgzMHwATmaXn8JHBWAjwFNhNKPZucAypNf05f9Ahk aIYYwCshMF41Sv1yrK3PBC0WfZJQsF+jwPEIXQ5cSCqDengNIH/QNvul5LLvn6Ep6B6VjEPh eMwiIQMMUqQ5M/71G+czUKBONgG2sW8aMdhTbFYND7Nikn2p5NU5fdEjSKMSFIeFf3eo1P5z LH3Pg8ukNXPUwr989lBXN5ttHTwX3/AFZbBmaNZHIS/gT16KPgGLm7/MapGHcdK0EM2jjI/a gJyLC2s3jSiUTZQoHDYCfmPdbiLhVpoa5RqY+JuMEQLyR8lUT9Aq1SjhHI2asKI/Mvz1xFaS 1pIlkEgCZpqNqEg2UORpf4dB9Zs0A7e2UdjqNohlv83AGILTzrPGikhY3/warkUqDWlOX6SB nwlJCm/HRStMcDW0Z9Q/eyGsTVXaS1hDp8EuKdjTdpAEqNh9inBUmtSsziw+IcbTxtj/gKFi GRhvYnmNy33fhN+HB4C3ETAVAGwPptp0Dq/shkFL5bHjz218S6ZsQrzqWobqL8ZH73UDYePt jGGIYF6PlJF2HnWjvN19akP8Msj7QR+kBKg3xzqpkL0K7zvGKo9R/YywmjYaJUCp6ycYllG5 W3P6osNCYqmnxYhfewfsjO8bOA9kEYHgPmaBNwpezQ8qjylyUalOc/qig1JwcKcB9f8jbZLT wCQcdOVcCvWNkVbzMW0dCMXEh0YGNmhtjF6TjnYkOul4W6xjYfTatCqUdc2CUZu8gaTtiz6+ rZql+1HmhUSnsS76LVpNzLpmQ7+RJJ6cNRx4O2ldwpAN1Jjb3wHZfpNmPNY2ClndBrHtt+mb DSVcBcAbdRvHYZpYVgeVMDKnrymzoUzxn0mz4SK1GxAnYlGKJ4UJi0kDQgFU3DxFQiqmOKsz WpkIb0TM9Bj7V9W1VsCj6zPsqntkRnTO3b5tCizajJV6eArSZ11KJLe59rvNYx3IAE7bk+VG E8N9A+dRicHFF/lRc6wEjQIoddbUFFORxjl9TancIe7zVO6JIKXKPYZcSn8184MSdYpcVGhx Tl8TKneMOqlyTwSDKnc2hYwqF24nKayOvWwx4dhbutGGKu/EOAnHvu3G5tjLVnbH3t6T0rwK JatjrzuyuOxq+nD47ex16EM3kAPv/A7o9puoIdnbSGzbNohlv01f9xYx/O0oKlv4jFHR3zl9 TenegoVHaN7xluhZOCjNO8RhUu9KcB0dYCUfFX2c1dmU3h3iPqF1y9me5wxFPHDtsdig9beP 08T8WEV8ItngxAaeHzHlSu5IcK0as844FeOa09eUGu5jPk8JnwhQKuH5pFL6TM2MVmdWUlFR rTl9TajgIeKkAj4RCCrgmdQxqd8yEXNjjaurFnb1a+umMVplE6v67XRjUb+qlVX9TvQk1W+D kk39th1Z1K+cPK1c+cj1pRvIgbe/N5qVj1xfexuJrW6jtS+nXN+sHKgri5HKqTDajK6mlC/U 9sxXvuM62XNQULp3iMKk7pXQ5rm8nIqpzelrSvMOMW8z2aVSu28yYseVGqh4N+35/zI7MOsd I9AoVxkxxzdM103td/JOlP1jcKPTCMfn4g8tgm4EvbEIMsz5nYhE28LRp5ETDuDNyyMYQYki CW2WX8yp6NGMriz6OIYU5CHer79/Rqnh08AIucKTI8ijlJqajDl+MKciQzO6mtDBQ7S/p3Tw aTBQBc8kjUkFCwsnz2xBZ9nAHnS2dNLYqtjCGnRuO7EEnWUja9DZ3o/UvQodW9BZd2MJOssp o/1e8nc54vZn0uu1NpGI6iaTPq/6O0/p2lP2rF1NKd20PEbpckLpnoaCUrpDFCaVroQ2U+lO JOxZ+5pSukbitbc/dPxHXQnR7k4P1a48jrN+39wGJ1PGoXlzxWPn2KCMCGJL7anr1KZ96o4D jt+7JwmgC41916EsWCNU7WlEVKckzZ9+JXeUnTdL1U6kCtq6mlK1Q7wtqvY0MFLVzieP0l1q Mmap2olUNFtXE6p2iDapak+Dgap2JmlMqjYrJlStbGBXtZZOGhu0mFS1bScWVSsbWVWtvR+p ahU6NlWru7GoWjllBlWqfs5o2k42QOLLBnbik0g0v9NAGqmVTU5OC2Ss8lWLbMb0yUbW6bNB appYQckZVmOyzbCGZLBRmiaZlQnmNMKV9/8TtBawDQplbmRzdHJlYW0NCmVuZG9iag0KMjA4 IDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9G MSA3IDAgUi9GMiAxMCAwIFIvRjMgMTIgMCBSL0Y0IDE0IDAgUi9GMTMgNTggMCBSL0YxNyAx MTUgMCBSL0YxMiA1MiAwIFI+Pi9FeHRHU3RhdGU8PC9HUzYgNiAwIFIvR1M5IDkgMCBSPj4v UHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAw IDAgNTk1LjMyIDg0Mi4wNF0gL0NvbnRlbnRzIDIwOSAwIFIvR3JvdXA8PC9UeXBlL0dyb3Vw L1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDcz Pj4NCmVuZG9iag0KMjA5IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDcx NDA+Pg0Kc3RyZWFtDQp4nNVd64/cNpL/bsD/g7CfphceWRJFPe6CALaTze7hHHvjwR4OyeLQ bvfYfWlPT2ba8c1/fywWXxJfajU1yAZIe7pVYhWLj/qxWEU+f3F33F2vN8fsm2+evzge15tP 2w/Zz8+vDrf/fH71cLt9/nb9cXezPu4ON8/ffXl/hJ/+ul1/2N59+2328rtX2W9PnxR5Af91 XVtmRUZ7mpMq6+oqL+rsbvv0yX/9Obt5+uTl1dMnz/9SZn12df30CVAWWZk1Zd4ysrbv86bL rj4zmh/eNdnHe1Zs9pF/68W3H54++fkiW/0zu/qPp0++Z6X9/emT7PvXr7Lnnkq8PByPh8/+ evzlcDjOrUc1qkfVtTlts7LLu5pXg0svhP7+6t3fhnKfyY0Ubd6UHm6nqOikdiZdk9OetRVj XmclrfKyy8oC5NYCT6Vzdwf1ap/Txq3HS3KRXcHnu6xcXdKLYtVfEP4rha8V/zpW9hki1ZTm be0T6TItqy7AquSV/Eex6i7yAqqaV6v2gvJff7mAvwv4u4KPIqVYtKryrnoUDdCKelllbMQQ 9uPm54ui/WWVlC1hiu98NRwNKORW9VXeEsmtz/vGNRQmULklUi+GFVHbXX02S1JUeeMde04l 0AZ4CFY0L0DvthImUHmaRbw4USA+0wG/Nq/Ya6SBDsBGb1/XGanzujEn1uz5u9v1DUyHr1/9 7buseP6f65uP2cX25vKHlys9500qC6UnqOyBdavyGl5nVq5yTGery+oih48Xr1YE/+JTGv+L Wi17nixMi33nlcWvzbIkedNItoQN0IZE1Vl61DmtMG8dSlKxSvjq8OZmddlc7B9WlzWrD1Ph lv3QXnwAld6umosD/LG7gcfH+5WguWea/wQP1vs9/4GT45sP8GfGDMpneGf3YSUK22/fAyde 3v8hDXtxvYGZd7OFTygV/ucPON0dn6eNstinKoyOywJxt3fwFclBXChvd4CvN/DgXnaZzOoo Z2q5ZvN93U7sKekate7B+I3Z/fjmCqrMx8q/ZS+wwuzDpcZBmzxjulYt/AV+2XyCRsW2us9W ZXmxzuD9zQP8/p63+51scuwG17ozYMPCo4+8uxy3X+GHNX/5mZJrs4Zfb1j7ASnwPu72e9nb OJM9b8TNr0qa4yf4YbuYZpl1I7ZmsVrH3Z2oGAh/gJ949+IfW96lGShkmONGdU7U1PErf4+V Uo/0DH/cGq9vP0DL6FZbp65n1dd52frqud9tcNgo4QaTQ4OyjieHZYYWadq8pD5J/ZNwTXoO UJBtQ3Jm/2NzcOWZgyeV5Z8cmE2jnikYgElFEZm8fm3p7kzGXQE6O9l+0YK1WKVarIZ1Zkx1 xIcGppTlrQEt25z4KvDftrk/j1lV5/REbelV4kv2jb8gIFhbwD9FXnf4AQJc/zn+mPX2Sj5m tIWkkgQwnFjlvAXI4YbPxXAbUECnImYBRVHaFK3iwbpdNRICFF1UwTKAhCoxeFMMn7MBPagH A60zSFCb2OD8idHeprr8FEIdmgCqMqKR9Q0TCXEVERd3RDRC3GUFjSWQKQMRfeUfYnUYcAeL iuLtqtHTqxdqVz6APY937+Mdh9bIUPTuiN5oBFkHy/IjBXAlVT7FcdMvYLQylauS4IMAll5/ 4RAD4Y2AGxuGnDIsppGoWIJkQclB2NcdFLdFhKZxyTW8wZnzdz8rsK9AlMKF21VZCBF3xweF 0A6qGJQRZPWZ+fO0Wdbwj6FNL2htELNu7zP+A+JOvW7gNeHSflS/rY3a3cAPH/VKBB5tOPja 3t+vxK/Hw1hXn4FXBOjM00AF/tzeoYE4xEGGiA4iY6GJIJxQUVGAMxoKE7HNPJYC2pwwdUhw IJqHW6SIttoIqAkVFcM0luR+ODOPDaKZqQoaAhlpVmne+jEKfxqCKJ7X1YIAHgcAinrdi084 RQCe+EsQ6ARF8IMTWYAXeGDT8CcVkfsQpg68BKKS+jnIOCSR1QjSCEkVDRd1SDPCHEVhGOuy zGlgBHRhzBEsKoo5imo01bkwB8E52gM85gnAFr9AbwsQBx7IUPTaiPL6CPAIlhU1lZbwL47c Uu236/tjdgBDhR6JTGMJPyLJ7rmBkzBk84khlIMi1LhCEvBfuL38ouwrhwzEcFsgAeIbzp97 5fgj5VS4XnUDd5/0J66P60y6IfkjhDvbDfhWZN1y7rHyGeJ5+q3ZoG/akzqHnI+QIZqySN8o fe7zKWVFLfFI9omWeB5LYYlPUJe0a6J9+PQbU5fPPT6lrJgptkT3m+J5bNAUT9WQ0xSXlVq/ umwxPg4ZY18BBmrV7jmXOdYFeO0xkgQMcqAMYZGFGH6TrIrw2mRsI/5EN5GpCi+BqKl+DlIO SWRNgjRCVEXDRR3SDG1y07JmrNUCmgwjGsZjweemnFJWzCg3fTHBKNceezyTd+/jHbXHgqFc bEUU53NSTiosZpBt6V9KG4qLR3uDLeQZQL//g9rx+F++FhXu9v3DYGfljtlQNLBHrzWcWbmK EoibsSs3aVPOu8G31mow9qZADbC94NsyTFs12W4tDHqjZrd6W+uMrcS5QrUlGBpLqCj4EPzE OjoyEHyuxCllBcAHBSRgd5W3PsQxk0/LGDQOPj+l5tMCmDplVhIwQbY9rtgjbeFzT04pK4Js bNF/9CGbmWw4spmsISeyYVYyhGzwcQjZ+AowlgFhZKML8CIbJAkgm0AZAtkIMfzIRhXhQzai jfzeBj8B1tR47vU2hGlQVE0T9TY0lHevicjG556cUlYU2TTtcEp1ARsa8jbM5C+8DRb/OLhB fhPBjc9ZOamwqJF0Km/qLscYyww2OQynvLHRIVBNfKPjd22td9dA/bBqvNsbYkNFbm30zp0N T6iMCW629367f56eIXS2MxX99ZNCQYYXxoerdkrnxrYH1tqIKeHhKA8KfBkN4da3RK51oLHz 1BohRZN3vUMjcSiEDKdBIZ+Hc0pZUSg0HDXZZZEXJVRmw0CRH63MYynQyvRZRlp+0TyTwIrP pTmlrBhYGUvuxyrzuCBWmagfF1Rp2kY5DhxQRTwOQBVvAWrN0BgeSwdUMQrwQRVB4ocqoTIQ qkgxvFBFF+GFKthEAajiJRA11c/9UCVII0RVNHGoUrRGmHBNoQN5R0IVDn8OlxWFKjUZzXmv c5hkzaBnD0SZx7en7C0X3zhGQYaiy8aUFglyDhcWtZ221sCE+yKQmQ2HPQ/iDr0IoBJX/AWQ 8yfBGIw7hS100MGNYYt7NK1rVRpjvrvlBl94d3bciI9xjM/wnqdOUulAOK5OFQ26/aCg3LXa mtGK8aITQyHHO4m+9tnxgMikH+78jErljDkc+T1xhaumz7vSUeHdZnufp2bWtRDnYTNbqhmr QgeJO+LDr0CjfItOY0f9lxEBwwOz+ddb7d/j/dxCy4AKYbi1bn8gRN90RvDNF7nPd1Bh1MHO ILyeu9+FR7Q1yuJ0X3BL8wOrhXzf7Ked6YNcSu1FPwq8cC9BFPxew+6t3Cy9z27UZMV+Z9MB RpBvMVJeVnYDTz6JuPHu4lf+lx6bAuY7lkO+7AwRVJW6z5OqhzwzWydxKI8MEQvHrEskfDtY VmxLdWxcpm2pzmSJW6qnWGOJjEX7cOQWU1ckZDtYVgzLW6L7wfw8Ngjmp2rIieYZMiyNCGqA kCNAjxQGoDdpDCDrK8ZYAJeDWGyTSOPdchhKPSZqFTMN7gdCa1QcKElAfCGSgvgDEg2dy2Hc 9YAKtYjNx6uvW8/Uj5dAVFw/h9KHJLJKQRohraLh0g5phkCfcrhrRA2FUkLCUdfBomIwn/bt aD4cw3xfwPU8tgLl22yjKF/w06E0IY1F4q2DZcXMqkNlEYz/WSFq7fB6XKQvUf2dYMIQfesD 9DsGWQKYc57u6rLO+/KkdhfzjeCnQoJCzR4JLQ4VFfOj2ZJ7txTnscEdRZuN10c3kw130Z3S DsJIynaXcUehdogELYeKilh1W3CvVZ/HhRv1yepxGvWiMWOOHTadE0RMur8QhYObYeyyw6Cr QkL2nBOFzXmwHGHNUZygMZfFBGy5aDR/5JSfAOtsPPdGToVpUFhNE42cohAvQSZmUFXhcOZw WVFr3rG5qgxb80sadt/NlKAsKljj2xLEDTsynJZIVUUCmsOFRU27rb8/vGmHZTU4O3ANnukI LWbJ1+AsIQarQPq01wlxpkpbtj7qg06IxHzrno0FB9840kCGk5KYSCR2OlhWFGtY3dCPNebx EWDD4uMHGzP5INo4YVKQxls0/pQUKRIJzA6WFcMbluh+vDGPDQKOqRpyAQ7a15AtIMACNTeg ON4QzxXgoPZWmL8Ihfo5gYIb1NotM4pAlDAmaRUbCTaovZ8WLAWRhhRFQA1qb7jpQgTSGNCg zrCx/JuDfgJRXf3cuzkYphGyKpro5iCt2RvlxDgmEo7QDpcVxRlwAGA/DWd4/QfzJJA4w5Ig jjOQ4bRQJhKJ0w4XFjWKtv7+FXEGZjnf38r0KR2LZcbsKMmcRzr5Ycd5GqZFXrWzYMdMvgJ2 WHzjsAMZTgoVIpGo6WBZUdhh9Uo/7JjHR8AOi48fdszkg7DjhDlC2nDR+FMCkUgkajpYVgx2 WKL7Ycc8Ngg7pmrICTuY5SppyNEhKMKejlAxxkqAkQR9HUYxAWeHoAp6OyIlCRAiRAr5O3RB IYcHNl8AiHgJRMX1cz8QCdIIaRVNHIjA8TLlxPRtEg6oDpcVBSJM9uF06wci9qGbZ0kggYgl QRyIIMNpCdwkElMdLixqJm39/SsAkWGMNKZscYDRaJl95n2evkjHTBdx6EsHljiOr8GtlMSi sH6f9/1JHU/OfshwUnI4iQQlB8uKIg1Ldj/SmMdHIA2Ljx9pzOSDSOOEtpBmWzT+lMxzEgl5 DpYVQxqW6H6kMY8NIo2pGnIijbpVa3Fpn0ZIAyk00hjQKEvqL0aB/9bwOY6JpMFtTRjiImoV M4U0hkJLsxwsSSANIZJEGkMSabtbU16LCrWIzRfYWvESiIrr5/6tlSCNkFbRxLdWijIvWuPY ZBqIJqrD8dDhsqJIo2oiSMOLL+bxlZESFt84vkCG+pjToNIi8dDhwqL4wpL+RaYOgAscqWan bPUYWnij4MRXXhBDEa2MW9wd1alp3vBfGduIB7aNYhm/7hCUoItj/wEPWvNZ73mKIRT6fbxZ eZuO28rn00vTVmWdt9QbpZtYDyVbblQupn6H0ExGlAcf24yuVH/Qsca3Cqhuf4d+J9xF6vkH EegKBBD728jY37QyV3WT1+UjKKdirdATByNPVPUWzt9+r8agAX51Fp4O18aA4f0OdTmKkuZv HDN+ujcbkGseTKxOP0xbzbpghqd/jM4mhhIzhtUgxQtTKLE76WPH0QeqkxhEbPozlQY5ZUrT vffrbnXJ2ufIPkVMtprJEnebpsiL3lHN1LNlBdbXxSi+1kGG6rzqoA30OfunlBVY69Rwjrs9 0/vXOvP4sLUOdbB5k5pN67bo8aWOaHt5FnawKbyxrhPKii11LNG9h2zNZINLnakaci51CI0t dZAistQJFKO8DzS+1CF0ylIHqcJLnXBJYqlDaHypQ+iEpQ42H6++bj3zeQHJIG4txymwHZAi 0g5eQRSBn4+aOjlJuKE0H3EqOB0HuRucQm2JVOG2DDFTNEFuor1FzYLtrZjJo8ypFXevmbn7 xCQqJ+D2bfGccg2ca6Lgfazuy7BVc4rkc6efIlKdsQ7sEKjpRttBL/n5JPz8U/ZZw+Vl4xnz LL59zS8StBnbwOwsPmXF/XQ2n9cMRb2DStpG+TyGmPNtM7QvXjuTT6Bi4lKbS+4eF1+PuFlP Lu4esrd3h2uO8PerEjzX4J//if/zG1uIfxGed4pP+LHj21WDBR5tiH5WPSA9ry3jHcE5JHxb JGlGad1C5oJz4ei4/OdMni0bEJ2L6et35/VQ96FAfPBZvM7roy5OHTeSjlqtlQdGpNryPGy+ ArcjNM6UoqxLAOS2FMlbsawBCNqM2IBbXXZiT2u/Ba/WT7BF9BssC3nGMO504Rn/A+dDYgkr yP12iehKpn9h3UrwSh4rKRPp5a7ePrWgcGlq5xI0uUoIXG/YOjhh1lT6sQ6IrnRVDZb26yPf D8WusrUX8Ofypl1O+kdRa1MAC4da7zNMPLvf4NHd7/n+afKq1qxdS5cAtkvzbE4V+JeiSnUa Md9+60n3NLstSgNzL1uVDizrN0XRdt+eZ8RtZn1eVQ5m6btVX7mr5b+fc+Qscw0yeTgZ65rf Q2fEYlaXJc54o7s++V/amRe+GLTS0RLDgMjYu708EBBeXWomYotqthKxlem8ZudcZmx4ANSz mHlaxPYpnitAR2AhGO2kzmHq24o/aZi2Ls8xP6m7LinYZUMoO5LlzDFalo2bU3oYVHVuTuGh cupofa83ZTASSQcSTdpnPPskw8Y+yDCTF0zI44JOCop+hics3me7Y3YLiPGOr9oaLIeLNToI esh7oXYsCNxRbbTjdzveGKJFkrOlVU5rB9vk65MSNucdjP663e8x4O1GnWijtwjx8B8e49aI g2/0+aJyG6x3HnrjP9Qz/WxXdpAMY1duwmxHfREViWY7wqx4VT7GbGdzWmqU2JymAoMTZrvg fJN6qciGYUMd9bImtfDprDCTtfIeHc9UhvOf3iQ2Mk7Unuiykw7p27wgjtomn3TqooAlmM3p vFkndjt1ol7eFXCEXOQyhuEtic8ydeGhaUrNk9hSd104eI44hB0fshwIeE4uU9eAQ8OWaTyS 1+gE4t/3Wx5ssl0CjTc5LR3ijI+lRpAEo9AVn3E2JOcrZ1uKBcA/5aPO4jTFHPpi5VKZw4Yt n/tHMYcWp8UmCotT2BzSOebQDf4t4BW4C26E2TDOi9OowwunB0PFFhSpDUnFXqAOTZu+3NQ8 Cd7VsXw/go1pZz9aysLVtIZMTpuhgFfNEPik5t6VOXEwd4IrXwrtuRtfEMXmVDnCi4VmCtrm rRE3k7Fi8XDLL8ntTcm6L1tajlkyNS+06WRzWmjTyWaEoZxOAMl+WhZNVwXlAMwSKjmarooe QhJtThaahkjyZgCazcNvTziiVkcEHwRWvFnhBekyrBVjiM/DMGXlXqS0rrZebGwylDh04cXy BDfieOPaCNmH45BBIeMzxy+nXr7WT74YTbvl8QJaHtk/WK1u1mzZoWP/zXbf7Hdi7zUTGQKN Z+pNDk9r2kBYvK3vKfDUlx6QaAuJkDovzJXqkltIFrPFtpBsTi6EarlpklukGuy+JUsC7Ot3 Q8s828ZKs7V9yu750E4ECN1yhIeip1/SsZ+oQ3fJjQzpCRzTNObEL9VBqHK4Tu8mKnmQ5PK1 q4varUfez1zbliKrQT1RM7S+Ldvn5jNTQZZC8nKAVzyJwKiQDwxJd1otL9aEwMCDuYzDGBij KjqhXftKsD56/Tr20hl3Gxij67ASN4rDzaoyowPS3zqZIWLdUs6gXRv1YWlH6iG+QpUXHqQ3 bFUBKTh2W0wxbL78jFSGDSN/HsmwjZktZ9gsTi7DRpZxuBgYahTjpzgMbZIMvdjzCMAbEegg ToHYflQ3efCevMMRO2J5pzAlH+B8tWqn5p1tAxpuAyzlok/7diXyR3cbnek6dDzVht9JDbzR xTZ6/rHSFJfpLFXfgVvaqI+leKb03WGYMWvc14KAGOhF/KbrjK1zQVJH4MYaW9b0O8JdA5te NidhOsRUfNxujlsRYE3d+3OjM9O+V236LuPWc60cO9D62Ed+5csk7OB3RsxQw2mwn+OlTCqB kl8jtcBKk81aDXHoYcq07cvlSjRtw05K81jrEYvZciPR4mTfvOadsnkCqC+mbYnh2LoE1kt+ vXkp7x6AVAN+o1gTvoAAM4IxF5uPBPfVXzYmgqFiBSwPr/1S0crq3i8D+mQofOO594tP7eD5 39477hs9FyU1DWRhRTubc7ilSFbyZAZVTZ2XA2tnZQbZx1+kyAyyGS+TGWTzecu73+F6tz/P K2pzbEpwqdkcU6cGNRRSkGw+ztSghu9+UZEWxIDTNU9QYM9+gvQEOkgHapbOBiLcvxltfOcw SJEg580GqmoyujPPyAa602Z+nXzHrWd4s3MJoFGynnFNlPFWhdzovBP2YGriiW95qwNyjg9q gwEr/6e3CiBJlsnd/Wx+qEuHNtJvLPQtR4IWp0fNXSJ1CUHTthR/gta3knaS53BUcGiNzX1C ZpC8YjO9Q4FAXKMt0wKuiwZcFzanKbNRitxEn1GuCjiRIWSU62WMssV4IaNs8VncKFscFzLK Fp836LLYHaRN5bPLPhM1ZsNokkEWu1Xp03MpN8ixhncOgRSZTV6DXPbsQe0xyEul59pMR5md yVdaRQWnKth80zs+CvZC5+D0hi/ZoIOKbdN18im9rBnGcbBeIFSign4cbcaTgFLyDF0eoWjL eC3h3B8lQbcBkP4IrUaKzq2R5RJ0CcAem+GjJOg2APgeQ620h+Q/h1ofK0GXtWvtEmCBBN0S kFxUqU4zliTzz+/NLNsuf6w9qDGvxXyZFiP70NR5rsy12h/x5h0M9j/NaJ8F8mMosavKnYbb 8aqZL5D1PvP/DB3/hgdBng04TCB7t+VD0QjkgPg27cTE7SZuB9Z862b7TJ+arnYaoNSNXr7y p0aRu2v2XG9hQITg4J74RTeiyoZfomwo0tg+96irRenX+y86ZQJPjz1uPoFB395nx0+K+BZP t6G4V7PnO3XSRfxF7sIfQRf1wHcN3mJP2tWRdVjc8IvHFvxyIbfdf1mp7rE74nYQGukPstwF FrM15DfZWp4wBTYp0gE9i1mIXu2a4GKWLrKYtRkvs5i1+Sy9mLU5LrOYtfn8eDgvyMvm1NVw b8DyNeq6nBAHnxdiH4vgxx72qDbgNX/Pv/JkPLM9YcIMHKVF5FJ9Cec5w3NlGe/XzhGeIsPJ v1ZneLrvHnutbjF9pLW6xXextbrF6UcOCJIHWpZV4eaXvmYV31m2Ob24XYnoHma21+/BYi/Q gg3PDrG5p3dEtDxy1NVHpeP8D+GLoG3elQ4xk0e7Vsx0gTfB4jTf4bHIaTkdcci4mB+C8pNL bYY38twQEWR3q2LfFhwdddHknauJ0kdDFD3k6joU/VieCdpxgGMJkN4zwfp95ZoIphjthfM+ xE1nj+SaGDNbbqFpcQpnJmtXxfpGpT7BStr9WnJLwdNgbaE5u1rLhnOQ2py/kdFMoSmCL1x9 gb2ipugF4NZIBDqI6C1gNTUtyxQxU0/EFHZg7+hkxK2uiA6u1E4RI8Lh35MPxrYB6PwIXbFm rQqIyuJk3heRPr8XD7m3uS6ciAHnXVeWI91zQpYYY40j3xlirEMZJqmHHnuhoJb0POuH1DXP +1ngnJCihAgXW2fj8JuFM3hJDzfE2GKkD7SB+IrewSnteTiTTuGSR9U045Nq5AE26WcCyN7u HLXnR9X0E47XWeAYgMIt0sLTBFi6bjxLPM5pOHAuALOylgTuw3CM9Knk1r4GH4IlR3J3cMlM HXWofArsTJKV5cg5EN2g6fIy6r/6fwcb3t0NCmVuZHN0cmVhbQ0KZW5kb2JqDQoyMTAgMCBv YmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDcg MCBSL0YyIDEwIDAgUi9GNCAxNCAwIFIvRjMgMTIgMCBSL0YxMyA1OCAwIFIvRjE3IDExNSAw IFIvRjExIDQ2IDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2IDAgUi9HUzkgOSAwIFI+Pi9Qcm9j U2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA1 OTUuMzIgODQyLjA0XSAvQ29udGVudHMgMjExIDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9U cmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgNzQ+Pg0K ZW5kb2JqDQoyMTEgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNjA1MT4+ DQpzdHJlYW0NCnic7V3rcxs3kv/uKv8PU/uJ3LJGM4N5plK5sh2vNlunO5+t2q2r7H6gJcrm hRJlibLj/PWH7sZjHniRBFV7t8kHRyR70I0G0P3rRgNz+vJ+u7peXG6T778/fbndLi4/La+S n08vNnf/OL34drc8fbv4uLpdbFeb29P3jx+28NWfl4ur5f0PPySvfnydfH7+LEsz+K9tmzzJ kqqrUlYkbVmkWZncL58/+9sfk9vnz15dPH92+qc86ZKL6+fPgDJL8qTO04aTNV2X1m1yccNp zt7XyccH3mzyET914tPZ82c/z5L5P5KLvzx/9oa39l/PnyVvzl8np5ZOvNpst5sbez/+tNls 9+1HMepH0TZp1SR5m7YldgOlF0K/uXj/01DuA7mxrEnr3MJtFxXtNM6srdOq42PFmZdJXhVp 3iZ5BnJrgUPpzNNBPdqlVW3W4wmbJRfw7/skn59Us2zezRh+W8HHAj+OlX2ASGVVpU1pE+kk LqvWwSrHTv41m7ezNIOupsW8mVX47d9n8HcGfxfwTxZTrKoo0rZ4Eg1URWVllfAVw/iXlz/P subv86hsGVd8a+vhaEERt6Ir0oZJbl3a1aalEEBllkg96FZEWU7UsDdLlhVpbV17RiVUNfAQ rKo0A71PlRBAZRkW8WCgQGjpktP3d4tbMHPnr3/6MclO/31x+zGZLW9Pzl7N97P1XNzCJFfV wVwdy/VqflLMUoYLlM3LWVofZPonzLuSPKaZexKXWV5wt9bamL2Frt5vrlfrZWS2HBbUtY3t 1OIcyKxK68LG7N3yf5ZgUS+3Sz6YV2hteb9L2e9mlrxDgs/wzyP8s7qfV7PlvJ7dzE/qGf54 yz9tH+LKzYo2ZV3gRDCtjTzC2mBkYQyrg5vUbgpOLmDKfILFsTxsqhoYN3xltFbOb+8385N2 do0jdOCENTDPufXMChvzw6askR1/oLWxe8enKp+3l9DX7fIqOvOSm28b7+jDmpcEP4KGNYH5 hd3n67GB9VjBeuRfLmk13sLXfCmW8QUtWIYO1CwoSrjhduAebQiI9PISR2j58MANBn7zmsu1 AZlv4Z8tCo6f19GlZVnrkHZxf5w1ygqWlo2NK/Ya+7uNz5mzbK2z9mHOZjz6gf/RVIq/aljD Ka1dj99fbg4r+/jekjcT8w7npLYY8zyfRe9/yYf+Cftf8lDC0f+H5ArtwcMl9n31AXx6/EEv +SjYjdd38dk1aVkH6tiECYoImCA3++YaUEHeGMDK91nWtD8cBo6mHLu0KGwc4083HnXZOzh7 E51dS1jHzC5F7/KaGzP8q1DrfEWOj//VN7UPaPkqbfn4wkAivkrewLowtYd/YQbmBfyF9G8w 9rERazEW8zwjCbQJcjwLGR0pkfRLXCpfF9LoqyvL0XkFTSnT6mIxVldjgEg8noZ4Kas5LhvL tTkw7DBwq+3c4sM/HuZYubknXO6Z94QIOdTgc+YDziv0fzg7ETkCHFi+gLmW8Em4/ALYkRAk tXqtZv72E/oPnJeX65WAmfNcIL1LjALR02xX16tLnMpbIK96st3Bx3vCifyvL/jrFTYMIl0N F9tqm1A7QqBO9AFlIIcOT2Gj68U37OsVkKaqiQv+EAVjtKyulXL084LhcUa1hmxGOxnWG+gC 9Rw7vV5+APEBPf+Kgj70uz5AjYOhQ1XQ0GgtXysFayQutEyjttp+UxpaIDZ/VNTEkQ9nS79/ XVHz2N4jybDgP14p47barjZq4i3WONmwf8sF/AlyPkY3VKxM89ymXRrbhxcoytdPoNnV5ScZ gigL2xwVjssJ0LK0mCb3QlYCDdwtrU7pQDC/8D665c+7JmXMJm2A5S+Pa/nrJoedg6cy/RZ2 R5skZnahaONJjT8+dc8N1RdtV0NcQF47fAD4EZzzZMCNPkB0MdgHdNitXj5u4AJEmkL2/0jj Wmcco/9u/ZW//SexyWVrwrf/rDbZLG2ATa6ObJNZ84Ro3MztaFPEyG1ikGMzrxjs1JiZa8vP olh+WGwBlgiX6oKcg4hKa2KEfHtr/VY2DXYXmrhWBmjxiKbnU98MXfKIFh/5SI11Qnwiupdf mkQUPRUipkebBEVlgpfnK/QwQ4VpcbiBVAlHVFjPu4muX6+WQDOwKBThGDytNEWBrlYNMFmp jzKx8FfM/VIacLVebfnE+aYa/EmNX999tKT8BZp4kbIXrlnEYsIlvIH/kRVMruTocE3cKt0c z5bn5R74miYlatk8gdGRtmM/KufiePD1atnqlWGZ8zRKxJA7QLF8J1Of8MtxMvQWnQV4lPq4 2dOa9hifMHtq5ni07KmFnQnol30jH3vtsBwM21N1PufROrNxC8rT9r0YLiuNf30ujNYiPkpm Ex5Vi1w70I8jELyV7IWp08bSZaPBuGh7Qcv+iotyp3pJZjm+PSyLOi2tWl6sN3NhwePveZZV BkU0FtbRSwNKjpK6p1u6ZVWnzMqOQpl+2LxN7uCre7kd/kUEwHyWblRWnybgcYxM1WWQxR9L 2p+2P65wiYl1dgzzwmxixK8UYeA8bOz+vFyvbzA21UOkwQFCMxwg6Zh/Ucu4t+A3Kt7rK/Fm CO4skCBFGI4AC2Jn/r/1gyyCEIanHtgdZZEW6/UAdThA+lZWHAmTtKAQAD+vIbPDP1BsvlEg z2oYo4c1FdRxW0foaMuAu/hsyk4nhLTtF1rYqIoaqk7RHsCUVMHNj09DnPnIxwQdySc1vG9k Eup9egHDcZ7CTzlhvNgFOiXvcmXreQC+a46L76q6hhKVJ8R3Zo7Hm3NmdiZ8V3mC+B2xUPSp lDcpH8mn0l+Rd2ld2dgdllMysStKqA2zsMNhWH8bG30VODoC84Ushk2UmennTiDfmjemhKu0 KsO8iS3gxGxDbUzuRoc/nLIsbKpaLaMHJwDvytrGUG8N0Kg4be944FCxZOy36DPrI6BhaQoq /ly+c+5fA5SNxIk43TBRP/L0PRzzhRI1fQzzTeEd7tjKgV+7V08vVMCyxdxFbQ5xttwYXSJ+ OC5yZHUOJd8W3UWHjqwu06aysRtBx6NU2/AnLdzjxzFZmRbMxs4Pi2oxewD20B6bdb9pAo1q mn795XmkVVeytOnMDvipUFjOmrSzSRIAwtpjHluoCpYWe2HDLs5JoxK+n8pVdhyzTs39qxQm EEu58ZueBDuUc9ulLLOyPvik0YRfnjMeF1vYnW02VwlfKK8pLm35IoI/fqM97o4vvujidNwg 5IHdN56viXH4zDpTodS3tsRviw9gf9bxnXebp11r5f1qXo6Ts2QdyTIuVsMdBF24pjchdOnE CqvQv5qi8r77hfMfbNfjH8kW2sYMxp3GC7Tbv/qoslA9M97LcYi9CUAGx7HVrOXroLIp+Wwj AZHeH4NjI6vt6rflrYIo+52LiZ7aKDJu6y09ia44MN7Mxm3iiGMzp1XJYbnBf/QcLJV4LG7V HilVkhDaFqB7lCaXm2FyMr69l2tm13m/ehCBcz0NnEcgRQTbdfxJwZ1KWnY2VUXHG3BZQpbb 2B3hXFWXVszG7uV6nZwpbW9UYjTuMtYQVRcOOWwo4tGBNTzO2qgwnBir5A/neJvD2+i+KkPI a+EaPVhqOYAorOzO9Q76FeXTN2oXBDX/hyPg7DKtrAKF4JcYB4Rzg2A8is1bLFIupsBKABg+ 1wHcdrPyO1gwmNUp6J8rzHG8Xm0xvfMbpXfgUHbD9cmIRh3zLeF89udH2os4QbvKcLHksP+4 RUCS3GA1UI7lQMXsW/KGrxey1gcNiqHvJWNp19n6bhoUzrNqUj6zWNuCHePxaVfyTyVciqA5 jsfOdpArpC0hvUF8cK2wpjhSL8ZBMlxLwfXS4sUU75bXE9UdxlpEsEbW1tsgOFeIKupasmVF ldbMqz3bQZ2gxux9KDIU3tKHM1VKSn6Bpjg38NwhIGh4i5VTiKiHDoFP8NU9TuocJ/VY8weK zcoOHthZ9SXroI5CsK05OKu9mrcVyoe0Ze9BWTZpY+vAOTcS59JjnoIhyZv+FxN1RpElyyHF brxS4z9VrIHSVLP/eIl+Or4okODji7DL0nyMVfCWGb5CYTW/fRebccMfq82MXTOqyrACVE7k Ei4N880oW5lvSFv2HlQc5rW1a0otcfH+29QMHsaXFaC53daivv7rFf+EDwhIVhRwbVmWli3+ k3GJQIrrPwZRNGleSApODjf7jGnA9ICzdzQjrJMgEdZpTATzjfWbgR9NRI1ixidlMRUI1J8V vpaAqlIi4RhNSFg77FnTdXtToa7FlEAl6RnR06KdgNTT+z2judUjER1305C0mgalHdKMUEmN wZxw53DEv3SsRVuBZEhbVqBbww4cf5rbFGVMRvvKZ2pfObfBkv14dzbefkBCDMV09ynOVnkQ 1Jg9RMjx7MRUegwxHzbiSiORFuhtwy7gCkH49MsgozcprlYFhrq66Pz9W6gAa3pbkwMwA4/T xrCo75nsEj/Mac/kRkewXJ7eNQ5Udr3aqJBLpvCaUexrw0mHaZNH/nXV1+ZQW7KA+cR0rPZA Cfj0LU0S+DEaMSQ/7puMth2YkLbs+298GVftZC4CDCkquu3u/NwKQ/Zj2WZQurjL4pXOW4wP Ogafumw7QyFtOYrG4BDMVPT/tuKN/dgU3PaHa2gINKRXayAhJl0/epQhghAUGkEMaJTvszej 4hsk0QhiQCRdpGom67m4EYIQVApBDIWWjtTZEiEIKZJEEEMS6W1lQxIbDKlIizR82H09en39 WAlEx/XvIO6QRHbJSSOkVTQo5ZBmhA3KPM20Ty3SrrAvk8K2WxbSlhcbVOXIIpqxwUnlQQn7 SdF1uG02lcKPEoihdAQeFdoSdkGNef3aRPqXmKfWhcBUMoPubftNOluqx1shqTpttXj4BTdu zRtssP3xq05HGy6LQYyhN+roLPbqEmBGO9smlPXm+KU1w5crWXEh8t8becq7h1N2OpwQR8El NzcDBdMpOZ3qXz5sX+wEkviXN6NTXRopNRagJDBZO90o0CfKP1NJGcnUP9bVJ1/SJWMGDRrO JB6mQtZWaV4ZVOhHPsRQQAfPArNlVUPa8iKf0foKRD77sRTIx2eQDudTQJZkF8Mn4YqYBwRX PMNiS9eGtOVDWBPR7QhrPzaEsEI1ZERY3CXLtIA5RyMo3DkaVzO9uERnkM05ml4zjhyNoHLm aDwtCYQlRHLlaHRDruwLDR8BKDV6ff1YCUTH9e+IngYksktOGiGtoiGENaAZIawcXzsQiLBs ufWQtrwIi+Ujy2tCWIUNV+3Hu7Px9uMqYhiIq2wp5KDGvG5/Iv1Lq3Pck1FR49ybMNI+f+es TP8sxt28HBwmr2XRPeVmFB5xILaFuhgFscJaH9tfbWRprTppJErUNwqS9Ctt+xfsLuww47Ah yzu4Y3+C1IIzZp7sz57CtWWaG2TzQyDiFwaBbCnckLa8EGg0QwMh0H4sBQTy2Y7D+RAE2sFG STwhpkEQBLIliEPa8kGgieh2CLQfG4JAoRoyQqAygzfiuCAQUXggkKMZFaAgiRsC6WZcEIio 3BDI3ZKAQEIkJwRSDbkgEA2fI8lkJRAd17/bk0xOGiGtovEmmQo6XS+gQ12nlSsZW9hy10GN eUFQ1oxsrxkE+dJM+4oh80wTMbx4SHAUs9qrRVtKO6w1r3udyP83jjD6t9QRsAhL1jwsdfJI 7VSdv4cK8LeDuwgAyyCmoKL1tbgoCqvCFx8xtSIPmC3o9iiZnynx/A9kQoLAjs3vH6i2oqt1 TQBtPGEPDIhKnnWbHPuDPTKNnwShSNoZME7bhzjLX0FHlLNT18uvto9aUy9MZ0ZHiadblfPr J6NGR6fk4X1d1L1eo1xfB3dmwQNfN+Yi/Ug6b0tdxnOm75HobYCqOWdJ2t1prSl1fJegWvF6 QdY/QavSa2KY6KDz6g55Ut0wVnn3r5YaXulIA6ZTqXpbVF120JI4vTOgKvf3WR6VhMnuqqaP pN6GjTaepunIQXp0NReZTD0DRvnjO3k/m7QPqI9fY3dAHKGedmC0PtTsIKNzo+/cupWH13vH obfLtT63iodThzFT/960LiAoEbexHW344D1OA0jXOw+kunbTv9HuZHzGezLjH9CgrB055L3H jD+eVQapvRGU4Eihgc97MttOV1Bj3hhq5DzDYqh9eYogygc4IjCiKGoHZCNCEjkZEBx7h8a2 gxbUmC+OmghvjaP25UOBVKiSjIEUF1UmOQmil+NAiigGgZQxULA108ty6J2eMZGOJ3rpUhNR o5j1Aylj1OFoSQRSQqReIGUMTXrZ2QkValGMH3a/N3w9BTkoqOs9AhB4RCN65SEiiTURSjwi GkVTRQPlpWEJZeY+ZOBuyxdLFTxgVZd+U1EtHkr3l/LtyberuLJMfP3BEzEMSyYzz9kCd2Ne jzuR/l+7lO9AbRadvqDcUcoXmXlFa3vC3A9DiGFQIpd5Tlo42/KBkPE0DAQh+7EkDLLLupVe VoxPSIKVeY4RONvyAIOp6HZgsB8bxAXBGjLhAnAiuQsWEIEbFTga6UH33I0JdCMOSEBETkTg bocAgRDHhQdUMy44QKNmz6vaCUSf9e/WvKqbRgiraPx5VVBAGVjYz9yF/e62vEiAL5KhIZwi AW9GdT8J4K2ujUkCPyYghmHl/cxT3u9uzOvFJtL/PyzcS8IuO7Z56sMUnFXpqGS9ZAyd3f30 DrADWRY1+oEhy5+HBXn/l4oEnXf4OdHVfgqEM4dVNVWgH1wRv6AjEsxzRMLZlhdcjdZzILja j6UAVzsYQIlUxPCEHJFgniMSzrZ84Goiuh1c7ceGwFWohozgii9qmQwwH5EQFO4jEq5mVEhS 91Kj5iMSvWYcRyQElfOIhKclgbGESK4jErohxxEJMXwOlGUlEB3Xv9tRlpNGSKtovCgrb2Hx BqKs0n1Ewt2WD2XlHRsaxDHIstXu7clWpFsmbL3ISvALQ1al50iEuzGf458I/1Lf3POvVlF3 oCbbAlbOIRV1keVqc7A4U7m8OEEwDMIJpedAgbMtH04Yzc4wmLAnR4IJOyxm4XLl6ISghNJT 5u9sy4MSJpJbQcKeXBAkhOrHiBHA/9ROjEAUHozgaKYHrHXa0oIRdDMujEBUbozgbklgBCGS EyOohhwYQYyeHSPYCajjvd+tGMFNQ9JqGj9GKIrefgb/rmwdi8Rd5O9uy4sRmmxkDacgwZeJ 2VMCkYmZSuDHC8RQTGef+jyl/u7GvF5uIr25sC0wmSFQhCx+G9a3TdBHjNo2m4/dTyus6eA6 86lW9qyfO3BwKnxj3u/lc7uUzx2o8pI7rsGOxO/VcxG1y6rRfs+OxXP+t4vKiVtiWZ3JELnK 2mpjVdtw0cHd3lrdh1e0HahSDuOGWZ69C9piCwiXRrcGAaNroq3SNjcwGlXnRWZb5BlckuHt nyEeI4YU0fjcv+d0k7Mtbzw28nOBAdl+LEVAtgNckvGNGB+E2j51eU4dOdvyRWQT0e0h2X5s KCQL1ZApJss5gJEJRfOuuKBwb4u7mpGrhkicG+O9Zhw744LKuTXuaYliMimSa3NcN+TYHRfD h93Xo9f/Pbdnx/0UNA5E4Y6N7YIoAjsfZd5yb4K9xwfUO2QlSfKAHLygcsbXTmaKxslNjLfo mSsG18zw1xEzSZM7c/lBVInhvuryqG+GyfPC7XmMIsV4K4xdpCwbppP0W4qiv3qq4b03sYx+ V3xT8pltYPRavhX0VoU0o/ewj98VR8n4xVq96wPDSnU3PgUZk/3oOwUrl+Lk2DZBaL+G1wnW vVcr0zvrHy575Yo8iP4kAfLX6G8W4BAoy59gCBif6lU1ZXQe/5J+xgp46emEVfx3mfFgqGWG Pjkv5o8tBHeHraG3R3iFTIGZlTGjs838Kd86cZTXSLRdmg/SNBRuxX9lOLdEsEM54ed437l+ m+3oLdfqfQSxX/JQtoDzJzLGf5tElcEBnAmjACdYxXgPluO1uXUDZbBapmO+MHfMK/7SFe85 mDAKu8z40FEugPsT9DIvYPt/yki7Z7WqT9h4xeErvOEtRuLFX/jL+JyC0FdnKRM1bhkf/H5p TI34tIdr5H8BmMuI6Q0KZW5kc3RyZWFtDQplbmRvYmoNCjIxMiAwIG9iag0KPDwvVHlwZS9Q YWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250PDwvRjEgNyAwIFIvRjIgMTAgMCBS L0YxNyAxMTUgMCBSL0Y0IDE0IDAgUi9GMyAxMiAwIFIvRjEzIDU4IDAgUj4+L0V4dEdTdGF0 ZTw8L0dTNiA2IDAgUi9HUzkgOSAwIFI+Pi9YT2JqZWN0PDwvSW1hZ2UyMTQgMjE0IDAgUi9J bWFnZTIxNiAyMTYgMCBSL0ltYWdlMjE4IDIxOCAwIFIvSW1hZ2UyMjAgMjIwIDAgUi9JbWFn ZTIyMiAyMjIgMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUld ID4+L01lZGlhQm94WyAwIDAgNTk1LjMyIDg0Mi4wNF0gL0NvbnRlbnRzIDIxMyAwIFIvR3Jv dXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9T dHJ1Y3RQYXJlbnRzIDc+Pg0KZW5kb2JqDQoyMTMgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURl Y29kZS9MZW5ndGggNjI0Nz4+DQpzdHJlYW0NCnic1T3bbuNGsu8DzD8QOQ/HWsQ0+0pyNwiQ TC47BzF2dm2c85DsAy3TthDZciROZvz3p6ual5bURXGsbgG7wHokRWJVdXfdL33x3bpZ3FXz Jvnmm4vvmqaaP9S3ya8X16vnf19cvzzXFx+q+8VT1SxWTxdXH28a+OjvdXVbr7/9Nvn+h3fJ H2/fZGkG/yuKnCVZokqVCp4UkqeZTNb12zf/95fk6e2b76/fvrn4iSVlcn339g18M0tYolma m6/lZZnqIrl+NN/5+Uon9xvz2OQe35Xtu5/fvvn1LJn9O7n+n7dvfjRP++fbN8mPl++SC4KI 71dNs3qk6fhptWpeSwffoYMXearyhBVpIZEMxL5F+sfrq/fbeB8JTWR5qhkB7UuW6Iv2WRQ6 VaXZKwNcJkzxlBUJywDvAeGp3/Mfh/6nZaq0fx3PxVlyDX+vEjY7V2fZrDwT+KmCtxzf7i72 EShJpdJcUiidhwVVjIBiSOT/ZrPiLM2A1JTP8jOFn/52Bq8zeM3hTxYSLcV5WvCTrIDiigSV GI4R5sP5r2dZ/tssKFhhFr6gKNxhKAuNlzzNRQetTEvtY4UJ3/Jj1P9wfCGk2luGV4MUGU81 yXveRVAaYLSgVJrBuu8vwoRvEdvS/nAiQijpkour5+oJxNzlu/c/JNnFL9XTfXJWP53//P3s lTort8voosYMBVonOeivfRG8OkraSx84PQIuOQqc8IDjxQi4H2fn/CyFPz+/mwn7CkXx8CqB V4vNTNpXj7NzeVY3CYimahMcXZ7plDMK3SY8uCItcwrcA9BfJ0jx0+w8P7ud6bNn+HAFfxYz Js6e4FWT1LAeG7OETXUzO9dnS7Niyj5g8QQPuO/Xcr6CR+Hv8E89h98adW20wVP/rU+L5TJ5 hket4T8jwD97qLcDZs0D4rdYwz/4U1SsH5LKqE/8Hv7Bp9QbwAq/VLUEdfAaeKzF1+514JVW mUR14F9ppDY4yFbZ+UHetEsYid+UEYv7QO3e417YDbF7HxwJI24VhcPXsN2453ioho2v1/D3 0wKOcfiF4UYnFSRS7SnGE30NuL0zh/BDsqxeYMEsZuFR0llaCgolPJNPwIF2nZIbRCU4FgJE XklhUW9QosheooSGLlnKiTUA64QZYwrMk/o2OGQD0vyShCwQbhp+vcELIA/itZGarhh05al5 TQvU5/7DldESVlTf4qHeJJsVfP44HPGqadZG3C9wZz/i8Vrgd56s8g0uCSUtD3xO5o7pxUKY Xh68cmlkpTELjc3OdvH6Jsvy4tvAxldeppwTAMPLF2O+k+R5TS9+eoOLaYMkH8MRxfFV8gCS 0CAwSMTEsIrFDrmgukf5uEka5J/Kojx/gE+ttXG/Z7Xga6uJZyyzjFfBK8s/q549kLEAIEK+ s+/AjMEnPBuOq9ZWm4WWFmWWSkGsz2K+QLa35AWHLZnxs3ICdnAhIbl5AAVtgpDgkf0zbmya 4nT+mR9cNHvRD44UEpP8M2Ssl/5LYNdVDZp3yEAve95JOQYwtPFVsLRgE9fZd95EZKXEpEdb RtVKXojx1JIf3GUK2+2GA4KfeJVKfjJqGc/TkqQ2GOPsL9sWl4ZnH8VSISauoo99ZGRxnaHz fTJx7QcXTVz7wR04BKcOpdnYlh9V17QLDpkbgaYoyI/BwYk8zUhw1gmDyN2yvult189oc26s U2ddObQk7cvK+Gbh/V3DqoWg0NzPvRwNzthxJc2H2vqay5fggIVKS3I7wrvzxl6V5DH/7Qw2 1Dns6fUsb/lUwB9P9ulYhAqjcNjp6G8dFD+4qo9b2yivdbvQVarvZi0zOOe//QK4YM6n1rey r59mvfvXybCOxeA4GR5TDovFEsC6NOpvj1qL8h9A8kfL4M3GoBtc+TItwKbwIzFB96q4pqs2 BiXbs6ljmq5+iNFMVwLcrvrlkUzXU1Hbmq4EOI8hETyNIME3I+BHCUaZH5AAD0Wj+pU4IhwV XAnnUMhAEBQ08GVjUTJaLIpnqVIUJRGCURyMiGmc5hOxOq57o3UO/5zKvSHARdOufnD78nWS exMax9IYtjmF45e47q1RRJAVPN6Vg8M+bSd9JzoPcKJ9uSGszNEyT9mr4ghFALRkAky+jxRj kJvYReq7J7NTT7WR8Z+PO1x7YBnjqPB8cJPzoVbrXWi4IiPhog8TGJoegXZcees+MIlQCGBP d6sZlkLos0fDpn/Cph7pke1hwIUBrSgM/hoamIbKOwJY4GPDzdrmgtzIp81HEHso94x1MMMq JihkgA8urz4ExkbkGvLqBDbvVjOsdzIIrdaPFSAyf7W99Uf7bKVSc7TM/iqZyEKmZcJSab94 9xenuDGALFLGzS72nT2URdXSUPOygVNsNE1wlSygfImAP0FAl2EEtPIrDmVcYbabL0RZmQnG rbRMj8sh+IAXZs8zAnoAPtuHp7HY9WTwGBOpoMBd/3JkzNYL0VgAGadAXhqODQ4xh0wzAfC4 eKgXXCHAufQf2Cw1fIan9X0EQksNpW8noxRK7Rh9esC8fajDQ+UlaKPTUSnUCJWXC4xJ3i7b KGZw6EYi0NRuAOozwl5ghWfyvF59Bi0RHBEBnSbk4ZpS3BWisJ50LBTUF+b7ejO0mjTkFzS4 4E6o1kaWkOCaNYZobiESs8DKPm6zLcZSCG0eZDlYP6eiG8IfmfaDw6JNY36BFDUqKkY0tOCn o1RgtSRJKVfWFzxWM/pAS8PSFKHBE4XQXkVuKRhyuc5DaEZvvJde4xiUGiFBrisGlm0dfHC4 Nop5MjILPiISLhe3fefHskZf8MgAgy/YxfJUkEt9+R5cJVzwy+CQpYR+WpJtpbBm3m+z8GUP KktlSRENIUgsFl0ujDUwc/t6Ppt3wdPwvBSpVCcTl9z8oCR2HKQI4yWue3gHGZodT0ioyCRJ 6K9tWsaXFR8qT3TX4WWzTuExzDHpRGCI4SBMLS2Xic3r23KXLmSOaainvs/B4ordZYumtt/A rqV53/MG/7flBau+Ca0KTpYsC8iGjonvX+LUM7WWrPFvin3AdDsftnO0m21Tfc0nXDPbTOik 8ebLhf0sQrYkx3wVgbxvr7H9a933G5qXwZWD+WZJoRReMjGJYtkPLo7uA2/fD2+xXH7sVrl1 E5raLH7Rps+eeg76aXEP/wxZYMwUJ11z3JB3i1DCxDCU6yUhamsWZ2lObBXANQ+23WjfRSgj Y6li1K650uUS9gJ7wqwFk8Ae7Gh3txUsinaX0NFFohte9hrfy+w6Ae62b4muoSJDdQ2Tj6D0 6toGQC7hYF99iNJbbOUzK1Kh/FtXIyp2g6rG1nz8CxIiQ63YYj18sRXGfSrbraILLp9ZWhYU 8nCshuqWedW3CPZVeE0yfOjoa9u7qnZbV0GJP1mN83HW/qC+7bWRI326QsDgbCZBexPkRuBq jQLFDw5yYJvamjZ1eLu0YFAHejJSCwl1oAQ4WweLqr3ua4hAjSzN8WGtlmkbv81y9ApG9Efq rndX1v0D7PlpqsVyE14JSePAMJIzwlccmR8oEtyUOGqILllSusky9+X/nKiFLWR7sWVhINDm 1XLwRmrD0K04GMQEqKehpGyv1Xy3y2UQC/jcgx7tztHR3ckJbXDlHAZ2eVfIbWEP75LwvEyV GN2bSC4JhylrJQV5gk8SfIyATpki9uDcNd0iBAAUB2uVWIvjCjyI+QGKUeCmCIoQnbJ09bc0 7r/wJDgzG69mR9fX7AEuuHHMCcDxisAJcNfBwcFAMRKcI3sdLx5tsqapH3tpPBiTTpDEJ3Hd sEDLxtrLxb1IXs1yv3CO6sULzpEN/MsSXD0L4/CUJLgpXBeiX3iE67QCS5PiOh6P63yAI3Kd H1w0rvODc7jucAdS79g09Ywxa4QMU7yQUTbJAhm0Xt4NEcydCVk3LQ8W9ndtq0HbXtBaX9aZ eGz9rBxKj4F9B/updh+6XdQfmmF0jhrZv4CuqBjk1n/PGB+iuZUVYK3f3AT3BaWxGTSnMAze fykVg0joqfhFKgnMT/LLYBvO+1lcIxZbhJlA2fTl8ArUEB3kIwJVSX8GzwpUEU+g+gBHFKh+ cLuO3SQx57MnuibnIbb/jC1Qa9sVVWP4kjqOX2h59AHq+NaHzqC7mVi8YcRd1WKOlceDGK7c RRnkX3AZIPgIluFDGEJC4m/aAfaydIjG1BGWNj/wxvUtS8t4LO0DHJGl/eC+nKXbAZ6W/da2 f0nv+hPBFSUznq1UFBVVEyGOAj0DjIJohUvbwLlo2qQ1rkm9+BPj9Zvkzsm5oHWWx6hxkKkk 0Rw0eDfGsvwCDR+8BkBBuyaB6iAf28Ri8Fh0kYqSgh5+1EXJMADkB1f3Oe75um8OdHkoeK6s gErc0cO8cLgX1TA4JhFKJrSErj6Kk11fJDTkgkHwnoCM5sEA3Xocoe3bTKXEEdwJSIYvulAM 50MQ1HdZtuAGvVH7evzctRZaJLUnmC91YlOQzuCRCEXJeNUAAd9j2+qTyWFWQKkwhVr4wSTG 4JEkuCkWYIi+eTqJxTKY+XfIMGplYhX8nLJU0liEZwsjBAoSXJwx6ywTKaNA0sYk1AC0lWo2 U/xVjCpzOJl+zG62KmZ+t1XYndoeZpXbScnh7V2FWTwfapg/1Lbe6avwOW7o1Crzk51IbnSi LClwrYXtDISPMhmuUBQC3ksWbOTWLcWRbrGqwbmIOL6FoxXtR3fUf4uQdBTkzkWYkY4zzAhw MYfHGb9FkwyR9n5LP6bd40p7Jv1tlU9pZz7J4JQtGriAI06FgjSOoyaF386MtrptG4tUJifK Eq4bGEsIxNK/xitkGYnB35Lg1ldZGJ1DAqwXjXPvxU4oMAH1s1Pu5EY1tfszLLfDI9fOy/tU DVd82Kq7uyEkCRJsKI7ptnu4mWU90+6xtm2E4X10uJ8rp9YmQv4WQwIEuAiFfxmkNaaB8xrC UcftiLxI88MRQuc4NuveAMLS8aGcwGFcSiPp8AqJgYNP0fE3zIpqJ8xhS90H9CNYFgJCiARC dhUrLINdBmclLksASsAOXu/E1RipEdraNPTZE+DGjx+EtW56W25QxV0NTEmUwATPFgkwZwgS gus5obGG9FQbJPIMJfmITIlUhQiBV0YS6qlCLKIFWqRQcHvFqdZcihwsOoophhIvf6FF+HAr DD86GfEwyo6CZuMH7qn7L1AFLApjt9pU5zBvfBcTKGI/adKFwQxmTaETIdajYKANAc7XSaZd k9RpIgse6wG7m0IsfBSFwQ1/xELEbFdjWkPcmaDzH3czw+k1TqgdEm4Rolc4V5JAorvKLHgg Ce8WONVJh/ywLMmT3luZQzkdrHtwK48B9JPRLAUalX5wbcuddhPON1tNF0PxsB0ACFG9+96H QDmwMwfVr6oiGGPYk0UQNnTFbw05jpOnlhn2uRKoBM9TQ/yHsRGBnbdXyC6XTkD+ud+0G9ts M8ePbZA8fGNpUaTkigxi7BNY9la4zIPfSalYnpIHJJYNoRREpvd8g+UShcqn7UJf1zFf9Tvl zkWweZXWDzY/yumhEMGFpYJ2KIKgwQfbroGr+4BVs7hbzNvGdCwOrD4ipQ+GhiEgtoBOM7EV kR3m53RlgJOKFuHIg4EirSwbyo/tSsPD6nbEuYtY8FKJDGxa/6L5eh9txK4vGA8eMcZpjAQ+ W0IyVvKj5QspwbzwVnBsFXh222nnnD0OwdCt8q2t5NI2Iy02Sf0ZBiE8u5b6buGmZ2DF0Lva MenC12zTH+OuDsJe3b2Yd+d8S/8duqQ7fIC09aX96z0lYhliEjd9DriYkrp39hNXrHJGnSw3 q8EMXs9KNxzYy0kMI+Xjw3MiDAjJBUXhzbD99gRFuh5bFnAXNYHEomnTC2Z5/2zvtQhf3cjR vvVjgOKfjjLjBulId/5AgyfPybXxhsKjV6DLLEs1uWGpOd6I03Hj1L1wC4xl+uE6xfm9pB0W yGZAcWm+Dt/vwmGQBYFXhPYalY4d1tGcSH9aI9T9kVsTocpQYQzywBrEMQsY9yXWaLPA3nCz STYPKEltDbczeaTxXKQOxd1gOdQdM/0OmdGXQaPsdOgZI7YgbFi/xeQcj9ynbCL0sCrlXzus SS2jzVUq4Y48YtPe73T17FQobwkN3xLubrq9PK7waP35sh4S48uX4Wk72cF9iR7nEBsR7olg H9Jvrc8TPJorYWongdNgZznqbpj1MbhcO9dEWVpAFdz2RvMS3taYC92vkCmck3Dj2HW4bzYu 4Zri+Oory83WMFn31jg4vQMzb88F+SpCgUGOzOVfvyn2c4iLEsizxosMJqLu4vXTqueH4Ccq F1huQ0B+ReI29IkXoC0J9A42yMLpm2MmR223JE4XURHKAIx4JQiKkJfHC9QJcL40nLJXW+Hq 2OTY6QrhYfBXJk62ODD4y0gDAhyGWrdTY+fqNLkxUZTQo0ntWvhRjiVepEfA+7qzrLalwYj/ HcGMF8XJjoWEulYKWtsrPJQaUzHfFN+/t/Gs0JaJ4ZOCn2xBWuWkC1+Y0ZILstMdQhq6KBTu LSZRCJ65LDT2KhHggq9vAZPfSXDbodHR6MUEH2ewDPFH1XLhGGsRe/24KCHhQNDoDK2Eeq/n gZ67bpQKkvPYVYR5+sWAbry41eqo34c8QWhpKQUMNZq0XTuRbNyyeT9c202StG6tRq8IyXNW oYHRk8JrvG8FpPt65JGgdFc/fB6jd6MVFSr33HldPcPuuMa+dv34buRq5EGAjOGEcD+K/ux2 jKKQjEYi+HUHTJeoLrzQ2nYp1h5JHAcptvMgdhUgB9JZ0hGM4kwRCEaxiSUFjZrBvju85HB8 e78PiRbYg1R2ZvaGryxQEIz20w0FHvYA2Jkvds9rO3XcGZXSmztfkL+NI2OkgnououblvB0z fb49AXn5qXrpzBUn4miDEj1F+/P2wY30J7/D55k0soKfuvAXDhtpCGrZD25CQIRHvRiMcwXt 6nsS8iOcymUDl5lzvKAmfFeu5iT4mNXScKdjSdLt3IkTHrIxa7SmQG+rbWRsY5MkW4YbNCp9 xkYlEGdNMqTHRyyVxz629LGLNLSaRu3UeiAKlU0C4wd3liPdWXvJToOWU3hzkvAOVG8JRS1i BJGOcxwIcDa8g4FdvFBCHLpQIni5jDW1/NiNRlWCz/nQcD8ugQkPn3TDWmMvuO37pcJTyvCq v2kH0CvQo04o55mEjXgNXpEGIlu8jP+d8oN3cXvxijQytsULrqx8HV6RJi+2eElx2FRv0fow 4KRaNBj8CAa+JUwpvOfHwIEbLozAMD41oAF3c2dQePupffyB718h95y31OWal4l9rVlmJDJF p3kQ00iacekNNAYf8GRuKLt4/1jd15zJ5IdVQq0yNQpleJSFYJ4+Mb8HOjjDsZuv2fVIHakl xyZpmFTD9tkX74hAnbs3ecOLZKQiNGZs55LC8eDZLLuzKYwtbA5aoVLFE/MUZo68NNLc6BCz BMv+AxgJUhTwAdwnyNn+B8NPuJZQudU+1PmJ+XzrEbmC0+IA2fug+8WD5RGGDGKEfW7Ou5Tw N9dl8i/gmP8gUq48WyKy4Wh8MWOXRk7Zc1GkAuQGvGe5gG+53K1HuFtQurB7Gk9LnhhIOQcw hqRJ0RgU6dAbXe4fU6onrs/GjQT3DjKeoHToMfRws/K6pOg5xHZCtFhwrSHnxRSDI6tLo2Xy RDOcjuTXB4d+8UqNAGHdwmoEiMnnqHIMAPfQFGOHhlK8zrM03LwIymFKuDnDvibQCa8q+RWR 5rXyPIeKWLi3dnx09QQUIw0U42WRZoxAccSZ9uIYSbPyooTtZdAOvh+B+bBegZeG/vbLBCQj aVbBBAzmIJA8yOOdapWGSblCJoB76XobjovB5ntz6EuvN/R4y9YZvAIwukAjzcg5h7l5NsLc kgp3bT8O/gKciW0cJXTCvprBZSSPTRYaLt4G7vHEBq9qdNq9hdNeLGP5bzB+i0Ly0MmUnfYR Ige3ghUCmrPNU2C4FRTOQMEd2ijtB6xER9F8IKU5k3vvhx9g9IN3jxx+YNQ/k857Y5IoF8Du +/77Ewy+/xAyfMaelOGMPZxMpvHaxB1fbszak5SiRBJk97gvNI+EVkZ0dTM+D5p7u8VXx5h7 klKrRxEkjXnPKHoOMlx+xC4z44UafAENDrIVJhUakctZmm1LcD62y5SK7J6W4dJAnwtAgGDH 7qIwXx5FQNqGCe5blZ8wyHrfhjoh0vkunbB9VK3pcZgaU1/kFKbsMFqKUoHHoWUM96Kk0Por lgJczbAognf350pcTMMjTJ19frEZVJZhBlOfzR8WDeYb5pCLaEsuuF3+CURSOnU6kd4hPCV4 MASRPt75f4UeeRUNCmVuZHN0cmVhbQ0KZW5kb2JqDQoyMTQgMCBvYmoNCjw8L1R5cGUvWE9i amVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDE2NC9IZWlnaHQgMTQxL0NvbG9yU3BhY2UvRGV2 aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFzayAyMTUg MCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggOTA+Pg0Kc3RyZWFtDQp4nO3BAQ0AAADC oPdPbQ8HFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAMC/AQ8LAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoyMTUgMCBv YmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDE2NC9IZWlnaHQgMTQx L0NvbG9yU3BhY2UvRGV2aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50 IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA0NT4+DQpz dHJlYW0NCnic7cExAQAAAMKg9U9tDQ+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHg3WlQAAQ0K ZW5kc3RyZWFtDQplbmRvYmoNCjIxNiAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUv SW1hZ2UvV2lkdGggMjY4L0hlaWdodCA1MC9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRzUGVy Q29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvU01hc2sgMjE3IDAgUi9GaWx0ZXIvRmxh dGVEZWNvZGUvTGVuZ3RoIDYxPj4NCnN0cmVhbQ0KeJztwQENAAAAwqD3T20PBxQAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPBmnQgAAQ0KZW5kc3RyZWFtDQplbmRv YmoNCjIxNyAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjY4 L0hlaWdodCA1MC9Db2xvclNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1Bl ckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5n dGggMzU+Pg0Kc3RyZWFtDQp4nO3BAQEAAACCIP+vbkhAAQAAAAAAAAAAAAAAAG8GNFgAAQ0K ZW5kc3RyZWFtDQplbmRvYmoNCjIxOCAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUv SW1hZ2UvV2lkdGggMTkxL0hlaWdodCAxNTAvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1Bl ckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDIxOSAwIFIvRmlsdGVyL0Zs YXRlRGVjb2RlL0xlbmd0aCAxMDY+Pg0Kc3RyZWFtDQp4nO3BgQAAAADDoPlTH+ECVQEAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8A1PzQABDQplbmRzdHJlYW0NCmVuZG9iag0KMjE5 IDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAxOTEvSGVpZ2h0 IDE1MC9Db2xvclNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBv bmVudCA4L0ludGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNTA+ Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVP7WkJoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AIAbb+oAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjIyMCAwIG9iag0KPDwvVHlwZS9YT2JqZWN0 L1N1YnR5cGUvSW1hZ2UvV2lkdGggMTY0L0hlaWdodCAxMzkvQ29sb3JTcGFjZS9EZXZpY2VS R0IvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDIyMSAwIFIv RmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA4OT4+DQpzdHJlYW0NCnic7cExAQAAAMKg9U/t bwagAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAeAMLMwABDQplbmRzdHJlYW0NCmVuZG9iag0KMjIxIDAgb2JqDQo8 PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAxNjQvSGVpZ2h0IDEzOS9Db2xv clNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4L0lu dGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNDU+Pg0Kc3RyZWFt DQp4nO3BMQEAAADCoPVPbQo/oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB+BlkMAAENCmVuZHN0 cmVhbQ0KZW5kb2JqDQoyMjIgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdl L1dpZHRoIDUzMy9IZWlnaHQgNTYvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1BlckNvbXBv bmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDIyMyAwIFIvRmlsdGVyL0ZsYXRlRGVj b2RlL0xlbmd0aCAxMDk+Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVP7W8GoAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAgDdd1wABDQplbmRzdHJlYW0NCmVuZG9iag0KMjIzIDAg b2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCA1MzMvSGVpZ2h0IDU2 L0NvbG9yU3BhY2UvRGV2aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50 IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA1Mj4+DQpz dHJlYW0NCnic7cEBDQAAAMKg909tDjegAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA3 A3SYAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoyMjQgMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJl bnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9GNCAxNCAw IFIvRjMgMTIgMCBSL0YxMSA0NiAwIFIvRjEyIDUyIDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2 IDAgUi9HUzkgOSAwIFI+Pi9YT2JqZWN0PDwvSW1hZ2UyMjYgMjI2IDAgUi9JbWFnZTIxNCAy MTQgMCBSL0ltYWdlMjI4IDIyOCAwIFIvSW1hZ2UyMTggMjE4IDAgUi9JbWFnZTIyMCAyMjAg MCBSL0ltYWdlMjMwIDIzMCAwIFIvSW1hZ2UyMzIgMjMyIDAgUj4+L1Byb2NTZXRbL1BERi9U ZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIu MDRdIC9Db250ZW50cyAyMjUgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5j eS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyA4Pj4NCmVuZG9iag0KMjI1 IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDY3MzA+Pg0Kc3RyZWFtDQp4 nNVd62/jRpL/PsD8D0Tui7QY0+wXm8wuFphxHjt38e1cbNwtkOwHjUzbysiSY9HjzH9/XdV8 tKgumWN1C0iAKDRDsqpfVb+uV5++fagX17N5nfztb6dv63o2v62ukl9OL9f3/z69/HJfnX6Y 3SxWs3qxXp1ePH6s4dY/qtlV9fD3vyfvvjtLfn/9Kksz+KcoNEuyRJUqFTwpJE8zmTxUr1/9 31+S1etX7y5fvzr9gSVlcnn9+hU8mSUsyVmqzWO6LNO8SC7vzDM/XuTJzcZ8NrnBv8rmrx9f v/plkkz/nVz+5+tX35uv/c/rV8n352fJKdGId+u6Xt/R7fhhva5f2g4+aAcvdKp0woq0kNgM 5L5h+vvLi/fbfB9ITWQ6zRlB7Wu66KvGWRR5qkozVoa4TJjiKSsSlgHfPcNjn/NPh+7VMlW5 vx9PxCS5hN+LhE1P1CSblhOBdxX8yfHPYWcfwJJUKtWSYukkLKliDymGjfzfbFpM0gyamvKp nii8++sErjO45vCThWRLcZ4W/Cg9oLgiSSVmxQhzc/7LJNO/ToOSFabjC6qFgwVlqfGSp1q0 1Mq0zH1LYcRTfo66F/d3hMx3uuHFJEXG05xce95OUDnQaEipNIN+3+2EEU8Rw9K8OJIhlHTJ 6cX9bAVi7vzs/XdJdvrTbHWTTKrVyY/vpi/WWdCL28NjGqMSDeprnAQe8MUC8AWTfMhY02VC paoYTpsT+LhgHGfOWXqQRvLR1mb+cIL4L0YuhaZXsH30kuD0GBOpoMhdVnf3SxC9s7pKfq6m J8Xk98cF3HiYnshJdVet6mR6wicbuFfho9Ucfmt8ar0Kzq+QItVqZP/4JikPM0kl3PdMUiME 2O7iOYPeSK0mKycHz9Id4gVPJU2dBadXAh2S3sGzdJeeSMviiPSaVeEnh0Dt9qGaTVk2qRGq TOXkDlbE+soMb7VMcM2szPWVvTRXuETw59H8hU/fmwt83wBUfCJ0M0SmAMCP6zbfYhEBFovY 1TR2reQFApTd7j2kGzzUcoMdCpLcLaDOKoHxqG/h9wGl2AylWHI3VZM1PHGFj9mRvUbZNs3t oygA7avVYTPRwzszXaXonjKUf4Kfi2TK2OTcbCRye/c8AX43U2EmmblYLurQnHEuYLtGsBa8 IzjPUyYoctjIBzss5uoP+PliBig8GwaBZ+SA2EmymSMni484Jcw9befIYsrEZAWPbE8ZlAQt /9WmwkfqBPXocgYD+9gOZvgJJnQO+pRo0HwN3K9a8osrZPmh/TsxUgs7HJ9YfoH/u902bSXd YnllG1cn9W3fVrvINtPmLSMxDbUr20OB29mIHK1Tvgu7Y61ezVLJSarQg/UDNLzvwxs7g+rw gsTogCynWJltNkbQ4TS76+ZjvVjD+Kz60W5Zve7l3oOZAt30rFOczSiBcJgX3dj2V/W6myaL 5fLRwse2JwBoBl+zBsMXzN/0BHsF9g6366fghA1Mykqqz8O302ySc6Kde2ZbeJHCs5QLcq2B FGyVbmjKQqaFpihbmfO7mYc4YRfYGdUd6MwKJU8viRaroSgDrAfi7vziQ3LdSbCZfftpDVsj vPMpdJtkkaUlKUOCd6EshNlKkHICRX/1LcIgp2e+BBfXrADIeqxWN9ohVz7Lx3zWiUH8WVv9 /BGmTDMvzDxBuVnV2DMfe/wBMq0Xig1YO4eH0Op7CVNqB6slfjxjft6Y5/Gj1Wckv9qPLnqp axXLatqqb/zu45ZoHwF/D9u5euEHT0tG9XwEtKNSKShyMBiu2gpN3LygSor4TTcgDcqCmTUY GwsWL6plNUflnDsD/uEBhdC8svtM4VfZcdaNkinnOy0CUXlp7UTAqp3cqODNvZ9hJv4Os3ef MH4Dd+0iWi6xHU+LiJqLM3RBEe1BAL5s7Vs9NoqOXQHA5CXFFpohkJEZIPDc8MlyZ+Vfd2LE s109kVubC/OnlXb93yjLZpvqqmsq7Hy3BI3et382DEWVINJsYMqC6pzw+lGXqRhLzmdSkVFN KkKAq2nI1tvgJhVDhibXSp8x+4kGUYTf74C9gORwuYD9Tg2TOqcQH2xe9+zLH+1Sa5dJ1PWv WMoZ1RZc/5ZH5GQ5+4hSdLk0zWua9M1BLDGPs0hkMs1Int6uVtUf4WkKhrYKP81dn+3h9FTK yDaepRbAycm5+fcwuealbhaZIKn/Kzw0ylJFkjtsAnnJSQRDfnK93n+6xcncSgkzv/+FEHsx PXHxkcXYqw5D3XWqy7waWgXAwPg5R3dkifaENLzqyQvQOUSXfY/dgMLp1koh1zYXXsA2Codz 0xf+nfY9SMRt4Tkw9dnL52xPSesvmYE8s5PAJ67HWfD/6r60qfAvg3kKB9J87Ceb/RRIWIRR zTxE5i3Svmp3eQ5pAEiPHUq9nebObssaQHNn4/jQWkYHprW3qw7g48N/dPydeUxpSGrxOY4d sxlrlj1jI66N0Dc819ZCQnhIzC/sDM76AXYRamGGWjfTw/aw0xkdwBUW3wYHk1zIVDKqpSPQ nYqD7oywzCHOpETLGmXCVIc6lnfoFtxIHILuoeDap/PAgkm1MxaqYDwDRE/QDI8qGBew/yfH 0ny5CBHN4qUt0LpHtPUSFp0FM2bJ7YbbHezL1Ckj2n3iNvzb8LuBnO8ZY1Sdq05H3Hf2sd6m 5mguqwJimB60iLPSvO5UQ0dR5Fwz550VvIu5NThtmwxnYFDsLQNPi+UyvNmMsbQkWd11Pzaw 574Bf2C9QJuTGhourMPputNAi3mDLHtDamgEx8SepjiYqFf4thnW5gSMmT1dcFjJ9qyNCCjW 9MEI6fc0C+5UAFeKIlsa3jJltGc5tmN9YCKPCyZ0kZoPUGAijwYmfHRjggk/vbhgwk8zHpig xvIYYMLf1m0wcVgIIg0mvO0+Epjwt/uf4cmVKLX85NrdPQQfDmz8T+vgqCHTqRJxVrCXnLlF ktt2qAbfCJZgyCFIN65bb5yd13e7qDaJ40YGkOIYGXxW5sWqM03POlNBu9VuzQLbrqjQ6kvw VCmqC96EJ6fSTB9tbkmh05xT5GBA1+1IWUvS/LZDZ/uHO7ee+qQLgpptkhkuyOCNaDVcrsFS vOPkqGbWqpS7UmKGAYm/zaxxpZltzXW+swFCM1v42NGMgZmF4Du8VScTEABGkBsBxHRcIAbJ eCUJxHQ0IOajGxOI+enFBWJ+mvGAmJ9e6ytyIdFhuUM0JPJz8G3yfXhgUqSKorfliQhNuJAQ EkdQpgKtRmrr4LEbAgLGCV57TbE4LPvDR7nQ4DWOssq95Eo0YPnJkdGny+C7fMGNuCEZiRDt qlJGDnATH219Fm68wccupC88R0bPcU0uTBui6AcHYCGLEykmOQa/Ud3kOIcqa1PMd2FIFJeP hIzLfOR08YGDIhI4yNIClLSBxWYwh3z99z8xsi64TC81JhISVMMD2BLz+ghy4Y0GmdljcD+5 6FYDSA8/WsdCAqOkWmq+LYXAdr4Pvm1knEF4wtEaymUqyBn0w+IGhO1jv8FGEXMWQ5CAWYiR nIRHe0bKs4IiF3x73lqhjjWsmgOW9VNzIyOCAzZWFqnWFOnDNg7evSmHvEaC3Fm7WbDwNYUm 8zgxhiJHtOjnwyY39Aas8GAVik6QvR6+tblMeUmR27+DCO7eNAJMUax8CE+uhBQpgtxOyknw BK0CfGHHGmYhMwgYJbVgp+7fhietslSS/exkQz50CuqIWwSZWZ+6nzsnRS+8B1yilfdIE0Ay LJ9EStfgmxyRMpLcctEY999YQ+ymyYUOH68nNdujrMM3Wxd7oEjX7GSxiYZzOVaF2ROaaCM8 bmzCSxOX6OTm1+up9i/INl7TJsdUTfEbcLtcL+Zmc98Gl0BCgG42sr0nblF/GURAzmrI6O/8 CJal7ZwIdzfcUiwagm2O9ImTvee0w5UZgy8NzF75jtMi77qiDSrFj1t7wWPnGNj+cKTxZNwf HiKkRIF9+VP4jYRCO4CP8i8GCMy3jVc+B1weYVNRYOkWgqsIllW+pxP6vP4ISfpZhj4aovvD k8tTswUmyFUPZiw/9wFkEcLvylRoivygqEKUZFSuxB4OjouAM4HeQD8rTV7rH9uC7V14ZJqj t9vPxF8bLbBVzyK42VbhRuBISx2sxAU5ARZ3MOCNunByPyn9oq2CtV6f8I5uKRUE5FPM1smm qiGLJOl0d6+qbGrQUUMnlJAp2bXBdYQSGvKCjqYjGhVtBLYncuIf6FJ4gvIERSM9+2Su4IEE 4PIET6Cfl0iqCkxhNNHgqopBzYKcIme7+HOXJfQQxXsDRjEI/PLz0EY25W7geHiVqVKmKRYi aGgNOfcEuU9bbX1yyqHMwgs/ntswOD8rz7q7QYGKXf0Zo8CFMi+QfRapqEYuIW2VoDkbxNcN qqlEKPGh93EDC3Rex6xgIcEdQg7BdgLEx05o2DC15XW38WtSEYsY9RMU2gr8DLr71fBmitJA PFJud2aK4OoZDLwU1fBggOXofhslJn3u7DJqrBtkmWd00kERK9bNSzdirBtBL2qsG0EzWqwb Qc8X67Z7eEGQWDeCg2ixbgS9samDhGlxFh4rgd9Dx5n0XnICvGkEuVimQq4KiKwjqH5tFGAe 3/elGDgHjjUoQgnQAAS5OJmamu0huWrrIIRHyHBKRklOBSfTwpaRoJJZu0JaXVGHKN3UQCCC W289XSejtdvk9Vmt7Qux8guEWWnSG9voT6BtanMEN9BDsBjFzCw4OSgFwSlyPYr2p+qGT9Nl WqOS9/MTIQDH3PJTi52mywxOzxnV0vAulrKECJxjdSzkvuSKIueUTgYA0cmmq26lV5tk1RXV azJ3cPrVZv+inGR8x483i2Czl8A+0QpKt+axVKvUEGxxrCEU0twiG2/VzQIG46Y3Qg+KHDku 29nyCe1nX7Z9wP3oYUGcT1ju1Sly1Dt1myLE0aS/NMp1162PvuF55xruvN1x4jsJJoKH4zGu U01Rs0EDUMLUVn5qB3d+O218/ot5telQfdKcAtIVdehLBN63WKiJbE+eOi2PvbmExd8TsLDl U1dwOHwZ3qyAg0KIdkeIectwAY0i5zNSsBBHYO2xUvA8lcNwkt5KUUazUvjoxrRS+OnFtVL4 acazUvjp+awUMpKVws/Bt0nwsqxNkLZ/+p444TMRArHMpqYke/tpYZVWBMdUDnWMCLKOEWB6 UjqOyKbE9KJeQEXBTWL5a3U1ajVPIW1HJ7s62DU13IPot7rws3UH2U3aJwQFX6wuCO50YGDz J/pgUFWw3+Ru6SRPtlV4H34JtfwJNp1K3842vNOwDxY3NmzagbixuKOYzO6hERY1z6PBICbB C7ez73yw2Bt9J034Q2fwu+pDiJrSjD3sA+9K8NKkYKaEPvbzuu7gpw1hqcNniZipmJcU/Qir X0LSAjU0g8LIg7AqG2kdoYQk7grGdYEX24Q4RpPGNtz0maJrSBpkFhzcaDws0Es4Irgh6EUF NwTNaOCGoOcDNyoOuPFPp+NUYCJa/377ZIad8i3DY/OcKHF/VK+jm2wsmV8bNYp/oI1O8Ng0 3UOOL93XfCczNNx2Xnm8iWQaTQM7w62yAdJ5ZruIUFMv0JBNO5oX9/gINnFxjZ+Yz5a2rm7f zkVwt7TZV6vnZM8qlu7mhfCZ2oNnt5RmRWQkuaglMZiA2AaCskV0Bu3OwnszmCjBQENQdtfa /gj6InwYJtT9UZpiLTj4gZjyrKTIRTAkF2AmJ8htHbMGMsvGt+i+OHcDnrdSU1Bc7Q+VjRI2 xRXYg4imdAZkTxn5CPFkBZz5QLCyk/9j03HCp+cVkCV3rJkkDehTZPf/OvGoqQ8XZgj+69dp +E0inHfr5QTTf2IdraDgpE6qB/YCirKdm4/wn6FxfwtrRFJucMrorhviGVQTXAvkYHny8tIP 3Jvw2kcyKONH9IGFa9vjo30HTIAIXMw/dQ72OoFZr8hZfyKH8AvdIVbABhf0hYRcJaKNw6NS FvPbLoMYvUP1Av5jHfRVm3PaMz7bgGnsmeOaHPNX8KKikhdpMaJ5zpEfZm5LVFC/PXbZk/ZE POXwG83o2C48VfrcF3GrU7ASBZWfdAR3GJydTpHbqU4RfHHva2wEa72ERAuCXPjWqTwtSHJj DEU8auUpKIErd88Zilx5iqAaq/IUQS58tR5becpL7jiVp47VsU16GEEurnCUGQTWEaTDC0dp 99x+cr7SPeFtcFpB6t/RxlZrtDr6yW2Dods+PaovZR3crsRZAR4A/7qKaFiCbDStqZ7wlR0L Hv0swY323OQLHnjPc2t1oDo8FtCHOqo52d5ZeIc2oG66g0dk3bUH0djiGsGjuwuotXKshS/y DKpjkqOeRSykZM+l3C9zgtMsoYQsNdlsvJ7jWYx4wjZUMCrDTMMYkZeyzFJiXsQwVJX7sMW7 7cMluyD+RVMaIBLQ4Trd3bbuemPawwyD7yIyiIr3c2HEIgakNK6jBLbN18E5KKwK9nIQweWf QZlpP7WtwknWRuCYv4po1i8OoS0lwVT4CAOFQRajOty7bxQB9o0ygUpuctvJh8eEgtfFc3jm GfQ8+qW5EUndxWETxMeFkRG4s/OzEZ4eyAFBkbuolmbmgS8WzG/rFbbYXEJSfjmZWwExhYgU kF1GkzzWaOCCSyzBcphvwcdvY+Qe1z/e+RP1CHsoQUUI99nGqUQzMPbZpe/UVfSdBNymTTRH AdsAbRtuljvRZn1hNStJZm0kYPVmGADYHCD87BnG7omJ/TnxFJ/bJxYvreUTw93e2Am0HYAI kwwDGXZMoE3xJE8so+XYqT7nFsOLlLHZDLDOPHKrO7UeB+WbD302prVcL4M72VhWQsSqn53w xgKUEn5iP0MQ6m995pjph29sxJqbBAIO2i40so8AOb/4kKBFrsL5bdNubNiptF/+HQYW5+YC M/bsg1X3rTh19SHGP2dEiyNkFAg4hcFP7S12Ka6mBS6R5rRXjHsJvlMSsFPyMRJzewxu64Ka X66s6KfQLHzjZaYgxdnPRfCCadIs4Ixqc68JYm7OeAl+ej8HYINZQlXQ3NEljmGmXcADY1nr oYtQSKiRv6qE4DlvPtdnTDGyh+ZaSQzi5RwnTq+4ZvW6C3PvBZGNEzg/n+oJeEhj7HUMcjGc Ew247GWbIwSD2/0EbD8IFsaLW6uDH5r4nNBMlljckmBy53DnKrjHGmL8NaMYaIsp2nlWXbe5 cG6otpVY3cGHHjtHEascJRxECEKMWibByZVgpibIdVm04SNeZEo28j48NYu1/OSOUpoLDn8u +N5+7rKUW8gZXgJnWMOAYGIryTuS8JcanM77ZEJowto8yEnKfbDhIBr6btqX5o6SOcaKVFNc uYgJNOCmnuEeDGyKVmpfbenvJsenCn8uBqSRkGweeKYz99HTEIVD0DswV8NHj2dgjBhHrzFG fOgtEao3Ppw0rOicl+iSyJj5uCZ54krDggA2DA/KSIaCwYPCgAyZzA0np+/vZjcV53ny3Tqh bCHUGe3O1zgE0GhrGoPfnX7x21QhH7uUvpioH9CqfdO4F0FnDk/39rJKnWJ6GKtcsLQoKVb5 CL6oA9QO5UtDVWkvX+4JWMN4Cy+LVFG8A1mEAAJBdd3547JGm9Y9KKITA4U2z3PKqcT4Azkt SizJ4uf0HubjLkjx8kcltx3Gn8hQbNH82YViMcYXOI6Zcbwzt9GQta3kA3fntT0jol1bI9pE xWF9RZu8ab0SzrQg2vScaOSi4YPBS7mGT0kj3BVIxLSEw18KA8k4cnL9F5Dk5omn5vvPvXCB wv9rRa75DsuxdYolEGefmx00S1Xuilsm94hbTpmet75m6UC5NT4y8gzi3WSOJqQXGMS5imMQ L1SqCsOYxANNvfYFf9FSL5OUpgoQXWb2LwSTz05T3U5TiALW5jMa3N3mKxD8aeaehHgTmSz7 GxD5UOINmKS+G/0rRo3K7qPOE1xD1QDnBpwG7xIZ/t29cGtXC8OlkvJcm4lvvm9+dV4mP8Pa +RM15cI3JMXLQZU0t+0KN+jaXDE470villoWW6Cq2LfKSXVrPmfWNHzOfFziRw0h8zsqXA/r qEtp5On+Ey/+A6wT7PklJUhlexCfWqWaYvO59SRYu54KOwkZzpfcqG8pk5ylpSgJkf/cGy+T +WCXLqzMB99eidPBiOmSbwn9fdNB0PrV/RxUa/8aG57McwgseoG8FyEc6EQlulJjDhTbn0o5 gsdITlrYsBnxQfB4/h6Wjtcw52UymOIsBj7uLIfqC1JISGwbcvlhKjqbkwSbkxwGRnmZDaZA h8yKbA+zY7qR2tkdzpmAGEiCs7cjOAt2OPaQM5nB1umr+syRkmXDiczR7gCnEnIH5jIzHK2Q fPXMMy+GwrwRixlcgaIHUQbhzFt6MtsjGCWlf7a+ZkhB0ft0ZISdBgMl2GuzFyWlyEjVS2QB 9mppFKvaxegXFS7n9sSu55mMlDmjGEMs7OfyuVkp2y0bHIZblhbrSQCQHI5lKx002N7o8CJs gPPcc6N7RXBEZM1HnScADwr3hgGMqnSp7NzoXhmBhv9UjfHhYSlfjocVc8AwhzOtcw8YFnsX OaUj4XOZbEGm3e2OBplcl2AdGwuGR5jxJKUeD+JTZCWE/b8QDct2dyl4aWW4AscoVMkzOGsv Gn7ujQBoWBi9j1IadcFYNCwplQqfg02H/Ryi4ZEGEDhDB6w9uYANwEuEfqRDQ+D8ZpQdAk7G OwwQq0glQ4WZFFxTPH4lIFbBtOcALwkJiMUsQgZhQmEAsQqmRYfMgqAkmR3TjcE2aDucSQhs IDh7N4KzYNuyIWdgayY5e05QqtaRJjMMrwfFykFZw95aCouTUWu2N5SG3Ee4YXaCovDc6F8x V1nRfNN5gEOpD+dvkaeFcmns3GjfGAE7/jQN8UEOlR8COUDq96hDQmUo7kMdfI+WUdSW0vmc 1ebg2h+rzSXHNLKxqEOMWE+UNjyMT2Vx/HjU8f+TsC1JDQplbmRzdHJlYW0NCmVuZG9iag0K MjI2IDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCA3MTUvSGVp Z2h0IDU2L0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBv bGF0ZSBmYWxzZS9TTWFzayAyMjcgMCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTM5 Pj4NCnN0cmVhbQ0KeJztwTEBAAAAwqD1T20ND6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHg01UcAAQ0KZW5kc3RyZWFt DQplbmRvYmoNCjIyNyAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lk dGggNzE1L0hlaWdodCA1Ni9Db2xvclNwYWNlL0RldmljZUdyYXkvTWF0dGVbIDAgMCAwXSAv Qml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL0ZpbHRlci9GbGF0ZURlY29k ZS9MZW5ndGggNjI+Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVPbQZ/oAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgNcAnGgAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjIy OCAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMTI1L0hlaWdo dCA1MS9Db2xvclNwYWNlL0RldmljZVJHQi9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xh dGUgZmFsc2UvU01hc2sgMjI5IDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDQxPj4N CnN0cmVhbQ0KeJztwYEAAAAAw6D5Ux/hAlUBAAAAAAAAAAAAAAAAAAAAAADAMUq1AAENCmVu ZHN0cmVhbQ0KZW5kb2JqDQoyMjkgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0lt YWdlL1dpZHRoIDEyNS9IZWlnaHQgNTEvQ29sb3JTcGFjZS9EZXZpY2VHcmF5L01hdHRlWyAw IDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0ZXIvRmxh dGVEZWNvZGUvTGVuZ3RoIDI5Pj4NCnN0cmVhbQ0KeJztwQENAAAAwqD3T20ON6AAAAAAAAAu DRjnAAENCmVuZHN0cmVhbQ0KZW5kb2JqDQoyMzAgMCBvYmoNCjw8L1R5cGUvWE9iamVjdC9T dWJ0eXBlL0ltYWdlL1dpZHRoIDE0MS9IZWlnaHQgNTEvQ29sb3JTcGFjZS9EZXZpY2VSR0Iv Qml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDIzMSAwIFIvRmls dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA0ND4+DQpzdHJlYW0NCnic7cExAQAAAMKg9U9tDQ+g AAAAAAAAAAAAAAAAAAAAAAAAAACAawNURQABDQplbmRzdHJlYW0NCmVuZG9iag0KMjMxIDAg b2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAxNDEvSGVpZ2h0IDUx L0NvbG9yU3BhY2UvRGV2aWNlR3JheS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50 IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAyOT4+DQpz dHJlYW0NCnic7cEBDQAAAMKg909tDwcUAAAAAAAAcG4cFwABDQplbmRzdHJlYW0NCmVuZG9i ag0KMjMyIDAgb2JqDQo8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAxNDEv SGVpZ2h0IDUxL0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRl cnBvbGF0ZSBmYWxzZS9TTWFzayAyMzMgMCBSL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGgg NDQ+Pg0Kc3RyZWFtDQp4nO3BMQEAAADCoPVPbQ0PoAAAAAAAAAAAAAAAAAAAAAAAAAAAgGsD VEUAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjIzMyAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1 YnR5cGUvSW1hZ2UvV2lkdGggMTQxL0hlaWdodCA1MS9Db2xvclNwYWNlL0RldmljZUdyYXkv TWF0dGVbIDAgMCAwXSAvQml0c1BlckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL0Zp bHRlci9GbGF0ZURlY29kZS9MZW5ndGggMjk+Pg0Kc3RyZWFtDQp4nO3BAQ0AAADCoPdPbQ8H FAAAAAAAAHBuHBcAAQ0KZW5kc3RyZWFtDQplbmRvYmoNCjIzNCAwIG9iag0KPDwvVHlwZS9Q YWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250PDwvRjEgNyAwIFIvRjIgMTAgMCBS L0Y0IDE0IDAgUi9GMyAxMiAwIFIvRjExIDQ2IDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2IDAg Ui9HUzkgOSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0g Pj4vTWVkaWFCb3hbIDAgMCA1OTUuMzIgODQyLjA0XSAvQ29udGVudHMgMjM1IDAgUi9Hcm91 cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0 cnVjdFBhcmVudHMgNzU+Pg0KZW5kb2JqDQoyMzUgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURl Y29kZS9MZW5ndGggNzYzMD4+DQpzdHJlYW0NCnic7V3bbhxHkn0XoH+ot2UPrGLdL4PBLGzZ 4/Fi5NFawg4W9jy0yJbUAEXKZMu2/n4zIjKrqqsyIrKrqunBYP1AU83oOJGRlzgZebv88v6w f7u9OkR/+tPll4fD9ur97jr68fL13cd/Xr7+/HF3+XL7bn+7Pezvbi9ffXpzgI/+utte7+7/ /Ofoq6+fRz8/fZLECfzXNHUaJVHZlnGeRU2RxUkR3e+ePvnHH6Lbp0++ev30yeVf0qiNXr99 +gQkkyiNqjSujVjdtnHVRK8/GJlvX1XRuwejNnqH/2rtv759+uTHi2jzz+j1fz198o3R9t9P n0TfvHgeXTKF+OrucLj7wJfjL3d3h7nlyEblyJo6LusobeKmwGKg9dbob16/+u7Y7oVoeVLH VcqgneKik+o5b6q4bE1dGfAiSsssTpsoTcDu3uBQOX9z6L7axmXl9+Oz/CJ6DT9fRenmWXmR bNqLHD8t4Z8Z/nPs7AUmFWUZ1wVn0rN1oRoBKsVC/k+yaS7iBIoaZ6uCt1mcZRx4ieA/GffW xuPm9wx+JGsaUGZZ3LAGrOroMitZqMh0zNx8ePXjRVL/tFkVNjf123AlHPVbQstMrdS5Q2vj tvL1uAApv0XdF2VHFPXEDbMh8ySLK7aLe51QVoBhoco4Ab9PnRAgxVSL/WKgQTigRpevPm5v YTR98fy7r6Pk8m/b23fRxe722bdfbeaFFGhM4EaPaeZ/6bh2noHuPM2wgp7Hi+KLD7o21ZT5 sX/0jLBL4ZpUgItWh0vTPM4ZtJf3d2/3MLzdwI/dGcCr3MD6wX/Y/fzJgBcX97sPm2eVaVGH 1fGzssAu6DXgYX24ioaKR6rarKrjtGbgtrfbG/DuZ6jaB/ixp9/WtiI3ISYJLLRvREnXGVEK +NwzouRJXPkG/CpPVxpQJsh1YmIuA73CiDLFa+IyEYpami4ARY3T1aHbJE4LtqiLm/wEz45m frivoYFvD5vyYhvBry/vDUW+O+DYZn672hQX+A9D/Vc3LEvauEkDHeHrBtk63SDz9QEzicqb iVHPY5xNxDi5iA3ZXtw8jsFBOmHRF7eNY7A0M9PShgP7+y87KOT9L3vTOHZQ6l9Xhq8NGcsC y+qr/nyF6s+JnU4bQAVMfmKVmVtmF9s3m2f1xc0OO8xz00Ni+HRZS/DY0VY4TvgNWdYUfGiN 6YQc2tUdlPgW2sNhu8f/P2zMlA+9cQt/i2DYgM9/gR+7+01Fv+13mzS9+BVdhX9/i3NF+OLh PcRa8GIBrMrow7/t0bHZxQ/GsbufQfcnVHQPHzraAx8fogPo/gx//YioqGr78GAa7P4d/I6W 7q7JQIC8g0/x190WwK42aXLxfm1f5o2JZvlj1VzemPG9ZNC+3h62ncfJy4fd1WF/B35cNqR7 TCmKEuawj1TwomhizstQ1GfNoEWtjW0IRFIx4HrTXducMmsf0fF2hKyLuJ0O3G+7rn6/Nm7V xEXGAq9eTMNJ24KBA46YGo8DR9yuj1zHbcIWFIPQ3+DHq+gFeBvznvjpi9VNAZLQsqZAFMCx 92Z/iD6aQf++q/3fzL8+r24N1AlfIznWxxfrO6HGlCDjBIqA11BoHGZ/fY89/UD/g1A4jDjv u2g0L+jtH6KH7WH/YNTSVyG+WQjb7dx4j+EPPzssm7H5BsDERB2mKoLYW3FW9lYWcTGdU/zD uHcP9WId9A75ATrW1JNz1qdjfoN8Aj/7AOwBmzsG0PzCMqG1W1tVQ1zzF2H9tl212Lb9cPc0 EzQsCX21RS9hUwcaWJhPq/VNylIzIyw5kw7YKbpKWj2WZpkJM+mj+T8z09+Wre6fLnCC/hBd 05iyNSPFNTAbbJtUB/grzENuNqmR/QTNGTxDfLiboGQ0Z8WpivnNs3qxlIgWRZyxJflifbgq rtlWsj7NLto4qzk4EwMKFwLWBq7MRLAVgDGerA1q+K0ACgPCdT8U4HBo4832Jto0dtxgIhl8 myaTq0clQxFbdvg/wywgBRwGjnjA/uo9xee1sc2Mncc2/MBOf/8DJsmHc80BjHw73WWAgXJA i7YHN2i1F2/gg88dWRpmAR6dTZrWkjdcIVYfsCx59aOdgbPmZrbEwa3e89K6wgmxH+69zc+s DdqYWTjrUnmeZOnDoL057nxn2tpv1ErXjvVNGmfpozWBrMlhbY2Bg9LjRALmIGuHj6QQkPe7 1TlznpZx/XidK0/NyMFW5HBMmw6FmHrDhvb5HOQZInfBun6SDzSj8lkTgglMDx+rWooij0sO 7cWrl+vTDWmMXb94VYnsRhjuiGHRoGai7rnCfp5CuU/Pe64/V05xYxpj0PohPC1gEx4Dt358 S+s4q/xwuCCP+a7r3fpJv0ooJqWdVh8r0rwGeuTH3HUzDu/E10x6SzfnXZ1jtJiM8NtVrQ7X 4vYbBm44kV+bLJiQzZczIKFXrpDQS/lceJrGydQuuyC7dIXHg5smpg9wsM9NRZhpVfrH1VGz EjZDMLDrFxJyXRkHZ8gCujcClvDS9LP7DU7Hsgu7QeRZe0HUAeea2fr2ZUkZpzln35FJLo+O 6RDYKAdWQQiqTQiCjXImCi0LPx77cmNfybaS1d2RJ6a6Sg7OBNrUBOBlUzsfqokGOYv6RbTd 2Oq/xjZwSysOyDI/7PD/y+Kwz6Q2xWTcY/ndDMoJ2wzfQLE/YydZuBTogS7SCvcSCMMfTXE3 GA9NlHzx3esXkZ3aZrBN1Xy2x44cfby/+23ZpNZjYWlICj+G+AKHwawS3H9XwhGf1qgApTls RxpCjgJMxQSYIF3WfI/9VYk7X0oT59vWQ7KMY2id94fddJ68ELtJeGx2e7mBBdrbdrAwLOS5 6r+a8V+YMr4QkIUx32AK8fUWRl4cBrYdf3sJP8zs0+4u3F3BT7vREKPJtB8ttTIrcVmHsbI3 iN8ystgCA12zfsK93biv2xAL38bupfB5gSmSk9takaWwzmJxzYw3My1Wa2sN09bClPGFKDLD xmuuEC8mTluMl7cwzXo8vAIJWVglrYFXJtio/HiXZ8DLY7b6zlG8CtIDbKdfHa/KYDWGbS52 znp5hpKajlGa70P2r36MkuYldkQ/3t/P0DEgtcfAncGdRQVsxotHp6scKzhHXRoekT9iVZZI 4Bi877/EPPY5illglqmsqrj17OA8QzmzuKk4vB/OMBhgio7BEwJuU8LGeItbtEDHtXjbcvE2 RJdQhLaFE6zCeAYTvPLiP6fOWwZcGt/nLDDju/4g+1fmX/gFqILMtDFTDqMuiQv7A2x4+4eg vyO/p7+bBpSMBICVlQ2vAE7fQCOgv1vWdiQBzSxvhxqSJJ2KNLUTsS3xWMK4Ox2Wo27bZioC NUIipkaKkY4yLwemenUEiDiPUsXjnwb1PnQZL+Fc0kuAS8ZCtsidENoyEnIGi0LjSWmR9JO5 zHyW8f0u5Q73huiSNjqnxr4SvuZGDmz43wB7wCTw1y89R9MWgbZ1nCY+UH0aSni2cWse4w4v BikTliwSbN1+l912e5U+dts897BbjrYhPThiBmmT97SL6QY/GO4KAMmdGVwgHLoTMW4T7vWm dmtc++3N/vCZ0qFuT25/6gUXKW7dFr39Yf8LLpKhUrtAvI27eTI/CZ3npdxML4C1nVDHLgoS oB17tDrmTuYFKROWd3Gv09R6fh42E8jMUnJfV1gdqMLly5Pqww7jBEiBVasO7qRciC5+KTgh +jax/X9ZMjAPx0TQ9oRx6ZgFDMJRnnbxGaPAOMaTSBfjj2QGMYtT4yI9ifSR/khoENmsHhvs J1IQ70mqj/fHQn38y9NhLJ5IWR6Wp33UP5IZBElBk/MkVSK6oK/DoY9YAVf4XgAKP5Kxpepk 0IZjGWevJDOK6UVbwBoGhcQCD+Tz3YU7mhCiS43psN2bj+nTW3sWgbqYPgFVY7rFs81Y8xi3 9hukTIzpwLr9LguN6bQD63N37GZ73W/V7iN80wd4txcKJdqjQ6O/YYSHsyKF2+1889kJ0oFX wN2/AQF7QphO/NDJiS0lukkBGotHGPZX3XGTIV1gYv9Cb6Yt7A8beHP7EQy0GyGvtlj+0pWf lvWQluCeSeONmnMcw4xgL9xSakQbPt46NGRkH4wlU2vpdDbs4cRNSJ6dz+u4ManjNj3Fjbbu oVRQOrxkJBZJ3kwLsySL89pjYcjNItwi23KnmShUtFVcHpn0/d9fQ8Vih/4jXN1WEv/ed923 /41a1oduV2XvX+iDVqg/sPS2+w0/oz94z4JvHyK04p4Wqdx3qf1eYSf+8hbGhC0AVdQ8O7Om p6rdOZu1KzY37sMgPvaiyt4toGUS2mjOLRQGKRPYe41cdzSaYzbVHaV9yWbh5oKWLU4ZTgiA ljFZQCKrmsfY5a4AXSrBntjOEuyZOJZgh/rIT7ANGdMINonIBFtQ4wg2iSgEu9cjEWySUgh2 p0ok2CQlE2xZk/WkrUR0QV+HAx/xArbwAwEo/EiGStXLoA3HMtZeUWZMsOu856dmtBdy1SmX rA5QpdHroilGY+MRvZ5eJLUE07LrKabOrgmuT98I7sq4FGOILjUi+/21er6M+Nth9647/IDq Dn3gHpFBw6aKAE4ae49QLPJMnqdxWp5Uqy5GEV6fBJJqlUuDhujSMmRge94GJa5m4lCC7Pw4 lB+b4ujhm/C6XJNUFWy2UlelBe+p5XzwngVDsTvYQd7YXbQ5RMNu8QqCxih2W5F+AWwo08Ul Xo2N3VZksAw2FOrCV6fHrYSNpcyfrdRgMexIyEU5p6pbqBpLIW3KSaNbEhvKdLFQ1OQ8SXXI J8d4AVf4XoBNjvUyfHJMlBnHblPyJnfBzwydQi4543LJIbrU6G1qU4zeZvLGXLa2CN5E8bj0 weuBnPBciFF8xyUWg5SpoXxgvWkBVY0L5vTbCZGdi6UzbatS2ECgenYFINhYNsUJZijH6ZtN mnlyS451vIO93pQt+OASAhEdQmgGuj8QuWkH6Qq6L+EtJjau4GT+FMSdbVrZP7aRQM84ChR0 ncp2kHeL3tBdI7/irY+72z5zileL0OnWPg2HmRCXWGnJg1u49eiwv9p/7I+/ImucHltaVqys ruOs9BRLJ2sE6AiJ0nO5BHeQMpWuVXkwjZoJZPna+YEsYZsA6YSNAC39UaqDy1KG6FIp28R2 nrLNw7GcLdRHfs5WZypnIxGZswlqHGcjEYWz9XokzkZSCmfrVImcjaRkziZrcp6kSiRKlrtD L0MfsQKu8L0AcrZjGVuqTob42JGMs1eSGXO2rIqzbo9Pji8a8P2Fy+gGKVNZW95v0uOJx5TE 8Wud88xxLG5gTiiLI0AXfDRvctneMG1qiA5y52weN9c4S+Q043jeMhsYiZ2G61Z510Zv8AKL 36HYDex3V3GZRdjRWiQsaQ2vLFxAZlcuJpwtzXK9nJ86jmxJKDT1913L7zOKuIh87b8TbaX+ mfX75PmmOGX72/HGgtFNWNv+vhgsSX+/2s3uzaZ092B5z/4vLFmWN3FbH5UslEUToqOJ2sjJ blMP0qYtLY5H/tClxbmotLZ4Srxx5IUQLW9UnJZz+f8gZSrbnVj/Pct2ZwJZuhvqJj/dBdRS XF60IuLyoqTG0V0SkZcXB3qE5UUrJS8v9qqk5UUrJS4vKpqcJ6kWOzZbTfkuL+GK30s4wltN GW8n1LHZakp5RaEx502yuK4HvFDqNdz6SogulfGmFdzDcBrj5cjuLEPgScwswBB+wXMWrKPY A9hQik14g9AkVR63IhOkTA3gQbU3m2DPtM3ya802ntXMxUV6rcGON1EyvHN4853ll5jkfDjc 73qGGXX3tUzoJe7XrEX2VE2ugEIySAx2mMZc21O29Zgu0OaCq5DWqdnTypM8dX6lvaLj9Klj tzz7m1euzIQN87VhuULJHwEOiJPUp9lDCCHKBOpX4QRtNCIdUz/2OPJc0BLvTD9lGHRxnAB7 DiV5jFsuCtGl8r6J7XyWcx6OpX2hPvLTPniLVd5VZkVk2ieocbSPRBTa1+uRaB9JKbSvUyXS PpKSaZ+syXmSKlHIcrICrvC9AJ/l7GSELKckM2J8eVXHjduWlRfgBb67cGs0Ibo0xpe3mTzq MznOguNf86yx/GtoTSD/snju2hjFlcoucFmZFkHDfDmXf821jfiXahvLKmbjAv9SYR+Lf7XT TNt7x8e8hOWDozNSrst8ZpNdwm69hY2qSeF6J86Dkfxe01IT8CFFxQRbiXQgpsvrGSd1942z zG6uXTU+mj6060yN2NZBDV4+iUJaQHe5hjIsKQcTZGVa9nA8qAZmD+eCUvLwlJHccgILaK/U UDymHEwQdWkUcmo7mzqciUMUMthHfgpp6IbLZnEL5SQiL5QLahyFJBFlobzXIy2Uk5SyUN6p EhfKSUpeKJc1WU/aSkQX9HU48BEvYAs/EMALPY5lqFS9DF3VcSRj7RVlxhSyKPB2wpDNjbly MkHUpVLIshmNjkeckWeKs0Dt2YQpqM4UCS9sS2OhHE6QlakBxe+y1U8nhJw8tQ+D2JOnwMam JzxhnfVNZ5I9f/qwA6Wo2N2UXPb2HfCWfocQuty60K2FmZMfLcWcSPquuyOaVzd3bs34Uye+ +6JLzQ0k4XJN9zqwW/j8ojsLTC7tXoaizBeqvNl2V0xb6jp+cPGqO+RJbyyCfON5zGKZ83LT j+vU4zyets0EqlNYE58C6WyKAMP2NBbKCRRZmbanMS/NEB221XAuEO1pfAQg2tM4BdKpGgEG 7WkslFMooi6Vqk1sZ7N9M3EsVQv1kZeqQVjP+82IvmyfFRGzfZIaS9WsiJztG+gRsn1WSs72 9aqkbJ+VErN9iibnSapEPtvHC7jC9wJstq+X4bN9osyYqpnwBKnckPXdQjmHIupSqRowSnkL HkfWZsHWxkdJAGzPFdWDMAGGeO/ytgnGgSWhtJEAwxZ4C+UkjKxM5Td69S1JMM60zSYYNdt4 zjcXFxOMGmwwVx4/2LiDl0+ntPmqJ3moia7beNcpRaqHf6H7PuiaDZkRC3v6FjYYiHPSlr5/ T378TLunJMSr3qvm6zyu8iO3hjJYQgxbUi6UUzmyMpXBjsZASCFnZYXpwBc8xwzA5G4Oz7KT Bl7HGggxaEm5UA7OiLpUkjmxnSeZ83AsyQz1kZ9kFnmXpGLygVZEzAdKahzJJBE5HzjQI+QD rZScD+xVSflAKyXmAxVNzpNUiQLJZAVc4XsBnmR2MgLJlGRGJDNr6+PDJVJ3Uc7NiLpUkpkm ctBhSeY8WEcyNdgRyVzVBrttUbWBPRoUACvR2gFuIK21gIG0VjkZJCtTWYreYEKTo0y8D7HP 617imJp9yDGRgdzcLDGBOS4T4qJFRffiVnEaUPQQNq1ceROQLT66/440bT/7X59fVmy4R7os 9WJvb/GuzepiNKWYvli60J7ajKmtbs+ztXGbNMgPti5gLwZ7RG2uCS2lpR+75RcJZak1XPZC 0168a005rPaUSZxWk8TWWoNoZkLQ8U5ntHJ09fra42OB5H6IfcrTWxY2cFKknLGSlYn7bFNf BGXfaZkLZGJ7VXmA2ClXCBD3PsuJpMByaIsYNOUqleNboi51yjWxnZ1yzcSxU65QH/mnXHBl bi7n9UlEzusLatyUi0SUvH6vR8rrk5SS1+9UiXl9kpLz+rIm60lbifyUixewhR8IsFOuXoaf coky4ylXnQef2yqVc1uiLm3KlTX1aDP6CxzwpcdU5gGakb6pfID6hIPwwiYcpXJQSlbGx8rU +Mvnrf11l1nsNi+6U8m7h+jhPaZ2IYPMRdCZBrW4ijS16FEvIe9Jwrqly0u8p0RtLJHv1XVu HWyhwy1bqstTDwVZwDCyUrJHXEKUaRlcTwNmOcRMINqD8AhAlB4+ZTxxcZ8Aw7gKm1AP0KVx lantPFeZh0NcJdhHXq6StZV24siKiFxFUmO5ihWRucpAj8BVrJTMVXpVElexUiJXUTQ5T1Il ClyFFXCF7wV4rtLJCFxFkhlzlayO3WZLuPBaenSxVF4kF3WpXMXU5vHQ23EVPjs6C9BxlQmg zlUQb/CMgegt5f1xWZn2HofHXQpZ+YDRHDJlgztY7FcmCav+cRjI4Ywyc8MXYkDfbyTseyXG iMjPxHRLtdsrw2rcSzEgfeIrMQvdaUY387//fyVmoRsLvD5q8SsxKxsHPb70GBfCN7Uljvn+ guiT4amY3/GBmJVdnRmC2Naecl37Ro+zPESzboHyNodXhaYF0icGCDh4wEUMFloWU1SmHfUa B4vAo15zQemo1ynx1ZExBOyfc5E8Vml5RkmXyt0ntrNHvWbiWO4e6iM/dzc8b3BGy8vdSUTm 7oIax91JROHuvR6Ju5OUwt07VSJ3JymZu8uanCexEhP3wsz08WZewBW+E3BP0Eyfbu5kuudl pi83izJj7m4aa3dQSn4StdLSjIIqlbmn9Whs7Jg7ex3TLDxH3Cd4OnFHuLAHmystxyjpUgP+ 1FfhOUaeXrrnZoCs93tOLZ0assqme22GZ2VtQOJvlg9yQ8Cy+qT6c5EI8cIeY66Ui3dEXWqK bVp/bPSch2MzbGfHsQm2U+rCjrqIF/QQc6Xc6COpUkP0xHI+vTYLxkboUAf5I3RWwY0EYoQm ETlCC2pchCYRJUL3eqQITVJKhO5UiRGapOQILWtynsQ6TNiHZti/u6J3f2efmelE+FdmJJFR cE6bLK6bsEXASrnKR9Slhee0rfjwrJ6rmQedJsBipshqoLZwYauBlXJtj6xMC9Uev60Rql3o reS0knBLNc7dG/UawdZ7L43y2spClzUFKPnXe21lZrHsayvTYqmExQKGrQpWyj0vsjKNsnja MUcl5gIRZ3kEICItp4wrNhBZwKBVwUq5REbUpdGWqe0sbZmJQ7wl2Ed+3pKUKm8hEZm3CGoc byERhbf0eiTeQlIKb+lUibyFpGTeImuynrSVyK8K8gK28AMBdlWwl+FXBUWZMXnJK+jR/cqa 8Bh0pVwiI+pSyUudjYZeD3lh1wfnQVvyMkHWyQvBMc+cj9xWKzfJyMrUSDz124zlwYDXNuCk hY9nzH067pSTp1ywX+a5Ko2LbOi53+99i5klsc9bTEtyLpeZcbLlFrHkE7dzgWG5doq7PkwB Q/wE5ztcs4z2D9Ft148OEZ30+ZVurezaOTaPHa5y7h4eNu62676dvO06wX3/GjTMIVrpduxu FWywnDY4TY0tDjX3QESt9+KJqIUNwTQ833bFow0FAWt1c63AY1kTI3SyTnCDhS5p3FauEZKV aSt143E7cKVuLiit1J0S6hw3JcB+2UvymHLTj6hL5dMT29mVupk4lk+H+sjLp4F79Tv5DY8r xnSaJIZHsL1MkVFiyTRJHB3A9tLJo8MAEyFDpUno6Pi1l3MebeCfCNk5TH50+NrLS3k9zoFU d90CXDVxDivgyt0LuBW6alKkTqZbfasm5koyYxqd4oW0QXcx1soFP6IulUZnVew/B9CzaHat bh6yZdFjYJ1EE1rYdYy1cq+OrEwNZxOvrcehu4OwdUeVT7i0WqKkg3W84Zsh40QcG3vnuczu kxm5DMNX0jQUv/hdZwvrKS1GG7t+tzdJZhbEvkkyLYjOXQgw7ArEWrlARlamvUkCdT/cQxn4 JslcUHqTZAwawl0IMOiWwlq5QEbUpXKXie18LnAejuUuoT7ycxcT95pKJi8kIrMXQY2jLySi 8Jdej0RgSEphMJ0qkcKQlMxhZE3Ok1SJQi6QFXCF7wX4XGAnI+QCJZkRiamyuOpyaGaYklLn tXKBjKhLJTFJNhodPSyGvVZ6HrRlMRNklcYQnJvBam5TNhnLypRjjR63/avQmKBXbo8XAMOS cUx0XuTHltrRmGX4E37Xm7F/tTcv5tpGWf2pcedxAtw7ks1L9c3FBdFmCrw6DqYUJzD/vqm+ Re2gKuHLyzN9c42gy0UnVqh0mfBcnkwblpVN+bIyNdU3GZfZq0XmApkmXfviJptHnA1EecQT wqQlVwRoU3JKdTTKjn9Rl8rFJ7azecSZOJaLh/rIz8VNr3FZLmZd3oqI6/KSGsfFSURelx/o EdblrZS8Lt+rktblrZS4Lq9osp6kSqR0YV+HxwJpxXpal7CcM63kquDt6AU4FFtVJCHXVA+D yc9jpF4mrbTKJCG5LjswypCOwDqZtNKqm4TE2haxehkBK0gIu+T/AbdVR1UNCmVuZHN0cmVh bQ0KZW5kb2JqDQoyMzYgMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3Vy Y2VzPDwvRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9GMyAxMiAwIFIvRjExIDQ2IDAgUi9G NCAxNCAwIFIvRjEzIDU4IDAgUi9GMTcgMTE1IDAgUi9GMTIgNTIgMCBSPj4vRXh0R1N0YXRl PDwvR1M2IDYgMCBSL0dTOSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFn ZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyAy MzcgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+ Pi9UYWJzL1MvU3RydWN0UGFyZW50cyA3Nj4+DQplbmRvYmoNCjIzNyAwIG9iag0KPDwvRmls dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA3NDI0Pj4NCnN0cmVhbQ0KeJzlXW1zGzeS/u4q/4ep /XLiljUeDDCYmbtUqhI7yeVqfeuLVbd1lewHmqZknmlRkeg4+veHbmBeuzEciQCd280HxRKH 0423xtPdDxrPv7ndby6Xq33y1VfPv9nvl6v363fJz88vdjd/f35xf7N+/np5tble7je76+dv Pr3dw5/+fb18t779+uvk25cvkl+fPsnSDP6rqlIkWVLURSrzpFJ5mqnkdv30yd/+nFw/ffLt xdMnz78XSZ1cXD59Ak9miUi0SEvzWFnXqa6Si4/mmR/e6OTqzrw2ucLfavfbD0+f/HyWLP6e XPzH0yffmbf919MnyXevXiTPPY34drff7z762/H9brd/bDvyUTvyqkyLMhFVWilsBmrvlP7u 4s2PQ72PlCazMtXCI+0hXfSgcZaVTovajJURrhJR5KmoEpGB3p3Cc5/jp0P71TotNN+P5/Is uYCfbxKxOC/OskV9JvGvBfya46/jzj5CJVUUaal8Kp2HFVVNiBLYyP/OFtVZmkFT03xRnhX4 11/O4N8Z/DuHH1lItYo8T6v8JD1Q5IVXVGJWjDR/XP18lpW/LIKKlabjK18LRwvKSsvrPC1l I61Oa80thRlP8Rq1X5zuCFWRbni0SJnlqfauPbYTCg0ynKgizaDfaSfMeMozLO6LMxVCS2fk CZGntfleUafQqiqVMhEiLVTfsCbP39wsr8Ecvnrx48ske/6X5fVVcra+Pv/h20Vn82a9y2ov bWf3GyDyLNVmOptdLp/dgs5Wf2t+wy9oM+K50aLMoEOyVFX2B6hw+edZnxdZ+7lZGdnoAWhm UflfIIQ049Z87vph8ITKRSrr/huyTNBHqrJ5REvTJ2r0RFWkot8OM/YVfQS61D6i6lSN3lHI oqcq+44ZjzQ9iuOOn/RGvd9j3geaDmkfgP4YP+Pa2zyDeoyeaZSdeqaZ+c04m68Y3QoB8zGX Q0QxmvjCM/HnvMo773VlbK/5shmedt7jlH+Vwsb18nWqiN06SqAxEZXmBB62Elaem9IHOis/ YCUm33XQStDe2rxbnJdn76DPtuu3i3N9toN//w4/1nfJ3XvY65fbbUJ680iNap1WBaPRDUi+ NQgE9divjZFanKuzu4U0fQK6wr82+81vi/P8bI2fba7h5yVourPfNv/6CH8DtAl/uYYfCXxj uRDZ2Vv4FT/4hEKSuzW8Fd+8g+91z8Pf9su9FYQibls5KCJ4x7ihkiUAtV7HfGobsvwE/bB/ b/BY197N3UKdrXE0UXEcUvzjaruDcYWWfGofXz+zyg+f3Jkfv+HQ38LPe/jxDJ7BB22XQgei Gpsb+B1fubUdDR2nXT9ft/MKf1/B16zkJfyE5yv7njRwD8rS7IWS6UH/SgVLWhaNQLdvHFip 0rNSZ73Lq7xSKlWaW6mkl44UVMhUsgY0tCCdpzlneyaGw+3AVqD5okFyB0ZD+UZjxqu8qheZ Rm+JqP4/tI+OkmOwT/2AvWWI31ogUYEGfmhmP5+AZr4XNNDMfj4Fzbo3eKGZfWQKmrUv8UMz +8gENJt4R9NddqTwo26g+t3hfaBpbfcAtHb0jGtM+wwqMnymUXbqmTHuEuhzOuxirGTuXxLF Adw19aqDuCsvRsa1h7uM4U/B5gsvAnuUaJGVqWQkHwZgVlyzj0z3mj4AwCbf5dddmH7jem0+ /jId6sFGBgmYnwailJMwadXt6fiiPe7YVy0kwJ0dP3mP2/sqgb+OAFA1H/8c1VNCwe4UE/6E VTsXRaoKRu/Q/ZOLMq1LRtA8GBdYGW2Mes0oc3Ko+Dj9pTFnJTfbQncUYFIxQxCDSa3ABnVN G6/yACadfNdBTEqtlxcqPlKQw6TxBTlM+oC9pIEeVqADeNOjUR3ApFOvOohJiep+TPo4OQ6T zu0iHpMaaCMmICl+PIFIPV9vACl+PIVH2+974Sg+MYVGm1f4wSg+MYFF/W9oeskOkEWa7fj0 +8H7QNPQ7gGEosNnXEvaZyzMHDzT6Dr1zAiK6spgbD0PitbTUHTyVQehaJaPbCoDRXMfFH2c aAdFieSDUNSJmwdFxYGUwfTLDkaYaL8dAKO+PXGOHmbzo4qUBe4rRBHAau9x799ujxHKxh2N THF46AIIMjiNmyM3LQhlUTyAn2RRny1vYCzw4e1mRQOZ04FJh4ItisI3bZf3MKChmynNOhI1 08wO/HXIrmv6OrQaVZ1WXG/T3PGRgmrJt9eOlOnksPKUAGN8eL6242AApvGsszQf7TWhzIau M8if9zTBKYczsPO8lvulF6s/Vr5plEEiVH7wlWtQqJghiGJ1J3AeVhe+vNisl02AdY27fYYI t9U+OTdYQ5QV5vRfe/H0Y4XCbkqFzsDTTuAsPC18ybE57zoIqInuXkD9SDkOUM/tIx5QCzNM E4AaP54A1J6vN4AaP54C1O33vYAan5gC1M0r/IAan5gA1P43uF5yA8SEbnsPNIDa9wLf5w1q hACmt6P9GvQeYCW4oXCfT4xFTwQTfu6e6fkF3IC5RyZGrBPExKd7z/QcB25Y3SP+cZ2U03vG J2fGI7iwxlbFl8h7IOmUrHekFumymN5FWJV82ayHqKSMveQUghhL1VfoxVHEUSJGm6czTk4q +RDeUdJK4DNy0mjy4Sg5FbgqVA5uq7VlyqXUyTxKZO3rSAp4jpIj8hItEpHzyrgYbwDSvQ4s 0EgCg0AEUrB+pJyJhqF7eQ0/3tnkB0SabWrFuFL3yevb3SWSS7YLAW4ZwNuf8H+/LjSEsuXZ 5nZR2E8+gmu1Nn/HF+7vwrZD5jVEqQ9OBNaU+LKAD9GIQzPWmEizmfU1uoDpgumj9XGzlBFZ qrSsGJmv3hw3Pzmyl8IzA0TUcROUE1QhWZW2qZmeReNPYRILfWfqYh6phFAirSuqRPARFEoZ CUSOWWqL88q6kJtt+IkjzMwRTCf/BCnDXyE4gpkps5whV2rXMuak9pBNQ6d2RC4LrmJuvLZC UhVfGke69axdP0HECIIrA6paYH2kwdiqpPosb+OsbZlr4GwReRDlWu438D87PSDF2+QN7xL8 ZX23singtxhAwxjmv4ZWUBlYXjEKzjHBPkrBgwAmbxA1GA8hhrShr7KsrL4+bguiwmrjtjLC ws+9OuebdfYdjDqG81++TkWb6t+0q3RqtiDnc73Cvf5TQ5AIP5HzzDhSglGeRjyPllSmumAk dbvGTctztRRZZ8+C2y4Fx0E8iqyvjEwb6d7YcLUkGX+MFXdElPU6io2VufEPOT2XwJz5gMre 21kVWrKq0pqbFKYjVNMPoWUaP6ziWovUDLsQEKj1WBowPTyknkDmk2jzeWPzHjgPWiKTI3y7 7Mc+GeVMfjdI+76bPWjx/3e5WreYaZ8YvBShU51pKup6lBQ3Om663Ey/HasdaHdtfYPGAmE2 B3QNjXR0DfE/ol7acrgvFrWjd7VWczDz6+HiDG0q8gr4QlTBeZMSBtsCkOCKVXVqtliqWPgu qAWYbSrJTZrrZlgQk+Im9a4ZGsvYw08tQG0ofdox+pK79XXztSH5r8nKBF/YxjfN6JTDA4Q2 KhLelkgFXCrag9/v2jRoeKFFhoeG6LAthIzl8Spjw/OcEbrabpyHkqx7jqKmO/6zaDYQwqw1 M4Gp9Q5u5fISaENEgcldYvUe+mu3cJwGXFh3yZJnRR6rYK3SrGY0JGYOBzHivpubJ3Our1jG QGjh2izUkhG+xDmyNe0GmxXelhdpyYm1E3S5RwzaztbgnnOFBpFI763Z8PgyT0tuvvUIF25n QBfg38JrUGWA7zzzLGLgRJovCG6CD+g0zje0dOgeM9pupT2mCmNBgxv1EnO0ROHunN0EDNa8 fYtk4ksN0+rwfLLIbLCoEfVeRhlyoTOgjVHtDllX6Mvw1kbkQPyn2oyd3PGo9idjy3jvpurW eQpt/3b8r3WPLwbWrAL34w5TEjdDt/82QDqCZbPrVEumzccl91hJNQBJKmlO3M3Hhg8UdyvM 9lb0g4Ex425EWLxVTyQN4m4yUNzNzF36XndsrFkyByUEn29QZAmQ26HeZuebj+//oPlWckei MuQoFxKdqj7zLvBkE0LzkiJg+IqXdPykOGm4V2nEmqNmIC3AvNTS7YylDi22UFALjPZeXGc/ Lyv0JojY3iHCj/awXeh9wFYOOsHElFnBt9HAQWf49rfdsTUbaYmC6GtOizYB19a9wADE+gqU sWmwffAEsaxFWnDaBM+HS+M5V9zEpkdf1467UTQLPhYaVgrDDUSlPqBbt4H8nv8AA+PC0a0J smN21Ut9BNa2yEtI5p/QhCucHD1JvYByE7sMLbookH9JRL/6Bjr1OEYbyyAo04o2tYtyhg+z icpYAKaFXcIkTuaSSrSOXTOoMSTnFnQRyYOAzYbxhLb3cboCCCOSndkujYMqfL7mT9QcvQNJ xBTMZLNEw7f3EaJWGvjCzOCDa2qrJOFgeE7c19bumd1Jn+036/D7f6XTumD0C+9xVjXUeKSS 5ngAvnOOoTzO3DiD5ak8zrGweB4nkTRwAlTncYbfwjTadaKADRVN+RjBg1oVbttEk7n+s/pD +c+H5g63enLfcddQ/rMoAVuewn8mkqKBLyLp+EkRJUQK3irRlZ/bMfhJeXGKQWmiAUTSoICP deFwl5T90LDDOR9adGNBxjBbNVUKMfhOaBBozbRmFV5SmSrJSHJ858atQlcXe+VBVYv6PrP1 3R23Qhiw0osZdZ2O/KEoZt4t28zArUF8ka1X5Nz84Cko2GwqTosI1GthzyOPJf1yBsP0DSJo m9T4PbxDI4BTTWUHj1rkmUJaE5H0woxnamlX5gc9dXu041SnmWDkokwF3cpUMT9WqKyhsMEJ Jg+QFyQnadcEg6z17FhRtuyUTfvdLMq24lSzkBKYdkXcaQdkT3WSaScLgWn/Q9MuQlbO00R6 KcDRO4OEcwiM/Qg+r8HFrLhGdeTJb3CvsKYaKJy1K0i33U6VWAsQflScse5jAqB1/gXEv0ne L4p+7hlrqaCWHzAgF2tLUxC5HcZHR2FyS1a0peD2SZemtwDwQ68HmyJwXZVBS4FYw26tegme +0U/3bPrwhSE2OGLzMKO20nt8Rt+w95q3xCHOi8LzDPSvmsMmfKUzmvAvKu9UfVx5LoXrwP9 Ow6cMXZAGkUmXMewvXLoqCTUqKbj+3SYaPPHrHQpiJXv6orY6dOVBETao+6tzh9bJqTtjJaY 6aE6dx0CXdEwRlxwvqmPHYESl9dMY3sTuNU7AjMO04ZUOueXBI8wSigwQmXbedWjEHVL/7qj vLS0+SrWibeyBPtK9WsI/NA3aNE2bxtk0RxnSZp6lp3WqzhnWKBCYpUzWl42qbGORjTwKqc7 1a2lOBtYs8BLMeLwdE6sK8waPEuUgfNBBTdJuOBulQS6NpUXIVqIVRmpJDzK1HF717Z+cASC cwHMXirf0qqBAjjeqYjphQk5LlJr5+3mo30guPXT4C1Rpf2nYyKcqs0lo8EE7gjvnnh0CJ+z UQUwoU+wHKSByEXNSGIxA4+dLE51Hzia7RIN5Db4TIRDMwD74veMkjk/Bo2HoHuHjawzM5Xw EzpaRt9tEjobJQ4GZa2N5IHJCG5WS06JmIeZRInloGi75yRMfBXkAqUblapScSqCKxEWLd1I JbUFYweHykOPtJTgx5+gnUIWkEukkriET4QTqICBTtBKsGncaH5+31XwcNvp7dDo91j03mPG 2pa97WBJ50UypyDg9G/H8y9HZ3+9XkwXeVjeJUaBa6jvYbl83ZH5u8S4hF1VHe4mh8N5kagH RZTE8wAks7f/jF7QuttaN3vAhuvtZefzjWsBXA8hYj9+o4cHc0yjwyewhXEDS6ZFEbKiNSQN qKS/mXn2vtvlXN7q867toumj8dBBcLLxFlcB+AOe+drWUWnmqjq9b6hkBjQb2gk9kxz8UC0W 4DzBCCut0EIRSatlD4nWbrHgKNgjTNZlj8dobZYtFMSgfsh2udrgIryKIlzkCsp7EtnNwg++ GWpeHBiXd61xwXh+kwNebpPmopv1r+F9ZwH5M6rRsAhV0dSgSrpNJEqGreB6Z3B6MvjhhRKI plToHLsWnmypoR48Vabbmjcp7mLhs2i5hLJ+VHSs6lrMMNtYszaoMLxPngF75BStUxL3EN8k jpC1qcBZowJ7eM/i63ftKrp2cG4LxzOi7KQGTgiuFzynYmHkYcF1pVVIwZH2GNUIx0XajYQE W8QYodAGOFNpzYj7GFyQyGHrIYLC73EC64RQSXHCmLCDS27AbLzMpj6sY7LEW0S2Nk/SEDWC O4J1qrjWv20chvAH8OB2j1ycZGyh+ItkJLkjRyeoWJBLBSWLqArBd+NcVqni1mY/RH+ej9O6 Jy+rAoH8muuRTieu+F0cei1Uesu5GeJzwnv3Rfq8xxgklopbo583ENvohZrdjdzhY+5VAaXn qAbg3PLVEoMfzTNmuuJUiLalZuYLg9iYbdlN19HhtyKZSkZwlD0PZhSR5GoqBncjM9xiT9Aw mWPUgEh6wHnTGIcRFdf68FHySiNB5gT9XFVpJRhJnzfbbXLd3n4Wfjs1SB220/hNzPMc0/RE Ej1jEDywUGKu3TeJ4wQWtOA7trexrBZC9HiF4UkGtQb/i+oQPlJdV6nmujjCgVTBD+acHKXv zqYwO5ysM+D493T6z79etGfjglcBF2ZBZZqRGqFUvgCsQCWNWI4dgFu6iP0qvMNc4f2/VBd6 ifbRktBsnKJ/4ZivZCRxtNFldy8miRO3VCswae5qEPYuAct4bqLcg6j/5mpAILTva5nOzYn/ XfPyYdFPJjOWfGhyOda8b21EpyG2RojhqCrjpkjvzPqn8IX0aoCaJ5grqkaoSSVB1WdwX6IQ ZhsLUGJlYj7KiAcAYZru1whYIgA/gU0nSkRYkBhUopIGFcK7nbzjudpp3QZZbda0XSyjQ5b9 e+WTjy3Iw2W0ppfNHr1zWisTv/ukQKIXlcTdw7pEhuanFgXZWF1HS4hDALclQqmGDHW5f0AL 9P+9Vf1FjICmkhIC+lS13tGycZ9FqPZcFnCJJtWiZUjbkxtN0j6SvQEO3IBa3uRB2XtyutzG cH9rcwdtAVZg9cqeuzosbb5rKqvMZjiEX0E1EIlo+yMk/gTQP6mkOXg6yG2Ffs6fLArgv5yG 80eERYuEUUktwYQUtIzDxqMaPLJq5lDxL1/xA3pYHB5KdjKHuOdyajIrOTSlUSfzWFi8yUwk jedEcLcXy+RQucHJWUKKtD5FVwqpIKJJJU2voOCpS52WFaPFgBh62e6ZDiHVEelxLgU3Vilm qbscCByS6QWWyatnEXn1GDHwRF49wYsc3OIzcXwO7gftPvJRetWQ0RvpxpDGQphlpJlTlnvg FuuuTmiDt2dfv8OmFOsH0nq53IVVL23RIiXBlkdwYNHHmRrrlgPL3dUUPp5Qg5EjY0QmUaTJ kWfAXZg+/zCgqLYDP+SoVs0h/HPLYx2zRzUZ+nEgrWbiaD1HA0Jx9o+DQFrLVMY7kWbfGWYn xbMhp+98cOdCeBocuJZaMn0ewYnV6L8QSVFvKCoyjA8Rob1k5GNtTujsu4Tpf4qRaNZZVkHN 6jHD9wsw7IRChhRVyC2e8Mw3XWM4mAiMcgoIvCsiKZIzV4lUMNIY5hskGnFw47LfcokJR6oS qSgRnMYt06o4xRjnhQbfkkpat4dY43PgagE8caoDLOc57DSwbq7ySnR2mq7gOLR3TfTYaYOD ZnHoaSoXQAT3TNCe5WMuAWUO5MVgpxWZ4s1Vl3prCQSxdou8LoGrwczuc19ReYtfY5K5YHfX jGoRCrpLKNVBJfXTFxFOe5eczAibVJZKRtD4jjLWng1rVbmM8JChlHxoM4JczdByQIDB6pKd TUqjuBpSogk62LdsVLCIShmB6wH1gMZyCsoIlRorgUMlzaCMPGsd938S/kODvN0L4QoXcAub UzHRBsfeLDAzm598tmem37dOU+T8d9KeHH9Uxtg8+Ihk7nl+IM/qPPuTpUBznZ8+BRrhkKUq mKY8PNEaK/9JdZuzOei4KaO8QCLTaVJGRFi0WASV1Mb8etcrPPZmtQhHnjLB6DxKgP5Brjyw CdCDY8nO5iBXVPqvPIBkTq2Gyz/wVHZXHlBJsUpEUUlzJkSEM4eFYnR5ZFI/6gUBkKCCSwKU r3zMblH2K8fcNLmXucX0bbX6L1NKHy6PUnl/CL5EKX2qRaxS+lTS6UrpU9mxSulTSaSmuWmo ihFMLUqujxdN5v3/Q+35E4yTqz0/b5wk/IhWsZ3qEOVSMFmcYpXDVZsVNwO/ZO15qs2w9nxo qcam5jkj9ctWuM9FkQ6zZ/+ABe57huyfp/Y8bDpmax1TMf4xa8/TxvK15/1o9LEV26Ejjyqm zseX/mB1zoXxB+tB/5I65+fMPcCewt3OkT2+pnbw2VTiLaW0tTZql7ZTZFxTe6YVClS6Oeki cn+4YsdAJhiGDCaLHZsfcZI1rgYxVWdOBKMKEMFQpkeGCVmdavPHok6zEbg8LnoxEqPN0xkn 5zgASeVUGISjcmRYOaV5uqJygLubK1vA+ji+MJFYFWbKMBLPzVtre/IzDdzI2jdox60LIkcY +Amrgsh5DYvwdne5ObIwPJUI9Qs0I/E4742RU6Q6Z+S8guCVs7QSjBH8qtHJNWbxPnl9C5Ei aDia1Z8gI4K5GgkZEYB8mFnW+A98x/644DBRXcoSbpE5OPisqQpxOzPHHrHGSlapGIQCOy5Q v5BvGz/rJ+xxW4LebaKG2MP52U9wxTaTdmqLgw7vRL8cYSIXpbtvCj3Z3//0usvxNNLCowPM c9JOCR8wKks4r0AlvVo2cO8dFrjctSxU3Er/FD6rVcAV6lSRCOU8y7QWjKTLhinlwHHw6BKe MaZyXy73y3bqwTQ+rwycXyFsa7ONdaPeee8cy9JFEMz3nHP/Cj5Cd8oGkJLGxfenKXX4myCK XEC1MNrU45CBsWaMKIlW/9C84UyaDHFltg99iSItTwC+xmJSaZFuWGRUpaVihEWCQ0MxAzR0 XMzai4bGDYsEhsZiomOhscBIUGgs5q8twcUBGbRv28S1F4zZHBTkNqDgKMhsNYCCDgw6azFC 3BnjBUFwj2XuA0HB9yODMcqKE+q2oFjgRkAhrJyRGxzciAw8OkYSzE/dj64tg9cuEQpIq1R0 BNZVDmeIDg7jJCLueIZR8v25zIAaTnWMDLlypeCQBZU7C3JFqGZTcZ3Q+jTBga5KdckIPMHR bFkgyD7B/Jc6g6Qt0613CSb91ncrG5N8i05d8KYqM66aUyA4GVqJHArtHOxUducKUUlwgvlX yrQ4FfFvLCsa748IQpI7hpEHFUTkfAJdhPCzBi4VUXXXEZR68f/ldgsl14J7fHDxk5kdRIvg a8Dd+xR/CkD1VyWooGHu3tGwXyfb5X3/rrTQykCBQKbVg3PmwZmZGm7aoTLhAPltl2uz6cHk sjt/EOE0TMUoEiFCI4CnQgTZdrbNfueCkqGll3iJ5Ug6eL8CgrXG+42wTZe4d5EWd5QHzEei VUM25CjvOgxHvXOeXNFEm4A6aadon92IjxkAdgWoy6YbP1qiYegwlMAqNROtI4c14uwjGp8f +3UuZBd8QzAooWZk+mpSRDgFYpwuKr6tO2G3wytLjtHteaX2foVdjBKrcOWIKqha/XCothlj d+/QgOyrW65vM/+5ayI3q/CGX8O+StSOsMNUcO6NCPqtJSNZEH2JKGeFfCagAQS39QoMUvz2 QipMMO3tZ4Ii0Euz0mMMEEX8iz1AF9zIC9g/T9CnxheQTJ/2cELHLULO+21LKLG+d0FZKm1O LmodlhpiKERxdqeKsE1ASaOCMdnIXerCNTZEs4pzn14hkVUTf5YUZoMQzAYRQZBMmeUWQY6x 0QfloFP+f8SDmVsNCmVuZHN0cmVhbQ0KZW5kb2JqDQoyMzggMCBvYmoNCjw8L1R5cGUvUGFn ZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9G MTMgNTggMCBSL0Y0IDE0IDAgUi9GMyAxMiAwIFIvRjEyIDUyIDAgUi9GMTEgNDYgMCBSPj4v RXh0R1N0YXRlPDwvR1M2IDYgMCBSL0dTOSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0lt YWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9D b250ZW50cyAyMzkgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9E ZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyA3Nz4+DQplbmRvYmoNCjIzOSAwIG9i ag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA2ODMwPj4NCnN0cmVhbQ0KeJztXVlz HLmRfleE/kOFX6bbYRYLQJ27E7MhaeTxbFgyV2LsPsz4odgsij3iNc2mZP77RSZQqANAodgN tOiw9UD1gcaXuDK/zARQx6822/VFvdpG339//Gq7rVeXzXn0y/Hp7d3fj08f75rjk/rT+qbe rm9vjj8+nG3ho7809Xmz+eGH6PWPb6LfX75I4gT+lWVBoiTKqixmNCpTGidptGlevvi/P0Y3 L1+8Pn354vjPJKqi04uXL6BkEpEoJ3HBixVVFedldHrNy/z0MY8+3fNqo0/4rpLvfnr54pdF tPx7dPrfL1+85bX9z8sX0dt3b6JjSyNe3263t9f2dvz59na7azvoqB20LOKsiEgZlyk2A6WX Qr89/fjzUO490VhSxDmxoD2li540zqzM46ziY8XB04hkNCZlRBKQuxN4bjnzdFA/reIsN/fj EVtEp/D3Y0SWR9kiWVYLhp9m8Jbi23Fn7yFSmmVxkdpEOvILVU5AEWzk/ybLchEn0NSYLotF hp/+uoDXCbym8CfxKVZGaVzSg/RARjMrVMRXDOMfrn5ZJMWvS6+wjHd8aWvhaEEJNFrRuGAt WhVXuWkpzChllkj9cLoj0krrhp0hWULj3Lr2jJ2Q5YAhobI4gX7XO2FGKcuwyB/OFAg1XXT8 8a6+ATX37s3PP0bJ8V/rm0/Rork5+un1ckebxUQ39kUr0jgH2bj9SuhYtu+TpCh/2EfhpwbE KqbUhjjujSfCGRrIZ5G9gYu3yyO6iOHPjydxujwqxBsKaimCV+v7ZSpe3S/ZgtsV+O8CVNO6 OV8e5f4FJgVf/laBb0GyO/jDTRyIcQOv66urJaGLRyG2Z4Eo4Zwmswn09RJ6obmBvsN+0lX2 vvgppwfEhq+r7X3hQOEWNrgPfDqcQjPxDzb4enmUinE5hz9NxC0YzhD8bIN2jRtz/MFf4Q8a /FzMNGaYaTik+ONtdP8Atd8tczHoXZXbZkmIQPyTEMVzP6Qkjwtrt9cRyIWSNl8j+A8WRnO/ JCm+gskpv8c2fcaSj2qWdK1dbfCrWjQqzJpqlUDKZ7LeFm2wuFTNFxCV93EiPnxULVndLmXD ROtXKHi7GHNR6NcFqogb6ITV1cNSzg3+QbH4pKr6ut5eQgl8gzANjDcTU0qt8rLXj6JKOU1y IXX3rfe1xzhlIpmt47yvPcZpU0ZscDPWHqdTeaD1wIoiTgubbEINrleXQeZvmqQxsw7DnZq6 vVmLk2LrXRA2Jci9f7iSkwUbnP9uThP0W8xwoofv+CS8qh+VAo/UhLztVMRApUX435KwxaW0 D4G0G+8sYhgT0Cr3XANNqOQ/qZacdbbn0juz4aYkpRY5/fOonKELZkTDJVNvhIZtoI/841cs TogFv6fGhQnANdvaFz4iJgOj7IBvxpOncWqTtCfOdoMWCGYyTpMH/FDM75YP9E3SquEiizbe jpuLxcUMhJZ35rX5B+CBHi0WtVJkaDOb2PuCp3yMikPNyBSsW2VBO+UU0cwOvwOiJ6ZoCBOf FnxV5hapvFv4lDuc1lVpMPCSJwbSmJS7WqUmxhc1ua9wmTaoJ+ozmJJXPXXeKfzWNECBGoar m881BCnh688tSe6ULbzrKhEroyPGQ9cT5cFl91uz2uLysayq9TXAoYa7aq6XrXO2rbc9C+B9 KbGc92Vm61JTLHcU4SCBIxyEMxctyBw0wmFEDDeZTXAQYqOZiLG98z7mhNPSJLc19MeTWA9g 74tIEcraVoYtDYDLSFwdbEQJZ9lAlMxw3yIkVcXMJo41IvXonafQBBmVWY7/8A9H46I42KBT zg6odY71FTxaxzd8EpxE6IkU0kIJ+lirMfAvYlVhJM4sIgZG0BIKcyh4a3TRckIZXPFtd9I0 ptbJKSRRgokgwUbRzn74rI0m4PLCEBYa/y5aMwznnSuSICztGiJfq2EUi/8Ii9XbmldTih/X 1/Cld1c5I4V9jXZN7Cj1uWGK4G+UwcxjVkYp5CySOC1RiIs/+rRYCebjhLCSBHcx0hWK28WV z6TzDBE1FYITau8TfPjA55kY7nP1G86Q5KsuRnLLyyHDW593S0p47I9tmFUwq0/qN9hr+A26 8OsVksAvah5hofWF97mdFHFaGfppvUIy1w/93aru6CISqCO+A6qq3Ife0uwcNfhWOHc4oVeo yCcqHwQzeEcZJ3nW2ajmdxgRrFtwUe4Z+p7+LI9prnVVdMTrrQQp8K56spQg/dGGZwbbpWHZ bl4lHQ0PTXQ1sGAcV0fipJbPqmeUvAOmpIs5QZJUMiB8Ii0jkBjXpQuQQ8viJDMg/SulzyoI 9uhd8E+ZOcv5vCaDZvw7aeZKmul9FipfpiM9i1SZLtZBsmQ67OETZLoMoXJjOlKotJiONMyI +UbNs9g0h55Z1i3PC/7/cKSfW8ZNlzFUtk1HOlymTcd+jlk2Xcp/hQzbAWagzK7pSN86s6ZL FCqrpiMdOqOWZ3lM0r4E/06m7Z5M03tzRmSBeYgsTAxwmnZ7Y+aKlHoQKY0INWyqzikd8YM3 ew2GBsNZCEt0HEyspT6yTRpiwUuX04jEL2KZcT1lQMTgmUgexplfyMrcrfvaBQ2H0AL8bx3n BFXN7cX6ar9YpI7IORdXwjriflrfgJPBStRx3t/u59XoSCUmFcK3qCxjxgw4r2QEn4k/V+sl plpyUOEMrUg+GE8wCR8a+O53/g0GB9abJRAhDBMw8eIGbc9+fpnWBpZxf4W457VJTWZhNLdU lAmJmZZruewlxNDe1e1r3/ygEKHisRRdsA5N78nmVoVokR1QpDC9BMIaKXID+QVpipVlH2cp emZ8+7gshBUX7/9wslHxqxbNO+HnpIwwvcn+o60Fpok0oPe3QHe9hzjgYJYJzn+7+A8KQwe+ uoN2ybTrqqWS3jkYq+K80NH/gBOoH/4sA0TQ8iRODU3/sd7WaoLDYjkquX8oEnZ5L9Jgis7W wvn1HhzK0QwZ1Yt0u96BDHjiFT99p6Lecgy3/lNzqPOysoqLzBwJxM75BzcP3gNXZYJHA3Xw /dwEbmh0KIrETYeaYW3ycKQ8435oysKTch0nZvv7Yzohh9PMJrQwNHyMM6DheRAarjctDA3X cULTcB0xDA3XcT40vyHNXG2bJW6R4Gr4BEyHbG3RcdQjNiCp+QK3CDVtcsw7R6WcZ1fuQTdp jSIkR81SDHuYSap3G8HpWVGaQKVdDcULSULhRKWO651AkQRCCQYk5NS/yZh3c+4dN004GdBh /Uf+U9x64xzCSUdC7brYBomMUpbArgtdxot2N1qYjZE0TeMyM+DO4pDed7JVcWnqBOlvBkrB H2AKMpoChI402IaCe4+ybu+R94Q7O1Rziwy8IsNA4hI6H0XxlY5Ru20C5H3yuDBOrfsI98Q0 96uNd1Bxw40Ouj7DoIP3EU6L3Gw0vG97TzndBeLkmksmdlCG3dUIt+ow0pMp5K5GDSxY0kxH GlxLQg1bv0arq9tvXnvfZ0IK2IdxgN4gBW5o0ZH6gbwHtWFO7NuGmEZ933R77VHjNvfRDXSJ VL9o7uBHKvd3LWv0HrHK4fY0QxOQbNQXXbxRbCGX+fd8UV89imMBzJi0FMl/0RFi7MU2l2h7 q4a+301ii5fIoWKe8lF4FWlLdf4z8r/1iS+cMjc0XuyZV2256Mn/0DUo6iVsA60zwsBS2Gz0 g9o/eDc4shKEIHN32CCP/zWVJWg2NCRurtOetVYLQ2wL8S9HWUAoV5djFJADHgpLYrBzKgAh L4lBlsHRqUodOPG+N7qCtIAOP9pqoA5LeF+oLCFxVRgk6M5Eyd0WYntGq1eKRY0aRUXetXMi 8mKMZrNU5giUL2y79c76iriqDrGEUj5dMtN0qc8V411DT1Ttpv5I7UZulOV56Laget8tkiV4 65+zL0yMrQrM2PhUG7DIoIxtDBbOkmhIA8bGJs+iHJK7lQxORR2gY0iZoVLVkAZpnrs2YSaz L96P0DIMeWhCrDkhhEhDLmlGd+CtU2C4AfIKtqJ1+816h+LwJ73BEocVXt20h/Aa761hnCRQ ZmiN/2MEnCVklQEJDhDGavugOGuFU9pwbem+MvAJlJta6z+EUZYYLNGQtLOxw33DYt1e9M4R lQHoQZoyzCdo0skdjYPTnDOo9OhAVCCFmFbi8oXx2QAt3OqfSlMMjOgC+L/tgpawmV5HmnO5 SeD7W9OC06FDRUY0sGB2Vkey2Nl0bGcDZDQ4xdLlmTDmoWysLsQ3sLG6EP/MNlZvTSgbqyMd 3sYeYP1KG6sjPScbq0v3vG1snkPa/hvaWE2AYDZWQ5pjYwPfIJZmKczpA9nYMVg4G6shqTsV aJhYIJ9NZW7AneUiR9vexSPjbIAKt/Si4KaEgP+zfUWcMUOTajwHOkg5QBx/OhuAQaSA6YBC WN9ROuC5ROlT/oPcskfcEaVXs8QR3K5mhZ2PqC0irJ8L64K1/Uy37xiqqvSZRR71IZujrgNf gQNx24ENCaqux2DhloeGpNS1Fnb0rbjFtYS6BKF8LgYPwtDhDutzlZDR1YUw+VzdtnLvTlcO 6TNDz7ucrlz6XI/d6VaLv+XbAyAVJGh0kQ/h1FmgAzh1DG770JEO6tThbt4DaCBWJeAv6UjP xKkT9xVq0j1vp46UkIv9hk6dJkAwp05DmsMSfBxnn2IJCWrWA7GEMVg4lqAhGVhC+KCpMOCa LN/CgGtCfBMDrknh0YBXBzStWjuCmVYN6RuY1vDLtjWtGtKzMq2adM/atDL+O2pI1hzMtOoC hDKtOtIc0+rjWhbrWS4GBvbJIVwfVyCkvGXwuUGmLInTXnwOrlTJYa/qiquVvQ+NaqBFEpdU R/3F8FzfvaG4kUvMDcxyef8x9Y7KlRZJTQ3c+/SoBkUINwcGJHyC8qa+4dbvHiNy9aa5Ac24 WqZ7Hu02ilGVcI7pEC2mhMaVqclz1lHAw92MFvB8zL5FjvG51TFa4ZhbIM/nouUhZR04zCFl HedvXxo0rl/W7SUyXz0jFwUkJJ0tNI510CO5jNt8Wo1WXOgjuRbQ2bdJ9Nl8zsn8Ueb/lgeS F3FlkDTAsRg4TKsDnbfpj2Fuy7vnkjBUQ+EbSjkE13Q60uDydu+OWWEG9f/0GobX5hyiI1kG 96HqSCoL5f2ocQVPytEBMRXVZeNqkZ7s3w0uL3YXD43ADJpayfJosHhgRO8KU++OJoX9fLrw 7z6eBDg+m8LN2BYFJw6jCzVWbzFbOOfQuvdzXAlsGtdl7O7aFPlkdDvFHbujkyPtxbu+041o kmiVwmwbhQSu6oc2Y+5/gpc5MhAdeb/rWEy+K4lZakLqbq0N8Bg3vCVax5zDPrwc+TXIxAlx hleoUf1CkPrsas8xNiGm4GGMEcGD4lWWPnxEEyhEuUpDO/dz1oxIJecrOtB+58dNQDkF9aEj +R+xPIMwi2WSbIA13NxzbUrwWkNhSghbrB5FEIprrBN8MBgGfWl330v77Yfmd6V0C650m5st qhjvDWEsh0sV9IZco/DNFv+Lzh6j2j92mcCFlZZOFJQbd828+3mJjJtkQLk9SwFZO2Ja7/d3 nNDjbSViINVocVZf7UnSTHKUELNxT15UhRwO7tcHkwR3BeYcLuavudue9sHGGtN25G5OXVJw g+R5hbEYyhUKpRb99aHR+fN8VJNdTI2gWnf1eoxQvBRd4tGSxnnm7DNqOz4xrzZ7rxEK3WZo wClohhov5ocdfHcYz96IK7lWFiK6tzDc+GeFQRh5SRpIM7zRiCuoNayDjbzZlr8EJbWPYMb7 RSt4mtNTRhkexVKQFpGvwix1rwxq28A7rzZ7x6YEN3rrDXinddXeUNyfpKYxDAAFVoO5h8UL FD6FRYc69g+VEl72MK1KU1wWhvXmHSpLYvOskPmw4wDNywvYZ32Q5hUsrkzz42/+oUoCW04P Mj/g3nPdoh71TWqIcWMETgpRvhDK0OPGCrjGSod6/wrztSFaxylGZYIM0Lo8h+dz6lAf9oIy hkzwnL2OZLeQWYIP1ZKIjMYZdRtI25bpWZXZOypLMvANjdoJnI9s8V9ajz0B0hTJoWVsMsiW /jp+tdmuL+rVNnrN3+UJVzYcmjuaORHPJuZ/iqrqnlE8p4gkvqIIEt9xEUIT1KATtQC1YqoW oFZFoRWC2QU+VldPkhBjKVj3ohSfg7CJYVwIup32RcJvTaUKJZUYHK0MY8OauFAGvFml2u4W kwE7qjcX+l1pL9F2UlcCOmlUqG2+KoRijAtJmfs1peNCYw+O4KN2lP9DJ1ahbUvijKqsC6J1 37g/Uo7cN4gHgql5G58aHvyyD2gbbByBznHfBFzPlZjqMNtGk1mVTex9Eb5bJ734ZvOpffWh OzLebaG6UzuPcN+SeO7a4OlQl+IwzVXvKBruVGzWX4Yb9UR0aFufiWNAdo9wtwbSrBTlHQ38 rA4QYbO+XoknoH9atrKOHozRNu1abd46V71z1ZyJXKLMm/puUztopJSPCzA3ST6bXWQ41lt4 4Etzr0df95QlL1FPOGRxe7kCvscaphaDbYvTrMpcR5r1pWz3O3cEymicHQKHKzaIjD9BN7VW TwB2lGRqNGwbZebUZWc3sFlphmZ6b2VVu8FyG5vNgH0SyRKef8t90JKOGZQo0jKoQZGe2bfV 0jIoGWJQDGpQqEcOSNlnUFopYFCiVMegBoV6FIKUfQallSqUVIpBDct0PIOUfW407CXZkWJI BfNhsaGPrAXaxncFkBkNyrStUmUEMRqWkfL260lHZUa0iMBeWippBRsG0cdLybYPaUZVTlqU 5MOny3TXwJyqV0QkR/GVhSXtJENVxlVikMFJkiRaa5Yc3WdLpM6qzGlvlfD7cCSL+d1VND64 hVMyKwHZFbWg4HO6YPfjge0TSqdImXhu1a14QB1sg99edrVK/tM9p3y9fVS7L0x0znMniVlD YEdAOdFL152sRvbYyKProoWXiotiZ+JhANEr8pnefhsBdjCt3I1w8juJ3zIYxzq2pfdmVebk d2MlZKVdu+IIehccRrK7+TpVGmSJJ5nR9FAwW9ZwTl1OcudQIFZutyOq5HZP05bT1I5kKhZj C46JIpPBsYlaWmonijiCY109U8ExUcoRHFNVTQbHRKnp4FhfKGvYS46ondrZC8jG9wpYqV1X xk7tBvW4qB1wq1nMjtnysu6aXMSOwJwo5zM7fVvUHjJIYqfL4GZ2iDaP2DFb0H5OXU4L3ZM9 TvK8iD6pVx6I3W6iIa9zSmY397uhCl7nhBVbkh/VMzWMvK7Q6duS0EVL4dQtQJzDSUazD4er eiSzlNtqu5utzs2XcHmZPQUBreHorEl+Z43J7SiYGL6+YGFmS5nBo6adOAYyiHjzuCCzZQrm 1DVBBSls19XVljWDuitOAZnaMc5gR9n7V54xc4qD+gSV3NIqxJvHC235iBlVuWihLrmdCO4E I3hgD2Z/IgisoY08WYigLDJFBKdqkURQFpkmgr16JoigLDVNBLuqpoigLDVJBAdC2YkgjugE D7R93zZdfW9ngW2RCRLYq8XFAVmqQrdwudfUorHlLWZU5WSB/FdDNTzNAvXz0/sI0dJATQg3 DRRw0vi4OtCWaphVmdOUd9KHyIKeDTgPPm9d3Gt4q64l+YJF1KUUWO1F76RXS3o2Lem57YJC DR71+rruXeWJu13h+pML+WTcNmHZuwKju1yxWDSP0zxpv95NcZ+UvXdFZ33BcwK9uzm7EGF9 3RHDz8vcGBls+8900ymOV4PbfLsnujfDy0HUhZji+NU2kjuGS1Pat0/q4MrKMyWQZHaee5JV BG6Ocfbkd95xGZytcOKGmjksB8v3xEy3HHo5v+VBSLH6HrDgVCjVbzvgMbIFc7fDTZwFvmSE LmVpSybNqswVRdVVvT2+uSMQhlEPgCPiqE+xXS3rEYCC9bhGw5abmlOXkzG7LJedQO8GKxm0 C/ZJDDovVYDPxqBFkUkGPVFLy6BFEQeD7uqZYtCilINBq6omGbQoNc2g+0LZGbQYUuyCbkT7 fWQt0Da+KwCNH5ZpW6XKoAyjMlLefj3pqMyIRsOzeSXrzAq8iMe+lBynv6aqctJomrY62rh5 0Bo83QlUbh4cg86gzQJOGiJXh6WOo1/TlTnNcyf9ITcPfm7v9jMwwP6OPSdzO1v2SRsWuhvy 8Gt17xpeJt9dcC4ubLOQhT17ldDpHUjjh4Ub+sOzYGWCht8lWDsEhW3PJHooOKDdveoY1xU+ jbh7Hb8XEwEbit1/3boC3S15Q39IXpFRR2qiDS+o52MnQ9LT6fI9xy4h7p0idddC4YjI8cz7 C0Q6IffCVTM4kjBH+1smWmeykr4k0t71BfxM3RbS77LWoxzfh2jyI9vB1BxJWMaX8ABmwz2E Xjq0rOJiimdI6buMRN+XVO7gtD9p1yaqAnE36GhWz9sBrJTKpn2ItF2fiKcvdIs7SJfCg8Kn lPbkIm2b/dRVWvauPsFVmlsW6ZH07n9dKv099OWHgY98Ygl1Nsbq1u3Yk6wkcVI4e9Lp1Ql4 6bY4bbnjgO90ZU6vTmMiVm9rVyDh1YXHkV7dE6iVZOICUBBx52g4TpNN1uX06lzEyurV7Qgr vToX7JO8Ou4JFNNOHZaY9OnsdbQuHZZweHSqlimHDgs5/Lm2okl3DgtNe3M9gazOnBhJbHsG 9xtqzpy9gGx3VwDaPSojm6TKoAjjMkLcfj3puMzImctT5QwRAl1gX0COg2ATNblcuTxv9bJK iFh8t11Aiox3igYSieeawlWxp7E1xbILnnQVtUY5PUUBJo2bazQcp8wm63IxDsN4PMEv9Lrn ZOga9nlhmyMo+ymCCWa+xovjZRIhV/tTrFRjtx6Eh05mxDn4+8OUMH2fMMekjRZw0ka75pjj 8NZkXRP8Ba9XHy9HuGeAFGKfxYn1yPqOkBlG457QW9I2CDhhG1yd5ThbNVWVi15oglvpxG4o gk3M7R4je+BKdnpzLRaY4g72GiR1wALTzEHVMUEcsMw0b2irmaINWGaSNfSEsZIGMV7Y6m64 +t8za7c6C0gLxhz9bhWh/d6KIMcFC0yPS4cBAzOEaYsw99BhmemhU0j45RCpLcLco4tlJke3 36R0DCSLsIkJMKcMLrf/B/C8JIENCmVuZHN0cmVhbQ0KZW5kb2JqDQoyNDAgMCBvYmoNCjw8 L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDcgMCBSL0Yy IDEwIDAgUi9GMyAxMiAwIFIvRjExIDQ2IDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2IDAgUi9H UzkgOSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4v TWVkaWFCb3hbIDAgMCA1OTUuMzIgODQyLjA0XSAvQ29udGVudHMgMjQxIDAgUi9Hcm91cDw8 L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVj dFBhcmVudHMgNzg+Pg0KZW5kb2JqDQoyNDEgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29k ZS9MZW5ndGggODQ0MD4+DQpzdHJlYW0NCnic5Z3djxw3csDfBeh/mLfsHKBWs78bOBxg+3yX C+KLEwsJAvseRrsraXHSrqId2af/PiSLX02yqjicsRQjflhrd2qqisVu1m+K1ZznX3043r06 XB93v//986+Ox8P1m9ub3Y/PXzy8/9vzF5/e3z7//vD67v5wvHu4f/7Dx5dH9ad/vj3c3H74 wx92X//xm93/PH3SNq36b1lmsWt34zo2fbdbhq5ph92H26dP/ut3u/unT75+8fTJ8z+J3bp7 8erpEyXZ7sRuEs0sxeZ1baZl9+KdlPnzD9Pu9aNUu3utf1vNb39++uTHq93+b7sX//L0ybdS 278/fbL79rtvds+RQXz9cDw+vMPH8aeHh2PtOLpoHN0yN+O8E0uzDHoY2nvj9LcvfvjL1u8z rfXt3EwCsXZKiE6a536ZmnGVcyWNDzsxdo1YdqJVfnuHS+Xyl4N769qMUz6Oz/qr3Qv184ed 2D8br9r9etXrv47q107/Ggf7DJeGcWzmAXPp2WVNLYQpoQf5n+1+uWpaNdSm289Xo/7rT1fq 3636d6d+tJd0a+y6Zuk+SwTGbkRN7eQd08s/Xv941c4/7S9qtpeBX7ARRjcUWOvWrpl7a21t 1il3KxRI5T1yb6QDMaYTXW2yb7tmQu+9bBDGSdkwpsamVXFPg1AghUyLeWOhQ3qlk/ZkThnU +wa5JC9yZW2GXddrs97g7vkP7w/3ajX87pu//HHXPv/Xw/3r3dXt/bM/f733S16JKvC9h1Bv ctvaiEG+WSrpMotZMnNnGZtHaQQ11uyfdVcv1A/9r14vH+pf4rJerEuztqgX+JSJTlm1RrtF XokjO2kCmbQyZegYRKfmDRuDDuIbFb/b3f7ZcHV3r38e7w7HB7XyftDrsRK6vd8PVzdK8r36 8aB+gPRxtxft1Tv1z8On/bMZ5A8f1T+Pe9Eb/ff697vrw1GZMhq8fv1rIP5B/fzl7nHfG9d+ 9n++e6Xe8Un9U783eNsuuQIuFL9hVcksjt/djXLNju34SXnjh/PKje74RsupQOnf9bhvH9+r /2nR+/0E0ZUjvPAIum5u+h4bwcUD1smALSNmTofgXg3UXEvT5lK6uDPT0Mwz5kxzeXNz062f L9RyTZ5KzQXr09DKqAhrVrL6OPBJpUPWpzJl6BiGYWr6Jb8+7Z5JNhASZRQcfP8fSfjONS0B depOX97HttVgC2b7rhk7Nno9Er0iXegIRtE3Pbq4/zUJ2JnWulZG+MR4+c9qX8vf9Bumtlnl J715bhUQtc2wwA/lwqvfFbxucjq8rnP65nUh/Vwm/P3qruvd+9VdJ5eIjYS6sIQINbStSEUU n4OIvPamKXJDBbsL3ZDot6Qis/ME5mMr0PdbHdKR2AwvYgMK065fCmY9DBkuYUPiJVRIIiE7 ZCekhxwLGYdDTUMsFNNvN6jPP8BvXbN2+J02MPBLaGLZt5/9Qstgb40ZS72JGRR4u4vat7yb 2OdRF8zZDEbP0MiQLqmLBbXE+ZhxSfaySJlwimNexZr6heNOMu+0YV71po/6tTchF2aZdzXI C5IluDttWRKDibrw9cvSiJGf+4vNUzepRTgwVMvS6WeWyzrcCfmJvc84fOnIdFKyHTOGsp+9 /HV4aTfGqVnnjBs4LtcakqvT+jkCKxfFpcBQBpHBoEVLel2bGEImdbGAnNyY36M8XGloFM2a sYNzd60dwO4TsozlJDBouJWejJkBbkoVy9uJ6zhq19kxpF0aoi1kB7gnCHzWL+P0jLzbwrN+ mWJn934UnbUERc5WBQ7OWoLg5sAJhIlhfoB43fSEcUAF7EC9gCbijYwdiZMBIN7KGF9DPUMk E+Ow6BzdCfkn/DZYGBrGFbEwLIZoNcVhuMKKZeHIit4t0PWA5kUzXNLgqq7r3LB4+AVrJivR 87Ey7EupYpEqMyOSjxiKfZRsoTkqruCGBKrENYHdHV4q6H37SQnbQq+BEy113B2U3PXxTr9f c1yf5ThtT0LfDO9+e6s1P0jM/Ye2/IjzRlWU+lEuViM/wefbkZfufNKFZBMq2DMJlb6QBLbJ U6KLhY3Edxw26uwAayRmcNaoNAOoccJU2MwC9iC1MDOB7dwUqGJJI/EcJ40qMwY0SgOUB42u b2YCNPTLOGgg77agoV+mQMO9HwUNLUGBhlWBg4aWIEAjcAIBDZge/ZKcnTEFDVTADtQLqJFu ZexInIweSiRjfA31DJFMBBrTIm+gqajuJrANggJVLGu0XSlrVJmxsJGYiQpvA7/TXGXfFt4S +yx7GHNlhTeB7UIUKWPxI/E+rrxBke3xeLc38KE6tKAC5+pudKljW3Jb0ypZhk9cUQ4g5bg7 Bi4drhWPaFjpPaysG1ZB6OC8aE1rq3qDgmhZHrKBOgGIal1Rq+qSceXiY15GtQXNGkqRyBgs K8AIrPZfpIyFouj6LtydrDVq0OWEJcHkKmOwqEoisFp8iS4WXhLfUXiptGPopTRGeXqRCZCi F/0yTi/Iuy296JcpenHvR+lFS1D0YlXg9KIlCHoJnMjTi5kftzGY7BziAmaggYDdOEz2Db2M 2zdMtg03eoZIJqaXaVRLrev6oiAeK94WqOLoZZqXaNnD6aXGjKGX1AxBLxOHMTWOiFYX2FNH eIwBc0EHDDVXWG23SBmbmBPvvwDGmN42LAvXDbCb56afMwOEHbXDcbdfwOnD8aD3K/WgD4+7 4wctoLfm1Bbl3fH2xo31sN0q3bmaE+xvXnoUdpomOZhwEC+VtU8u5IfHx72M6Y0rZ91CXeqN +wPwlpqUG+d8zFw4cVVOQT+ovcTE+YtPdT81K28nw1tgL+ilom5ErLpcpIzjrfg6LeWtSqPA W6esXZZdwKDvpqIihtV/S3RxvJX6jvNWnR3greIYZXlLJXBb58gBl3kdJS70/Qa5zOsEcwUa MOgyIgR1eSUodhkRnLs2jiDgBRNFgBcqYEfrBXDwcjIEeIV6OPAahLqZSsCrYx5WoFSx4DWO 2+UP564aK5a7Yis8dqFtW1V+WOyK/eCpC6yVUVfHPKBAK2PTeez8F4EuLAnXDa2bB9UJz83L BewA18V2fnmjBnx73AsRPlQB0KaDymzB7dwcaMZT5Hdp3+30D72qRMXVsAdftoPqnuK5Sc+e 5dSGJuVKrxZ5A4qMVzw/gcEyfuqYnnpaGctP2+uhFJ8qbRp8Kl+DbJIEe0X01DFd9KQulp5i 13F4qjNj4KkwQnl2mgZXZcmyE7yOsxP2fstO8DrFTl4Dyk4gQrGTU4KzE4gQ7BQ6grATzBPB TqiAHa0XwNnJyRDsFOrh2Eksti+Lux2YVndCE0tOvYhWPhydKqxYckqs8OiUPg1/hh+WnBI/ eHTS1grJiWl4J3WxmTPx/cuVqzLN2XoLTe++vX27u97yhFb+2juqX7lT/UiqkVs16i9Wc9mG 3Flx7Fr/VJOOIzwnoPcHb9X+4BRWkzx+XNaZZVAfrVNnLj3oZW66kbeTARxtr5BvmI5oUheL N9GFX8o3dTYN3pywUNhEpu2V4Q3Ts0ypYukm8RzHmyozhm5KA5THG5kmRfDEnsq5MeGAiCOc UCTI6pgWyzkgEnBOKBQkf7F9+i+WUrQDUgHthEIBI4jtM4Cx1Oy88syzkfEkIbaP+W2iZAKp p5AAH+x1O3T3Oo49VoSgnkALAz3jKoM5lp1u0TE9zaQuFnzaJVoRUfCps2PRJ7GDog9aLKpz wPQapQ6wzGPsFZ5n0TGtzow2Nl8n/sfco5+l01tWN/6Egdf2KTr7ypQ5zwJwRyGKBxvLPBPe aPTR2wqajGakxyhqiEbS+5lRGtcpeoKkoMvo8s5A+0/qDEsbxmLhEQU90xPNaGOJI7rkComj 2qphjhNuVJNIjMXCkwmY9mVaGcsdifcod9QaMuRRGqY8eYjZVQKyhRV4HS+sYO+3wAGvU4UV rwEtrIAIVVhxSvDCCogQhZXQkXxhxcyU44f0IAFCwow3kMAPEvBCxEECG03cQQLjLNRjziUN zT3T0Eyp4jBjXPTSUIQZNWYMZaRmCMrgWoKqHDEVltQRnjbAXFlnc890NtPK2CyaeP95WSMu r6hOnWc92arj6itpu453U9VVSjp1zozeLDPBJnqft1Wn0nvTqpN6f+kwmV4d1lCGjsBgWXN0 zzRH08o4NopvkVI2qjQKaHTKqmIhAwwWNUf3THM0qYsDo9R3HIzq7AAXFccoy0Uqt7ZEd7R5 HeUi9P2Gi8zrBBcFGjAuMiIEF3klKBcZEZyLNo4gXAQT1aIPk+MCdrReAH2Y3MvgD5Nv9DAP k4+DBL6+DImYLmlKFYtEUkdfiEQ1ZiwSJWZ4JMIrMDWOWCRKHOGRCMwVIhHTJU0rY5N64v3n RiIsCdcNq5s6ma/4SbmAIcCKxJDt1oH/BZ06bi8tV7oxofuHxTmLgRf22s66OmlyvXybTq1X 0KaTesWTExgsJCemzZlWxpJTdCWUklOlUUNOJyw+NkGCwTJyYtqcSV0sOSW+4+RUZ8eQU2mM 8uSkzmMMyCezl2VEqL0sSotFKBCh97ICPcRelpGi97K8Kmovy0iRe1kbp9C9LDOH+GYWLmAH 7wXQ7Swvg+9nbfRwG1qdoVe+jWdgOqApVSxUqROk1jKoqjFjoSoxw0MV2shT5YiFqsQRHqrA XFkrz8A0QdPK2PSaeP9l60xg89V+yXXwaFvQveMIJe3gedaf1MJzZvy6SZ28c3oPD8kmlS5B h03qEs8mYLCsxWZgWohpZSybRBdkKZtUGjVscsI9bLMNGCzqshmYJmJSF8smie84m9TZMWxS GqM8m6hj8UaaTUCEZBNCi2UTEGHYxOuh2ASkGDZxqkg2ASmaTUKncDaBOSTYBBWwg/cCOJs4 GYJNQj0cm0i1umxWwCZMizGlimUTMURLI84mNWYsm0RmduEJguNFLZojBNOB8RAC5gohhOkn ppWxSTQzLZc+RdCDhtq+ib8ExrcQqw7g8FDs6wel995xxN0HZzLdHsMebtLlkikorlwDH+hd KBwDzgtqq88eDIK62YYjTkN03l7YL3mtDmPGr/d+vsAlNbN6E1ETndtTjJ4N+9kzqt7du71V Mb236Kc5Uc8zjFttSI7BnLsz0aFZXcuYKlIj/3rp0ffyvu5zo+fhDAwWwhnT/0wrY+EsuVHR QxprDelTGlM7OPjV2gHwO2HdtKkcDJaBH9NeTepiwS/xHQe/OjsG/EpjlAc/ac6WSixOxOAH Ihb8NiIOanAtFvxAxIPfRsixTx/WZXJSKgWDlAe/jZBDpD4s3+SkZueVA7+tjAWpPizyJFEy gYQ5JMAPFbCD9wI4+DkZAvxCPQz4DcvioMYf+5i/WZgma0oVB37D2m6WXUVknfpORMlk30ko QzuQqoyuMtxtarQAyow5f/wvGTCm3ZlWxvFD6v13dzcOILawoJt4Vb1njOs9mWqI6k/+u3sY TNHYL2+hRBI8mBUd3Hx4+7bkAGf4co7Nl3rsxSB/3ip+QNt1KgPVL2vT9SdNs0laxqA/Wpia 5pFpMaaVcSk99R5N6bWGdEpP7aApvdqOTumnTIdZpI1Bd44xORtM7zKpi0vpqe9oSq+0Aym9 OEb5lC49sBUGrJYDImQth9BiUzqIMLUcr4eq5YAUU8txqshaDkjRtZzQKbSWY+ZQhyB7QDMu YAYfCKAHNHsZ/IDmjR7mgOZhGl0DFsO/I9PPTKliU/q8xPlJV9X9DpAIHuXG0nuNA6IV6hyA 1AE+vYO5sprLyDQY08rY9J6Gj0nvaPYs8EPdeul2RS/vgowjKle/0f24b9+eYzTXCtP2qvGV nboLGJpUsSM1lAUiySt/lwxzb7+aNgNEh5d7Q0Uf6c7pSof7dslHJtyXM2jlOr3R70xbgdgu 66K9ctU33m7OM+EfMFPfENKF35PnS0C62gThxgGx8iLo9NeapQ7zgAgGy2o+I9NmTSsjAFEd G5NeEDgfVtoZ9RHdmQXp4obWZj5p2basBfaKSj4j08FN6mL5MPH9v1E+rLNj+LA0Rlk+VDDB 8KERofiQ0mL40IjQfBjoIfjQSNF86FVRfGikSD7cOIXzIcwhXvLBBezgvQBa8vEyeMlno4cr +aiTh+ai5u6Rae6mVLF8qL4TqS/jQ7TbusoBy4eJAzwfgrnC77Rluq1pZWyWTcP3Gcs/6kn3 Wb9oaMf0KIcUEn1r65rWjNQphASFnBefoW+WPiW7Vw7R9B7iTfRAGbLbpiN4YUc70alH4FNH ccypNSSzcs4QjzlgsKwnemR6omllBOZ0zdBlrnecc2oNzc2a3liqFN0uCzQ4/fWrSxudOj2z J6xFNo2BwaLm65FpviZ1sdCT+I4XxersGOgpjVEeeqbBlWqQfS4jQu1zUVos9IAIvc8V6CH2 uYwUvc/lVVH7XEaK3OfaOIXuc5k5xJ9owwXs4L0A+kSbl8GfaNvoYZ5oG+Tn/ckAbT/oP6F3 y8R0X5O6WOzpRbQK49iD9kPXeWC5J/GA5x6wZxIPGz+mI5rRxmb2NIIV5PMygBn1ykt4s24T gk5l06s0IccamgrFkrYpafFcj9JEtygpHApbrU3HFAYDZ0ZRnfO3aReFzp2flVFwO6wsqcEc 3sXlMNv1tSVE1/t9eNw97LdhufhwumlR70uHA+cIfIAy2PXde/91Jb4z7cFOSXYT05er1My8 dKM1l9U/qd61X2162kWlj2A8EVXfqarYozlTyrS3wWjNRa2PnqoqptXOxACYmXjOYyZYNOzE Li9Mfzujjd1wTZYXHDRrLcGOa2II33GtNgRbries+JYXwCLwAjsjTP88rYzly8R7nC8rDRnA LA1THjDVMYwMYIIICZiEFguYIMIAptdDASZIMYDpVJGACVI0YIZO4YAJk6hDoA5cWdKyGi5h h+8l1PAjITswJ6TdiIWMz6GmIRaKKLNf+qYta6OfmDZ6ShXHmL06VS/qbw+7qdByWpVR000V Gy3ASmOubLt1YlrcaWVcvk29/410U9nm7ElKz0RrNpLsz4zaMqon2ogedjN0ZN90xkau2fna HRT+IfoqXh0YeD148lAP/p2lVX/WeKad3B6R9d69BAB/e60OQjeThRJSZdD6eWmGPhM0FpCM wbLtxolpMaeVcXiUrC1lz//VGgWAOWVtMfnIGCzaE5yYNnBSF4cvqe8ovlTaAXopjlGeXmSa E76BO7snCCLkniChxdILiDB7gl4PtScIUsyeoFNF7gmCFL0nGDqF7gmaOcT3BHEBM/hAAN0T 9DL4nuBGD7Mn2A9L046uoCRZAb9ZmDZwShULLnO/WRpjcEELYlVGLbhERkvABcz5j8hkwJg2 cFoZm4IT7790NQxLmnXDVPLdmhnm56+4nTlR8lKd+1+34PbTlUOZV3ouVrb3agORRU/4WcQz z0uSqPbrRHKUa+DmFJ7Pw4M/7T2nPvrT3C2/bx5StYLZKqTvz1Me4phZF6VeMVOfiRKPmWDQ l5moZW1mHnuglbGYGWeCQsysNGow84RMYJENDLqKExkx5tEEUheLmYnvOGbW2TGYWRqjLGb2 6lqmW8+MCIWZlBaDmUaExsxAD4GZRorGTK+KwkwjRWLmxikcM2EOXQlsSmKECtjBewFbIpuS UTkZVyGbEn9DPUMkE2NmN6ilrKT1bGYeTaBUsZjZL5ulMcbMAcXMGqMWMyOjJZgJ5srazWbm cQRaGZtzE++/YH3s9s4k322u3eZ1v18HiRne6VKvObdi2h6Jhabi84LXTc0i2M08HAQqrU/6 +y9S6zwIgMGyvq+ZaW+nlZEg0HbpvboBgX9DQaDSqAQBtXiecK/apR0MFrVjzUwPOqmLBYHE d7QHvdKOAYHSGOVBYJibkT4L04iQIEBosSAAIgwIeD0UCIAUAwJOFQkCIEWDQOgUDgIwh3g7 Fi5gB+8F0HYsL4O3Y230MO1YfStcLZG7WZgedEoVCwJiiJbGuBkr/LpZDApqHDC9WKkDPBSA uUIoYHrQaWVsXkvDV/mMYq0f8Ihi6sc79zn7E9l1VGlXPaY4rRm7X7KfXr5FF5IuHGIz1XLE 2/4qGOrje1cs8ViltyO540dx2qmdE90IljrK0w4YLKQdpsudVsbSTnJFoc1HtYZGobN3YghH qVpDgFInrHA2OYLBMpRiOttJXSxKJb7jKFVnx6BUaYzyKKXOefQQlGs8MiJU4xGlxaIUiNCN R4EeovHISNGNR14V1XhkpMjGo41TaOORmUNi6w4VsIP3AvjWnZMhtu5CPczWXTfPrl7G7HMv TGM7pYpDqW4Vm3V3W1PB2KnK4tLCShRZ/PG0r8qtMm2wLTXNYpsxV9brtDAd9LQyLpen3v/W Hh1kUOfM8Mxr3HqtieXueHdQe6F9UHIKDl6Pa0ko31R618nlQyaJ1DuWb4zBsu6hhemuppVx fJOsEmXVnFqjgCCn3K0mqRiDRd1DC9P9TOriECT1HUWQSjuAIMUxyiOI9GDanPs9JAgCIkE1 J5NecS0WQUBkU83JZOE2LGjkpBSCgNSmmpNJ1m1Y98hJzc6rsJqTSeltWB1JogSBNHOIIwgu YAYfCKAI4mVwBNno4RBkGl0qZY5nW5i2Z0oViyDTTLY9oyd7Vxk12zqx0RIUAHNlh0guTNsz rYzNdYn3NSgQHugN3/Z1cE9Mvf3kNl/0uz66KsHdEU79uT7e/Qy/f9pu5bizipJWHzzz10Wj l9f8KjLRwL5fzR1chGf5Sk+WWfUIn3JV2RwJBsvOrFyYHmFaGde8kdyIZc0btUaheeOUkNmM CQaLzpVcmB5hUheb5RPf0eaNSjsmy5fGKJvlVUoQ9FHRRoQqNFBaTJY3InShIdBDFBqMFF1o 8KqoQoORIgsNG6fQQoOZwxY9VxIXsIP3Aui5kl4GP1dyo4c5V7Ibuqad/Adm6onAhWkSJnWx eX4c1XwQuzYjv2tT54H9/J94wCd9sBd86iPjx/QMM9rYtJ9G8LeR9teShkqv6p6GhTODOAxN 11V8tdil3VFf553xhicGMBh8qqYuyZXp92S0scwQXZKlzFBr1UDDCTeyTQNg0X/MJoPGtHzS ylhsSLzHsaHSkOGG0jDluUEmGY4bQITkBkKL5QYQYbjB66G4AaQYbnCqSG4AKZobQqdwboBJ dB/+p7Q8gEvY4XsJWx+Y0gKBE3IFgimtEISahlgohgex6O8qKdilWJnOT0oViw5yFrarJIUO +l8rwRA1nohWupJxhCcIsFa2g7Ay3aC0Mjb1pWE8mx/W5LtGzakm6qkiLqnqhzfsF50fP2yh QD/Ior5eyqrfPKS8Bo/V4A2gZ8ZL3p2bj12akT65J04O+ovGgnHd6uO1r99EpxOqE2duHEnF j/LgZFHnfKdO0BCp8zxYgL2yDYeVaR+llbFYEV2ppVhRadRQxQk3t00SYLBow2Fl2kdJXSxT JL7jTFFnxyBFaYzySDHIT6oLjRQgQiIFocUiBYgwSOH1UEgBUgxSOFUkUoAUjRShUzhSwBwS Gw6ogB28F8A3HJwMseEQ6mE2HIQMohiK2kdXpn2UUsXShDrq6kSYQPsRqhwxMBH7wbKEMVbW RLoyTaS0MjY3JkE8FSWQrFfpluntTNzCaeUXaGDQTxO/8VIBagBcqOwdv15yxIvlmne2q+Im KLnAN2JeOghmbsQ6N5kzlBkYu7QvUl4sqS8shhh7ZX2dK9PXSStjMWR7NRVSSK1NQyHlq4JJ K8ZeUePlyjRekrpYCIldRxmk0oxhkMII5RFE5iv7URtDEBAhEYTQYhEERBgE8XooBAEpBkGc KhJBQIpGkNApFEHMFOJPsOACZvCBAPoEi5fBn2DZ6GGeYFGPHth0LeSf8DtFtEzbJaGKIxCx jA15mHCGQNBDVGr8AABJ3OABBGz57XEygEw7JKmMzXFJCH+FUgZ0N6ozOfRGyNu3u2uf2e+3 R6LpP+qzK+DklQ/p16P7TshMQlaeudoGu+tQF7t+0WdMnDDvNqWBOb/HT84704tIKuNScuR7 aUquMwkZ+YRw2fQG5txuPxktpg+R0sUl5MRzPCFXWYF8XBqfbD4W66C2Zql8bESofExpMfnY iND5ONBD5GMjRedjr4rKx0aKzMcbp/B8DDOIdyfgAnbwXgDtTvAyeHfCRg/TnSDkrKovjC8o CYiWaUKkdLEZee5LMzJeCqixb1oTEvt8KgZrZbUA0TL9iLQ2Nhkn0ft/2JdwZgjVOWNLGEN9 Qhc8UrHT0SR5oNL4NKkvz0mN80QABss+pYuWaVyktbFMsL38Spmg0qaBgvIb1i71YK/oY7po mb5FUhmLBbHvOBbUmTFcUBiiPBeoK5nhAhAhuYDQYrkARBgu8HooLgAphgucKpILQIrmgtAp nAtgCvGtAlzADt4LoFsFXgbfKtjo4bYK+qkpezpStEzTIqGKpYJhjdZFCgu4voMaR8wH9cQP Hg+0sbKuA2mEoQNKGZvZ0iD+el0Hj3sxJVkz12agRXItBkNwDHpJi8F5sen1WU9frMWgznnT YZA6z1ODtlfWYSAE07pIKmOZIboqS6GhzqZhhhNuY5sHtL2i/gIhmK5FSheLDInrODNUmTHI UBqhPDOMq/uEizEDiJDMQGixzAAiDDN4PRQzgBTDDE4VyQzj6ms4GDOETuHMoKeQQAbsdTt0 9zoODFaE4IVAC4cLonNdI+xtwjQqUrpYYOimaEksAAa8oFDjiSGGxBGeGMBaITIIplOR1sbm xTSOF2WG/9N7/+dFTn1r8FBfR6g0buoIiXGeCMBgKRIwXYe0NpYJoquulAkqjRooOOFOtQs9 GCykAqbtkFTGYkHiPI4FdXYMF5QGKc8F/eg+4WJcACIkFxBaLBeACMMFXg/FBSDFcIFTRXIB SNFcEDqFcwHMIQEGqIAdvBfA0cDJEGwQ6uHgQKq1aZR5XFgIru+Q0MXCQdsVPwDp4ADf9q/x xMBB4ggPB2Ct7PADIbjWQ1Ibm+LSOP5m9v6xtFsXEHUAglgzATkt51can+UtP590MdmECQbL zjwQgmvxI7WxOT9yvzTnVxo1Of+EmNlFHAwWHXogBNflRyljc37iPJ7z6+yYnF8apHzOlwlC uGSdO9oIJKiTjQgdNuFrCfpcI6+FONYIhOhTjZwi6lAjECLPNAodQo80MlOX6RYIBLAA8xI+ hzFTgLoRCDBzpCWYOfJm0taHQIafRy3EzKMzluuh8DL8XGsheq7DgcW9GIEMfj0UCen7MF6F Oqx+K1dY9d+yzOqWH2W0+m63qOdSyz4TTI0M7qpCQC0P2qf/BXPP9T4NCmVuZHN0cmVhbQ0K ZW5kb2JqDQoyNDIgMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2Vz PDwvRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9GNCAxNCAwIFIvRjMgMTIgMCBSL0YxMyA1 OCAwIFIvRjE3IDExNSAwIFIvRjEyIDUyIDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2IDAgUi9H UzkgOSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4v TWVkaWFCb3hbIDAgMCA1OTUuMzIgODQyLjA0XSAvQ29udGVudHMgMjQzIDAgUi9Hcm91cDw8 L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVj dFBhcmVudHMgNzk+Pg0KZW5kb2JqDQoyNDMgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29k ZS9MZW5ndGggNjM4Mz4+DQpzdHJlYW0NCnic7V1bcxvHlX5Xlf7DVF6WSJnD6etM77pcJSuK 460oq5VY6wcrDyMQlOBAgExCZrS/fvucnnt3A5DQZ+x1JVWRKYjkd/p27perJ3f79W293Gdf f331ZL+vl+9WN9mPV9e7D3+/uv70YXX1on673tb79W579erjmz189JdVfbO6++ab7Ns/Pc1+ fvyoyAv4X1WVLCsyZVQueFZJnhcyu1s9fvTDH7Pt40ffXj9+dPVnlpns+vbxI/jOImOZZnlp v600JtdVdv3efs93r3T29t7+2uwt/s00f/vu8aMfL7LF37Pr/3z86Jn9bf/9+FH27PnT7Cqy iG93+/3ufXwdf97t9l+6Dj5ZB6/KXJUZq/JK4jKQ+oboZ9evvh/TfSaaKMpcswja52zRZ52z qHSujD0rCy4zpnjOqowVQHdP8KnfF74O3Y+aXOnwPl6Ki+wa/nyVscWluigW5kLgpwr+yvGv 080+gySpVF7KGEmXaaGqA1AMF/k/xaK6yAtYas4X5YXCT19fwNcFfM3hjyIlWYrzvOKz7IDi KgqV2Rcj7IfLHy+K8vUiKaywG1/FVjh5UA6NG56XokUzudGhp3DCd4Up6n7w8EYo5m3DF0OK guc6+vaCm6A0YDRQKi9g3/1NOOG7IsfS/OCJBCGny65efai3wOaeP/3+T1lx9dd6+za7WG0v v/t28WW83pLLQ3QpA3d1StfTHLlRfhbD9yBL4AxRTJ4WrFK5jC0wu7S/2rjblyfGhe8uoovM 0oIxbiV2FQN7vrACZnHJL14kRlUi1zyG6vPSM8GOLbGGq7qFP27gD/zr3gqYHXxx9yl7cbe7 XVzKi/VmweTFCmXNS/zPzwt98RG+WN8tlPuX94tLbb/S7hfu79MuRnCT25877XKEWAFLwAqE Y6gBZmAliPF1sSebTWb3sry4xa2DC7U/a1sCBNjXqqooBe9AU1id93YCoKY8BPr81XnPJgDI mEWM4Z33bkJovMgrHV1e+2wUPBt1Ue93cPXv7MP5lJwSLVE1CVOS/FyZLnMRQ3txZ5XrHawY r/N6s8Ib/XJhWcPPcMs/wr9ZhmA/XDlusIWPLSuQ6UnlVjEvolcCKdwt4FTal3cNf+BfayTr 3jLAD/Y76jt8I/jZMvkBCi6Qb810gILrnEdPsFnqghUEyNK+mTKGjK8F784+PbI6tGY4ZmvY wn/ctV3dJCegMrmMLj39eg3LjYnBvYFN/gR/4K2vSQ5bMpbL6JZfWz7xVwB/lT2HLUerHZ/f 8wwIcy/PfrFZ7zP84s49V/vVPx35ielVhbQ6bZhetKdQof0q+T6pwsTFVn2fHs9pI1a3lb6S hMJqdb/EzV6/AcUu/VswzsKLkPDvBIoIOhDDcCeohTyBWsgChJUy17APhbYCdULX10VRVt+c px77gCbnPAKYngEYHl/exTN46nknc/Er1nGkNYk6wKzgA8sqSBCl9GHScuMqAhwSPlYvwn1A Rr1aokLysVVIrEpVRvYvtf4kZM7KIN09R8zTw9rt0myua8qlXaSIoDk18Ka7mM+s2Bruempa yioXYVpgw51PhaWHtQZiGT9nByvS77wRsdX2emhqxahQEIWZ6W5BFMbE0Ej1XWtSCPV5HOcr uNJOIbzP8BNPEbBvYcCXNmjTPiS/jtKaCVyfdkYheS1SyOsy5GAorETLtEF7e0rY7kxnVgBO H4AjkI7VAbhnyeEE4kTgkt8pJsBrEUGbqCDNV5pUFymRsUYIIlVGwHevYsifr42kd9rwvDKz XXvwEUkWg3t4h3zwjsZFyit+AHv/sHN6R3Kxaz+KvoXXF+mFoMh59EAHDrjUuMwqdtHdfQ8i rQNPr2dY9qbjm+zHps/GK8HhM9erAU+eiu5tyHlTDXw369V5kZ+If03NuH5r3MbvVt3yC7xi 9sttK0z271CTwn9Z7qxg2bp/7hjrfr1zkYPUOpW1LGLyxgVsidxb0vI4E5Xz6GeuceXvOiOr jx8M94zESdkqPZUAjXNK3XKzbsIT6YGVVdCrGHBrdhKEbkwMk0TFkTwGh7oDvpNf8Pbfkcg6 ZkowMSM04JWrf4G9RqdKo3allrf2jlnreq5t54KhuA3D/cMF3xWKvoeNs+neTtjVLYk85lWV q+hZ1PaNWdTNqr7fZ2hYbgkDUULlRh26msHYgyYKPYjSgDctQk5yW0hULFfR1aff7ErmRfT+ n5f2GoSzT57F4LadlBmJYgzXN87V/hVUBFExqzgxGaNu12sD6ZFVCemOp915TX3lVXFoH75K D8cPyHmCmJ46sNfdzSNSZkoGOcK/gjITBl71PvQPnV9jvWBNfkzybCdm5Qw4OMLUEKgYBfh4 Y7veJwIh13EqBwi1X4h8Co22ESYHDJFdR8w/WtsEPwpoA+6m1smPqEkknuuIwOnPWQxuvb9f qEH+T5OWsOxMEd9Gg1TH5p8IZLOIkkogm0VeiRjcHrRy6Vwl6627CulNd8kVpMbMtWTJnack DFen545SlIAUBITwGgO72NreNYGyYY3u2EqPOWmSi3xpFbMyKiXSL97yZRaFg7XW+4F3d6AT OuubTDzrIud+HspQHY3YxhCM2GdrJzVBqmonVeHbHfm7RROgW2JK8bY19hq+lbks1PTxYy3Q oxxe2QkRO0kcsZNVKCOcLGIXhiO7UGG4aIYNfiXmCW+FSZsjvBVG/pJkG6KAU5hAJ2bTg2oF JV8R0BNM4c4Z+7Brb87RFE3U8VfpMxhFVaDzPbyY9KGcSqK75MBdnho3eIg0Oe2SMwwsham5 aV17BFqMPLDpoxdtjZuxZ7WzJBpvXnN5alcAQMYXMeTvO0BbZT5o9CTngypnEUoIXa2s0lD4 EMYdvdvkjKZwjCaIPE8okAsFCX1hEpJnF3MLA+kKQTSCZMUChUcQzb4x+9w+dVlavfG6+dQq hpsVBCf1wCNRv1k0XP6je7+NVgwBkZE/EoTDZsGY+xQlxL1TKcce1ffpKwkMFG+EF50++8wy 2DL2dgjYucx5GUH7wZ7MGnZVDA70Yydp8bO3XZRk29gKevB9zjQg4q/Wbg8Fv+/BnYLo6DjA R9+FtSeWlgv6DFyTqH45g2e/vl0vFwZ9DhlqJS5VozeRmp9ZbzsdboXft3zXvYGYR0fj/2lj 7sJYs4jF9qlPt2x1vqNBCT1QxHadbdftR1wZ0221D9FNYDLk5z7m+CW1PEIk9cnMNzsCmcsP 7IXv9+2Vou4AG4UovYgyGAQPU0Ygo1heqRjcIAAd9jmPr/nAObu+wd1yj369/wSf9Y/ojas2 J4gnCGUgl3qu7ROaQZFkBG5agDAx6i9JC2gkZPJFSYMbvF9vNouGl1Fa+VJojJiHKUG5s0p+ EaRiUdZCoRooAb0ZInBDbwWwlU7cj1jLIBGtuRKjgyETCAUPOV3dufTZXs7RioS970Sgsxrr 9cYqpvYLrCAXGIzfjTWf1qQkYl/hJZCUH4kyBtcrdjEXQ/IkHfvEZ1y9qzyKwIFt0dyKJWxE b47cNn1FzODiuPuwTp9aak8IUkvDNKbPzpEa41MnnUDIma5oy1WVKSBcN2O9ahiRrGA1Ahfy p3NigdtUrEYomqFkNYL8G6gSKQy4+ee6GpyhUIjAja3O5No7dmuLQTc2lvZlQ4b01OlrVA2w 7OjNIBBIms130JUG52H0xY3TZzxTRrb+mORCgUMzjbl2AUSeiVz33oje3aY3tbBsdbZlKgWm 1gEm5/hY73IDs5MgX3XOo61M9GiPa+hdqsGgeVLlPmn6XNVZp6j2Hqj9aglONtU6AFOnW7IK TKTImnrL6IaEQbdqAyRx++iTXjudy6dxrg/tNOfB3Nq9njFZsixRzoeJ790rKxfL27Y2ZOuz NJC2dNlQvPqAFhtq7Z/s3Xg/cNhkD86d8873YG4+dTr8Ia9meiZXQVw3svSgDzV53j/Dtxim IL1lYTV4+z4icOn3t0RDJgL3veUbNNwAGGoZxXXXdVL9SdD86hANTkfAd4EGvus4t0mf/ldC PtZc5y2lAYs1AocGfH3v+gE+rB3fO48GxkNJhgacZhEi0pdVGokG2lxbbEqomojAPf8ejLC2 iRqRlNMlMM2TS6YI4/xgolY6RtFAdE1jgkdEbGs32fvaqTtDl+kpifPjIAaRpxIK6wsV2wCS LHpVxuBa9c9qBLjmca5HowBi4kHyeImC7IDZdsHilNFN9/Tnzn8b16FHTu3k5roUVS6i73bb h4Yb7Yv81spSHHi26Vmm1UJEFYMbpgdQcUyFoSpPHjYZ2pfh8n+CDD4mTM7C5GAHAPuLXSHC OvkbZeDTju0Ege/SQOF5BM61dFkv33Ueyz3wftcFu0+e6no4lKR+Vs6dvyl4KqTFIVwI6PoQ 2SVk502f5qZ4IH0idAWF6hECUH64Q0jvc4E+eyay60PV4QHS3fBmdPcltThhBTqWw5QkiCqE lGTBDFpmYdD0EporwJnr+QuOrD7Gd8eBxBDvRXdRcmNYQV1fhKjzTP3gEZcl9BQ/bc9DUUSd IooYIKyVihBUZV9CWEk3rwXGGAXsKtJ5LRFMmnktQbDRvBZ/MNZZuPDdRXSRNPNaImAvsLf/ 7na9OU+l9WE1g5yXCGzqgS3W2gGHQxgsOLBFX7gcbTesxeozt+smqeYlzGRQoyEtmnpGi3Dm 00kXIvT8K8oZLapgOTNhK+EdSWCv5DmPAyeXjSV04YrCwfW4rLrRHcn18sJ+J4+Bp5/QUii0 /MJw7YQWPRnQYj9MP6HFGiQsSglBOw6WlzE0fxSLCU1iCbknkps+AhpnHHpzd11647YN4g3s gmYeC/wzTXo7r5xyHqZw2OXvfsF0NCPmUDvl5PVI0NEB3GEn3bUQgzW06WPS7qnP+SnTx8KI ZHHgCNzzHG5LuNPwIIksuc9Hgitkri1gQsMUkwjcb6H4utBg+B8gcO4oBlfoAJrrhMDpolUM 7mG92WR3/VGs1r80tYBdB5hBInbl/Nk1Gs5dbocrKbws0Zs8LSmEX3PTVQK7eEtTyuG1/kwe nmQQDT149PrQyRNE83BqboSiGuXDT/Vy1Xkl2gYeE0rwpzr2io1pJcxDLXL7qwuGpNz+MSWL 01XvTHeOqn2enplAtQkPgD1JfxTQuaOsAliUXdPshVQhyFVX6+hKIOFFhWog681D7fTVy0ET mEE1YZ/5RMG1pAkQT8CwTG7vsI/0+gLW/mTbtwr9Z3r9L4Kd3FaBkcyiDCA9tdp4n3TulAic Yv564bik8WbU+KU/dZdk0vzdld2+7/p7YOlWhg3nCRLkpMCyMX9xQ3m7YGoUOKbnvpXMQzd4 WI3bB4bItEVV9g7aUwODljT/9sMZJ38BTEPM0CcyvbFecpi+5yOFHgDrH0DyTqGcFZBU4RNC UFPAoYRhikQc9WMGGkj4y5t/4CLXHGXIDDutFfJxDwn1XYqKhSBaQF4njyY6TutBO+bv6/Qu GzKicWSdMt7l8bwn6U4lrfbFwjuW/ngkr6Cc7+gL0PMIIWyZ5xMT6glBJIGk6iNxny2B/re/ Ol1jsKHP0Ax7yHzVrckur82zuGmT8daIwIdNQvr6T9cHYLXBWfPpx6fwEkcO+ntBMOJPInfw kE5wzbGCKCjroh/Qi8aUn0sTo4vHyoLDxIChNkAZivXhaKKwU5xRAFaSBGD9pdHEXn0c6rCr j0gTcfVx/qvrbNTESlG4b7JmxZb1nRRobXhq8kArdB1Sxw8++KZTTDyOBlmhxbUemVyD+CpV xNMHnSfY6eNSxTl9JLigGi9oU2qTvsSEySIXAWgCZxn6So8eIyoLfowT0hj9IGfyjMoCutr7 NA6KJdvk6tPDm+ntLmOgG/4MhyYK1Kp8pC50mtz+0bkInUAo9JS8nNBAY9Y5tlXxnKnQtsYC zamtFnuuIkRA8mi2LLDr7NFNDUqxJHOA45FsoYuxaKUMYntgZPHrKRL4o7hy2unz/PpMBTUY e8H5CDOskHEcLO0j9b2xDsWod13J2DBVuN5s+gqaPmF8te1KCaahf7mg6MGvDBhv/tr69IK6 q3vzyTKWKkxISM6RscTZJ+s80yrC+42Z4xpB+rxiAaRRnKV0OQ2DKn8CQSChdYRPSNMAj6CC nMG4mKN7HGTHxEMeQP4WI48K1XwHH4mqj56P5POSPo0oeeyHgW4/w2K1QN3eQzqNLU9mdDfV t8PpkacMK+h5eI960/0O96NNY4v2Q/zn/3CNLRzPh+bLBFptqVHf8/aHakI4NC7WZQDwlASp zDUYn/QPH3uyIeZwvA4n8aqUwASgGV+vKCHANW/OAlMVZLL42On9DppDMwIfKRyy1QRuexjv W5gACX0JX6jLDFVEBWYBWAnlkzN4NzA6jqKWUkOTOB95jjY2kCbNQuAEoVUOdqCPFEuWCzAe f7gWRVlnWUAg1icUI85v4f3Xg7b1oaEkMjaWmTgxBUKSLHKHcbNI53U3nJOrSSTqWC/5bH0z cO91KaXJ+Y2BNC2fPMiK7V/Z+0nYkqR2m7MAHaNIPrAapy0t6/3q/LhZMJqJPUF8Qk4xCJI0 qj1gEDAJ+TVzGAQeEtnD8JAiBkFyrUKj58SD9zrgfp6ynvxd4PSh0Mn/Li0Cb51gESQ3BlgY i8zs8JB+F2bHfDzCtYX6dcwOD5vM7PCQ5jc7PBJ+XbPDI2c2s8NDntPs8MDJzA4P6VSzI3mo UaAD2qOnr1ZJDgkDREOQBA3WKgz5eUj/D0wnaKYbYk1056KKIswN0zdZLnhYuoxMMz1uQU8k 4rjVSSYRvMBwKAJHNQMh56PfjpJgyc0/Zn/A8iOfjkgid3qzT1TAen0CTjH7UnQWiiSMcm1A MM+VMOrD0SSMTnFGCaOKJGHUXxpNwqiPQ50w6iPSJIz6OH/bncf+faRKQm9P+hVVFQwQ9HGe NAV7wv1h1UwcW6kh9C1wdJcenScw5ZfIo352xeFdOiyWI4o2HZai8ZAyoFYcvddBlpWi51g0 H5bLCrrDzJsP64POkw/r41Llw/pIf8Pi+fQjFHgRxku/Mi4gU8pHevJhoVpLb9nOzUuv/ViO HUKnmuEauqNtQdFvIt9XlXnFAmQezvfdtu1NQFuepPpSlF8LqzMbEyCzwXYeUQITVYsA6LCZ br2o3K2dXl2CyaUcyrwDewAps4o+Y1Y53cPDT58xq7Djz9FXGpRzKZrrHciYhWbHRg6IosyY 9cDIMmZ9pNCswL7hE28LJUMjWfeuzUfkWQD/uId2OvqE2a4tx1l1g8R7xzemKmKCYvNrXWTj tjfesRzT9PWeEz/KH+6aH9DTAUt/GHQLCkbfo0W2GqcGddGZ1f4jsPAP3WrCE5N6j07d59ym r5xvD5speF9TX2fXqbpbNFDYdPx3e1Hv17CZb/t8XBeR2NmzO1Zs2w9M6X7uxInvXj2uO+jN +k0fxq/3kLa8Ale1Htwb/DnXwclSXg0pv3PXrDn7ZkBte6uhF5D98R/sut71IMO5xE0DEgRY Tkaswbp6P3o7hGDcwIRm2mZ7woXITVhkDWKAt+MEhHa2mJ9m/bYTstvBjm+yrgPLkXERWbAX Y9foZzwYub1u5fCw+lfhjRPu3XVl16arOZwHy2i2ro8XsqUPOBXFu+awA/3eDJ969wLK7gHA LjXj4toicx289hS5Jc3xMvvfSWx4tK3umt21W9Pdf/tps6fG8yn3l/SE0HLzNP8N3lzftSm5 ysF5CTki3nIHPtJzEENl5FwVkFrpQaZvb84VlrV6SKcoOcQNLllV9PPaqZUcD4zu2XhI8Y6W oaSQbloSQVAA6uGqAIU18qx/aVG/PS2K6aqfbv4vLep3qEUxhcMHidWo5KykYuBR94nfZM6d 9CW6WmrBLnF4zZRG4r5hMCrZBDYm9ICqURYdRXo1FCCXAWoGHYPc/QIGoob8o7n6t93bqAdK bp8bQJPeLOAH1BftIgU5UhYwis0nZ5hAZ8b5c9HeUFTjXFt+IlU+yjBu9fSWqTgWm97rzVnO fPTk6jrjGuIjHhBJCoUK7OfIdEMPen3bKSvrJUU0wXKrGdZbQosSD6ev1W1ujx4Yxo0ETs5E Cw3BR/o186KCxhse0DgmEVKuBhb61Ko9bLEnD1oI5JTTFaQvaXZ9ko6dSciS5LTt2KB3/2e7 8DlhOzbG2ERpJ82u8eFosmumOKPsGk2SXeMvjSa7xsehzq7xEWmya3ycl6ufMHtkaXUA6WZf QSs22a627FNPnKU0Yyu2CroSHT304HsmbcVmQP8bkTRD6okPOk/qiY9LlXriI2GGwk+NyEwf XnZt2HxYqjZsR4/wV03LcG3YfBrPbMNG0cDFNUjzSSVukOYDDgPQ91i8p+g6pWkJCSkzXFcY 1q6C+zucmWAaW3LwPilG/UpWQUpMgBi4el0kyPktqPNRNPbc8mlJn49izS91/KyDso+4gZs2 eTl0e1AGaqZYZH4SDyiUiyKCAZqeAzgevW8iJUSmP/2WgOnPAkDOfsVggBrGQIZbZQY71Ye3 xqGsXo40P2mmewwf9dGw4cRAshZdTEAr+WObi+/t/wCAgyJNDQplbmRzdHJlYW0NCmVuZG9i ag0KMjQ0IDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0Zv bnQ8PC9GMSA3IDAgUi9GMiAxMCAwIFIvRjE3IDExNSAwIFIvRjQgMTQgMCBSL0YzIDEyIDAg Ui9GMTMgNTggMCBSL0YxMiA1MiAwIFIvRjEwIDM5IDAgUi9GMTEgNDYgMCBSPj4vRXh0R1N0 YXRlPDwvR1M2IDYgMCBSL0dTOSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9J bWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50 cyAyNDUgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VS R0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyA4MD4+DQplbmRvYmoNCjI0NSAwIG9iag0KPDwv RmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA4NDYxPj4NCnN0cmVhbQ0KeJzNPV1zHLeR76rS f5hHMiUOZwDMV+zylaQ4uVxFsc9iXerKzsOKWlJ7XpE0uZKs+/WHbmCA+UADs7vA5vxAk1os utEA+rsbly8fd5ub1fUu+/bby5e73er6w/p99vPl1f3DPy+vvj6sL39c3W7uVrvN/d3l20/v dvBP/75evV8/fvdd9upPr7Pfnj8r8gL+a9umzIqs6qqcs6wVLC9E9rh+/uwff8junj97dfX8 2eWfy6zLrm6eP4ORRVZmdZk3cljTdXndZlcf5Zi/vK2z2yc5bXaLf3X6r788f/bzWXb+z+zq P54/+17O9p/Pn2Xfv3mdXRKLeHW/291/pNfx5/v73aHrYJN1sLbJqyYr27wVuAzEXiP9/dXb v47xPhIaL5q8Lglo+5Bor33mbZ1XndwrCVxkZcXyss3KAvC2CC8d5z4O5qtdXtVuOl7ws+wK fr7NyvOL6qw47844/msFfzL8c0rsI1ASVZU3gkLpIi6o1gOqxEX+V3HenuUFLDVn581Zhf/6 yxn8XsDvDH4UMdGqGMtbdhIKVKwiQWXyxnD5j9c/nxXNL+dRwXJJ+JZa4eRCKWisY3nDe2hd 3tWuq7BglBsj80U/ISo2I8PBIHnB8pq8e04iVDXA0KCqvAC6z4mwYBSxLfqLCxFCTpddvn1Y 3QGbe/P6r3/Kisu/re5us7P13cVfXp0fKLMaRcYhaqVcQV1nDcivOQu+P4rbCxe42gMuOwoc d4BjrQfc9+cX7CyHH1fmN44MCX4rz2uJkPxl83Qu1G938OE9/NhlH88v6rP1LjbGrChyUZ2M QEzela6hwK2est0HWO5aLl+cXW83a0mC5mx3XnJFkUdg0utr/Ln5jCR5io9k2+aiJJFUuK0B B0RHKgiba0ButQO8q7Mb89G93NOPMDw6jrzq8pZTOAIVxdn6vCwSQG5ELsgtfDrnZw9AhO1m l+EvmhDyt9/hx9fY+IhS8kcSnxdSrcGTs7pWe3UH/7sFTNQ/j48coL9+hL8/y61Tv72AcbP7 CN+qE5G4ZyOV5PbzJS09evJPffbkgNGJMBdpBT+32ZNcaOw7xJu8qKglfEaKxwcqurxpKKDx +YRUlVhHgfvlDHdI0R0Pl6L500PPGfA4vdek6A8kbpH95EGOw62EgyvOdg797WhOUuTym85V oMaEClOegINJ+4A8IVfy3qp7CfRQlLsx10/9/SI6SqBq8ZOdHyFlb0lSAIWeUxpmyMpWd1JN GHKkz/ChOkkb+C7ygq+9VmEOYiJeJS0BaYBMF7F5j1AV3pvdV8NK7w238rCn/qrIoXdyHXte lejXvRZ43d0rjc9d6jpvSwrcnLsAR0GybW7hT0WE1TaDfxqKNUVDfSomsgQIeo1CYbdOwGmk XgXXy72iPP5tLvF6Ldovlw1UJraBWJPz05lATmjJ2IETmt8AYv9SA+g05OntHye0oS4aG67c looTcDV3iK6MSelGLfXzWLQnUM0qNOGcwJ1G5MqIpgX6detQr5sE28abGnUkcttObWopo9OJ jjWTFphasRFrmlxQXAcUJ6MpROcfArxsIkiTU5uOZQWO2fSmY3xGpS4ugb/1CEXnVhgZIuAm 4E9yAhLcXLlT2txmt1nt7s0+KSUYzACt//ZHrFeApRGQQIuTfB20OBfqSe1FUaGfx00yVCjm BmOd1l6E4GV1skPDOzkBSYFUBp4oBDJ9N9SpZZFOpAteop+C4AzIj+56r4rfJO4lUi+14Wo5 DdVEzFlSlM0DM26TOD4SlQB3A4HEnNHEBt/W6Bh0g4+/WmlzVg0F7tQeBMZz0Z1s7YzVKGTc 4EZCxgh3nxdh6oFSF2uoSKSQNorru9cQ32cgWmSxi3bI5TNgMXwGDsQaITmHyOpOfmPmzPi2 KJr2u8h+g6bLGaMgxj+sEgy9QKfnQBg+7nYYPK128gPNUjfr96B046B3KKmUE/UTnGcUYpmU BSSYcYR2hbfgvYH//XlHfKuDtJLe/nnUxk8zQjP6EZZMhlcUIWGpSBc+ostxF6lk7gBlWaY5 Pk54dQlq6TJ4rpvL03r76lb+b45YKncfAS6VSkOAC92n6KpNmwt2urXXRd4JCtyRTCK6LiAg mkDgGmabsdFpqrzjFDo3xgvxOFeHdZR+pfzBwE0HDgn4RMeL5I9vMm0VIHU7rd5PjWUwDJRv yATWLho0JRxWxI2cxhoQX9CTs9qherTC6Mlug4YQmhAa9VWyW1dLHnuIX1DTA+3l1RMM6pMd bnrfJn4HnUBwBBo8ppk5vh8M5QDaRAjvHuHnJ2UPRs/NKSHZzrVy63x4kSAlqIbkQDfBVVxS BSs36E2bH1dFE3s0rVt0K5XvUqWbKDV7agdaauJEGejkiYO6gjd51y47X/XoeNX96YqNUcvB w+vGSJkyL4GOd4bC699j41CVHhzm6byR7njV5NXc3/FaXjYrTd7ksGIMpUkTTNIiuqurrGtp DlDYJBCtmNFNgKMU+DTBOgKJGyt10NP6yToa4ydTFcj03IgYDqyAb+EarDD6MmQz4M7R/FnS TLuM5QVe2W/GN0XKBjLLCbxHSscnKccfBoJZc5WdFD7RY2os5yWFVHyPQoPu01NdHN40OVsK zmUGicRmkKjzwuX7TGQGucElU8jc4PxmUCDvYW83RppQOrG0qZ4zULGV7/A2+gkvypw3J9tZ XvC87ShwAQdygiBYic4dNzbuIAig2Kd9KRNGHh7KhtGh+89Kl/0qrYH4qlwl10AtYWVOktOE qRNlNlRwqMTJDlUFh4pkF71ZlopJcQEZC1OoD/aIDO3v1hiBsbFpCnTWuLGxmRNre36RtyhW eaM+7xQXtKd59QS88pPJYHhQSR9SP9ugAnRnnca7DHnpvbLeMrCzxNDO0mkaWa+ZTI+gS7NS LoDBVbq+B5zxqyOmWM++u9kB5jY59os186Qpo1ei2D2uB2pOjbEDGH8T396RRi+1QfHvRNmh heEGZxlamuhyfzcYd7mPr4d+JId1P5R68SOYBdribsyA2Vslv8ejnieDxNcLeAmBXAKv1W6n wohwVPGO4s1C74hDzCTJAey6nHMKweGtTWD41BiMcIM20k3dZsXLNtcJKiwKDMG4sZjytFSe Gw6uXhILpX0MOPsgIN1bpRCBTuQWB0cXJy/X7st97ypVLqYhA+qUgBnkFwHOyv2iGPpdksq/ qqg8nCpxmUddli6HvZJyA9+bvt/3im3GjvWV0oSX1i2BTPxYZilt+I6Et8CortJmBVTA6WbW fsqsADfEZFkBBDiXXV3FzQqI71PsoNzAuaCkAYxSgNVMwi0hp05CXm3jRx5LyMAitlDxq3uj IKAu8+E8RchRmp0dp/CwqrQSOCc37IsavCwEdiP9M3q+CMtbcn9W2y9AidXX/kYk0FJY3nUU fI/jYjXeIlW7cd8XRar7jbGzNBX4gmMeNHWuTfXmKv5hEZClVnuuVJ/VusLQ7f+sVN7/XZqE I9G1II0JbEaunFTioW3Ax+7TcJMGJ8tSUcCNhpVDFqH101rtRnxOX0IiVE0iczerWYLaYpM8 0deS6lQANbBXg6NbkFJ9qShMg2kMmyStP2oUk26UUinX4NKW6h0B9d64sD5YZhiq/YiPI/TX IDdLHqB2oP8rlBNU9BZgShI4JKi34LkgtiW7kJO30F5JKk1XH1IUXQjyHFqOYn9zq68vzG1X hvZmC7rvLrP2mlZ3Tug46pl2U0Mcll7bwKi8sRnpwzC7lP9W9A8dOsr1ikJPO4CjO+U4mILE GhJUMdRQS0uAmylCnSlx1clct+ZmInkTBAkFh84rBIKKbyZQhJhkSqyjwIajSEn0aanJtyRO OlXp7jxZlhLndd6Q8KOnKUE5YFlR4FxpSkynKSXwM5bkum08yQjxRosp9beVqvKKxObmTKCp cCJuIVjj2ZLj3HFOQ4h5CH9cZgfhsmU1yWri21oF+FlPtndypCDB9c7VVhoQIMiVW3yzjV/p D/muFBbR9TrRYujvZDTusFUcAe4VCEh0d1if0PskkgKatgryJPfx4ETaVy1ASsxUiVM4DCCW UJEo+O2+On7uR9mgW9+JTkqXbNlgihpBBnXVN7thTXt0X7RAn6MbgQTptDU6YN3g4nvaS6kb Vl7yEm0TouvGZd6SiCRQxZWn3w0uVW4Rq4uckWfpszE9oqdHMIiBkYDfKfm42UnQ1nM8rLCI rv13aKm50SFcOdEtAAZx/4P4ayK/Gpf2ckvefStonQ1nekdAHT247MxOFHkXEgbxu5uIqoNa QoJAg+4mKhEidWcTyIek0UmQ04A9KRaJwjR3pleLKp5zh3AKFQ5G1w14gRqxC51huPZ6Ff0C lFJ+lCQl4q9UKC3IDW61/bIyPVui2+WQ18Hb0y1VKnwdBc0yueSRS9CMINzgRuTpvKwDCniS YBA8WlBSSPXJybqdOqoSIMj6pN7oUrxAzZiiEB/oEbZE2bidWxwS/bhywUEAEVgl6IWCrVeW 3Q5X1lOdOOtJYH/XU2Y9OSGmE0ZucG+i8yUp7CsS3CS/qkwTQWcFOvXcKPw/LYwqleVB7BL6 uid00/Vergw1021gZaJWmglfr97BIrbRLWReVuB4OtWphmrQhgSnAiO4U2vDUSF8sIU9rAfJ CSamwMcktel/fRJu9KBsiXaVewGjfh+xIZctevQphjDrLKJPW6dolMBa4TlJiHFbiJStjnTb VwKPJK2OiLYAoKsvukYuOdmkLbmtWAfRp1OV3BLgUmWkE+Bo9sv97Dd+6L5Fx5gbTeKMnjIh uaowCetEu8aqFv1jbnC6GqQv9gBv7CA6q3MaJ6UhqbLTOO8w2YjeuGRpjdA7reoo0I5Mhs06 vrEhz21H4pAg10rqoCS1x1mLpvTutI7BukAt2Y3hLL/AeC89qVWG/3zZbOO30u4ZJOgOrrh8 73PdfjXEVdEBW3CLVP51VE/+Zav6Qd3qAQ3ZtxbsdFAFYOmLX4BxlX8THYbA4rbhyrZ3xUEe WN9QAUOo6+0NTPrNvHHSINfMJsC+SJMtXqusBfdmTJ2b3eImXonOTIFPglLBo1ug46Dr2m79 aI7QYaclSS98JmpMSnMv5uRxZtZ2GAd0o5Og/JVhHNANbtLvegNJD/37DCtbjTkJQA+azlt/ +LgyJkFopMQVEAv5h8R8GBkZag0TTcFe90G1j+HT/vMQ22bgKs3HtSbw76u84q+p7reQ3yua OGL2wryQGD1fAB/kJXC1UdToGWasrKBGjwD8qa+4/5DGD86x6ZgT+KhQLwHkDvIziGXb64HN NHaqaWTqF2dYyyCZlsApQfkH9joiwCXR0qC/EA1yEv9KkbDAOXj5CfiOp5KUEQaifP/XZKKn gtZgNJC025KMvR3lO0DHPNvH1MEEE3HhFkm/ZzG91mCVv/R/1wM61/OoVDcUdbYYRK6xMRq0 6QUIENgwD2PanEZr0kc27y7cOfNSU3MT5NuieFUeFdFxOqNLSEghtiCB71tA3y4CXNJyAFGA HU9ATlAO4FvopBxAHs/S+uutCS3vKfDa+P57jHecas9F0XiO2NAv/uvoJdcvme0K05NjY9jT tHxhasIndUz1jKthLlc3nStAsFXQLUH/tguZMLw2vhtHv8FCLCF6cEC/wUKAS9DmHZ+uXwbO FYto08bsMc1t5v9IGbN3Q0wWs3eCA72d6VrRN/lVzuIXoDdQ0XCqtepoPQFuZRyemS36mjz4 ahs4pOmYrFKtTkYPedakNU+AGwSXVMrCRf2vy1mADMuGPqW9dblexc/T5hBnImh0/aF3zXy0 r7GhWrpdvzuvBto66LRoiKGbdyr9flVCpB5K0lmzPqSyrSMePtXwEVoi4OcDTxj6jT72X8dx rhcqEN3VLr5h3rMW0ZKpcVbq7tbXqMjXtjEkYmcaWyqHbJLHUKqWQlKaEo0vmdt47Tt3CdID /NtKvzd2vXlAG1Q5L59Qp4zuPO2g4zqxmgROAAZBYgLcVf9Uh0n+vuhbpLcpXrUUHC2GU61d KCPeDW6oJqsnZ7fK8zQ9DPaFX+PlVVdYvd4ydAsnSd6nz/7otRqMp11Ui0MkiVgJr6HnkwtT P3cE8u3JHtspd6x9LCt6ugFDeedeb3y2UVWQ3UCAW6B+d4nVbybApX5K9dsJMd3BdoOb6qCR mwSmSi3dZzU6yyl6CLWBIkonIknbFcp7yzqSAPOER00DeEotekxAoCpwchK0HYa/FpyBbnQE NCHKQWSu856ZVJSDp08a4hSnpByXvKfxHNqhKR4/j6nDcIp71xxU5/HD5R1J9Z/jPwwlGIMH Z07F5xEOsbeeWwFvrFi6W0/z/FrU04xy8zxLygTvXnxBKvHcOqYvL7PHyHhV3M/MukRafP2n wJ7wxDISZAhwaC1LgNNFs7Xu5jEmDlaN1UF5n6BSHgK+JYn0tA9tOEspxXHkdYWhCzeO7mdm lJ1lXHqLnpk5L8XZ/LnMO9N8ZZrHkz7C0V/EAp+Z3CvCMX1Ns556iT6axSR4TAVfkiHQjn7P ywYbnhLgEuTQl3lJQRu8RzptixhdKy/yilN4JH31lNVQseuEnFQH5SXyKveKZ++eRndWM4yd EfQmXlit5w+sqsSVbdanfdjOttO3VeNn8jfQG41YAhET7V3gjfWA9+8U/Z6iMzr0i6tIOv9y Fj9tpwD3CAHv5Z1xXiOvjJ4RIeBtRJLFR8+IgLoB8gS4n3GNjUHHPNw6fidGyMfqSALHt0C6 FqoATyWMqqKAt9sIcCdyEGk1BRoil3NH4/Bp2k/ATBIFWZmUhxQO01dp1Yu0teNF2m5RzE9R 8xSv1mqfMbGuodXwybwwZ7Lgk71aWzSQtkIgFf/JG+hj1ZLwFniyyyKCK9t1/eocDn7dQTT5 ELzKCHiJrBTw7w7EBGYQz/n8ce71Obi6llyIhHfcgXDBayTXYyQ8rjyy/Ejh5QIMJ1CQgI+7 /U54PO/aE8IrpZHNKXAv44NjIDooeNfnkJKHD1Scg06M2imXxxcM2Tu5yTvMN74/LjfThReT DK4i6bDkYrM4F5u5brUkWjl3N77OOZAj140o2iPjLzPgMLogoR99FNnkYOCT4QSwHz6vUbx9 3kAeOKz6S2TwTQNdWJet1bn/PKnAKbCbKO18iK+HQPSk9UP+G/x4m72B/fgr/FBmRNYbtE7P Yao3lMu6kYYOgW6CnLsC2KYb2vtz+67vnTGeJ37ewQu+U+N7ZR5WWanEpMfBF7qzl9eaR5oX e8GOs67b3hUBxIfNEWdvf+xdU7hDa0wHUbuzkiy1LDX0n6AO8zfQdNEpobrAqdHrPt0pQRMV Th4zGyp5b3OPlN8ijSezKhn05DvVMapKQR/aVC94IkfR8V2XR2Dc8igydHjhqCDB19EtVXhY nQQX3TPdcVSLCXAiOrg272hixve7y3MqGAVuiZAUKYUkk1ZZOO7nxCvKC6kOgvEqrzIm2ryZ P02HrHj1brvOXkvbpTvjfzyyss0VuaghIEoggHIE3nLAbpYSg+x1X4LHtKZ9jgGkEgTJj5jx iX/rDLvNFr60zn5aywl+065sdraRXyhwKEiOEsr1d6gRRF8exAmrjloeAJdiYpe9Azb6NVsp GShxe3qAltwQ0Ht4vP8dcTxOHXHgBkmZDYWa60hKkFWTSxsXCs/hOT/wYoIhmFf1AOD05FJd LpfMpZF3YA/aMNwoqZTP0IeIjySLytT/SYrkKeWOA619i07QM8oNiAeGrLQsNVjOKuiTE6Ie 1fts0WT0Gkp4jLKh1jDR36bkOxI243J/Ogr2a5XourNRZLjZoJ1jYry+12tUuX5a//YJ78vm cXCTI6PLK453eN/tFryDL2iwNc95HdxtqrpsyVz0CoRocnKv591SjwQmL1dRnwxaXaPAX7Q5 EaC1ELghoF3GhtaU9LZFX5q0phlJyB9jQ2sLCEmRh0TbgpfRV6luQllDeV7yRUrG0TIK2g/R zya+0kNAi38TsAm+Exo+/Wnkb/w9rLGY8FSb2FQQDCeg/f0leiUSrFFAvSo8QCT/l36NGLEl oP0UHRo+zk1Ao+VpVeCTor0YF3ndBuUpVS6yZC56BRXE/rzca432xL/NFc/j4HLmEa0E5S5f Pu42N6vrXfZK/oVf0MYob+AKS0bcwo+m61rE4uYPi0bIj1g/ooLkOjEbA4pX2Xqn6XUzNUTr ZtNBcN74cJqiKJ2DGgNMHko2RwjIX7DQTDCqMijhHs2G8Ha8Mvz0wFGK1upIIJHsiRhSkRyg yWM/h0WNh/QL947R2JoxiOV4zNgOhLLuou4NKMbHhufkLjIq3r1kLtKvUkObOPltaZMZZoK3 4XuTDP7ytTT0ieqfo2B3FOygCagB6uMeIhwVkF80maclQgvayRz7HzAgMKgZ9zQzNAml4IpV +b26qdStCajoMuTMNDIxrZeUxxw/trGGj4O+qBfVJMOv7vNdLsaPWKvnREb50e/3nJGwGo+k bluCVj2g7oOtU3a/1KIjU7m7ZeCRWKmXHOdYBa1YDVDJ+tCBpQLNS+bypAkiX5qfV9KkPBCO pJE0TdLDkSYQ3497aO2h33yUTKG9oIK+S+byBIUaKXHmqP83pfAcCIZJ4bOcQmNNx4rV0qge UuqJqQaDA6wCMxoyEL3EJAPfUjlQX0ZjrHwuhzrHbEzTQzLKyxhfK8PpebTuotDpVZfxCCvm y6FOMh6ExNO7hgu3mzYgDD1ArXnwOSA7HqLX4x+jkLVjENvxmIlOUjcDWV6WecU8t4OK9iyZ K6iT1N2Ey7p1Ero2+Sgsug7TtOZYhLUTBVCf5hAJqcDUosmC8nOG/ZvNeyPdx4n/Qb1gpqO8 s2Vkt30T9UGfjGlZ+1dT6KiKtLbr1dNu0GZHzeRpZ+9o/XwcleAdhLLca497maUAKpkV2mIq grNkrqA8n+8wKWcPg6PleXI4Wp7vsRe9cNSbj+w6tBdUPGjJXCF5PkOdlueHgVHyfCmFXPJc F9Z5XBJ6hN8l4ZvGqNjtIFzkdkkMpvG4JPQor0siMJMS6z1KPpeEncjjbNDbh8u3uzekDzlA L9x+DuiOh/RL8o7R2JoxiOV4zESwSwG4XLBTgbQlcwUFO0yyh2Cf9404CotesM+wCAt2BXCh YKd8p4smCwr2GfYBwd4ttpwXyPqJawL7W1t/wX7CXuwt6w8jHJdGOy/32vae/yiAi2Q9p7x0 S+YKyvr5ppMy+DA4WtYnh6Nl/R570QtOvflLZD2nHH9L5grJ+hnqtKw/DIyS9Usp5JT1dR2S 9WpEQNZ7pjHqdx2W9XYan6xXo/yy3j+TlvUaJa+sNxP5ZL3aPo+sJwfohdvPaVnvHaOxNWPC sh4ecl4q6znlblwyV1DWi2ovWT8v7zoKi17Wz7AIy3oFcJms55SXcNFkQVk/w35UFdKXiD7a 7gODFC9VbmAb1IBg/9QLXCt1VVkpxhjwG1gdsN1B70tocKBFuO5z8JThMw2T9rRUV4FhzKHX QWpshBvw3Xsd+IdRlHcCx+9xHnrGpAAuUwIot9iSuTxKQIVCc4I7Zov0bZV/JJMNDoTZYM3W PvTqpZ7eoEWCmvKBLZkrJKhnqP+dFNSHgVGCeimFnIK6EiFBrUYEBLVnGqM7i7CgttP4BLUa 5RfU/pm0oNYoeQW1mcgnqNX2eQQ1OUAv3H5OC2rvGI2tGRMW1LzcQ1D7M8H9cwUFNed7Cep5 pctRWPSCeoZFWFArgAsFdSAd3D9ZUFC7aXhnouYDKxfC6ZN20lNRrTpS7D70HZtV2zMYPm7j c6FMaLc3/8H0ubEtwryW/8BNMOqnjh59MPRx7l3uflHzODpyqZAXzV6noGdHCuAy8RzIEvfO FRTPE9yXiufDYGrxvAe9elmnN2iReA5kAXrnConnGeq0eD4MjBLPSynkFM+ChcSzGhEQz55p jFbLwuJZsCXiWbCwePbPpMWzYGHxLNgC8ay2zyOeyQF64fZzWjx7x2hszZigeO5qbA1iK5yE J1VE+BP0/HMFxTObphz5xXNFiOcDsejF8wyLoHjWAG3VkJeEgVQ9/2RB8TzDPk6q3jwNr/O3 2AtG2sdpfuHuVSi26+PT4g6kryhadK2HTke0jYT88bHQ+OEKlol34o/ZS+M/cJFutA8vJH0H fhH5L9cfrAL2lIHCs1IPyaFi9m6oHXXDngXqAKjNhI9uVXeH9RcMlOCXba8D2+G2f4t9B+8R ikEAZYsbd/2rwYZ8XCQKTbsWq/YHNO3f7n5cGxcP/XJoO3jWU9Fo9wW/hxGeMYVN4xD99UGe iFKBt5tr9VyHGT66nI5o0VPf5jA2dXjF4K2aOXWCGqkGaKo7vHwvkPHpnSsYNZpdSzKacyAc HTVKDkdHjfYQQlp17De/rxfx7kUg49M7V0jbnaFORo0OBKO0XQtGffB42//2097KLy9Cyq8a EVB+PdMYm7EIK792Gp/yq0b5lV//TFr51Sh5lV8zkUf51bvZF5+IWSYoPUAtfPC5rjwRs0xQ /xiFrR3TV6cIKhO0YfmopqP2XRp/Iqh3qpDq29Y5a0OaL5UjchjkjoAc1HYR3KCqwEuzQOan d66QOLeouznAXo6pmcZrPFMmX3O3ue5fZr/vU0GtKqtHotr0ZaPbDoF2Y/UJFbQC4NZPNeud pTS5tU0xxbb+bADpxnb5B1wJZeAo0kLbtNpDWlLn1IGw9VOG/9A/s9er+mvlURvX/gyWegf/ YLvb4kezPmGDJ9U14T66H+I4ihKsa6Bra4gSkemv30zcE+pcM0PottrEe0cDqbu+qUJ62Yy7 kOrSYVCUVpYaitLJ9uCUWr9RR8DUs3g3IZCz65sqoJCF2CTpjDwMJmpnIZh7KGddhZ10PMqZ HuFXznzT9OaTGuJVzgbTeJQzPcqrnAVmUspZj5JPObMTeZQz3EtTg1PPdDPyc7Vs83FfflPP NDPvEIVpP8QU6NSUXlYX+dKIofCn8fpmCmll8n9NHdLKuLs09AjoncDxM+hBzQyhLQsSikDm rm+qkPJgEXdf/pc7/aSIrzSGUtiypw/Kf6K0NHzz+t4MtGpXPyDic6wt/Vi19qWSL0jn6IIj NIWDaC14BW/khWgdVBQQ+KKQYhVI+/XMFFITZkedFOAHAVFaQmIgSknY49JqKat2f0mMsgrk +npmCqgIoVNEqggHgUQN4cCD69IQpFiRWoBHQVAD/PqBZxKr0JfMrx3YSTzKgRrk1Q388yjV QKPj0wzMNB7FAHfQEY80n5KkDQ5A2qsBftpTONiPA1ujRni3xsCYx0zNgPDeqUHevfMAsiOC u6tX5NvdHpAjwmtH+PZ/ySC8dP8HPrl7fQ0KZW5kc3RyZWFtDQplbmRvYmoNCjI0NiAwIG9i ag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250PDwvRjEgNyAw IFIvRjIgMTAgMCBSL0YzIDEyIDAgUi9GMTEgNDYgMCBSL0Y0IDE0IDAgUi9GMTMgNTggMCBS L0YxNyAxMTUgMCBSL0YxMiA1MiAwIFI+Pi9FeHRHU3RhdGU8PC9HUzYgNiAwIFIvR1M5IDkg MCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlh Qm94WyAwIDAgNTk1LjMyIDg0Mi4wNF0gL0NvbnRlbnRzIDI0NyAwIFIvR3JvdXA8PC9UeXBl L0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJl bnRzIDgxPj4NCmVuZG9iag0KMjQ3IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVu Z3RoIDcwOTg+Pg0Kc3RyZWFtDQp4nN1dbZMbt5H+rir9h6l8Wqa0owHm/exylaw4Pl9FZ5+l utSVnQ/ULldiQnHlXcob/ftDNzAAZhovsySGyl2qQms5IJ5G46UfNBo9z1/cHbY366tD9vXX z18cDuur95vr7Jfnb24//u35m88fN89/Wr/b7teH7e3++etPbw/w1b9v1tebu2++yb7908vs t6dPiryA/3Vdy7Iiq/s6L3nWVTwvquxu8/TJX/+Y7Z8++fbN0yfP/8yyPntz8/QJlCwyljUs b0Wxtu/zpsvefBBlvn/dZO/uRbXZO/yrV399//TJLxfZ6m/Zm/94+uQ7Udt/PX2SfffqZfbc 04hvbw+H2w/+dvz59vZwbDv4pB28a/O6zViXdxU2A6VXQn/35vUPY7lPRCuLNm+YB+0xKnpU P5ddk9e96CsBXmWs5jnrMlaA3EbgueXcw0H/tM/rxq3Hy/IiewOfrzO2uqwvilV/UeK3NfzJ 8c+psk8QqarrvK18Il2mheoCUAwb+d/FqrvIC2hqzlftRY3f/noB/y7g3xw+ipRi1ZznHT+L Bmpee6EyMWNK8eXVLxdF++sqKWwpFN/5WjiZUBKN9zxvywGtz/vGNRVmlHJLpH8YVkRNh/rR kGXB88Y795xKqBvAUFB1XoDeqRJmlPJ0i/rhTIFwpQO8NufiZ3WfiyrqvK8EHsvryl5Xs+ev P673sBq+evnDn7Li+V/W+3fZxWZ/+f23K7PkzalKyl5KVY9sG88r+LWwcdyxmK0u+UUOHy9e rkr5r4r05kkC9EEB/ApkrMybRqGWYko2ZVSDzKPBWXV5W8DAxHG/CqfqOhGNV0LDPrQ9rLnX 8PERPm7hY7tipXxwuF9VQqWiEz+sLquL9efVZSv//vstfLHdw+dh9xnXa2Gk3sGv7uCv9R7K HrIPK1HhNRRDlN3m7eqykTj/XDWysvUV/OJqA5/3K/l/+QArwR8aKUa1rRi7eCslb0SFQ0Fs zOYOPuVvoCFQ7RblxsbdDwM0S6zxijP4waNHaFX2uGAjalPmYjmMDVDuGaBzqvLL3wja5hkx 2aVYp5moGhbqn34mmjsNuBV8s3u84upCdBcfuqsC0h1TXOlbG2dU5ZW/Zm3u7ff/pMvgSVhi WtePVJUhzN+Kv/AHyhq1BfynyKtOfoAAN3+MP25zxofHomwxlBoKwEQShMVbwTDR5HM100Yl YECVdgVFwWiJVmOIMccnQoCeCx6sA4rUWgzsivFzwaVG7RD2+4giUpvY3/jA6m5bW94CShn6 ObRjUmRobLCMEnUog5JOykx4R1nDzFTGmpfj/dxkblVh3hGsKso7qt4MeC/lqKUh8PCO4wTo KyxPBYhTDgmoRndEeXWEcgTrilIOt/aOJQHrT2jj38PXwhIXqvz2an3YZLqmO7G3w+L4lyqN pvlhCzYYilYXvxuLvb2B0p8HdqB+kRnbv5HcYnv4LM13L6u+kSwEBNvtPHzh7aoeyAfg3ftt /2mKLlvY9FqKfniveY9ptJf4bLXOCaPaXENF+AyJz2dNeqyOcOsbvxXKqwKdnafWSFk0edc7 NBInQhJQsojItGkiRChUVZQITWbNXA50HKbiQI9YZgYeofoHrVdEXW2E/oSqitEfIrmf+RwH I5nPXAWNSc9ggjvA9xIa+ThEaHwV6J0DPg8QGlOBl9DIIgFCE6hDERolhp/Q6Cq8bEX2ET4x XWSrwltAtdQ8BynHRYaWBMsoUXUZFHVcZsxWmk4Qm2qw8FUNI8g7FbogWwlXFWUrvJ4seq9y WGUNU2EeknIkbl8LVblwoyRFAaoRG9FZHyYp4bqitpMqDUx463IgSBt+/x7tozL6c1nJQBZs MwnF8YlNTa5uocK9phjbO80tJKAGUba4l6Z1rWsT4NuPaPCVV2SLRnzKYzyG90R1sgqMmKXO T5qEXGsqhw2bKMbLTiyFHO4G9rXLDreSmfSyp9aHNVF32hbyWqxApaOF2DikPEgrt1eb+zw1 dteiY5lgL9WNBZ5X2Gb1xzcwpJDB/xucHtUX77G1mjuafx1u9WgF3cg/P2pOuMZxTtgysEKY bq013ayRcdjuBbV/p7/9JEmlmpz7YS54B4NyF25/V67E1qoLy2GFh+xatGL4vT1OO9tJuJDa m54JG2Zp3b0D0ex7fchAQuyI9X2212uV+F6sBsjYNzij9rqtV/AEf7G5Eo36B/7LTE3F8h27 oaHDpkuj8oSmHvIl7+EsiqgkSuQVnmTCEdPCfKcWc+oKMHmOrJqaFh97PxKnZXnVnAGnK3Bn 8gg7rzj30PdICWN94Tv/mFNXbJtARP8f3zbhSBi5TZirIec2QVBO5t8l4NPQJsHzc2s/zUJb BP1z7w4BSwQ2CP4a1P5AiuDfHgwV+HYHqmvwiekZSwf+ArKR1nOQcVxENSNcRkpqyqCo4zKT 3YHYYRtqDW5PHpgCvhOWOXXFtgdN249X0unugPt2B8fBqt0BgY1vDiSedRIWUpnvbGVWZVGD THQW2Rx80FTceMrOu0UYtgN3CkRsBVrfTmAruE6IrB6nu0qw1J49puMH6yTxzEFeqN99fv85 dQUstxC9m4o+dsH96DWux0GKX7lGWty2qt7RR3khbfkc/XPqithWIrnftB6HgqZ1rn5clrXp OhjOPtOqHgdsq7cCTXHxud+6WhX4zKsq4revoTqkgR3E8FpYU4XXxMou0seBnKjCW0C11Dwf zgI5aUmwjBJVl9HnhdxnYmscXfOOC5nPdz+nrqiJbdqYicWdUsgVd5wATGzYW4cAcWMr8eYd FzKfJ39WZVFjS7Q3z9j6rNeRwnR13jEqzJey57ALB9eI3LJnJhBKmO81uFZKC2qjQpga+7hN hk35XRandRrE9nZBn0Vi3KoXc82BG6cXEnDWCR/zOern1BWlF+OxNZdeHAep6MX8hWEw1qp7 5hzwMZ+Lfk5dMXoxldxPL45DkfRipn6c9KJtgvRCPg7RC18Fmoc3EXphKvDSC1kkQC8CdSh6 ocTw0wtdhZdeyC7yn+/5C6iWmufe871wGSWqLhM/3ysLEzkcmQg8HAUdrCpKLqpysuL52YV3 K3+UAAO5IALE2QXizSMXPBL/HKwraqao8v7ld/IOy48VbO4/rjrr2OPaBDNJEqAlux6dkUSJ wEkKLvkkQmI2DzgOVtEAAhunAYg3iwXwSMRzqKooCZiMyLks4ChIRQIeMYEHmyo7Zw4J4JEo 51BVMQ5ABPeTgKNQJAeYqx4nCYDTYSvoGCzPhAfIEhYPsMtY9s9XjcWb2Sh82S5kzCQbRx9P C7UazHCCkdDGmAZqUsxAiaSZwaiIsbhsHKo8KiW1iL0XoAe+56rZ+rGfHISKKEmHInFqINY+ NtO3z8OBysGqotSAF5NV0E8N6HW3UwQYqAERIE4NEG+ek59H4pSDdUUtF1VehBp4LVlcDMYc crTy10QO4Anv12Dyd7sTMF1N70u4/RztttNxGoiZoTgjJqUogmBRcMFKMp3kYVOjIG2gVeAl cXdxYiWUPctZ7VCCEgMG1fhEJi1+xVso/5g5OhgIxJt1HsMjMdGhqoJUibtmxk9eenQcjPwt XQjSwrSde57HWZjs9zknPTwSbB2qKsbCiOB+FnYUimRhc9XjZGG8D4Vaq8chV4yvgmEGyucB V4ypwOuKkUUCrphAHYpwKTH8rhhdhdcVg10UOOjxPVft1I/9xzyhIkrMoUj0kKfuSlhEFT8R DRdrQ2AWhOOsI5VF6VbRReiWj2QdCzzEUhDgKM1SiGrARvUWibWO1BalWkT+FxjA6Lo5ZccW 0vtgvQxc3GunywNWJBhCO0RFbg/3q1EEqSO2eIicRLhppOTDVhIO6X/ZYeiEN1biWM2UNYz+ eM9it06vFfu8jWl6qxbkbRzNNgoCTq0JVgkVuFC9dOxoJKFzAUGR3ugxYYKZP2oiuvkdxp6i avr5tQqlhQIQXNxMg4s94c52MoFRuLN1Pc7EUctQ3t1WyjBBwF8csvfwSAzmNYb5Sonu5RxI rUA1QLo6Lxm9dyhV9EwHK0vHo4n8VwHdz/TdwTlT1fTIw3Z1KXR3EJ8qklnP0MTt5E2RF72j ncmXAQ6mxYUU5egKUXLR2Ppe+nzssyqLXV2ki5iXpx8L1BZ51ziAvPcijwbCi5GPMbiK+g4j AKlZtD+8AZ9zKovxdSK8927ksTiSsc9VkpOxC1FDjF0+DjF2XwV6z9xGGLupwMvYZZEAYw/U oRi7EsPP2HUVPsYOnVSoJoh66q4iBXhe1x4fdLwEKlyVCHupA5LoEn4gvVRikaAf2wKChxOs oYyGCvi6VamgrzuMpgsF4WRvD20LOcQNGnb4FG0oNKC5veazSjm5o++05jFJFatMjBiabqwW 5oC39oLwMsf8gvAJbujOcUB9Ei6ULlzAlPqchMM4mgWK80rQlNdATqjFOw1QhQMSQJoz8ESc QMPWal+Ezkr150EeQZcXd5+zn+5ub5De7lYM/LPgtP0Z//Ob2MF9Uu7YWj75gAxRfI8VHqiv 86R2wK2xlsUHgnNK+E5oHiORy0rKSVFVedm7dxub04apA7OtxKLnAn31+rQR6s5VAwloKdZp Y9SF1KFVcrRqrbfu6gIo3g7GbRsNPDhRClYxOMCnUiTvRVYBv6JAYsKtLjt10LHbgDvkZzg4 +A32XXiPVR5/bD5Y1z3k/imxhBziL1wiuq54vxhvSsU3L1eVFchyuNNHPfS860RBId9v5xI0 uUpKyMzZOpDklZz0cx0YFHM1bb/S14HVKWJ67JrnnauxsG9fH/CATg7TDd2dn4rdNTljZ+lS uDdRurr0PpM3qu6vcJhv3+IJZfKmVmUL+14qAPXCnYpUFc4lZ4799J3SPyq7uduYNbDs83Js 1L8uirb75jT+QMH6nHMHWPpR1XN3s5xJ5pjx9mlHmGuODdm6xMj8DsairGZ1yeRia+oy/zKO Oi+wiSGZ5CAx2VIDv+2HFHnw02ERbH3iU9/aqbO3ZbhOxHrUOaZ9x9qPGtOty4Va4CaYsbyt baFuTyTEDqTGjZServDOjRQeV8wdc3GqMA1mgqfCjNL89vPHvBy46QlUCwnrztA7XKzsFXMg hZaRt+Z0Q4bsqIibhTgTkc1OQLKXWVoaeZby1o56JjkZIej5TlNQPFzZbu6zrTnds2vGnCiG h+5Now/bW7HR3U8X39RGt4N0qI7mXyFv+zjc57LytKhDzsPD7TKzR03losj56F7MrxcA+wJT zUg9/TM5do2vEqDYyfeTrOEYkkuQtKnEPbo83WeiF35dmXxV+qqdI/1lMzo77Caj8GErmPhe ZzpS7Px6bE/RxprvtjASL1X21PUuG8aFY5Afbk8c5OM+bhbo4qrH/Jxn6OK6YBDWOquH0Tsp u/g0EsK4Q5CywzlOJJnDQnxBXYlYSCX2Ny07BwuhSEstXRQpbOnr6RrvIdiprbJY88We5wx6 4XDsUjuQzmTjeYUeGIpvJw1WF5x1D5gAH/xTxmGsh+CA25UyQmvMGweesGEhxShh2WnDbelb QRPMIjchDH9ITmn6Es5kaHOtgN/krskKTt+YA/QPmY57dlMgUCeaq932kDnslk42iYPj8Als w8fkizWDZG9U+mfpgUoIYDnDrKvFuldWzhX2cpovewQ9LM19AZzQ3KodDvXSLZRtO4k5UckF 94ZsZjqDo8orBAPJygUOLRhinPYyM+EWmMM0CurqdlUhpZiwD2fcnfW72aNz4nEGerbZba29 wvqw2Zmc8oY9yeyPkxyT67vBg/pJUybN+LaH9NuAAl6eQztEeWh6FV+1vXqvN2gPeNCB4u2u pdYWsqdNnbcjl6DMdooxajt5AbZaeGPQ1TlnDknSbwzEdK1bBxKhjcmNdA0RZxSYRhSfisQL JB4EKX2bOEfiQZDSUwwutDcDycmxfSHjibzXVY184DzeawK2mPeaIrloNl/ISQFh8UQEvEkt KpVXqbenRRi4YEsG/okz6JiVFfChaftErQ22bX+b3AaxCvNunaNxVY92hSB5/ZELmJOqdghg RzFLfvNgtiAuKkJcMMCSmiX2UHBvs3eIrF1Bm/uNPEtHX6dMkD7yApl7kj4PUPKNUJNXdBRb rsR6KcJQcQ90csJQQdyRq2MIYWikz2FwMw1Hbz9IDjzKu222wVd6y7t5pqmx3AdfvXcnJE+0 vMMPyuns9I//5Atggfs0IoXZexgl/WPYV8gLQXr4G58nMH+ZI3XyMiPtSFhgyoox2LeOJgRy tX2VbcxdiPdaykcndkkQWNKUDtGlphX6w312sJPT+VLWK4dLR30Pvszyl6O3AODZx9/XV5th pTrod0AsshuTwe208YtNNTHWazZZIFNDNXnBXVDL7tvEBgAIE0FNv28Tk4252udy99fpD67a vHX1I33T9skHVww4IIVKf27BmhJeMkCh5uypfNdJU+2pWAfRh2faU03BllsJCJJrT1XaJnCh Lc7yTVZbnAnQWbY4Z2ic2uIQpH+BkAvOevTKENm0ZU4e6VJB/IlbGX5G2Qw0LbU4HeRbc4iD p/P3m93m6jDcKR8zlY2hZdJHjhTUpJpRoc/NyA99ad5KND62PwgcsfuqLQe4HAGHB7wvYW1D 5TXZze7GeMftWKaFFiN4o6Y3Judqt1VUL7nbkJUYnEHxZxieynczPpHhKfsK8iedx/AQsMX6 miLRNwgu48hr4eCDwpOjeLz5/UWXzUIYj9YhanIzxQvxVelAer9q7CRZo51t8jN7DicuVIZh Iex862Byx1fhFsTKkaAOFy/HF0nS74oFNyp7hygYsWWuuCS/adHACfIZFoOy7iFEKajreS5F 7dJKfh0CD8W960VyOPGVSx+WEnBf+Rf4eJ0ev63cy6Py+H7SOXQ+ylNs+0B9IUsBl5d714rg o0bp+UFVwB6FSrIAjS/FHoUCudLFWG/BROs0REiYqSMjGsCFtjGBCNNsRpAcZhKrJNf5SeCF Y0a2VhDE9p0VkiGWwo6+HMq8JxYk/2qBu1M1ONCo9ozXc8jzIi8GyoiCfXoPfYtrxvLDBVYn 3jqQJiFnVo/Jt3Ca4eDYQvjmOly5tl+ButB8bxkERPii9m50X0oxcYijPfxkhTmZPJ8b6TNu TK6ubKsz/UzD0tYf1GGaFYOUml6I5pUtaeX4JNmRwvxk2B7JJFHuArtdBgeHFGn5Q7gSbjUw B3Ry728JwTMudVre336BoJ2yYvCqWoqb3MNcVg3mlaLdmNzFXFbiK1ej0quv5kioY7PAudH3 JbQ6KYuEzNgAGmDjSwPTNCanRWX50phQ4GXSmFCcn9DS3N5sd6dddKOIDZPvjpkips5j0tQy zdIUx5nHpLmQd2VkDhNhh2+2Kob8Z8ilUI9ylzRLpy4pJUGJdb5zGvjyiJ16BionAp/6SM+Q uoSCTrJeJGf5BYf8ThQ3/SllIX7QOZCGNCbNWbKY9BA8R4VIv32qBQGY0Z9MBQp8sVQmPYSD UTkfncqkWTaTCbxe1yXnArdyW8hNS5EWy2QC2WRKB+A5sokIy+FsbPpWNi0yK6rWc2UTEf3K XAKkzybC+rxzdegcm5YiQ13oDIc1Y0O76BnOFGy5nTpBCr0LhkbRrXcPa2lwlGcmkmqEVee7 QFhBJB1tIL1AaGUZMb6RiW/MEdnLmnhoL00hoNMYD47w8PUmsePulo23gntEQO+JotKHvXYl eqYJkvsCvYx77Yaw14UmQDF1k1tsdeSuGkKmny1zb0rweSBYRJxHXWnD+3C7nQwIlYm+R3cG 9cknVjp1Ao/OBmnweuOOtLg0KbsfEzyePG4cc1BR/S0Sod4zB5J0jq33q8pKzIDdIZ2XMiG8 duBa/vudTNXxbrzuGN/vkPF8mSkA1wQcruchJBrwHVG6C4QpVg28pJGK80wMLHOyoZbjBZJ7 8IaAT24HpY8uE+yu7RxtTt/AtshLBxAO0DszP+G1BONXh092NB/UjV0dBR+J1yaDR3dm4zre GAIVpq/vUitS8vMmfKEGVYvTsjfTxdZ6V8H05avhBCpo45OnSWHgkjjDWBoWjs57PmDRFdHt kysttTLtC3gOmEOo9GfJcG/HATRnm7Jo1mAu5njx6J1TikSMHqc4ZPGoRy9JJU7xahGnOAVe xilOcZZ2ilPEZZziFOdHHS+ifNoyTWymWizW9VkOceWzTJ/LuwaHeLTjnVMgRd5G/6zkTd56 dhhL+cMJ5nnc4QR2KW84AYLB2dg3U9fJXakQQlRS5AUCiDhcY4x14Zf1fhcQIEBEdESifNk0 3g1ETCzfZWXROfWxXBLvEmnrFO8cnm8ZWXoGncrAUqrTc/m9RZ9WDvwF3N4MHOwxjToNV5JU f36vNxer7ciaLun1JmDLbVwIkuvKnCvH3628kjOJm13vdstcO2LwYjGHuGdJNVjkbXuOToFU g7x3IG1vxtfBJ7fyR776R/lI7fc1ejNh0Lj1Khy2fjnNhXqpEgumd9lX+C5KqrH0Lvu6gD01 AQp57CeZKuxcsfFMFctMeNZXeEXUHY1/RBIC7y1E6iICv5A+GfvdnCvI0U0uJX1e2X8NrjAV 6RvIAgE6Nbn5YeRv3uErPhFMpUoQJKwZNW1gaTRVXCx9xDuBd6cc3qA3qx22olxv6HTmMVmo 4+FdZ5Wv463hZxyPlk8ykshnkqk5/ZWuCu7c0iaYbsZOIok//IMku9JHFHRZbcdDdJnwENoa MQ96+5LCxI8amJw+/3HoqOpqh1FS8gLBQWe/Tn4Hp4DbqI7G6ku5yZ2/eAmeIib3flZiaglj QJHm8NWF0+bJQ47z0NUp1nJr2BSIhmgkv2Fbw0nc8i1UV3kJ0Jcj3F0Bx4BEoFAKhoGmpl7+ eQU+BSJKGio8yO56c/n/LSrcix0SUdICRJgD5SZAUSK8wDpfRmemc+1Nkl7H/1oA9SKO0UhN vPKq1wJQpKXSGFOk5dfehuHaS5DtjAqXc1/sFVg+Uy9XdQvHzmfoG173EHlDkVQmTiuyT8co WFFNdva+E3ZyydZL8c1X6n7jGGEk2VIDvGrhOGUa+HCOlDqsrpBHEglcESn6SqfKDI/7yTup x5vtFYaiHjZDaMmNfoptMMl2SJDGbpv+KADP4Gmz1BYmA8NYL28Yy6qCYGoqR/qLlFUH/muK NLGNoneMX3XqJ/qrKGsHXcoARf8G3Pkuo/WdDl1yTc+l5lBZw+s2bfpqhQU5AiK9Eb9mY28G qitZgAkdPGT3uPTXznc63uoxNlr/LkmIM9lHw5A00wYTDKhZWblmpTvJk/Q2bFT6gNE0XWRX Wrn6YgYzqpPkfwowI8Hky+oszIggLTboCZL/4sACHKmDd2qfo7VwzdgBdDL7Gpa183GW1Kt+ i8ejVDX/T4gRwyCMWcRoCPM+D2dB1yVCWYcJfkOq75scn5a+nd2nbTy907NFnCVDrxUsd1z2 WdKGav26DekH8+4dzxAxHTQ5X7I7eRwG7RlK6Y0qLyBPPdGqy6b+L1nMV28NCmVuZHN0cmVh bQ0KZW5kb2JqDQoyNDggMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3Vy Y2VzPDwvRm9udDw8L0YxIDcgMCBSL0YyIDEwIDAgUi9GNCAxNCAwIFIvRjMgMTIgMCBSL0Yx MyA1OCAwIFIvRjEyIDUyIDAgUi9GMTEgNDYgMCBSPj4vRXh0R1N0YXRlPDwvR1M2IDYgMCBS L0dTOSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+ Pi9NZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyAyNDkgMCBSL0dyb3Vw PDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3Ry dWN0UGFyZW50cyA4Mj4+DQplbmRvYmoNCjI0OSAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVj b2RlL0xlbmd0aCA2NDU2Pj4NCnN0cmVhbQ0KeJztXW1vHLmR/m7A/6GxX24mWLX6/SVZ7EHr bHw5xBufbVxw2M2HsdSSJxlpZM1obe+vD6uKzWZ3s8ieaY4uSNaAhXmpYRWLZNVTxSL7/OJh v75eXe6Db745v9jvV5cfmqvgx/N32/u/nr/7ct+cv17drO9W+/X27vzt4/s9fPRfzeqqefj2 2+C7378IPj5/FoUR/KuqMg6iIK/zME2CKkvCKAsemufP/vKb4O75s+/ePX92/oc4qIN318+f AWUUxEERh6UgK+s6LKrg3a2gefm2CG52otngBt/V8t3L589+XATLvwbv/vv5s+9Fa//z/Fnw /asXwTnTie+2+/32lu/HH7bb/bH9SAb9SKoyzMsgrsIqw26g9FLo79+9/WNf7pnc0qgMi5jh doiKDhrntCrCvBZjJZhnQZwnYVwFcQRydwJPpTNPB/XTOswLsx7P0kXwDv6+DeLlWb6IlvUi xU9zeJvg26GyZ4iU5XlYZpxIZ35ZVRZWMXbyf6NltQgj6GqYLMtFjp/+tIDXEbxO4E/kU6w8 ScIqeRIN5EnOsgrEiknFh5c/LqLyp6VXtqlQfMX1cLCgiFtSJ2GZttzqsC5MS2EClVki9UO7 IvJspIajWaZREhbs2jMqIS+Ah2SVhxHofayECVTMsMgfThQILV1w/vZ+dQdm7tWLP/4+iM7/ tLq7CRbN3dnL75bH2XohbmKSK69hrg7lehGiNYK/YomKxZrPMv0j5kAdsdwDv8ziRLi1imP2 enmWLB621+tN45mtgAVFwbEdW5yZzPKwSDhmP2z3ntlVWZiy4+e7b1UVpinH7ALG7x5mK/7Z rJfZ4nK1LBbv8W0TiJdyjP2KlQiVl6xYMJ8CkOBN81FI9Agv1w/LfNHAq9tlSi/u4M9+51ey VIgUxxNXl8ngxB4MTkpm22ByhJ+qx4jvHYzRB7A3oLds8VqM11m1uEbFzVybBlli4SiihBNm 3gw2shM/qDh2P4iuFot5a9TENIksTP33MUkR+ZnZXdyLyX8P47tZX67E4iwXcoW8fhBwdwvf tIMdwFx4I5aNWDuC7hG+E4tHfNjcgqaaO/hYLJtsgaT4u61Y6A8IJOGji8tLeN3sdoItfvJC UCOXO/izx+bw/SZYASn+tpnnewxaSfMIEZ1ZK3dCaBRiT0KggoZa8i1SFhVhVXIieddAFtVh ympgtQuucEx3lzgC6/ew+psr6PpvvYsifHJSTOy5tIyvlVlMpCUUU1209iB+WGbCxYspH+fg 6gGqC8BOmPD6N2bbmnqwrbGha0qU0mD0v4misvp2npMZc6zDJOE4+p9GIiTgO7h4FcKiuXgh HGsIKxuRK677tTITuPCdqw1t0nt0RGhCVss4IhO0W57CQCRpFCYx16/9B1wOD51jNPUH35IB w46BpGAPkaLXsStsCLpExvYOm9yvt6rBQBnGa2VNv/JuFcsijHOu05/WotulRAObK+9WII7D qOSYf0VaRsVg5+UQgM7wPShXTpp9gC8eyP+IV5+F0r8oLeKE2T+Cebvvqxb7R6N6soUirHzK zKcVOlAUZ4XdRfFWKM9+GadtH3wjBEGZFZxkoI5MQGOl/dV+Df7xRqmOZL3cigVw185uWqQ4 gVNtAuMUakeQfqePm/dFLGKUsmR65t9k1MKN1Qw3OSOrdkKKP3I0JcrqQNKVUGKzWZOxw8Ff 7ZvNFzU3unmN9g+Go9KH46FFL48KV0GTZHb3YSCo/yLG6kPXPpkwOQn3gWqf0NqjEg/G6mto 5lSro6gzyJbNMLdGS0q4hbQDX0mdtL+5Ub+503QO7zcBIVvUAyqM1iiyv1Uz+VppDEaYFI2M +xBYW0TacCm+MBUIQ18pD4iNrmHtEz4OQBVFO0ifBEzDH0j3eQ+vsUHkt//SWcstvaxbXdKI GxY36Ko63QBXKUC94QAL4yEkv1PzdWA+Cs1Gy3VSS8f6oLRkXAyge+kwfVvNWnxUch1SWi4d jqm1A/+xjGMkpdlzhT+ngGotxtG7qSrCLOeED/2zqyy6mjc0AtiPcUwUh+lUfqZwIPMRDhgE a1dBGUNMfoRg+emSzkVWG/zWKOdcnCTnbGZ+mpSzmdepM85mrqdJOJt5vWn+htnNy30jvNcV WsXXYGdkr4WHfIMEH6XXV7nRYkFusLXG3lOjSQW5iEmTwLQqilNmRgshXDYOSP5/MqOMMKfK jDLsMAn4N+mkG0wUodsa6OBfKmGYpGFWcgrRcxg7ESCBtKQFTTsCOmYa6iRBlRbB/1+dJL7L khxynYzoT5vpK0sINRlRJqz08rR5uiIqxxbolGk6I8PToW8jt+9hNmJ6rkvUxeTuu5Sdb/uS JoCAzALJ4M57miMOq4JhOViM3aLVU46PsCYwe+QdIAuhyvKpZkMSR5CoMHPDRNMoN8DG2xg7 Cv1UlvC4DT5l7u2RotsC/3cx3T5Am7O+Vq6gUZGs9BSB8Kviy58pA7kL9HxoTUEWCX2rZAaG a+SPgv/Ov3UtyrCuGGV2juqyaTMDK+8S1CkkTcwSjPznaRaXNDDwO0P+5kYNMs0PucBkKqlN ghyYxr1cabnFWs+zQ7araxvnwlZlfMT8qrVWVjLhUujpo02zb7R0HGbgVt6j4jQWSis5nU1w htVpnWEuwuc8fkpvaOZ4utlqZmf3h5lhC+ufw3s8lfak+2DYndZ/kKZ3+4c14OVLSoOuUMGX TZuiVmk07Yf0LTma1brbkaAcKbkOdCiFtsF2pRLB+9XvAlnS5PQxin3PQp1oCpdxWNcWv7Pp csDvVZq7y3r3jLIWgvSVt9pseqbw66U5pJFZz11zuK5W2mTRoimYTCeI5RLY5mR0h0v0BjRy qyVh20XtWxSBHsQiYkRpt8v0bc9ueantMwqCyffdekcXaRHWnIDefWKWQgqI4TbBJdYndol5 HZb5k7pEI8fT2RMzO5NL/Kd0hFi08VQ6SyKsh2fYaQUKbU5qiiNUG41qX3BSNCVDKj2cgga8 m4M0y8OM7TPtwT3iTuIm6CK3q2Wh72eiOYNqn0rzQk2j9kjbcE9t42pJQe/hGwZPTH8mRiOe ZcqhNI+VyYR2vNvhPC2hlPyprU9Whck4hh0ngbtVxISWndHpQr0OFHUgSJ+eRW92fo3LdbUL dnuh4G5fXO3tE2xBmR4VxrmnTehB2csFICttd/uz/3LWIkxzTn/edweglF38kmEHGXr0ELhF 8sp/3FzZOpt4Z1fHsDnFsPPfO8jmsOymHBPwcTDJtHlN22F5UobVcYL5OMCQBXEGnxsEi1LY 5hjPxjMELOkiXdb0Ynyyba4EdRTGGSvC7G3sEb84TgEmm9m93G6v4HwN9nwtfOweX/xCKdVa 2CDv4tQZ4q5J3TdOjeSUO7hZlZjWUm8H1/MqLqGOzc75T/DnbfAKhgXPHpO5DNqw2Ig7irZk yPfmCGSxOXH9b8WUkZi+DLer1hE3WNxWGPdVO6+u17PdyirarM1UYD7nQftBLVaHarNLXIDL Wu/XvzR3Cjy8evsaDoNncq+aRkPAAGQ0ZVPbO1Ctw5ydUf5xcSkoC47dTwvQqVCR/72MHHAn w9Y7kJH2QUzHcpzJfNWl77jphDUPB5+TUpEdlj4YzpvPLk2M4bg1062v/bND68+wO0HhZQFR N8POVs6gZSI2OJSfAnKRsQ7WhwcLOvPb7BpZhYvxyGaFZwhOkskAQF+yOvUPOuls6rQhNDpw Hweo+AWaC3w1BhboMHvnaFTo0SWntNLiNvHfJZ3lgQu5gH+WCeuCXq0xIf6pK4fvNgZ0pwNF T+mhNU/BHtr+onI3jYw2wcGtb1QSXJu3WtqHMr2XMEM/qH62fq2wu7XjSrT0TMxZfqJUjBzr tIJd0fG9FDFskl7+CMdGPDMu0rBIGM5zwJpKEvm2gGAcWHm1XXVtd6ZefMKTAw0dIGgPOXWz 6YOaaQd5NEoyajm79U4itWJcATc46KLt84Q4/y82m+Bly9wN0UZz+TQTUgS88TgHdkBdo763 NTQkg+0cfTsSP/gKFPzqrX8nmoZJzvXNO6yLazyIxbDzDusgMR+nHDsnrvtqnn81pE6SPAkL Vt1T/KuXEwnmorgcj54XY78v/evclWViSwGgiS2YetEu2foX80bCxLnC2xeYHs/LDBnZ5WHN 9PTHmfW1RnY1lGYw7PwPYy0o2enzUtq7hP5coV96sd5jCv0X8hlwAKEUSy8lGlU9n8FZhI+4 kbRenuEWWorWNYac/R7dbnDbQP1HjOfCk8WXYAU/291viAW44jjr2v48zw8bup/lKRxVnqZt XNWCZ16GAmukRRTmsI0W1pl4l4WZznG4+LlTP1PaktIbxC9L3HRJK7wxx7IK3zTXI9XNYy33 e4ys2fu3BFfIexZFyzZN8rBIndrjTodMaozvQxKlEPYyfXipnD3hGJr4AicAgBkqc64kInor WEnGq34uuwK9K8PuNdYBYNDVh49iOa8fcAnHuIQ9S5VmNf7g0CkFFScispBsRSiQFs4ZxZ1C mNIW34MsK8OS68Crkb5mMhMLOCqejFtRwIGPyTN0Lje8SIbhdu6bGxzmfLKulVmYsIoc4/aZ 3ARYyiyTRMY35957SSuhxLziyTtJXpzh9mfvczOGE5oMN/8rIQvjzMwtONN9vP8xLGpc8k80 iGUOuyMMtx8uMJY+QR8zSMSkBV5vevo+RnCAieH2xju3Ch2EmRvvT2ETGCa4dOMZXL7t8qfc QYYpbfE9gDKqymq9GoRk/zkGt/P4ponFtTKa667R/k68wx9Q+ikVUUlUCzyeVfCnrOtK3WQ2 gaKEm88khSCHG3KHNAC84sraTIvNiERisyER1e5qzURRbCQqFTMxKZOxQKD+KHG1hNUGSiQc oxFJWvV7ht8eSUW6pimBShI882KkRZZAqqf7HjrVJ2k7bqWR0ioalLJPM4g1UwH14jZIS9J+ dDtci1wF9ZS2+Ax7InxBhrcuKmPysl9Y/FI7a8MEm8fxrjne7jCTGMrp7lBcwpVdTWqMz5zC TfyJLj19A/cc0qs3XTp6t+3f13TZnWJbwc388O7vvR0wdYPe6Fqi7i4yqIS4pzRNbyesjezg 51SyLI+J0Juf4SfdIYUt3SLR7poJebT92Udj2eR+u2w3v9r9Ni5onKdcsTLj0qLcvvJo7ySk bRbPAonJnU0QyB3OEn9y+q6Zy9XlTWnLUq+SwGUr42XHx5bH8RHhF8QoJ+cDiePDzEgLI+Rc QBflGguuEG5KW/xGVgxHg5025AcWCB3HNcnAQbu4TgJEnfeNcgVR0DsOkA5RdEinR6P5aK4Z LQslSDqk0yPqXLlsRuKTEVGpmCmk0xe6c/iWliTSkSK1SKdP0qECaqjFMH0q0iKNJna/G0xd PyyB7Hj3PbTeJ2m7ZKWR0ioalLZPM8AwQrKsnohhEq4YZUpbTgwDe3ilG8O0LoJFM8dJAbfO VSYp3GiGGE5EM9x+46TGnA63k95sEy5wk78rssMNcXkR6pdlr5JrjaQ36kTq7u9YqmUunIHN 9M9d0Y3hLkjEQl0BDt1Gsb4EOFQt9gHt5AucVZlhFhSvPmrb+eraRQ1P2Y5EsXhinr7hJuzc om8qb+uqGZodnn+Zju3a8y9d2ZwG8EoG30koWY1rqh7U9R8fgaaVKdh35+V08oYKXQwKDX1r FKL6OHdr1I3QiP80hMZtAE5py4nQBqYEtv4SeCrOpcBQPIg6jqUEUS7rNZ9PgqmfA6xkC3Xk tJgE1ridxSltucCay0TyYO04rgTWXFwPAWtpoTIhTFqKKBxpKUszKtgqtC1DJi3VNWNLSxGV PS1lb0mCNSmSNS2lGrIlnGg0LWCNJZAd777nwZqVRkqraJxgLakjTDdKaJOEdWJZRNxm6pS2 nGANlkTuAmvjI4OzeNccbydEkwxbn+RQHJc1n9SYEzKMpL/on405KCOk3494v8y03/0svLa8 7ZjyQgpUWFDYSp0Ul3W31+tLwhxr9XwFAF3X3e0whMS62lPDXZOGwmIvqoTH5iU9VcrTBFOz dfZU07HCVVkYG2RzAhfJT3pkxxzlsslT2nICl8EUnQZcjmQpgYtrTc/nQ8DlANsh3X47Dcjt 24cl5XLVU9pyAZeR6P/HIZUj2RBSmaohIzQRK6dNcDDQhCgc0MTSjBZldHlgBpp0zdigCVHZ oYm9JQlNpEhWaKIaskATOXyEPNToafrhCajj2vcIO3okskt2GpK2oyFo0qMZQJM0htsapUsX n+U2gJ9ymfFJjbnASSJsSjIAJwwQOZZRFeaZidEIALmyVcdKINNVYwncWIg4ypXjHCkubz6t NacLH8lvfILKxCSPPEZ41duJe/UWToQhrio0fES4hQ6xtU8jwVNiK7yirNnhE0Hy9okgbSIH ttQKTJlMAlQstpipNjEBVQkE7aRph6l7qK29G6UDZwq3lRpGk4SFft1UD0dVOoxqPoOOKNen zkKt94+dpr42PU9qkKEaXBljPsFTyCnQHZLbbFCuT3TmsNtZ3X+SSawT6RwcWKXrXL9D7qY3 55js3n2nNaWO3waoVryQLtWPj2lPOiGV4rCt75EnHdbCQ2H6Uf5rWhKFjnt7Fw+2D+tprzqq 5MU68vE3epJQPseV8oO204me1JvhQwVH6u2LpOVR10uZ8uxmwCDvPLx5iDQ9viNoZgcSgZuK 2tCBwfrorq/cqksQtRN+6s4xunSp92SqlToNqFZ4I49+6Jf02gKfHQR3tmhn5vClWBCp9V47 H6y6dts9bkou+cJ0+Led8Ts0KBtLsvnoMQMclhukdkdpxJHCD6f35DbMJjXmitOGznNinHYk TwrUnIDDAyOM1A5BNm3YIycDAnDn0HAbcZMac8RqY+H5WO1IPhisTVaSKVhLKjzdYgnWJIU9 WLM1065SIrEGa1ozlmBNUlmDNUdLFKy1ItmCta4hW7BG44fdF1qD8+5DBfEUsusdAQg8oGl7 ZSeSEisilHRANIjYogrqe6bt/Kf2k3L2tpzxGlwb3LPC9Hhbd+XikXzrXCjLxNcdPBHDaXv9 qeOAnL0xp8ftpP+1ctGADOYpN47AOB9auehZlpxWvksWN2Yh/pO2xFPHGTxrW07EMlhxExHL cSwlYHEt8vl8CK8cYExa1y+nxZQt8dRxlMPalgutuCwJuyV+JFfCLi6uh0CZFG5bsCEZJHAA Gb4RLdrIHTBGNWJDMUhkBzHWdiSGIXGsEKZtxoZgaBD5nXCeQPa5+57dCbfTSGEVjXMnHK5/ iIqJO+Gp/eiFvS0XeIEbWIrEDl5cSeAjJYBHF5YmCZwwRjKcth+eOQ5g2BtzeVpN+n+bkkUW tBypyhT2I2q3KulpIVgUgL3cNO/bu80+W1OnM4e4KuFs9b9slWSr1nKg1TP5HGoWFx473HUU 5rlbrU5cKPlPqjjIHIdZrG25cOHQhE3DhUeyJFzotJrz+SAuPMQ6S1TVTospFQeZ41yLtS0H LnTaExYXHskVcaGT6yG4MCpV6oWgRzYEhkTRO9diAEB8MyrEK7VE9JCoxUmlnsIxEZWKmX6u xYCmrC1JeChF0s61GCBXqSeMRlSoRTmafD0CT0Ad175n6xHsNCRtR+OsR4CHg+fZRICY2c+1 2NtyAsQyb800AxC5Mskj+crs1pivGxYSw4mw0HGSxd6YEzOMpP83LpOcqUp4Es+sKknPYlUx +vyhWG64QvymwRXHyQ5rW064MpicE+HKcSwlXHGt5vl8CK4cYDVaZy+nwSS44jjZYW3LBVdG orObbkeyIXwyVUMmQALFwXmHJAyZKklhT1XZmlGxRUaHkCzJKq0ZS7ZKUlnTVY6WCJC0ItkS Vl1DloyVHD4+Y8UTyI5337MZKzuNlFbRuDNWotVuqwp25iyrxH50w9qUE47kcd/sjtGIM111 FP82WzXk70YlxK6r8bBpznF2w9qW05EORTfXKvZyAnyqReKUtp6xX7I4wjeHlCty7vqovqdZ DE8MGfXdc0HkvIHJokFp3q/lkM5yyHkaTypjtd6vxZA+lCvgTH8r8cBSyNpofnItJdlO2wyL JE02yFakWBhrFPtLDh6I1ml7fn3iPI1G+SAJN6pO9Ms2SwAjjtkeWwDpVzyoKMhTg3juEIz4 qZo+myt2HFGzNeUMwEYghg2GjuJCVx+dmouM7KYDojZ6kYPelgxaBiF3HEizNeUKt4Zy89HW UUwo2JqoHGOsJcB5m5VkYi2icMRalma0REi3j8PEWl0ztliLqOyxlr0lGWtJkayxlmrIFmvR 4KnqxdHXCZ9hd1PQMBCFPQfPyqG+59koY5k4c/Qam7bMckSRTMjiSyprFt/GS5FYmcmxlv2y Jfo7XqoydEySWPcCJlEFhmes5D6eT8s+Rqimh0zxNsIo0kmfi1qKUdcF6j0QVXh4eORSB/n1 x39V6lGbAp1o8IiS36uNergZhlnqQUjag7N1qHivkJblCXuBAomDR/vtgg8tZqRntZ3gsZRp moiJNFKY/wdrpzk8XHnIZ9qTKF9ul0c9NetsyhPgxg+z8tx1mpJwO3ovQta3RHyzhEecJgae hH7pQOX7pV7U4//Zc3FUoQEeynDYU+eWsf6cytM9eQ4erAWH0IfSen8gZRJlYWZgZLKZ/wAQ 3gANDQplbmRzdHJlYW0NCmVuZG9iag0KMjUwIDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50 IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA3IDAgUi9GMiAxMCAwIFIvRjEzIDU4IDAg Ui9GNCAxNCAwIFIvRjMgMTIgMCBSL0YxNyAxMTUgMCBSL0YxMiA1MiAwIFIvRjEwIDM5IDAg Uj4+L0V4dEdTdGF0ZTw8L0dTNiA2IDAgUi9HUzkgOSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4 dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA1OTUuMzIgODQyLjA0 XSAvQ29udGVudHMgMjUxIDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kv Q1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgODM+Pg0KZW5kb2JqDQoyNTEg MCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNDkyOD4+DQpzdHJlYW0NCnic 1V3db9s4En8PkP9Bb2sfEkYURX3cFQu06cf2sMH1NsHdQ7sPiq2kwjp2aitNu3/9cYayKEsc x41JY69AjdiWNcMh5+s3Q+rs5bKubopJHbx4cfayrovJ53IafDy7Wtz/fnb1/b48+1DcVvOi rhbzs8uH6xo++qUspuXy55+DV6/Pgy/HRyEL4V+WpTwIA5lLJqIgiyMWxsGyPD7679+C+fHR q6vjo7O3PMiDq5vjI7gyDHiQcJaqy9I8Z0kWXN2pa95dJsHtSt02uMV3efPu3fHRx1Ew/j24 +ufx0Rt1t38fHwVvLs6DM2IQrxZ1vbijx/F2saifO46oN44oS5lMA56xLMZhIPcN02+uLt9v 8r0nNRGmLOEEtR8R0Q/Ns8gSJnM1V4p4HHAZMZ4FPAS+DcO7XmdfDu1PcyYTuxxPxSi4gtfL gI9P5Sgc5yOBn0p4G+HbvrD3YCmWkqUxxdKpW1LZFlIcB/mfcJyNWAhDZdE4HUn89NMI/g7h 7wheQpdsyShiWXQQCchIkqQCpTFCfTj5OArTT2OnZIUSfEaNsKdQmlqURywVa2o5yxObKuxw lZ2j9ofbBSHlQAzPJinCiCWk7lmFIBOg0ZCSLAS5D4Www1XEtDQ/3JEhtHTB2eV9MQczd3H+ /nUQnv1azG+DUTk/ffdq/EyfJbQYu6ylMUuAN+W/wqjP24swTLOf9zH4sYVizqKIotiXxg+S swxQrSJ6gKM349NoxODl3flY6L+4axZ4BDwcbMRc2R5lMQhyxXx8mo6mYHcDGK1dAmCV/chC Tf8hZZFF22SxhIGWzonmMYvl4caYJyxPKXLzcTJawDBr54Qjrq7MKcJ349N4VNbOiUbpFqLu xxjlEKES5K5x/UwgUikeQK9WSoWcr6dIEY/IIZ+AnqIql1+BhXI+jvX7+jNMAU7+g1oFt/DH 51bx9bflmIfupSZEhCGMnWMQ0j3wMavqAP9YggSR0W/w8l0z6ZqpNGOcZAoFU6yCql6h/BwT j0PJcnId4dAflWVO9NxMShAISkWlO9VE5QJFXQaoxguYNrzKiK5cqVlHHYevE/8TvPaqsdIO +wSXaFu/ooIsnZs8njJOkndvYbl2WnZyn0YwBS9x9ubaoSiRf3PORLyNiWH2si85KWClEuTO lY5ggHAFLxcMho1pqyWf2duFZ2jwbYwEpyF8BxnEiQe/qiTAKQk02uXe4YQpS9NtmkWbzsST 5YzUWhAkT9oC3Y2lZkOr/Coo0AbVy+oavNIDmqdqAddCSBIok9YxZb6kKWTGMpLzn8acN+wX 8DpTH0Q+HE/OUkkxMZlVJcbkzkOlOOQsJ+l6cHEq7CVl3c871PqtYDXjGzSbTZR6D9fh3/A1 /IcVFI9m4P/E6KZd7zhx+PMigAv6XgescHONJ+8nVEAxNAxmVf8BfJixPfrI9ATBhoe0MkVI yz7obqyhRj7QrACDZL3U1Sz/5N5LSMCt7dwxXz7pQJLPQ8xBrNTQAWPwWq3WgX81PlUT0WrX I8aEOBuoI6iJ5RRe3bsKCHAlwSvq7kOru/WYC826VlvN+02bz3QWlV5KqOZN0u4hZ0mYpDiv Hxd+chIZs5Batk/mSZVys9W8n9GhlCYgtUVrf+ZNopoZH+za+qcxowbi3tWkKYsoW2SJxx2T l6FGlazknQf+MtwyWOdx/9q3RUobsp3ifu4p7lf+JqX4cG/RRYhCtpOzlSJ7AD33DNDzmIlB jdQrQG+l6C+YspOzwdORcRaty2vQRgwRi5V7F5xEENT+KJMGTbez63wZA1wJmdpOc2dbxpGL ZZzaIJQQ0YsQS7BD/MvxGuY82ULOQ2ycbSH37OXhPpBU/OWHk4r6QcwpckpL607w1wvuUlO4 6EhktRrLUXGL8at7JY/yBKN6O786uiq0idEhNYays2mb702KNsDFQBuHZKJcM7+6bvAZxlEg aF9h0ggoPYZ4zu1CrDLFSOw48za7IPy6t0SlOEO/69O92Sl6c28EOR1Bea09Kx2MDjZaCNpy crR9DGg4+p5RdJ62pyyTJHfLFjbqg1KgwoMww178O9HWwLVpSjnUeK2cQxsNTzNEwYuZe8o5 4wTlj22JsbGF/RKjSfBbhE4ntPCFTmqTYfGvqV/1K3LqoyfrZAAG1uU4b+jvXivrcurJAoAg hxI8VK2MIO+rVkaQO2ytjGDCV62MIHf4WhnByEmrFx2gaMeKkvqV0zqPeqWqL6DXbU0kKPSd 1F291Q486XuSwhq0tsVUGDPigGblNSgDmNBvxnB2awhJt4SA49gqxQHSziP38WQkBLQ4EWN0 7/6ERPdnJ2cgcLOkizuQqn5v4u56Ca8P5lJAT+Pu8tYtNEsldDTM/xjIu7M0p+1qU2ow17OI y/APRc8yZyk1ZQjX46fIydAlYFjkGlbkKqQ42AxKHmMc+tQMVl66b9YqKRNwhX3qZn1srZSo 7/sFjF6BgihgwGpq09vER88Az1jEqeFB7cKD+tMEvah/KihyK/fkcqglEuScVWSSJnnwVZER in8hDzZJTasFQe5AgZ/ItjHhPPATyrBE5MI8YLEkVnl3RI57P9/BIxs9FWCT9HbAk2LPeFIs lHM7JJxkI+jPkVmpXThPJ0LOJEXtr1CUUT/IKGH0sCUCcF97dm8FGeW6Qr7b8rDpifRbj0lE BCI8VD2GIOerHkOQ23Fp2BfxlprFabxD0UL//v+2jJAxznecRttyThwsZ9gTOUgvcIddEiZQ xLf0CIdCeTEASM/3k4mNdgqlYYL4x1HsnF6mjHJI0ttPl6z0EtzqeDB6nAsmKHKXD3ewsu+K 5Xf3hJVk0x3HaVvcqYPFbUudcW3LDLtrrbVlDRPMW2f2WOnEw71dDUPGKVbaZCfVdYAme16u TWJr0DqpUQcFURZRZQR37ZYlRMfKWWN3wYbiDfCC+w2UsXvbDqAD4fcMKjPJ2oymJiTv2Xyz iapwniOoUFnlCITQPLQxcmg2J8hhJvIrvFwGFyA9PIdA5yc+2t5VTnKwgYP25hQ5G8yd2VDu aYvbIajXQssaTyz1SsU3BWy0Mz/E627UTb1uaGiMgfI5uRwGNpcfXNNLoR+OJOg8oVZLJo/p 8fWKAUVt8DozER+W6tNMY3UVIv/R6Dc1VeUXXaBIRhXCwKWeUg3mtjGVBirW10K49RWDvBlc mI3q2Zg3s25sRhfmUTxmJItNtVHNExz9ETcs6HWpN/jFG6wCeTuvn8Z+AjyZAkxLyN99H6+E +abI/etmWDdKO0Wch7Ua+9KyhENHuBUAxAnVzmZSYRl75qEjKc8w3ScY0R5yNdG8YKGrg1VX kDAYKHLoDdXlsvWCwk/DRR4Dkkrwr1XtdVEXLXje6G5dTsC7N1CpUbSrtlBTQLDQun6cEg2u o4pM9gsObd6F4x4uYiSGw5eTiW4ygIClFbyBfXUFCt/PrLXNd1AGWmgnlHQ+h9tUdfVniRCq Vv+GrGulTFJGjrRr6rYFE75UUsKZMc/eUZ733bup2bXB59rHX6DZBx+/xdc8w5IbQl3P4zzo TGH2rOLSCXGW6Y6hyn3dQUioOxBT5SHgTQHyJ8h10wzn+0CE8pY5P9xIk5DFgiIH5uKmNaTr 0qTzIFtAdE2wcOe+vsIxhbCT6yRtyvUqs/mEQ6RTw1XQgoGidYlRx/f4MWYiY3K4pafNUUXf O8NIey2U/YvzPQEnoqNLktyydhLePphmvN7OPj9S5Cp6DCOKMdMklHf87+x7L6Zs08CmgTHp 9C/etoXKuRmLBcsYwhOJBZ1wbuJDOGOFGL2KrZzTExCkE/TW3fHurXu2hap7ocYc7ZuNXLfP dlJ4KNerH5Dz6aFcr32XnRw6kqKabRjOvJP6FE3rwqSEUNRD6hBHfIs4zGYM12RhvZHGrpfo D8AIaYsPPTmPKGH5sKR4ZdCCp4JR5zW3GHBzgi872PKw7oSZNvZ18+iiwMRuGnGrMGJXrw3E 3GvtNilvm5OftBGRyTPzXpq5bkkx8cTEzC1cft0p9qGp1+ldJ7aAAOSUe9u4FQs154KS7UYc NEU5PyMG8rVOubThsZYgx/nelzRjIiM5cI6dZSHLQ5Kcc/GqSFzsTM5Wrsp8lqviPLZBer4b PdME8WOCul79sNofNFi/7gmvJm1TL6b9lx/GHS0x0WO3gTzTyq4Dcr0RRSNAaKMKCDS1ZlVe GhRjSY3SfftljJuPtgoVDXg1gc03TfOsezYyCMAoNrxFBFGeMim2k20iAg/OXogYcEeCuukU rzygzwLQeZL2dQ8Gv/WX6WQIZlHrDxsCeqDfV4CCuyGHc48cK2ufbZuXvr8tZjPTQ96vX2yG MU1ZASANHcSVzk2IjDJGqrSnUCBWLssCKXd2Ey29pBJpig0sBPnyG3ZOgTuqQfKiE1pevFdh 3hrQPpUbiLf7bkYOm7YILnc5C8j9toIQ9u8THJ24JxexXFDkPGyakOhE7eTcn1us92gQ5D6P u/tgLaf19roBrWCvdkIqXzHhy2U5wa3J2q7U39ufvF1iiqPzlUfMhvCaP7pIY9wBGtuo6brl xGSTPxI8NQO1BE9+jE4a2bBjW5QWu88JlH3lIcnEfkO29eXnCfYi7kbPlhTkbho0M9tMwAFr Q0xFzYRKtUtlaL/t3Uu4SZYrgyIzO10sgjUPn3jtmq4ISbp7I7MWaskWavs9r2dITKUCSUQR m98sxlgBSEZ3RV19hUndc6/LgINIKA4kxcHfXRNL4FEiBDHHywbSrFRQxK4+L8tiDGdRKFMd FKA0xUy9/75CSGwV3CyWjhkSynplKcXQ3tnOgF6DvVICKO/uYcCQYj7fW3xpbiolU8tYGaYY Ig4VBQecxfrCm7/hLR0MqLF7HHcv9sfzG2jHF+z0rwA4LtdNAWqO98zlhmqbCnguEMHJLqfb uXj+DN24Dxle1gc2Nxv3X7P98EGikx68pZW6v852gtz7eb1cTB+augrGSvvVmKwc6GeF7DZi 60Jwcc4hGayJJIHDZp5EDVuYTddlvxl8u/1enwnd2dCNka2pEJgkr6imlnNgmh06G5WAdssN 9CGaiNzA6+tzG5wDcDlMFyEdLIf0jra4M7BDe57RZtfzRnts0zhR3cKbTq0bzyRowYxe2jlp ob79UR8e2po/Qnheh33UL8LwFd9rL6e13QRPSSPk7B7XylPA9ghyj5/RsU9gCkwe2AGUbMXY YPO8i6ou9QV19dXUsK7XxzW5B0sbNZYxxGj9Eel9bnV1p/d7lDNTJzUsm1G1BzWVRj87w++0 BEMoct+mucPlXayCmd6Vr7eaODgV3rZgIzgklBOj97JgIzhOQ1Ly9nAKWQgrlSC3iUno1F6F qGr5fl+byg5STGwCgnXQ6/fdpZoNZrtTKO7XmftdU83aqZbj1KAb5ax3HoPn9i8RC8aH0Vif 1wnu78Szu7ULs8qw7Jv5BmtZ68GmJZ8s4J6DktYAlsk23VoHxd4QWEdBl/3dE3pmMpgY5y3Z WA8ixNhZAs5RHQHbiwVFeZcoysUxu1vCaY7PSNseTkfewmkbdY/htJ2cypfBRmAYl43uivv7 CpHI2+AGPlDJMjSEBB8Q+VxgJ0jT3ZfueRSLjVWRKFb5jqKxrhgXB7CSpiiCwIeo1pvt7J02 GB1y163ZLVpD4Lz5NIMTawkGdxGci5NGaFWLkvxpVRs+x9mRqlmp+1M1gtzTqnY1Ri8PnmWF DbLFssT0baLb5ZyrmwxZRvK7y6pxce4GrW5xajue/S+kbnYGdxGc3xMeoogPT7bsq5uXIxdQ 3WzUPaqbndzT6vYSl0ezEU0n6RCWny8AYsK+SA8OLoQDoXaTkHXheD09gec5i4lzB39Q4zDS dd47y0HfCC53kZ6LZj5a7QA/tm8jM1o3fIK7I62zEfendHZqT+vcu3ETPC6mwXllQNw/UQs9 RJSxhNrFTsKxrhgXlV5a3yS3HRf+1/FwBIO7PCHFbymkObB/u64l3nTNRt2jstnJvaxrmP8E AI+184IFAgtiOS9mQY3rKLi4hM8+BNNSQxK4BQAauDyoGxxByneUj3XZeC2c8FAwW93EsfIk EUszilrnBGYDKs1mCKY9VvN1T5OGkfQMN1UZg0sR1Zbh8amIJk6b43VPN/ZiXG+c59LHhhNb 5eMrGPfZosUZ9T2BhsEinwKZO32oM0AhuzsHNYDWnitsxSTh/qt7HBFKRp8jDC3VnS0qnqDI HJ5nN4z3HzFnWxcRVustsgaa1VO+KrfNqUYEZ01neB9PvOkYe4uQTJ8sInnNjFta4OjZgfNa ytVJsL4v3k2DquviAFZa9DF+OB+PxdKcHr7x3J9Je7pLb1+QrRrYKVYAe/hFiUyqpZbqNer9 JAA9wVkIr9bO285R+EsjmgoQsYe2eGrgZf31Qrf7lyv3D+KLc2hVsDPsYQtxpNyQndgvqHaP 8DSRTndyZ5PYYn3Me98YaZWVHUNm7dfcrjemJNZoEJxNnzVmY/PhJb3HOWj7YY4pb/s+845i rJflSWAQ/81uTxOn9Z+M0zSoz3B9TNvvph4tVJIzPvS7g7M4N3tM+7UO6zw1lnW/zjHrQtbP XbEybgsY/gchUseiDQplbmRzdHJlYW0NCmVuZG9iag0KMjUyIDAgb2JqDQo8PC9UeXBlL1Bh Z2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA3IDAgUi9GMiAxMCAwIFIv RjEzIDU4IDAgUi9GNCAxNCAwIFIvRjMgMTIgMCBSPj4vRXh0R1N0YXRlPDwvR1M2IDYgMCBS L0dTOSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+ Pi9NZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250ZW50cyAyNTMgMCBSL0dyb3Vw PDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3Ry dWN0UGFyZW50cyA4ND4+DQplbmRvYmoNCjI1MyAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVj b2RlL0xlbmd0aCAxODI4Pj4NCnN0cmVhbQ0KeJy9Wktv2zgQvhvwf+BRWmxoPSkJLQo0bdrt YgN0YWP30PbAyIojVH6srST1v1/OUKJkiUrURnIPgkWRnAfn+2aG6eztPk9veZyT169nb/Oc x3fJknyZLba7b7PFcZfMPvNVuuF5ut3M5vc3OQz9kfBlsn/zhly+f0f+m04sasG/MAxsYhE/ 8qnrkNBzqOWRfTKd/Psb2Uwnl4vpZPbBJhFZ3E4nMNMiNmE2DcS0IIooC8liLeZ8nDOyOoht yQrfouLt43TyxSDmN7L4czq5Erv9PZ2Qq+t3ZNZhxOU2z7frbjs+bLf5r9rhNOxwwoD6AbFD GnpoBmpfKH21mH861fuF0lwroMzukPYzLvqpc3ZDRv1InJUQ7hHbd6gdEtsCvSuF+87Th4Na GlGf6f144RpkAc85sc0L37DMyHBx1IdXB1+bzn6BSp7v08DrUuliWFHhE6JsNPIfywwNaoGp 1DEDw8fRrwb8tuC3Aw9rSLV8x6GhcxYP+I7fKYoIxLhiMP5iWMFXc1CxrnB82GVhA1BSmhM5 NHBLaRGNmA4KPWbpNVILn3aEz1pu+GWRruVQ1ok9rRN8BjIKUT61wO9tJ/SY1XEsxcKeCiHT kdl8xzdAc9fvPr0n1uwvvlkRI9lcfLw0fzFnudKNddUCjzLQTeQvy2nq9tqygvDNSwjf00iM qON0SWx64yfFaQwUUdRtoHFlXjjGDyChHTyyrXnhGWkO+QPoZwODBOZsTWbcIkXB28F0xYj4 hkP5I9/DS0JgdX4HT54T+JSatmusYUDun6xxotg3MPKD6cnt5BK5/Hr+mezg8x7WV0LSTHyP 5MBeUCcuTMUehYIxqnBUpuRoykpOF+u5aVvyyx080hj145mYwdA6nJWCKoXGYOQrAgPMSJWu 1S9OyllaV4x0jp4osNrnyA/giPvKWvRwnKgTi+9ggGeZ9D36JaFDK2kLOIWsS0ldQdOAuT0y zN2AuuFZYa6VOB7M9eLmCSJ5iZE/+KHbPvVYl2gUvDrhkb2KSvyVxPhMHxBoGzOoTUcg8iyN gY+YCHCGgMNvaA3PAYZF6MMnsUGJe4lSjHf82aQWVmMW8flGDBx16/g90hVQGXLHVsEMySBZ qpnIL8g0+Dk/gi4UvuDnhSAwyT6ddBIfYbMbhOdeKhNJS5PbijpLYI8URFC8tRN1vAXRG+Xo JZL2Xp5Cik7Bj6/InbAJ3x8TcahhMel35Qf0kKSlwlymrC0PtmFu2Eg82T3mmmaaqodBoImC CIJgaLe5noh8v8tt7br6peJ8i4qVT55SLeWmHN2TkzXiC09tKZPxjVkE8w/lqEfTtuUYujLD 6UVss1pOfsAwliGgTrOGmeSHwoxMSKMFq+1Rt908Z/wI5taiqkrST0KqDE+MHQ5sIiknb1UC smqRFMYR7oPnU8eVPYDexh751Bk5n4pWwz5rOtUJHI8ItdI+KcqBuJDZq6q8ZBVblZxF4h06 53qMRh36YaCvzQKImErSnGCdK0M9UQmK55hW9yUq0CAEgiwVqlz6ihywoK4MjSU2VoIWJOJl Ub8vs/xO1eONRCepA5gh5xmO3CpaqUqDek+g83MqkmvYRraqGZTvj2UW3ZWtw7bqDyRbZqDb 4OD1wkicTq+I1UHXHRe6TGjXTh9jYlcvcTTwdoh7nz5U2W2F7W6jYjxtdb9jioBoOpaQr4Ku CteqGGW19IktbpElMZIboaqCPCijswQCZk78VYQokVCFQL5XpVZRmd6J9aox1tekmAfzNOnX 1EoUq2IqJ1xx3rJRpmFBLe8NjpJ4ypKgKDvGOt4ghK6jVf6cp891XRDeoUMPcHsjg5sxAbmz glsrcTxw68Vdml7tCkheirQaQoxwDNNGMVxcBFXFsL6pjOpbyLSETZ2sfhFKa1U1d3FBcEIF Q3cItgV/VupwUpt0dCmRoo0LsOGZlrXOA4q1alwg6wISl2Ke7yAHx6tvMWr3DVIdXv2R8eq7 NDrrvZRe4nh41YubQwg4RW4sqHujbhmSjBR3mV4t7eTpGqOwCWv4Y6gIse8nWZqvcM92G1eI bF4aq/h97uL4yYttGcyetKK49ihufmQiRmvwqpjV2mckA54KEDn1huIA2dc5yb4jHZJYoEln tXppUwPsDbJdluZAa8nh99oNQO2w+LpsBeSy+r1MZDymkoxq9cQDbhsnh/4E1Has2Fr6bvir HpcGfpenhr/q8QJq213iIJ6lazEJpbfoHBmf56mDPMemfqd+PXiVjcyrrnXuOkgrcTzI6sVd p4e4Sqfylnt12r5XCZdpu+iiSlDkBMF2HLyOjkSL7HZZgXwtibW6O5YskaW1K3KeJ9mxvN9t 9GU8lncVS0W1si0RyMDL+ed7oafanFppI0mowhsDuCG1DY055tJOl/WAXDAA5HQlFv6Nn1kR DcaPfsey4L849JKGPvgffLIRFA0KZW5kc3RyZWFtDQplbmRvYmoNCjI1NCAwIG9iag0KPDwv VHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250PDwvRjEgNyAwIFIvRjIg MTAgMCBSL0Y0IDE0IDAgUi9GMTEgNDYgMCBSL0YzIDEyIDAgUi9GMTAgMzkgMCBSPj4vRXh0 R1N0YXRlPDwvR1M2IDYgMCBSL0dTOSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdl Qi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDU5NS4zMiA4NDIuMDRdIC9Db250 ZW50cyAyNTUgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZp Y2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyA4NT4+DQplbmRvYmoNCjI1NSAwIG9iag0K PDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA3Mjk5Pj4NCnN0cmVhbQ0KeJzNXW2PHLeR /i5A/6GBfNnJRa1ms19xhgHJb3Fwzt1FSoKDkw+j3ZE08Wh3szuSo39/JItkv5BVxeGMjfiD vLtkV1Wz2c9TVSSrn794OO7fbq+PxRdfPH9xPG6v3+9uih+fv767//vz15/vd8//Z/tuf7s9 7u9un7/6+Oao//T73fZm9/Dll8XLr78q/vn0SVVW+r9h6EVRFe3YlrIuhqYuq6Z42D198tff FrdPn7x8/fTJ829FMRav3z59ontWhSg6UfaqWz+OZTcUrz+oPt+96op3j0ps8c78Ntrfvnv6 5MerYvP34vUfnj75Rkn736dPim9++Kp4jtzEy7vj8e4Dfh/f3t0dc++jXt1HPfRl2xdiKIfG 3Iax3hr9zetX3y/tPlObrPqyE4i2U4bopOcsh65sR/WslPKmEG1diqEQlbZ7Mji1X3w6+EvH su3i4/hMXhWv9b+vimBMz9Dc1LIUqGahFVab8Uoa/e3mWXtVm18vaULbln2DmfDssqoGQpW5 2+Iv1Wa4Kit9q2W96a9a89e/XemfK/1zDYNyQbPaui6H+lcZgbZuUVWFejel+uP1j1dV/7fN RdVKNfADdoerGQ3a6rEue+m0jeXYxV66hF5xi/yF9EC0fTAM2SplVZcd+q5FB6HttA6rqi0r Pe7hICT0Qh6LvTDRIIOpxfNX99tbDag/fPX910X1/L+2t++Kq93ts+9ebvJYRZk7xOxqFDvW gV2/32+aq8fj3cPns8glUCqEeq6Y0hB003T904pRGKfeus4MdDM05ViIsoGOb3+7GF/9PPtS qN6iK+WgeotSFmIsh5nY1UMQyEPgBdl5oe6+Xr4erSgHUfQKmapwNL6+u950Vx81EH7YPOuu duqJ3OrfjsX7/eZZbR6P6hE+oXyLZCPLFrUImayTA/BS/QZPoitrhUSy0+hVlX0N/7gnwTX3 rk0b36xbFcypv01Xi3HsT+8CJsAYmRY/RHMJvt1IWHRZTqRuVLq0y9kqt0mYKYjOpJqcSaQk eHASEHHh7FblqPr3Cv6k89ssylq2qQQyUfIU9m1UITpLlDqhhDdOX6+9BHaoJDJUKaJQ04Xy x9RTjY1V3cJo/bB9CEbrPJ2NeRLscJ2vp1bPMaKn1s6W8biEAo2Qcc/T2imtp82FcShbadVJ qV6skZsLDTYXEkShltfK5iFmuokGbvV47Y/77aG40Rj8oP+4fav/eiwef9o8a652h93xbvOs h76FBubjRsirO//r40Ze7Xb6yp/83643ooIu5rLjg/7j/o0W+NH8YX+nPGTT9hg+qnNuWCp+ 7MekiYhivAPPtuw6BL+hzYbgi1ahQssev9jOQ9tuJ+Kyh7p9QUlQ7WpEbLseHzVYUX7wEjB+ gCF29GAHeLoJvBlMRNutAb7dscusy4peehNSpPFLS/MLKYojmG6oDaPECKbGCCZPo2WYtcYU hgGFaRTTMRRDyuI4JjT+xT0ACYa/merUhBpj6nB6yVTUqKcY0WPppdMBfkvQS6bWzviBJ00F C5KgMI1heoZhSFkcxYTGf/2g8Z6nkzvdcDKV9BOTOCbDqSTvzmSjALRPmnUMl3Q6tENiAduG cwl6sfdpTDvBJbgE4BLbTnDJJAHlEhhjnEzwdmsk2sHZ4DvwfNI6fraQ3DT4azHQfEKKYvlE P9YhzidhBvQsjY5PVhpT+KSdOyPMaI0Mn5CyWD4JjP9hq1/vzx4OUv38TDO6RofUJ42hhZjW u2MAMdQYCizjlSSMReLA+gsgMYasmZaOdale4dDSi6B9nk0O7blnn4D26lUUCNibJgLrkUtn /oUgkR673gK9aaZw3l2Pwnw7hSXT0M5uAG+3FqIdnAntImxZ9lnBvHTUmQDzgs5w0rJYnDd+ YxTmGwzm8xQ6mF8qTEF5OXcTuMHCknhJwliYXxufi/KZVliUP2EILbJI7yclgDya3EsRxoL8 2vh/I28778Yc/jJPJQF+26YcGwR/oY0AYOxi71iYdgqCUQkWg6GdAmEvAUVh2c4T+6Gzjbdb I9EOzgbZrpYGcGdbtMlrAwLLciaIYjG4FujiQIuBcJZCh8ErhSkgLNrkxQGBJbpSZLEQHNie i8F5VlgIPmUELbqINjmlLtDkV4IsFoED2/+NIDjrxhwCcw8lAYJlg+bObRsBwdjFnvUbJneO S7AQDO0UBHsJKASLlsydo83WRKzdGSDaxNx5OzZ6xWOGYQPllWBJwCRhLARXAk2fdwgE56p0 ILxSmQDCVuMMs8gRw/JDadJYIA7s/4MChY/w/iOYm61S9qXkR+wSikazJBJoSiSVbL3tqDfn nTQnADGtxhlkknMCzYIlSWOpJbD/BwX6w9UnPXC7G00nQBXv9Y9bTRj3hht2D55aOjW+a7rZ FvpHQx27n9GcTq7xsjJwGhof7j48V5Ooy1Fg08vc6o26fUOi1x/1GH0wXHyrfzxe3Bo16Ya0 14qjTdHgywTQRtAmdrF31BpumQCVYGkT2ina9BIw2rSD7IlvWCeQqA5gJtHDmjH18Ow5YDmk tldMLxNzSDWWuE2RxZFnOyiDkSRSiJRnabTcudaYwp2gMC2LVGMptyRhHHOG1r/4qBef361D GG7VNteMTioX7aQxtEAD+tLSSDWaiUsR5vapLvfsqrdCp9/bQZRCLAbwRscW5p+d/6nYCAF7 NE3k8bDbjFfFXv9u9mu+1c2mpXir/4VO5iITURbAN/pHxTlCqqhFXfqTime0oIMBZrPv08Y8 SvjWRj/aAPXrDQgY4cq9vuKd+s10gL5vXOPxYasEX5sf92Cy6/i4afXWJWvVO3+PaBCVM7KN mhMqbghHNmlz6QSRVR9nAduGswB68cyzUu0EC+ASgAVsO8ECkwSUBWBo0VUEot0aiXZwNvgO 7CpC2yrSalMZAMvqpshiGUD9v+njDDBgDJCn0THASmMKA4DCRAZAdzWmCGMZILBex07bW+8g z8MN9U84hmeaoTy/ujttEC22gMJECkATgSnCuGAjtB4ygf8wccMDMMAUbNxuGmDY3ePzB0D1 O7939KdYkutnDbrvdcudouLDrrDM0oYOuo5kIOuFgnLevcq+LqXgnxTvo7e91LFHHJ2hjUBn 7GLviZh2Cp1RCRadoZ1CZy8BRWcYYzS3RbRbI9EOzgbfgU9vScd4KUcPsIRviiwWnZtKz6Eo Oo8YOudpdOi80piCznLO79xwoTsCU4Sx6BxYn4vOmWZYdD5lEC3ISO/i8IsMNZofTBHGonNg /Q97M4IGOyd0hqzQ/gjet/5H7+r36wkGfmHoLXjj6Z88e2VVGfzhRjsBYVvpfbsAYaGNQFjs Ys/0chbrRREWlWARFtophPUSUISVk48dRVi83RqJdnA2yIUPTiKscKyV4v9imc8UWSzC1vrU 7HzyhGekz9PTlVX9K+jphTlBu9YzMYa4sEIVb8ZvjCcMMXc5mKcv0Y2LKcJYwgis/3b3Jroe TbJFpg16Dp44ghYwhXe5eF9eoimxFGEsWwTW/3H3s+cIk57Zv/OnsAxN7MyagOaU+Zr0tcnI zJaai814ZWo3lLqPhJ/Gq/DQ5Xn3IYVCdsE/hQQWkdL7oA4F50QCzRORLDo4FMZFeNdEzgLH oJMDa0KOJRXoMpHK0l6H6XLuNQe94L7FFCBEUyt4u7UW7eDMEIsAgkqtNKNMT65L+uAwLYuj lmYcV2laDIFz9QC1/OJ6LLWs9cyoBTsInanQUkt4Yyy1WIWJ1MKchaaFcdQSWp9DLbk2ALWc NIKAolZhIrUwJ4hpYRy1hNa/uLVrACqc+JeOLFRQYRZg7jcd5He2RxWWIASRa42a/wp02LFM IAhhyhbFwwxoI8IM7OKZEyJGMsxAJVhGgHYqzPASsDDDjjEaZhDtYCTewdowdWDDjKaXy0Q1 WRiBPuRLy2K5oB91EaIUjM7UY7ngl9bjuGClZ8YF2JnlTIWOC4Ib47mgl8sMO/n0mUPLtDCW CwLr3aFl4yhj2J+p02xnD1Uul6ZxxsnUCgeKT3pOFpZ7ucyvk8+JOVFMC2MZJ7D+G03W/4Kd ToZ8dKyy/2SWDkwY47JgOpypZxsBjncbm3O8g+ViLWK7n/bkmj1UPvw5bt9o6fOlinlpDJTS 8m5Xdo2uSsQ+LJ7SmrFG1yZsG05p6MXe+amZtQlcAlCabScobZKAUlovybUJot0aiXZwNvQy dW2ikb1+ZBZFZbus27V+WehzxrQsltJaoedQCtVk6rGU9kvrcZS20jOjNOzYdKZCR2nBjfGU BgrtC8E9febcNC2MpbTAeqYOR646qMPBDtb5ioA2Az2ptJmp1dLmKXPBQj8otNDPzIWGOf5N C2Npsx35FSOMwTI1y6psYpqRVakR8o9mz7ILFB+L/1gmKvUO5S7a8Wg2HMDi1h1sHuihz+Hz tOtgf3zvfzGOw2v9z6vvtdTFSZ39rd0QZn2BP21sfvSwQ/eGZQ5UW8ly6CIDVV5cEVRHDBRF fYoiUpSzYRLVZ07SRuo878ywv+i969aju/Pb1M0DMXtDtmYqgZt37yaGceQO++vZc99+MttU 9gflwzXqEV54YKWs9WWh/ac7a32NLnPaNsJZwy72cUPNLHPiEqyzBu2Us+YloM4ajLFpmUZ4 dhd4uzUS7eBs8B2MDcs+K2dN9GWdfE6qYZLRtDDWXVO03UYXBqtKYAUDcnU6D2elM8XDAY2J B6UaLoNLS2N9nMD+RdgebPfGnYNcO6x3cMo4WqwBjYmHixouj0tLY6E3sP9bvSZYz9cEH3Wd 9g7W+sxg/k7/tFwDrJG/S4/bf9Yb/xbcfaNPMenuC3Y+bB9gT7fOJD/4y+1ucptiPuJcnDke cuh1sMk+zwQol105IDu2bRsB5djF3pc17RSUoxIslEM7BeVeAgrlMMj4uR2qgzUT7+HM8D34 cztyaPWHHFy4V+mni79SdDqZlsWCuXLqauTcDrYWl6mx70pRhRp/vMLqG2TqcZQR6GEpwyp0 kRfzWJg8Ly2MJYzA+le7e6Sa1Xn6GtWTmAZ1JVAyylVplxRPeUCAllah83uZB8QkeGlhLBMF 1r8wZYgNW+zN7pN6FgbcYQSQa0XTlVXMircXVzRqWGMf1vmKoOJ+qAjIFrh9C0X2P2zs/ns4 XXW4sCn6QxXVr3HPsmr0ZaGi+D4m/de5d7HYRGsqW7+f3CA7VOZ/18fpmIMWYj0fHXHqjwL5 0w+7B3Pw+rI32TRCU2xwj9Nqxj9210e9EtJd4UmLXOVDrfdR//KPUn/Uoo/hNmxcvpmWc95v +sUjuvQtt/WgS6DEIF0aSC+jPuKlgFGOQn8eZr3yZXEx3OJtk2TTrotLj0fdm83doV1o3ipb kSwbEVF0uk8uOv1ZsbhPDm2ET45d7ENI00755KgE65NDO+WTewmYT27HGLIjfoSnuyDawUi8 g7Vh6gDplUWflT/etaWUids7GnotjJbF+eOyF3rg4v44VoUmU6V1lNcqUxxlUJi2IaJhVo9o YZyjHFrvHeUTNsfl2gCe7EkjaCEGFKZtVWiZNRdaGAvY6yn3TM25RgJX/AnNQecqFdKAajBk aKGVbEW95r9QkZkdiwz81jhZ7cJdVz+93Qzw26cpuROk+C9rtP3CI4UCl9aohqmPaHw2LVqH 8fmZKutel2pj35rzFSnMF7G5tsjgfZjOEFiXeuCOpX3cdKt1vQtbrpdolNuaMkSMKyGVXzog O0VtG+5KoBf7BIBpJ1wJXAK4EradcCUmCagrAWOMbqsh2q2RaAdng+/AbquRUpZdm5jaa+my zrQs1pVQAXUd3VmpXAmsJk+mSudKrFSmuBKgMC3n1jKVnWlhrCsRWP/f6lXSuJDsRmTqV09M njh6Fl5AYVpCrGWKOtPCWDcisD5+2DeM9woNxjY7cQfkbAsh+cILUD20uNfyDh9VAL1MhUyr P4Drs4UYW39HVJbFD3dul/+8rFphtmJ4wrdSzLNH8iquppDPQZntlltfBOIm7h4syeG8AVeX 9QtyuJn8FNhYunJsRufXuGcxpZmmEdwfP0P7aEfItM/OYO+hDpKEZpz58m5O6jPYY+TmTme+ rvEBYsB80EYwH3axDxiaWeo7ynyoBMt80E4xn5eAMh+MMR5E4+3WSLSDs8F34INo5dnLHjui tcYiupY2LYtlPn0BynxbjPrydA5t2XShzhTqA4VpR8xapqA2LYylvsD6Pxqc/EQvOWXqVM6t iOlM3AORq9aUvDvpOVkkA31pB9lapmw3LYzF/MD6v26aGcOaLD7EMtOewOu7TQPhymc6Zk0w TVQR2zrzQZzAti+q6qX48gxlsXHoegOe3FM8X1FfmWRuoOiDDxQ/eddiyu77LR/gPEz+gDtq eFkrNVsOkaHPYEupHiKyo8+2EWyJXez9YtNOsSUqwbIltFNs6SWgbAljjMeJeLs1Eu3gbPAd 2DixHqVeY0z8aihd+JyWxbFlPY46uF0ci1iEO72a028Q0sxUrUhzbGKqWdK0CtNSzy1T/pwW xpFmaP2CNNM39eWaYQjtpDEEsLH6EpPPTLlwWhhHaKH18QJ+EHv9bCqJW6azu+gX66uj2wN4 fDCV+a6PH31oiWayM+9A1pU+a8WOfwL2itp74fqfqpIL+IXmGfzOOzjswkV4t6meJSeCTg7i CDkWiqHLDIoX9jokrOdxQ9DL3LcdeBSQiXawFu9gzZg68IDc13r/SRogd3QtbVoWC8j9qPf2 IOHLNYbEeTpt+LLWmYLEoDDxS85MNW1aGIvEgfW5SJxpBiDxKWNooQf0pSFxx1TTpoWxSBxY T5xqmU42He5mB1yWvrBOp62Sf1+pSOT/XiqB38BhJXWReSDNLGWmIxbDAQd0X1fmnUr9dUbJ PycesfU3QOW0Q2JdoMk2kwWaKBHeL6hngW7QyWEgIQcQ23ahCzRNcogCTXbgccTG2621aAdn hu/AI3arOGb+7XoNZPjbQxe/ZoSxmN0Oq3xlxIkO68mcp9t50YFuHrtB4yyFQg4dUwibkcai d2B/Lnrn2gHwfcowWhwChbOonRxGphQ2I40F8MD+oMiRGcxvTyh0lG1Sb/bAsUOagLR97V28 iG9sm0nfmBIx4/1qZHxjUo5FWuhC+8aTHMo3hpF3QOnGfXZXRAdrL97DWeJ7+Gp4HXZmpa7G 0u8xa+qyGYiZTpeyJkWxSKtN7zDvOAzyzlHpnOOVyhSANfrsfOJGi6lkTcpiwTWw/WtY0Ttp f1ymCZ2a6PVpw2dxx+izsMMNH1PDmpTFgmpgeyThbobSVSHFkDTPCq1+jFhx73YqGVPezU4/ 6k/FBIcEhtli+P5R3QF8uEC79jH3frUbbu21241Tk+cOyW7ntaP7qvPGoBGtXhFmZ9H5esyR ylDP9/4AxvXh46aNuHHn6W1kGZtoJpry+xygtJM5a+p3K1DVMDJtgVMMoTFB/u3GrjT1s4Wm 2a5Jct/DeW9k3ek9t/MDQq7i1WMxq4qFlQJWTeiGxkzD+iZu2HTMBqpA3Lt1uMUK3UiN21mG yVr5ATHDyH0fi0Jj86M5+ixR7Xa3uOzrdH6om2+7QSTAd7Jme2yWB2Fi+HnBmaOARHEZcTZn /0EbssRWWOUz231mn3h5dCA4+1bM0t321Vsu/EhbfYwnvJULg67eo9vGhux0B74V5YhnSkwr nSjBBfi4T/dg0iSEFOu7mx5MksRJoXIkZsCNJjXcQYYEa7VmIs1Ov2s2ehc9lt666PtZSoHZ GNjR30WgZXH+uhhbvZX5pBPmmRrtCfO1xh8jfu1ZevQH8pqYHmxrUa4eCD9CPWz4YRWm7art mQ8j0MK4ACS0nv6STvg1ojPNgC/pnDSIgJxWYdrm2p4pOUUL46grtJ4LQ9SPVIyAkEWulfoL ZTJi5eQBAccb/bOCV+b7Pnd+MeGz84giSweffOyyf2NObBz2R/XL59idv3ZRiw9fPnt/ZOak /MZlFKcCMFr50t93Z/rxMx6Zg9YMlXay2Yl5AUW1LnwYKopUWDxTUaf3sYeKfOAw+Lgh4v9G w5mLTE/7Eg1Sf2B9ZhdErGbq6Riid5Nqr13Vbbjn5UwzOrMYHZpB1OrLfiGbUsiIqkvPrVpx bhcb2pljfzN7teN5Cbs/Q2GBC5Se9ctIiShLkGm51P6JiFi+2iMfOa/vqvWtood4VLURc5CK x0Wo8577Io6NeeMTHj/nvVfKjgF336GZ9t8JET69aLowHjwlx7rw0IXx4b0cwom3A4/urCfa wVq8gzVj6sDurBeySU6993TtP1IU68orAENT7yPq/GapdL7vSmWK72v0paXee6bsHymL9XwD 2+mif7jnm2cFlPw7aQQt6hh9adn3nin4R8piGTuw/Uy396zUeOmd2T/fe7dwKgwYrcGD4XrW qMix1l9mD0cFreqfq6fRu8rZmXO+nl5n9kM9do+987wPB+cGXFS9rr86xl7TWXkkv6MJ5seF DVC4KkIDJli9vfQd95WJhX/pB2uq68b0mHcDvuL33r+7h52utWmPZ3IRwFlworN3QSLcOGtm xoHz+bB0V81Hw9Eln0x7FDPqSCCw58LPoW5HfYIw1ANJ6p8L/T9sMcBimgFQ/S5uD4v8/Sx2 0pusXSrfrATaQ7nd7Cjsdp1Bt6UU7r3OO1dUASL0owrCNvP1iMkl38LBXHdI9xecME21Sn/P zdVGGnaAQu6H4ug/Fr89muPAs2jGLRbYnw5QuH3xzfn+4vgqGl1gOrwLE9PAo4Kndth90iS2 taehL2xG1+g1i9CMoPjcPB9wQpCUh1GNKEXEqJNDJKFCYHyBA1rJAIkQ4FOfHbvAQUmB6Ah6 0MGRl0LFRma8sQUOtNWaiTQ7/a6ZXeBQc7uqE7fr93QJXVoWGxXVFbrAgYVEeQrt92VwhfWF FdqyHmuFKUEYKEw7HNAzpXRpYWwYFlgPR4wmip+vQHREGJZphoI/ETODj8NAYdrpgJ4pd0sL Y5kwsH5e1bEw+3VPqysxr51xmKf5lovqptpEmIy3bsYACqB9XuxCexdDnEjgYC54dfPUXXR3 jU9OGvfFhAP3frnCbn/BaClvwNu60Uk7drokEJOUVO7ONtPURIjwyQnJ5+5IOZadoAtDT14O xU8w8OghBaLdWot2cGb4DuwhhVF/NKdJrIrR06UlaVkcT42j+V+Up2psJT5TpSWOtcoE4rAK 04pi9ExpSVoYRxyh9ba05FGjQbicmJjNyzVqGMpuPG1IAYiswrT6FQNTa5IWxtFIaD1xyCxW 5Trcivobv3Og1//8Z2EeCNTu0yHoNVbc0Yl8cbtp54ckdo/Fi995/vka6jot6eJbo0UFn+Z7 TbAoHdtC+3Zh92H70d0qkFD4sZzzBrnVXwNJeOsSqEMXMkAPXUAreeaCEOC9KVlK5sQFJcWy hulBn7fwUojjFnbE/VmJ9WkLoh1MxTtYK6YO/qwFdtSil5pPEs+1DXQNQVoWxxn9WHYDQhnY 55kzNVrKWGlMYAzQl3iUbWAqCNLCOMYIjJ8dZAMPcsEZY2rkkWuVogx9qumEIQX8AX2Jx9oG pqwgLYxjjMD4CxLGMCcMW9DPPq0t1PNLQXFDO9OSQVgbdv7NxzXZ2D3Cfr1hyTNRfeju9cyB 1qyh5xgzS3jSUAgnXHmfSLxhm8l4gxIxuU+6Cx1vkHKAOWwXOt6Y5BDxBoy7jxbmn4aCdjWR G4RM2Q69bSXZFrfAtuMKHMKYHjQbE1psB0INDDr0oOnaq4l9R8v1cZrilJ7SyUzj/weriSIV DQplbmRzdHJlYW0NCmVuZG9iag0KMjU2IDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIg MCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA3IDAgUi9GMiAxMCAwIFIvRjMgMTIgMCBSL0Y0 IDE0IDAgUj4+L0V4dEdTdGF0ZTw8L0dTNiA2IDAgUi9HUzkgOSAwIFI+Pi9Qcm9jU2V0Wy9Q REYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA1OTUuMzIg ODQyLjA0XSAvQ29udGVudHMgMjU3IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3Bh cmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgODY+Pg0KZW5kb2Jq DQoyNTcgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTU2Mz4+DQpzdHJl YW0NCnicvVpbb9NIFH6PlP8wEi82IpO52yMhpKYUFrRIu5uI1Qp4MK3brQRJSd2F/vs9Mx7b SewZ52LgIcRzzsx3bj7ns9Pp2bq4vc4uC/T8+fSsKLLLf/Mr9GG6WN19mi4e7/LpH9nN7TIr blfL6fzhc2GWfsuzq3z94gWavTxH38Yjgon5l6YJRQRJLTFnKBUME4HW+Xj091O0HI9mi/Fo +ooijRbX45HRJIgiRXECaonWWKVo8RV0Xs8VurmHY9GNvdLu6vV49CFC8Se0eDseXcBpf45H 6OLdOZp6nJitimL11e/Hq9WqONYPtuMHSxMsE0RTnArrhrXeGX2xmL/ZtvtENE4SrKgH7ZAQ HZRnniosNeQKwAWikmGaIkqM3Y3B++p1l0O9VWOpuuM44RFamM85ovFERiTWEber0lwye7kb 7BNMElLiRPhMmgwLlQagqHXyPYnTCBPjKmZxEkm7+jEy34n5zswHGdIsyRhO2S+JgGTSC4Xg juGwePkhIsnHeFBYDoFPfR7u3FAlGtMMJ7xC01irrlthD61ui+qN4UDItBWGoyE5YVh5773O IEhlMByUxMTEvR2EPbQ8aXEb9zTIdjqDl2AKNSSJKSUYMBKaJNX2vwYRTed32dK0w3fnb14i Mv09W96gKF9OXs/ipuftdVZpPS+DvTXdCNagmcAppCuLrpoJa3es04BTignzAIdCRwFC1LCJ aUf9saOe2O13mNcHyjjmqc+Hd5npc4+mD6JW8E5FFgIz5UNm5dSxs0Z1dNpTwZUwjevw1OkU S17Bcq5xqntTx3yp2+swrw8MWkkqfT68z9fxREX3MY9uV/FERMsyixMWXZukrszl2s41s3Ye i+ifGShfmKu/4MouPykzUOXCrn0237L7PKYsuqpX7XkOQ5df8u+oXlxBFi3aV2MLUKD/rAYy V8bG/NIIH2qjbovH2rZiDSfmubnG7UI4LYgC2h9jexbCt61yaOjeDK7sNnMYVFVCsIDOk7Dy w5hx/bRXmjiRY+tbQgosNPFurW4GK3b3wrYCBIkG9oMYolaKTQghoNu2weiuAUBCtU4O1ii9 L/NkJRtZ2vAxoOC88GtUVtQa1owdpZ0JxglWaqP5i8CdzMMDLHhU7/ziytCjsgR3R5fwja7j IKvJtQO5z9AqAZuGGwqX6JlZwbN6R1bL+K1pBX1j3xlypBluhBwSQ9erSsCmV4ViKHuGR/Cs 3tnRMv4njQ1f1z7Oek6EeTJvW99+TDoVKMHQQHpzfDoQcHWhO4CywYEETnkHkJ3kV3Cf3BYm 8QwSPzCy4Jh2ldzgsRQSq66k2dq93qrdL9lDVe750GakHObPr/AXHslZO6XN/JDPhkbU4FpX tQ7umlaYd8VQQaHaJGbQn5INGnoWU1r2rJKC/qha0gy++NnjceaZV0l6jxEQ4o0NLaIeUmhF AVLo2brxhESDpNC335FCKw6Rwmq/l/KVwa34mmgxPr/cWehVqEyoFSq+J3x0TxmvasIE+yCl 3tmrgnQvfFQv3aMKSw/bkx62dyRixfa2Efcgew7PFU9PsJIw2Quf1Uv2dm1/G7unxS+PhqUc wveOtUQxMOGQIJa9xcG53tITxDTM9sJn9bK9XdtfrcwwdGzO0xqPhYRYM92G3CWMA6NKhgXt TdIAOAJr7r+HnzByNThmYn+Oavnm5bzH4qTEct6fHkPgR6KjQryM92icpCNXNeGFj4bxqupd ltrgiWdLQxErOgFsw7HHYc3kSmLREfZnBswi2vvUy1KPhYU2yDuq6vvatNXbIjdv83qIs32J J4yOM3ZYE4WkuKNObAP5YbNyWZs2fyjfMSbuPePayJs3AllMSZnJq+7n0kEKznVbeEjVW6xw fmkDeWdtflaPrYdyUZU2ZUV+j4qVCW539YH4DIGDu8x3NnRlCAg47XDjcHLL4HDfK89SFqC3 vs0Vvy3lIYLrPcEx3FIeorj1CT6O62JsJRzoVtohp/53wn5xUsn8EfJjN/LOwzf4EA1GMIDQ KHRDlCF28kCIGwgb4p0YNjo0/P45pGLrc4dvaQ/fOuTvRgSiwqy3f1RViW5+VfD+2cj/rxYf ww0KZW5kc3RyZWFtDQplbmRvYmoNCjI2NSAwIG9iag0KPDwvVHlwZS9PYmpTdG0vTiA1MDAv Rmlyc3QgNDgzMy9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDYzMjE+Pg0Kc3RyZWFtDQp4 nK1dXY8lt3F9D5D/0EBebMDxNj+KRRqGAUeOkcQ2JEh6i/OwWl1Zk6xmN7uzsfTvcw5vzdze nSabvFcP0uXOdFWxilXFw9Pdd3wKy7r4lBbx+NDFrRGfeXGS8FkWv+bFq8MYl6lfgsN1GpaQ cJ3GJTpcp7LExOuohtfpIsqf5yV56NCypAy5vC4aBP/GZ8b1+Flx/IxLoY0ssO+hOCcMoMVn zMgFqMTlzuWAQVmcD1BeVgzwL1/c4kLEr4rHoECqhMVFgcIS4cgKiwWaRXgxNCfHi6E5JV4M herdElboUbgSVujJ8DOsMJERm7BCYalGMY0Cy4FhWhMvxk+dKxjAEcfIrDDjHa+Bdo84BfzD h4ABpxLgSo1iROyDgx5xigF+JcKLA4PNa7gCyoFjyBl7RmTlxQxawpxd9R/TYNgL1itUTzw0 ezqAGAb+wwX82FM7Yuwz/xF4MSQFHgSP/xifgFiHhEkFCtSw0HBe+RPoyVRIT0rCj7GWccX/ AkITaxCw2tFhHYLPS2T8QlAMGMO4LjFSYXQYIJAh+iWK8icB+UN3IhJKIREiNGfHa6C51AH0 FGqOeZFVqbAsUm3BE/Fci4BfMQHg0yI1vBIWEYojsvDP0UvkJkQDEl4yg4REkcz5IOWlcL1E l7RyUQQJvCpD4pfkGC0oTZ7RwHWJiR5gOAVGHk6mmGr8liSMFv6RUpWCwkTr8DYpfEJoURIM HbSnwuWGilToF3JIV8Qm4B+60h2YUSQiBrKo5zKh8pAR/FXGoHBl3KIRsQkoKhWsQ0C1aFq5 erhYuRasP2WKoiA1w8uAbNDCBEEhaWGyIbnzShOYbnZcfIQ4eyYJzGQWYkBZZfodUFY5IqLM 6Sye1nXJCAcTZMlK66ivrLAVMYNcXUasc3UZvmW6HFF6hS5HRLbQ5YhKKU5rfi3Fw68IXYU1 ETGVQi8jCq1E5hfqq4jjxRmDzIt1KUlqVqK1YJUjfl2UtqCi5JqnuCYjABHpXqCRmYu2s9IG ygkjLAkz1q1c+og0wggxiggY+hTVo6TcyoqPnr2LQYmwhi7qeF3tp4XXUVaQltHTBpIKIzY5 pn0MtIFlxIiyikDHQBuZEoFzQXgwoo1C1xFhR3ML/ceoSmAuzrFOoMk5zzmj6DDCckdUHTpp lWAr5TpH1B0E0LljpKwwTqg8jKoE5uIS5hEjbahj3VJW6WWkjVwlOJfM0AptFJRaRHE5v2I5 IirQ1U4ZhQ2bXYIZgxGXGTHkRB0bAft6lYi1w7M5sNfTB5YVRsi7iHhhNaoE5oJOyb2HNlBO GFGWHSQm2tAqwblkphD3N+wSqe5WGGVqhg30d0okjpD2UbmjOK6+ckvxWG+0JY4ogYpFIANb lXDnQS+PSllqiKhVh95CicgR/h2VNpKwp1FWmS+ZNrRKYC7IZ2jOtMFWFDNlC6IYuSeidCjh OYKvkbsishYz5baItKVm2EASUgJzidyXInfGyPKP3BojVz7WvTFSghsogg3N3B0RJnZYyibM LXJ/hNOUiBxBQ+RWCeNortwZoRRNlbsmujkliBq4HQi3S0GOYcQN2CHu3IWZYJTwHGlt4xjV trtSlnUs8BSjKpG4Z6P+oKru3uz3lE3s6o42lBL4DyOsPFuAk4y8hUmO4A33VielSmAuaYVN YZ1ji5WKVggHuIE4jqoE5oKuDc2s88StTFjniU1HWOcpVgnPEeIprPPEnYwt0NWWzw6MUZUg 5FBUnrDOEVzMlHWecuJ+RRuFEqxz7ADQzDrXFRUhrHMUHjSzztVViUjAAuvCOlfussI617rJ sc41VonMEepAWOfK/wvrXAVrK6xzFDIlPHEPVkBY56rIH2Gda4Yu5gdGjD3rXEvdSGEjr/BB WOd5RT4K6xyuwRrrHOmMWbHOc11p1nkmghDWeebmQrDjMrsHgQdwCXODdZ7ZfYR1jp2EmjNH yD9hnQOBQDPrPGdGjXWesa9gxLmwjwvrvLCPC+u8rFwZ1nlBzWOUOEJVcMUAICAnrPNCfCVa oZ4SJWAuhd1XWOeFOUpUixHmwbpGtjA7WeclEfuyzosyQqxztBdYY52XzHzWih25bsSx68oI ZcLIlZiEuGytNUOkvNaVRlw98DA0Ey2vRKhCxIsio2bgw5WbF3ENRoxQoSzXUQptsDsK6hwj RBZlgBFrGjCHI+Yu8TJKAZoL51JWgiDaKJgbygWgdkWeAQ9xxMwpBLqoYPwMNti0MYocwQda 9BWOE3pgVCqEwog9MlWQzDpIRMksUYyIoBMyMxHoMrWJtThCjCtWd4QNiSgaCwxrxMoIOTQT I3vC3URsDEegmZAahmGN6BhDIrWVI0IsrBj6uafmzBGinSCPzkS0hozidkSQR81SJTxhPGfl KUEkVU81OPbgOh5OPFea/RMjIsVAiYKa5O6JUeF1mBVODbgO3nscCXhd4ijzOsgCkvO6zBG9 5EkpEBKnyPMDcUWKlK2RRNX6IFWicIRcYQyxcRKQRsoq/Aci5ahKBB4+uFqRNojA0L444pxR tR44jBLKEeog8UwI4FThLEbIrIUdA6MqgblEIjICLYyQP2iCGBElJFStj1IlhCNkLHOQpx6C YcoSEaNZYqRVAnPBBgnNPFtiayN6pmxB7FKijVIlMBdsLNDMMye2hEBwXY9R0IyqxS5YJZQj VE5CdXup+FwpS3QHFM5RlXA8eTEneWYVZmbi2VNoiQcwj/ZACZ7QFHIp00ZmBWTKsmbq+RZl RYnCAxzyMbG6oQ4zZXUjMXkO5qnOVwke9HiuTqzuxNNLYnUnIu7Eqk2xSmAuiXsqeyBGzHFW d2KGJFZtSlWCp3QeLhKrGxOKPFBwxHM4qxZilOBcCgE/q1tXxElZ3QpMthCyY1QleHJHLvI0 wgMo6k9Z3cqzj7JqNVaJwBGPJpUr4E5AhOOVdc8dGqMqoWQGUHVaOQTFLJXVrUS5yqrVUiU4 l4IMUVZ3ZvfR88kXXms9+roqwZMsz2JcHYx48GF1Z6JcdhGMqkQhw4Cs1kotcAdX1nndZ5R1 Xk8syi6QGXdlnQPQYqas80yUq2cSokpwLgWVxzM5KhXzVdZ5IcpV1jn2GUqQgHA8xFXmANm2 EJn6QpTLLoxRlSA/wbOHss4LkZeyzgv3WWWdl1QlKn2BelHWeeHVyjovRLlcdwDaKsG5FKwU qwojngN54F2JclVITKxVQsl54BocF8kZIBLsaBjxnEgqYg1VgowCd2wVUiFEzDzPhZX4SFHn GPH0KZUNYSRTJT+wospDPQ7rkCBfsAIM4LpKlnC1eNZe4dzCEwXyCytKRBx4GMKIvAU2lYUr EXiIWKgJI+YGT+WO/IcmEiL1RFz5KZ496iHXEV/+9rcvvmCZLevy5YuvXnzx4uuf3p5efPXw 7sOrh399ffrhxZ/+c1n/a3nxxd8WMmFf/u53//gPIzLuChl/hUy4QibuyiBgHRm5QiZdIaNX yOQrZMoVMjxI7K/rgdz+wh4I7a/sgdA1S+v21/YgV7Er4teV8z1/BvuM9in2mexT7TPbZzl/ 5jq33RlkN5D5XmaE4jVCco1QukZIrxHK1wiVa4TcepWUu0rKXyV1VVa4q9LCXZUX7qrEcI3M KNmkvnr78v6Z4JPAiz/h6GtS9aLP/+U/vnzx+Tf/jTqsv3+umrTBqOqyM6E/393/z27ZrufG wbsoT4V/vVt+HQ0hb+ScDa/2GdoTOFC1n9G8fTM6bb+/Grm5GjqsOuxMqL0a2YJRmsGYcSsO d+81meHzvsDTQ3MCzg1PQPbjWlpxdWFYddqZUDOuLppb8rO4pcNxdd4MB/tMV2f5VRuLv2pn CVftLOGqnSVctbOEq3aWcNXOEho7ywEkywbFskGwbBAsGwTLBsGyQbBsEKys9mmQrpieYpCu mL5i+orpK6avPPYQy/lzv3jM73pb+vxp1zlrxN4asbfrvKWut9T1sZ26Qye2plCr4FyIVnHh sq8E6x4Nsd+/evjw8vXXpx8ffvGH03d396dvl7v75eH70/L23en96f5h+fbNqw8/cICf/3LZ Jq7Zu8LUZ69ffnh/er+kX3tT6W9V+c+mKNyqKP1alpf332Ju7ml28Valj5GTWxVhUd6eXj3c /d/p9U+mM/1ck9OWotzLVj5UURM+WCEEK4RghRCssIIVVtj09E9tXZKcM/vmzY/7LbCMaBgo kwv042MWY9H6/fL29O4csbg2IjaszLI2tipqWNHbd2++u3t9Wt5/+Ob96WF5850tamwV1rDm v3z1xaOuVm0N6/r69MPb1y8fTo8KW3U1rPDL0/9+uHt3Yn96/6vl5d9e3t2/f1j+/v3dq+8f bbRKbtjGy0dNrUIb1vTZm/vv3rz74eX9q6cItGpuPB3vX77+6f3d++Wvv/j20sDPDbb2sPDX Xy749bdv7k9mM99q83HypaWo3zCiNYxoDSNaw4jWMKI1jGgNIxrYjrYTR9uJ41Ab6DWS8DM1 Etnst9IV20Txj+coSqv2hxXd/e3Du7rWv1m+xsb97oQSu3tz//77u7fLN6eHv59O9wur+Kn6 tlVT97ovrHtsf2Gza/WP4dlZskirecgBmLSkEEsKkVsXXfyIhh4vPolsr4Vzslp65c3hLXWP XZu425qeo58f+8xZ5xXqbKfK+VZFxC933929Wt6fXhPJvLn/laVILrfqvqv9FS3wm5+W39/f n35c/nBWXdZbVdsci2sp6rLUIVmPS5bOydI5WY9LW1D0ie6xtD57cqSheVg/n7w/OTtol0Xb bux//mr5J7dgg7s/r+nHJwXTfoXi5ePzwTNFqXTDbjx/0C1d94mOsfDqOqLhOLwxbqLQpaY+ Da9/Ft5HbPM8vKOKP4E2zxXFfnhtZz7fHrkpvPIzhffCNYU8mmR/PO+gn/36Y4D0LBrDCt3H AOl6Rb9Zvnr7+u4Bh/E3P/60vHz36vu7B2QAZmu76nqrheVjFPI8A/oFlq3AjL3hY9nnz3hr RuTbCs4/YjMnm6h0mfl2Rjzd9vCfgJdhhcYkPN0JuVrRb2zBXL5V018+vH64e8szo2kst2qs qXpW5teblTVS/un2xdWaH6foW4q0n/JGABrxGIx4DEY8BiMegxGPoWxbm78GsZ49O9JwXAo+ X5zs36R6trVbyFopMqztcT9vpUfpx97ugvFtixtjWn6mmG7287h2b8c8288/2cQ/mcS4tk83 8WeK+s/TGPEd11vzNH50T/KGmEraTH4qT4PtZo02O67tcVtsdNm4dvM0rpan7tY8tRkfafg3 17mRED4+eUYXD1YiPN0b3xFq3TT0txoLG6HH1P/688/+fTcs5zuT9X2n8+cGgT6bwtH9+Kcp xB2hlr9yq7E05a8llN11it61/fVHlfY0Bd0RavmbbzVWZvy1u2jRW3Py0vE3DefzuiPVcvjp abnrzfkpl9VczfZZ2i6Ho8dbLnMIO1JNl+PN5mTGZbtlFO2WUQyh4/J410o7Uk2X9WZzecpl a1zBGlfoNK4w3Es2DzFdpJqdurEvjJvzbspl613G+8fY6V1xuJ14vyPVdDncbC7OuGy3MqLd yoix077icD/xsiPVdDndbE6nXLb2ZXdnYuy0LxnuJ5sjy0Wq6XK51dyG/BxwWax9ibUv6bQv GcdBbkeq+ahWA3ZNmJvCXWLtS6x9Sad9yXA/CXFHqulyA3lNmJuCXmLtK1n7Sp32dXjIucxB d6SaLjfA14S5KfRldymi3aWIqdO+0nA/ieuOVMvl2EBfE+am0Fey9pWsfaVO++rfvfhoDmFH qulyA31NmJtCX3ZzJNpLEFE77UuH+0lMO1JNlxvoa8LcFPqy9zqi3biI2mlfOn5sLDtSzXNj A32Nm5Mp9GWvqsRs7St32lce7ifid6SaLjfQ14S5KfRlNyGiPUoac6d95eF+IrIj1XS5gb4m zE2hL3s6NtrTsTF32lcZ7ieSd6SaLjfQ17i5NIW+jHePxrvH0mlfZbifJLcj1XI5NdDXhLkp 9GXPMEd7hjmWTvs6fAvlMoe4I9V0uYG+JsxNoS9j/PmdLOfPdvuSdbifJN2Rarq8j75mzM2g LznT6PXrZc6f7fYl63A/0XVHquWy7qOvGXMz6EvsPRqxF3pkbbcvccP9RMOOVNPlffQ1Y24G fYm9XyD2you4dvuScRJd045U0+V99DVjbgZ9iZH2YqS9dEh7GefRtexINVnsffQ1YS7PoC8x 3l6Mt5cOby/jVHr2O1JNl/fR14y5GfQlRt2LUffSoe5lnEvPsiPVdHkffc2Ym0FfYtS9GHUv Hepexrn0nHekmi7vo68Jc2UGfYlR92LUvXSoexnn0ovbkWq5XPbR14y5GfQlRt2LUffSoe5l nEsvcUeq6fI++poxN4O+xKh7MepeOtS9jHPpRXekmi430NeEuSn0ZdS9GHUvHepexrl0t647 Ys2bUmsDf80YnAJgxt6LsffSYe9lnE53a9gRa3vdgGAzBqcwmBH4YgS+dAh8GWfU3Zp2xNpe N1DYjMEpGGYcvhiHLx0OX8ZJdbeWHbH2zfUGEJsw6KaQmNH4YjS+dGh8GefV3eYevxzy+M41 sNiMwSkwZky+GJMvHSZfxql1t7nNL4dUvnMNODZjcAqPGZkvRuZLh8yXcXbdbe70yyGb71wD kU0Y9FOQzPh8MT5fOny+jBPsbnOzXw4JfecboGzG4BQqM0pfjNKXDqUv4xy729zvl0NO3/kG LpsxOAXMjNUXY/Wlw+rLOM3uNrf85ZDWd74BzWYMTmEzI/bFiH3pEPsyzrS7zV1/OWT2XWhg sxmDU9jMuH0xbl863L6Mk+1uc+NfDsl9FxrYbMbgFDYzel+M3pcOvS/jfLvb3PuXQ37fhQY2 mzE4hc2M4Rdj+KXD8Ms45e42t//lkOJ3sYHNJgzGKWxmJD+/kPn82e5maZx1d5snANIhy+/i PjabMjiDzZLx/Ml4/tTh+dM48e42DwGkQ6LfxX1sNmVwBpslo/qTUf2pQ/Wnce7dbZ4DSIdc v4v72GzGoMxgs2RsfzK2P3XY/jTxfP7mUYB0SPc72cdmUwZnsFkywj8Z4Z86hH8aZ+Dd5mmA dMj4O9nHZlMGZ7BZMs4/GeefOpx/OiTh4+NLMeuOUNPns7EYrzU2g0+SEf7J22r7zbvsz6Zw 9E2AT1MIO0LNx4huNTaDTJKx/MnbOoe17W84+pa8pymkHaHmjbtbjc1gkmQUf7IvdEohdvyV 0SmUHaE2R3artSmuKBnDn4LtVSF3PO5+a85Hc/A7Um3oebO5KTBiDH+yL+VJ0bddjkdfO3mZ g+xINV1ON5ubQiLG8Cf7nqEUO30rDreSDUl0kWq6XG41N0URJaP3U7TWJZ3WJcPdZMMQXaSa D+n7m81NYRDj9pN9kVCSTveS4X6yoYcuUk2X5WZzUwDEiP0k1r6k075kuJ9suKGLVNPlfLO5 GWYoGaufkrWv1GlfabifbIihi1T7W3NvNjcFu4zST/YVQil12lcah11hR6rpcgN4TZibQl7G 56dk7Us77UuH+8mGErpINV1uYK8Jc1Pgy8j8ZH+hIGmnffW/9uejOZQdqSa6bqCvcXNTbFAy Jj/ZH11I2mlfOtxPtmSQHrWv2EBfE+am0JfR+Mm+TiflTvvKw/1kywTlo/YVG+hrwtwU+jIO P9n3PKfcaV95uJ9saaB8eGxsoK9xc3MkkBH4yb5BJpVO+yrD/WTLAZWj9iUN9DVhbgp9GXuf 7EtxUum0rzLcT7YEUDlqX9JAXxPmptCXUffJvmA8lU77KsP9ZPM6yEWq6XIDfU2Ym0Ff/FNr dFXtr2Po2m5f2v9am48YkXVHqvmQ/j76mjE3g77USHu1r4vXtd2+9PDPX1zmEHakmi7vo68Z czPoS42xV/tyG3Xt9qWHfx3iMoe0I9V0eR99zZibQV9qdL3a36NQ125f6ob7yeZ1kItUk+vb R18T5nQGfalx9Wp/90Bdu32pG+4nm9dBLlJNl/fR14y5GfSlRtSr/SkH9Z325Yf7yeZ1kItU 0+V99DVjbgZ9qT2cr8bZa4ez13EaffM6iB6S9rqPvibM5Rn0pUbbq9H22qHtdYJJdztSzYf0 99HXjLkZ9KXG3Ksx99ph7nWcS9+8DqKH1H3eR18z5mbQlxp1r0bda4e613EuffM6iB5S93kf fc2Ym0JfRt2rUffaoe51nEvfvA6ih9R9aaCvCXNT6MuoezXqXjvUvY5z6ZvXQfSQui8N9DVh bgp9GXWvRt1rh7rXcS598zqIHlL3pYG+JsxNoS+j7tWoe+1Q9zrOpW9eB9FD6t6tDfg1bs+t U/jLyHs18l475L2Os+nb10H0kL13awOBzRicgmDG36vx99rh73WcUN++DqKHBL5bGyBsxuAU CjMKX43C1w6Fr+Oc+vZ1ED3k8N3awGETBt0UEDMWX43F1w6Lr+O0+vZ1ED2k8Z17BsX+HzO1 81ENCmVuZHN0cmVhbQ0KZW5kb2JqDQo3NzUgMCBvYmoNCjw8L1R5cGUvT2JqU3RtL04gNTAw L0ZpcnN0IDUxMTEvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA1Nzc5Pj4NCnN0cmVhbQ0K eJylXcuuLLttnQfIP/QfnNKLEgHDQBwESGID98LXsyCDPIwgL8cInIH/PmuxWN1995GqSurJ ae5qUSRFcpFSVdepNT+2R63hUQo+6iOkhM/2CK3hUx8xCz7lkbbwqC08Eq7VFh85ZXymR9aI z+1RcsVneUjEPE0egmu14VrCPA1jFfM2fTSIqro9NGJeDQ/ld5AVtqQ2KIQALs0gKqbW8ggx YS7ICRECqlJJwWwKrhwwvSqIyvnkEUoKjwZlg2yQtoFLJIPAzDVGEBsIGNo2zNxgddvApWED gZlVGoj8iFtMILAAAZM1fB1DERDhEWPghA2EQERIj5hgfcPVmCGwhcJlw4QhPmLBXw0mxQLj GtSNkiEiYOa6cUIBIRARMXPDIjRoGRsWoEGDqAUTxg3rD+0aFjdtWISG1UshQ0SsILASLeZH igUioj5S4iJg1VKCKxr+SDlzwgYCq9Xg5FS4CPAi1hIiEmYW+KXhj1QzRCTMTBUaPJgaQoLK JU2cENIVzms5PPLGRciIiAAVWkZIBMRHg3I5Yo6GuXLiIiCScqoQgcXKGbo06JQzgqhlfeTC RSjgEixJK5hZKidsj1xhU4NtmS5qBVxNIALOQ/hhQqxR1goRpT7KxkUo7VECXNSKghBOKI8C zz0axJTIRcAUJWGyhmAq0B4E41ggQgrygYuAP0rh8iIsitjg/CiVasCSwohnRBcuUkO8FnMc VqQoQwIGyBY5BpmxcQ0RphKw6q0mEI1jGpJGOEYfkhAgDakjiebAQ5JpOxZUCoViscQWCmkj YoMDCEhuTLqK9WuYVBjCDWklzQZDutIFcLAo4xDOqxs1ZPoGG4z0C1g2GlAjvYzUw8JjQqRV tQhnDmemA1akZujbsI61IJoUaVWLDUb2ChyryITKjNONiAK7dTPI4GBiCdTUzZK2gGBCIieU PttsMNMGIaxM44jLOTC4ORjJqIn/wGeIR8hC6mlGkilCBwvPr/AHV4xmaxFeaQ8VToh5kOX4 h/IqTGYMKTNbIwGJE1JvmwMJoFr5FRBp2yK/K6RqMwwDOiB1FGkICmuokVgWkQYKx4HCeiik At8Q0lAbVIZtijwDhfDUxJkLTUicryDUNHE+sXGUJjaOMzMVFGsIiiYkymC0a6YMW5FMGYrI VWRlgAqQmwmsG2JKEdWA2EgOJdX4LWYGyuIadASlpDAfTOPqkTfbOnI+ZCMozlISKSJ1oeVI vhAkkxKi90ZfGIX800IZzCctlGtrLpShlf6AXEAuxglxfmv8FnIjc4W2gGp0IOaLrEmKHGNh INVI0WuVs2T6CCEACmnD2UMsmRRnlo0zZ1IMikoKEcxAYH1hxLAKRuaNsg5GC65Kabam0Axh uUcMKWoPOSEFag+fgMJo1rWQIlcI2QcK/yK0WF8Tv7VKi1RTrBxshAcIqFjwjZHH+QrHKaWx cjBrUfaE0qBVqgxOVsnEyqgsk4kIq6yBiemoVijpH7UCuW2MH5Y/QDZDhEUyw58W1yS5zBuS NOQYGU0sjDlWG4CvgOLGVkiKJQErcLa4ZH3NbAZAUlqhB7ZAaRIZruQFtlrGUFq1pKD0bGV/ C5RGuAdJaUQtkJS2BzcSOBSkm+UcSbGxkIbk4bxUukRayJgHydjckMqIVDOeipTECGMiB4C+ sbFryKYvk7cUS3Bmbyn7WKgD0OXqUOnCOhkI66GwUuIqpTUzk6lZCNxMeJB7njOxi4XsxmwX E78xydGl2Fj2KaHYWOggcYcMJclI2pjUkmypmcuSbM0yJ8s2lrmOzqIYqoAsxcZu7H9szbhE ImoARBG76kxzsaZoY+5LM+QhNEgzb1InUXM3SgCy2kKDmFA3dmAbkx2Vg/NSZI2bzasks81A tsi43JjwNdk6EEFqtjVjNKJycQbmfC3mN4qsYn5j1qOoGBJmkgzojeGKwkIRdFNtBscMispS A7ijNIOljaOaxSATFqTFGfECrZ2haSZp4Un14Ewbyx4xMaA3urSx7wTJAew8A3EKJG3ZrGku jPiNyABQtrGYEQ2GjaUO1UKOLkWQ2FgOaBZyBIXWLOSadeC6oztIg9mNWKEWTBsnR2k0qN/Y v9qi0mOoXRRMbEBZomCCg7IFA0m2ZILpEM3ZxgaS5k1GI5aMIijdKmZgC8zOuFg5Acm6Hmzh gJuEcwaQsgMObCZAmrs5o+41BUGBzIw2tpJsVpHQBSOZWRrYYSPxTUSz9puC2W4j6WyskLQy wr4aacDawqYb4WpjOaDs9Y0iChc8sBlHWFWrdSBrsLGJpNhY6tCsQLIF39jBsBqC3AtepAjD 6cDWfM861BSQFASSmwPuVgJrQMRXFAEsQfXiarCNiYRxkoEkVwf1BGS21Umct0Sbt5KsNhY6 IJEpAqgRkWU2liJ21RNFcHcAkpO1fSxnYCcQuEMAaX4DGgHViQdAeu5hGL8AcpKmeuaASKwj moJiqgHTQSaCLHCapNpY6BtztrHcBxlkAqdJmuqFIrixYJdA0nQoFFGTDaAIdoUgKaKZuwtF qLm7UMTeU8DniAbCKeCSJLMDwAgyWIsj3IIFEwwsQdElCgMNQbJDwAxK0toNLBy2axZygBWQ DH6Wvoi9AMcKpclmV8km1utUCq5EAriBJJGAC4e2yYKgUgfuBUBSsLWJjGeQphlsxfbQNAOW gGzGBmmZHgnBdtuByQp8erCPIRuwBN2kLQniGaQtCbIH62/x0LjtzBYPjRvPYs5qlFaqsVGa mGMbpQnhCeABstqiKkXUtrdlIPdkUIrYk0EpYs9jqIfw3oxNSO7dHPe3TKrAvShIMTYYZHuu wKIMku5GkoPkBpUNH8lmVyGt5GxXM0m1q5RWil2lNNnsKqXJ3jJSmmFqJJaUai0gsaRYOYgE kMJNEshom3C7SmnWcHEvj6Yw21VIE8O6SAARxiv7TpCcEqSStO6ROW+7tUADQVqfSXzAjo0N JAEE9ThYvwqycKkjUUPYLYOEQSLZ2ChN1CajNDakICmN5wx2AALSGmICiNhuhM0lSGtNCRXV eotIqKhWKiJzvjKF2R+TVLsKadV6I7b8yMfNrvJAIpltRI2aGUaRUIGdnl2FtFqiXaW00uwq pUmyq5QmalcprWa7SmncjrIfJ1nsKqWxszawBGntPFGjWW8Umf7NKi0PNWILZhuhojF0QUJa i+Y3YklL5jcCSEvFrkIEqvRmTT/JveunCEuRSABpliKRSNAsRbjBBGkxSSRouxXEh7b7gkjQ LNF5/BOb7e5itUMbltdIfFDrm9g7Y//AyhuJDxpsJQlXSjdw6wEyZRsAHdDo2mSVpEUf8UGt q4jEB2yt9n0KSCHwR+IDNiZlPx3DdtPUIShotYVi+muziCIoKPe/v/jFtx/t1G97/PbbT99+ +uM//eHb7/78x99/++lP//t///Knv/mv3//3tx//7ZGzDfg1y8cvf/mXf2Fs3IfvbL/74a// 7ju2X/8Dt/0cgc/knzbPPz5ecz5nYwm4rUTusP3m3//wnz0lsOqfC5Qpq6tb2/xTx1bDgbeV qB22sdXtc4E6Y3ULu7XNfd7SidX5thJx67ANrY7hc4Fxyuri1op/1hOr230lUodtbHX+XGCZ slp3a3XzzzC2WuN9JaTDNra6fi6wzVitjmKa/bOcWH0fXKJ22IZWp+1jgSlMWe1opo5mOkYz Hh/cViJ22MZWp88F5gmreeOI1vK+0f45RjP2NLeVKB22sdXyucA6ZXVxa8U/x2jGHui2Eq3D NrZaPxaYtymrdzTjvb39c4xmvJN3W4nQYRtanePnAmd6s7aPsLuV++cYzXhv8rYSucM2trrf m00JnOnNuEXfrW3+eYJm8T645NphG1vd782mBM70ZrylbNZGR7N4gmbxPriUrcM2tLr0e7Mp gTO9Gc9Sd2sdzeIJmsX74FJSh21sdb83mxI405vxtr9ZmxzN0gmapfvgUqTDNra635tNCZzp zXg3ebfW0SydoFm6Dy5FO2xDq6Xfm80IlJnejPdodmsdzdIJmuX74CKxwza2etCbzQic6s2y o1l2NMsnaJbvg4uUDtvY6kFvNiNwqjfLjmbZ0SyfoFm+Dy7SOmxjqwe92YTAOtWbZUez4mhW TtCs3AeXGjpsQ6vroDebETjVmxVHs+JoVk7QrNwHl5o7bGOrB73ZjMCp3qw4mhVHs3KCZnIf XGrtsI2tHvRmMwKnejNxNBNHMzlBM7kEl+ZKbB2moc0urK0Km+rKxHFM3NvS3uz9qoLeVSF1 mEb25k+FTfVj1ZGrup/3M/G+CjXdVUE6TCN766fCpjqx6phV3c/7MftAhXpXBe0wDeN5+1Ra mOrC/Jy/Va9V+xF7X4d2eavlqUPscI0PTT4WN9WC+SF/a16oWj4xudzWoXS4xr3Ix+Km+i8/ 4W/Ncaud4Fa7DSWhdbiGJuun4uJU8+XH+00duvQEuvQ2msTQ4RqZHOPH4qY6Lz/bb+ropSfo pbfxJOYO19Dk8rG4qbbLD/bbfrBvT3CPTNbtNp7E2uEamtw+FjfTc6mf6ut+qm8PpI9Nvo0n aetwjUxO/a5rRtxM26V+pK/7kb49Xz8y+Xq21C83UeKLsdt5+WFz9uPX7AeS2Y/osh9aZT/G yX6wkX2rn33zm307mH2DlH3LkL2JzuLjvPnK3pRkL9XZ61d2UM+OdNnTP3tOFA+U4qtX/BZB cTuK21HcjuJ2FLejuB3F7ShuR3E7ittR3I7idhS3o7gdxe0obkdxO4rbUdyO4nYUt6O4HeJ2 iNshboe4HeJ2iNsh+1Epf4bin8U/d4yQ/cgFnz6u+Lji44qPEx/nzb54EyzeHIq3TOJ9hHhx Fa844jAsjk3VE7Z6FNfgDx0Evw0ffFz0cW5HdTuq21Hdjup2VLejuh3V7ahuR3U7qhyPdvi4 etz29xvhzW8Nt+NmqT8MoccNNa+om5eZ7bgN4f1UOI6qfVz0cfE44PNx6TgE8nHZx+Vj6+zj io8THyc+TrxV9QdzvDU++sWjiTo6i6PcHjXoAOYDrey3OU802de4Awp/G3qY4M36ngkdrh9P tqxfmDRcdQU7w9uW1cb88Ku//+23H/75Px57GnZnvoLl58ypo86oCKj7W8PbYd66Ufnu8qnn vZtlv4kayb+YqqwwyQpTvWDqh1dbEaVLMbkWyXx+cIkxLXHlJa4lL4clN4crP/e5rvzcj47Q 97Sm+0Cy9ZGkjJAk3UaSt43SS6EhlHhJ0HQCJRNmxdu54j2OG2Y/T1zEkngV0n0nxqWYjksx HZdi+kAGWalxP2fS102aX/3Pv/65q+OA8Xni398h5Lca/pW3bFdC05rQ9/s53wmNV0LzotB0 IjRfCS2LQsuJULkSKotC61DoK/p+8+2v+GNp+6sbGHtT6UFw+OVYqkP7lRCvK0xthUmXMnAt b/uJe8U1yFq5DI0wSL3XfZ9+bMg4NlQuQSYMcu9S6gnK1EuUCYPku5JaT2CmXsJMGGTfpdQx znzJvv2mWH/BvK6LZ6EfBej7faTJULtKu9ON2r4Vnixic0xxhSmtMOUVprLCJCtMdYWpXTD1 vatXXPEMISeDoh8Vevl7hZ3h/ebYz7tueXbdX6fWq9v3r6lTR6Fh1+0HVfp+a+QDs+7v4P1k xg2z10KMFLi5uZvkWgrocBXR/TDzKNtRfBJ65pjiClNaYcpdJnuBxnm0+K/1Xo8h/DwH/LZ+ d+qrredzaukpNL7f7sfK9nqQZxR+YFm97ePNT1IP4/aXkYx0uIecc0y6FJtrEc2zogd/XT0K nsuzwucSh0H05GH0XB6BvuaWnkrj8AlH+ISz8JmwbSJ+whE/4YifsBw/YSmAwlIExaUIimug uISKsQ+L9sKcm4583jf/EqRlGKTx6ib5a+7SU2kcpH4Lxl4INA7SCdvkfpDGI0H8fpa9f2gx SI+fTX6nerp6mvWleuu7RYZuSVfPEr7m1p5KY7ekI22TnLjlvm1vN/Ev3eI/OjjM29/ktOiW tJSZqZ+Z9r6nuwanvjPr0Jn5/mLmnkpjZ+ZjQXM+ceaEbeW+M/1XBYd5++uzVp0pI9Vvw9Pz h5tf3NLGbrl6Cuw1d+upNHaLH/zZm8FO3HLfNp1wywG7/ksAexHZoluOkqlfNC+XoK1HZ9F1 ij9l2Z36clGOqWNPoROfHOvy/pT8B5al+y4pRzUqRzWSbajDzV3QV8XlEmMOxft97P5gTH/q y1p0TC09hcYukaMUiZy45L5lE12sHMApRyV6P92dc0kbKX6JL4fi2ndJGrrk8gU0rwTcehqN fVIPMH8/i/3AtLcnwy+dUg/YrEdpeX//zZxTjtsD3y/d1a9xXqr3C33LY7dcHVy95s49lU7c coB5GyPHlG0Thb4eqFUPCG1h2S0yUL1dblafqvcLfStdt3wZJEPfXT4G/1Kg9fQe+64d8N+O hXx/FP6TlZhoC9qBc+0A3Taug3e30l9V19uwFAeNQR365/IB9tfcsafS2D96LM37+2k+sW2i NdADbvUoSDquhVduGfUGehuW4qA5aF23fBmkI9/xJad3FZCe3uOXdvlzlfZ2VSfO6tbESkw0 E/6w7WHn/irXVScOuomw3cb22G8n/I5Od+7by/K2239T6cQ/x9KEk7o1YVu6304Ef+b5MG9/ Ke6iW9KgnQjXh6xP1fvthA73QuH6APk5d+6pNHbLcYAcwrjrnbLtfjsRjgPkcBwghzAuh3fP Db6qfvlmmJfq/XZCh/uhEG9vSN7PDcL1a26CP4Vvb04eu2XCtvsNQogHksYDSeO4HF5tUgcN Qrg+bT5Uz/0GQYd7ohBv70ly7Kk0dks6YD2N8WPKtvsNQjhO0d28/ZXXq27pNwhXXGVg8OWD uS+Dpe/M4U4qpPuLWXsqnTjzWND3d798Ylu778x0wG46SlNePwjSgerXp83Pk6D+o9ja30n9 uL/U/O7coafS2C35KAb55CxoxrZ43y3HKbqbt7+xfdEtJa1wOV7qyvPOX5jsBfDni+Svvhz9 qEef3f73U1/5/zl16il08srhw/3vz8Z+YNnt54LsNfsu+vD++0PAcy4pI8WvatNT8QFS6tAl crUvfU5dewqNXSJHH/D+gpUPLJvASTkKrhxNieRVl+gF0+B3LlcZOXi8r5+TN88qJ7nSElde 4uoH9s3DvkmuusTVlriuouP0/GuSayk24lJsxKXYiEuxEZdiIy7FRlyKjbgUG3EpNtJSbKSl 2HBRYRv9gPisbZjkiktcaYkrL3GVJS5Z4qpLXG2JS9e8vBgca9ER1sIjrMVHWAuQsBYhYS1E wlqMhLUgCWtREteiJC5iyFqUxLUoiWtREtei5LmQo33foGG8YjsH47nD0jUV85KwssQlS1x1 iastcekSV7gMjws0Xnr2YZbtMkAGaPzg/9O05rqw5ruw5ryw5r245r24mNxr3otr3otr6R3X 8juuRUlci5K4FiVxLUrSWpSktShJizVgLUrSWpSktShJa1GS1qIkXUZJ/4goXYbJoJ6uxUle i5O8FieHjmHlF4Rjrv6KxCVhaYkr97nsvy/c2a7eY9Fhfd5w7/6s3f6XxO04veyw1yvJsi65 nUrWK8l1WXLdziQ/H2AdSm7rkuOp5HQlWdcl57HkV1zyBQYh+lPVfa/53RAPjaenngv3tGMt TRez+zK9z7vRSba1/A6DBL97NjDJNszMdvlanDDMrRYv4qyVswhv129AGSbXtejaFf3/MDvI 8Q0KZW5kc3RyZWFtDQplbmRvYmoNCjk0NyAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJp bmcvRGlzYz4+DQplbmRvYmoNCjk2NSAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcv RGVjaW1hbD4+DQplbmRvYmoNCjEyNjQgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5n L0Rpc2M+Pg0KZW5kb2JqDQoxMjgzIDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9E ZWNpbWFsPj4NCmVuZG9iag0KMTI5MCAwIG9iag0KPDwvVHlwZS9PYmpTdG0vTiA1MDAvRmly c3QgNTMxOC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDU5MTI+Pg0Kc3RyZWFtDQp4nKVd XY8dyW19D5D/0I/2k+qTrAIMAxs4wQZOgIVXb3EextrxQoBWUrQjwPvvw8O+1bp3ZorsW34Z 073NYhV5eMiq7tuKqfUtbDG1thH+tyf5kyHELTYILW2pEK7kLZcKoWwl6M11K1Wv8FajXmlb Jb3SN4p9i1luJM4Q4sapQUgby6Ai5K1lglC31gME2nrRK7zFEPQmUQlV9WS4GItIMBVZFeT/ pgSNKPPNGfdFqHWYjPKnFIYk91UdL8rsatVrcjPpzZgoEa4lGZQTriUZj1mvJXhCr8l4rcFG kvF6wVxS3VKAN7JMI4WKuSTeUtSRZcEpks5KrqWkGn1Luel0o7g2V0hwctdreUtV55zLlihg HXJLogpvirsSR9WQ8Zgvi5YgqYaM3BC0XMIm8YJGERu9Q6OkTTwNjSKRjHBxliXkSKpRN1mz 2ggisWqQRFxnLxPKVf1Smkjqlyr3UcZ4MmimptfEBheMV8UGd4xXxUYDTLL8yV0DJW7KXT0u oSghqUYTiVWjbyWqXwSTJapfKG4lqV8obSWrX2TiJatfSCBZ1C9FdIv6RXBYiOBxok0uYR2y mMIKR4FP2b0mN5fdaywj716TW8ruNS5b3b0mLqm715hEUq9R3+ruNXFJhdtFkhzIHXZlMbUU /NcWtlp1zoL8uuNPTFaKek1sEOl9YoMT7DaxwYoScWxtWTWiSIpsTdeA+yRvKKgPxE0U1QeS xBTVB3IzJV2lTIiSrlKWRVlX2UkkXaWwABVdpaQyyRQgiQ3S3EIyE+ZS9mwmSGKNu14Ta63o NbHRg14TGx0xL5LSHJC6EluR4LUiEGBJYEhBJIauOIITZlUkcRhEEhFQRuBFKhsXJGcRNS5N R5GRq4BaRm4bE7xRJMjMIIUiYGUGbxTJZHGkSjJK03UI4LgXlWhrYdcQFgqkUttahNeK/BFV nWnfWqqYgeRvA8xikVxtRXUlf8UFKskoVXUlf1tVXcmoRqorrmuMnCkS0MYNK5cltKZzkT+t dWgIkFon1ehb1/wo4uIeGOuQXO2CdEhNpF2Dt54q7hNDXZIa10QXoJZrSYgVGYUgd2WaIrkv IcIoEqhORSW5xmCzIkN11miJE3sDDorAtrem48lcOopBQbIL/2FaYF8Jtf53cU+ICgCsIiRQ dkEoQyK9KncFpdsCIyErCODBAGeKWCGq+8AToaqHSKtB1xFgYvcqSkHYww7Uhz3uWHhooOGC jA+NYIJhooPdCzgudPwtsC5TQ1DBbXKzDta04qgJLT5quKH67FAAlrR8iZggKliBTgWqiAWi hkBSW7JTkYGwx6qORDURKsHMGkywjoBiGBtyWUMVGxZb4NnYFQsgAYk7BgPTpKCYwvRSaKqG ih01nwAP4ShVayiXRdU6Cj1KYtVaDvoVUYZJyEURMZg6vGqVraldamiqmFRFUicivRfjat2s 8HdizKGC6VMDrirqb+ogzxq1u0AsatRSD69X5a0Ab1Ql6ggyqlHrL7BTk5ZYBLLuVQoo2UuS UlhNWtmA56plVpXrXlkQ3qpURnBJVYYleENXldXrGhvhZ1jLQUkW1pIyJWBeFZghYDD1d9BV aCJGXUVWXmoqklIKJql5p21JzZongFzNmrX4b1URpsGpGrGqsVBqIyxrYF9FBaY6FXMSNKqo AEKiVM3KnlRsGmgsCDGXkELUP1FjXNT16lSdacKsq7o+dRWLzh+3VVWIKpIODo2q7VRREZNW Gtb6JhWt6gX5o41f1WFYY4z0r00Nqeu1K6hI/9qRoRWwkuZHRYLYdciKlm0fHd1b0mBh2VLb 1JD8oazBQspQQc3VckZFgwV+IIVChR2qGix4QFoFFWGNNVgIEzGrCGtNg4Wko6aQg0kpc1gQ +IFD1BQhiBospD/vOQQssUJMawJXDQuYgHfDmAjvhuEi1uZOM42b+gEKrOW/4g93DQNIoQXt ajGnphWighRaBMQqHCeghjWEVIoYrCH9m7a2Fbhr2pASsruhMIgINWUJQmyaRpqQio2iimiG iUcTLWVNRZhooBFCbFpDsHQn0HrUOOHerp4DtHsoKqKfjggWIWO7dlfafHRt7wkZ2xPcRRim awHWifSyixhBM5+Qil29TEhIKW0YDMkrtU1FqLHiCp7dqxsh56W8dQWTiF2xgl5e+gPFoDTa IYL2KKDXT7uIDUBCpAmdeECvHGEyBUUfFYygFVEwiC2Cbjdk0iI2RSbUCDlEkhFJKhn8K2kq oiJeAiK0jknhLjG7j4B7e1cUizWpi6zYxt5DXS0RE1FdLXmchM1VxJZE+2fp7iDqzCQLkzY5 yAOIOjPCuHWfWcdOZp8Z66ZGTciCBMBp3z8loAs5g3G10SLGDR1AJMZ0eldR5iBLDppfIkZg hWSmIiJRpLPU3ZKKMoeEnSHSEuI+Au7VwippKaKSLOaU9upEAhVBTtUMxb0MvEreQlQ1SZyU NKWpY9ymnpQ4JtnXao7LDbLB1MyXG7Lui6UPhqhAFAAl2fXhBglTynnHGbZ3ReeLPVrW0oYK L2LfCUNEhExE3MuonihGIoLKOMBwAxwZOJM6VCFCTfecUJBYBr2XIQLKLLmZ9jrEAkwRlUYk 0EnqUFR6wnYT0USLl4q2KGAcEYES6clF1BJEQhVS/IM6qkDsOl8MxlgxNqFJOh2MmzBYU1ZL uFeLpTTzspENQcUIcZ+kzKxqX4INmdRH5C0jyYQbMQL2xBW7YBEDROU67KMruk4RZWZVqzI2 SkkKDEaIuKp7eJYRk5C7msAcmpJCUFFBCz8I66kYsMfeq5FcFSaDq7EbF/LBCNiOk278Wffj 2N2JiA152SdJENXVCDdpVQYXYseuV2XFpOFm7MpJw81IXkkOrQ+wpm0Hds4iogShwssM1L8F 1rqWChCINLp6FQcAoevVpqcCUSuMiElLELhEvKWijMBZfYY85qyIAhOwsj36H9nyK6IkK0VU NaQ/K50ixUXUZQLrzGoNVCF7K0wd6c8NhRTEmriDb5lgTTfSQI3U6KqG5YYWUSwZxNS07WCQ WNNzHARPRBRoRqI3PWVCQUxN205ksIgoEtjNS11QKDMGA0uIKJNsupNmUJBstcJ+noMDElgD BQnZY5IgG8l+jAAK6nrwhCMqEatelcG6dkzYsYm4l2IZTPosvbfhuEVdAobpRZMXXNK1eWZw VKd9XBzIgL8its+pI7wi4l6tmwx+6MpGjHzrXfOt4/QmaOKI9Rz0JIKFC0Vs2gPgakIRxjBC 8EnVuohF67oQiIiIEHpG2bVkFRtE7QwCBgOlR4Q0B9ayHTACfBSxl5IeHQQi0ROx67gRg3UU Kuk4cLCUtA9JEBUwkgY56i6VxY7wKGt3ItPR4xoRcbUEFRkiqQg1beCbTCTvTRjyJO/FvAmt ZCX6P/zhzQ/7GWbY/vLmxzf/9W+ffvrtzdvfPj+++fHpy9d3T//+4fGXN3/+Hynq/7u9+eFn bOVw6x//+K//MnTT0P3PVxX3c9K/zNR79EynsGy6p7lp4amh/eY7DJb1/76+hIL/BoGG0C7C Pn/PxA+vLiyuqSVP7fv0mt7hxjxTy6+u3lN7fZJLWnltimXJWF3SoiUtfl1Lj+ENtThxo6s3 caSrN/Gkqzfxpas38aarN/Hntyi8ffzH098+/eN15wifa/KiN74IPIQ2hH4RhNCvEvw+YLYl sPQlrejm9+tqbn6/vrTDGj+L3H7BTZ/71HhNra2p9TW1uOiTbyG4Uy8t6uVFvbKoVxf1JmA5 meVxpHIcqZzCEOIQ0hDyEMoQBkmkQRJpkERq15Qwm9zra5q5IodzhHen3jQDHL1pCth6aZoC jt6iX9I0BRy9aQo4etMUcPSmKeDoTfnS0VvES1rES1rES17ES57g5SQ15JH/eeR/HvmfR/7n kf955H8e+Z8Hs+TBLGUwSxkjlzFyGSOXMXKpy/QxgbtXrCdod4xNsV66GZtpTjp605x09Fbn Oc1JR2+ak47eNCcdvWlOOnrTnLT1yjQnHb0phzt6i3gpi3gpi3gpi3gp/1wbUwe11EEtdVBL HdRSB7XUQVp1kFYdpFUHadVBWjRGpjEyjZFpjExlmasm7jq9sehLfVV/FhsyY/OtLt+pR4t6 vKjXFvX6ml6eRMHVm8ThJNZ5IJIHInkgkgcieWCdB9aZrjF6F2ySp+XU07uMlSWtKUJbtNTi ZGmu3mRtrt5kda7e6vqmGejoTTLwJELbwGMbeBxnw3gydBEG9zZeBuZ8dWb+xSlPOHpTnrD1 0pQnHL0pXzt6c1TbenNU23puzppo6YPP+uCzPvDTB376wE8f+OnrfOaC+/tonpNN1V59ojAB zemDyvvU3NJiP/ZIdz1kiUtaaUkrL2mV17X0zeBgP1GrM9VwPAd8/YFaiddPu15aTp5lWrec TcvFs8zrlqtpmTzLbd0yzy0/e3xZ9ucVk3EuNHQJ0OGvY/pLAOyzdSX3kW6cJKW+R2X7JCUr Gvsxrml6ktlnTBfTdHVNT+jhjGkjTPquvWd6wjFnTLfzINwP2CfjXEpgGUftZZywX+a/xtNT GswuGcUpDx6HjzOnZJONsstGcUqEvmmDjp7HYz/nnIwzuCAbsPa8P2FVT21KicXu3aeUU4bX 3n7/+mqLSRt5JMHbibOKWfdyO6w/Pvw0GeHyGPl60tVabJpyZCneYk22KOZDtzTlx29m/zQx azCF/qTGMjvlRtdsDZbZaiIqTXnRN2siqmQPUYP8Cg/hci53mfJ0QeabEWnKhzU7qKlmn+Mu qJrVsdqgmzJxJW/WNujcWRul5zqxp0RexmOdMk5jL3P2mPHtw98+PE6oeSCh5Gek4e0/JmXF U1uj8TShcW9HliY07p66rW3l8tpe7jB23+s0ntbrS0tLxvKSVlnSqktatOYOXjLWlrT6Wpxd eEzepnQBYp/m3qm2hpDoQuT1xI4uSCZOcWHidJ/3qa3hJK4B5cBJnWj9x/ufv355fPPdh6ff fbe9+/Dp18ft6+ft09+3h+2Xh89//fjXj396/PXdl/efn95/+rg9fH369MvD0/t3Dx8+/Lb9 /Pjx8cvD0+NPv9/seMyM2xx2l1Za0spLWmVJa80btKTFS1ptSauvRdlFpsdg95lbw0ecAER/ Wh2cTfYEJvpb7GBtsmu46YVnM9ZNNj5OESab7Mskp9Nwf3ZxxKg9VyVvBde/unihHv0jumXL MZmW3RO6tG65mJbdA7q8bplMy+75XFm33EzL3bNcly2nYFn2D4Fp3bKJMP8MmNctmwjzj4Db umUTYf4JcF+3bCIsuQiL6ySWTYhln8TWWSybGMv+c4Z1GssmyLL/nGGdx7KJsuw/Z1gnsmzC LPswW2eyYsKs+DBbp7Jiwqz4MFvnsmLCrPgwWyezYsKs+DBbZ7Niwqy4MEvrbFZNmFUXZmmd zaoJs+r3ZOtsVk2YVRdmaZ3Nqgmz6sIsrbNZNWFWfZitsxmZMCMfZutsRibMyIfZOpuRCTPy YbbOZmTCjHyYrbMZmTAjF2Z5nc3YhBm7MMvrbMYmzNiFWV5nMzZhxv4Wc53N2IQZuzDL62zG JszYh9k6mzUDZi9OYnYfvH4ecvn5w+Xo4ziJOA4Gjn36sW0+drHHpvLY4x1brmMHdOxHjt3B 0asfnfPRxx5d5dHjHR3X0f8c3cjRGxyV+qibRxU7asrB8AffHux3cNHBDEeeHllzYPhA1BHf WQSbm26DY/bd3LXqQRKz4F9n20t199W7uG6ZTcvuwV1at9wty919uTMvW775lMlLy+77VGXd cjYtuye9dd1yNS27CKN1yybCuoswXrdsIQzf+NrVf/z88PHFAN9U3vx5a9dqdFotxis9/23l OMsl8l6gpWghmvzXleMsmU6YtiBNx1n0CW+Va73zxyAvbbIz5ZsD3RfqJ97qnSXDCdPJNH3+ GGTBtFVj6MRbvW3dNJ3CiDY3tB/0T8B2Kec0+hUa/cplAVMbJ95UjZefM1G0GOtERpgzSUP9 REb0Kz3/Nd806z/Ie9eWspnE/mu+adaAnDB9zls7Noz3fGm850vZBrp/6Eaj06VsMoWLhJsn Ci/V6WZtxg8baPywgcYPG2j8sIGSDVY/rWl8E+qynulQ2VltMLP8OFP3cZ+uK0FJ5/XqtZ7b 0qQpjR/vxM6WWkynF79rntK4b9psaqrbZaQpjbumq9lllJs9Kl3O1V9fw2DactmsUjUT7cyT ibG9pGKmf3Z+BkLFrNDVZ+G+bLqaLFxdFs7zAuCaNlm4ns/dfN3z+mewedrzVm/KZAbKP4PN 057XN21C7Nt5uyYCzX8rROMI4zLd6Yj+AQDVI5VMgvCRYFIbnd/95GsW5/ObrXzN4icOGqcs zl7BYrNgnThonLK4b9ostScOGqcs7ppuJtV+O89W8O7HwJM1XA7QaBygEZvQY38HTOMzGJdl TGHodV5slqp2vqfI1z24fxB3MHB6btIrrrcHcS/U/f3wsuUeLMsnvlu8bjmZa75tKJrRUIwv UVz8dEx7OvSJhmJ8+ILMw1kfis2uU7ebADI2AeOjMZfZT0c80fKP83Eik4fcYkHnWv5LR2gU wvGUgMY3n2h86onGF54uC5saO1Ejx/fsLgtb3ulks0Yex7hzdkmDXa7V3F1Dmeao83CJbk9C n6nziZPQMeF6reYCjaYWHQ/z7V7yhbpbmnndcjMtuzzcli1Hi4e/BUmTicO8MPP47DOPnT0H O/5+YeaQxlDZGMpF4mUZs5n4r2v3ZcvRLDbfnr0oV/X5E9ZLoh5+O6Y9Hdo/1aXxTRzqFvB9 ZurFdO95Zrp+dsHHafwJvXSld+I8O8/mmpynO5zspfbrePJ+7j4ZyEI0R/+fjODxveXLpKdD uRA10zT5e68jCld7L85+etepTae74WyuONFtFObdDWeT/U48nuDxogInk8LdKCSz9sQbouA4 JwoeH+bm22cTL0Y88dRnvLrB8Z/iB45W0tBtjSGjxtCoMTS+GkzjQ19sPxE8UWxoFBsK5vNy 7wEwBaNRfv5OTZszRB1bgTr2GXX8syh1fPmsjg+e1fGds8tD9eMZ97F2bz7mb9/u04qTE8Gz //LKnWqTE7XTk0x3qU26y7M/pr1TbdLXeV+ci5OGxf12gOuUyQ/sJ+cApyN+n9qkfHtqk52M pzYpU2c/FnGn2nQPceIN9ukuoDhbar55g/2l6fMdXOrXeuc3l+W5Sa9e3h44P1cnl+/rsmWK pmX3WQ2vW86mZfdRTVu3XE3L7ilIX7fMpmW/Tw7rpk2I1duWrBot2XhKwuOb4Dw+BX4J2uHD Y0lTqyfatvH2Klezp/RJwWjbnjUyXOfHbDzer+Vq7HlOfujhmUNOfmvhPq20pJWXtGhtXe7C Jl8XcJf2fbE3zPdNc0LvntqEm0+3Zs+TpvlHjeVSvyJf65l177t3T18fPuALxb/77x9/2H6/ 3XZsLyZxdrC3j798/vDw9DhGnHLn6RH/8vh/X99/2YdLUz48PdzjL48fn369DDdB4h3DXdaZ JtjUf6TUbK3Hp8F5bJS4jU352DFxM7n8AIj1vWm+fSQzw+blizOvjzBov5mV/HgN3cdrytd6 +aTLf/jy6e/vPzxuOzBu4jntyE4PPuI57bC6ncY89rLcza7j8JIZtG54+lzQxtfF+fbB4Yvp +AdlR9DoWs885rzy64+PHx7f6WeKJHzvHn8dEZv2k6dHHhGbctfxlGiySw2XvqYFqzduJz4q Mzi8tOe6R7/xerfSbj4q81LdfwGT100307T/FL0tm755fPNC/cSHaPq66WSa9n+OGtZNF8P0 N7Rqa9qMLwhdEHng44jW4btjJVNjxyc0TRYaowaDQ07S0aht3dgonBkqTRqLM7p5QhUnu/hn XnTbT0/NbOPv08pLWuWF1v8De4qo/w0KZW5kc3RyZWFtDQplbmRvYmoNCjE0MDkgMCBvYmoN Cjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0RlY2ltYWw+Pg0KZW5kb2JqDQoxNDIwIDAgb2Jq DQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EZWNpbWFsPj4NCmVuZG9iag0KMTQzMSAwIG9i ag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQplbmRvYmoNCjE1MDMgMCBvYmoN Cjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5kb2JqDQoxNTA3IDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9DaXJjbGU+Pg0KZW5kb2JqDQoxNTgyIDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9DaXJjbGU+Pg0KZW5kb2JqDQoxNjA0IDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2JqDQoxNjA5IDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9DaXJjbGU+Pg0KZW5kb2JqDQoxNjE4IDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2JqDQoxNjMxIDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2JqDQoxNjQwIDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9DaXJjbGU+Pg0KZW5kb2JqDQoxNjQ1IDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2JqDQoxNjYwIDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2JqDQoxNjY5IDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2JqDQoxNjc0IDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2JqDQoxNjg1IDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2JqDQoxNjk3IDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9DaXJjbGU+Pg0KZW5kb2JqDQoxNzA0IDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2JqDQoxNzE3IDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9DaXJjbGU+Pg0KZW5kb2JqDQoxNzIyIDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2JqDQoxNzI5IDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2JqDQoxNzUwIDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9DaXJjbGU+Pg0KZW5kb2JqDQoxNzU3IDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EZWNpbWFsPj4NCmVuZG9iag0KMTgwMyAwIG9iag0K PDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGVjaW1hbD4+DQplbmRvYmoNCjE4MjcgMCBvYmoN Cjw8L1R5cGUvT2JqU3RtL04gNTAwL0ZpcnN0IDUzMjUvRmlsdGVyL0ZsYXRlRGVjb2RlL0xl bmd0aCA2MjI2Pj4NCnN0cmVhbQ0KeJzNXcuuHElu3RvwP+TSXhiKIONpDAaQYRtjTM+MIPVu 4IWm+3ogQ92Su9Xw9N+bh5mRVaUqMrKqNt5cUXUjyAjy8DAelXljo7KEJTbKS874ty8xNgjy ozKEtBAXCLxwwK9YhIJfMS1JG3NeUosQypK1Mdcld/0kLSVVCHGpUNpSWFqATe5Ly2icaOmx Q4hLrxgGS8PAqlpaxqhDJAwNv01inJLqSkvkgLEk+QVnVSIqU0yQxG4q+pk0zoTPsjTOFZ9l 0VcY+jDz0qEvS5OatR3GHPFDh6iugPqu08vSuHdR0EpcKKjrSlhIhorfymexqhb5jLRvyeJG nX+BQxt+W+pCSZ1TykJZ5yHDpVxgo7SFCibdqugrOvMq+mqK64CoBWipJFKBhyQo1AlaapFY rX2zSBV25QfHtW8VqcOuDJJJ+0r4mBk9WhCpoUeTQKeMHo0WzgE9ZBicq/aQvoUw0ib6SoNP m9itCEWT/3JTuIgqxqTFmnzWCVoEGilo384iNejrQJN6twucxL2Q0pJIvSvDTaxg60Uk9a40 SSJCaiJ1zLyHJWWErAexUdC3i2NTDQheEBu16GeALOLRg+jDZEQSa13gKVJbcogESYAcCtoJ CHMUFMtnXSSZtEjymQQOvidBflKsyW/Va11AmDOQ2CPSa9UiGaJR7QKuXCpGKtjPFUDvMsFc EekeeckK205RUgkoQWhLCNAsCkrQWUrilojk6eLOoqjrAnQxoZ+1pfDao4qkPcRQSWuPjtzU HvJZhie7QKAU1naipXSMShK+aFS7TL9oVLs4pwAqIslnHfHtkkw1IEZIkhoqZilKayTV10TS HpL4lZB5PYEU1IZkcmWkbhdDNSGxu+R5zapPpl8zENalSS1gny6sUSuplrDUFmBNfF8B79gl uysGLhIL30S0k6DI4KFFQtZiUbttEWaBDYFKUy7pkt1NuaTLD+EYtBM+aGssxYmS/6ovLZLX 6CEs0JTd4AjJNLQTmDXQg0jSA1MVqS59HYuAQRAFzTKZvsZNMCRxwjxkaOJ//W1fpCt6CAuI H1RKi8wK+uS/YhsjFT6QthiLKOhV4yFp2kHSIpWlA8oiiV0MI3YQdgigiy7pHUPUuUvOi6gu xCwCqR8QtsDqTnBnSIpgtApJwwd/CCAxOiRGKBoY/EqSByNFMQh1580A9pe2UAasiwjK7zoD YRGhfHWdEIBwquIRhCVIh2FwdSTNHdCEEL/wYoA3Y9L5dmiQvIWYIXYdjiiPAA9pFkl9axDx ae0qFi0xCSKsAdEiSl/52SEmiE2tiR2KSbvJcIhI9XaIDSJKAXFSEd24QwNCKbVLPxVrQm4V olijosOBM0hSBiJMCHYhBohFNcAE8oWU4RnzJo2jlGeMF3WOZcoQURVJZ4EcZNZZgIJZmBii DFLSrkAMqKBVRyYTYiEJfCrWuEY0gGe5otwEIIFRGUWENZCKiGItYd4iRog6HBBbAsBFmehN lFQDqjRHTB68IzSuIhqA0kXsEDtEJEJaHYUsSkW7iRoRtRsWBKky9GrNFw6ACBNYBEiBhgYw +FqrU9cZA9oZThQRC4TQIAJ3kukYOhgiyy/RoEBETQ5YH+QVcrqakAqFtvhUCglEKMsaIWRa LgEiiqZUdgwHa5JcCWNAygjlIyxgtazFXtJHRHCdmJDhlBV9KC9F0gWimChRZwGqVLonZdzC Ok0sOoTH1bCMoWChJmKBqD5DHpectC2UZYUncrWUAj8g50slWAMpFLAawUWxNEV102VTwBhA FQWMJ8qwhEKk5VOxVpG8IlaIHdaQ6JXUO0h/4X8YBlVUztAAqpBFDtoi22tSvUjpKsGAmCFq FoIJhOwwHPBDrUFFhqjeAT9UBYGybcUSQESYAKeLiDUPUk1ELD4QMhGx5kDdEhFFPSJCUdcz WHluCz0G1tfVKVdd/ulSVLJDRNK1APTGdZGZIeq6T35SXJd7iEWMusRs2kAXWQxrutrBAom0 wLeusyBdn4AUIuliRPWuKwr4LCqjx6Kfam0n/TTrIkA/1WrMqkFLfsM0tXol5GbUpYOmXmSt eBmfKvuXgMkrHxcgNWoZr6Rtm5YHWOO1fkDvysfA77p46tpAOSAgyWJa+Q3KFBQRoI0a0nXo mgbKqWtWsnpHkZs0mkmTY22gCaoNsiaSNsia1xlD17StGgDl+aqTz4pnnbzyBZaH8qmKawNF gjbIGpu1gSIBW4D1B2GzFHUjQIBn1NhoDdhmtTZYR4oGRZWvDVQjkiGCZqJmYVQ01qgf4P+1 qdfRqukHYF5dvBD2a6TkLSJBxAeSHiJqFkaEXxrr9kRaEcEFKPZSvDRCCCkxOkfYoQTHYNEm TTXycDJljTzIkoqmCJBLRVMEJCFbFNUr/xc3YAKgRcJOgLBuFrLSGQMJjKJLml4c1IlIGY7q KIyUVU9EFFhLh0xWRCbVgL0UYy7Yz0i1TaoBbVf8wp2y7FUfNWxkUckicoqLjg/44IoGBAhy QwMKukdbG6CtLgQII2UsPkhrQkIlEFH6JuStiB3i2kB+JPUvgSTWUkdIUClvrBHB5o81OASx ryETUamCMJBU1gawVrQBoiurwDWQIjZoJyhPup8kEHbCEps0exIWQPJhwgYza9AhxrUBQ9QG iKNsZbSBqJHlZVKAQAS1aYHJyg9YLouo00TxlJ2NwgZi0Qbglly0AcNaXRvAWlM/YFa5Ka7g 2dx1moByxopORPlRwtoA+2DFLyG6RWNKSP9C6gdgqWBvSIqPgs0hUCyiLiUIBFLy2iBD1Aag ClkMagO0xeoZMBexZrWGMTQER6tVaZo+yIjStQFopWrp0IHIjkcbSNsKrkOiQARICR2qaicQ U2XEH1tvEdcGHVt7bYC8lo2PNmCIWPcRfFixrhYR1goATqCVWrMOXSZUV/wWFdcGGEPXBohj C2uDDlFZQs8PogIced006wjE1Fb8YlaN1wYJojYAa7S0NkDbHPWsA3p1EUnISqGovp6AYPEK a2AN2aGhARimNW0A1mhtbYC22JaJKHq7ricJDNO1NCux9pX2MKGu+RUxIdkoqYYKERMgMI5s BVUDGmTlOvCObLvQFlORvZh+CmtV8YuM6LolIPzoespDcGfHth2kBVHhKWiU/yo8JY4iKjw7 DsuUODngU4U5dpciKqsFnNAw3McBRzS63sH5mojwDgsTyG9IeZEgrrwYRSzaQDpII20Qobdu xIlTOrhPtgAiYntOSGYRiw5dxhuxKCekjChcG+BISIsNC2uIlrUB2tJKvaI34oBDxIiDJDAg C5ZEBNpYgCkW1wZiTaqgnnhBb1kboG3V40SCXl2k40iM9USPwOisxzFgd4jaQBKJdYUvIk6r 4tqAISJRWFzPylS/+c2rN+tRZljevnr36s2rb3/9/PLq3Zeffvnuy799fPnh1e//vOT/XF69 +Ss2Bmj129/+/d+Nbmnr9u3vbvWL60npW7N786yWx6121yqP7m+N7uqMfXymHtqH8fL+e0NV WjWcdWPyJl0taxJSf9LM3mA5eVbbY936Y91imE/yX41JjtBwGUJ1px0msV6jsQ/Z1NPdCUWz X5tELQXPbIquWZqbNfyY6Dmv9c1r6wDnGfIvn77/1VAVRwCcZEN13zS9/8vHFyPXeGgKXyXd qfttP/LM6u/SzX5p1u+2OYNOJ93IANmsmwGSWTfDJ3oF5PUzfKIXPH4qZJfAskspZJaoudns mi2uWbNGzc26vJXdykhmlZibdUtjCa5Zs0xMzRaXJ/KMb/Jg6RUFe1x2T+1jN5m07yM0i3WO V8W6+KgzC2DhmUNc1BUXdWzWz5NZg/eLi7rioo7NKjc366Kuuqhjs8pNzVYXddUlMjYJcG7W JbJTKTPAXgbGy8B4GRhfPbWP3ZyZu5pnk6LrbGFd3eV8ra5Zk6JPZi2HuuvwqUPrWDRWF/3N h6FJ9bVPvNZcGDYfhibVn8waXmsuDJvLbGxS/dysy2zNZzaTUOdm/di6zJZMQp2b9evpDJpt JHQbFa6N7G8j+5uL/h489Jm9XNAlk+lP1gx/dBd03QVdMpl+btYFXXdBl0ymn5t1Qdd90Jk0 PDf7HOj62HL1Abo+QNcH6LoHOnyF537Q4RbR84dVH86s3fYHvqvkDdYHncXrs34WMR8Y7laP cGznjdstp8li6AP2/di6Rx3JYui52egu0GeoxVfTNq/RENIQ6hDcxDjtAezjiDIOEepIiTrO OnoYVpyJHDqpyIP1y7aMO3NjdHcOm9FVwc1et5z//6KXS4bhMWOLfg/wFIzr7jNUxYGhOJIy liEMVMXmmaAjXHjdyz8imhsz3EHsjtXfzj7WjR8f7PD5xTXBtR6fCB8378fV5cH8sFUOTwGW Bg3SoEEaEKYBWHJzwr9JMHux544yN2a5Iz3ljnF+39kFftyHYVL/RjV7CPfB39Z5hOi34R8/ ia4zW+7tzX29+kO9osHUs24mo6WRL+8+v//xquupy6vfLxTP+7HX7/V3X355//Hbl799+Yc/ vHuzfPvyw+eP77+8LG9f/ueXDz+9/PDy45ef/3G5OB+/HtlRC8umySTC5PsG30tdAZeyB+JU 7hyQSY3TAVV3HDvFibG/fPqboWOkU3LI/QSbf//w119+MtIoDc67uLa6Hlc7DqV81m8/vZ5C 6f2P37//8umnXzf/mqx3WOOIlJH4+qV7N1LjZLxnl/9217ghy4f4zo1UH8Nxq9x+mXMgUu28 Xz3o1z99/vLh04/vP27uNbjuDoVboNhcqPoXRfp8xOYZtzjvnvED5eTnsUDlsfTK7tKrHGdn Pmfncg87b641ifiwsjc/ffqvDx9fNn0mHR/WN0Zm8uhhTdd1h80V5N3DM2loUpP7uGnoZaBh XDn0MtaSxV0kl0OloDjcdAyuZVSA4lSAI6rYZNp6B9TPOakeDdfrj//7/tefl59fPr589+Xl +y14JjUd1rvBIJnU5F906aNRq3Oru/yoh2Jdn451HbGuT8Y6mYvO6tL+RawTnfVrLkbOae0P /7wItW2RMZnosL5/2jSZTHR8ZJdrmGTS0GGNA38mDVX/y1O9jYCPS5DextqxubvDPYwuIpuz FDmIyFG7q1O7DyHSZJ/mru0vEXnOPq0fjNIfP30ZgTIp57Cydxcclk3mOaxwG1o2M9a/wNOn JtcQjcuN3t29wu5vHzpPxlu/jrsh2a2j3SX7i/Dnc0LqR7eEb4SQLpZH2SSlwzo3UsomKR3W 9BUpZZOUDmscgDJJqbvfkdAnZzccjeRfb93WZ2aPhNJFVn96Uzzu7Hp3qvYRVdk6dQr7hd0B VLbzfvlglL7iEetI6rjCLezFOqUK/qWePs28BdnbYp084wR5DPvxyOhz1ttwnEJ4RFUxmPVQ X2Nnpk9YHwVI4fN+h3d0f/qKtopBNnfo3GirGCRzh6bLU4ZicM0dCgd8zYyM7lJeH5pf8bJd Z+kD85vgAnqPpAvo+OTiXh/w34bjLe5DPH6UV86Zh44evL354+uvkWWyz2GlG7KqyT6HNclq bdNl5e39ozKz+LCm158/f/zwHa47NpXGGuIOlRviq5nW+32agfjtGkxf5rAJIwdo5ACNHCA/ Bw4cko6pPZUDYyFB3s4k0PEcqPmsHx/OgbdfpUA1GeywzgE2k8EOa3r78t9na4NqXXIdVzig ZuY5T6DGA2o8oMYDauxV+lMkXWAdu230gEUDWN4d8xFVbXrL5/R9YqXRLI460tcioyN9Lfo5 0tdaR0xOX6dT9Z9VugLZfjv4jXnFbZJsGqvib/7jNrK8C0F9x8pRpornTHXHNVAs5/3adKom /+z3NNZUvfsZfbvNzLTJVFPTxWOAk7e+efUa/10Pv27PoW1EUNwKk3k2GX31z6rKuyjSN+5M 3OptYIJ/53GJhH7er85nYNrMs3A4Rzb6PqKJ6WF5fWriHsv1PGzX3fkCCNvDQrenUAcQfFTT 3I1l1Lri1ropENzLoBOVbCAnB+SjCrt3QiFNyUJfdbWB3M3AOU0eOi9cp7Z+18PQMxasyYPg pFIY8Jk892mBrk7LC5tdZ267eC7nuvs0gOlxy92z3KZknx+2fPFQ0LXlaUKWxy2zaznNLNfH LWfH8lfpUZ30qCM96qhzbSRwG2v0i5uj+3KgPdSrP9QrWkXi9Ow53+z3WHpHK78Prjrv7GYm 5n76bi+jzNTaD9gtmF2crV93ny4Zoplbc9PtOMK3h6Fu6xmrru5R48T7VqJOuj0G//gY/snC fwxTiOxd29ddJ2GKFw/eXHefby8et9w9y3FacOhhyzG6lqcFhx+3zK7lacFJj1vOjuXLdIzB TscNizs09kjtjtvnMbPlPkxwX6/yUK/6UK/2UK/+UK9o5fXBr5jf2c3KqKMV0XxnzO26bYH5 4DtjbHPkl7L7zD2GkmjBJPpPj0QLKHF/WdbtZ+v1XasOt7B7yU9mAZmbdQsIuw8skVk95mab a3Z/yMWgsXFuvfllH6mpcL8UtF6aMsZ8/ohL9N9aRWYJOz1XYEz/4uv/191djJFZv05mbz6i pG/Y9cz6GDOL19ysj7E+Cfb20MTwyz5SczzuN6zIIqCY6ixq7pLHf8CBLP6a9bMI7Gy4htvz 8Ft20ZZ9tJlMOLfvM9o07GOFMs60YnaXX5MXXJnMnPMk7NmlFv8FV2wy88ms5T4Xbf4Lrthk 5qnZ4q6up1HbXmc1/LKP1JyHiz42KbbMKkxx0VdcrmOTYk9mLfe5XFfcesomxc7N+vV0FrUy mLWMeloO1lNze7eVhZ0oduzt05mtzMzHUccCYZ/ZRdH2HxIY+di+OoKO1X/zm75f/TTo6+7+ tzDnVo3AXryo6rq7vz573GpzrYYJnOrYStYR8YuD8SuFkxdWmePw31elb7H3rPpvcZlbNZzX XKD4r6vKj1vNT4VsnDvHce4cL86dr6fhIq+Y3cosZC7ymvsARp1bNZzXg2e1u9uA9rhVei5k g1fb9m2ZbaDmNA69Avm6m/8GSP2LDJ5V/3FSk49PZi3vuZTiv7IqmoQ8N9ufCtr2Zffhl32k hkIKx16cfN1vsgWl4IGPgn/MYVHymdnb7qPgsQoFv4panHzArF9GJ1HborD7ZR+pOR4ffRbL U5hsQSl46KP91P22WYuVz8wa7osesZD/Xe5o0fIBs/6Saxq1bQtC44ybogv66KPPInraD/6t qEUPfRTdUhotYp70I4tZz4ZruX33m4u2yReaLYqd2ye3jE3DPp4Y2By0j9Sch38AYlIsTbag RC7X+X+pgkyKnfQzOZIme0gaXy4n8ior+X/rgkxum9t/qrLS+No8jW/LE7mVlf3DXZMsz86S bw+EXZLxLxDIJMuTWcN97KJtcoFgctvc7HOVdezkaRzpE7uVlX30mWTJs8rKLtcll+vY5Fqe lbjkVlb/9UZsUuzc7HOVlUeFGIc8lFzQ+1cLbFJsmlXW5FbW5B+3mRSbZhUqucyS3F0qmww9 NXvxLqL7o5YGMY4TOUou6P0/kMEm00/+iIL+FTXPrP+SRpOY8+RUi7LLLP79AZvEPDfrblSn UdtejDX8so/UHI+PPpPp94sMK2rFQx8Vt5yyScx+v2Qy62m4htvL8Ftx0eb/YYxkUuzc/lMH clsYdwftIzXn4b9b1KTYMjmRo+JyXXHRlkyKLZPDMaou2qqPGpNi52afOpOj8ZjC5pd9pOY8 fPSZFFsnh3JUXa6rLtclk2Lr5HSM3HN+qu7iLZkUOzf73NahDmYd38cm9wKEmo8+k2L3ew4r as1dRTV365BMij2ZNdznHvVT8/+kosnQc7PPbR3aIMY2tg7+HchOVc6lZR0Xi3Wcqbf9nHY/ +htr3jCSfbysgMYz3Nu2aV+J74u7fb2wV5CdlHac764zJnLkgnSw541et6No1bnJ1/KyVVcm 5qy6MOlm8fqkm0mj/rtzssmDfbYv6e4Srbu1Ops8ODfr0lb3XwRu0tbMLAe3Vp+uVIxEHs8I bH7ZR2oqPB28Wd/m28Z8ngDs32lkiz45TM752L3TYP9Oo1j0eWb2Nn2ye6fB/h/dKFa+HzDr YYzD5KubPG5QeHwVnYO3ZmD/TqNY/MNh8uUAdu802L/TKBZ/nZk13OfeaXB014PF4r8DZr3S OI/auEHh8ZQARxf0/t1EsQiZ42Q3wtFFX3QZrlh8fmbWcJ97g8DkrgeLxecHzHrrwQNRqyNY 22qG3asV9v88RrEKBNNkN8Lkoo/c3UgxiZkm2wJ2LzLYv8ioJjHPzXrVax618dofHhcy7F5k sH+RUU2mn11ksHuRwf5FRjWJeXajwO5FBvsXGfWamP8P5rxWEQ0KZW5kc3RyZWFtDQplbmRv YmoNCjIwNDUgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5kb2Jq DQoyMDUyIDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2Jq DQoyMDU3IDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9DaXJjbGU+Pg0KZW5kb2Jq DQoyMDY2IDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9DaXJjbGU+Pg0KZW5kb2Jq DQoyMDc1IDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EaXNjPj4NCmVuZG9iag0K MjA5NCAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvQ2lyY2xlPj4NCmVuZG9iag0K MjEwNCAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGVjaW1hbD4+DQplbmRvYmoN CjIzMzcgMCBvYmoNCjw8L1R5cGUvT2JqU3RtL04gNTAwL0ZpcnN0IDUzMjIvRmlsdGVyL0Zs YXRlRGVjb2RlL0xlbmd0aCA1OTg5Pj4NCnN0cmVhbQ0KeJylXc2uJblt3gfIO5w36NIPSQkw DCRIgAkyi4HtXZCFHQ+ycZAgcBZ++/CjSuq+ty/J0+duenRPUaIkkh8pslRTW6PH9aitXQ9u +t9+PUrv+GE+6oUnvT7qelQerUw0+qONikZ79DZAPB50FfwiD1qPWMfDoz4fsh6Nh5Bog8pj VIxM12MI4xE9Jvg16o9yrWdNW/aQ+FHKekramoTWeJRKGF5HLK1gwlS1JWDARddgT1lXQ/ZU V1BoPVU6blgQ63g8wYOVrxDmTfNRRgEPnXQZeFqnPrgaRhGd2jVtFJ1QsR6iQ1XrIfpnBUkT /Gk8BN2GzUX/6YSdEG1Rs746FA2MN7Qbk/XVkeXCANhIQbc2tNuoNp5OaAzMeSjJZOur8rgq xtOh2jWsL6uwOsYb89F0+msabe3aaI/WKuaia1OZo+9U8XYT0NTxyKQwlY5MCroRuoeQggpA Vw8e83roSjHeVB5jPVUeA0+77p/SYtGqRvpXR0sV5sKiwbIX2yHdzl6wz/3iR6/rKali4Wm/ hrbWU6Xr2PFedDwqxmNqSwpa/dEZMtJRH13saVEeYk/1zz7WU6UbOnFt6XiTwKOwaq8Opa2i LYix6/KVhT2dD90MPNUtprqeKl2rWFvt2prgoeKh3jH7otZABTyqmgOtp8qD7WnV8WQ9VTph rK0VmA14qB3SgAR7pQfNDh46cb7W06Yte9rUvsp6Sg+uF9am9sYVGtGbqPVBX7qqGUMZalfz 5W5PVS2Y7KkaMNN6qnQMU9c9frDpX1c7Z2HMXkXLo4KHsuS5niqPaU9VbeVaT2HsUGUISkpv S+WlTMxeMUEqg4dasrT1tGvLnqrqSV9PlY6KmYuOR8N4KHpww+xVKCJAJhCL2FOdhgx7qpYs cz1VuklYm27xuIBcXS1+XDDOrsgwCgCqqyWPup4ObdlTVZrR7Kma84BBaKs9htlHVxUYVDB7 3c5h9tH1n8HrqfIQe6p2PmQ9VboBi++6OWPZh9q5NjB7xYi57EPtcl72VG1/Fnuq4p51PVU6 w5eudj6XfajwJkxcW+Uxl32oeqti29OpLXuqdj55PVU6FRJaOt6yD7XzqUtHj6Etsw+1yznX U0Xg67LHKiltrueKwTprXR6gH7A90bzQZCxB11EusxK6gOt9EQDYIQhtYlxaBKAlXaA2Ma6Z ipoinACwixQv4A/ArYDbMIICbtMICsadi0BpiwEiUEKbsBi4gVKKWoEOpqsoZjNQM20uAoGj MQK1fiVdBKCFuuivGNcMhxQAtAmopgL/ZKZDFdxkEYCbGEHFuGMRgHZMrLhiXLMf7IDOpmBB 2lebsCA4iFKLESg8FPUxIFAs0OYiAG1rWLH+UwyFtalzMAPT5gUvWczbTDQXAbixEXSMK0YA v6/YixV3jGvWRB1zGBML0r9LNXsilXlp1yIgNI1AkUE98SKAU64FK1Zs0KYYN52DKi0WpMii TZgVwdG3bgTmwckI4OrVFxsBaM01kjl7sy1CVKDOEAtSK1FLNn/KIJjFnLsSKE4b7UAT0Edw 74qJmBlig758sQUMAFdtohusQJuEMALBEDFG4AsjgIUiCmgFIyii4VeMK8PG1fmqqWJBCDrU 8kAg+HUCrEgQiqztU3BQIwdcke6ANm37dE6qZoAkRCzatN1R1FGHBFACIhbqRjAQ4aztGxiX FgFo1/YNjGvIBPNSnbUtUcVEOARuA9wG3ZFIIds+mhh3LgKl5Qv7SxOxkwEUvJoqJxAKDqSw QRTB5rkugo44ywgUStRCFgFogaqmjYUNpwhYwgZUpLpU2JCKYfMsIGAgDAtwh4ElPMh+Be0s 9ivGnWK/6hwUNOzXC81pvyo3KVBwBsKolerMGFgiFRvFwBKx+TKwRGy+DCwR+IMK8WuQiCgC IUdRz2gyBoEpAQNL1CFNNEE7oDsMqNCZC5pgMeHjGIY+LgUMbVY0LQAElgxzmwyoGLXaCIQm sIQBFWOF5ICVgehJo3MddxhGMWBlWHDEgKABZaoId4u6J4wAWFH/hHEBFeqgbATQmg3ByZbl ohiwoi2MCwhSJ4WZASrUS9kIym2qXuNXHXeazTNgRbUejGHo02yeASsTEWrFwaDMbuMCKiYt AkbTCAAVkxcBaOXC/sLQp9k8HhX1WJgkIGgOWCwDKuZcBA3HFyOATV3XItC/LzvfMCJT9Vng Bt2/7IxjeqeqDm5A3qsbAXb26kaAfy5aBKC10w7DnV2YiTZ18MtOPLbf6rPADZtxjUUAbtMI 1nFiEeA8YUcfRoSpPgvcoHfr8MPwbOoawA3WDoRGU/sWO6sx5Fj6IgCtnYBY1jnFuA00Tdyw kwJBqpTATYwA6FSWPsATq0oZAbjZQYjBUkUEFhBTtaCPET8un8X4py79hQrWpb9QNj25GAud g4W22pxoWjfYtTkxbRY08a+dzEwrqh03NPIBYzhPPRVhBOi+HosKzksYYWDWDCenFm3j4vB1 ITxgYIAejTpo8attqoUWzY6UpmHrdLQOX3aotDip2TFNoAnNnIRNpCEsUudZ7BAKAuBQs5Ol LA+0COychz2zQ0mzw6XZn9qCTd2OTYAV88R6UjICOwYZQbXTyiKwQwq2S6qdQ6DmJjw9OGBB xU4T0CCpFqQvgm5ROggsiqNFYLExwi+xw4XtvdipRhBdWSCjYSW4rdjVCJqFhEZgWHgtAgvS oKTSVgwGbs3iKmiQNIugcGKRZmHIIrDgxAj6CgxA0M3ZQ07Sl7MHN4ugAJzazTwxFE8sAJVF YF7QCLp5wUUg5oywYlo+wbhNcxpYUF84D27mVaoRmJZXIyDDwkVgqAeltVwG4wSlTTbMwoLM f8Ap1IUBbMYwzSpt180qRzMW08wAg/FSV/zKS5/tV1M2sl9N/LbVbPphP9h+V6jN2gE7nVrK QAzEDCzF0gcCsJFujE2tcDio95xsFWJLsVWYPgNOq8UIYvpq0aysZ8CSdeKyA9g6conty2Rr 6mDq3zAkEGYYnll8OezMIDBFPVJiOhD/aGsEQdMYAyoGzv/VXOow/LUQYCBU1yZGsNO/wLoH 3CDYozmNFuMu04PmjmV6QI1heCbAknUGGzDpaaoxILd5YX8HVHAW2MwAVMxi8wNUzAplGugw W7HmQFNs3Uo1DSrMeqZBxYD9TQSu+iu4Max5AECmwfTAJk9T8wEAmTapAZOeA0K3+c9ZbRUY bNoeFSR9SjVuA02xXyeSQq2vxJE2bRMVNTRy79a8tIkcScXJT5tLIqxN0weViDYRWFWkJrRp c6hINhlKDEUChVQsC/qsTbZuIJiAJ8QT2lziRT7qgs3AqzQ9iWHXFQm0Cc2ELjUcZ0CARGMz Wah+NBwE0OzIaBXTioqmJcU6xsUh4je/+fLLymNej999+f2XP/zTlz/87X9+/fL7v/7v//3H X//5L7/+15d//beHnZeU4N8fX375T4Rd+OO3v/37v7u7q+zv7r9zuhvByu7dDYoG1BWuAX/5 aDzpbr+xJ/LTxxPpV8S2l5At5Wyd7dOtj9i2kC2/zrZ/TmrzFlbf4lszddfB4TrE7UeZ1CRk O0K2I2frbd+M2NIVsp0vs6XyKaktKZx9OTN11xFq37jcfjWRGoXaRxSyLTlbb/tCqCIJ2dbX 2Y5PSY02MK59OTP1BuRQ+0Zz1zETqXGofVxDti4wf2XrbB+HyMI9ZOsCc842dEOp1JYUzr6c mToDoiZ2D/iP//3nv3085rWHujb8lm3R9XjPzbdtG+9HbXZ3itDryPEPf/zTX379cCIalu2J 3CrxrUBCB30wo76XY+af5Q1Uve8uofaVnKujBdJCrqHy1de5UsSVN1C5urfVQ7bEpYfLCJGv ud04E9kIuYaK0nOuzuaNUFFGGMjR61zrp0S2RHB25UzUXUaoeex2a4nIRqh5Iw7jcq7e5knI NYzixutc56dEtkRwduVM1Btwhpo33W5XIrIZat4MY7ji4vFXts7uzRBSZhjDFReQc7b8KaHN fV45LmyGGj9D3SsuxE/JpBYpH97wiNi6kPyV7cfb168IVfoVe1EXk3O2oRvNpXbHMve+nJm6 64i1z0N5FKhDqeGNmoht6EeLh8rfsPW2LwKWfoWOtHiwnLMtoSfNpHZL4ezLmak3nxJrnwf0 eMkollqJtA9lyYitB8zfsPW2L0KWXkJfWj1gfoJt6ExTqZU7Zrz35czUnU+ofdVDeiQeY6nV SPvwxljE1gPmb9g621dDZKmhO60eMD/BNnSnudTusPHelzNTdx2x9nlIj0pjIrVI+/CGXsTW BeaaZMbwEmDAtoXutLrAnLJtYZCeSq3yFtZ2cC1U+hZrn4v0LUnI4Y3IiG3oTqsLzF/ZetsX IksL3Wl1gTlnG8bpqdR2peLelzNTbz491L7mIn1LEnK9h8FcD91pc4G5JZmx3kNk6aE7bS4w 52w/lRS5pXD25czUXUecFHGRvidZkd7DYK6H7rS5wNyTBEWnEFkodKfNBeac7afyIrcUzr6c mbrriLXPRXpKEiOdwmCOQnfaXGCmJEfRKUQWCt1pc4E5Z/up1MgthbMvZ6befDjWPhfpOcmN dA6DOQ7daXeBmZMkRecQWTh0p90F5pztp3IjtxTOvpyZuvMJta+7SM9JbqRzGMxJ6E67C8yc JSkkRJa4wtBdYM7Zfio3ckvh7MuZqbuOWPtcpJcsNyJhMBfXGLoLzJIlKcIiQ0+KDC4wp2zj KkMqNdmh40783zP15jNi7XORfmS5kREGc3GZobvAPLIkRVhn6HGdgVxgztl+Ljcydui4c//3 TN35hNpHLtKPLDcyw2AurjSQC8wjS1KEpYYelxrIBeac7edyI2OHjjv5f8/UXUesfS7Szyw3 MsNgLi41kAvMM0tShKUGXDCL2LrAnLGlsNSQS23u0HEn/++ZuuuItc9Dejo1D0dqdEXaR3Gp gTxg/oatt30RslBcaiAPmJ9g+6ncyC2Fsy9npt58Sqh97CE9XUluhEqkfRSXGtgD5m/YOtsX lhooLjWwB8xPsP1UbuSWwtmXM1N3HaH2sYf0VJLcCJVI+yguNbAHzN+wdbYvLDVQXGpgD5if YPup3MgthbMvZ6buOmLt85CeapIboRppH8WlBnaBuSZJCgpLDRSXGtgF5pztp3IjtxTOvpyZ evNpsfa5SN+S3Ai1SPsoLjWIC8zZfQEKSw0UlxrEBeac7adyI7SvKdBO/lMLlb6F2icu0rck N0ItDObiUoO4wNySJAWFpQaKSw3iAnPO9lO5EdrvwNJO/lMPlb7H2ucifU9yI9TDYC4uNYgL zD1JUlBYaqC41CAuMKdsw1JDLrX9wjLt5D/1UOkp1j4X6SnJjRCFwVxcahAXmClJUlBYaqC4 1DBcYM7Zfio3QvvtctrJf6IYck905L/wvnOb9+u356XO86LgeffssV9neuw3ZB77pYtTxz+l 4VNtPAWsUxM5afaTuT3JwJNfOimLcwo+B6sTq5/w70QUx0kd3DumdKTj7NUTr+Tf8vn2Tfzk QobnSk+3n+qH/TzXlbDzXM+z10beq3NcRBkuVHMG1WERhTiE6uFCdc42hOr4UsVwoTplG96q oFMg84yet/pvW6GwdkNfNfmnX//4Z2fM/l6TSeKLaC7CS82WHwajcalkuAj/la0DtWGphOJS yXQRPmcb6pgkV5puKZx9OTP1BhxhMDrdWF6y3E54NYLiUsl0Q2/JkixhqYTiUsl0Q++cbRgO pFIb2+ns4sU9U3cdsfa5gDyy3E54O4LiUsl08XxkSZawVELJpQwXz3O24UEjl9rG0128uGfq riPWPtdBzCy3E16PoLhUMl1gnlmSJSyVUFwqmS4w52xD75VKbe5wbhcv7pl6sc8Val+5PKjH d7hCsXF4P4LjWkm53NjwStIsHBZLOLmXcbmxZc439qiJ4G5BnJ05U3XnE18Lutxo90ryOxxe keC4XFIuD52/4etsYFgv4eRqxuXB8xN8Q6eaC+4+iPEuYdxTzQNQ99RJ+9Ys7buYNI45H/XY 7MLy1hMHN+ITVX13l5rjOstBh/5eWokr5rdllvfda6xkOVdH1G+rE99xDVWsvs61RVwLJQq2 iyz3rpyJussIIa653ZKDGlcOucZvV+Vcvc2LFSV+veVlrm8vQfywyHa2596VM1FvwBZqHrvd kvQht1DzWpw+zLl6m0ch1zh7+DpX+ZTIdl7u3pUzUXc+8WnB7Za8V8U91Lz4I1DFxePsa0zc Q0iJPwJVXEDO2fbPCe12j7w/AsU91Pj4I1DFhfjsI1DcQ+WLPwJVXEjOvsbEPUSV+CNQxcXk lC2FbjSV2k548/4IFFOo9PFHoIqL8tlHoJhC7Ys/AlVcVM6+xsQUAkv8EajiwnLONvSkqdR2 dYL3R6CYQqWPPwJVXKDPPgLFHGpfnM0vLjBnX2NiDpEl/ghUdYE5Zxs601Rqu5TE+yNQzKHS x9WF6iI9ZwE/h9oXVxeqC8ycxd4SIouE7rS6wJyzDd1pLrUdNu7vKLGESp98BcpFeklybyyh 9knoTqsLzJIkwVhCZJH4CrcLzDnb0J2mUttFWt61YpZQ6eMPQVUX6UeWehuh9o3QnVYXmJN+ LrKOLHO2rzLwCLUtvpLRXIjN+X/u5LBL8rzfDOAROvjzCq6fAOJduef9rh7v1794v1HE/fjh De200YKPAp4phTiYJ4l4v9/7bN28ua4iru43F+tjdn5eI+zmQmP8+ajmYtspg3jGOUPlmKH/ bS625WxDKJrxnW8XijK2+Ip/xDap7vN+uYX3OzY8Q4z++g1Lt7rP+y7P124SVyOaB4mS3dyQ t8WI77rHOuYhqmRXKOSKdEzimxvdA9In2EY6JtkHS2VXPmTf3JArQmaJSxHdAyDJbm5IiYIt iSsR3cMvya5QSIlOGBLf3Oge/j3BNvK6udR22UP2zQ0podLHFYXuAbJkJQUJSwoS39zoHp5L lt2XGiGcxDc3uofnT7CNYrwnpCZbWHfMIGFtROKbG91zEJLd3JAaal98c6O7wJxdoZAaIkt8 c6O7wJyzjbxXLrUdDcq+uSFheUTimxvkIn12c0NaqH3xzQ1ygTm7QiEtRJb45ga5wJyzjd1p JrUdusu+uSFhhUTimxvkIn12c0NaqH3xzQ1ygTm7QiE9RJb45ga5wJyzDd1pLrX7nCX75oaE NRKJb26Qi/TZzQ3pofbFNzfIBebsCoX0EFnimxvkAnPKNiwF5FLbh2LZNzckrJFIfHODXKTP bm4IhdoX39xgF5izKxRCIbLENzfYBeacbehOU6ntDIbsmxsS10ie+F8VyL4OIfs6hJTjNA8O b9NuR1vOBOJXRTZ/P2Eyz2nm+7dq4nL/axkQfi0Dwv6rGXe3n8pH/Y6Kstftw/ROybrF7978 UK/2Uq/+Ui96bTv4JWbyUq/xUq/5opxT/UheJXjXTU6t4WfP5IunJXLKIz//y8dY8bbe8F33 kbL2VO0J1jNifXLXPmtPX3PWby8xfMe6pqw9pX+CdQtYHxX5+cs/YLAVWH28exvSZUdr+7KB vC2C/JgWvmaWR+XHDzHLen1sYPUlZu2lXt3pJSd/6+oIuV1LoiJvP7n0XXfKOPPrnDng/E45 70jk43F2BPD2BsOPyVlekthweo0Tirn7Nt19m/G+jbdv/H/HOdWV4hnQE6wjZRlXqizFs8In WEfaMk6u/Qm39eOsR8h6pqw9OMhZv/0fM7xnXVItKz6mpKxDNSu5mvmYlLIO1azkauaDUsr6 eVAa1+WC0tj3TMautoxdbRn7f5Ix9olp7Hvs966eNb7m6FIoc0JJD8yefdXrvZxqGtlUD4nG uZngyenty/6xnO7iwMfjhFpe02h4r2Be77smsdl4kxr/vnuOKi9zfvPW/fvu7/fOjwrHzo6P N+l2d8DwyPndKs5b8+4GNLdrzTaAnt+AO8n+8Tj95XV3d/Kp4MntKsm6+w8I/s6Of7zu1+XN 3uR7Km9xu2by7j8g7x7Iu78u7/Fdr/8HgnknJA0KZW5kc3RyZWFtDQplbmRvYmoNCjI3NzUg MCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5kb2JqDQoyNzkyIDAg b2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EaXNjPj4NCmVuZG9iag0KMjgwMCAwIG9i ag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQplbmRvYmoNCjI4MjEgMCBvYmoN Cjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5kb2JqDQoyODI1IDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EaXNjPj4NCmVuZG9iag0KMjgzMyAwIG9iag0KPDwv Ty9MaXN0L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQplbmRvYmoNCjI4MzggMCBvYmoNCjw8L08v TGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5kb2JqDQoyODQzIDAgb2JqDQo8PC9PL0xp c3QvTGlzdE51bWJlcmluZy9EaXNjPj4NCmVuZG9iag0KMjg0OCAwIG9iag0KPDwvTy9MaXN0 L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQplbmRvYmoNCjI4NTEgMCBvYmoNCjw8L1R5cGUvT2Jq U3RtL04gNTAwL0ZpcnN0IDUzMTcvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA1OTYyPj4N CnN0cmVhbQ0KeJytXcuOLMlt3RvQP+QfdEYwnoAgQIYNyJAXA83sDC/G0sAb2RYMeaG/1znM iui6t4tkdbUNSKLzVvAwGOQJxiOz86jncR55lHnUyf/tR8oZQs1HmoVCO3LhP9V6yKmCHNL1 N/0oRX8zjjL5T+08auWTlo52Dgr5aI0/bnL01CiUo3ditnaMrD/ux+jafBxTBALUz9EppCOd hc16OVJS/C6QGpX3BmslUaqQJrX2cSSpqgR9KYnY44SEn2TCpCoKSmkSYwCjn/zXgU73Ri0D GEPNHcClGZCgeWZ9Bs1zUCLkqe4Z+K/LvgFVSR000SyrLRPPRB1Cp4paP/GTotZPqKonfjdP 6KtV/xWqWlIJRjYYiX/Ff/Wqv6O51DfPcjkOEvRN0d81DNWlr0Oq+q/jkJT02YSE7ueZzkMy h2DCTZK7PsPoiuizAmnoMwx9KWyb0aLQoJmgpVZCIl6k4SeQEiSO7YRS6aItGC2DFsB1Mirt y9BHI6EFVs3LFgTTyRicch4lJVqQJyT9V8lHyXLrYMmqD0YWUX0AKuWkVdIgqQVSj1I5WjMj Oqv2Q6CvaS8Fz7rQ5gJ9fVJfAcZg9M4CC+gcSMCYg7joPoZIf9eOmjgUs1RIVXH7UXPWFsgk udoOSI0WwMhaMnGRbrUwQCaGEalCfXBibRzGiRSrrVEfzKg903/IyNqHaoE+hjwkPJvqDSbc nKpvIuPUG0y5y3/MwqTeQNK1rOOBPGxZvYHMbqIjCMhWikp4VtQbcHurTfUNpHCiVUiD1gb1 QWnrQluQjXAp9SHkG1kCLerROLR41o5+apwi/frZaBUytKes+jqkQaugtOei+ubRRUMZbgcE 9SH4e8m0BSzQy6AWOLHXrhKeNaFVyMvepuoDbmdeTnS1j6T6gHtlCvKyX5mC/O3KNBNmjLNS CzJ0pKISniUm55zkKo1OOHuIRjvcNBDalEBgBeGIpDshaX7AJXAGbUGegw9vKTn6lZx41jFQ kKBvMCFOhMAgGUGCPoYepHZMKoU0IWHwhO6ciel3IgjhZmpBB2fuKuGZIOQhFUiT+pDTUEcq gBmIRupDFxABtAUDhZihPgwyRpu24CfwNbXA7fCNSnhG+oIEfQxCSGDHk/ohZoqNepB2SJBC aPQM4tTfgj/xTwTH6KdT1CfoCMTOZnKRvYpg7LOqWxC1EActEKI1dYwQratnhGhdOy9EG9p7 IdrQ7gvRpvYf3cQsog6AeQmyiifFSnMKJ5es3kVCQOy0AYkO7lQvFM5Dom7gZJmK+gGhCwXq ByFE7VRWqbepkwufdlLlyak1dXVzpQ1DHVWpl2wOkTZMdVTlDEd/Q+QUd6qjMDCwsaiyyQlb 8kXzENVRyFtMjJV6oSblovMAogdip16EXsqkR4jUS34UpmfKrahlLAS6Zm5WUUkh0RwmjXCg k5oqGAaISSE4X2NcCcxpWjKnjhNjA/EC5vSM/+NT6JWifeNELqXTdM7QUtUl11Q+aSTnaHAB jeRkLp2T08lZWnonMKduGeoH1gLCGRdPqXeqq/FfSOpCGziRFwQdRa0RKoEni4TMKQxhQ1GH EMmbigiBEUsQdeRZFJRr5Cf1Vg2uyaftpA2TelvTkqmx+FC9k3r7oIZJGwbN4VSSyqQ5jEaI 2k1wT6pMKjyF3pqSinzK4gci9FZWPxArRfQF4mCBU1UvbKiFdIMwp8jMYomSqmYWkpHiuBUG iP+uIp92shnCmCKTl/MJ3MThRuyyckqqt2kRRcuYx40JCHFQZOohqyACmiOPZi1r8iIjEqYe /hakklrRkiTzt6XpUwC3ymIjkWFaHSpSbyu0genf2mQzskbrVTXQhqE+Y9A2DYJENmqcsfDb wlJPVINQnCriB13TP5FAMFYqDopdIaCsaxCQ1FIvHONEUuiFsZNICr0mFVlDVtI45xCUk+x8 IimAolQD9fZJDWQChAObkQn6VaSRKjrnWogAHqQciI0VadJuZopDNbBOFW1GAhnCGSKRKsAq +pTNSqcGpjTqemogVaBq16dAQ01O75AfUBfTZ+QHFNX8AQcL0xKDgFQxWIIIQzCNqS7hwA7O hhDR40n20QIzTXZLWIGgcD6pl/wwdQ5ITFNMwoRgbY8SiqZ3XXcIIUgKKJiol1SB2Yo9JinM puYw51G7EIL8gFJERSrrTFOWFqjTtRdkgjmvZgRm7QERpHYqKSQWAadOB0mL+qSeZKGEJKTI ch1zGC1jXY/JSI3kD674ZeFxKqfqyum8goDFGZiXaKwkzqYhxxLh1Ak2kVhBaniaWbKfXE1B JJqW4HQcRNqbWSUmjd/McjeRXCBCb2IwQeQqREk3k7uRBoki7E0s6iGib4hRilwMIMImRaCR Ng4lbPyHo5lZQyaN38zyD4NHG7gqwoDQhkS0wcHKrPYSlzQQicZaFmsL6M2cPYXEiv+c6bbi gBrqZYmbWThDbBQH9SL98S8MLjyAqPmWWTJmzTettDF9URlLbSyU1NWTIkdIS93MAlB01YC1 EtFYsOpyEyIhdOmSWdRrPQmxc5nGeMgsAJVv8XRSVGAWjdoX/AAQIknFTJHzPOyDyFpfSHUQ mWSYdCHqJKFFrugkoctq0UkicyGARbUCE6KrH1icy1BXs7IXLmUgUi9rWNG1ZWHxAZHrdLI7 xEpR9XLpV/LVrFNUc1jmol6lOazwsbRTkU8LwzM36q1kxMzFe2m6PmQtjvUT9bKQL5pvmeuV ovmWudgp3FIQrZWLLiY57wNRPcm1XGXNIixW0SkdAK6uKxMbIvRWugCiUOTkw5kYXSVrsByD A5JaNihq/DILYa6KfNo4v2WumWvj/Ja5aMFqgUZyvYH5hHq5sKvcmYBIvbpEpYsgDrWMS+8r fkkVLWmKkCpa0gEgVbSsKUKqaKJLalJFUz7LpIp2xQNJAYsr6iVVNK7+hIQCv2kY6UK/a4qQ KuBpGqkbAUNDg1TRlH+FKd2Uf4Up3bgugQi9nYWg6BKqJyUQUlAnh+Ip9HYOGUQ+FVKbbkx0 GaoXNnSuBUUXsb2eqndSJK8LqQIrF+4NMNE714P4AfqGBReVkUAQviryKXdGIFIvl7oiuq3C VQxE7pewaITIrQ5O2yKkikEWhsjNGOYMfsB9FFqCp9zzkKkinxaSjejWjE7CQgIZXB0Kl0Lc fFK9Xfd9dINDt4oY4JJ1z4YBLrrzxb0krVC5L6Ni1s0VGqk7Bqz+9hYJjSRrTJI3RN1wYICT vrhvQb26bcClIkTdN2CAiy64q6iYdH1PI4su3JlDojsuul6Ua2nMAJeiK2IGuOj2AfelhMnM lSst0xqXa0i5VgAsRkVLwpP1gogW7VrkcPnP1RiNrNdii3q1XtOlo1yrGz4QXR/p4lFIrFgi UJkuU1pTvVNXADRSl7adOSS6GNAVpDStfBngWqecuoZU3kxcXYpo8XdqgNerLFVlV9Gj4tA6 kEbqvE8X/PrXbz9cW5jn8Ye3H9/+9R//509/e/vpb3/55e3Hv/7v//3xr//851/+6+33/3bM fz/efvhPVij85W9+86t/WE37avovj9rla5f0D0Zz9PXW+u23VDb0/32o57Ix0vPDo8bptKzH wAUdT8lsK1HP2/M9R5SYPb+MfK3nOWr2u/yo3XZY/hTaS63yS63kpVblpVbbG+VTTkxRM98d n2olRituvwcRXqymbQYB3vN9YH5Algi5vo5cXOQwq9vryM1F7hFyfx15uMghhY+XkcfpIH9H ZP20ieyKxR0ae6S243Y/Xku4GTYTf3r4VMql1/I7WQnOo7FoMjLTfNRoDN3oGWH0JJMmQuj5 ifAZzQ6fsWJkPBUjj71vcs71wHWByRozRy6oz7tgiu2C6fFe0HOTeWY8+CZ3zKD846ns8z13 yr/5hTG3eIFHBkHPs8UNPDIOev78mHMH2+r5zcjXaokXS5CwBnlMpNmipwDOopZni9T2OboP mxW3LrOa+XXZp1oVoxVvDjjNqtls3Jr99LvHMZa/ydLvm+fkobbXUbOLKh5qfx21uKjVQx2v ozYPNS0a/ckggWvg91hs92yLTc1tG/bLz38ylN9qg3s3uIE2Te9FbhA30MQNtGQl/B3sPxmw bqSJG2nJIownYN1QEzfUkkU4T8C6sZajWMsr1mTFmqxYEzfWZLgdsriQN4CCqJkebDldWJNM g3Ymm76ba/i/LL8VN+yKH3Ymr8b4btgVP+xMYo1hvxZ2V/TscdkO2iabHfLDzuTsEoVdccOu +uFjcmSJ/FiTC+vXUiZHxrDiwhYX1uTIGNYd2zBqyoqauqLmctA22exQdztksm9tQdTU4cK6 E2s2OfId1vBjc2fW5s6s2eTIGNaluOZSXDYpNob1i7goampfMbLmurY4u7lp0JrbIZOzWw2i pnUX1qW4bHL2O6zlR5fiuktx2WTWELa7FNd9ijOZNYZ1xzaMmmvw93BsB22TzQ65U66YnN1L EDXf7kZ/aO5SnJic/Q5r+dGluO5SnJjMGsIOl+KGS3FiMmsM6y9To6hZe9xz7XHfHLRNNjvk TrlicvaQIGqGO+UOl+LE5Ox3WMuPLsUNl+LEZNYY1qW46VKcmMwawk53bMOouQZ/D8d20DbZ 7JA75YrJ2XsP24qa6U6506c4k7PfYS0/uhQ3XYorJrPGsC7FTZfiismsAay+BPGVqJlrxTQX 6cxFOtNJA32pwuuQwdn6GoUXNfrehgfrUlwxOPse1vKjQ3H6aogHazDrM7AOxenbJx6swazP wLoUF0TNGvw9HNtB22TLsOROucXgbH1Fxo+a5Ey5+k6OB2tw9j2s4cfkUJy+9uPBGsz6DKxD cfpmkQdrMOszsC7FhVFzDf4eju2gbbJlWHan3Gpwtr7u5EdNdqZcfcnKgzU4O2xnUuO7uYb/ 8/KbdyKhr4F5+CZHxvhu2GU37KrJkTHs18Luip49LttB22TLMPHDzmTfHIWduGEnfviYHBm0 M0kuR/6XFXbe6YS+D+jhm2wX47thJ37YmWwXw34t7GSFnaywkxV24oadf8rQTLaTKOyKG3bF DZ9msp1EfixuQVfcgq6ZZBnDugVdcQu6ZnJkDOuuWcOoKStqyoqaskos77RE33n1OmSyb/EP YPW9Wge2+if9JkcW/0hSX9z1YN2CrpkcGcO6FFddimsmxcawXzkJW4O/h2M7aJtsdshdYDST s6t/EqavSjuwzac4k7Orfzak72J7sC7FdZNZY1iX4ppLcd1k1hj2Kydha/D3cGwHbZMtze9X RMxbcLc7B/sUeB/s7bOavf2+d1T3Jtne99hL2b062fXinsE3Ke88264z7N9h8NPP//HnXx6b n5axq0S8H0+XMhfo+D4KXA74/23ln4ecr4Ed+pmBO7d+aB4FXFvj1NdY9jW63x6HfOiPO1sn s5l/hqZfRfBQ/TO0GNXy4vRQh7+//DLqt0cHH1Cfu174edSvRUxf20p9ZfZYoTPciBn+YsRs 5p+f6UcuPFR3LdJiVMuLw0V1S7/+Muq3xwbfN59u5TdeR3XHNYyYsRZZt8v/yz3bYrM/7iw9 zWb+2Zl+s8RD9ZnNpOrpnybpR1E8WP8GlMmoMazHbfzigwdrUmoEm053aMOgmWuNNRffzBvf 3Ew2O+TfyLPYOp3+2Zl+hsaD9W/kWXR9B2v50aO3dLr0lixWfQLW47d0uvyWLFqNYZNLcFHU 3AZ/D8d20DbZMiw9+d7Nh3bB2VlK3mybkstwyaLsO1jLjx7FpeRTnMWsT8B6FJeSS3HZYtYn YN3yLYyadFvZ3IZjO2ibbGoOV12rgt+F2Z5vN4futNg9fQz3xCJp9fX+NYDolRhjYnn69aLv ByvH72OZHLyPaR6/j6UfxnLiay+vf/zLz//9QcF7k7ffH7nctduvLNgmm0S696wtk8Urnt5N 5jtk+LH55u2y0lTUoj7oB8SuMMsuF8aj4Gb5fhPD9qY5P4TQ4k7C+7zDhjaZPIZ2J+J95mFD m2weQ7uT8T6deCLs5327MFPFpOQSmVzcTN0mX2FfzFcnl5Wm28P3XvWbdVfYFz8Vwy65dWd5 nnwk3bWrIfmIybUlIp/q9rh8Sz7VIZ/qkk95gnzWRmAqXyOf4pDPt6/kQpkTV3nN9XnN9etQ Na1TwVtS7zDbPX1pyhRj2ouaGUuHaGIXY8qK4AxujpoZvBpaaZBiBGeWqO8RYIXijdP4KcDv mp5B6N2fKTxoHn+H6HXk5iLHc8/ryMNG/j7dbi+oPNazSty2kuv+bQlbs7flard6HGzlJbBq +a6H82czm0Ys1+vzbu8Oy91/ZOeT/e6vOXm8BDYtT41wekxmQvdoerzfsH4AHRayyczoGNoZ GP1GawRtpnQM7ZLJ81+weQXaYRP92mwEbaTwE9D3W+cfm884zGweCKGdMPs+mYdThI1VyI5V qayt9bS21tPaWk/3W+ufTMZk8Fb4VY4XKSO9xhnJII1o68Lgiye/w/Jh/LN/7z5biZqje/f5 9OqN7N+7z1aSPgHrzD36tWUP1krQJ2CdekA/5+zBWsn5BOx0YfcF7Mc5mdfWXV737vO6d59P l+z26yfmRz2W8fc3HbK/UZ2tiiNHG9U5ucHmb1RnI/HvYR9v3ebkBpu/UZ0N3ngG1g22YKPa KlaegHWDLUXBtjaq89qozmujOicv2LL/9R+xKqi8r/lbUZO9Cir7n/8Rk1HfYQ0/Zq96yv5t ezEJOYb1Kqfs37YXk5BjWHdsw6i5fW5oDcd20DY5pih7aypt5U599czRxa3N7tA3rOdfpN/h m79zjUSkJ9+Q3ofm/plujGqMpzQX1f+oxeuow0X1X/h+GbWcLmoUu+umfl57cnntyWWZnmb/ 7nwxm0URU9yI8a/O1xjV8mJ1Uf2b86+jdhfVnST766juuIYRs27p53VL/+aebbGl2b83P8xm 0RRZs4vqTpEzRjW8WIuL6jObSagxrEtt/vd6ksmoMazPbVHMrDv6ed3Rvzlom2xp9m/NJ5Os 6wyCpiUX1l8Xm2z9Dmv4sbns5t+aTyapxrAuvfnf60kmq8aw7tiGUbPu6Oe1t31z0DbZ7NBT t6cetAteDMrdnWy7S3DJZOzoDnruLsN1/0KeSawxrEtx/vd6ksmsMaxfvYVRc9ugy+ui/c1B 22SzQ0/dnnrQLngxKHd3wvUvv2eTs99hDT8Ol+L82+/ZZNYY1qU4/3s92WTWGNYd2zBq1mX7 vC7b3xy0TTY75K8mTM7eXxCyoma4U65/AT6bnP0Oa/hxuhTn34DPJrPGsC7F+d/rySazxrDu 2IZRs04F8joVuDlom2x26Ml9tw/tgtd78nSnXP8OfDY5ewbvvOTpURz/gpgDKyazRrByehQn /rmBmMwaw/q7GlHUrBv3ed24vzlom2x26Ml9tw/tgld85PSmXPHvwIvF2Xewlh89ihP/DrxY zBrDJo/ixP9ej1jM+gSsS3FR1Mi6cS/rxv3NQdtks0P+J/IszpYUvOYjyZtyxT9aEIuz72At P3oUJ/7RgljM+gSsS3H+93rEYtYYNrtVXBg16yBD1kHGzUHbZLND/vejLM6Wfb/QiprsTbni Hy0Ui7PvYC0/uhTnHy0Uk1ljWJfi/L8gUExmDWHlS7vCsg4yZB1k3By0TbYM888RisnZ0UGC uAcJIv4n8kzOjnbXRVyKE/8TeSazxrAuxfl/QqCYzBrDfmlnWNZZwm04toO2yZZhxZ1yi8nZ JdgalvsL6Q+a+xRncnYJdkuluBTn/22BajJrDOtSXHEprprMGsN+aW9Y1tsDt+HYDtomW4b5 f1ugmpxdgr1hqW455f9tgWpydgl2S6W6FOf/bYFqMmsM61JcdSmumswaw35pb/g2+Hs4toO2 yWaH/L8OZXJ2DfaGpbnllP+3BarJ2TXYLZXmUpz/twWqyawxrEtxzac4k1lj2C/tDd8Gfw/H dtA22eyQO+U2k7NbsDcszS2n/L8t0D5y9t8B/YD8DA0KZW5kc3RyZWFtDQplbmRvYmoNCjI4 NTQgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5kb2JqDQoyODcw IDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EaXNjPj4NCmVuZG9iag0KMjg4NiAw IG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGVjaW1hbD4+DQplbmRvYmoNCjI4OTMg MCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0RlY2ltYWw+Pg0KZW5kb2JqDQoyODk4 IDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EZWNpbWFsPj4NCmVuZG9iag0KMjkw MyAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGVjaW1hbD4+DQplbmRvYmoNCjMx MjMgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5kb2JqDQozMTMw IDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9DaXJjbGU+Pg0KZW5kb2JqDQozMTQz IDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9DaXJjbGU+Pg0KZW5kb2JqDQozMTUw IDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9DaXJjbGU+Pg0KZW5kb2JqDQozMTYx IDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EaXNjPj4NCmVuZG9iag0KMzE3MyAw IG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQplbmRvYmoNCjMxODAgMCBv YmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5kb2JqDQozMzcyIDAgb2Jq DQo8PC9UeXBlL09ialN0bS9OIDUwMC9GaXJzdCA1MzI2L0ZpbHRlci9GbGF0ZURlY29kZS9M ZW5ndGggNjIxMj4+DQpzdHJlYW0NCnicpV3LriTJbd0b8D/kH3TGmwEIAmzYwBgzi4FmdoYX sjXwRrYFQ17o730OKyOqqu8lWV29kTjRFSSDj0NGRGbeUsZ5nEcpox698P/LkdIk0Y8kmUQ7 chEQfRzlTBzBv08l5KgVo0XS0RLZyHm03kmUo2fyAY8ujUQ7RiUfqYecldPHIV2nyzGbEuNI Z6Ie8wQ1lNOERoWazEzdyAvSU25UYdYjlURuE5pzNZgB1WtRLuDXslIYa1S8TPDrVfkJKPxP qVhWGj2RglxJgxT4CdYDCnJnoS4QniYYYKwf+RSlYJ9UGyk5MgZJDVAdWlVYJZes/CbtWDiW j1xrJ5WO3MAe/1pBdXJJ4NebUhgbiVpBoTyG8oNcKdQKXsoylR/kzkpdcqKLyC/jJ2enLjQn TMQxMMhZKYyBISkuq5JfbjczgeK0pvzwk5aoC0W2wX+gV3uhLhmC+iQXGnuIUhiTSq0Kps2T /Pjj2alVGQesqfw6KKEuZR5YKfkhyqA3dYG60Ixc4ChwUgpjNCKoyrAjPwiqTdWFOaEy+cEV tTMqK6KtDoYlg7QOxiU4HFW4hIrwqTMphbE5qBUEtbPo8jOoSa3gCpiA/Fo9WqY5K/6zZUZn bf1opaguExSjs3YkQZV2M2JrjLWK5bd+6r8mpoiOgd9Qa2CpMK6OgZ9oNCEY2tTYaAJKY6PP A0yUkqMn9fRIoFR7BH/PqsvQ7NMxpF9pOtaOXtWXzPWb/ZB9vRUdA7+uuiAselddEPx9qC5I nC6qi6az6gLn9Zl1DPymrhfhPU5dL4wD0+vYAKW6IC+xXJ0xj1FUF6T+KKoLnDc0aCpyf9Sp Y+DXdL34TySozgWOdF0vgnUM1QXsYT6dAX6iuiAwx6QuDSElp+qC1JWz61g+JHG9DbkvinQV 7pZcdawdUopSGCPwgAJaMRhA9UNa0jHwa0PHBFhG2zckrHSul4goo+nvyiGSdAz85qkUxjQr GnJ6alYw1eYpOgZIVFRpyP2ZafuGnJ6569g8Zsn6uwyK683I0EknYxz/KgSABqZTiBsNuT8n 457pAghTfkTbk6nSCuE2JZ0zSaoYrCedmfnVkJEgCV/E03QW4hdDJ53MZZCVJDOwFfJF3JME 7J6dWYvcIElXN2QYwF3BpZLvmBRcqYPGPjIK5CSUtkwd5lQSv8WPqUNlKUg3DqxYiVDSAAwY VHWQ+yBVHSwQBYTVoiHTUyKuYpRlpaptGplRa5AU0aaSZNY7NWsUMdSiUA+k2qGRFPUWUACV 6caB0m72Rd6mfLLmNfg5ZViNJGtX6kpCRM6E4Ib/BilKglkuxHMWhJQV9BqgBKSaD1mL0NXQ 6RTRE0UMiuhqnUERoyhJEYOw3ljaszQlKULBj9ELcswbvKei6dsAAqgZGnVAAZAaD/gVKrFG KpYNUigYpk+oIbpM/oBVDaMsx4rNwDOSajOWZlQPjrLCo3yoCE4b6iHWeLQTdAuLPDoCnUZ1 tAQ3lnnUa5qatR+llhxY1FFX8YN+clTjoSOAUtV46MhekExLojDaAzgHJJmx2oCE4MrULsBV kp11LvG3nYWzJ/LtoiR/O5g4HSmTqiYboxzkTQRHZ9NlQgegCGNHu5FEGABgk2Q97alrj6Ik ODTtsehSkGxJOjOgafHuzNhGXIYNoWRrujYmL+KDZOa0ztrds3Y8hCTieoIfx61wgxzKgb+d ajNmLDRVEr+FDbXIwzpYKzkQCaAeOTD9wZwcmJDgqCJOdlU3t5DDpSR7LW27OrO7a9/QmfO9 M+fZhyXUGApmHqPIcMXM466R2pmmfSYd1XaNDWNnmo6TPUlnSo9TVWeajqSqM6WRsDQ103Rk tkKdKQ2LqA6DJFuWDulpsOwVGg6lVG3G5B2NAd67docMT8JBGkMtyYwdQy3J7Eb9oQ7MWBQg 6sDsRgVSHSANJUiZCcmpJEcTcbIPtp05Kd9JkmFPsEyoQ+TLlL4Vos6UvlUiZnuSptYhagjT HaPkS/EgOarI1Zm8osjVmegCbiCZvKJtRmeiiwZtZ/JikHyZ6PNU6xAqUJTIjHk8szpAOKrI 1WEtoKA6gBk7qzqAiT6rOoCJPps6gIk+mzqAiT7p/8L0QpRpFmqvrcjVmehoMK52E+iqOcSW fs5BJZH+aBw1uGBZkAyugVjKZ2LzOJCQqKEE0g4AATnUx2ziC4G0w02AatpsaGvP4giSo8Q6 kBTBn4GkCLIs7M5BEszZaKL5JxSPRBFCCBrs9U9FrsEW/9Tdw2AXn3T7MNjuJ+1/B/t4FAwK ZsMPOKNgOA9NJ0F3sOVP3GNhNHPXQZsNuAnkVMEQkVhhCvtKVJmmJEfVqKy5IAltSAmQQl+M TL5CX4xMHabyBcJgO6PT4GiQN3Wwtqyd04C9Ub2SkhzN9MXAWnMu9MUAloBUXxTujar6onBz xNYJm07yZeXC6OSWifWCmAWStRsNIcihlqwcFdZY9qRoctQBlTpMQgXxGBGZlG8nyWYIjSTI RHjl7hMkm/oBCEKnzK6eDRrVVZKj3PiBrCS5ZQAegGQfApJ8G9sttKUgCWUgyZfuBUkdBsFx NO78hDst7ixhhqQkR6c6AFGD2k6wGZ07wpNgw342o00nX0Rjrrd4AFSAJNhwG5OxzVLNJkkN I/wT9pRD+XJUu/oxyLdpaMA3uRIBCzeS6CQINmNQB/4vSPIVjVRu+VHJVDOsDZVMmU1uVjUD ACDYfhOr6RuQmjgITLT3BBvCDEjRbSF0QENHzWC43LidBsn9Lnc2YIa1NTZ3GCVf1l/dTYIk 2rM7hKuK8qUOg2AzJvkKwWZM6qBdNfCWJMFmMNFR1lWzTlIDHACChmkoydGse1cCCHZM4CuE ituWaRBLOrf1hZuffCtqLFHowov+tpJkSstJabpvH5M7+KFIoKNyKkkOk4YSwgrQSfl2knQA 6zMyiD26EDXAgL8lVCCDKZhQATMoKSSJO6JnA7qjZxsCktYRQgWCWEnoMLQHF8LVGDcO/C09 XbhxQo4xRYRYAiMrydOHSSxhEGfRcsAiB1I1I8KIIhcXmEUjVYgwUogaQiwRhVfuuLNoe8DD C5C6YgKIaI8oBBDRcivEHVHkEgKIDF0bYUUYg0WIGsLJhTUM5FSSgvUYSZjdKF/620xS9SVU IAl1dJLk4Ykwu2dm98oCk2fRVTC7p54mCZFg6qmHMLun7kzZnAB2VEkm+mR7CL48iWHVAMnf Dg0YpunUQxEhVEwtt0JQmLqtF+LFqZGq259TI1VouFMjVejoM7NPFQbQqeVWt+Eoehylpqee 3gix5eT5BUbJQc9vhNB8cmNQdD94aiemzfWpnZjwNOMk1oEkX9GAYSKdykdP6k7dsOqpWNIe XOiQ255Md0LYaFEHAjZ2QfpbyEG5oA5yO4miDtQ/8dCx6GY96fmSsB9OVd1CUEu6ZxAGRerq N9aENNR8VJoNGknyZej+7ndffr4dVJ7HH7788uXXf/ry69/+8tuXX/76v//3H3/95z//9l9f fvxXHjwm/uDfji8//yd7Af7H73//9393TcdibtN//mx2z9a8WGx1xTZXbHlfbHfEsoe7pv/h 8+kIAfyAfM5FlEU0d0HiLqia8/aCfjAWND2xcrpiWyzWsKO4USPZFdvfF1tcsdUVO94X6/k2 jpqxokZW1NwMtFU2FzTcBYk5rwdRI+KKna7YGYs17DhPT+xMnthxvi82u2JdiBvpfbGeb+Oo uTl/u2MbaKtsLqi7CzIxe7YgauZwxboQN0zMvou17OhBHC+pPLEmskZieQ/miXUhbpjIGov1 fBtHzc352x3bQFtlc0FuyR0WZvOyzo0a3g56Yl2IGxZmP4i17OhBHI+RPbEWssZikwdxPA32 xFrI+oJYz7dh1FzO3+7YBtoqmwtyS65YmM2LWD9qkldyefPribUw+0GsZUcP4ni57Im1kPUF sS7EZRfixELWWGz2fBtHzc352x3bQFtlc0FuyRULs3nJ7kdN9koub/U9sRZmP4i17OhCXHYh TkxkjcW6EJddiBMTWUOxxfNtHDW5rBhZoJMX6GQ3DYpbcsXE7JKCqCleyeUTG55YE7PvYi07 uhBXXIibJrLGYl2IKy7ETRNZY7Geb+OoKdeO6XLHNtBW2VKsuiV3mphdzyBqqttOVRfiponZ d7GGHasLcdWFuGkiayzWhbjqQtw0kTUW6/k2jpp67Zgud2wDbZUtxZpbcqeJ2XUGUdPcdqq5 EDdNzL6LNezYXIhrLsRNE1ljsS7ENR/iTGSNxXq+jaOmrR1TW6DTFug0Nw2aW3LTaYJ2kyBs uttPdRfj0mmi9l2uYcnuglx3QS6dJrjGcl2U6y7KpdNE11jud50PXwGwPbJNtHU2V+SW3XSa wN2DA2I+JunIHS7OpdNE7uikvbr3Cnx2y5VrAmws10W64SJdOk2EjeV+1xlxXTcLdd0sXCba OpsrcktvOk3wHsEhcR1uXzUCrDPRewTnplVcrBMf65KJsbFcF+vEx7pkYmws97vOia8A2B7Z Jto6mytyy29KJnpLcFBcxe2txMe6ZKK3RGen4mLd9LEumRgbyp0u1k0f65KJsbHc7zorvgJg e2SbaOtsrsivv8lE7xkdFk+3v5o+1iUTvWd0fjpdrJs+1iUTYyO5fBzfltvOAOtMjI3lft95 8Vy7qLnAZ17g09xrk3b69Tdb6N3O4MC4nV79baePddlC7we5liU9rGunj3XZwtgX5HpY15KP ddnC2Fiuex8QRs4VANsj20RbZ3NFfv3NFnq3FBwat+TV35Z8rMsWej/ItSzpYV1LPtZlC2Nf kOthXUs+1mULY2O57p1AHDmprDhpixiLcM8W90H4r//4P3/626fMc7laprxOjPI6BMhrT5dX i55Xx5VXAc0LD8sK77K0Lflq48sSUep6CqSui/22HhDp685/7Mv/fZ+7r+j2rcs+SN9no/u4 a9XxJaIuEbXvdnFX/w3mOze3qZ0ykft2+B///c+/GXa9fP4QJ9ktAbsA1K/CK0cFID8VgA/T /XSKpVpBLa5UN5ny21Kfr2C+nl7ctqG8LzW7a93hYCRwXuG17nsu82yNzfW4EVPNaVHEFDdi /AuYFku1rDhcqf6Dgu9LnZ7U6rYL422p1fVrGDHrrqetu57LPFtjk/O+jTIhv617yPZ8/ffM 6hWQu9bxAHL3WZ/fGUayfqifHohH04yTGNPpCxJ/soyUTFzc90w//YvheRcX9wm+LdoEx1B0 c0OjpVC0iZCxaBchWwlFm2AWi66vRPFPX/6BzG7Q9rnjFjiv1uGy2Nb/vSg08DKaZgBelCrJ gKxInJGZ+qJy5DojPfVtZd913Y2aHkZNNlM8Fu1Ejb5yHYk2ESIW3V8P2Nv1l8Fnhee6amnd qetR5GQDd4LIySZmjDByspn0PbLhcCNnxJFjtjGxaDdyRhw5Zi8Ti3YiR1/Xj0SbDU0s2i1r Iyxr2UaYSLS4ZU3iMDMBKhbthNnXqTqcVB0rVddbM1ecbK9tG+4VvZWNxQDEKPn3tP5NVePz Wfoph8gn5tQRuOT5VYqvp88wGsr7krMt+etguK56Pg+q5ejn2xOL4eceq295rJl2W7uvX/7y x//+MPM+5cuPR79P6/vQNJ42HqeFSCWGov0M2sH+/Pj7h+nl0U39tPvB/ny+/YFRDgOtrwOr /nxE/4HVGS2peNP3iXfsg/k4rUYLSAYq6KdPfI2Tu+Ct8c0J1wH354yqa7kQZ/Q7LjcnJCd9 X3BC8nFHnuMqOXGVV1RMl2OYI/rBm4uVr1y0hZpuzux3Dl7YLn+r6J7cLNvvHbywXf520Z79 +z5JidMqlcd5/fV59WHevgawl2qhd88SLLU4leZB5VvwXme3nzPyAq3nsPnVrxfdYja7QbfP ZK0lPb968PX08nphSo8FrcRHQ8OUGQVccVdcnktTcUpTcZOmvFCa1gFjLy5Sh14obmnaOXQF VrWXtN6J6MWF6RxmiX4q64owT7kYH/JL7dmt35vOwdJ6VKCvt4X6eluoZyedXj6yMRvH4h/X fFvDmd/bI2SjNETTDFh/+TTi68Cp7vVCNtpp/UTY6d2l9OpWEf9x+mwieii2uYjuP05/P4H4 drFuvvuP02cTOWOxLkrV/aChAS515du62+7rAffe3AZzHz7/+sNvf/yTwfwC40c7+MFmbm5a aAc32LofbEbiP4r9/DardzfYXj2S+HaxbrB1N9iK1ZK+INYNthYF23rg4HLHNtBW2VyQe1Nf rEa39+B55t7dvqO7V/XFRNS7WMOOw+0Vh39XbwJyLNZtIPzv+hQTkGOxrm/DqFlPp1zu2Aba KpsLcm/riwn1owVRM9wm0/+uTzGh/i7WsqMLcf53fYqJrKFYcSHO/65PMZE1FuvX0yhq1qNM fX1pp68v7XRx02A/Yf35kyUmZu8vDVlRI+62zP+uTzUx+y7WsqMLcf53faqJrKFY9zC6+9/1 qSayxmJd34ZRs5576+tLO30dSXfvSFo/weotyMTsGTyQ1Kdbcv3v+lQTs2fwlE6fLsT53/Wp JrLGYj2I44cZPbEmskZix+lvGaKoWQ9J9vWlnb6+tHOpHDfR9p697fK3EW0H6ZbrYOUrjytd +4S91seWffhfAdp4KF87K8DD8fwRoA/T/afkY6mWq6cn1X9GPr8t9fkJ+Q9S/Rr6vtTiWnhn xedhPdYXgMZ6HP8yz9bYXI9fQs1pUcQkN2L8p+NbLNWyorhS/Q/jvS31+fzr6+nZrZ/jfamu X8OIWY/hj/UY/mWerbG5Hv+DKua0oHqO5wfAP0x3q+eMpVpWHK7U4L3u98W60FZcaEsmooZi i+vZMGbWI+CXN7aBtsrmgoK3f8x5wcs/o1RXrP/yj4nWd7GWHV10Ky66JRNUY7EuvBX/1R8T VUOx1fVtGDWlrBhZkFMW5BQ3DeqLD5d+mBd8MWpUt9hW/yVHE7HvYi07ughXXYRLJrDGYl2I 868UkomssVjXt2HU1Ou48XLHNtBW2eLc3HqbTczelxxW1DS34DYX4rKJ2Xexhh2bC3HNhbhs Imss1oW45kJcNpE1Fuv6Noya9bD75Y5toK2yxTm4dTAxez8nbUVNd0tucBFoYvZdrGHH7kKc f+uQTWSNxboQ112IyyayxmJd34ZRs+44xrrjuAy0VTYX5L8gaGL2/l6QFTXDLbn+rUM2Mfsu 1rDjcCEuuHUwkTUW60Kc/9cEiomssVj/VCOMmrVfWnccYz0XPYabBsGtg4nZ0V8TGMMtucGt g4nZ0ff1h7gQF9w6mMgai3Uhzv9rAsVE1lis69swatYdx1h3HGP9NYEhbhr4tw7FxOzorwmM 51uHD9P9i1UTs6Pv64/pQpx/61BMZI3FuhDn/zWBYiJrLNb1bRg1645jrDuOsf6awJhuGgS3 DiZmR39NYEy35Aa3DiZmB/NMaIy+yz/WQ8b8m1i23uJ/sqeaGBnJl9MLOzndsKsmRsZivy/s 1iXJWJckl4G2yibnfaZg3paM9WLBSPtYaZ8U7M3f7ucXWq7veYz1PY8xdm5sbR2IfuWOZazF fTIruL2zhBnvvxioHYmzUFdS/Lz3LcN+PKo8zgufea4W9sn+tI/xCKq4dwGy7wJM0c1CqRdE e7VNUvjmRbOQKhbt3grcHaVP3kqyHyqWdVIv66RektfnSYqfLpaUFysvjWXf7Jn29Vo/uT85 bdrXQvRYtHv/Ifdnvk3RFpi/INpDVYnfH2gWoL8g2smlrx7nltN+BULW9eDlo22xrf97gNZC IPz8xi/EQUOcAYSROKt9lBKHjYmD+7s9lu+8y4qvfXcdyn/Ox8nZyGLdwNLAYt3EwRJiaDdz /P6eimEx7+bhg8XEsZgDmNHKDZh49WXkW6K9Ki19Pkv/HGdQ2C/Y//HID9P2I/Thm8QfJO6j Wss5T0/Rf5wevplZ35fcXMnhm37tfcnDk7yddIvIZr8/KevRfVnfppenA/ePrOMXKWV98kWe PqHzkVXwypA83a98tJFEmvS3JT+9GfBheg8bm/G25KdjejNnb351vr8j6/s7sh6gl+4448Uv TZmzPn85ar4HPW8ilglZ/uH4vvT/OC84HJfhhrd/OJ5MvIvFZles/4iDCXax2OqK9R9xMJEu FuvC0f17+kYerMNxWYfjsg7HZbjo/fAeiPWykqxXQR7t4AebCUkjsoO4wRZ8zt7Eo7tY4+BG 3GALvmZv4MYrYt1g85+3TwbuvCLWDbYRBdv66IysT+dfBtoqmwtyjxuzgYiYF9zEiLiFzP+U fTYRVYK7CZlOFcO/vvay6n3e/wOoAWl2DQplbmRzdHJlYW0NCmVuZG9iag0KMzU0NiAwIG9i ag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQplbmRvYmoNCjM1NjAgMCBvYmoN Cjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5kb2JqDQozNTcwIDAgb2JqDQo8 PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EaXNjPj4NCmVuZG9iag0KMzU4OCAwIG9iag0KPDwv Ty9MaXN0L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQplbmRvYmoNCjM1OTYgMCBvYmoNCjw8L08v TGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5kb2JqDQozNjAxIDAgb2JqDQo8PC9PL0xp c3QvTGlzdE51bWJlcmluZy9DaXJjbGU+Pg0KZW5kb2JqDQozNjA2IDAgb2JqDQo8PC9PL0xp c3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2JqDQozNjEzIDAgb2JqDQo8PC9PL0xp c3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2JqDQozNjI0IDAgb2JqDQo8PC9PL0xp c3QvTGlzdE51bWJlcmluZy9DaXJjbGU+Pg0KZW5kb2JqDQozNjI5IDAgb2JqDQo8PC9PL0xp c3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2JqDQozNjM2IDAgb2JqDQo8PC9PL0xp c3QvTGlzdE51bWJlcmluZy9TcXVhcmU+Pg0KZW5kb2JqDQozODA5IDAgb2JqDQo8PC9PL0xp c3QvTGlzdE51bWJlcmluZy9EaXNjPj4NCmVuZG9iag0KMzgxNCAwIG9iag0KPDwvTy9MaXN0 L0xpc3ROdW1iZXJpbmcvQ2lyY2xlPj4NCmVuZG9iag0KMzgzMiAwIG9iag0KPDwvTy9MaXN0 L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQplbmRvYmoNCjM4MzggMCBvYmoNCjw8L08vTGlzdC9M aXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5kb2JqDQozODQ2IDAgb2JqDQo8PC9PL0xpc3QvTGlz dE51bWJlcmluZy9EaXNjPj4NCmVuZG9iag0KMzg1MSAwIG9iag0KPDwvTy9MaXN0L0xpc3RO dW1iZXJpbmcvQ2lyY2xlPj4NCmVuZG9iag0KMzg5NCAwIG9iag0KPDwvVHlwZS9PYmpTdG0v TiA1MDAvRmlyc3QgNTMyOC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDYyNDE+Pg0Kc3Ry ZWFtDQp4nK1dy44sx3HdG/A/9NJe3crINyAIoPyABFEAIXJneEFJF4IAWhQI0iD/3udEVWZ3 T3dE1vR4ccmYmsqIyHiciMysqomty2W7xNbLpUT+P19C6CBavYQmvNIvUpVolyj417eA//Df tl1SqiTiJYeNhFxyKSTypUgnkS6lZQ6vl5p0eLu0qES9tJ7Ia7v0rHz6JWwh8pKAquQUAjSK QipRt0wqXoJkVaFcQgzKBAqnTSlcS4XqYCYhi/JroCoVEvArifxkA8VZddwSaiE/gdwWqEuA JVojFwG/XpXKF9mEWsEQsjXlVy8SErWK20VwkddgMynUBYpLFPKLAVSjLpIukhK5RPDLUSlc y51aRfArWfkVWD5Qq0gfVOUHuS1SlwR+rZNfgtyeqEvEj1sgl4Sbw6YUroVMrShShPyoLhiS wi9iUn74MXbqkvFjyuRHpjlQFxosV9zcOKwUUnR07eRCVzS1eJbddHF3qFoNhk271XBL2hgN HcGWgoZDkUuSjTeXDGofkS4paviUCkrtAmkpqc8xGRC0Rsa1slMYW9QfGZyrqlEht0na1UhN bV/xWzVER0znbaMuNYPijDpMnIN6Cz/m0KkLgjCLxgFmnmEsUvgtUoRUv+REE3fckpNGUwOX nPUa8qJoPDdwKRrPmH6u6nMwQEhSZyRbbmpxiMwMQlwD596UCpeyaYQh6zBdagCTlKBjEQJF sl5DqsVNryH7osYf8zoFvdZAYYJpQ/6WHOkKJHABa1LgUmjijQlbIQ0UZLR9bAel1oC7izqF pqsbwgIUMpuxljYkcmWs4Vq/VAQ+rwmoThkwRI10ygaX1YTgAgUuWcgPgV7Lxt8ihWrpql+5 1KrSkJK1qTRkbSUW4Rpk0I24Jpe2RcpAJjfABakAqulYAI6oVkCGFiPnhrBoKVAGcrqluu0h 2rLob4FMuek1jC06AgZrjDBQkLFbCBNstBAocAFJClz2QIdCfdcKuQ+QU84dVKPOyHPgCfVD dgMdSGGCyH9qj+zuxFZQ4JI3yoBIxD59hABGPpAzbkHUkh+SCZGivwW/pvZDYPa+3wesg6NU wUaQTbQH0gmOEwpEBIGslIPQDZiQXgX0QRdqDlVBqiORbJhNUQ7E6RJ1GEVU1SBTRO2UVni1 ZSXJl6gPksO62quw4lBTkJAWglBzOB2kuhlycLGSb+msBZk3wGMhJKE6hXUh7feyWBS1dOa9 RU1debWqrREuQQEeZCSp8VO1smgYVi2AqhmMAWXU+Uh4kDp5/CpIUGaIkABApWaNFWk3H0QG iZHqQOkgSYMaoABSTdLILGsAscrKnoGdzIoGe6Pgqup0MqvqzE7BLR8QGqRrmCP9Q2T6JqoH UgOdZTzCKCS1QhZqBhOhkqrNkNEgqS/CAiRxDWQgCf0S8znExMiCJ0mCD0gyy/RmYK2OBF+Q 5FsoIrBaI4I5LJBvZQYyIUNU1QMLu7YHiQkRFGlBJhZvqh60jmsKBy3kYecLaUl2vo2kKsla nqKqw2KeEoMrsJonTenAcp6yUHXW85SZwEG0QdDJC69W+hi2JdmVL6W1zLkJ1WGHkmBFkowo mBntBDMJJKRlWi6xSwGZVYfEzkN0GKTluHPIJAmzgVmYk1AHIAHIRh2Ypjkn5cveRUMDsyXJ 0IA52McwY+ESksQDth+A3aokr3Y1VCJf1gKQ0KFsaiigQygaGsQAkGooIkFB1JJkWyRqKGRl APqRGfGh7PFAfCiab4H4UDILfCAolMLMYgUA2ZQvdCgsd/Aj+bLe4Sp1aKzZgQBS2J7hBnZh RH+QQpLIFYgPlW4AmUg2Kkl8qJKUL3SokfWHoQKSfUQgagAYqRlBAa0nmTH9AQRK8mphGQxM f1Qc8iUooNOikkze2gL5EhRgaWpGJKhs5kBSh64BTjRqmwY48aHRkSB5NWjiEB9QhMiX+NAi MTUwjxtyhCR0aEmzUFvv1MkX3sVNWTXD3Foh2LAvwU2b8uXVyh4qECpaY/0KhIq9HAWCQmM7 CBI6dNb8RJ1AahNGqOjMLzBrJDXAiQ+dfX8iCGMosgNtWiBJEBOixl6hAJEg2f+DFJIMcGF2 d64BQCaSGuCYFf4lZUa+XAlo+weS8CpEjc7mESQ63I1dA27oJIkEgp+hR6IO8A3IrvfunTl1 QGhDpaA6FJJVh7FhTzsHdNibFnomKEhiCRtj3J9UB0qrNBRrI0jaQYTSmtpB1wFN7cBmfutq B4iE+moHLg9C2DlwfcBEAXxBWiB3XO0kK3XgEiFovRCuEZD41IELAuQ1+SIrMT+1g1BErsqM fLVlEy4UENpUkisFxKjypQ5NDcW1QuBSDCR10P5EkN0wALFEkNcg1VBckwghJzG9MOuoJK8q 6Aqch4tZ+UIHUdCVzMWPgi6qHEgFXfyXJLGEyzWuiagZjAyzMNElk6+CLntYSCDosi2ChYLy pQ7atjN7YMKofBvJTs0K11VEn0T3Q9tAzZAyXHeRGVADJixK8moiKqPSkiSWYLUFMrOHkUK+ ZVO+lSRLEtckMDexRAp1qJWaFS7tmiY6Q07Xf6hkEKE4nihdNDsSHS06rcRGBpZXJZH4IPdl T+WaUDWr5LBrhlSE5XXySGb4Q6OvkW/R6Gu8txIGpZFvY6MII5LUGTeK0M5GGkVo+eJyBg5T X4ANXBOV5FWCC0jwzTQiSOEaVZ3VdbnKJpINPRymPkb+gVQfA1bgUc0h/AzfMTTQnZDUNOVm QubqLBGw4UbCIJasJMk3broOJgxGWjJzQQQSfAv7UpDQoQSdJqIGpOYm/gN/6FISbODnrHy5 lE68l/qD1HUlsaRkmjoSS0pmFkZiSdFOn9ABkjEZiQ+lMiYjQQHLISXJlwvhRBhHTGRlBtUr lxMYFkk25VC5iE+6oOV6nmAIkveKLm4JK5VLcJBQvWq3zcUvyKocoHrNxAc2EbIvkiKxpCpG sXUDqTMmVNTdqLp70JQDU7p25UCEadvOoZJkPESmf2MfArKQZC2MzPmmQRAJFU0xNeq+Q6S7 qTSCUY2q+xK6kIsEBSxm9QZeLaoZQQEupr6ECtQsMmPOo2ZRHWbsXrOILbLXrMhE75sKJij0 TZ3FnO9BJ8Sc71oDIrO7aw2IzM1OlyVGAkidJpEAUK0krypGsR0DqYKZ830PAiJB11VoZHCh ZlEdBhdW+jQJs7s3nQUztnf1PLO7d/U8NEXoJyUb92WY85HbJ1vQWOemwiYa69yZ2nSVTE0R +oSKCJ2QEEHnxhsSWyrdQ8LqRm/AEh8LKE6IuyqbYmoEEoBUtzRK0xWqbqJgvcGr3LzbFK5Y a0Cqu7mXxBUeSXDgSoxkJsnWJ3JzI7BGgawkm27OYBb7moxBEdmEX/BPSLL35PKH+BxIcldK 1wxYhpKsei+lVfaeifsxKF+dJKU1zo0FBr7k3NJGabqzk7gzJlzxJS7kifv18qtfffpq37zc Ln/89PWnb/790ze//OPzp69//OGnP//4H999/p9Pv/8vbkZG3vDfl09f/ZU1mz/8+tf//E/H cKi9D//q2WiJ1ri12OKJrXP4H58PR1jhBvLZBiGDyO6EmjuhZI6bGv3WmFB3xHJ/2BOb12Kf 25E70J5YccWW18V6UcP2yhNbXxfr+nYZNf2ImsMd00BTZXNC1Z1QM8cVP2qYyZ7Y7orta7GG HfcR1vAQPLFxe12suGKjKza8Ltbz7TJqDudPd0wDTZXNCRV3QmKOy4uoCdUV60JctDD7Rqxl RxfixIW4aCHrWqy4ECcuxEULWU+IdQvjMmp25093TANNlc0JuSU3WpjNszQ/asQruVwYeWIt zL4Ra9nRhThxIS6ayLoUG12Iiz7Emci6Fuv5dh01u/OnO6aBpsrmhNySm0zMjnERNdEruTyY 9cSamH0Va9nRhbjoQlwykXUt1oW45EJcMpF1KTZ5vl1Hze786Y5poKmyOSG35CYTs5Msoia5 7VRyIS6ZmH0Va9nRhbjkQlwykXUt1oW45EJcMpF1KTZ7vl1Hze786Y5poKmyxbnMhus33//l l+e4XccCrR08j+Z+9muzBE9UnYky5/5cAW5uHfK//dN3n5/LL0NsPYDkyfDn/jBKzmqYWTLy sNbX//j27w9Dr0M+/f6St5txZYDNl5aVJ6jLW5EDHr/83XPXlzu8eTt8ztSULK9Ljq7ktJKc XpecXcllJbm8Lrl6kmd8fPnpC/64o8VzRqODLGPZWkbmlOLKyKvZ6VNKO6vsolmOi9lmB4Ov SXRMNtmTzW7jUZfZEUxXr/xV3eyoy+yIr0t2s6MusyO/LtnJjrdeK06I1hGidYRoTWc4PwXV +tKothr1W3k2rL8kLBggvBpmRmeLy8A20beFhZeb4wt9Hm8l2gzttWgXoOZ+sS3aRP616OaK 7kvRZlotRfftTPDvadXETqs2GqM2eqbRVx36vxaFRk1bDXstL8MyMZ8Pey0x5bXEFDMx5+a0 3cfJ0cdJnuP0yVJn3Bd//vGnb7/75vPPP/7L5V8v97vyDxr4C4ltc+qWPsN6To9/++5vn//+ 46GM4ep3sBvTMrx/Ylp77OvzuE4eXw8PIPVP3/9sMNsGM7GZXWPkP//2159+eL7E6PM0oZ/K QJuVGBGuT/2ejbkYb8f19zknGuCqTyC7zgkOwOmTzOf0+ObLr4cqBti+g9kffvfNHwY3I5ne we2rH77/+ZeDm5kNp7kNvYxsOGFwOQI4jLTYjzf2J8i9/C+n8qMPZg6YnAlqfRj+SDWn/uqT 6KdjvN+Oe2eMJ6Mg6FPxrsnFjXE56/qvP//wv59/OJQxysw72I1pGd3giWmNSBJn1XHjHzdu wogb+XDchBE3wYmbU6yMbnXVAhgWXQ17UZoBvYthI5j3rbPb+HHT4jqEbcptyYjvrefJ0sA/ W9GXRq5ufRydTupx16bkD7N72329f1r5CNtYvPlN/7jpFEduxmQzO5dOcXQ8dwdIL7CaveCj adrpmIvhZlx6b9UUS4PFycx2t5/8ODqe1OOmTYkfZnbbppjJdJrbbZtiZsNpbm/bp9c5ffGm dfq4Tu3lIBiNUhqpup8X7S+PHUQbRPciZka8m8V7fM85fiiLR329O9B70Cu7i837TLxtpvI7 nZDM+pP9Y5ItO4Cm79N9oJl6nd3bZur90xqRlOsp/7hxk0drf7cH/lLc5BGC2UHAdzVTj3M6 33GkejOuvLPjSGbil0VpLm7HMQ+dzqP/PO17ndkN+mczmU5zu0H/bGbDaW5DLzMbTnP6zcHJ DJ5362RWymUQDNAvI1XLAP0yQL8MlK0+yp7q4cro4cqHe7gyerjywR4uG63B6nDEiKmbYdE7 JzaHPX/86qVRZmDUefa1OjZ7HDrPZp/u7+uL0U6ctOUhpdlfLSU3JxL0zeuFZLMfW0s+1czw TAPM9k3Z57YbWddGdLdTNco99Hu0xPJkycTy63mYZYnm+mB9sGQC/1J0dwGqh6Vos0qsRZ/y 0u7//dTPsN6A3zZQt59Ct+enREuoeY5Q4TWwCQbarHB0ODy+U8vlsOTBrznMhd/3jUovjcrP R+nnFZxhxRzmPzqvX3C4htjjcHfLtL4utXtSg7tubS9LvdvCf5TqOqa/LjW6Fp4PUD9HhcPx 0xfTPFNjk/P1SebP3/7FYH6sp27N4AZaMBJWP6KxsIMbaf7mfDAS/lbs04dC9fMgjlj/JY1g AMYJseLGmv+SRjAQ54xYN9jCKtjCCLYwgk1GsIkbbP5LGsEAQ/0Yih81dy9pPA53n2AOJpou xplwunjdQb8Uc5jLDbvoh50JrEv50Q276IediaxrsR8Lu+Mtj+GXaaCpsjkhP+xM0I6rsItu 2EX/9UcTI+PSjs0V67/+aGLkUuzdHurD8ORuJIiJkWuxrm+XUTMOmA53TANNlc0JJXdCJvom /90g/diSJ9atrGJiZPLfltGvOXli/Te8TYxci3UhLrsQJybELsVmv4tbRc049AjjrCOMI46Q 3TTI7rtBYmL23Cm3oubuBOBxuP/FAROzr2ItO7oQl32IM5F1LdaFuOy//mgi61JscX27jJpx AnG4YxpoqmxxXiwtTcyeu7dW1BS35BYX4qKJ2Vexlh1diCsuxEUTWddiXYgrLsRFE1nXYv11 6ipqxo734Y5poKmyxbn6r+OamD3fArGiprolt/pfHDAx+yrWsGN1Ia76b3ibyLoW60JcdSEu msi6Fuv6dhk19TiiPNwxDTRVtjg3t+RGE7NrX0RNc0tu8/fBTMy+ijXs2FyIay7EJRNZ12Jd iGv+G94msq7F+vsjq6gZhwaHO6aBpsrmhPzHzU3Mbm0RNd0tud0/njQx+yrWsGN3Ia77b3ib yLoW60Kc/92oZCLrWqzr23XUjBVTH6DTB+h0Nw3870YlE7MX343Sz4vaYvltUU+sidmLLynp 90s9sT7Emci6FutBnPjfjcomsq7Fur5dRs3xpsdwxzTQVNmckFtys4XZsvhulH4x1hPrQly2 MHs1zoJGWXyBKcnYwhf3SEL8I4lsYeQJ+W7YBT/sLIw8IfZDYSfjBQoZL2XIePlDght2wQ87 C30lrMIuuGEX/PCxMHI1zgK5G3UN+4/NfHFPJ8Q/ncgW2p2Q74aduGFXLLQ7IfZjYTfev5Dx ToeMN0UOlc0JuWFXTLSTVdiJG3b+J6SKiXaysmP0Gjrx3wcoJliuxXoNnUS3oSsmRq7Fug3d MmrGUcbhjmmgqbI5If+k30TfuDiAlegtMMT/hFQxMTIujiQlug2d/4x6MTFyKdY9ApDkQlwx IXYt9kMnYYfzpzumgabK5oTcBUYxMXuehVhRk7wFhvifkKomZl/FWnZ0Ic7/hFQ1kXUp1j0C kOxCXDWRdS32QydhMt7fkPHaxmGgqbI5IbfkVhOz8+IkTLJXciW7EFdNzM6LsyHJLsRl/2km E1nXYl2IKy7EVRNZl2LLh07CDudPd0wDTZXNCbklt5qYXRYnYXL3YPjjcBfiqonZZXE2JMWF uOJDnImsa7EuxBUX4pqJrEux9UMnYYfzpzumgabKFufr82jmt8yO55su44mT+RDBPBeeR33z 9GZuyM891rltNndC5tp0rhZmAzhr+oTpmXnTmM9ndOKze+PxvmnX2yftpLogOoSWN/6tLir8 P49yQ397TdhF/7rJjVkfhk+7GiFYh5/GuYjU4cv7A5K3nJtbv4M5bHGqJnfP6T8O9x8cWEs1 rHj38arH4f6h2utSiyvV/6To61I/FjFtLL3ayOw2Qqe5EdPd2p3N+SxO1OTuyf5Hqf7qZC3V sOLd37Z4lOo3g69Lza5Utxdsr0t1/bqMmD6WXX3s9fSBOt3NAP/rTd0ctjhN459KsqXGzUc2 E6r74nwpbh60xc2FtmAi6lqsh21x8x/7NCF1LdZ17Tpojv7jcMc00FTZ5DwfRDF7I6kTukZo jsO7Y17PmZ9pU2Q8FvJk1OIJdUvY8xdwglEBVuIsoI3zhMR+scuCyzhfMzFe7IrBg8s4n8U3 X/M+dvJ+fwn1dtz6NTgL9eI8yLBUFhclpsr6Mlo83rl4PvfuMkqrOejfSttDP3hIfMILXubE eVZxwgv9dtzy+8ZigWacBxWmF9wZT5V3LxyvTjxn5OFRnJ/GcrwgA4DERdSlF8StA7J8pVis WnBCtBOKb96vjMd3554HkoyATMMmA6blFIAunn9/O7F5MmEbxWrD4zxMsYwSXXfObWpbtNWL nxDtBOVbfxxvnDznM0IzOhm+sr5ZGfxvKd0Bg5TbcWvTWa1wnM+uW6ZLbj5PlXfbHbvGzxm5 oDgPVRxgSCMbklvl5rGQOSVnJfMQDeaHsofOr7UVYhTMVfAY3fhKXDQqw+o9YhMC8xIpooky eZWu2UGKtw7KTrpmN07m+wLLv86wR9Tt0MUL9vH+lYG3w9d/FyK8LPl+h/1B8rL5lNclR1vy g9fsjwrE8ZpCHJ9Mifd7mhZnf9fIGvU8X9JLwvJrwspLwqrlqLrssZoZHn3h4+p4Qv907EJy f11yciWvv3tvJvNadHFFr797b2bzWrSLI3W9LjPTeSm6bZ7otgyyYKTeGdGn8n1HkuPVhufW G83y2IiIY/v98Nq04ZzRS6kYlnBhfBPkRcAIryFGMCDj7Ef/HxzpPxAfzGTvi9OJ2F2Y8R+I FzPR12JdjFn8IWUzyddiXXzp7vmEmAm+Futiy3W32kiu8fh9HI/fHwaaKpucr/vG1lc+4ngR 4zos+fvFYqEN/8i2a4e0ecGW/P1iMTL/Vuzzjdu0ecGW/P1iMYDjjFgv2NLiryQbuHNGrBts fRFsaexOp7E7fRhoqmwp5n+YR6wmKm2L47AUnpeL/wNDlQa7DQplbmRzdHJlYW0NCmVuZG9i ag0KMzk1NCAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQplbmRvYmoN CjM5NTkgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0NpcmNsZT4+DQplbmRvYmoN CjM5NjkgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5kb2JqDQoz OTgyIDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EZWNpbWFsPj4NCmVuZG9iag0K NDA3NyAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGVjaW1hbD4+DQplbmRvYmoN CjQwODYgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0RlY2ltYWw+Pg0KZW5kb2Jq DQo0MzExIDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EaXNjPj4NCmVuZG9iag0K NDMxOCAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvQ2lyY2xlPj4NCmVuZG9iag0K NDMyNSAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvQ2lyY2xlPj4NCmVuZG9iag0K NDMzMiAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQplbmRvYmoNCjQz MzkgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5kb2JqDQo0MzQ0 IDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9DaXJjbGU+Pg0KZW5kb2JqDQo0MzUy IDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EaXNjPj4NCmVuZG9iag0KNDM1NiAw IG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQplbmRvYmoNCjQzNzAgMCBv YmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5kb2JqDQo0NDE0IDAgb2Jq DQo8PC9UeXBlL09ialN0bS9OIDUwMC9GaXJzdCA1MzIyL0ZpbHRlci9GbGF0ZURlY29kZS9M ZW5ndGggNjEyNj4+DQpzdHJlYW0NCnicpV3NjnS5bd0HyDvUG3xXfxQFGAYSJMAEnsXA9i7w wo4H2TiJETgLv33OYZXU3V83yZruhcecOyWS4s8hJV3d7r2023XrvdTbEP6/3EpZJMatzEFC b7UpiXmrq4O41q2NCaIW/MOI6zauRqKBDfnUehP8D8S4iZJP7bfZOaDOm17kU+WmYsLXbVUO b9etXMUYLVBCRVqFRo2sWgGlVKX1W6mDzFq7lXZRhwbN2yS7BtXJHFwUlBoX8BvTKDyTRo2g TZFFfv3iZKlTBz8t5NchVyd16eC3Gvl1yF3LdIExrmFcYJ/SjcKzelGrcYES47dgvUqtRqUd yQ+KVyoEqt/quMhvNFDDdJFbFVq2LYydhRQmXdXMOfBMzZ74MdxBzlJv7TLzSwFlXCC8FfOP NFCT2sMxrZpcGaDMl/BjuzsTxm53b4rCv6bVBL8hlAbDNrF5wCRNbB4TcqeFBgKlqc18Qq5a JAk4LwuliZ9cl1Fgf5ldFKxKpTQ6pSil8R/VLKmctPFT/LjdR7R7oGGE7H9VMBjmI8UzqZRB d4v5iKEyO/VbYKW0ZF9goEK5C8NWIz/+eKkxHYjjTi5LbqOYrRaelUWtECqjmnXXvI1WoNW4 EPltGr91GwzHTtMNMgBVbmMM6gJjD0FO4Rn4zcsoPJtwGSjw02r8IFdpnAGDjdWNH+QusEfg lJtccDeo6yZIBv7XBooGG1BIEDCk8KzRugP5LI2THhAuDC5QehOyBzVB0b8DhhWp5AeXidDs A5ggkxExkJxwuVF4pjTdYGIvenows69CrSByXtP4yW2WRl3glFkYawPsJ8KdVLnNxjwfSOzZ L6PwjOENCvwoCFQDxfAZSL8phI+B1J2yqAtCb04CCDxwm1qoCxw6lSE18OO5xKgLgFOpFcyp F8NiILu1dGqFgNNKBBn4V61CXTBpbUSQAYNpU9Nl3ZRQ0AemoFQD/xXPBoOLTlYhggxkt85C rfCvOhmdA9mtyugcMJgqAw5xcdPVTRe9rasYFwBhuYzCs8K8RNQAHBn3A1NdlcE/oORqjM6B YFiN0Uk3LoICqH5bw6ITDNaYxgX8RIzCs0m0RRSCUuMHudqpFXJ6LYtOBNJaFp3I6XJdFp6Y DUiLT6AJVLUAhYRyVYv9yaeVOUi0LVcbxhWYe/WLyiFSQVqUKtF+WJgq+Q6LUxgbyG+Bikgq 17RIVfKdlgTKp0rsRaaAXJYGSh3WpJJgUyDZ+C6SFq+LdaRYwC4WkmoRi0AHaSELK6LQWDYs PrXyNhBpIC0fFmsjowkk+YrFLVABJANXLvKdjFy5qMO00IV0ZCpjVy7yXc1IPl0EMGQ0qtnF xBBYHopdBDNYC6QYX+hQKyNYEFggGcICu5TaGMMCxCm1M4gFWQVyGcmnjL1O5ClVmCFSWDtl UslCvrMZX+owGcpSyFcZy8AVkIvBDLAhyWhmXUfNFSPxtFnDIIgPkEwVqSzK1jRIZVU2KBfo X+61hkBTmoE5AIvkNPjG3BrzDDWLfA3PhT1BsxZCrNgbogu7gmZtBGs5SMa2sC9o1kpII19D dWFn0K9e7xWi9ML4Ftb8bsAubA669RPCqt8N2ok2INlRCOu+9RogG0krMp18Dd6FLYK5DMzY c8g0ZuRrCC/dOhE2FjLI1zAeKAzSWgsZ5GsoL+BYhjUXgn+UYThPcAE5TTPMDZhszMB3GNTL 4FPrMARIgUDtxpeNj1Vz4DtJBrhAJ6QCA1yEfA3wBS4F5nTTDHNDghoz8jXMF+Y8koNKIjCR AMX4sqO6hEpOtlSG+wLDgbQAJ2qIIT/jDt2XBTgUAWkBTtQQA39hzguLFUjyNfgXIozQvWhO yNcKgBBhMICaETXESoAQYUQtwIlcsizAiRrTqgDnCtIilagxrXsTIsysZiiixqxmKCLMbJbS RA20O3xKhJndIorINYdFFFFjDoso5vwUCw2ixpw2ISLMnKYZUWOqaUaEmVYTJlFjLvM8EUbv 9iVyqZXVeVl7Kkbyaa02bJBUewodtHV7Cr7aL3sqJMWeki+LN0glqfYUc1NGMZD53vcayafT NCNqqIHuJMLoKvaUfJdpRoRZV7OnSnLZU+iAOmZPMbdVaYdJ1EDrZeRlvTV/QNRY3TQjwizr BydRYw3TjAiziHUgyVfMDkSYZaA7iVyoaNYd86naAgZKw633YUqSNWACCerVbBYIV5AEkIlU rJcBP9MAJIFpNv7WKv6EZUEu6yw5jFmHH3A1wLl0Gq6iQBrfTpLlF7EC0rr1CQAByURHXN0I 9vwtJliLVdPJBQAg1YaBLyCcP+CioVjiTK4u7oVq3hcf7Nsm1xeF/WhnRoA0Z3GFUQjeIBdJ rs6m8Ad3mwmHTTO1UAc1UwuHWR/ABgukmAjlAmeYCK51ijmL9q22LptgjohkSzaFP2hMSAQ/ SSLinFwYcSHX2RiBZGPIjEB1Y8WZQhEsTHjaSZqpJ0VYoqPhA6nsCdDxkeTigD6vdZkDlMPW tB9w6WrAj54QpLVWE8lLxWyYrc5YLxjlIFkvWAXRzJgdoB5KLHF9IqVBWpQof8tWEySZsYBA MzJjooCktGmeX7Z8JmTOxaeLzPTisGUm4SoPHTDXJYgakERaLqZqt8RhkavdEod4DJI1QBEJ MCRrgMJNXE+a6iQNSAEYINntgYQOVrY7DVcNWVGMoIMFqS2NqlkDJHXQbk/JQZc9pTQDJkWS AcqLcVCSpg5SBgXU1IEXQNosKle1lm9cvdZh+aaYCshpzLgA5nIUP5hcAdOFaMJJThtGaWZf ZfIOYijWfpTGcARJaeQDktIs35SZhcbLdKC0ResosxtF2kg8RStEdVCwseC+jO8kyYKtTH90 GcZ3kWTBZo+MdT3TlA0dSLMOE13YindmTxUDftoQfZa5m3kszAOQ1IGT7QwKkLYiZR6jflAz Jvq05bIy0YHd1IyoAWgmM6Y0INRIPr3HA4yMVs4cwIQEZlFJZuzs5gBm7BzmAKb0HOYAgsJk uwWykmRCKvFhMpNA8imtAZJ8F3sCJh1IizMmOiLX+ApJCy7hPkVh06tMaTU8U1i2quED63OF F4zk005oU+a8ciuic+ul3guVMueVzX4nojPlqdkkX1a5Tp+DZEeqRBhlBKHFIt9VjOTTxcqr KNgVkyBf5jEKFZUkgKBQkS8BBIWKmhE1sOQiX0RNXa2aZoskyyKdV++FSokli2vSzlpeF1cD IAtJFgklliwrEmymQFqAL/JVC3Am71ILcCLXWhbgCMF2Xd3yrYEsDHCsF0FWumUBS0By2Lr4 28ZhdBOgj2vsBcu2eyUjoqPu0t3EIZB094INUVm66bBAsgfoq1CEVTKuAEByFst0MKRlCwCS YQTL3YCunPwq3HkyEFsAkHZfctEL3I8ywYskg5ZsWrHtHe4UNfbjfFpJ0qhwA0gu70GSL9dV nQ0+SONbyZeF/1e/+vbTfR/zuv322+++/fTt93//68/ffve3//2///jbv/7l5//69pt/Rwz8 4fbtp/+0DU387Ne//sd/eIyDUvdxv/+Xjwb2+z7pb73hmH8kdn1erIRiZyS2XZ8Xq4FYbkw+ hv/WGX7xB8cdx0BHZU+xeoUTKq4hjkY/fKwRAikSG0ZNq7lYx441jBqEdCS2fV7sCMVKKLZ/ Xmzk2zxq6o6auqPmbqCjsjuhFU5ouOM0iZp2RWJbCcVKLtaxY6uh2BaKnZ8X20OxIcQ1F1lz sZFvn4ia9YiRuzuOgY7K7oQ0nJCL2W1mUbMisT2EuO5i9otYx449hLgeQlx3kTUXG0JcDyGu u8iai418m0fNfcRxxzHQUdmdUFhyu4vZXZKo6VHJ5TliJNbF7Bexjh1HCHEjhLjuImsuNoS4 EUJcd5E1Fxv5No+au/OPO46BjsoeZz0g+M//8+e/f8z82pF4beZlE3VHazsKBKCJJeyW9sc/ /eXnj+NUH7wfk/7D7bX5Q2TcCHXPnNfDMmAcr4Hx3XAJY63kUh2fSw2lhqFWPy+1h1LjYvp5 qRJJHSc9nPgeO85kh7XsWiojnE8YMd0dlkWMhBEzw1I6cqmOFWcJpYaVVD4vtYVSw0I6Py81 9GsaMbIjZm70mruOzjADZlhH1R2WldGpodSwjK5cqmNFvSKpGiObC6i52BDaNIS24iJqLjb0 bBozcxexueubbrjRMAc0XLgWF6x1JEGjMxQbgltx0fpFrGfHEN1WiG7FBdVU7ArhbYXwVlxU zcWGvk2j5u78445joKOyO6Gw1hYXsFdPomaFxXaFAFdcxH4R69kxRLgVIlxxgTUTO64I4vim WyTWRdZcbOjbNGrW3ndcG3TWA3QeKrsTCutt9TCbr+OFUcNXBSKxIcRVD7NfifXsGEEcXzGM xHrI+oTYCOJGCSGuesiaiy0hxGVR83D+cccx0FHZnVC8mvAwe5xjCy9qSlRyR3L84GH2K7Ge HSOIG/HxQ/WQ9QmxEcSNEkJc9ZA1F1vDLi6NmtJ2jIxNzE2EaRAfP1QPs0ctSdTUqOSO+Pih epj9SqxnxxDikuMHF1lzsSHE1RDimousudiwi0ujZh92jH3Y8TDQUdlTLDl+cDG7XUnUtKjk juT4wcXsF7GOHVsIccnxg4usudgQ4lp8wuoiay427OLSqNmHHWMfdjwMdFT2FIuPH5qL2S05 YR09bKfi44fmYnZLzhxHDyEuPn5oLrLmYkOI6zHEuciaiw0XqmnU7MOOsQ87HgY6KrsTio8f XMzuyQnreHP88G54cvzgYvaLWMeOI4S45PjBRdZcbAhxI4S47iJrLvZLu8JjH3aMfdjxMNBR 2Z1QvCvsYnZ2kDDCgwTek4nEupid7a4PCSFO4hNWF1lzsSHESXzC6iJrLvZLO8NjnyU83HEM dFR2JxSfsLqYLcnW8JCwnZIY4lzMlmS3dMwQ4mYIccNF1lxsCHEzhLjhImsu9kt7ww/nH3cc Ax2V3QmFJXe4mD2TveExw3ZqhhA3XMyeyW7pmCHEaQhxw0XWVKyGEKchxA0XWXOxX9obfjj/ uOMY6KjsTigsucPFbE32hoeG7ZSGEDdczNZst1RDiNMQ4oaLrKnYFULciiHORdZc7Jf2hh/O P+44BjoquxMKS664mL2yveEVtlMrhDhxMXtlu6UrhLgVQpy4yJqLjSCOb3pHYl1kzcRKuO+f R83aK6a1QWc9QOehsjuhsOSKh9lyJXvDckUlV64Q4sTD7FdiPTtGECdXCHHiIesTYiOIkyuE OPGQNRcb7vunUfNw/nHHMdBR2VMsvtAgHmZLSfaGpUQlV0oMcR5mvxLr2TGCOCkhxE0PWZ8Q G0GclBDipoesT4j90t6w7OsTD3ccAx2VPcVqWHKnh9ly7l94UVOjkis1hLjpYfYrsY4dawhx NYS46SJrLjaEuBpC3HSRNRf7pb3hh/OPO46BjsqeYmfT+uMJuZhdk71haVHJlRZC3HQxuya7 pdJCiGvxG3UusuZiQ4hrMcS5yJqL/dLe8MP5xx3HQEdld0JhyVUXs1uyNyw9bKd6CHHqYnZL dkulhxDXQ4hTF1lzsSHE9RDi1EXWXOyX9oYfzj/uOAY6KrsTCkuuupjdk71h6WE7NUKIUxez e7JbKiOEuBFCnLrImosNIW6EEKcusuZiv7Q3/HD+cccx0FHZnVD81rCL2SPZG5YRtlMjhjgX s0eyWyoSQlx8I2K5yJqLDSEuvhKxXGTNxX5pb/jh/OOOY6CjsjuhsOQuF7Ml2RsWCdup+FLE cjFbkt1SCW9FSHwrYrnImooNr0VIfC1iuciai/3S3vDD+ccdx0BHZXdCYcldLmbPZG9YZthO xRcjlovZM9ktlfBmhCQ3I1xkTcWGVyMkvhqxXGTNxX5pb/jh/OOOY6CjsjuhsOSWywVtTTaH RcN+Krkbcbmordl+aXg5QpLLEZcLrrncEOWS2xGXi66p3Ph6RBo5uldN+8KC7AsLEh6TyArL brlc4F7ZBvEKe6rkfsTlIvfK9kzDCxKSXJC4XIDN5YZIl9yQuFyEzeTy831fiZy1V0770oLs SwsSHpXMKyy95fLAe17JJvG8oto74zsS5fLQ+5Vcz5IR1s34kkRxL9Q9ITfCuhnfkijujbon 5H5pn/gRAMcjx0RHZ0+xEpbf4l6pm+fmhhc5Jaq/M74nUdw7da/kOpYML0rM+KJEcS/VPSE3 wroZ35Qo7q26J+R+aa/4EQDHI8dER2dPsfhLTcW9VjezTzXNGtXfGd+VKO69upl9vWiGlyVm fFmiuBfrnpAbYl18W6K4N+uekPul/eK5v9Y09wWGuS8wzPDYpJ/XXINvYeylft/vg/X9ik/f b230cxC/z1bHPi4b+wRk7E3tsfcpx956GuO8aXZeHjrvg5wj/nNqew7iztnKXkTu7w/J/qSM 9LNPcZaeZzVxmsNT6w90n0zcho0OD5/5xkff7/1+MMq5Qe1UzpdxP/SPBp5h1RkWf9Lj7Sj7 hu592O/++sf/fjfyZci339zq62E74n/0Aqu5Ejc+//hvH0f727OI74efswhXcv+85BpJPqb6 8ds/8V/vHcqHjHYKzLc3Nd5x7OlcZtvdxdszp3esajK3tydl76zaMk3GpyW/PW3xwvZh1BYY dWPe23sovygPJBv1cdLNTwlTz2TnZMS19nIdpYm1RxBx31v7cdXkYz5BFmZgk2LUx1YuDkql UOraeRsrB7fSXo17MZPnn+KCzLkR4TlIgui1r4Fnot1MzEWHGHCsdQ+Ox4nIx4x2JZUgt+3L 5Sm+7QOGKSHsn07GjXt9Jl7vU3s0XB/zCWA2DeAUXpIPVHw/65kCRXFBRjKkmGFtmnkOuCCV i34KwR9xGIDUPl6Yb48XfpH16yfRqn4OraqLVueiwROt2Gu00hQyzgz79yKz2v12I/zd8DS/ y+clayj5+f7zF0t+u3X8/fD1fP/5yyXXUHLao83PS+6htQ8MWUZq0KTt9dzcL/rP/aL/w3Jn Ip6wmbrW/hzFg3nYsc+s4denmpz7rGfQ77+9QfS9GitNk+r6PCt7K0yTldpyfFYy/66GL1mv NE3k85KjNNErTRP9vOQoTfS8/p+39b9csviSv4/UFbQ3+5hj7m8z6d4M0b23o1cA+k+3/t6w H1rc+rvjPu64nMzJ1HSqQzbMgfZsmJdkGr+DX7wU0ZK8LaNvN5TfDY8PV7wy8oTYFYlN9rG9 tMzFvt3Gfic2do6Xk0+IjeqYnmsdzq6u7vsFD3ccAx2VXc4vry/8/Mc/O8wfOfzaDvH3zrwm UWtqhzDY4o8BVa9DfCX24011rWGwxS/YV6/i5mJbGGzxC/bV60qfEBsGW82CbX/oSPf3rXXv 12sLgy3+GFD1ml09e5te1LSgotmfh4rEuoj6ItazY9QwafyCfXUBORXbw24pfsG+uoCciw19 m0bN/tCR7o+h697Z1h6mQfwxoOpCfU/ezNIeLUg1/hhQdaG+Jy8qaQ8hLn7BvrnImosNIS5+ wb65yJqKHXE9zaJmf+jo4Y5joKOyO6H4e2cuZp9X/r2oefum+7vh8ffOXMx+EevZMYS4+AX7 5iJrLjaEuPgF++YiaypWQt+mUbM/dPRwxzHQUdnjHDffzcVsSd7IUglLbvwxoOZitiQvKKmE EBe/YN9cZM3FhhAXv2DfXGTNxcZLhixq9knEwx3HQEdlj3P8MaDuYvbZkveiZoYlN/4YUHcx +0WsY8cZQlz8gn13kTUXG0Jc/IJ9d5E1Fxv6No2a/aGjhzuOgY7KHuf4Y0DdxeyZvImlGpbc +GNA3cXsmbyYpBpCXPyCfXeRNRcbQlz8fn13kTUXGy9Us6jZHzp6uOMY6KjsTij+3pmL2S9/ ysiJmvCoQuOPAXUXs1/EOnYMzyk0frl+uMiaiw0hLn63frjImosNfZtHzV4x7fMP3a+66QrT 4GWbxz0I0XoWaKfnPm3UqYwH7Hb87vs1Gh2yPfPam+6PZej+asSL/vxjuYFDThjI935MoHK9 /ajQd8NX/Omfkkv9OArW263/d1LjXZLPS5VQaryC+LxUDaTq+UiVE/EPxx9fHPMcjb35xH+j oLtmyCKmhBETf/Zn5FIdK7796s87qWFtlc9LHaHU+IsYn5ca+TWPmP0e7tqvFa8NLKuEGRD/ fQJ1hyWFdb398wTfD48/+bNyqY4V3277v5OaXFr7vNgQ2uIv/pT3iPr/JAFPDQ0KZW5kc3Ry ZWFtDQplbmRvYmoNCjQ3MzMgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+ Pg0KZW5kb2JqDQo0NzM4IDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9DaXJjbGU+ Pg0KZW5kb2JqDQo0NzQ5IDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EaXNjPj4N CmVuZG9iag0KNDc1NiAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQpl bmRvYmoNCjQ3NjEgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0NpcmNsZT4+DQpl bmRvYmoNCjQ3NjkgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5k b2JqDQo0Nzc4IDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EaXNjPj4NCmVuZG9i ag0KNDc4MyAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvQ2lyY2xlPj4NCmVuZG9i ag0KNDc5NiAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQplbmRvYmoN CjQ5MjcgMCBvYmoNCjw8L1R5cGUvT2JqU3RtL04gNTAwL0ZpcnN0IDUzMDQvRmlsdGVyL0Zs YXRlRGVjb2RlL0xlbmd0aCAxMTc4MD4+DQpzdHJlYW0NCnic5Z3fjmW7jZ/vA+Qd1hv0JvV3 AYMBJvEMPLBnYPgYyIWRi7bdsQ/m+LRx3AbGbx9Sm59q9+mSVnVV4iSTmy52lSRqSSRF/kit lU8tx+3Ip/SjJvuZbocUJ/Q89Hb6b/TQpk7IkbQ7kY90ihPWMDcn6lHEh0nlKLV6dxtPR/fz aDKIfrRWjMhy9OTj5NvRz+xEOs7i42Q95CbOPhejmo+U8yGSxgSaUecYoh+ifVD2u5R9MsVm nm9juNOo6tMpNl5RH6+IUc3nUWy8mn08e06p55hJPaTVMYqN18ug7HfnzWdVbLyzjfG6LYr6 rKyx3rqPZ4xUss/FFlDtl07Zmmn1uZRyaFIfxZZFswzKfpebz6raeCWN8Wy5y+mzqu2wrj5K E19552vMtY3VsG7ak/O1PdE+VsMYqU8td3uYdMuDakeS5tya7ZYmfyJbfdtA/12/HSmNNej2 1zTWoKcj5TKoeqSi3sOWOJU+KNv8mv2JbBFTG2vQjFu/jb86NZ7Xhk+nOnUaj/POzaZ7G3Li DyhDUFx+ZKypP5a6JJ2n/ZPGTrtUpO5z8anlPP5qA5TboOyh71J22sjVZKncbjZUtQGMspGb iYBR1q6bRBhl4/n8jPJBbT/KTfT+0EaJ/ZMHlV2Oq1P2X6lOmRIU1TGedUujsTexB3ZKj5IH NzHRL6Y+Rlm7YktXbraIpSb/q21jabfxV5tuq85NrW9Po539t/fRzmbgIm+UtfPHN6od9VZ8 zjZ8FR/qZhOq0ryHLVhV20ujxHT45vMzpa5pPK8tbM1lUPmo5TZ62F9Ldb4merWO8Uy3am3+ OxuqtvEcpla1jae0CdU+ntKWqZ630c76ugAbVY42Ju6i127dZ2rb3WSsqWm5CbGP4qZAT6dM L1sqPlP7p2Vf2JtNsuXmfE0vW9HRrho11sX0qNmDOOV25OZ8bUlMKZyv6X7rY1dNL9spg7Lf uboYlY7uj2qUGnX6Wtnjdyk+ng3QdeyqaZ4N4uPZxvc01sB039TNR7Gp9TzkxXS1l7GrpoO9 ugjcTFd7LT4rG6A33/ibMe+t+VxMxnvPPp4tsW30mEs361fGKOdx3sbqmkadMlbX9O2Usbqm q6eO1TXmp47V7XqYFfa5mJiZHfXxTJPNjo25NDOnOkax8aoMyn5Xm8/K9NKWZYxnfNvps7Il MV338UwvTXN9LqaDpxsZo8xO3oY83kwajDzHOM1tdR+k/1aTz8w0UkxMx6DdyTKOBrO+Jk6n kzcnXdLsj0YWV1/r7eTpszrd8lcXd9dEOwTyIP23totO+ri9jnF9DqfrkVsVI/sY1+bg7Py3 Nq7TToqTJhXF/29/caUTWxw7XYa2yzhoqk9S/KTJaYxbnew+SfFxSxnj2hxsLJ+Z+rjVBdc1 07q65NpATg7R9eNI+l1X/dxyG2Rt1UnfEbGJ2Cijm8mwkX381hjbvvu4ptjWaDy86a6RLmh2 7BnpJ0rx49HIPtraHLT4XorZCBtFR1sft/q+2RMa2Yq3zd62j4f3U1a7C5xrrXV1bZLsjN2S WzcbLLkqGWlPkWTsm8mlMXeb40egpLHz4sdpSq5dcj+fXaDED+2Uxwi+JKb/zsKP7VRcT8XP 6HSfrx/cyUyOkzad1FzdxI/u1E4ftzi3Pp7CD+p0ug6In97Jz2Yju7sDdxbuD7iuFt9+e6jB wvTeyD7svLHIw4baRhqZXAXd+hvp9sW8BCPzWJLq42a3imKbZ0/tiusnmbscPm7zwYaqmSgY OWypmMAb6YZEmjPuxbk153a6gpr74WQb3NxXcYtsvzVuY37Fjb0ty3ggk3IjxwPZEtkKjZnZ oxg5Nqt7tzyEwBTfFmvM7HTfroyZdR+sDpE73UeqLqlyDifJTx9xRS99CLgrpJ1OYwTn5u6a kTZuHQehuPrX21h1V//qUmFkd7KNcd3RGuurrug1ueq51BhpT2jk8MlcY9WNQs1uIf3QkFrc RKqrfx2WTN2A2FE1ujm3dm/g3Ppo4Ipe+2jgRqG6v2rkcPZs1kbaHJqfMtbNnqK5jttv3QeU ewPj1nQ0cEVv6d7A2yZfdXVFbzkNbqeTrlnqBqQVP2zdttiOjgau6G2onqqP2+4NvG23+Rnp 43bXAHWdb+56GylO+lmlrtL9dm9g3LqMBq7zXe4NrG03/XfSxu3DSXGfysjqD2QCb5LiguhW 2h3c0aA6ORq4dvd6b+Btqwu4uvr34Uu5HTKpcr1QN0F9mAp1q9HPe4Pk7vJokIfnfG9gbc8h Dz49I/34UjcKp/coLhQmHi5G6upvUYI3cKNw5tHA1d98+9HA2xY/4tTV37xs5+ZGwfwQf6A8 HHWXX3X1P/u9gXPro4Gr/3neG3h8426j/VaddCXT4da7obcG1cnu3NxhN7d/NDBf2xwtb+CO uln00cDbZreI6o68+SODm0cLxU8y72vi7J6Wq62J3WjgDr55BN6g+bj93sDb9uZP3HxcD6GM dG7u+hpp0xH3nIz04EOGOnUnXZPst6eTftSpTc9E/95AnHSFVLMa6gbNyeSk+5lqKmOi73rs XoaOKMnI6uRo0H3cdm/gbbtbIz193O6Hj54+hxENenRm5OnczGp4XDQaeIgko4GpuHoLJ62t +p4aaeOaPDs3U0Uj3SLaaWRkdovo/q019QZ+1hjpDfxsNOW5Nxixl1taN+OmXe6BWFRkpGmO D3Y66R5Iujm3897AuCUPCszFvzl5b2Btk5+/9lt10l0UVy9TPz98XHJN0fwITeKhXro3MG4W THkD8XHLvYG3Le5guACZ+qXBrTvp5tWHsQf2jU3q3PpooM5t2N+kPu55b2Bt8z0kUY8s3T81 0kPL4UrYqeyk2/XksXzWewPjltNoYE9l5GiQvG129zolH3ecFx6KGekHoB8wptZ+zKTk3Nq9 wQhkR4Pk4/Z7A2/b/WC1g99Ij67ttx7gjnDJIk8nPQBxH1aHv1A8HNVxPhhZnLw38La+BEY2 J90nMC/CyOy+kcf+JjnuGyVbbyPvDZxbHQ2Kj9vuDbztOC9S8XG7e46p+BzGeZGyx+MOUNhv PQy/3RtUJ0cDtxpV7g26k35eJLcadehbcjSgjvPC/R8XSefmVqPmewPjVsto4FajlnsDbzvO i+RWow59SwMKGOdFchtVh74ltxq1jwau/vUcDdxqtNu9gSM247xIbira0DdXJCP9vHAf18zQ 8M/cPrQ08Bu3D/cYK7ktsTPLZ+a25H5mJTcV7T6H0a37WZhc0dsAfnxvjHQPxI91s0h+hHoc 707mGKE5OUTOTUV3k15cBM0MDVF2Re9pSKqblZ613CNtI4cGuKnodx1ys9Krny3JTYWdSGME b9vcciVX9PuZ5QiHkWMD3AT1U8fqWLfTwQEjq5POIrtZOcXF0Rf99C3248R22RXNJMA2w3XS RrONHXIihy2vz9I22tbcbZTDKeYBOPjSjHJ/2qXHFtEewTfZntWky5/N5mwrlx2QuLn/48+U TSkskHSUQz0eO83m5ORumR9fOXnMPKATEzP7ncMktmweJNlWmWa4m+q+tSl1GfHHaaQ7neKO Th6BnvhjmQPbh8Pvv63u66XRwFbWXfB2mNqfA1pLRpY+vFtrUPvwWB3gabfhsTqu04bL5eCH hXjuVLhhM7/XHbxutjJ39whH3GPr5YbAYzjbWrdL7hmbJ+VK6ELucNFY3HNEstVFUkdIUY+/ +7t3v7ijlrfjl+++efern7z71V//9OHdN59++MtvP/3jdx/++O5nv3akp3qD/368+8Xv3YD5 f/7+7//zf7p3dx2K7r98vruxtgY+jkAkiLIZ2V24+8i/eG5g0WW/OaOfPj8js9Qbtkm2bNM1 28U62lGwY5u2bPPr2eYt27JlW17P9m1So0hNQmoSUpO2UpP69oHqsl+7kppzxzbftmzbNdvF OmbZstUt2/56tmnLNm/Znq9nu9vba6m5b/7cjrlAc8rLB2q7B9Lbsl+9kJrct2y3Jk7lmu1i HcvWxJWtidOlZb1muzVxZWvidGlZr9nu9vZaau6bP7djLtCc8vKB6vaBlja7lAupKW3Ldmvi dGmzn9iu1nFr4urWxOnSsl6yrVsTV7cmTpeW9Zrtbm+vpea++XM75gLNKS8faHvk6tJm13wh NXV35HpOdMd2abP3/dLSND5Nd7X+c922Yte2YpeWNvKSf9uKXduKXVrayGu2bxO7u/TMfZkL NKe8HHmevf/l4+/++uzg/cQA3iCETVKINK3lVIA5pY0d1qnHv3r/m+8+LPjHaflMr5/mZ/dh cWjo3mqkpWlunMjf/On99190fery7mcWij7065xtP1+tbloayM5x/PN/fn7P+9Z36eWS9dJI XrPe2pS5Wj9/9w/e+L7ozw+E+9637nvrVw8zKi9iqL0G14tna1u709vlsi5N9SXrvnUL+3nJ emmuL1mfW9fwlMv1X1r8a9YbA/WksXdZam0tSw1b1LFFHXt1bkTiypjkxVlyYUzy8iw4L0Uo L53es1wt5kaEfryYZ10v5rnxNa+efGFGLxd64aJesVtY0FGbdLXQCxM44PTdQo8SqOUCjYKm lx4YuT/0k2tFW+j4KKfaT1k2ijbqsi5Yl4WOv4T15qx6WC2XS2t8W8klCzSnuxyxXj/MrcdQ t43Ff4kkvEhV7o92S+tHu4vrnPzrlGhuUf8aHZLne43iuot11COtOk8MebVy+plZXs04hOJc r5zeXjLO89bjqtfzy1xexawul/nySGjLrvsTYVQ7LhdnVDtecO6v5pw22zJqKi84n6/nrC8X LF2eguzLXKY569cp2aVu/jQ922+hnVfs9HXdFup81W2hSKPWdddvoUmjuvW2ATZGOe1GvPI+ c7JUxWu2ect2nzlZqvE127plu4VjZKnD12y31iNhPZ7HJdj8uR1zgeaUlyM/pes+vP/dYvCw Lw/d9hi2LC1KuVqHshW2Cwx7ofiPbJ+FhUbp9o7tHjNcnurXbLfCVvaY4cLuvITtVtjylbAV hK0gbAVhK1thu8Cwlw5OOS+kpm5Oi1Ezv2O7tKhPbBfr+DmG/QXbbZpOlwb5mm3Zst2nRZYG +Zrtdm8vpSbwebZjLtCc8vKB9mm6pamv+0qEcR9iw7bt03RLU//EdrGObWvi2t7ELS3rNdut iWtbE5eWlvWa7f48vZQaHMKG0WkYnbZVgwllXiQuvui3r0QYd102bPs+X7K02W2fmx/XaXZs 94D70rJes92auL41cWlpWa/Zbvf2UmoakEPH6HSMTt+qQd+n25Y2u+8rEcY9ph3brYlLS5v9 xHaxjufWxJ1bE5eWlvWa7dbEnVsTl5aW9ZrtPmS4kppOFNoxOidG59yqwbk9ctPSZp/7SoRx Q23Hdmvi8tJmn/vc/LgCt2br9992bJeW9Yqt37HbsX1hGuDr2W739lJq7ps/t2Mu0Jzy8oG2 R25e2Wy57SsRxqXDHduticsrm/3AdrWOOxMnt62JyyvLes1WdiZOZGvi8sqyvoDtHhW5kJrY /Lkdc4HmlJcPtD1y88pmy0w7rKRGdkeuXzDbsV3Z7Ae2q3XcmTiRvYlbWdYXsN2aON2auLKy rNdsd0j8C6RGMjJSITA6O2z+EeZZ52kKvlLh+Ku4UW2ejNPYTfmdU9qY0ReUnwByzWV4tg7l +f14HXBbVkeG6GVWCwm4r9lj15kLfR4yF32U9y+6JwRvmc8McOdnhzx2u8zA6pLjRdpNPiv4 Xk94gPyS1nk3+awU/suFu0yQjFvkd1n7LO/w9XvwWcLky0e63P30es773b8sf5q7nx+65euM 8opj3lcgjVv1L5nwfffzsgKJSS4Huiw8Gnf977v/WVH+K/bgXHf/UdJKIgP2vCZjg0laheTM x7li8VPdJS+X3Z41Zu1Vvfqrep2vezBZGM2rjJe8kt3C5L00L/e17PLr2C1U85Ld68RELuVk we51kiKvFBV9najoQlTG+ydeeqLrj7temcjP6m6/7H55msjrObct50ubqq/nfO44z6Lx6xP0 qzl/Vjf+JWe94pxfzzltOV+6YOX1nMuW86WE1ddz3kjYj8/Kujn9a4D2oQ5TOqewzL2bSzmf 7Ir7/jxc9fqpbK1A/tFK7ZFuWXa7Cgg/A7q/7D7DpsW6foZmf9l9n0BedrvAWeUzMPvL7nsw +9VcP8Oyv+i+x7Lz67nq2zYIeAdMWT6rkf7yMbZyVpbdruTs3MrZHsCur+fatly34E57Pdfz TVt2Yn5AduXcybvetpLXl90uqjT0tpM8vW2TKOfrue4siu4xa1mZzxewrW/Zs9iDuSxzpsv5 bEVPVvZcbxeJS73tZE9lf099ZZGv2crOqKi8MOL5erbpbbsWPkCsy5zp8jn20rcy8jox8+Vz 7KRPZV/0tzLKL2C7tSuyfwPHyipfs9XtQXq5a1LYrAaxFXp9YUT6RT+5eo6d9OnEgfalmq9g u7Usuj1KZWmYr9luz9LLXdPwrmNd5kyX89lXXS0t/cWrSca7ADds9+9/0aVhvma7tSz797/o 0jBfs9076Je7Fl6jAn3HTJfPsS/+W1r6dJEk17STPt2/9kWXhvma7day7F/7okvDfMk2b330 y10DB451mTNdPsde+paWfr5/ZvkcW2duX0OvS8N8zXZrWS7e9rI0zNds92Hp1a5ROq+Uzmve Cn3ZS9/S0j9leRfPUbbOXNmX+i0N8zXbrWUp+1K/pWG+ZvsmBETJWse6zJkun2Nf4be09OUC KNCydebKHhRZGuZLtnVrWeq+wm9pmK/ZvgkWiV2Y6zJnunyOvfQtLX29wAq0bp25fS19Whrm a7Zby1K3x2laGuZrtm9CRpSCfQXFjZmu5rMvoU9LS9+u0IK2deb2JfRpaZiv2W4ty76EPi8N 80W/pWW9ni671N4WOlB6r5Tea9tqTduX+i1NbLtypvvW1vU9Arw0sddst9LWt9KWlyb2mu3b QoeGZe1sX98e8H1f4bc0sf3Kme5bW9f3FX5LE3vNdhs6nPsi5qWJvWS7h/cvd40Cu1iXOdPl c+ylb2lizytn+tzaunNvs5Ym9prtNnQ4t85bWZrYa7ZvCx1ODCNlkbrNfPh733fPsTT554Uz nW476Uv7EvqyNMzXbHeWJc1a6ufZLg3zNds3hQ6xC3Nd5kyXz7GXvpWlT7cLZzrddtKX9pXz ZWWYr9nKzrKkfeV8WRnmF7B9U+iQKJhPFMynbfIj7Qvmy8rSp6ta7iQ76Uv7gvmyMswvYLu1 LPuC+bIyzC9g+6bQIVG5nqhcT9vkR9Kt9NWVpU964RQn3Ulf0u1xWleG+QVst5ZFt8dpXRnm F7B9U1o1dmGuy5zpcj5b6asrS5/0ItGYdCd9KW2P07o0zJds09aypO1xWpeG+Zrtm9KqsQtz XeZMl8+xl76lpZ+3DpbPsZO+lLbHaV0a5mu2W8uStsdpXRrmS7ZbjP9611JhszjgtsmPtH/5 fF1a+nyRaEx568ztXz7flob5mu3WsuTtcdqWhvma7ZuwkdiFuS5zpsv5bKWvLS19vkALUtk6 c/v39bSlYb5mu7Us+/f1tKVhvmb7JmwkdmGuy5zp8jn20re09BdvQR/faNqx3RfILQ3zNdut Zdm/pqctDfMl2y3Gf71rBdexcMBtkx+p7qVvaenrBVqQ6k760v4N821pmK/Zbi3L/k3xfWmY r9m+CRtJlH7HusyZruazf+N8X1r6eoUWtK0zt3/jfF8a5mu2W8syrw08z3ZpmK/Zvg0boSo/ UZWftskPmeD7+oJxFMPPoutZyntQH3pQcnhQxXZQGDVrbWb5xqwImEnmmbecqbCZJZl4+4Rw Jyo4gaaJXcxweEZY02mffuB0LeZpNQ3g1Km5Tc8v2ksuRQu5h0eR2boQU89/9H7ddJVvSJ9n V37cff+GIXk917TlulUPfT3XsuP69HqilXYgMLxWKH2erPniMfZFB8tuV1Da5xcxvui+z8O9 muu5FZT9RYzyeq76pi3jIkbiIkb6PFPzxWNsJa8uu13haOdW8vYXMdrrubYt162f2V/P9XzT lnERI3ERI51beZ8X4dZnUOIUSH2OuTFALzHRiez6M72ef9HwuWA23f2ffPztX/744ftPz9q8 ONmowYhSkiNKMY6o8Tg4+Ej/BnJ3BCR4gBIBNwRqckQgeRAa4XVHqHLgfIfvfYQ3d8RRd4S/ c4S/cLDi2MwwvQcKyeaGiB45rnLkSMrkOJNzeAY53kyf44g+4+7AeU8r2E9+f+d3xgnOBzDP KITmO5hn1EPH5zCP+ODmccaBz6d3+CZifL/y4NOI8WHJgy8kxpcKDz6CF58QPPgWXnzb74iP 7R18yIcPWcVnwA6+ZxXf5zris1ZHfDjriM/9HGfjZ4wX72rhMx3xnZWD77bEZ1uO+FzMwadh 4jM3R3wh5ohvzxx85SM+mnKcoZXxiYwjvm5xxJcsjjOcKfEvkwchEAqRIGgsNBYaC42FxkJj pbHSWGmsNI5tNaIEkWicaBwiL7x6RuJVx05UiBZEYeTCgJUBKwNWBqwM2GjcGLDTuDPgCdOT AU+YxjvFhPdFSbzcywjWR1gfYX2E9eEVFRJvnTEi0TjcWIn3uxgRgirxGg8n4J4ZudCm0KbQ ptCmMmCFe4U76yOsD7d/Je51O8HIjak2pspiCosZ95OdYOTGyJ2ROyOz8gQiEtdnnWDkzsid kTsjs03CNsXdUCcY8GTAkwFPBmRPZe4pmkL0I1xjE0VTuM8mcS/PiQJRIRpEh2Bk1EpRK0Vs FLEh0hIu9ggXeyQuKDnBgIgWYZlwsUQU1eOGiSiqp8ihIocEc8INB4l7IU4wMnqqCK0itISA Qqm9xAUFJxgZpVaUWpFwAkeh5luiUt4JRsYCKBZAUQfCTaH4WBS9oApZFHMRUZ8TjFwYuTAy uhPVvE4wILaFc18ULaC+TxQtIMYVir9E0QLcAFG0gKIVUYSW6hVRZFWRVUJkoWhCErJK9YQk ZDUhqwmpS0gdgbWQEJaE1CWkLiES5K8ksReJvSDmFqBcAV6ShNlJWBtcE0ksFE6J4JVIYqES C5VQfCIGwUWRxLIkliWzLLgvgv9iRIYoEBWiQcSAWSbByKxGZjUyMp+R+YzMZwQpI0gZQcoI UkaQcmViLF3GUGeWLrN0GUOdMdQZQ50x1BlDnRHRjIhmVj6z8pmVz6x8ZuUzIpox1BlDnTHU GUOd2abMNmUMdcZQZwx1RuYzMp+R+YyhzuxyZpczu1zY5cIuF3a5sKeFp2hJIRJEhigQFaJB dIhg2jBfDfPVMF8N89UwXw3z1VCZhso0VKahMo09bexpY08be9rY08aeNva0saeNPW3saWNP 21wNNqWxzh3F7zJ/0yA6RAzYOXc6507n3OksQmcROovQWYTOInQWobMIJzbqZFNONoWPbQpf thace8G7l5MBT+w8jruc6A7fCJWTpcNJF7xtwd02pyDiO9xmxW1WvqSluM2K26zxDSgjFCKe wogGMf9E90z3DK8Mr8w0YlU13lvvBH9q/KnDq8Orw6vD64TXCa+TAecjh6Ipr9BVYRGERYjX 9RoRYqPxClEnOgTjKOMo4yjjKOOEu6LxsjcnGFkZmVXlXW8a7xA0gnhbeXZKd1V5duXZlWcH e1ZOK/MOOkT0KiFIRghE9KpxelrQT9QPrwqvCq8KrwaLBosGiwaLBrzQ4nQwokBUiAbBgBN0 AHXApCgmRTEpikkxb2USsGANG8/VeC4MiBGMfNL4pDHygyVRLIliSRRLYkRw7+FwGqEQFYJx UJCOgmBbFNuivfCn8P2MmH9iGix4Z8E7e9pZ+c7Kdxa8s+C9znF4nM44nXE647C8neXtLF1H JPoJCxbzRONONO6Mo82I2aZDxDRAYRQYRsFhjMgQBSIgn/jwx5HQ04SeJvTU3MMEkSEKBN3B pohGE9FoEmAq9DQRciZCzkTImYgrE3FlIq5MxJWJWC8R6yVivUSsl4j1ErFeItZLxDup8KQl JMqIBJEhYuRSJgEaN+E4Hhm7kQqIXKn8iWcvHRYdFp0BweMKD1h4wMID1jg4Us2Af6EXRihE gsgQ0b2FRJmvDQYYomVEg4g5d+U3On8Dghi2N6G5RjBgYkBgTTQ3obkJPyHhJyR0MKGDCR00 YrYBpwQYPUPfjYhefFQ9cdAnDvoEHJfA4xKAXAKRS/H5XCcYmb0AdUvAbumcuOkETmNV821C pgIRti6DhuX4HJ8TdOcb43yEL+M5ZDyHzDuic3xCygkaN3DbBnAbBj/jJ2TQsAwaluNzHE7w p5NeJ38655/odcKdT6bjMGQchozDkHEYMvfYMiXkOQrvnYhxoibeiDQJerEaIOWZaDQTjWai 0QyKnoHRM8nhHNUjTszfVAgGrAxYGZAveCdWDCA9k8rIQOqZ0DVnmDY2t7G5jeciTsnEDpnY IRM7ZGIHC+xoHDJvRIagO4+Dn5DxEzJHfyaayEQTmWjC4sL4EzYhYxOMiMl3tqmTDehx7hgR E+NEyyDkGYicb2X755cTBG3gDo5dwLELDjmfqjWCV+HceBUOfngBkS4g0gUd5LOa/sZz/kRN wS3NP1UIRuZdEpyMBQ+WVx77m5F5K3umwiLz/jmKFMByi3BzHlC3AOoWztzCmVs4cwtnbuHM LZy5hTO3cObyfkl/kyNtyJyDypK1O0pAKDOP9pD7+tUPHz788uPHT+9++fG7D//y/k8H1+l/ 8f6HD9+PPx8Bnd1TZDNVPP/+rx/+/dPPPvz16C2G/ycb7/uPnz68+1f/5x+//93Tf35lbX/z 8d/fffPht5/e+WcRP/xwp70P9D9//92333/45g/vfZb+i3/43kZ4/+nbj9/H/3/49O3/eG/E +N9/+/jDv/3m48d/e8rt+W/+/IcPHz75LD+9+5f3v/3h48P//+sf7N+H///k2/ffffz9wy++ +e7b3314aHvnY81+/8P7P777p29//5cfPsSz/utf/vjnX9uScIFbDsVJPAD00jHN4jHLXw7K XuoRNYNHOzBO/cDynGZlyWocFfhXDs5M++MMs9OBH2h+4Yy5y3ESvddjhsntOIEN+nECx5ye NwpX8uZpIcI2T/YQg3lSJ/zO5Fmc8Eqz08RXnsshjnKacMLzN7jOnrnBIXY6TnHnSyJTHmjn y5mdPFsTi5sf6OI0SVRP2+AeeZ4GR8RpHAVP0nASezImTJV40iXsoDrNweD5lTCLzjciKLMN ojgE1UFnjLLDu/H77jgsxtGRU6yPY5QYBYcFqbNy3I3KCttGXuSWHQgLk2F8CVPNeAg+ny23 zq+6dQ/sY5zT6DDZptMadXuHPZLFvfdnMQW3mPO+VuayWZR4H9O2TfEX7XS1uCvaVw+Z7vOx R1Kk0SQ54Z3YSZviXc6HhQiJZIOxN2f9Pr65NonnMu/GPNr7nG2IBA5lh0wmgWeCnMHi7XzL U4m6bU1YSfuzncF32lzCzLOYgczEYBbbFZw509wCHmG+QCHfZtMqJL1siJL4YhxG4P0fP/z5 1/f/fk0ZAdE2YTxRPLH7RAd+9HNG8vGTgDWsvE9i1iT8qMZAZyyLGhLAEq3SjnCYMHRGofGT YJRYlFCUSJTIlsA2VI5AJUSehAb1gbiLeIukN8hloEKkNOKu2xGX6A6qCrlflVD7ONHnbTFf pJfBtAD/ADkPwC14P0CO4JcJsM2rwV2mAYqJ7ApAjgDkCECOgN8YwQzB4EF0TIwx+wDtoMWz fIUYkBAwxRImrG9sGZEhoC5o86x7IZQlTiRMJI4lWiRYDNcK5x/fH9f/qX5mRvPxszzsKdUp QhmKUH8iFKAIlSdCyYkRYMxfgVU/i+kC0xZA2cKBCjRIdYPOs3BWN1DSIvPMppjFCKYx8XUy okTJRtCY2gFqXoRiF6G6xQga40ucSO855/MEtNMd4cflf4Te6UVqgkoYoRRGqIV5hOdhikNC sC4E60IMIUTk8uSyAEwSTDyi+xPvB0QHZnsO76cXoNr0fjgelFhEqZdRYhElFlFiESUWUfAA nS4UMIBSL6PEKzpdK+KV12UbnkrJwI4mdBQ/wZ3qk+okZCSx24mSKPvNBGJASRoEoNhXQjPA LsBklEElBOF1qM0GiEnnRDdmKRwQxu0GJgKCxmOxFhN8wZknRZQpqMoUVGWEKCNEGdnJlFhl ZCcjOxNLeir0i6VhPVlOYK2OTwu29nC4PaBOL4KNAJs6KwMs8gAkTWyIRzgZeQktPRUlIgFs LnvL1rKzbCwzAy5CRzKqkVGNCac9VTzyNLMvv8jMGF//BjZDYVrGhhvBAwM+3cCcCG9yfGje CXpNAI+2s2n8rMyq8kR1/onRAHg4GjKFbzk+rv2IC07w7v5THhzBp6LOYEEMgjyGKcuIZThO GaEE30SrADWRLlCvCebFArNbbBZ7NbG+6BemK2fiqujH/rA9bAp7wpawI8BnoGdgZuwP2wOq yiYQz7EXYIhsCRvBPrANLD7KhW5N+G2ib/ETgG3ia/ETUC34gj2COKJ0xJqhNxRe5Imzga4R Y4LRTbAtfgK1gZABkIGPEZcCtwErATiBZE0gK36CXgFeRT+u+czLRlwf4hZS9OcW0LyLFP15 PW/iPgj3h6IfcN682x39+KYZd4l4Bym3iQH0gPFA8QDxgO5A7gDugOtA6wDrgOhA6ADouC7F G/64q0f8z9da+Bw7cTu3w3gzXMhVAdTjw5HAfnyPG/SPK2EhVxMzAFMAN+DSBh9k5uoWF8h4 7xI3BU6whIj/Q65qyFUNuao3cIbABkKuashVDbmq4AUhVzXkqoZc1ZCrGnL1hFMEX7776cau hnDVEKoaHkAFuAihqnGm1ATQEf3C+6ohVDWEqobHRXKO3BypORJy5ONqBjShX/CNoKCGUNUQ qhqnSQ2hqiFUNY6SGkJVQ6gqAE0IVQWAieOjVvoF3zgyaghVDaGqADQhVDWEqoajUUOoagfU if4hVDWEqgISdfoF3zjsqZOoIVT1BBiKfiFUNfyzFkLVQqhIb7YbIFIARXHytRv9AgQKz6yF ULUQqiYAT9EvhKoFitBCqFoYqxYuWgtj1UKu2gSt6Bd8Q65I/FCfRnkaRWnUpFGSRiEadWiU oVF8Rv6I9BFJI+rNWsgVOSRSSGSQWshVC7miXIUiFaANgD8qVMA1yDuRbQLdAD8BNQE0ASEB 6gDpAOigdg2Yo4WxAu0A7ADrAOGgUgWgo4U8gXcAd4B2UL5C9QqYRwf8C2NF1hwAlfwYWTGS YuTEyIT1kCcgFIpjqI2hNIbSOirretipHvLUQ57IzJOPJx1PNr6HPPWQJ5LzpOR7yFOPQ5AM PQl6gFTS81TaUGhD6V4PeepxCFJ200OeegEYjX4hT4DClOCQ/Y/k/91IgxZTekPlTQ9h6nEC 9hCqHsLU4wTsYax6o18wBaENoaJah2KdDvobQtXDWPUQKkp4qODpIVQ9hIqCnn7S7873vN3i p8bPFD9z/IxUTggVJT4nH7TxRfnyrlV0Dok6Q6Jef/eKnzGZr76DFeOFpIGFXdzJiof74mJW dArxAr8CvjpDrL7+4lb0C/MEjAF4cXLRfkzqf/utrhgnxAnoYnHLKyb1VVe9MkSD6BB0313+ 2hCMTNkwyfdX3xSrEHQHeH24O0YvgFei+mdvk9ELnJQw/vF+Gb24QnIrD0L5eO2MHoClROiP F9FoDFhKhP5wNY1sAjiLgLM8XlajF1A/gMvj9TV6gfBT6vt4oY3GIPyU8DxecYte1OkIn5R/ vPQWjQVJESTl4RocvWQ27hCwQApk5qhB3R+uytGLPY+vjT9/eY5e7DlfqX68Tkcv9pyiDC7Y xVY/d8uOrmw+VRcP9+6QAr6xKSQx/2PdxGOR/j+5jheP+3/NnbwvCXihHf8xb+mxD193VY9J oWVcxhfS6EL+/O3X+ehOhopkuJD9/uKmH8/0v+q630tu+aEmpNCFaiOhCFPIqkt6hIYfLgjO e4Gb64DzFiBqQs5dSLoLWXch7S7k3SWhJlQmCPlmoRJKeHGCkHoWcs9C8lnIPgvpZ5n5Z/LO QhmppDSfixmiAiSjhWy0kI4W8tFCwlkoNZWEeJODFpLQQhWqUHIh1FwI2TihSEV4xYMkRJxM nZCqk/kutPtefXn38kVXLvnT11ywJK8kJJaE0lghnSMUqAmlsUJmR0jtCLkdIbkjZHeE9I6Q shHeiyUk3ISMm5APE958IQnVTu3RlnzdzVCUi/ddSJ7lczLbxGplBJp8iBEMqLMNK4qwkvx4 7mIp8pdROTIbkhE7chpCMsOI2QZeL7+OyiL9P3cnlYk/XUxlsL/pfVS690fXkvyIkBgxIkNU iBieZIgRNEacqIMTEiDmodI40RjbR9LDCBpj4LjzIiQ6jKAxAlYQMJIbRtAY48XlFyGhIVyR E1IZRtAYASrIDekLI2iMcBRkojwWrAmJCiFDIaQmhNyEkJQQshJCOkLIR5jTTulUmkTiT9GY pIOQbRDSDEJewQiFoHxWZxt4zZGfrh1TecVvyB0I13eMYBr4UZXzhYSAEXRnH8D8BdDfCMZh scHxBQBfQPCNeIDg7H90RYOA6I2AMyva5opiQ8HbBaBdQNof7l1jTAHVBRTdCErYOOf/ppe0 Efr2Wd3YV16RpuYNUQCaFTBZ6bMujofrPAp47PaG9W0Scz50Z7HBn7fXsREpQFsBtRXgWgGv FbBZAZwVrkMKsKwRDIi0gcQKVyYF7FW4ICmgrkYwIMoMwCp9FikiemCpRlAuhgwCo8r56NMq IMyzl6opoKJiFuxFKXZRys3ffvGa7tygvb6BHU/Ae4iMoAe1abyQSGVW5v8fvqpNL4rUhNo0 XnWkFNUrII2CxihojHI9Rqm0V9AY5eqLUnivgDAK9qJSH05kBVNREBQFOFFgEgUdUUARBf1Q 0A8F9FAgDgXZUAANBb5QUAsFrFCgCQWRUIAI5a6AgjgoiIMCNCiwgoImqM4bGCw/AIGCCyhw gBL8KzG/Euorgb0SzythvBK0K7G6Ep0rQbkSi+usc1eusc8K9/mGvFnbPovZZ/X6LFufJemz Jn0Wo3/lxX96oXKE2EqVuRIjK6GxEmIrkbUSFSuBrhLfKmGtEsQqsasSQishq6Z5S4ZNIQpV gk8l5lTibaXYWYk5lQhTCSyVeFKJHpWgUVN9ONOUmEqJoJTASQkalVhRifqUGE8J7ZTiPU3z 5QrU+xO/KfGkEkYq11qU2Et5GY9mLrUTeymxlxJ7KRVpSuylxF5KEZoScinlZ0bQhlXnFT5K iZlSY6YUlymxlxJ7KbGXEnspFWRK7KVEWkrRmHJ7R4mklABKiZuUKEkJjpSYSImAlCowpQxM CXWUCEcJbJQwRolelKBFqe5SXqKj1HUpBV1KJZdSyqXEK0q8osQrSrmWUq+lFGopYYoSpihh ilKUpVRjKeVYSnSiRCdKdKKUXCk1V0qx1Qtf6cHImCWiEyUoUYISJShR6qeUAiqlckopmdLC XlAspcQjSjyixCNKPKJURBlRIWjDXkQ8Eupb2YfKqUCBkxKLKKVNSk2TEpQoQYlSxqTULymF S0rlkhKUKEGJEpRonVf5MEAEJUpBkhEw5TCo87oTq06YYgRtOAwqhwEVRkqJkVJjpMQsL3wz C1OdbzC53SAyRIWgDftAwZASxSglQko4oxQHKVVBSlyj1AMpMagSFyrxkRLgKHGNEs4owYsS sygFPkplj3InXNu8XLl6B01I09/2RTR0Z2Mp+VFqfXhHjc/ufwItZ3n5DQplbmRzdHJlYW0N CmVuZG9iag0KNDk3NyAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQpl bmRvYmoNCjQ5ODIgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0NpcmNsZT4+DQpl bmRvYmoNCjQ5OTYgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5k b2JqDQo1MDAzIDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EaXNjPj4NCmVuZG9i ag0KNTAxMCAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvQ2lyY2xlPj4NCmVuZG9i ag0KNTAxOSAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQplbmRvYmoN CjUwMjYgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL0Rpc2M+Pg0KZW5kb2JqDQo1 MTI1IDAgb2JqDQo8PC9PL0xpc3QvTGlzdE51bWJlcmluZy9EaXNjPj4NCmVuZG9iag0KNTEz MyAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvQ2lyY2xlPj4NCmVuZG9iag0KNTE0 MiAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvQ2lyY2xlPj4NCmVuZG9iag0KNTE2 MiAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvRGlzYz4+DQplbmRvYmoNCjU0MDEg MCBvYmoNCjw8L1R5cGUvT2JqU3RtL04gMjQvRmlyc3QgMjM0L0ZpbHRlci9GbGF0ZURlY29k ZS9MZW5ndGggMjU1OD4+DQpzdHJlYW0NCnicVdpLciuxsQTQ+YvwHrgENuoDYBtv6vD+t+G6 vn1keaJIidUJEMkEmCitffrz/ayzzue5OaDuJ54e0PWJHnCf51O3P/Hd+XlW/uf1Qf3kJ1YM umtKa/0pOWvQmV//PBr7uz9xvjE/Mj45Pz/5vfuTJ88n176fqnkiYwat8+fV7O+n45m/7fh+ dn570Exx95rH7nd9zvP9fuo7Uzw106hnZn6/2YNmxvfP/Oo538+NmVDFeT7zwNmff37Wnol9 P///B2zgAPcF9wsk0ICn7vvUmfm8IIEG1DxfQPGj+FH8bODnqXc+Z8Uf8K/PP/7vn39+UxhY 4wEKwJpqUk2qSTWlpsyufl7av0cuM2tPNNb2aP/PXNvbbIxt9o1se3Qr3oq3mmPAY8DjqROA xwl66Hiup643T9D7/QIPUMBPzQYOcH+9y0veS977BJAA1qV4KV5qlgEpOx9gQE381LyfjkvZ m4pTMYlvKi7FZYZlYtS91L1EvWS81LuNcCPcCKl3qXepd4l2ufBy4WW+S6vLfPdHq9dz8X1F GxBAARu4L3hFGZBAAwjXAyBcipfipTgUh+JQHIpDcSpOxWmqaarl7ZSpFsJCWN5OI2yEXf/9 MM4O7c8b/fbo8ehRc9Af873mcs3lmu9FeF/C5/XMgAQaeAmf1xwDAihgAwiXYoI8S7Hlf15P DDCoVX+s+mPVH4v9pJes8VPmY7GfUmzVnzLD+nn8l/PnEMTRnmiF7T1t72mb1DbO9hStnu3x Y5rH7Gj10Oqh1UOr55rP9RT1nutxMj7stLhocdHiosVFi3qLeot6i3rr3dEGJNDA+bVsi3EW 5Rbl1ntgDVBDwsUvKw1Iy0XCRblFsMUvi1arETZCEq2NcCMk0eKixUWLi9ZBSJlFmUWZRZBl +RcXBRcFHYKLgouCi8JuFnQIOgQdgnmCDkGH4KIIhLSIQBgIA2EaNBEmQr6KMihfBTsFF0Ub tBE2QgYKvgl2CVoELYIWQYugRdAiaBG0CFoELYIWQYukRdIiaZG0SFokLZIWSYukRdIiaZG0 SFokLZIWSYukRdIiaZG0SFokLZIWSYukRdIiaZG0SFokLZIWSYt0uqQ9LO1YeRDautLWlceg B+FFaMdK+1Palur7BRZQwAZewnoeIIEGEP49Xd5NqJwsRYeiQ4UB6VB0KDqUI6YIUnasokwR pJzwZccqO1ZRpmxdRaKyhxWJikRForKHlYOn7GHFN8U3RauiVdGqTvxeG8qVQ6e4qLioKFfs VFzUvg40zzR5mlWaVZpV2vHRy0u+abWjvp0TTYd2YDRBmiBNkCZIOzmaQ5pDmg7tm1Y7OdrJ 0U6Ottjt5Gir3la9neltt2q7Vdut2vK23aqtc1vndoK33aqt8/67W72ibTvVZopt1bfTezPF ZortK9e2/JsxNh32QkiQTZDtBN+U2QTZln87wbcTfNNh88Pmh80G26d/02HTYdNh+/RvOmw6 bDpsn/5Nh02HTQe3AuEyINwBDEDoY+4OYMBLeL5fYAEJFNDA+7jLgHAHEKJ/HKIcohzHx3F8 uAeIs36eMh8b2SGTm4FwMxBuBuK9GXg/RId5Ds8cWh1WOaxy7FSHZ1wIhAuBOERzFxCHeodo rgDCFUC4AgjJPwT+kPMH/NQY3aly7E1y/oC3Rs4fEEAB70IK9CHQhxw/YAMInfBXdpTjByAk iEA/wKBOFoE+BPqQ40OOH4DQgSLQD8D8+84mv+8CDDjA33HyeT+1KcYNWMAGFD9q3q0kpbeU 3lJoG6DmXYmU3gYoDsWhOBSH4jTDNLF3Kxlg9ERYCN+tJMW4lN7yaYRt0EbYCBvhNuhGuBFu hMegB+FBeBBeg16EFyF1HqIsWghlKZQNeAdd78dzgGKiSGcDFC/F1FnUWUsxdVYofj+nud4d ZMAGTDURJsL3czoAYSEshGXQQlgIG2EbtBE2wv3rO9z85s8H/fHo8ehRc9Ff873m8m7p8038 CywggQZ+ig/wvoOgQzyKLX9Y9VgeZwVZbICxWEEWSxEsJa8BPy+ZBiuEVY+/VnhXK9ggLHSw gRw2oADjMEbQIBhDMkvJbICaYwqUEdH+0wJ4gbFoFTwjq6WsNkCNjSxJlCSS1VJWy+SQpExS JjlERBughjGSViLaAIPSKmklok0wQ8gYadsS0eYPCBkj/0erZArxLMWzFM9SPEvxLMWzFM9S PEvxLMWzFM9SPEvxLMWzFM9SPEvxLMWzFM9SPEvxLMWzFM9SPEvxLMWzLFYpOohoAxDyjIg2 ACEdyvEhoqVkNgAh80hmKZmlZJYC2QCD8k3xTbGL+DX5GiGXyGEDDLoROj6KOQSuAQgdH5LX AIPatiSvCfUPkEADL2E7PponhLIUylIoS6FsAEJnejs1xLQBCAOh/UtMS+kshbIBCO1f0llK ZymdDTCoo7wZpBmk7VjNIM0gzSBtx2oGaQZpBmn7UzNIM0gzSNufmkGaQTaDbEf5ZpDNIKLa OHgBCTSA0Ea1GURUS1FtwK+L1hTcUnBLeS3FtAFGJoi8NuCnGD1lBLcB5sI3m13ktZTXBiAk 0abMpozgNsBTtHqDmzdHHqEt98/S84z0liJaimgpz6WsliJaimipgzvgfU9auQMewBDMo3E7 O60aggltKaul5u0ANSQ6NjJZLaWz1MUdgJB5DokOQbRzUwM3NXBTOkuhLDVoByC0kUlnKZ2l Bm3qy6Z27ACEzKMdOwDhjwR/zfMKK6INSKCBd8Br+bVaU4c1RbTUak2t1tRqTREtJbOUzFKr NbVaUzJLyWyAQekgmaVklgLZAIS+8V4OuQ6US4fLIdeBotWaWq2p1ToAM6totQ7wkgPlcsml w6XDdcrruaZW64C/o5ee64AHKOC84LVCva3Wv3rObwpfZUq/9Tfw6GuV0oEtjdf6himE4lAc isNYr3oDDJqeSsWpJg1RakpNqSk1bc5t9DZoG2ub6ka4EW6E29IehAfhQXgMehFehBfhNSit BPoBATTwEurLDlhAARtASKaHTM/v/0mZ3zwRCunwWH5hfkACaugg1Zd2bYn39ZTHyxC00skt yb90cssVQOnklruAeju5f/5n6Pv7rTQOWroQKA3cAQbcxtmK9/lNRmK3AqV5W24Fyq1AadWW Dm25FZhvxgtIoAE1745YLgMGqHm/QZTLgHIHUO4ABryDugModwDlDqDcAZQ7gHIHMEANLd0B zJd4NXRyB1C6tLXaoG1QntKlHWBQntKlLV3aAYoPwqP4KD4/NQivGfLUugjfjbB0aUuXdkAB anhKl7Z0aUuXtnRpJ8CosdHp0pabgQp20qUtNwMDDMpXkWr4yhVBuRAYYFBW0Zyt4Ae3A+VS oNwFlCuA0pwdYND9679QSvwvqb+E/dKYLY3ZEvYHqOEAjdnK749J/w1QG67cDQplbmRzdHJl YW0NCmVuZG9iag0KNTQwMiAwIG9iag0KPDwvUHJvZHVjZXIo/v8ATQBpAGMAcgBvAHMAbwBm AHQArgAgAFcAbwByAGQAIAAyADAAMQA2KSAvQ3JlYXRvcij+/wBNAGkAYwByAG8AcwBvAGYA dACuACAAVwBvAHIAZAAgADIAMAAxADYpIC9DcmVhdGlvbkRhdGUoRDoyMDIwMDcyMTE0MjE0 NC0wNCcwMCcpIC9Nb2REYXRlKEQ6MjAyMDA3MjExNDIxNDQtMDQnMDAnKSA+Pg0KZW5kb2Jq DQo1NDAzIDAgb2JqDQpbIDI3OCAwIDAgMCAwIDAgMCAwIDMzMyAzMzMgMCAwIDI3OCAzMzMg Mjc4IDAgNTU2IDU1NiA1NTYgNTU2IDU1NiA1NTYgNTU2IDU1NiA1NTYgNTU2IDMzMyAzMzMg MCAwIDAgMCAwIDcyMiA3MjIgNzIyIDcyMiA2NjcgNjExIDc3OCAwIDI3OCAwIDAgNjExIDgz MyA3MjIgNzc4IDY2NyAwIDcyMiA2NjcgNjExIDcyMiA2NjcgMCAwIDY2NyAwIDAgMCAwIDAg MCAwIDU1NiA2MTEgNTU2IDYxMSA1NTYgMzMzIDYxMSA2MTEgMjc4IDI3OCA1NTYgMjc4IDg4 OSA2MTEgNjExIDYxMSA2MTEgMzg5IDU1NiAzMzMgNjExIDU1NiA3NzggNTU2IDU1NiA1MDBd IA0KZW5kb2JqDQo1NDA0IDAgb2JqDQpbIDI3OCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDcyMiAwIDY2NyAw IDAgMCAyNzggMCAwIDAgMCA3MjIgMCAwIDAgMCA2NjcgNjExIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDU1NiAwIDU1NiAwIDU1NiAzMzMgNjExIDYxMSAyNzggMCAwIDAgODg5IDYxMSA2 MTEgNjExIDAgMzg5IDAgMzMzIDAgMCAwIDAgNTU2XSANCmVuZG9iag0KNTQwNSAwIG9iag0K PDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAzMzA+Pg0Kc3RyZWFtDQp4nGVSy26DMBC8 8xU+pocIzLOREFLJQ+LQh0r7AcReUkvFWIYc+Pvau2nappaMNLsz4zHrcNvsGq1mFr7YUbQw s15paWEaz1YAO8JJ6YCnTCoxXxB+xdCZIHTidplmGBrdj0FZsvDVNafZLmz1IMcj3AXhs5Vg lT6x1fu2dbg9G/MJA+iZRUFVMQm9M3rszFM3AAtRtm6k66t5WTvND+NtMcBixJzCiFHCZDoB ttMnCMrIrYqVB7eqALS86aekOvbio7PIThw7iuKo8ohzQntE8T2iNCO0JbRB34sD//a7Hp+Q RRITe39hU5/fHp8USMvS36bpP9M0JTeKkHMM5LxRSzfIayxmGRXJt4ipuKEiyYv8T6bkNlPt bxBHPEFtnRPaeFTvCkTx4Xde/5v9a7jOUJytdePDJ4Nz8xNTGq6vyozGq/z+AqIOunUNCmVu ZHN0cmVhbQ0KZW5kb2JqDQo1NDA2IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVu Z3RoIDYxODkyL0xlbmd0aDEgMTIxNTYwPj4NCnN0cmVhbQ0KeJzsfQt81MW1/5mZ376SbLJ5 Pzawu/llE8ImJCSERwhk8+SxPAIJkEUwCSG8BBIMqChKrCJ2UUFLUVsr2IpS0fLLxscCtkRb a9Va0NZnW8GKfaPUUluvkL3f+W1A6N///ffeT//13s/dM3vmzJxzZubM+c2c38yGBGJEFI9M oR2zm4pL07uabiBiK8Bt61jT3p2/5ZO5RLUjiERax1XrncOW8jcgKiGy3byse/maNX57E1GD lyjGv3z1xmWTzBvaibofJ/oke0Vn+9I/rvaeQ19/BI5dAUbyzLRr0X8u6rkr1qy/5qnRzqdR /xFR9eWruzraTywenkRs5TGI71vTfk13xq9s/ZBPhb5zTef6drHH0E7s6R9I+9a2r+nc+f21 HxC7YzXRqLHdXT3rw7m0FPIHpX73lZ3d/aV33UnUeB9RwldIztVEdJflgfLWhMq/mDPNJOGb 7w17VtLXb36z7dP1526zXW6eg6pF15cAanIN1tMCG326/pNXbZdfkAxB/BLJSZpJ28hGc0kQ B/XSLUSG32FcDqkQ5WwHGchs+JqhDF26I1TsoWU8iRk4NwqDYuBCOUGjwgN0zWW6BYDmmbVO 9OX8VDHcNtjAykwudthLLBwOo/VOwww5U0o1TmDZUpufx0fopKijLQqR+7yVxgnkY+toDmTN wFGSp9xEbuivRb0J9E4+gQTaTAeeBhYCm4BO4BJgC3AGcBNwDnQ14B3n+5FU3E6LJDU8TzbD fMoBTkdZVd6jkUoPuVCeKusYr0wMo5Eo50BWYBoG3efD70s59HJ0vflo10O9kE9GPRaYZLqd 7KAJwGTws9DPPorM16fbQeEPh+yYhvKnoA2wtQ50BnRmozwJaIXdlXxCuAPlRJQnwTeJKMcB 69HuE9kG+lbYuBTyFNS51MW4VlC71EWfBRevAqWZUugLBCXy6P9TgDlO+P9hy38F4PcP/p4H +575ex6bP7j/knY9lAlM/2fbI9fI59jzu3/2OFGIQhSiEIUoROF/J7B94UNftA3/KBjs/3Ns jUIUohCFLxIYhQ+ZgTaKxs0oRCEKUYhCFKIQhShEIQpRiEIUohCFKEQhClGIQhSiEIUo/PNA eYaWfR5f/jvYf7UtUYjC/xRgX/uiLYhCFKIQhSj8dwXxLtXwn9Na8SzViBupVLxKuSJAY+Tv TInfUK14g1bJ35lSJtBy/gw1yt+tEiGaJX+3Cm31361CPeei362qVF6jAuPzwH1UoCwj1fgQ aA7FiBcpTZlC05QHKUvspHLRinq/Xs/gqZTPt1O2sp7yxSuUb8hCnw9SstJL08Q+ilEmUb4y nNL4GZoJm4qVm8msxFOMsYmyIMtWknSdcV+kL6VN/4pxpK/+FeNE4b8X8PmUDtwITAKOA8YB JwJdQHWI5/pH9bC/pphNNPmLnlcUohCFKEQhClH4p4MYwuzIX39gaaihxLNJoX8DYzw5Ucog lQpoIk2iKrqMFlMrXUs30B7aR4/RWTaaj+NviRuMXqfFmezMdBY763JS3T/+VJF/zQHt88ij t6zWW7b/Ay0pHA6/9zmpI/xr4Jbwg+Y3B9nZPWe1P/zkxP0nvvGHfSeufueh9ycR/f3fsPgH Qf7xhA10hAasV1mvRifGzzpinP+ff4EAQqEYoGWJiY2j+ARbYlJySmpaekZmlj172HDMOYdy 3Xn5IwpGegqLRhWXjC4tG1M+dtz4CRUTKydNJi/VUF19w5Sp06b7ZsycNbtxztym5nnzF7T4 F162aDEGaP9/WXzjxZU7/kNVoed9MntSZoeBRwY+V/U1mb193if/a5+/d8GW9T1XruvuWrtm 9RWrVq5YvqxzyeJ5zbNneasmT6qcWDFh/Lix5WPKSkeXFI8qKvSMLBiRn+fOVXNcTsfwYdn2 rMyM9LSU5KREW0K8NS42xmI2GQ2K4IwK69WGNqeW16YpeerUqUWyrraD0X4Ro01zgtVwqY7m bNPVnJdqeqG57O80vRFN7wVNZnNWUmVRobNedWov16nOEFs4pwXl2+tUv1M7pZdn6uUdetmK ssuFBs76jBV1To21Oeu1hqtWBOrb6tBdX2xMrVrbGVNUSH0xsSjGoqSlq919LH0y0ws8vb6i j5PZCqO0LLWuXstU66QFmnDXty/VGue01NfZXS5/UaHGajvUJRqpNVqCR1ehWn0YzVirmfRh nCvlbGibs69wIHBbyEZL2jxxS9Wl7YtaNNHul2MkejBunZZ+7cmMz6roPKm2ZevFUrsI1Ges dMpqILDVqe2Z03Kx1CVzvx99aNzd0BZowMC3wYW+JifG4lv8LRrbggGdch5yTpHZdar1ktO2 yqlZ1Bp1RWBVGx5MVkCjuRtdwaws78HwCcqqdwaaW1SXVmVX/e112X0pFJi7sT/T68y8VFJU 2GdLjLi1Lz5hqBBnvbjQeUGml3R1WfLNveBXJi1Sp2E5aM4OJyxpUTGn8TLrHE+BjvFQA/gZ WmlL8TxWapbatoCtAnybbK8Z3DbVGfgL4fmrp/54Kad9iGN02/5CsihXyYWFBvn5subxaCNH ygViqsUThY2T9Xp5UeFVIa6p3TYnCNxHjfBtu7+iGM53ueTj3Rby0hJUtN45LZG6k5bYg+Qt 9vg13iYlA+clqfOkpPe85ELzNhXr+HE9LKRq5rwLnwRbWnL9igqNpf0H4s6I3Nek+uYsbHHW B9qGfOtrvqQWkY+/IBsqsYgADtcUNzw1TcXSm7uwRTLwMbgb1PqVbVOx1WCjllzbIuzcHylx u9C7wvpddKFnWWmJk30pbqO+/peGTGYsYJ3DnA2arW1qJPfHuFz/YKNQ+LRspZPPmg3NSavw XFqfeEn9EvPiAgIGK3nc17wwEIi5RNaAYBUINKjOhkBboD0U7l2iOm1q4KBoES2B7vq2848/ FD60za413ObHJFawiqJCVUoCgaV9JNzNLZrX3sf0wrjabX5ttsevaks8qktt6cQgfRUU52pu q0WJU02fym6d0+dltzYtbDlow3vo1uaWIGe8tq3G35cLWctBJ0K9zuWSK5my4pQV8jHspSA3 6/r2g16iXl2q6Ay93hFipPPM53mMOkI8wrNFBsrTB/LiBNERUiIS73ltBTxzhNcb0R4xpG2G xCYlh4jL05gURqAPleYWb8w4b4V3oncyr+LwiGQFwTkE3YmM+iezKmbvQ59zdXaI9fZN9NoP 6j3NHdLshabk9V7gwXKpdlFHGC8y8XmfzWDewpb+yYT+9RwaNRJkvIQRF+8EPbzIXaDH0g68 wJaByi3cpmJXq9P7+CyPTplOA9PV+qXQkIg3RDmscjmX+qWWKleHfML/VyV2kZKMe3rnAdvE 8zU2VEMFn4C2/NLqigvVBol4obpHRTYI1rO+Nl3aKru22u+5oNKu9S5xBrCIK+RKrtAbT5HY ho09RevtaJd7HJu+QwVjOhjOliV2lx8dyvdKQL7mO9rRTMm7MJK21nNJl1j8rBlDc7ecjtbb 6GzzO9uwWdicFmxUp2YAdS7Du15tlxukMTKfRsQqkPZAE9oSHoTfrpkQsZa1d6pye2vywUa8 H4lN0zVqatHIHgioAY3BRHcDlNF9nmbMmyYJPt0etb1THkOWyVNIZ+QNCXN178je7PWqyw8V 7tZ9CcdhRS2RWUdAHnIWt3ngicRAUsA5IYCVvRibUsnrmN+GDey0ORuc+qNut6MGJ0yTNT86 iiha3FIR7fVPnrbG07fY5P6Mo3+6PBFls96r/s7TGs+rmPQPCus8Gk8fD6GcPJPxOBKdpfMM 7mlwrxeryi5bOzXePBQpI+2nyab28w8s0gwcfWvqr1PEHje7tfHiLb9IS/bNvcwOxxbhNVMd Q83iQ/4YDSOH+ECcokrQU0HjMEdI/LFfjHRUVaeKk9Qmfke7xft0HKiQDRwbSlXAbpTDQEN4 QLzbX19f6g2BekbpNDiioPSgFASzsku/K97lj1I+OcA4Hkyz65J3gjU1Q4Wx4yOF/pFFpcer Y8Q79CGQi3fEcRoRadU/YlTp6WorGEzcQAmMkYP2iF+SBuTkFW/35+aV7j4ifgz5i+IFWqo3 eyFoTSxFh8+LpygJ03tSPDEkeaI/PrGUqnvE7YiVA8iPAU8ATwMV6hIP02bgduABoEIJyB3A YuBsyRH7xX7YuRftE5AXA7uA24EKPPsI+FfIXOwTq3ALc4jbxE5KBd0mvqLTB0GzQL8J/nDQ B1CXdPdQ/eugUv61If69qKeB3jNE7wbfDroLdUm/OlS/SmzQ260fontET3C4w1Y9HHInsAQo UNqJ0k64bqe8mCFn4iaxWh+pD7QUdE2Ewl3XB12q/oyu70/PLN0Dl14P118Pz10Pz11PCkSb zutsiugUiU3Q2QSdTdDZBK+UiB6M1yNvschtQCdQwO898Lvka8gHgMd0/s3IdwD3yJq4Gn4s gFVfFquCIxxYZMv7J3hLqw6LZXC1VyzrzxxWuv2zmiVGLkTQ+CGaIHU7dWlnvyVOcjv7s4ZF KLSuqI4XHXQdkFMK8lzgGGAdUBEdwdxixyExi9aYyRvv2Mw3i83KZoNSUseSjohSajQTlmSS KKJKMz3paK1k47bsqd4i9L9didwG7AbuACqYbSv4TnE5sBV+aYVRl8vbH3JCzQY8hvIJUANq CdBLgF4CuAngJoBLyKWkEdgG7B6SGi9IzreR+qelBJgPaTy48ZjlCeSnZQk4HTUralbUrNA6 xs/CQhtyJ7ARKHTeCaD8IuLsBVnJkLwNaNTlp3Wd8zKvbMvPegvzBwqYVsD2FLAdBcxbWVVd 6s1BlpSUtGX7jAMzjsw4OkNpndE1Y/MMMS4UHugPekpKdZrjlvSJYGZW6biE6on8ACxrRb4b eBwoyIG8GFgF7AIq/AByB6JbMbAKOBvYCjSgxWNyzyJ3DMkkf7cukyUp55fIBebwaLCibHb1 TMSxVuBuoEDfj0L+qK4dKR3Q+RryEzp/9pD+Hp3vQH6+jdDbyNixcCh3AKuArcBuoIGOigWI uwtk/8gdwG7gAaAiFiItEAv4Y0iP8kdFodc6OtVBaWkI7UmJZlu1jcfhoVrZPj2/R8+/rOdV ep7rjZ9u/Xi69XvTrbdMt+ajwEdQNQQ79dzlja22Pl5tnV1tLai2ord0cpGVp+q5UebsD3o+ S88LvSku6ycu659d1j+5rN9wWde5rJNcsl02toWVp+h5rMzZLj2frud53liH9YcO6wKHdZzD Wm1l9zOMTjV6PlzP7TJnHz2eUJdAlsPsI6pDTyxYWeDAG10nLBysrAYZDFZOATkXrLwf5N+C lV9xPM0+Yfrbgn0czD3pqE5lZ9g0Rdb/PET/xKbRftDToMtBH6JK5gZ9MFh5o9T/Ftp/DfVv Uo5Z6j9AjXq73Wyazv/GULv7goVLMOrXg4UbMerXqFAf9e5g4UlwvxIs/DLIXcHC1SDbg25p 4Kpg5UhHdSJbTrlc6naQm0tLZgyNOBU9rwadEmlcHyyUrerkACFWG1RHg+RLK59mKjXqwzmC qj7JYaTqXWSTqhttJ7dO41mCbryVcnRqDqo3ohfj4+6Tjr9WHpYTp7+whOD9jveexvzmo/or Ni243/HKQemuoONoYYi5n3T8RD3seC43xOYHHQOFITMERwpDnD3h6IOTNehy9qTjQOFyx2Oq Lt2rQopHvbuyyPF1daHjXjfqQceNhU9LM2gNZjwfYn/hZMeMyv2OBneIQeytxGDeGEeFeqVj AtjjQ2xa/37H6NyQNKUEfex/0jESI+apMOVxR/m8eeMO8XIysQ3eQtN60xLTfNMc00RTmanI 5DQNM2WbUsxJZps53hxnjjGbzUazYuZmMqeEwie8HvmdXYrRJolRkbmil21c5jzylR5nZo7d oyULH/c11TAtyUe+5hptnMcXMoXnauM9Ps3ceFlLH2N3+FHT+K24mzW3YIlK1ha7/B7oIDFW vOV2u6Sbttzu9zOfNtBBviVO7eMmzCQG91mDWpNBaVdVZVQlTU6c0FD3OVnbUO75DDI8F0PG sBptl6+pJVj+yCPDavxaqV4Oh1H2aVPkF0kH+TreVV93kHdL4m85yK7l6+rnSj67ts5/QY1y eDfUqFISqdZPOVKNcli/rjZDV8N6zamv68vJiSg9y6ZJJayjZ3Wl5ZG+cjEE+mqUBGp8OOXq feXy4VINCyPSWcLFncURS9A7S4gjvbNsqdTndkOl0C1V+sa5odDnHqeL938mVt0Rc/zk1sdx M78+DmOf6YyI6GAxDOlwM3Q8/0zorPlPKLP+9l8s7ZBf57Wp9Z3ANm3bVSsy5FXP2bf0F0Pf 8+W1LelYISkuO79QO+u0pWqds6+943PEHVLcrtb1UUd9c0tfh7ezLtjuba9X2+v8/Q9trvVd MtaXL4xVu/lzOtssO6uVYz3k+xyxT4ofkmP55Fg+OdZD3of0sXxza5ivsaXPTDX+2kUR2s9j Y7At2nA/rEmzdU/W98hEV8YN9kMK4f0V6/FrcWqNZgVKUVF1UbUUYZNKUbz8wnZIlHHDRJf9 ENs3JLKBnajWkIcy6lfWXfj09PSs75HZhg0e5Os3ZOjM9di8riaf1iC/X6rUKus1b1udn8nn AcUW79hWtdXdOqJ1r9Kldrm7RnTtVWars92zR8zeq1SpVe6qEVV7lWK12F08oniv4lAdbscI x15lgw7+2hav7Ujl0UreVbm5cnvl7soDlYYIO+lIztEc3prTlbM5Z3vO7pwDOUYpWNTypLdy d86HOWIDViJbD6iv083dAIqPrK7fICfSA+ty2yzdll6LsFmclhKL19JoMXSJzWK7EA5RLKrE bNEqDDhGBU0VZSDeBmNF2Y7YPbFa7EDssViDZhwwHjOeMJ42GpzGEqPX2GhsM3Ybe407jHuM lh3GHSbeFtsd2xsrbLHO2JJYb2xjrMFhYoS59QCljzZssHttJmOdIzamziF4ncNirnNI9/k9 Gzy1LdU51IHzsfxr7UWUDFSBZcAmoIG+j/ynwPeAfwYqdBPyrwC/BeyXHFEkiuozVtZJH/g9 MpJmiNL+kvLS8SHQ9mUR2rQwQutnRWhldWkGaLCqLKY6AUd1RoeQvwh8G/h74L8BDaJUlOqd b4jsQX8P9XgYpkWorJdZj2c986DA5NpZ3+PxkES5XbGeoOphl+5iYj0bqKeHsLpAoKRze2Sz DZKeBwhI1zfcQWSYQQ5gtn6ro/C7wJPA3w5OD581XEHq4KrwCZGM19FjQyj/Bv0u2k25dJqN pmdpAC+oh3CGa6SdNIWO0gGKp43sJfhTxdFpH+KfA6+zBkpnBrqX3qJFdCW9Tydw0/bROywJ /dRTN26YE8K/Q+6jW8MHoRVDtfQdOsRWsyYqRnkqL4Qv3LQ9PEDpNCL8cvhN1L5B77PccB9N RenXlIh7xGa6E1fvVfRi+CwszaUl9DDbxH6HQ2MbbVPGKIHwFTSRnqDXmA+lmbTR8KblCRx7 7qRvsXQ2ED4e/g19D4eETvT0JboVFgdpgI8StYY9+k/0JtEsaof0OnqLJbPRwhvOD9eE7wX3 YfqIe/gPhQl2eGgatdLt9AC88TqdxBknlpXj6LYf6RX2geFN2OajDXQt9cLyh9D2UTrIRrPR PB0HX44ZFtA8yLbTXozfT8eYj/nZAHtG7DWUDFaFU8Kp4d+EwzSSWmDhbnoGY5xhJdDBCCJH rFeGK+sNpeduxAyX0n10jF6BHe/A73+hv7GRSO/yG/jm8ILwvvD7sMWMQ9F4mkMLqYuuoqvp m3iqz9IP6E/sU26B5lHlOcO1htPhu+DbPKqB7bOh3YS+t+EpBSmE9DpmmcicmMV4NovNZcvZ draLhdhb7C1u5C68+n8vNPGS+IUy1mAIV6CnNHn7xypZQCvwBG6At+/CfPfRc/QCS2V5rAgz eh3tP+YTeR3St/hR/o7YIrYrZw23DJ4Y/MPgp+EAmbDKpsAPG+gReOFDlgYbCtgq1sPeg+U7 +OMiXtiEKspFtWgWfnGr2Cl+JH6iXKnsV942TDO0G/ab2gfXDr4S9oVv1o9dRtiVT4U0hsZh /SzDaroC9nUjXUmb6EYK0B1YL3fRHhzkQ3SEXqDX6Jf0RzwBYi7YvBKjr8Gq28LuQLqXPcqe Yc+xF9i77GOZeA7SCD6WV/Fa3sCX8y1IO/kx/jr/rcgWHYiivUj3iyfFW3jrKErYUIo01bDN 8LDxJdMI01TTEvOPz546N/Kc/9w7gzSYNXjZ4K7BZwZ/E54f3gj73VREo2DpVlh5L9bgXqRH sBKfpB/Sj+kN3daPGGcGrPgMpmI1FOKpVbEpODpNYzPZHKR5SAvYQqR2toStQNrMetmX2E3s ZnY7+6qe7sHc9rJvsyeRnmKHkF5jx9mv2e/ZRxyLmAusZjfP58V8AmZay6fw2Xwu0nLehdTN r+RX4Qk9zPv5Qf66SBZuxNt2sU7cK74jnhU/E58oXClUipVKZb6yXLlJOaq8orypfGpwGOoN Kwz3G5412o1jjPOMq4z3GA8Yf2s8azKaGnEK32T6mSlsdiNaPY95P3HJT7yLjUdZjyFFuYYf x77IEN2GrWwePGbkzWK1uEO8aljGTgsne5sFxEpxRfhbooH/TXSx+fwIyxEOQ4VYRrdRmO3n 7/Iz/DdKKmvmv2MjlDvZU7xL1OKqCjD8VElVbjL8Fgf4N6iCX88G+HPiJnFT+LtUYbifHTfc z18hp3KCJ9Nx7Oqt/G40+glfybdRizLG8CmthN+/bbgG/p7Mb2Ujxc+U++l9ofI/49q4C1Hj ZTZdyeWX8wlsPyLuOTacTrF11M2+Sl52mP2ShXDU3yceZjN4HJ6Wxq1sHG4TLwsX+5mIIb+0 keXxVNbIT/N54mnjMVGO+9wxepWuZYKVYO2ch0Faix2wk+cjptUjmvyUlVIG3Y14f2bwaRmx DW8atmGdPSAKaS6V0GL+ElVgb7yP1EK3UCkdwhq8lUr4PbQp3MuWIu7PRPzkhAspFbNYRMt0 2LYZ74s0noNY2IpR/4b4/yKivo99QFczJ3bWAI1QpOQ2pR6RqQ3xdxvSUlqM2n10l/EJw09p NksnUpyD92OV/4IuxzvnPYyfRZWwbyE9oBTCaici8zq0uG9wKnn1/9XlJcbpetg8Gfu8UZmK yLsrvAozXIl31Ay8E1+gleG7qRbPbm74pvA2ag0/EF6EK3hTeB/i71XhII2lrQY/n2/wKGMQ Y19gP8D76OdsG+L2VHob8cjNMuj3SN+B/ZMNhymgvIHYWRW+LfwapcIfOfDQErxFT9Ia+gB+ myoGqGxwFu8LN4huvKGO05zww2EHi6EV4dWIvE/TXpMBsaeXhhv2Yu1uU5bxEthbQGmsGNxF ht3iDfEnpfu/9G9CohCFKEQhClGIwhcLaUjpOG9l4BRjxx22ACeOkbiZyPN9Mc42Y3D2GIeb 2wScXybinDMJp5ganHsacJqYgXPWbKQmpHm4Y/lx816E89JinIzkv0ZdilPYcty8ViJdgVNe F85FV+m3v6txHroBJ7Je3HW+hBPSVqQAbrN34N6/Cyeju3F+2oM74rdwWnsUp5x+3CxCdJC+ h7vQM/q98TncNJ7HCe5FeglnsR/TT3D/fJV+irvH2/RznM3eoeM4XZ3A+ezXxOX/dWfIlj9g xF1utbbF09LH2WH+PdzDTPxIkAxKiH/vcUExJll4glGm2Wg4AjknwQrIwq5gl1OGx/Zx5bnK WbYzlTPPVVIVyrazyEaX2PtICZne6F9NzATat5pRRrGn2FMy2u9KdCW6kbFshc46xcBZr4E+ xcF8QP7L55Phk+yHhisoDt6/WVp1mD9CmWQJD3gtY8ePIa+3eoxZfrOVMtw1Jibrb/HLx5J3 ZPmYh+kpzCkkpj1lNQmrNzkW5XKvlShGsXnTxsR4lb9l2j4+deZUYtKE4lNUdarK9uvRJWyd /o2MhzXU2b0WazJjpmSLSVBGVRXUEstgLVNFXvmYsWWlaakpJiFzo5ojOWxFXouxtri4Wlk7 qrp6FJAtFyPLs6pmzPBleM6WVBdJdlG1nNUW3CKexqysWFFBOaunQpk/yvxrnIgLhf/Wr7rH 6LSoZAwLhX/bj+lQKPwj7zAUMjOQZY1H9tc4ZopLj+Mx2VswaStO8s39JpEVDxpMEYTpPm61 xijxct5pWVnpiTFrlO+nr6FElrjFnr3TteraDI/n48XnPo64YMgP5yqr5OPysHWLh76UvtL+ BMV7TSnSC2VZL5dKH4j8i3zgutgh3Ds2jY8f5ZmQPGFwybi08qLCiqyxQmW5GzMzqyoqRs/r GPw5G3Ftobdi4uj8Owbfkt5wh0+Kn8MbdvkDN+kN7yKzwZSUYUhPUpLi042JCSZbfPpwa4Yx Mc5ky7A6YuzGxFiTzR5jsJAx0Wwhky3TmsFTk0VKenxaejxPHSZSMqxZPNUek22PESmMLDxV ESlkibHbQyLfayFLCpElPj1d1tBnSkaGNTUtLTMzK4sxLpnpIiU5ediw7GxFEU+ZEpOShg93 OAwGo5QVmWwJCXFxsbFms8kYDzfHWCg9I8NupxhbYmJKSmpV/Nb0x6xb2zK6M3hGiFu96TFb 7ZatdvmjZZPRKBI444ucLQ/KDbOustJWaTtz6qTt5MeLT547c0ZW5eaR5OJcT+c+K575PO5W wyjP9bYfbB2VIUnC3wGW+GJ7f1qW4CHTR0+tTs4WSQ6TEWVvwuqEWJNAsmSQxWrRn3ZVWdKE CcVY92We0tJIjqefnqyWlyW7yl3JZUJiWaoKdAk12SWSXcmunsX7D9eHiSVf1nQZm9Pe1PrI wYbw4OnFcy4bfKx1LWuaOrg/mz0/ly1oZM8PTpDYOPjtuZESz2QLEIF84XcNn2JFjEYsnca+ ra+JPPKd8HGbjxnjLfZYZ1q83ZlZbZwyssveNaKrrKvmWrtRKWU++W8HUtLGSOotjE8aU+At yy/x1eYvMbVltxW0lXZO6i5dP+ltZ1yc1ZNsnFxaXZAdZ+UjjcYQm+HNmZydMnlytlAKRxWV FJtYWfZIY6FncnK1xTL6HuL34HoeEnMeH9+gCkuIb/bG2qYcTUuzxY6WsYaV9FN9nvG77AGa zJ5HkCrgP3wqu8rhS0/PsobYTd7kTEcey7uxrZyVH57Y1+XodnBHiBV57XWVrZldmZszt2fu zjyQeSTzaObxzA8zYzIzp/vQrt/VvBBbddaZxTNPnVksP1fazs2q76z79UysGvn5+NzQgjll O1V16oxOk9InMODWeH05MGxvfHS0vSBXAcLcusVs8ZXr7N4Ej3FyskKlBdnVSppqs4TM2f2r OY0OiV89sZpITZsSMsc8sdqWZlHHh0yngqtVuTo8VWUexAxPqScR4ySmT5CBwZVqNHJTWlpZ 6dhx6UYZGfONQ/FxXB7ycZE4YTSlpY8tH5Ofl+8eC5qn5hhTU9KS86Q2CmitpLIHFzRpa/23 TalvS3G7H1wz99tLNz2/bu+z3zldnHPDkuuv3nVnaHNAG55WMPilTdf5axb4c16+edmkazYG NlRtECvdpqrBZwMrmnzT7Lff4l+1dp527cY/3bhiy6T9CxtuX75qT+uvnn51x6hcuyF24q5F Uy/fWDF647nMxx+6rv6h9iu+WSq/f5yDqJWlv3k69PVnj4nvHb58bKwMwHEyAIdifxT7Zuxv Y5U4GXufMgpEkyyLDLzemLg4yxrRa23WN/gpRNZZNvnAqGqmjK7sSgRWez95jdKRWS/Dc8kX B9H7x6aPKSqaqAfOEdd5ECtL3HfKWMmoeXA632S4g5LJp1ul7kp8OJHfEvflRB5zjyWR7mHJ DC85y774nEYjM/amNF8uTVh86lylvkawPkaX0GIZBVgy9PFmk88tNS8/j5fbaJx8fqkp6cM5 33R35477WOnH190/y5U1/frBLveMZXeywM/YWBZeO7Luj4O7nnv9QODhr0mrRsGq+bpV03Wr cguUkeapBgFzEmFWMjFmiYFJkR8yCWNvaiT0XWqWNMqSzM4blVyelp6WlGojU/nYsUlYLaP4 qHs6t983ePSv1+2e6cr0bTIsHelbdtfg1a8Nvjj473R9CXxU1b3/OefuM3Pn3tmXO9udPZkk M2QmgYRIbpBFQSQqoKApARdQoiRBEVCayMNGUAut1aooxirWhf6FhIQBrFqf+mrVSv9tXbo8 UosWqunzWdS6ZHjnnBkE209D7jln7kwmc3/L9/f9/X7nBnhdYuYHcNVLv92z9TH6mRLgTvZS 9j+BGRTpZ/JnUZaJiBGJzYIIF+Gz5tVgtZnvxFJqU5gLgMCkgAnPZsDgFWLI/1cs4pXEXDBq NoNODnI/xSfJdi08Mqn9sFOE4iHeTAKCn+vEv/JQBOWQgbrRYcRFCMJbLilLv+dEB2ZBRztA lqB8B4V7+j1xtKOijiETxeShLkI3shhqsQQSNoyytrxNd+k25ClZ4cft8ETJcif8+4Xwf0vK hSUZ/9LrSk/Be8HPMUO9ll5najFa7HnRzUieTt9hHyNBILCsItrBqN2wmNlmxRV29bsYVxFW G+awslRBis/7AFYHZm0d8yY6CBk6am+CxKuJTmCPth+blMVut5hJUMDhIJun6mmkLhyLChUP L7v2dSt6JEEwJ+zOSc1zG6ev2FZ6qia6rd0hS06pOT9p1pqlK/YS/VwE+9ElyIPRfgH93BHE 9QevaOzjIKR7AhmAVNgOO+F2OAgPQx4DbGEE9LMEDDHidRC7yY7jkaIZ5pdMUfTvxXjlpazS gYV2EeImvkSeH+Lf9j3MI1djVmwGU+lvC2DnMzOGZDQ3SEZrw1IJPiQ9LSHpVgvhRTgoYxcl ksDMdQjw9MKJQs7keyBrUJr3Ah3rsga5KubkUTQNewJTQQ0JcK+GMSeFkJiJjBgnQvjScLzA dgnDhjPC5JhOppsZZMYYnjkEf4JeZYtw9d4jFDlOEHXg8F+J6piYacPIjH++4rcwBtG0kqsd fsB994tF3JNYcnNOHmP2cyuBCuLg9+QzDC0TI0XID3Gci0yy7C9CxbBLfpA0kshIdiYHk2NJ Nmkjp61LcQrSB7bh1IIDvsRBGMLqqNgGBrGOnk/njVfc9ez1xnkwHotH44hHkIGIFxIBLaiF NIZ3JJWEOen1eXyI11nbchDm/cuh04pXbgtexWFkOdREPNhV13LgM+GBsk0yVNOjuvoWbS8X KQp/3dfFcbKrKBwf6pJlGnmoggt2Ek08bpsTYZWkkpNVD407jTYSWKhdojl3XL+k84Gbd9z2 6+Uv3HLtizObehqvD9Xl4k1VzTMazimgncfg/AvbHnqp9PSHpdG73/vZZ6Vje+9e1rsbNh3b sSann3VR6QGi1Y+w0/NYpu4yWzechrfTO+gd87LAa3jRWpyeIWubA14N23AmNAiiOCciaxGv Y/gN/gEUeDVw4zMAfmxYoaIgCUFOEi2IAQfhZ/jl5xp2q1UxbA05pU/ZrgwqrOLzHERxeLQi /kzLPBWjRwu1Bxtx0CbwyfhX8JNMhkJIT4e2D3KCZMJhe6hLshBB1VMcTeRtTrfb49IbpqEG Ihwim4/gHN3RclkJdU5xm4SEPzGd/a+HvxzonRJCiQQKTtqA/vCD6kgojK++Bl/9U/jqQ/Bu evWbBK+5yeMNnFXwGnjwkUEJud1VQotwrvCEwBuRS9kl4qWeJd5V4vW26+0PmB+03mfbbd5t fYV7xfNz7zued7xjkc/Zzz0uFwyyPk5z+dw+T9ArSB6z1xws+Gb7tni2RQSvDyGP32fx8TLj Qxzv9ZD46GAxnVppSJLhtLT2S1AqMnnDonL+bT5ICBTyHWTyWKR3DkNkCRXhnTjv49+d71jq WO3oc7COIhQMB7ldxg8iRqQ/wnRGBiMo4jsEP8d+K0PDcC5Fq1Ef2oaeQ2+gI+h/kIh84YPw u6d94WhL2Rs65mEXVYmTjk909ODkqWcvT+5F2b9Ngs9Jb0gIdPQszhylFImCalMTUssv2bfR d6cPP7/Y2jKgchtftL5IEtDeDqxLmoRq+2VZDYUQIWT+fV0qh3x4MdSFLGUfIBlpU5amY3oD AGUaJcQaKyyCF5Cg1zc2TmaeWvrVGFwGIzuvu+KhZML3xo5df8zNeezzaXB518Wz/JArfZmA 0+G9T9zy2A09B17+zfYVK340UvpoijqpluI0xpNFWPv1sI9o/wAwnRwbsjRJhGC3WJrapJmm Wea5UfYNCVZVTakyCp2FNwpjhc9MAijANqkvtqHuyfiB+MG6V+qOxI4kfl/31+jxhOVcsaoI 7xhOp1VQREeHD+dgrsgURhhOdUN3ET40EjQy2UKwCM8eVuWq9CG4EuDsDf3ZMLdjjaHtVGNY 78N7LNBShNvx+dr+WrS9drAW1eLzI0uFPiyAInrPMBkFOFh4voBwFg2n7TcczzmQw5cn0Hbs a3VSXY6TQI2Hozi1wiCXGe9tHe8YJ4kxRbvGumwoaVJYPqrH9Lie0FmeS1iTSROGsSxbuxyG FLzSzanl0CTV8bnlMCwHCa6pLZVNItW34C/qq72gh1BAiUlXUZqNBcHkiqJjXxcWQbAofDLU pcpf6xkfxJEbKd5h3bqpgvVK1PVg5ybIRwk1du4Y8XNiDcLK5r2bH7l4+sGN/d3fL32w5fKs 7vPb1nkS1Vf9MOYPZ+45PzL/oXNu6dyxkp2z5e5r5i/5wc5JozftueXxGalgjci18uadXfPn Tgmm20Kmb22ev6LvMbLDG6PBAWwPJuwpDMWDtFuGCpgpGwpjKLDaAl0CDgaQkTgeshazDFiL zPIWGXttwLALolMQRJFhBd4igrAM5UPwAcADM3zIkDnISyLPixxrsbCH4LnYH0V4lWGWJIWB DzFPM4gpws8ML2yl7qvAToyUYwqj8IYABZ/1DB/taaE6bcEOipfvq6Qe1dqUpVnyuDrR22Jr slGHHKjLsJUUiWbIoBfzsZ5ebcTCikjmi6LHMHUJJllmyceq1IJIMmyjWoGumC2GiRrM4wky B0Z3TbyAbrhuVykOT3y3dD+8qp/Z9NUd6OGJpcSblmNvWs+dB3Q4j8ru7EdZaF8cujrUx/Xx fcE72DuDQgNq0BcyCyMX66sCa7n1gQG01b818AjzuDQYG4spIAbpLf8ut0d0YkbBELHaIjqm EmxE92sBRvCyHD770HAkojsOYlTzMg4Dyx++C9C7uo457EE4DWhw9ki/MEi8BH6CvSQGjVhn DMWw+30+qqJBHerkTQwpYqiDKlJ90YPwbnicSvdoBw5GageRJHWco19nn9RdcGwiiDcg1mU4 LFpAHpRBz5B7YS/qjWyCm9CmCI/Rj4AexryzL7vEMK9iV9uvCHVz3UGuYzEmxXuZSFHUR7oY Rpe9RRHswwRAR/jUUJfOnvYOogVBF1jiGzx/Bh2tuAX2ihRk1p9fWrkYSjtuvXjzBWvWb1hd F/OnsnPn3bB35+3XPgNZ7rwnR1M7byuuGu1PTb6oPpBR9cLevpt+21wrIAXb/SVYc3ux3XtB Gmao7qpvkNaabrRukt5JHE/wPAM3MhvYDe5bPWyLmOY5JuZL+3gmshSnCRjHRiM4+U8qmMbe OewFHKFkw4oMsSoMolHDbvaDaqMaGdWd1YPVY9Vsta+sJfwUcKiOiCPnMBzbHYMOweGrOk3M vsKk/WiFmVHYwqEIC6VjvJeUAE5Lfp+Z13hEBY6xrCaQkOzBQCiAeFtCTiakGEYrVVsOdCte xU3J5TBgjywHUQsewClmRgCsTDX2ikkMUiNdoqh4YVF4e1+Xl1MwWfvzUJcif1MzLisjnIpJ hKfZCvZ4Yx6SRP+UfnDgYu7Z/ONHVsW3f+/211bc/Nrty579PlT+sWriNfvsWflzL95y28bk xdzKhDz/R/+15fKxPU/e8eRlwzA4Cs8pXTIxY+Cizj9Nzz5671NfRIiPnXfyKLML+5gZjJUj FntybNihTePojm+88ImQY6ql6cCQO+VB+RfwFfQ2fBuNyVgF0AyBbMgM4ljMw+8y/AxyMgxi GZkzZjdw70IeT/y7EDtREd43OmiGZp+FO4iOAQb9xbAAVmUNtp0dZDn2GfQ+sFT0RHLdozTU nCBcIaOOZ8qsfsC68cWKa0jXc9fzm7nNPFtxC8wFerHctVGTCbCYwxTF8FAXKBu+nYZ+nOXg FEDHVFdI/RK9VWrphneXbu/JLcgHufOSXzzLvqTVdeKMFtyMrXcrtl4fSII8fJTa70GcP0j5 cL46tTq/Idpv7rf0+/u1TYn+5Nb8E95d/h8nhi37/PuTh1IvmV4yvyW7BWCCvIz8Usote/wJ OWGdC++A/yHfan0CWKeCZjgXzIXnppfCS1OX5a8B18Cr0YrkNamV+Zvgzam1NTfnt7HbuH6h X9xk22Tf5tzmvpe9R/yB7R77DvdjyZ+kfpIvsqPicfNfLcetx1PH66sEWUo1gyY4pZ6bIQKL P8XSQfXQfIbnasnkkINtEo4/EvYjcuTwWsUxQwUNRgMyGjobBhvGGtiG2DP4CQZ7VDX2KFPO Y3i2exiPr3AQ/q0CarTARgFt/OiJcpZD3AeSPBi7TH0mG4ra3KzoSuhcDKc0QnA5rHFWLwd1 dhzroywO/iGS0mTctctB1lZbdpyK55DIT4AOf/dq+/0WkGIdPHaY9/Z18Zyjtij8aajLccpz ysW05OmkWnB7ypknLbyfWTTzOE6VzEj4h1se7njtiUd/3vXUnqbzfrf3Z12L1sNJ64y1V13V 3zCp8aL2O6/t2pScjZ7aPLho83NDveftXHXb+Vf1bHt1/bI1S/a+2bVx/tU3rp1fWJkt/WXW rs5bdmy4+JymazD2XYA96nFsPR6QguX8OX9T6h3ureg7KXYlu57bKG6QbrSsk9c7bozcLv6H wySJ26rQVJFLefWUl2NCCRYI3EF4OfBCY1+qHcdqjIiGlE2sTuB0A4SIIq0cxsY79nk8QPYS 5PNDZT+wq/aInbEX4ZUYBauMqv4qxqjqrBqsGqtiqyDBTh2/zDA9Z0ImX/obnG68TOomyrGp tQKKKm352MrY2FTWbLUWF22WpJoIJGPJsKwvB0GFJKkiXkXMIZyp2vAQlRJnQiFRKY1c2l4h URQ+G+kSBCsoYyGQrSGcuA51WblvYKGHVLIml+PT5AqZQxgVIdFnWaEUErs2jf2q6sG+ba9d ddPLP77x+//98sPPorx9+vp5i7+zuG1p3bcDCXQDjD995R/3D93+xNanvny3tP6Wa9CBTecv +9O6wZ2/vnFRDemr7Dl5FG5n9mAc9IBLaUeP8ZF7a4LyisbtvkGcmhtAsODAoxguxpAK212D LuR6BiZwjPv/EJRR6wTNbir1OZyTWOw8sJuBQHiQLV9uiZ1RFXGcWSHRK42wmmzbdDIze8ql krq2Ccf08mo6/pzfLT0Fi8xe/DljoK9ca9UTP7OtaHxZeTGKLLLmcKmSZdRrIZ/XWWTON8Ih w2vGZFMKS0hq1NRmRQ/r/Tqj/1zzxUkBBxsAKWWptH4ygT99Vj1K9U1VDnsypL1nsYS8Zp5e Sr41X65qnXktzL+pcEF/5bq+9c+lLmavUb4s44sv/rXohUAC/p69jN7lKoAdVCO8UGRSo9x8 dimL2GeZ80g7lUmRu45O9htTm3Fe1w9QOx4GwWEwBjjA8xyHkArhYQhz0ICDkAFQhRHIwMsk gWUZBlwmlsuO5Y7Qpx2YzFZaSh09mZaJlk87Ki1ZgS0KHw93CYDBc6V09nXxjPxLsJO/fIUc zJoLT1xIbOqyk+8xU7lVIArqoJVcwYgkKjmESGidkmsoZHOtufm5pbmbpdulXZZd/kc0KSla ZCujuhlOD7NQsTpM5O8RqQIincOaPgfECfnoiGmWD19IkbnQ0GJGlRnneyBZI+w9EoRKEAYH kuq17vdrckV47f6kEanJ1aCaQ0gGWQz3k4f1B5aUe5nv06JqT8/X3cxPWzAj7YDl9NvTBGgP xHOquIld3+8JiBYtYfbKQSD5hSC0eExBKAbwAMqejr28IwN7NMME8Uf1xarMPhPlOb5KF4T2 yGhnGCfbZyDz13ZU9nPMS3nhTO94uUqYNK8lPrD84ita6vTqmS889stl57Rd+r02V8VdoPHt XXf1rJ/Wd8+FuURXID7pojk9/2/dJavOvX/lo1tOtGVp1ZH2k1UAuD1YKwEQRgvKvXvKKOww HEKhIMA8DwTDELM957PMu8CDDwEfJuZdwyOiQIhRxIA7CMLdsB8iCEUFiSBLKEbH64dfz2aJ tNTx8b99CLPlL3XjwIsvqvjAVmRoolVRZNUUksLtOu9SHKrf5te0gDfI6+TWk0QDmYZzlxTo nKmj81BV+XQkWT7tD5VPe+jpIRedjB+qjoKsmPGbNylzlFnquaH5+mLlYnWh85LQNcoKdWVo rdrPDli3KgPqgH1L6LbwDmWHep9tR+iAckD9qf9A6FXlF+rPg78I/V55W/1AOaYeC32u/EP9 PPh5qEZS5moojPkZFhIIhkIByWrSJHfAo7lFJGiiy+bUXOtCihpRQ4FA1KY6bd02SP6ulrWI XjFsKOREKBQO7gKgLLgiHDEsoqowLrdbFCUxUIRfGJKCfwbtshq2IsoNzw/BUBF9aFgjhrXd +pGVsf44smorRVqfHyOW109SqvHT3d8THaS7S9p4JJMa6LDWeTMD3MYXM16gjkP1+X8dB9SN L7YILfibplanby/r7Vis7Q8pwaCkhHGcGjcsXeEwTqwFj5OhZcPhLrckEjTMeOqJ9jM2WmOi jT2Bkg2X3oBtfDLMw3JBkQKkGTFPTPz9sujU5aWFC335afCPMfh2U8dFE8cvaEpf9/6H8OU3 56fCWSGRULy5u9jLvrz3tgu4RIKt02uWQhnFJ/5Adp1EAWDfx6w9BDJgCvoljQO5JWBJaAu4 LbQlf5//wdRu/+7Ucf9fU3/JWqaADan1+fvr78vvij+Zf9v/durttIltLqK/DCsrGpuJRQWi BTIbf3Z5CnlDr8GDL1SoN2JpPGjBwoz4jMQW/zvwzfjv8u8lBDYOE3K9yrh4ze8MuePutCtX Vz8zPqdwMbzEtyR1D7KpQG1eCJfEO5u7m/ubB5tFf85f3w4wlvnjobQvy/KICXlC8/O3xe+P v5MXIs1Gc3vz5ehyppPr5DuFztxafo1/jdYduj6+JrUhvZn/jvad0LZ8f/Mvsr/LfhD/Iu5b LCphTdKjalhz67F8HDBsDWjIhONMtGpKTZ6pi6YbGiR3VdrjcaO6NLGy7TivJC7T3ECn6WTq H25tK5CHw2fPorPhxOfPWxqAplAugAIL2Ux4Ss0k8oQ6s8Fu4HwFATyMsQxLTppkWwGwMMJC nAT9ykjU8A4HWlhjURQyyjIeo9gPFBUtVCLkobKzqfkZ+Cugg2XQC2i7OpNpmTeO7W4CR52O HnLf1iSm9rhGp/HFGbWlhVh37zg1zt4yScMHhe4KXtvKSE0q3Bir27KFWNobgoJf82mI55Nx TB7zybQ3mYdZYVIexkLJPFOAk/JMSqvKwxxXlweJYDQPQvVMQx7nYWpLpuUMAleux8GOHtjb 2wt6e76m62SDljYEog1F4cORrmhUcmeKwqdDXe4qyurcLuws+7rcSKopChNDXVJdUfgAT5XS O3Eh/CbkIE5E/afM3/mY3pCvn9xIq/CxWINOanf4fIJ2zMuhQ7BVkmJazmWG7py1rP/IexP9 +YUJTzA1L4/mPHr5PTtvnrgpsbTp+3ed/8LBK9qv7xl5dtEL26ZdoqF9oemX3XrlgYWJxlgv 0/VtvSbhje+/8aqHFUFo3TTvxsfdX67WHlk3//sLWA6TjDkn/8QpOG7EK6x+uhTKQtInzYbv Ue4LPaI8Yh9V9tvNYghfANzI3ORa576T2ep+kLnHv5s5xEgWxsqi4DnMYobLiqotruGkmBtB GoQHQZGZOxq5n0sHGFhER0ZsmT0qVItM28g2+SEZyUUma2SdEvl7CBDWq7uftsGwrdWGbH4D G7TUEvFCxRv2Ii81N++5iSsup7wu09FLO1Gf9vbgdK2HRPmeEx0n3m8d//AEhj+Swb1CzSXi 0niLkPAnzUl3gtekWmBx4UH0cbXQ5JFrAfjaEspMvrenQ8PAHAmoagAhZyDOBDis2H1dAcYp 05KsUyrT+dYyMJ6qvztiVFnI5bRXdj6wsQjJ1OxxEvuJxiezvwqHp73/8MDvNq4dv3fzL9aH ryp9dKj09IGto7D1p3dtq7ZrTr+ZW1XKvzG6pfSbI8XSx9t7HneOPP7Fwa9ehQsOneN2aDkc 6WM40pP6oRvnPTOozhabNXPwO+rd6m9Vbq261jmg3uu4z/WK9krwN6rotdmdwRAjuOCA/7YQ Sot8WAN6VAhrsh7z6L5w2mqVkS/tdgMx0DLfDssJV85u2Dl78eR/jxLZ28+NEUyY1tpgxGAk BrtjpA7JxHQPRQUPRQUPVZMHU2WLilGBpyd5PznJ74wuq+iOYMIEHXFu1pv5lCrztOs3nXL1 gD+kuNSEMxlSAoug34WHoC28CGoO36JTaiOlKOy5HT3aXlkvimioSw4Xhb/hyULdU0bAQ90T +LAb4wlS9wRnuCdWXv6bDhlh7S5V4PUU1hrAgI/9MZZfFHcHiOelMeM+62e7f1a64fd9i47B +tIvP1qyJjFZX8N09UVqEltLz/669N6zv1kegLOgB/rgjCD2sWoc1/ZhjeXhdqqvVqNhReDG wI7cE97duUO5sQZxka+b7xb6xD6pn+8XtonbJCke1oJ6NBHWMnpMNIhARd1qDUuaKBBV6OSM oCMU5jUhoGoIxjAHC+bBrkwdqFVJCwT9Goe8mgy2yV1B7VggEBSl3aLI724lfREgqMJ8gcHv 9b7RTt9rbd3umky4Not/tMu/O4JZ3RGN0S5qb+huGGxgGoBKVa1SrapU1Wo0EaeqjtOTcarq +M7C2AE4QFNHomaqa+yrZNvS0Qms7o7xFtotUz/ErAZPJUpvsDfhlIQkaOr4h0D9JAMrc6W3 if1SqavL8HxGkjJ+fzADFcxfRrogDGYA3ZKUqaY6z6Cgkz4Ohqiyg2Vlt5aR+LTXVhzXphPX zNtitG+ikzZpnraQJ+eZMlKftgzi5HgFd8Pq61MFPpGwWu0XLiy9qaanvL9mZW5aW/qGLz/I 5TIRjz++IMe6lJQrX5++kkMTx2J115fSlwdi6VLbkpQnkp22sbQ74VGNy5meW0LpROmtVe0u hVQudWwr5D7gWriOsvh0tghDxuTEFY0SK5n2ZJl7MwczL2feYX6dOc4eN33JfmmSurluvg9b Tz/Xz2/D1iMKJqkaCbrFUoRJQxY1IRjWPHqUx+ZCzlRxGm+l7CIU1pJ6LFOTNokWFieVMIYV 66kFsSRIq2mUJjaUSKWSyO0RU5n0blAFQVWuyqjqrmKrtvN8WIDzBfgcLeaMGHXASm3ESs3B Sm3EGg0FqY0E6ckgtZHgzrp/gYMTNEf9tKOHVmuwXfyt42uzKG9dI8aRqdjFxKkZGwfZxEbS eUtVVZLjkqLoSUIM1h8T4/Aky8aRTNAeWxI5PV5qFh6x3B3/Z7OgNkEMAJtEHYrFbE4PqVHn XWeE7VPWgJ+Hj3y2cL6cSMDUzBmfySaclk6aOJhbkPTKpjA2XOZ/5Zh/5pXXYBP4YO7qUsP8 OYnSohW6z+5NJCZFNjBd5XXpzaWL00T75+Bo/CSOxgX4CEWKBSZ2Vh3ypfxppHpVH4o0Go2d jevEbm+3b131du923x7vHp+5NrvWPGBmvI11/vbG7sY72J+wY42shfmO+flG5hwRa9n796id 2ECsQOPzMI3PcBiz7rnG2ZPur/F4vVE+XcNY01EJZsIhC9FjiKosxBOVhaI2W7t9ux0p9vl2 RGJEn/2knbWzRLd2HCiO7qOBooj+YZhNLe1JqCTDSYSJ50eGSt4mqZLnk+c2XLG1onkM/BgP shmqeGoDR2mZiehcPRXJK9GgEMkIqphIp6pS1SmGt2Dip+i2qTASVm1CxlQL5Bge1Ih1KpBS fC00J6y1lUIdyaLodhIa4jMESyChejidnzSpBqFojdvjxzZhSF0eT7SmwNTwOFjs66pholbK 9aJnhnza8zsj6mNbiJDEqBz2bYSzNeguUi9y2TDZoxwAg8nXrajJ7HFsPAvWP1uaGOi55+/9 c+9oC7ddiGTf+UHnmrEtpRtfu2/RVUN3vzpn/eopDofGYD6wYPCCG17/yf+8UHr+7mQC3nZV q55MFhLXlpZNa/7qp58NP/qfV1/srXLF8th+CDd4EKPHTHjwdA1g/2yDiB4kiic/HSF6TRSK J78y7GRZoP5YoIouOPALDAc57YBRagFR6sPR4sljBnXiKH1h1N+mMu+CID5q8JHFRx2w4FHC Rys+WrA0zWeBeLzuLFQXMCHQmqW1hNfV8fEPP6QDzJIA/vzrGTL/MfM82ddk9HTPHpx9ePbY bNYxe2fAaGzHS4Tt1qxHo2EtoEcLYa1Oj84Ma9P0KAprJj3mCGuaHsNhslaPNYS1s/QYlkIs HtemnXWW2WxCdbW1gYAm2h1RZEThkSiMRHPR7uhg9HB0LMpHiyhi+NXZnbOfn81EZsPZMxPR hvZCZwEVds5a9gdvZp56opfcyKD29FKAmvjmruwyPJ3KJWh9FOIUe6QV0+JpLdioRruCNVlG 81PMiRMsMuQu/OlM05AJ1YqaCFrxFzUsnHHjb5ppnwYZaknYlP4ZhfR/j0uVH4G70FoMSJlc Ds2gMQkjUk0uN/FM7qKkb2IrfWrSxKEKVuFn0EysA8y234KbV5YRyqO2XfHV3afhCj5YuvwM 8Fp1xsuw7eUBQOvIX7EA71PsWq1T1qJT49ONdINPX2a7olEMa0iPesOaXY/6whrUY1JYs+kx uw2HH9HrQ8TufCKxMx9LftQXlbrFfnFMZE6KMCe2i50is1R8XjwsMiJLXiZSGxaLJ/+xj/ws XpSMICVMyyLder8+pjM5vV3v1Jnn9cM6Imo9H+uSBh8MPj29lQhEw05Zj2TUhpw2lUYNGwoj hmoQnYoadG/mv5H9KW2hdf8kXix4KvbEN8CfrL/6AV0TrnjyT4wNSzEG7VSKU2fa4VLHUie6 wtPtudXylPJ8grN7YS5hJJBfLAszSMXo9gZUtw9BlHMaTtTuhM4iYxrxpWUpGCie/ILKBi9O 7CMyIwtDJ3ILRCUpJxriNvEh8WmRe048Ip7EkkUVUf7VcFJRuqmM/YkjOIMbiyeKaNKwPvYj kuUf7aBEr6MHM/qKHMfHO3paW8p7K07xedWvmSx+S2AqNJs0s28qwBG8hWIy2e/Uo+1zOqGM afoHI12yxJJd9ljeEFXkXel1npYwf7qFUukhV7TwGhW09+xHr/9Wl0+vieRTnriWpXLnUlTY E1ff9+ydHS2TfOHqSxunL2B2npJ9FKPn21j2Z6O/UdkXb7I+a0U4a+gDN6CbrGtz6xs2ND5n OiiL1wJoZ2fWYXNuRAvRlagfbTG2o/uMYXmf9WD+4Nm/ld+ql+1myFgRj7j628FA/U6wGw5a f1UvmgHZ3spZwlJIrgYJmJVapfnSHeDlwjvg44IimX3mHGxAeWO60T7zMfgI2mWMolHTnumv gz+Aw/A36E3mA/AB/Ah+YvrI8rHsdefdhUJ9rrAA3gd+IN9Tf3dBqnST9awSDbWEZs5wAVcO WXOASXndPs3Le8WqpJaamkIEzCZeogOpsvRQhWUnWjSjiZcFjSfMQY9mw1paj7a0naW1cCyr cQplEuGwltJjUwvN2lQIQNQqO3Ei2QYAKYwuyBWcuVwBQLnQxs3MgbYC2yxDRP4vAkGwdluf syJrUmAFwe327fa2TJ2aTqfOam7GBG53yuvx8DyXQpzYchdrzeWybD8HuznIFdEUw2LI7TLq l+EeGXM89LlRk1Uo51RoZFJovFKimMAQq60QGIoPoZ0zZj4DW2h5yneqPHWKfGLa2Us279F2 CWYhrf96q82pB1hCHVksq2/eXTFgLd9tUynJYtZxuhpbeUD6+ThVBT29Z19iSNl8bVt2eu3Z bMfijgzZ+WJq9LrlVlPE2VRf/D/GvgRMiure95xTe6/V1Vt1Vy9Vvc/0dHfN0sP0MNCFILuC isCgI2NERB3DMCIRiXESFwRzlUTjwk3UJC6gvsjOuORKFkxyo19IXpJrFiN+Hxqj4UpuiDcG puedc6oHMMl9741f1zlVXd30qfPff///34mjB+SaJXtqpPhrj6cG8JU99OzQHpmcHdqNh2ZM t1jst1FlzfKYHsCoeV5s7Z3G5HPEqHEM4W0OCiyjRihHqVSChTvsCK+viTM3Y7l2pgz8f+oW X/cUMIXGqsg1DyKZhqvgyU3fWja+qbfTX220UX4rj//bOfLvvHKlLakGboIt07XWjiT8r7a5 axaG9qMTDe+mfuxM5VU11wV/0ljwCfs4pdoqxlrVuNI/BOXLColwGtvbofrswAuYZ1uwv3QQ 86wO3rZxQxnIUAc6tFLL0DXoM2ir/oi+U39Bd8HUGLzX6vSs6r4UXZ5AWOswRio0RfNNSzmS mmyk9aQOTGABBvw+5pNRLI0YETPtEBpD37cqoX8W6pAkByU0B73qoITmeNS4cuCsc2PLxJMn aYIo5rRjA0QkFmkJCPZq92MTXJG91HWVERMbE07uGWJYulfMpOvaYYs/GGb+LngYzDWNA+q0 drMPGutPvdu5NBukwYrVQ8t02dVx+1Vf/dwa+BmhsS3bo69nrieBiixstTaefu6SZDBQvgnY so//L/wcTcTS5/ieV4UeIIY9EXfB2+JtZU1BmQanVfrVtXCNekNlo/oQ3F75sfpr9T34gep2 q9AR5s3ZJtOtdptzVCZk5tWcyfAqZ4bDTBG04LOpoDdcU6uRqlnvWNSxBtwCNqgbI+vNrWCL eqf5CHjI3AmeMh/v2NXxWvhH6qGO34Z/pR7pOB5+X30/crTjI/C38H+b2blwXnh2ZQXsDy+t XBe+OfKqetj8pfpL8x31HdNjR871pBY1UmUqtbCVKBppO5ZuUIlFXB0AA0CNABhRVSKuppuV gKmGzYpagRX828PRSCSMJFEEwDTzBdG8DNs2kUo5pevG48Yug9gRRw3eeNTqgB0Qka9wy17d 6yNR8HZqYODdJ3bjBSTyQSZYG1YamASawsQ2HwkMeSZFDo8qnahnrUlsnazDEoOmxmkVOeCq Q/sg11TVV1NlpQZEtRYemziyP1wLm4GanThMX/2QxLAtF1QrjBQJISBGYrafE0F8tmUS8Cmc BXyK9UmJYFAh8EkRQDwbCM+xcc55GzKzx09q2cVmo2AuzYQCngWXwFH4R3gMjlaWZUKx7OLK +CFzWTo0/hf2ptMbbk22ZrNd+gizYUUhns+e+g1LT09vPfPG1lP3ADjxzsT72B9eCPLwvylV LtiqQOU+CJG1qHofgkocwTwq+Xv8N/sfRm+hCST4UylFJp5ByiCeQYohFJEOEIpIK4oPYn9P SQUUJYWlwTcsb/456JAkiLSoqEgM3UmXconPp8umbMmMjAXvPh/eVnnScCITGhKVH22h2Em9 arVAnbQ3PtqCWvwB8hVBwzBT8FAKe1HUa6IOcIq4wg7qT0UKV35jUkLYdtOZaCi+gOfv0lRV m0qOH9/czKFUarBGiUMgJS9ggCiSgqRElBZYBzVlEZivrAQrlLXgOuUW5V/hTvgS3K/8GP4N Kh8iSPzefrCuCNfNJN040cSOvQmljghAhPUOduDfO4DJ0YrVyHRPc9DocCBSw5Y5mb5heZWa ElJqSA7iV6SGXcY39jhr+GuO2MNf9wdqyPJNaqczQAuhR0qNfqRJAClS3iWJ1LqWkKrFqLzT zljXHdQnIoTIYErs+oRxnf570qRBOQ0OM9MImcE3CAFmTn9Byy3C1Eiob+q0qfGp3MLTAuOZ pK9TW9hZp799htqeP7/Nj38Vjb/cTCv+NPAzSnHtDyk7hJ2OnTL7GbhR2AzvFtiZorsAmGCB l9Q+0mMRAUZmSBGPxXDMvDihimi9qsetOIr7+khfRmSnqcyLNQEMEvK+QF5X/MiOfU/W0nRA jdTMRHP+nMflKwENqiUYEPAsxOGZ7HCXYAThgyIGSyDMBkvg3Edc/DwWGNpu4MZe5r4hwPBB iknx0pmCGawYfTIwyHFKNwnU+2jBjOKT8zl0HIrw9sYtjQ8a7zVu/+0r/33g01vuvWHvKx9v +TR3fWNt4+eNHzfWwHthH5z52u55m3c0Xm7s23s3bIUz4OXP3o2fHUFvi9T/a4O77azLMn4U 9/dWK+Wb1PXa+thnC8Plr8SEjerBzIuF32i/if06w0fycrmQq2Vr+akFs7wif21+uDxadr4K YDTWElsQ+4/IbzRuRwH+e+ZX4V9nfpV/o/BBho9Z6XhB9BDRnoJJTTDSWPAHjTSI622t8UI9 vSiN0mkh2FoIhYJIFEQFROWoGbWiw1EuOq/cxDJAGVrlXWX0WPlQ+UiZKbdBquIhVeaQqniY 8nooDzdjmlTDex4tlcfgZ/YaJIj5CTuyycUDFxCsM2djnTmCddohTYpsknKCmmLbAATnyLSE Y2q2kGsJ5zphJoYP+UhrJ8xq6c5zcI55S7ALlcBCLT2VTSX0qXgXkwDS2BYo2mmFI3CEMHlR 2x1Pjwnv7x+Kx8Vg65jwpz1DwQBltSA2qiXKauInwp806PkP8p6ik6Fmuko+dBaTFOATsdwF XeMvYUsjoGFLA/7pwM+2/eaH7SMzqhfH1zw0944lnYvRpsZNo0lsafQk1zNDZLZgzy1PHfHM cTi+Prr8oQV+krUyt7GW24j5LQhysI3yW8v5cLnwFcjwHrgMz1bDDfAuuA08KP7A+w6QWK8F zoPMUpF5iB1DR6yKGCrIDEg8J4rEdhsGo4AFF4uimymm+pL+ih+dzZvm/PMKk7xZsAqoEO2T 3bobed1JN3LPy/8z3jxGkOgBzKF9dVKtSTfMknJ6NpZzuhwuxKvZTDqbRnwymCrBuBTFbOnF h5wPnxqBRAmvTHPhQRIjnlAJphV8oNUgkwUhraTWrZkWqu1mmTHhP/YNsQAkxoSj+4dEIMmh MeHDPUPyZMG1/H2yXRwx2HOZTL5ZtUt4OgDgGZa2S+ByzF2rjz+0tfFq4/erty25ZTPcCrGd Bu/EPH7LgbVfvPfT+1++cfP82re9u55y6dzVe6/unXEl1L4DTfjlxg2N1z9u3M2+/4VvNnY1 Du7ZsuUbsO/PT41ubCKQazCnF0AXsmsY9mRUwh5ZyiSbU1C5M3c4fbjEzMs8XUJqMlxenWEk KGVz2TlgOVyL1mY2wU3oxuSN+obUzdmtcLP+cOlZ+Gz2YO7l0kQmyOt3wC9m7shvzzwJn0BP ZZ4vvVJ6w/ywNFFyKyAEo0gpYG5u7y33mqsz11YcrSKKxWAwqXmNFMgWNCAmNY+RDpGYYdpC bdlMJoVgACGYeQ7pSGhteZKCaGHycwVZWCwMCsw2WggBtOdiXWPwS5a3oxCPx5DX48HuuqjQ lKTldkrS+YuqwHjeQIuwMYiM/XI3tLqHu490M91dIpUgIn0OIpUgYioUpBIkSC8GqQQJPlq9 8gXqhn4CA5EHSJSxSDvcVmzpUWlKj6bReJzU9dcGRipF4o1GovLxSc8TKrWo2nQ1i7SarN1U iXwptSfSyWwpXemE7Ql8KKfaOkE6Y+odnRBM0uHnPw9HbPybWgdZWuCF/c0TewK1AvFHA1Td 4+mJ/XLNlL1YwUNbr/eTTgLankwbOyb8ARuXbW3eGBTxQxRO7xmKdVA8NqbRWGgMFVxemQog ry2AOigOawfWidlpQCps/m/CSCDOKuw4UzcgcGsaDzaqnbo7IcdyC6tULFEHCP7nG6/f981n oTq4de3paf6Y9N3Dj93eexW6BUHY2PBJ4VTfedOtY7nGpruWu9ADcMcXbnvMj72i0Ym3WQ7L px70CKXziPKVNuiFXlKA62ULoIUrLoKLkOTrHYOzrSPdPd1RRmNXqisjK6MrNZ5zcx7QeqiX Xe9c717v2eAdTgwnhyvD5hbxLudm92bPHd7NxR3sjk5ZcXe6u9zVeGe8K14lCRglVk/oyZaW Uud0OB3VWTNiJsykaUzrmlad657busS51L1MXtqytBhPwiTSOpNVrXuJuiSyJNrfcXnn5V2X Vy/vXjHFwzidLX6n1pJ26r1TW8zeEWXEvyXzsPBw5RFzR+VQ4TutrxYP9Z7oDVwo9mhgLdKe hz+BCN4Gm/kblru6vT2mxdcmtUTixTi50hXZHsBCq8/lCbhcnqKr1cPmJDrwaTiO/chCO5Mu kLwOaCVSXRCSnhdjMG3JFd8rPvSWD+q+531v+RjfGNp8MPlcoiiTCk58Q/KxMnyl/GF5Aitj a07VKv8EnzCgrJdNrKLZ8stwNqjB2TS9iIjqgeI6LKRHTpLCy5HxEUxEtjVFNW0zx5MEaDx2 ZGYSU6KzASivO94U6d0ZU/AXcs42qRO0eIka9uODYOJTR8nVCZyutmJexkrZ62lpzSpYMYsV nnCPDS7Rw2SOP3a6RgZIhOcq52r3NfJVRRLhgdgqAOvsEieXU/XWWNNb6zS91Ezu1yx/tdoe ibQj1J5IBNp7mLjUzmPFvW+onQmkqfw/k3dS/0cImwCRduJ4OIGaNQJ2JaivM4Em658yuclM VAJDMc9mlYHnLl9zd3H6H/7tngUfvjy1K/m9aCQuZLPR5fuHbv3SlN5844n7Fx79X0Mbe8JR w4GNwOLmx6+47aLpnQtuXX3DAxdtf0vi6okK/OmXvzR4x4qO1W2J763/4pIv/+9qJFkhEYXp 2B7cRexBmKC807sCrkAr4isS18Pr0fXx6xNixagbi4yHuYe0HdxTmoBgPBEikZiURCR5WlDT IIlkr2iMoUOWX4JFYIU9dcWLTczF4HlSfoMKVlSUqMyVqHiVqMyVUuFQspggstpDPgEScmJl 4vEEm3gRFUBo4o+Wk0jkEJXFIfzte/VVA3bCwskBInwTWNg7q+QL9ji9XaSR+TG5rwlTk70F lrOKX5NvvUvNOwIEQflHdnMV7OscQImELCbVMeHk/qEkcss+KvnkM14OKSI8AyPmbKz5HKlH Y21C2s9+3Ztz+pPXLHkFuzSV8e8Q/+abKwtd84WczC1sfHdJpnfKqZOTvgzr8viHLofT8Q44 J45yu/EOlOFztj1uYmevtdJl0qzbDB2tJaFYV4Hv5RfyG71sNp3Nd6Q78uenz88/mRda8rU8 Wmyud27ybs+/kv9rju/z2JBDMqlFjFQrBR78JEicjqgq1q8oW3BLrdgz/tM+8oTx5F3qNtMJ edotxD+WJUm0XDXRwqaYaIpIJGiELxAgOpPqT55iDsTVtgEe+ktn1auyCYfNx81d5lGTNZM6 3XidbrxON15PKcptfrjWD/1U5/o95D1/grznj1ROnvW6ByYjc6RujvrdxYGz4TpaQ9cEjrGZ vuCijbuniFhQ5IyCw0dqfxHvzeazGY9eArIv52opQafDkLMlUHBmiVcGbROP5hfCAcz5YB0R ENp+VgOMGqbWOFSRO0vjfW6padzZ+N/foRz5HNaAn4CXKFM39SLzU3i0c3ExeNHx1373rqmf T9IDu5ZkIvGF962582cXYD1IYI+ZyXXjv37t7a9v/0L/X5By64XZbDUzMr570Wsj89fvfwNl b9PbCM8q2P/9FuFZNIVQzD6Hl08iG0XeF4IJ2Y1/+EFPEoUEDzaVCKZbl8ePHDkEKyQN3KXI BgyJztrOEKT2kmoneHdW7QTvtgodrdv1dNeflVPJEwbzYvgF9aXoLuNjgdsZeS76MneAf0Hg nuGe5ncKzwSfDnH/KmzzblO2h7YZ3LXBVeH17EbHqMGtCC0LLzau5q8VuMuEfvEyxxWe/iBn GYvBEmYZdwnP6UYX2xOcDeZ5uCzfIhTEQrAQ4rCZbJjGoHHE4JoQSQx4DN0RioZaQ0xIcJMl ah5sYghi0kPQkfqAPH748GES9KfYiGYFAAc14A3Kmtcj4puT4YSWHJvYbPlCAq+LgoDtvQA2 VDieJ6ReDYVJ54WkFxuSAAm8dCoMw783Q1ZoW+hEiA29Zwat4OLgruCJIKcHB4PDwdEgGxxD HxzQjQcNkheORdJA5OTAsQFMI824IakaJDoNjyqd/M+p4HZx7dk/arMNFOEIUUWSQ1VqXkup sSTKI9dE0V/DhvEbB/w1R8FPrr6x21ubjC/0k3rcgyFBTkDG46YkjB+SQGiXkm6zFpoX8PNL QyLS8lXSDQorJgibNbhV7ltzs9WWRj7bYPNyZN501HpFTxn2Q6vSez7n4hZm3Ub71ac+x35p RSCZ5rJZqZzpuO70O4xvfSledWL5gqlUm3hbuBVTaY25+GyWwwEJ9rTkAkTGkiAVyqOYZGqs U0FOEZD0g3CtTon1DLlGJN4tuESHJDgcJl8TFI/qr7nwSyPEKkpdGsmixmMMj9Z7eNItVSvz pX52ufS0xOf4otjmLLgK/kK0RWst5Nu7+Vq0y5zDzxIWOOdqS/jlwnKx37HctTy63FzSfi2/ Shhyromu0a7v3MBu4DcIGxw3Oze5NkVv1m6N3azfVLmT/aK4NXZ35W5zS/uXhUec9/vvVx+J Pqw9UPhK5QFzh/iM9IzzmegObWfsmfjTlb3CXvGgYyy6z/yB+bH4sfN0/GN9/prK1eaa9i0S 26MNJdYmP11irxauFtdIzAJpYXJuYUGF7deWVS4ymcXCYnGFk2EF4MAmYixUaY21JNuFmnMS PIwDZWqvZkox1umzn6ymiIITOsVaXiGsgXmjjzLH4cNnauk0q02KxURJcsSwzZhIiIDHzOKP BjR/odKiFRQX/pZ8Iqfla+09Wm1sYniv5nToYxNrrYApCrrL6Uxp+G4tGoslJIeDBlO1GL4Q q8RFMUXi9GalnRcE8k7MbMen7X4lXyjUagpATodDFAVp6qP8k+14z/ZY1XY7LZ6muedKZpfZ Ptq+rZ1Z1L6yfbB9mJ4cbT/RLra/J/5eutip7Y86X0Q6iMK/WU7Ltdh1xMW4nu6dOoau22sz IynijcjHVHn8JHXViuPvnvHOzum/R2p6KXeenYi3nsOv/zPDnnsUZE+fiP8T5L5+CgfYf1ib kMAQ5kvCxIFCIeSuJ8hBN/EhqSrOOmgCgwPYuAxIMcoINSQ6pVZfrgdySpCG/slGNkP/nWew wGCqycFNJrb1DuVif57EGygYePZik7XTVeHW6nmJQLFxV6Hx48brmcYNJVfg/KnwI7Xa0wad bxd07Pv6IxF/C5IzPV0lyELUFg/lpmGmz3Wl7zj1EnPV6a+xqz8XzmWzWTOV/ty4gDaPXNaR 87sVkceXWjpvG0+iDz5rhguiJ0v0lRcA7nksCerMmrOSYJ+PFVTicO7je6cUSOKfJed8Biiz uUgPyqGIyE+m3YRrVH3Jp88IBXmjD7ojUq4X3gw+Y3BKkpS1eby1ihyoyTOsojWDmUGI6b5k umsDuNl3S2q4eEtpe+qR9FPwKXmnsTO1M/1UaWflpfRL2ZdyL/YcqP9QPqwd1n9YOzTjF8ov 9I+dJ2bElIqsKyk9UyyUK5VpsqmY+lSjO28W5wC3AmboM8wZR2awr5bg+tJnK3cWt1TYmcV+ V7/BSOlIOjS9PmNBdGaeVwJlmClfbTxpPFlmm1ybYqMzrBZfrox8wCizWpY8Ci3KR0XyKLRc T66J+R8+3BzIQ5jUbQvKegWWDL0ip3xySqkDWFLqvCxofFTH35IvFTDj1nu1GgdZjYsoqhbJ pci3VqZoPaWULKdgKQBhCUtbheJqeiWg65Wy4QMsPcBUraeH5JNGIxGe58Q1dVgvAohdah2a 8HI4CIfhLngIHoUnoAOOob9Z3ln6JfoqndE7QOrxFEqNoe8dsGY8OMmMJwew64dV47lJWc2K beL4Ue7zNNnw/4vlzj2Sdpn9BGjBNv8e/GRIQwr8B9fNXH6gAltSlekM9u2IP3Ctsaq4tjI4 g6L5EPt6lDO9q/PX9qBWguunZTdBR96z/K5aWnXWyviVnhuq5cwQuX7oQKiWKoSIxj26J1Qj /2O6A04K7yGCGmHeLYlKLaUrtR4Cy3hreXsgkAwedHso2sP0T6rtM382JENXAYhccJWB4WOj hSm9DE2PtRxDmDxUgWWiGhUPmGrOiAei3z+RK2AXOmJZwED+nMKw7ikQnqP4/X77LvsK8WeY WTC98aYV4y/2xoKaJJjvNo6VlO6FjWRndvrwXGg1/nLDw1ehGxdPNY/8qdXv8pbnwrdrme4V F6MPGxfuW4lNAuiUsv5w2DcHXt54oDcf1FuZbJaTo8svgw/AzY9dhc+Yciw7p/Ej2N5dCAbl oA/iS97whdcSmeHHMmMn8YpspHsfB6BC/Ysd9aplXqFeEVlssm3hTeGNuY35e8Jb8nyEi/AI mEEhWNDNxSbHcXglhSBiDaDDjFDIZwrZsmnOhpZ5EVwurEgsLyw2b+RvFG4s3Ng6bI7CUf4O 4Y7CaOuo+VjrN+E30ePm9+O/iB819Tv5zcLmAgMFpEHb9U3mdC0JCmUN2E5wQo1riUxODYex Ux/ArCOIImGtVL6AzwpqLlwpCKZYEPI5lUvKEIBkMkGc5nBoMukrNIldkonlpT5vyhIlRB1m fO0g9Zmf0/PkKSjuqp4381Z+cX44P5rflhfyY+jhvRXCcBHShCyKPaS+qHo2Ze4Mz022F93M Ns1TtqnuoFKbTIw5Ny+GHputSXpzvXm7NQlFvUmwBI7AIo1GckQEYyaCBaLZyEEl5O8itioZ CDPsdtUmC/OpmZqXmXKcSRg07ggS/+B9nzVYqSLDCu/vEe3cP1Fz2N06An8Vja66uK/xQix3 cdv4IeKNN754XmV+IIdmJSqLpkENOvri3d1YrZWXXjk+3nhu0jWHM1DPqo60I5tta8tc0VgA v3FFOdYWoX2MAEtwbh+sUJpULFITjXfjU/5oV4+3R57FzffexW5xH5RIVauUhReC8+GFjlXs p4RB/3p2RBj238XeLoz6d4Kdjifdr4Ax+IpjzB3wyphWOYbhfRxPEs9SkiOArTNJFh0Q4Ku0 dZpldYoOZ9rnA6QCQCAVhXabzsd4lo9W/HX/Ij/j93XoMpTvFSOKf6Nx/QBFvi7Afgl2oN8d oE3pLqD1HON98rvN5pF2ayUburavnA2PwCJxQfYB2UUSmkic2TE28dfddgZDv3aQ43yyLPqc NAzmQyKkrTFt3OrczmfQIOVWjFGFRsoOl2w/fSdqG91SNaxTu5jVjQuHruwM5mLcwlP88LN8 45Es+8tK/y3wEiILdjSuQ4Pc9UAAdtdp1SLNMiWG5XIMkgU+h2WDFA5HGWJGWlXGtiYZ4g+k p1QJ6jvMjDLsKLONQY8zkNnM8bsgXIwGEcJmhjQG2/caP7Nb99owP0kixuu70G4Faz8xu+yF dtrUdkN+TPhw3xBUEDcmnNgzhOSz6K1B24AaaLAxF441fgdTjesEuOhj2p9wQeNaxNCVPGn3 X7WkxyU0KEG8Fl7IQSBzbA4xSh3vOF4QhGgXz9nLIYOVwMvhdG6YG+XYUW4bhx7nILfZBM8D BPBKXobtwABLaEsI2ofYXgjt9E7WMnDOYpoNFkjvJhavYd8QowCBLgacXYzfoJ1NjQV4JXPx Sn7HXf/XxiJ+FV7LxIeN2azS2A4YULXjVog0zgReBnRzCF7DzpmrFuW/9Nkt2kgXA4jGhD83 G8rTB1U1WOXUm2y6MXsJ/v3zJo4zW5jnQQeYxtxzTm28Xqe5yXWLSMmgJpSzotNJUCxyNQtc nbbuVdClnSFyCz7/HQ1rdRJBGiTis5Pe21kT6CiUKLSsS/gj5U6QYFvazC6XJeEvdVnxODn6 8FuusYmfWwlyk8vF3qZClV5V6R2qnE0IfW0sqByvH8d+wgBNDS8WX6+MEyL5efF1WMEnVJUf OvRmsfh9+eevk4RlzVrrjG3tRMol3VDRk7XR+g7pgINRisqt4NbOu8A9znuqfFwJ9cr10Tor xRZyC/nz9fNTC3ut+pa46PAIOkjNgwsc85zzqgumzOydN22Z8xrnndIdjjuc3iWh20MoWV9Z R4NiJ+jqK7eUul7Crp0LuLDxItVcBWfNRdHV3qqM/SZEnKdBF6PTYYOLdfWpJH2kxVlbpK5U 16pMRb1NRernsMoiKzb7rD6Elz1MWviVqvi5jTGzLR/rLB8qwdJgFnS6Xa6uLvzgT+Md4C/t fIn875NBlvyLnhrIJrOj2W1Z1sqeyKLRLMzK5KbsS2gmZoggpvJkLTgGr7ESWqXWLliemi4s FkYFRhbgCQGSZjQzp8/8tA0qrBsZKZIuQEV5nJSmkAq2yQzQjwYwxZGOvfLxdfXjJGO06KvZ HF2x9dgexgWxFjvebLZN0YU51amxNOef0tPdg3hJdIiIN1J6CvFVZ00Hvrg/BhS/N+mOwVR6 KleLgR6xS4fVLqcSk2PQk8KHXr4vBihCSICGZmyxtZUUL2MtibUlXDcCiJVaV6h9VwRUuLbj lZaJSSnT4YCnNkX3EGuRaE2deDZObGXqzloYv2KE2qPOmgNv5ZQCGR14dOBRwqN0JqNn8q+f GJH7VZVNuLrGhPf2D7lcZkLGs31DeD9bxkT3viHTyfaNidKeIdbZhC/OlFuRBPrJRm3EbLSx PD4YPrdnRjgUpBV5pEYvaCODxIik3Y7QnH/JdE9buSnR8uM/Lrukns2hSi5b2fXYLRdOjSmO sFd2BfuGV7f3wofaFs1a2rPwjht8kS9cN7N91s1LM1tWp1JtveWOrtLSbS3J84p3Nn50+9SA 4O7reXDW/XCgL9I2WJu7EgA0cWriGPMCdy8IgQz86Kzs2J3giAyQiTTgAi6g0sQu1UXC3ERU uAihkkt0QiSFi9zvJve7XGoYsEjyE5vbF7AkfFsgCLSs5DT6kUARrPqbRRvCopz+ZvGQ/Cpm eyLrbD8PG4SAwV+BP0c+Qz6b4LhcFpBaaf5SFRH6Jz/nr/vIOZ7850FyyeXKZe1qEyw6DpHZ 681/73W7IYpmbZRz8An+AL9feD+J9eBM90C3nruJ2cDexWxmn2KeFYU5AuwVA3n3DH8iMEsN uwCrhYBswDO/pD1JNMgg1iXPcwz3gSuE1UbG5ZLdi93D7m1udhQfdrkZ4CYJGCaeHnIfcQtu LD8O9lXdg9nvLmjWeZPaDDvvenxgxMb2Ruq+cI12vaXMVYjojFPI6UxCh1GHGgMR1emKifgs yRo6jDi1GIjzmt5s29SM6X/+85hlaC3YSH+/tjcIkDEmhvcNIUHSaL2gNEmvRJ2cbV2H6c/O gMlnO32+0FkMmodT79z+Lz/7xj3PLn5yqVdXY60e6C913lC77GtfW1WtFtBHL/zppye/Mtrb y+z/6tyonB4eL4z/tqPzh6/s+rYWwPp7Nqaz+VhHGShFOzaLLJzUUij6iYJqqmn4UNYrCYPG sIFISJ2WdRlxrFf2+QPoUjz59wNEb8XbGaxIsJIoDtS/f5wS0+ukY8tuhdZz39ha6gJpssNh 9zIOxfxL2Eu4S/glwnJteUy4htvAjYJRY592WD+iHwXvcNIUOAcuVS+NrUwPqoOxDepIbKty r3+bb5v6FHwCPZ/eC78DfyD8IPIH8Vjsff0kVHk0X1mm3JO8Rx9Nn0gLPh2+PHEU6PiVxGIJ xAER8yamnUFj1EDAkA2dluoMG9vOybQ9YbiN1fG3vND7g1BWEuLEzw3UyGD1KDW8SKfxWtIF F7nucyFXRaZZ3INgGGwDu8AhcBRI5AICz9wYvT2KFkfhY1EYHYMuSznBQ8DLvG3tcvzM1MwX 0JdscJn0FhgYWTe+buDYOkp6xWL9+PF1VEEcU5ps6LgkflX8xjhzfxySLr+Yf3p6emAPbQpG igxphA7buCqJKZ844K9xsjyZxq+fk8YPSXB9nXbQ65UMg5FCtOW1JDDxMTG2Z4hx/r3RS3Ah VO0CnR2TPeGa7a6pZMTCkpmffeP2r74H4b7N32pvm5rwOdPp6aumXfT1LZ+6cEoXvHz/9yD/ 1hvQc98FuUouuCGZmP+prz9xamZ5I8nKmjVxjOWwzEuCEho5x17KVWhFVwuvUhIUbXKkpAn0 eIiKwJBTp2AeoT6dgnk6vRtf/atlI3Uq+YQee5GUEBLjgRQHJxUapvNbkgdd6g+ALN7mtjaG WkFEFlbwCzatnjexzXOIkjIpGmzuxMUK/hTQnQxDPhobjkMrPhhH8aQTf40zRKViiCUiEP/C ABl11uvFR0TeIUGqFnoPXRx/Kc9XylROvl60xSUpVSwSAfTmwMDrddKdBItMzEkvgMrEob1z 5nRVCEOdVyx3DVY+y372/zD2JfBxVGee9aq6q6qrq7uqr+q7q1p9362jJbUlUMmWJSNZSOBL shFSwBMScMaSCDeJlYMQJyzWkAnEkEWeSUKy5DdjYWSQ2SEoiUIgQcEzkyWBXQKT9ZIw4Ikn 47DJgOR936tuWWZ3f7+R3VWvXt3d3/H/jvc985dMM6XjpaUSp5dmSjRVUrKe3C7zLn5n7kGO 28YhrdQm9Am7ha+Zvp09VuKWSudytKZRWvQZzBtWrJm3dmpD2rXaR4UD2p3aHDWnPc6d4p7P WpO8KyV2OyOuHk84pXSHIuEeFZ9mNeU95FtT8yifVxmrSlmjogagx+mZUGaU4wqjKrMKrbyT GWYhwJEutsD66b4Ku6W45VAtMjp4dnUaioPBH4xYmMavjAWuTCQuJV8UvIFkzsSnEkk+o1E5 E16kuYSGsua8Rq2XzaLG2oEfILkN0osghBQ86aZUqyWxyL1NKDy/yJsvUjgpaZ+oje1yYgRQ uShuDRzgNccqDsh3qNE6/eMtM/0PvvnHH94xhMVuIGdDjoIUVYIF69q5Itt5fWlk6775A/tu 6L3s/R/9CPUN/pf/TKTv+6//VV/IEZt6Ef2yZ7I69LEXfvILoHyoG7qDmafcVJhZ2ED5aV7B mlaEYjeUnaxqo9s9ZZ1CkHpIU9i4oWFoDpHA0NAdkDlOUdZgwsFBvQUaks4W4GyOyGx8HGda vPAKOQM3fvI0cI2p0Wol4gbQPxkNDeHqMUL+GAiUVpYuwoCwB8rCzVNMfeQKeQjjjkadiDiQ usxp3DzHUNwEB+V+TdwDpr82nTAxcCsOvxpwbBLI3u1WI/g9oYnfFrMHvC1e2RXostvVyKXg IbdyGvDD2PLYWK7JqK+I2YME15zjvjH/BDXhfoUx+7UQhpihqqKHqiopLrSlv4VXQfGohBTT LaR7R7bYEmT9lhHXtcq4d69vX4BDjIXlLLxo9lzBHqbvY+8VvyTfE/4G/V3fSdfP6Vel1+Tz 9L8xLucEN8FP4rc7bPk+94J0jsP6k7N9nmYswE8s5qf+Vksv3WcZUnfSOy3X0dP0Yddh/1HX Ny3fFBb5k5Z54cf0b+g3xfOCmz/NIYo7zdFTsIbvDlID5zmW+5TJTZUVDzyqy1l1jnsOeeY8 b3hMHk/wH6FO0oXTWC1BLPWEETzVtzmr8B1fE0Twi3Av8Uo6WJUUdFA5pBxRGOW82z0Dg1pn ebrMH+Hf4BmZ13n8Jvw8/ybP8o/bPSbqMNAVk9edZTtUDGMou2zX7Mw5O7LDk1jwd2nfEtlS w0zYfBlcnQLANAUD2s5iG4WUb5wGkspNYwUCdsJBD7YTwHyHLKqpaeJ8oNrboZbClpEFlkI0 PTVKDBviOZ4mfjgO380aq4p6oWrDH5h07UQanHCwAllyImhsBY19tS3B2BKMLQvZ0u2Wqkf2 V/2ao2rTyHABlLvEwhgFWcFxVoeHWuT+18kDHo/VESS1eByc1UTq4Fov6sW6SeFivRdnHqKJ DFE8iWjSSIh6De3ff+/eewqq5ydf+9Y7//rUw8+v3ou+Y5b917fu+Bzd8dInP3n97e7D/4TQ q+8g7qePbxqJt+ufAe/KEEUxd5rvo3J09wapkCgQfVjQQa0ViC8hmEOynUW8PYN4kj/utMMY Wicwtt1JRIaRSM4+Y4yX1wU+noh4KUrKSIsoeMLJQt29s0vyUtfKWfmsofSWwABYlp+Hf8tk dHJNAJyiJHIOhU/Vwxk2jq/EZxBhYMQC5yJiCZDH+KVuJVxM+vH2a8QisNsL+bqKex0W+PYr K8aYhKB++Ze1o56jSaaH6RG3+e9h7hHND5tQqXAoOsvOcnP8nOVR+VHHfMEis1i+jWfHc3SI ty9E+Aca0EKEW2R4XY1F5iLPReiII57wotwwNvjL2YzTwfKcIGPGWERXP3kEG/mL9HsnUDa3 iGTdls4gp+SQH5AkFAcif3JiooWsN20y1l1dxjreSNa6Eoq2zNoRsMa4fdK+ZD9tZ+3+/DMM y3C1ZEGDmAfP1mdN68Srt8bOTBMfdmfn6nRn1yq25ku1vHxnIuVWkglPMqGkQ1TKHQ+hD2XK YgJ9whtf5N7VLQciEQf+DR3Y/H3nqQMZB7ueZy/U3c1GOb0PZdpDEk+s0oyt3XqJSKz5CJTD Rq6n2YMeCyUu37H6eia92X/ixMjJqY+PbGqJeJv7VTVZ1EPvMttXH5tpyMfj6Z7r6L3bOg9/ 75aeQnukEv2Ey9V4wyubt2GVcNlaL/PfsWXRQV1BjTKrxvwdTmX4oeTRVoYqyPvoW7O37qCp LFtkr/6yZupqG9p3sO2W5OQ+qNX8Oe/nfUcqX7r8c1uPDHxh6Kver/qODi2aTpkXvAu+F1te HFjad3rfm/vO7QsGNE+zXHG3qvvM3+b7W7uClMK0RvuDlH+LEwom2mDwr8Xlclv4mQRyJsCX 5sR6L0GmaxO7YK1bndauucTxxHMJJrGIHj05kpuJQirRr3QbHOucix6PPhdlorVzyBqfEsXH 6r7ZftQP84H067irPw8s10+GwSNedx3k0SEeNxyQZFZhj25BWxaZRl309wslPxr2z/hp/7P0 P1AsZspBqhPvEljOfxW6Kp+XBr/HlLF+jeBllRpkyroql9HB8pHyXJkp+0Cfl0VgpXKlWmRm dqKd8G42zOW48ZMF2U0avyJ+q53GIDDMgDsTahqRAQmKN9ByJI2G0pPppfTptClthyPT9agN bvyL7gRBk75F21fep+87hr9z8z44NWQVW/bZjzzYi3qJx6u3UVOQpEwqL2Plsnjh97qD5DmK AEQU8ozKIv2s7jrahboay8wwQw8zCIYv0eDaftIfbiFrfFUGbg/wHRpPwzsyH9+77xl0OxVF whOHIfhKcuawbTS9Shpnc9Nn5NyUUQsgZxT1m5LPkEIvZ+WzNSW0+haopC4ZyjBDLahpGY7H B2OttPBy9I0ojfXS9PmzkKgEPYk3Erhnuh5jqoWYLhbyxZx658CeTVvjlVDY60PmZKKpsbmx pZFhu5NDyWIim9yd2BlCoY5IiBqoDGrUZtSlUZeZu0LUcGEwRF2d26mhHl9vCO1K7Qmh3XvC m4L48GAHtb2xX0MD/ZVWnd6iQT6rqTOErixdFaJ2ZK7SqK3eLSGjunc9A7i2yF0SeM2Sst8g NGCEB5oiqlQXijKm0YrsBL/cuSectTzgJ3j3IveenjiASRUT7DiPhnjUxaMSj1QeSTxyMjyr t/bnqaB/yyL3xskDfn8/20laLHdVXiJ1jI2Sg/D1BOSV8WvXM782FBT3kqoJ4NNgY7GaCWlE ccm/9UL9Ru0aMm9fK1qvTU3KjLMbt/B2ZefelWOfm/hBzs6wZkbK3da+/K2evrwaLYcmf3bZ 2MEbv/7+9+8ZsDoq3HhLroo8/ft7Woa3X7e1ee2PpfKm/c8ufLe55eF/QldmvjL6xWXdzFq8 AcHMbpucecqdrLodGmdizBbb5NVT1z+wp6nV50tstlyvNqqxa+l7b73z0T2bp++c27v5g880 jyTK8csPbWtRFBOGMZQNa+5/w7ZsK/3sBs0dbtdBPMiCQyBqWvDFYdtHEoJ94DUDzvOBh5TY tz47sIIvCbpchY5ktKWSKqCoSRTpXVFyjWjBB9coQNgVenHjPeICLNQ5GTfe1SUCGcj1Cgjb oN0CBgJO/EngTxp/UlQLpLBViF+w0kqlHOG8CbyCpRJYwqR6DoTTDGuYQHF5+fkmeTln9Kxg 83h5g2U80uIExq+QJb5jqgVfFC7pSAkEHAgEEAgENAg1zyHpqvkSfe1tKEq6o6Q7Srqj+G3O EZmGG79fgB248cHTsK9QaG+rYQoCKWrtFYCS+C0MbyOJEkHcotSuZytC+wS2BqSElJxpn203 zbcvtZ9uZ3IsGm6faJ+ELr0dabwvE3EsMpLuaChkIqn+BiETkftj0UwkucjY9WKskip2t0Qq PUhLtVLkLTHyczhkwe+LW2YFNC8gSZgU5oSXBZMAojBRoKLxoloYLkwUJgummcJsgZ4vICih t1Q4XTAVJtoeO0SK8xrlfwBXbywDdBbqnFRrs3DVoIM7EDLzbCKYDJn9IcTxAS4M4KHmeSSu eqhYRqxh/PsKpvAiL2AQYeKkRJpxOAlycAi1Qg2GUYwcrUapk9pwfwM+kMExRq4/sY+hhoNR sa5mNqPBg5/tvnIy6LILZX3tco/eJDBqT7nxxn5PtXdt02Uxt09SA56SHTnN969ed+fW3dfo j6/93R7NF4LBZfKVqOfBa0stQ2uha4tqPO4S2nczlxkmNNjLnXjBYe6yUg30wYv8dYqKY+UU JgXBbIQ5bFHi9YmSYWJRl4+xYK1G9IsFhliTBASwhGspCT97Co622Hx1LYQbv16oMeebdeZ8 5SThTQ1cR96h6MHoIQwNGg5irocpHQkqJx4OuADbwLowsn0FK5qVMfn1sZo3yYikrWAGwnI8 B9NvrfONTSMcEyVLuM7CwECt0d1tNHR/Wxu7Swcn4jGWhptSlBZt4Fzweu/pITjTYonHbIR7 bDQwiY1wD7yZwT0+EBOE23DP0wbDxWMbOMaws/Gzv77StWIEm2qM45+No4n4ZHw2fix+Lm7W 4sNxWodFHJR4U1MLWbdvMtaFsrGOJchaL/oDLZidXP0NtkzEiZko5e/WItEe0S+6ZvGrVCmq QeRcTmHWgixVEvreQiLgutRVYW4SRZvfFvfpuaqPxP1aN7XM+tCwD8GMx7O+Y75zPrPvROzE N4zpL2EyRTJjMV4bkBujAaj2uD6BHaqlJ00ZTvlTFMs3Pq3jh+AcLjdhCVcNTHcFzn54zoF1 6m9tXZ/fDlN/JtvRkc12dnza39i9tmVLMWjhIoFQ2o7c5vthR2c227EWXdV2VzG5Bzp3oY98 Na/5pfgkRV+4fq0XHTEfwbSdQec26A5r2kXMPpcKv/L5BRD6pFEj4jfrRPxL3WVQscEBAnTb 1MULa+QU3HiXnIIb/4OcosIpFjhFpdhMCqhaTOvgHk1nlODPZKp0dgX8oPIrKzXizeXq5Jt7 HltrT309gFg/ysHv0dVWseVOYJGq54Zzs7nv2L8TPpZjNbwxk2Nk3HM6xwT4dErrTkXSPX54 JXaXK2DJ+oNaRuSURWTXbTJFiRy+szRHSvTfoHdmDWLQ+ypMMef1BjAVGLRNnKnwpngZV9VZ DUkagln1zmmMphF/6+KFP2AbGbytJ7K5v48CZZDB07UoT44MxiCTGp/HNCKTcbddXQY3zrMr wQVClWenR6FUbG3mLmeuNgWiUWMqFLFL4URIUkMoYg8CPkN1i43MdjwaXFAUOcMu8o1P6RTK cHKQJCbIEvEkYMKq+RE+RFwbQpJK84doLJ3r7MxhUpp54di+kcZoIOj4SNRXVC5S2hGyO5vr XNM++Og7ZzbHYk02bk9iz1/Q9z2UixJqQ5SDokwilqRtzJ820FouQOCHnyyNIS4OY1y6MdxF tAG1KLDE2OS3hJ6goecMkNKaKqqoBk9IrbQoSwBLkeCPogKEWKzjlGIdpxRBNsMFilBKjRSv KMrIoZqSgjeQSJMbgWHyXzFaSVIVTKfOVoJWWtuopF8Ujbgn8+unLKKNsALz6ycElkynl6uB mNXc0tLSxQBnDSc8j+UwJEc3lmu5iiDlTklVtUo7WRnh/1+xfFWYtc6Kj0gPOx5xPqzOVZ8U hKq/GhiXxx3j6gH5oOOg+ghteSdyVqVnLJ+xP888L71Nvy2ddfzOyXc5unxdarvWVe2VpoVb JL5EZ2UtoSVL1XbULnMeeRe6Wt6pmWLyHrRHekv+g2y+wrFN/YHlB8L/FMxeiyKrYVXdSm+W WKtDctkCYliK2FV2B7PLtMM8Ku907HSxfikcjqg76HpObqnVR+gfyYyQquDv6G4RiXdhPhJY f0oU8a1r6Iq4WqNFiCHDNpgGRDPgxr8TzVAsVtsv4ioCqwBPrWCVth7AxQpM3yVLiHY4XS7Z rwYi/iKGSqkGgbZEBEBKqVhrqtRdibT2UCXKimVUXFPdGqI1FWPTMqLdCNFQQkl1IVOKlgRZ 9gltFOVdRO/q233iS1arwGLq9/t9grUszoj0ORGdFt8U6UlxCeJvXu+cD/kCahVVMbSi4qUS VZSL86TIgnm4iGaKs0W6ONFeXUS3Pxl97M+N9KhpGJGF0e2V8jRUzAG/5NjUhmqLMLVcpx9e GUw/TDhyZydJ7bXXa+fYjXnmqr6aTtmQZHgv7FvmOFKDa3oKwnPTtXR6aooyKqLImG3c2CpT 09i+xJ+wjgkvLZH03BPWqhVWjqpkrCzGClJennBU0Yb02lrSvRXJGpPC35soWIyiOwKbCChM Kk1Sa/0pYb3ozsUyXA6wtiCbnqTPcpyLWGPN9VkWUH0S16a2i8gPRNDQ2/0iH02i+6/+RPc7 71zXUI77L1/bkgym137jLw6uFXtjHqtk1wKerAPJ5vs/mPp5j1MU3WFa0+hix6trv7grWrIL 8TjyuLzN6Ia106PtPhSPO6ze6FXM5rm+oCMGMuoyjPYkLKM8xnjCOtbzYqhDsJ5bZBFX83sS aYOItEEiGAi1rIh/JraRWIdzIoA+khSxeOFXJ0mehPlZLFZ4mJ+EckEdUdd6hgSMOHs917Tu FjXw0TJ4RjfYOykXQWxuEuSDBAmK4moeUcMXSlQVPJQBwERD7JGGAcBE0atcYrJ0kVgfSKOn Z71L3nNexkuckL0tsNY3VTtakPeEbX/rsBfp3mHvhHfSO+s9hg/kxEyE629AmQibitVTJvAj caxAobhNrF3GSJ2qdLTMimhYRBPipDgrHhPPiWbxhLIBQhmGR1fnRdA0hqaIX5JgpgUPZeZ4 gpU4YX32X3QpOKoTzV3+lr61rq5iwK76AmkHcpjvf797d3uYACFGf6SPgHyimdgyc5zaY+I3 aCbvKLGgR4nX2+sgP7pj1/ZyXYeU4aeGH7ZMko7h1y/nyFG5xrbe+lG99aN6ST1KOKq3u6+b HNdNSKibkFD3djfcbXv9vO11nbW9fgHc+HfdD8duF+Ay23Pk9Bw5PddGMvmgo42UIW6DDDwy BrgtBBduI4Y9HNpGk/2k/GWbg1zDQa7hgLQp4xpauRbR/oFxDS1Lot2LF17TrXCoRtf2f4Cp FyLgir/UtHUbiAGtb+cuHY4p7UJDuw7uOrSL2bWb7Wv0JfJWrjNvNrJ/SqAlx8YwsFtdgr+6 klxHfJc0a0wAnqhlOUfWzxNbZj1MoHfiy+OrWzkzt3PXbs7X2OcgvODQSEhcyxHDPkf6cm3d ZKubbHVvx+/xz08bQfKRNnCNQHeb4SMhjd+TvW1tI9sBN0Dn9jpv4cYfyd7t20dHaizlWF/K +MnJB78CRd55pasLBD2m63nbwM6R56jeC7+ltuJPCX/KF357MuDz+3y+duMPi9lQC3d69HcK M4OpfBQ8CDkbmh1FGq9lIr5F+oOFhrZMpBE3dGvD9kykr7/BkYl4Fxn7QiyXiZQXGdtCrDsT 6cUN/fLYrtRg987Irh4+0zaoVzNpnuISfbv3wA+TyIuClWNNZq6vt7Hs8wqjGP3Kjni0rKFJ bR6mIkYVXWrLFHPx9nIbmmybb6PboE8Z3NMd375dHRwepGcGZwdpalAepAdh0IdbaRmcGBld pPdiPXjIt4j230Mg8Xre03nwNZwxVp31pGH46yL/B4lSrOfeU+teiLofoiEuSrZELBkXoyFk lxrsiY1+iGkYB0rCGLqwm9vaVPIr5j6g0qcPNPr6hIS5c5EXnjxgNZPp0SCIQfQVyYhqM7wR /w+fRE01kRgGx3kvyp71bm6Ds+ISKN2Mhvc7Cx9r3n2354b7B66Yiio2ofWytU5XR9QrmIKp 3ZWbttO0Z1PvWuP2qtUczQ+1VnYU/I0Dax1dTQECuFMScufod/dLyez+8dsHBnZtunvt1t2a osbjXjnmGEZfmizqlW3W3NoAcWhgJXc17mvUw/m2Nc/e1mA8HuzYha59KG8Acyz/RIpi/jeW f82MaaP8qxD5VybIvNEoEcVLSgwESRG2YuF4hieCrFalmEgRXiGOxlrlAfHDwzOM9GIFPP5J OFyhwuTkMLlQmFwinCF+xgyB8Jk6VM8YYJE03quNtMcSUYAzMlSIjpcJCmkk9mRjkw0mAYMi 3g2G51G3xKV4ExfIG/mHpZJRqZtkIVYvBekbpI4MYkc23I0Xhc21JYVEQ0i8oZG0yQM0GteX 4jzRxjyRLzyRNbxC0nAU0qXw0KUolRYqTI4Mk44w2RkmL0oydepCJgMiCI7IZCot/1G3I0bJ myp6tsJXQGqUK8OVicpkZbZiLpiQTtozeGu+ws5XTlfo+QqawB1LFSbMK5mIZLggM5lIvL+B z0Ts/bFwJhIzXJCNqWx3OdLYE6JiTc3kjeOxmCTZBa8S52Z5NA+e/El+jn+ZN/HgggxmmsPx rJoZzkzAvAozmdnMfIahMnKGJiUGLVhMZCZaDDdk7j/uhnT6/AxrSvgZbwiZWZ85UGd+Y8Kj MTLExvBCNnGSQAcWeRHjVJprkG1MPEFKkkpCHIDERkfk/9cNCRMXbei8CDWa0cBfPTBwQFPs 1sbNax0uvVkwdQ/edqvVDqzr7m2U1Drnnv3BwO7Ou9fu2KP6iQNSGkK3fWrqs2vhMSWMebNv P9r5rW0Bwpk0VgxnmFOYMyUqTBc28GYIA1Ej0ZYASsMelSG1XwyYgNtgJzR0F3SayGEmb4K3 ygnK0MBGqqThXbmYbmOB/XBcAE4OAhUGTG5Co25RJhhSJgDSRPAGNE2miCgaaTNE5QE5Yp1H 1QPsW50zHvRt5SnlR+hFy3L4VQvr/I2Atlm2Kns896D7LIelV4OcqjdVTCRdZk5Fz3teDNC6 iq7g60/jJBN25bDtMoSJ14ROw3LYNGGaNM2a5k2s6V2Y4rNLF+ewebaeKQJZ7uDUzg3Mp3cM zA9ftfcJMXLFE6rpiqv3jjwLef2UCX/UC0ugareM/B0VYJooE+Vmmt6W3w5u2MRaaPRiFcNW FHYm7Ek6EUoKCTbpkNwaFUYBDSkW3PJxuOWyyRoKMnjhsXo1ym/Gi5q9X/8jee2YOjGdoi0j uuMW+hb2TuFO+53O25VbfLeE+LHR2pThlpDsqAbxxwOhNKsRSoPYPCWTNEqK472kECJvvTiU pqk2GZcxm26rF+LtbmctmkVTpz99060vH3r5zhs+9dKOyk2b5z77kU9/vI85/ui9x+/6YOZb X/6bT//ptu6uR+9+Ye1Xx354/r4Jir7wp7V+5hlMiymqSu/YQIuZDjK6pEnIwgpCLRBtcvkp jcm4iFR3aWRwiQZxozpuJJJcW88Y15h0zmmys4FnjKkbdSuGQcWEvXWU5Yif0EIRuU4hTL1Y ZmMEeZaI8EtSyJfk57GoLl2SN3mKarrwwUkg1CYBaJYkPwpCxyb8dISuXUTqujRDqxAv3r/o QQIaNXxUmrWnKOS344exwtPAA5B8ctmQtWg9X+x0LWEsB1T/aaEDqLkqXyHvkw87TF/Io458 V8dAfl/+RseN+Zv5Oxx35D/Pf4t7m/+TxVbuGGkebTnQYtI7UIln0hmnC8M7/xcaXBjkpWJU KjqUilA9tDOXZkxFuRXBk9AcPJPfZ29qVIVZgZ4QZoTjAiO8o9HElRnUtGFIn56JIkg7NlKN zdGJTZB8TswtMpTNyDsHAQv+au+6v5qxw+x1ncY0Y6UKZ+MTLUkxWU5UuCYNlWx40Wxp1VCj tah9aJoxEgkGsfsk4thWknfOcvbiIvebkwfsVq/fmCzCb6+VCTKS0JlEs6eeJGLEZlN1ENWs bAj5mA0RDEMYa2CLRoFk35GhL10z9cXJx/tb003e6sCa5m9LuTxyLOJLoBaL/RM79l9+1TX6 SLkUZ6rTr9zxkQOf//nZRw55pMLa29c2R6DetrVxP3PdaNlnP7T2+MHYppErP3rqH6au9Dkh X3it30Rh2g9TOdq8gfYDSSJ6kx4yeYCHRVyk5h2wgy1FcoRrFTUJErKD85wgKagjS9KkzM8Y zgBd5sKsFHHGEj42M+q0cnaDzjCJdW10BywRCjeIbCmYBZEczALdBrNAswEpENktM6hATAXN lxou0HphpvDN9LGCqRwoR7uy7bkhWQ/o0aHsttyINBwYjQxH92bHcwfl6wLXRQ9m75anAoci U9FDuXsC/yn3denBwNcjD0a/ln009x3lscB3Q3+TO6V8Dz/Ba7l3c+/nslrh5sTN6SOuh1wP uZcK3A4XauDtmQiXqvkEgj4pojKxQAbBa8USYR/HsfZgkFJVO5BpiVLRLKIn0Aw6jhjEEw/G O8lG2TPsoZ/zvOz5nYfxkNwPz5Z8PYsXqqKt5samjamTSsRlcLZrFejXWZ+PwRdPu7xxb1Kj 0i68SCgxDaXckMxb95lDDvvUdHsO0thzo8GFMGc4FxYOcHZfjMyR4+OcmUVeOXHAuT6+51KX Q20CrVpGL0VshjbGUZ/qGpzpzE2+5v61Jld72O3b98Ur7vl75P5hdSK5qfK51P6uyWPfuLnj Gub4+x8daQolErK1iuH6gaHf//RtlNC0UHy1hP4WI4bvff/UUrMR7aefxpSYRq9tzN7NEhnM ql5HisDplE9FNZfFRgtfrSNxtY6hVZB2JIdGJQ4IlYBulVj25EAkMz7FD45wH5XEZGofSh1M HUoxqTTnExksDFfAkj+L7fj/C0dDzFG+NFQfg8sl8bkHLYcstAVfwMfiJyWC2EEsdXjGfyeC WAXPB9A3NEgmn6pmMxu8w/IyyeQbW0e9Qf0gNlOlJrpJ0mld+qyJ07NoPItUkKLELv5CLJXS upORVA8lWLMOtyYjk28GIj6yiMRRhqE4bPmOs0hnEVtUsyhLOeKqqmpoRpvVaEqTsSW8pJ3W zNpE5rH18XSGLTt9Zmq6VgZ3+uyYozZenNoQAJzGiBSLxRMKmasAU5eQFhd515M3MWnDBDXm XUGe1vq4h7o16V2PfV/iF91+8x1t21risT0ep6dQdtk2X76W623wC2ZbLKCmBORhjv/sZ1vy qdat7sy1a1dsT2GIGVeInXj9sctCRmRm/4Uz9H/DNNVounEDTaWaCU0164AgaUSi24hEt5EU DPApEfpTUaku0iRQ5k1kjopGjk9JUZMzZ0Z3mNEBMzInSgihLOe/LYKuj6BIQgugicBkgA5g tupaHhvDOK2E13g1BgMPgIwwNl35+Yr8c0Obr1NQU1RK8aasEnEWzXS2kTMu43cOmNFN5rvM tDmR5XoiaH/kkxE6knBaETzh7/UAUJQkNTcFeDuxzVJOWKVSzU01rb1srJch23sMPvLy8liX vEzGOdZGjmUseX+edjqLurWaT1urPveouDf5iPyXcbPACWkhM9E82TzTzErNi0jT78Ui+Ke2 n9qX48uJX8Reib+af8v0Vuyt+Nt5q7MrP5b/88Kn8kfQEfoIM+OZCcwEZ0KHC0eKNqi+KTAW kQ0J+RcaXozxIUZxO0NK2J8J5o9ajgqPaF+JfSVudeZs6Xx/fqh5vPn2zO35L9i/Ezve/Fvm rZCY4Rsj1LN0BKmoRKZszp2gni0uooDuyPoi/meDkYAaQHJAw98c7PQ/q8DOBqczHrNZTVKK rMwR9GOqWMo2UhR8qYFP+/0+GMzkVkrwxdIvORFyQkLb7yBfkXHr1kkJTUiT0qzESIuoVfen Av6iyiM+P5dCE6TYAgOVF+jUM0ijmpD2xECdgaDGJTH5ViF3+0IUjY1WSxj7nriAcBMS686c hwk0SYT9zIbilxg5C9j6jNusbpvNWi+FOWrUwhybvqQaJm7WajEUNYuthcqNGvWp0xlVkx0s pzqiIcRm+BAFk2FTXNocQnVlARYl1EF5n3tPfs/xfto0NoqmScHLEd0/h+boOWbO+rBt1jMb mA3Oho42PBSbK4ikWMoUGSU1oltLsVL8y/lH4o/kzWOjAOwdac1ftaT9VaQLVRp/gkYaeYBk XgjVIu7Kk4+lKsoRZ5ddgwUUEwhWycpfjRvJ+DFjJUKZM1c1X6vxdcJpXEty4ls48S2c1bzm hHPO6ZKED5OqjGzD97HBBc7pThu+jw0fgz8+B/l8eFDspX/IGCU7GtRtNF0MBJRiI+cXsuZF 7q2FA1nOGcGNDbqzXtrTKOpZU5FexeutD/KCqUgdzfVhh/HUxoKe9Gw0eds1vbs1dfyBnz57 y84DUY/XFo2GHr1u656PrP2qUHjkrtbBZofsFJnjay985cb+Qns6U+y7/q8/dTQiBFDfffdf Vd167eym6p6pr3klO8yH5L7wr3Sn6ftUkE5vzHoP604s+cIkCcIqEmeU6HEhs4s0XURFuuo5 dK56ZoQLvkGjKKOVz0uK2wTp7hRisY5cPb1SOrtc046v18e6XpRqfq+Ru0qWng3tIMSiCbCr N/yALEnoZ9KKrFIQeT7uRle4EbmdjgkY39saRGZi1piJY8lM9KvZZbjSWPKkRLO66nFXlysc 2uBYImNeulZPj40tySvy8lg9dwUTQ/AUZcMP0C1Wx9E4TXeFjzqO+p/zPKcs+n/r5+bC6HAA DYlDtnFx3PYHn5n1eXwpH6N4fP4Ag2DhDh5DjKdce1qmTNOIFSvw0MrLnjcI2vszd/AlygrR 2LyG1XKxFJ4P02EKIZPJHHcPu9CMC0HZ83nXkuu0600X65oIffdw3aipTWk0dn4MknLPw4j2 1TNGfBXvOoOwYqYITjRm1gRrZRqMlaeCCMs2ZCK4D7EST8Z1SzXaJbmmxtyZnpiD4Lq2ZoL6 kpDh3kqmjO9/5ZXmdPRyRyo201Mcyf5F280Fb8b0/bV/7F3929HLM+nrrm8ev57+WFT5+Lbk n2H6oy+cYVaZv6QS9MgG+lNSxPPK10wJq5auRV9qmEyL1KzoM0b+jRYgBwacJNLjrBOms25v 48Z5kkjmjNfNa7svwVo1u48N5+1WDsarnATzmheo0uu5/8PYl8DHUVx5V3X3zHT3HN09Z899 dc8906O5pBlLmpEsS7Zs2cKRjW0sH+CTGHzENhhw7CyHTDjMJiQhySYm2d8G+EECPrCFnWyc rEL49ocJ325Cjl+AfPuZbA4EJD9C8gVr/FV1jw6bkEWj7qrqY6a73qtX71W9+j+8NkIzO96c dsPRYhm+mp6ry11r0BbykDRrDBlFiyS70LdqX2ls6fGsNhOpzk2GPOq8pEdV8zysOrZkpelY SOXRkF6bgYlZ8VwqvsQ67TeGMyqXWq3x2Nw5FrTj1VFavDuvOtMgdlWVQaSTqqu0yjCOLaFQ HPc/z8SpkrE9WAstDC4M6Ty0bRm2rsPLAnI8SsdhjyFA94WMsp8ehwsaNhbIMury8PtYWCNr NIbVxYYW8AyG89oFj8EfQQqqLpZWt0eyWodtD9mIw2j3jI3UUPk1BkXsGfv+oSt1RRyLawrj 6U0HhlYDoeAnn9EWsbuP18cJPs7jA7zg5f2+6ZByahQErEhKKtLqmR3IaGSNFv84bTqBLGzN 1aeo6ZJzlhVOsytSHw3lcIuJBTwbT97AhZ3BuKX5Vnb/HQuGdmd87Qthz+p6+qbF1TXkw1M/ OaYuJvz+4d7V9x+GX+wpeKE89eXDw5UlhGFpu4pZKSBenkS8HCJ+NxezkgEeq96OB+MFtIXQ RpD/dRxgZ5nJN9+sK6hnUmbHH9tElvHSDBMJo/uMdnVo3W7TC6ptK1j1hHoESYyQmgnh77mQ nv3XHOeVVy/w6trVBmP9GLtKvM5NutUwLuUI7g03Osp2t90TZSJsWAhZJTHkDnlqTJWtWXHw pppnkF7E9LELxAXuRZ7t9D/RX2S+4vmS91jkCfA4/S/M191f9zzu/Vf6WeY0e1o84z7rOec9 H/mJ+B77nvi+J3uMgRHVO3FDSU3TbVoaSGrpwICWxuNaGo1qqSCoaaPh9pW4yB1gD9xD7NLd EfqU7m7haISp0SW2JFa9z+vPh3/mMRxh7xXH3GS7daFI2ER7wAa8oQCwskIAtZZ7GhnG4w6J bndeQ0PyejwSQ6McbdDrKIpGqqHNitQ3oPe4jeI4RB3eehbyrMQeY0+zP2Z17EHGi5mdb+iV R+nn6JdQKz/IuPd5MCRKCDDoeTlriWktqVB9RQplnJwxlQFzHpl24/C7p/kIPBzRagNdhdPT nK0UxqLazafTOOIoliueKfHXGHhLfNczidM94uQM7BY/ieX12EdAg9XgI3dPayZqE9FQYJ9l Q05zHQm535xBKSMZsUPnr5C2xGL3d9ZWpUNIXUJby8sFasOrDTPjAVa9xxgS7CTQwmMiftN8 lrEmo4L8tNCzbDYNBS6qocCp+LAYR1KAT/viScdPXnHRxkgJpkv2qK95Ltl8zpkICgXyYTkW iuabesLc4bcwnFGWKSHQf+ktUldReIbGs3Pmyxd1p1C7ymgrm1rtKhYOCBYig4dGLYCJiTSV kIN6To8bRL2uKBru4zTo4/RQaAz13H2qB65PNYLUvagOrtDaXowxFEioX34gAzNgnwxl474E TBi1b89ksuFwLtvS41SQydE6djdWf0xz0FLr33vcqkIF+eplZxyZzYIcD+XW57Yzu3K/lX+b +Iv8l4QJX3DCVlave8EbLIVzueSmit/tDnqjfI5iY/5YJlaNrXA95npMfCxGG+V2qT2+DCyB Q4ZF9IDUHx9KDCWPGA7zh4UH5COJI8nDuS/xD+OL5XP8c/Jzie/mXpBfSPxc/nni5VwQ6CiD 3kG5GNkQZxL6ZNk1n58vDOuWG1aKy5P3Go/yR8R73fdGj8hHYodzrjHmHtdYjDQzq+Et/C0C hVoPIqkss9CA2g/vEgJ8KBoOhEAyEwAcawlwQXcgEETN7yR2Ox2/fLDREGUpRBtoxiAlE/Zk MoFYQo7nacZO0wzSjNwOiZXtLCtHJSkvuu2i6E7Gom7RxaKWyiI6nINvouYWgG+eDEJOwCUe WJBehPpVng8GQyFA4IMQZNAlqDmL5+CNQAY0/EaDSzTQw0pSwhi6xG1mkRV4/NR5sDkZxavF HA2vMuyGj7rhd9w/cr+O5ONnJAUJAu+ZECdDHhG9tUpKPgd5EAMOJAtMDVZZH4ON2GEc9Rq+ eYo5GFfos0gg0EiVY0MgAQ8n3sEx1ZE2gW5NPGpQh6GHk/AwjqrOJ0PJRvKZ5Pnky0lDckN2 RmObxP4Abs/k1EVkpu1uSQF0yIMOoNPiRQ9S4/A22ZoM9Gi+cli9mwYu0vKTmmU4gx6Nvefo acFBzz3ykfFpMTqtBtmnYrrhkUKoxrN8NoYD1WFTCi/Us2GJ4sdx6mYSO07eOeGqyjhxqKXj jlnUSk3GoBZHJgiLEAjrQEbty4Mc0MsJo7rSqTgLS2mbAZxUAWo1OTMteVplGCU1wWOGh1EH P/GDkhh3dsJTCwN2+uXv2eNVGL422Xwp+UbzT3LzF/6OTiSAqIAvmJn6A/zmWKfLgpElXXzU 7pj6I3y/ErIFCFk2b7/0e2LR1BmSWFQ0Y4nkBYD8bySROqjGHK3VFGPFUozKAvR1Ch7dytp4 ogM7yYJsQNAEk6JoaLRTLVmhIdKOWRew8Kj5qOWoMBYbK71ifMX1i/gvigyXi7GyUTLtYfcZ f10w+Go5bk2FytV1db4udMTqiWopX1tkXMYvE/oDi2JLEotLjdpK90p5uLbPcMh4iD8kHHIe cn3OcIw/JjwmnosFLDqO5wQuE+SDQjCTZJMupcbytRXMmspwbdqbVULPfaADduAX2a9AJRcr iSwFcvgdAjm/v5rL1arTAlBRWii7WAKe1/b4nT4VQ23Z5XTGS6UyazSZiiIODOuOlcqlYlm2 HnUqAhTKSDF2mvwH3cMBGFDkndFDUSJ6NAqjbjmXqxazf0wm48VhVOMHy7Cs0xlkt8EglWV7 uSybnPF4vmiyF4smRH2RMbmKcdlt7FBiIkuaSoayDwvVDMP0ruB80BdENFFymCBISRAE3PPn siF8lsrCbDYQ8LMmpPQ+u9MJnTl5HFpOhtzQjb/CxJcb7mfcv3K/46bwAdzvu88RFVAEBrj1 RDkXR/LkJCjC4jnie6AKasTQyfCFezUg6XexH/RoevckssW0tjuanu7YMQIHr6rAo2mstKlm mfVvoNpC0Vo9qIhv8hdHca1fVKsex6gdRUd4tcjf8SbKGWi+09I5ZuE7D05M4GSCnjCghEZH tdi0KiDStDusEbVKFnu9/uUMU3XhkRWU/w2OGejAJjbjE+rmhpdXoThPooKootu6LHUdnms2 YBDqCs7VsNqD0mSCw9/2zmmuKoc4rFxgrFoDFgWcFvLWjE6Y1SN4RCYWwpuAjgn4PhxlECsk J6xaImjqiddc5VEFCGhzNaxVnueqAtoyDQcOTYjlilNLrLgzdeDxnncaNke1Qjuqiby9mkSb QDuxPy/6Mmc12RDQ5qgW8IZ+2YV/HW3WOY6+H/y7ehQIXnECCzITK8ZKVI7gke3ToWHtCkhd CPrInKI6BAdy7AexdpFQmx4C0sLtttQng23GDxipVXHDHPzd9nasZnnh08lw1OjsWbwwEoOV NqltxcGLIwurzeGs29a457N92WzzJ5I3tub8twav6UJizucSC3xk27YbPA4/EnJiZM9jzfED baQk2S0u1+jExHWCGCckSWf333L50o527BfV7CffRXKuQKyYI+eQFp1OkeDWOIz7kWWjjovj 1TunBTWLQVhPE2qWwNmCmi2MTxs96cn0m+hTVy6MTgvAltwJMGngtwvEbQVYQHon0Edvw7/B 2e1FAErFGZXr1dEJZOeqkkab9niGXzyy6jvAe/kvwH35HeBB3QzLt9wHn2TwOlxL+nNJwlbK OTdV7tTdrScYRmel3bSHSds9MUaySp5YugNWrGXvgHUbs43d7t7iucG7LXMrfYA94L7Fs9d7 a+Ze9l73I+AR5guez6fPgZdLb+ijSCNKpzOpFAtVi8KNzZBMoWWGxOiQ2+PJp1g7uiCTTqsG SDqFbkl5GIqlMyh1Iz2HjrZMERWc14KeNq5Eq36u5HJ53FhX8R5l4evsO3iCexf7NkuyB3E4 8fUMyRyk8SIef/oVDi/GORYiQkfXZ6CSqWeIjLtYegK7HKpgnnuGLo7uvjj17ijGAplquRkO TV1Ma7JoJpISPUdvwKi+wgys799TDeBuLFa0VpBm/Ih2hWmL4RSyGPzxcTp0YodfW4GjBaWu frjxoFoP+jnrcbCR3g41WHoTfNKRzYZfvyAY6EgapuSEyLib91WevmbekvZ8uJpgAwNST/MM F3bzriJi+7g/vqBZgH9NJqyM0YzMCzFsqV+6+e4jfZlU0cl1rz5GnAzmoibeBLRY0+QOxPEO +IqKoqBYaUqkjlHHzMcsT1DjlOGYC5pd+8xtlWGwiht2kF7KZbFx66jl3OvUy5yhxckJSLqc JEdYdKbFOni7Dg7rNugIXd6k7+PgXg6u53ZyBJcnWFCfQkJZ3Wl4ki2Ydga8x/M9jgAeBJQa BZ3uFBswUhaOk0jKTpIUaSQoDposLjP+FWpYB3V5s0nPr+cgl4cEy50juoEFUER3I0PC3DH0 arlhM8ybG+ZdZtLsUVx11zIX6TLljGVAQMLtdH1N67SWvrt76F2M+IujI747epG/iKOlq9gZ eDf9jK1V+sguHTs4IUJ+Einmf2olalcD9qSRAar2M5bLLzcY1KuQebRTHZnMKMM1cEly4vUW vzztrFIJO87+7LS9Su2y4uxDp61VSnTg7G9OO1CWU7NXA58DFUzYaDQ5HIRJpw5emvQEN274 3YkdBHs1rloLRhjxWLQ97FChhSvt5FrjpZ8RG5o/3thp81IJPQmmvgSXbl/s4o3Q3fxviUy5 o4XBpnzpx9FMaCseN4cPUnXiG8AFPqfyiZ8ldZyHdHBJMs7VyDK338YwPOWgoMlccoyT8dPU HQwEJQZlGxEePPIQfBQSediABIA8DEESLsgjhcP0iHmBuOo1bBdMYhKMIrVBmXy3E6n+73bi gQCMVe991kwB9OXjhj+f3EHxzLjh0vEdPEbGVdTpZvyaxVZcITVGmOZVQqF2RFmz1P2bcze+ +qWe/g32jP7I2kxuG/zYgsVbiH/+h88G1zRWbhw7agn844bLl7WxWV0HEQOrAHY7ehA8gY6m ThBQBUKzCYJ+xXkFHkYaYmDewjQkiMxzxDdRE0KdI1I0yoixQJXaQOzRVYER1dQ6taYypHsk vqliahyyQitoHNJDvRvDLzdeZn7FEMzdXGO9Y6eDcIyII2u0EcOhqfdGWyJLGR2aVEYn1SVQ p4DJpLeity4WheJV6/nCc/KEPluvZ7ONRvPFXL2RyTbqumoj2zrWSgG8/Bb8ASUQFkCCwiwi MQuARzcNR/zGUv49oAypcMQEHDdMHt9BzIUjFjAcMfzBIixHvkduhn/UfRx4wEaNPxg3kvA6 nrGD0+aGnfShV9bVOFfQdRivNIGpk7zb6/s2TIEw+A/YpUEwD02NTs6K6pZsUDGkT5qBHUcL ncAvbitXZl2BWmCrLTjLt7bKHqPJYrR6hER3MFWb//HV88jNSlc5Vg5ynIHpzBZ8sd0j+zei Gmg+efnfiSd121ANaBE/LSK5itxG3Eo8Tv6F0JPjxLqTBDSS3ybjABBv4/o5AX9NnSVqqNZQ 9bw7qZqnk9oDEkYSP6DqKYIsMuLJS6tXk4/ptv31et1XUf24AaC6dA+CBvyDqllMD89A74mk 3olnRsxAP6+UBWyIDXIuDi+pxcMz6hy7OprO6dS117rxy79uSOocjwpgptP19gCXeoVL9Tt2 qdNArqSsLZ7UYzSa/6OOqqPM71WvClnu7bkCH2nWq1j1X1A658Alrdil7CoRg0qj8mnl05Un lCcqj/Y+W3m+crHCbmvf0Lur93eV37X/v8r77YbhXhiiuWSAjUfkU4HQPRFdMsDEo65TgeA9 0aRc6XCRbVylY96yEiyNk30N8zw5CxzDSOXJJ0gKTzRnE8kE0IeCLMO2KTqek6hjuqdRP+LZ 1fujXqK34ZJiO+WjMiF/Ju7u6R2H150MP/nP06jtKnB3KzS9KsLV9QQYGQnL8snJ3YLmu4cF OQ5VrA24OzvrqUx3vatO6NOxzkwjBOqpeSF1/VFK9RjCDhzeM6USyLJsdp4ahDgLnIk4ag9I 4wUJvd9Ik6GwOlgYmgY4KKpebtMLb8OFdoz1N63eaqsD1NB4s6hJKmiSipk0E564Jc30DrgT HtoVzpRHmx3X++wsnb3tdRPjy4RSTZPU3338+ObnD668f342GMlXw7IvVdxs85AP66dqO+tI vU0HtsI3Rm2cMPXUjpAo+CRp6C5iZPGZC/urq+ORXPQaxcEtLy88hb2PXYhL64hLY6AE/xPz 6Tgs3K3x6rOulCgCC57gFPQQM6ylpM+mHCBEhwwxIh6b5tjYDMfGPL7WPOYfNY71qBzr8aDG S6hXECp8AKFyLCGYteXj+hUo81OVY83THGs2owr6GxzbWjI6h2VxpWO2LRmV4QrxaAXuqsAI bT4VoO+JxJKBUDxCnAoY7ol6koFgPCqYM2kXSYieWCLlyqbGYbxRzL4kOgAYxopFKS7wiB1p A5uISe5jnqc9hMeDvrBSJCTLTvNRM2H+DOcuV/4OJ07zoaZQTE5ap1d5u+ZyoZgrWO1thXxB KZB6WyxnL/pAwZr1zfDh6O49eE1LKlVyiCDEOrLjhree3eFAfSnq999CjFji9fpwgLwCo2uG EWc5Ec8Ntc/huG4C9ZQqd85GQEH93LQbkt7hIJnm5sCCgSaTqPYfP24YObVmy/UPJBzV+c1q b9QuhuTc3lrEJfMmcuHU0zvmxxDLNe4nVi35X9/dMzj4fv+a9gCUJGhjK2uJ80h9fcIe6Eid X4P7DBVpg3waOOG8WZnYaLOrax0d6t5pdzgNOpoWab9+BW0QXa31jsScWca5qx7fu3rVo+i6 AnYCKMW0UKy/eoHX1j6efEiEKtaDu1Ao7RKfFt8RyZA4LBINtNsgPiRSYgtvQmzhTYgtvAn1 LtntKc2uhhyMOuLmHnvA0Wc2OIFBXQ9phpK6ENKNsSTUhZAPmd4xEXg1JGE64Wqtg8Qu65Pa 1GC901q9Ej8Cw0fgtZDeU07D/7wUcmYN/+2eq/EhyKf/FioEBL+l1sN/U3WWTrUf5A6hg+RN jNtk/nP4jVc1rkZq2egsbsFzQE8unVyNNQM8QaJcrY/Alaqu0VI91CyOgnAWyvBx+J+oxxW/ g/rTMwCSJ5EBMn5cBxUssnFfijQL+HjTCt+C8rda9+i8//M9Ou9fj+k2zt4DwYfd88bs74Dm Wdg/ew/9Ee6hwZ/P0nPu4T/CPTx4+yyv3cODLWANdR21FBgAh+RtEMSBAtpBHQyAZeBasB5s BTvBLeAQeKFxw7YdwyMja1fdekdH5669icyGTdKShSa6r0EBGn18IakzI0mZTnKVr5S387zo Wzq4f8+e67f0937ytkrh5hutzuUrCX2teyX6RNatCXjW3HbjmjU33kZuibCWVC4Xi2wBymsX qsqFl9WV9oqi8C/j6fQqyvIXcHbupl4HFS3lX9Kuv+riD1yPasAejZRLxUK8ldpaqauVTp83 XFW+Or36vMF5ZVm+6vunf4/8cb5Uyj+Md38uthXbJJxrthfQ3zeLbW1FYjneT3nwAeLOmWun vpUvFQoSbCuV2uAP8cnmWrz/M776YZwjP492eVRq/rRYbHsdFeAXUGYl/rbb0Q5+p6CUpxai 3Ofy+RIRal3UNKDMb/BtPy/lSzmUQZyEkVk+iWRhENyktkGzL9Dw9wUMwAj9JB4rbARZoWQU KM4fB5LDEQ5p6GnL6PX0TvoyTdEKEiJY1k0i7fnViTRYv25UrA/9yYOVuNNGIxU0UIIKDEJp wxKteAUzqGit4ASz0cm1ZU6fXLru212FvnxE9DuybaEuu5ExFVVxknb88MBRh7ccKZqZZOaa zEMY+6PWWmE4568Naxa9yLY6Rr4NbIjf9zaWrorBF2T4QhiuCsFrfVt9xA+98IcueK1zq5O4 1wpvs8IjJnjABMdouJ+GYwTcR0DdxijMRxvR4SgZjSbd2pBCgDXawTj5FqhfqCPeHL2g4vUi rhu96g8WcBxpCxGN5IhyqZtwRSyojKPOdqNyjoB/2PjV3d0dOx7ddv2xPd2LDnz52gU7h5LB gZ1Ll+xcGM0MbSffHr7v3I2bvv2Z1cP3fXfnwfP/MP+m9u2PbFz4mX2Lenc/cu11n91WRe99 M3rZG8lXgBe0Pevh7CaoH4eLGmzInrcTdg/0esfJyVMmzmvGIyET6B8989Rrz/OvPY8aigM/ kxoKF4tz9FwCerBombgx2ZMVvUp3tEkn6lnRlaknyFckc2ygOvWv1bpPJ0l0qKtCbGyrBRgJ 134vEkKfQLWdARsaYRHpEIaYjqSo2H+ZDHkBCoInZzC4Q548VmfczrNkEYTJtxoMCSieIqg0 qtDiCdx91S9MFV4cLdSnXirgui3iUXhl1FqdLCgX8PDkaFtexmNVhnC5m2zvJnFFYpU13q0r turb4CDWDhzORa6bSik337xZzlTDpvC8YWVkfzpocMUqizfWh3cNhKu3nv3U0UqZuBRJbrx+ rZQebLR7MkvnRa8dNAod3fViqDKyKdd74K5/2kwhm7zQ3EmW0fsZgPPy680xxF9Scz35ZXSE BWbQccbEGFgDhf1gF50yG4yQRRxywsxA9F4ndRTqPOsT6M0msPOI8oOpCxPWKn+hgAigenpF hXAZGmCY+O2JE1+b+iWxa7A5CE+Tb196ZKy5Hn5tI/ngr6c+CdBTlJp7ycXkz9BTiJf/o3k/ OrLq8m/I47pthB7be4gO85sfJ08jbjCB3oZvgBgjvkCcISjiEepxVM2QRB+LiTUaWeociV39 TeRbx0kC6Sj1olrjF4pWLFxRPV/ADnkOGIdhxCKGuI083Uxth19tdsf7u4q20H7yFfNfvx6k nkJMEuFhDT/djehZbkXWrR5438Lla5oPkI9TAnpaHwBNPLKxFV3xY/UKmx9fMYx4dwsqG4D9 8gaAj2QQHz2pvo9DLS9Fd1yj3uF8H5dD6Pxz6nmXev56dP6AbglWCdTyFfWByhEkBW5Xz3te weU70PlPq+e96vlr0PnH1bJPLbew2FB5CcBSJAmAbpPuPrAUbAb/2KjdkLpvOVy+dtPg3kFi cDAVjbalwh7xEHcUCQadV5RGU6na1rb0WqlW6uyq1bypfJe4Vt8mhUt4usIaKbCDy1bKfX3g hmXLWKuMfqI+9WJBKQpFBenp9YmpiYmJ+gROoDLx6vP81MSLuAGgA7/EgGvPqwP0RdwgRrHR MVfEqGoYas0O1XdwTosOX1HCNl83pbYVRzepi+Qo7a4wFlHtej11e3ZFI252uE2OkM/LeTr8 +YpH99RTrtzCwtRUpismNDdz0XmZZjjdFbPeeacp3HHt7csL1/UnbdXF65rPumORsJTxlbuD DPwyQZtNXEh3n5jukqx+h9EkRl1yJLNwtO3xRVNfHBiS9LJsjC/uIbZOfbFzMMnJsimxuE5s XaTctGPTkpwz3h6i/F1twd+7IvGIK7dsW/XIdeFSOu5goEYb/UHdA4gyt4FvNPpu6X9wO9x+ ww399frS/mRS6Sp7pb39R03QpNPFw5KyTIF5BfYr/crKO5YOfEJaObxq9cqV/eX86pB3r354 qDMZq6tUWproYm+S160Dt9ywZQutUWnyQkEdBVMmNfKodCpeTSjUdEZH+akXiwqi1gQ+pk4j YpJdmEMwvUqvHIlrHgficeAh0iImk2tGDLcMdkQ5zVz/EEoSmJKuSmUOIUuVdgtBfW/Btv5o Nmh1++Qg5w/H3Z5yVmItZnioOiCkjcEaUkjS1bA5bO/vfp0J1Sts0xSVikHuSvImRz9/U/Ha +RlDx9nmqSto6/XQDqfugXi17o5mKaeScQQcrDOW90Y/eV2FIqfm1fokM5RlRurvgv93L0cb pp6avzyLaMznlvcQI1dRfN0zY9fY4t2pdasmZ4m96qEqjfoIpO1iWo+hdmgFCbAHPNpoW7p0 rW3EnUyOdHf3LVlglaSRUlkqGkBfvg+O9I30bdq7bsumtSui0tZN665b3D1vKSZtcG3XEtYv 33xzLmlzOiGVK5eLJjkHNo0syG+1SnqgEbc+WSwiBbPwAZJD3BJf1NohpjU/8WJxsjBDaURl bGwrWK5rg8MajZFJi4uzFEItrZtUKTdLdtSXaQS+ovA32q2unw553JLZ7vcHnYV2r26nSbaK yWhUTns10rCczeddunJFVJ8sV10PBoRYZ7oZTnTGbc1tJqm30jSVemXzlYTmpHnX3jKESU1+ FsZpq8seyniN1fUHFwzDsImepUnHqgWVqtKXcZAWv3fR+yu7F8UxmSEbG+whtk99oT4YN+Ky Kb184ANUbt+7Y/1AEtEZ91XRZj/5FGq/a8DWRts9y+DWZbcsIw47oMPoP7oQLuzpgZLfX1qb jo5IpWylvRQt5dvBiH6J3NcJUlk88ZlmXS/xeg5pDZNYt0F73CSvEJ1YcRjlf4m7M6SSCXP0 MbX+ncUZrSd8VWubbV/TLVaTsAa1wSISkk+V1981nOvLOi3OAI9EZsTTFnZFXCbaW0w3f0d7 2lLpVqMaG+vc8/UtjW0L46hJ+gOSx99d9JRyEuuBXWK1VnaQ37q0Zd83P1G1+qNWa8hlJkxu MS1Ut68mnlq1uWCeeiq1pBqZbjqL7vruHfOk9h5fNMu4c3IqgZtd33gF6Rl6LBeb/bo3Ub3u A58GxxrDNFgiCWMHcjmBYcS7hMPb4LZ1u452wa5KZUTald8FhV3CrvD9ovVOKeyNSuGwAPIf WyLdpb/xpRtWc2O5/furbQflZHK+3Aa8rEHEwwEeBms0zQm1rSiTvCodcf1PTBT/hkzkZ6iA 1zqpDaWIT+OG8pFFXPHDZCciRfHvERZeJRvJb30keXfwwyRot9hRqzjS5fV3I+JnZomvRFzR FvGLHxSV5OBHlH8fIlERbf8ui8CVH5SbBNJOASWSfwAykpsvNvYikz3ucYsJC72OvpkmmzT8 PQ2HaJiiazThpSFDw3+n4TgNRZqlpYRoTyREi4VlE7Ic8/r8Cb9kKBkIA8rkdQa7TmeAMK9r 6AhJB3W6RCwuexJeLy0KrEUH/VJA5lk8fIRsJdRbNgsT6gcxQBW3UrdSFFF3WVTGeDzDCXfz Y5YJHWIedBhxyMxxHMkW/+3RTgv4fFu+iPV/WIQBcppbSrF4PKzGtcMcJIRJ1h5LZLxwIQ93 2GPxpKu5lQ0FnJylvflomaEdgQADC1+RoCHS3yD9l07kim5k15CswyqkAocOucK83csZJLgD 7sA9kBPt7id/ijTUHrAcbHj2yBD0LHecIwugHUTIQkMabEcf/UjPckmPjDCvJ5uXly9b1t27 QIaBDNvTLZsCFmSLYaf0At5QPaDOA69nfW0CNQatqajuhUhRGC3OMcfChQClWTYBnZpayCiJ Pe67KWT/UCpwsdM5bVfiorPaCOqZcHcFfmX9pzfMCxsLff02vq29I+MLpVKst2Ph+t49XM1v iOdLGZ83XSnnLGLc7lqcqI20e4Tqx1d72zjJrfSmiHhbX8Ye9Sudne22eUtyLooiLWKsPJBT Btr8Os5m0hE2ZGEYxXRPvm1A8XEUSV76ml4v1xZGHUsWtxMElvWLLl+kCMSHdbCrEV2lwHbb gI3YqsDueh0EQyEYRkZ7z0zonR5+HNWoY1kGZkJBiD4uo9xWr6+swmobYqeTLjmOo/vUi4h7 cH2hihOKyF7UYucgqxF32xfwRC7iHhjNkdMdsT2Ap2hR59vusuhm5YXThdhIlSPknyQD5ww6 vD0Dg9Lig2sK0erg8LJI7Y6aGPW5LFHap8wfvW1o03MPrFh+37ntQ5sjYsDK6ihB4Kgo8Xlb KpNxetMBvr7/8e3rH9jcG+MSRUc8kXHb+dqC/po0ePfZnbv/7ejyMMeaDATFhXy4leLIxdch 3vKDEri+4b0vC2tZWM3cmyFqcXiPEQ7QsJ+ECwiow/US5FOh1EOpR1NUKuWs+IWS5AxEZSHA sSVF9gXAXCaDyuRr6qpTPKV79cgE5qO5Zj9Ua4HSmAidJmyf/+VD/XxqoNJ164Hb6811mY6g iY9WYrDGSmnF5RsZXbdYmb/v0XVcIiGz5E+X3fnkaOz6bZtTqGlTkiVUjBEHsh0hY/TSzaRB R3Kx+oa7V237xt5uSJIQcUUZtamt6L1LYEejEpMljrMKgoTj5oQkKEnZSjGRZUQpK1klqxiQ YxzkIM3KokgnAjGWloszL6uGTdI4ocUQUJma4FvvjpihgDmioGhWtwuxBNKuMcnjRUErqP2Q ygOGuXVCFlhJl58/FPnf3681/BTWbOhwb/XM/2fvS8DbyMoE65Xu+76lUklVOizJkqzTsnzI tnwltpPYjnM6aVmWY6Vty/hI2oEeCNAXTR/ATMMCQ7PABx8D00DTdEMDPTTkA5bthIXmm8zH Qu+yy8c1BHZmYb9vIRb73quSLCfpXpbZ2W9213mx9Oqd//X+49WrksDU3jaVmBnptrP5HVkc 4iuxJ8OC6z8rjnnF9UuOSKer/gSbazPXn6PCDqUqfLj4B9Ydy9nJaVTKQOyRRhmE2LcTJwsB tVqn1bYTNID/fLEw7aOkFtanJtSEROazaC1aSuILU+1oM8dFUxS3mXODQ3UX4ZcaGF9NYHQh rruoZltR3bPf4xEMBoTG0HCm/pfBXMAkZFlS7S9mHxE7ezJ1T2cfLRFThS4BTd6ID7Wb6m+S Uj3p+jvD3T5t/SaMC+0sa24fhGY5OBi3M/xqf2/Lau+Kgc4oyIXAsBosCdCiBwThYllHwQqs 1n4Fkmo9Wu0OiiKcTr0YrXa81D9n0ftYtNihquxLcqs9dg1vYuHFfg0HW3ix87LNtC51iLSO O7isFphM2Am/bckL7Yyp99jmgcq7zrT7+qZOnAqyvamQFkYtn3LEGMPxr63ff/2JI+Pv+M59 mVrSYNUqpHqzSkz6yE+ky+PRmfs/NjP1lspYzKzUGaRAONRDQuopPd0d/z2enX74mfnKi+8+ bTTJFGJSY7LKkC60wtWOLEme2CzkxWYz65IZNSzhckV6EoFIms1TbITwaSg3FaMOUY9RT1Li Pj7zbUpEUb50QiamJCkoC8+xFmOAMvuQN8btHSCfDBHmdTeQPLzSWAJXdvhvKBFpjue37/15 TLdLhomLXwbFVE8G/Md0Ly1XensSddqRjjjqLgndl6vbsn1uiYTq6wQ/zRRoGWn6VWAgamcY Q3g4ufPv00NtOpYVO/Np4N5pG4hBYbHHBtpIHxIlhjFHh6I/Q1QJwI8bkCoOIlhQOjQmVgI1 kFaFXhN24xkHSRG7+5fIXv4AYuK5HVKMD7hR74p1umRCRy4Nvp7OOYQyV2eMNYV6g+Qg3R1z Mcie0TtfDvaGTGhu5x9+TN4F544RoYLS5A4QYrY9QLRTMTj35+x27zUtMjeJGJ792s417Svo LgM3n1EsRnp0j+/Z4nymPeRdqZxdKFQoDLmBMcaSSzAKo8ugs+o1Up1DZrLKSZmnLw1eFjxD dQyw9Q96Bvp7HPGRuFVpD1MaaHTkeruGUTtjvV7SB6mFdQeklvAShLgIY+GRYpHoAjIZ6JJJ ZPHOLmOnTNHZ1QV9M4lGAiQKnc4mU8hYh83osMkcGo1C0TYcY9sSnk4H2+boZCVgMJagOooQ 2YLcpldoPCyl8/IiBR02TqgS+NUbLSIFFyPx4gMi7KMlkMs2B1WsLvmAFLptwnuvEMjOIE8N bTILJRJoXPDuRgaJXwDcQQlxDAT8pm5aSFuj6d4ji/2XwGBfZbLLXLf7KZHSqK5/UeQe7K17 EWMxi18J97YZgE5Bu0xGu10kuM6Qaqpztnez/pHiREAhYFmXWqrWmnXgVP3fMd0RK8s6Y3k3 OUh1xymGUXh6kvVfA0JOMz6NWi8TMLw8Cj4NKewl0gWdQafX21naZPeKWDtNUB5Iq2f1Cp+J MkA63dh5CUvGTkP9Xk02xaNpVQR7cCVlPUVaTMIQ+rvWvtFxH3vs5rUmPv9J8IwpXIztvMvi McokwdnJ+q9YKpZ3kYOenpgDQ+eF/P8dhC5B/FVh6aQD3A/ARWg57A4BE9UBjc6tI3VWjVDG 2kirNZzq8Ic9DIy4tQzJOD9CgHXizQRZJkCRmCHQk5ViaIxIwhUnwtowGfbrNQylswMHq5O7 nM4Oq80m7KBIztZCoYC2FKW+K99LXNHexPsiczsJTv8mrs3NNQQkCZWO9qU59JoSWNMRl5F3 UDoMgOl2aQAnoXPvA6OZbpdE5OzprHd3pG1CYf1pT/1poTZQiNcfyOYdIoG9Oye4vhMhv8c4 E0PBnf8cGEw4WdaTHWsjj938osC584lUgVFCCYhmHaS8+3jOielngPR7BNIvQLy/UJJp4u8m wOuJhwnyBAGCOkDo9DoWHUEkJI8D0A/w+cE4EACgbws4PHGtDdg0eiDVWx2UTXcfR3utTS6X UDLPef0lPXlKD0b1IKcHej9FyDDhvncDkygBff2+78EscvpB7MzcS3M71/BWBay89gAf8szN WXdQeAz2rA1m77KBli4NGPK9Km9fB6jRGb+J2ckqvP3p+oO5bqfQE29rs0Pi5MANTtdKXdno zb8VSHa+g/ZvoPntGImQ55iQWcIgLxRZ7Sy02iboi9cKsWx0JEqOBkEuCDrpUZrMOkYc5HHD koE8qT+vJ2dViyryqKQiIU8KzgtIObLhOoLVsjT+KY1Ps2KWTZph6XOEy6dRhH0iHAji1wLe uMUhnZszNLdacBwvzHLmm49v1MKxA/d9fnXt+fsOHLzv8yuJ9bVzh2JfE+h8xfMTE+eHfDqB yBgsLo4OlIYiNhnYWXr2wclDb39hbfnLDx82dRy5+KFTxqPV2ql8/lRtacbovetc5XAiNDp3 rspFyIINKAksjOMOfoGQQDQYbYyOkbGYK2fS+FgXY3X5Qj6NUpkyWSmzPJvyMS1O9s4VLpDj w7iXGs424IM2/HvXkGtZ0+2udjNeA1+wzMwvTqd6zqyn++bjMmaoe2fH2xtzyL3FLjArdfvD xvBY0hXoOeD1jRgF1wUapm9+ZPRcP6VR1H/v624zoecKXH1d5IFof5uBqYeFcqnYk5/q6Dua MEkkiL+B+k0hDfnrIXqIXxTGR7rAaBqMRcD58KUwWQlsBcjhAEgHwJAbZN3gGAVGXCBjnjWT GT2Y1S3qLugEaR3IqU6oqqptlbBLCU6IwYMkdOWMiPnZ+GUn2HCCeSc47AT9ThB3ArHT7PQ7 BY8JoNt3j4B0CpwC77+OfyZOauN0/PG4IB7v86K+xhfk4FNy8AE5qMnfKH9MLpBnfdDw/+q5 Np9ToPBQBPoN4ySWHSQtXJzH77fz/9Ae0+03YZFH6GcDUVF6dy8PmmsJNEbgFhET0k/Vn3/k 9BtnombR+P2fX3nd828dOzZqj8UTVOauk7ORm9/iBe5uLHCmwFBD4Oo3ydffazpSqc2P69a+ /ODEkbd/8fw9Xx+yMg6TrP9w1CQkv/3q8gejACGFNfkQ8Y6C8aEu8FAOhKGKYtvDxvb2MEiy iEKxno6O9je3gwvt4K520N8O2hM9PcaESpJkjQ6NMZn2BcMgLAZANTTgs1NObMzbOyiVUkMR Ks6Ya3+JY0IdUs1zuxIbwz8HgEilQw62PsdtvOAnEj1ALOYF+BZrzTk6UMKFnGkHZnMm03JH VuCs/4XaoDMoqXCHod6W7PMo5J6+FPgkPXFkyhdMOyKZTEwNgCUUjrt2BvSheNpFhZ1qV2Yi 5sxowTdRJFT/ba7XJWJZY6QYJwOxoYiJEWrcDtfpfHQ4xVrVwvrXnGHKKGbB72FwrFZrwsms LTKedUvwrsME9Ou+ByV+nPjqczql+SAUVTN6i5Amp03RKTKV6p0M+gIBJSqb6f1r4ssE+WfE owR5lqgRZJQAGsKNtiN0krfqwJRuXreuE6R0RWhaY4OXg+BwEHiCgAhqg2QwmIs9nANzOZDP HcyROYfENzg+PjqIRDjmc/j9tAPFMIi8jShmDj+PgOVXp2+9moP6EQY0V/E1vvF9FZ8wBIzf 37jJh24TUILGrT8crMMYjxI1dEogKmgIPH6JCPkOVu4PMadD3oRXx/SfzsVODoWY8QtT/v7O mFFv0ymEDKNJdOWTPhE7lKLdualUojQZZ4bOFYO9cb/OYlX4yafCp5LhNhMTtQUKXV0eR+HQ 2Xxkfjqr1WsVGp0EjA/OdXvUAoM/3+btzne5Xb0H53oScyMhtU5tNUF+xKCu/SiUdTdxtpB3 Ux9wgTe6HnORva5JF+l2xVyky0yAd5BgjXwTSXaQ/SSpJWmSJDVSVmtWox0OF7BIfZzy3bny Ay4ceGnnpVcQ3a4mtPz3boi/x9PAZMoK3qNmxFQ07/1zBd0Vq7cn85T0ncn+oE7AqgTXf5Ed YJU7nb6+dhvL2tr7fOQ3zeG+tl9A6KXQPr4BQp8jSoX0dgQcjyxFyId14CEtuE8J3iIHnZ32 BCGO9yeANkEn4glBIqHP22nWqndYQSeVs0O4PxuExhCZQexUo2iCt/3cdzOM5R0lLrbw3xrj cKEtukvEucpv6Cq4xXqL5/RCOfjdb8tRPPHTTB8tJTV0/tSgd3ykz6Q3K6Am7YpD79jRMRis X8pvt+VGguovPAc+zrkHpshQR/2YKjswlPOpHBHakclmXeCjdCZgxj6THOIvxB7xWwvDWQcQ O8wOv0NgkWalcJGIpVLW4TI6pHKHy+NxuRx2nU4qt9qldnncajda4R/6cNgVLo/VKAZyHWXg PcrGznAfpAfauYP6B4cW6PEovBmMC2FcgUtwUIFJ5MeP7BkMSOn4eeqgtyJgv+h90ahaUf+3 crVUGPYDrTfmZ0z1H/nq7zX5WOQWMcBgNwYsO8+SOmfQbVXYrAxD5Y9mdoyC4WSnQ4iiLPsf fiyG7iXRS3y78JZ7VCAUog0GilXqdIQyEknE6Y9mn82S41mQy4J85mCGlGbA/XKwIQdiOZBn soLOj6aeTZHvToFLKTCWAp0pUE1uJx9KCvJJcMEN3MlUWiGiH6QBeusfqaSVdGeBIGRsZ29v p9ydVgiNqYyipz2kg8YqTOg5cjXvP+OH+5A2ScQaN5/12NXG/1qyfAvckhMyTr4w9dDeKC9Z SK1w5IQqBG+aIHI2KPqkzmVWKZU/+ZugPeRjjeCNCodVK1Wpxa/8GwF0fXUOWg0SUJ1HbPWX /fXf1//RV/+K1e8L2CCxBUqz3shQOy+AF+cLw7SIYUi52aRwe73qnf8KdiROj1dtdulkJMOI dKGJws0dcmXnXYJQftAjQZxwQivphZyYANLCu4PBeG9vymIh1MPqYnw0QaXiozSV8sqTbipF DanURbVSXfTKK6mt1H0pwQykvRqkYGmcShkpKmWzURQMoOQjHfHRuMLjlXsfioPXxxHrtuRg UQ7icq+cHY0bR0fjUHV7gddbPDQxMTpaLBTiRVAsFlI9Xn+8jQr2ykfHKbscqC2U9TZhRjkY IaGDTEnujga/Gdm8sYFY84D6yhX8oeNkXddar9mt1mg0OhhR4HsjmIegyTJLdpdlaAlIDHys zd8VgTrE1LyxnM0KMDd/a/RTBqHaZVt6RGVSSdRmmxwcsPeMHk284Vp0JBe31jMSj8emNT/5 sNxiUOmsdln9Y9bM4EzmfVcsiXwxhMJshdko1Tmj/vd/3eC0GBUavUIIGMaYPD70VP2bI5N+ GYnuqKD3FNG/elFJe71ajV4uRMezZYGpg38LwsxQ1ov4i+5TSbEXdLnQbzAoIXekcqWU94ES iTB0eMJypd0pdyrjdicM850mk51xsr5w2GnweSkWOjt2sxQoDZTxVk4gFz2HVe3VxB7lYtVe m8MlUl7VtBIWrY1MpmWzTCJo3R9Lc4viObnXazNpvvkZl1Nj8+hBjzUYitO/FLr6e+rWjl5G Wf8vFjcddCOFIzPqLUFL/RvA3J6G8aNcgEKyro76e3/C9CcoltWHhpLfAB9gog4FokkW/2bC dRirHitE3yoDMolUStgVQKYAswAoAAFYucIolysgsUxoh0IuBT65XK9oGMiX4H+kIPDJuRap 0kFMrybRAS/g4fcmuGNejEHwnZ1T4G1HK10Opd9/c5H8q/rzkyeTViXrFFy/ueDpmozWfyV4 nz52pBco0XkpbBNFOdKvepR7gg1AU0FYCwoYFhzqoZMFEox/XvBrog/SK5xOwx54n090P+zx ZgJtPHz/cxOEsSADhM8tNRWAl2sNG6OnQ8gPkT2iJwgLjEiTBWvQBAKa6xoyANl82e9PWi9D TwL/qN7xp8MiEdF39ebcVS665IJLPqpEcZgQOUotUSVymoSWzumzfkdvby5id0W7urPGtvLR 3CNAqnXHvJ52l1YCZM50OxV2QV4JPZVHT7TpfPmZ1eGDGzM5r9p/8l3L+sL4ZCEY6j801qVK XawM0pmhsVHIu23yKfAyhhwGN2aLRa6REuRljcVgBhI5IQVSCPNnAAT55twPr6CjJiC2k3hJ ey0RQ1tHyb3+Nn4oJwBGfSqb315/2t1mlUkt0HwaRU/sPODyaARut0hH28Ez0ZRC5oSz68mn yANw9jBxqqCXiMRi5rJabWsPyWRWm80G6VV8hgqJ0Q/eFwv68zKQk43JTsgECihjhARIEGwU hg3tWECbkUCGA50OjCUbZyoQmI27JQ2nH0kQd64FhwUm8Fgw6tTKYwN1+Z/9qxmHJ9Fp8Wf8 ZnFMbEmfHO2fyzvF1ujh7aMCuUhl1v65o/TY6lF/sJPR2piAyjIyGA/mi05je7Z4bGVIiDyQ LJQHC8SrhzhZCDp77JdFnsudPaLOTlGPQNsXDmu0PT2gx0loNQRM8miS8AP/8+A4IQfFz5gg RjeggFzl7xfqklehq51EWpk7WM7fejW0oBNooCPZ9bbxweXdY7zM88hhtrBRqyfqNsmCUlfq cLdvpJM5l+lyiAITm5MdAwEta7RGQhG7I86aw8WjIWFMZPFl/c6wQ613uNU6fWfSZwp2+SYn jfl8XBo/ORxSGq0Ki1ln0Jl8Hc6OgaAOrgcl5Os4xF9OqImRglZFIKUgFwrAZbVSIpQgdmrU MgURA32ARM+7o8PAxz9DIMzn8Dla7nwM/Lx6JanF76/DR1BNUMWlgYSBiuCHtdob60+Be8PC OiBFT9SDp5955jT4u/fUv4I4kIcciIkeInxEf8EGwynpZZcrQPp8Wq0AanoBabASKqBCJCch yYldksfgwkxASYJ0xwKE5EfCNMnq30tVYcBAxpK/6Ri8cCLVdWa7r/+IT2cN+gNmKh91icyR Q/fMflD00OkzivjY2a5ceSwc8prMOqPOGupmJf5ENuYhAb6z6oHwpiHFKCJJ5AoWglBdjkTS bpH3ssXdIYL6NEDogR4pEILiFQgKj6+iG6eJBCfrEFLoCDUOoDTPmQiTgD9ssLuRQzIDK8cH ra6hZORIjy84fDabXxhtc+Zm1x+brT8mEGm8uTZjmLEo3dmwLyfaIiMHl3rVNmfmcDp9ZiQU m64VEucrJwb99Qe0ITtzbCKt8/e22w4U4w58Ygpik4XUV0BtqAYCiB9JqBQyuVwmgLz/LAEj 5l1+4wO9ycaBXsRpwBg4qc6S2fo/nvlvP1O62aC57bDooR0b+bBA7/MqP0kI8CpzQZoFiE7i IHGk4NOA9vbhoDENGZ4TDQ8zE2kgEvUCJkdQCbkxKB8kKEChieVYaaAFhp/SwIHsDf7XBtFN SnSYDi6w3eAU34VuXVpcVMMRE5lg3nVJ8rcNrttTEYenezqZnOn1MslOM7rj6B841pE6OeDX sL3vcreZZY5ASJMZ6owbFZTToPWm/elRqSPdLmR0/lgX6+3rcDmjXRSdiXiVrmSmyxsaSTqp xACM9uLps6YAy+iCUas41+4boLel9kCKsWUizp6kyh1IeFplygmtUk/B7rJcFtF0MnRZBaXL FUNC5dMThBM4EUn0HEm0TbHitlhiyRtJrGqyrTclefkCvNvRfGAgkxxYOQHFaniPWBXe9OJl 8DooVExni1CRXyPDu0J1diQUh0J18Mm3zoBtTdjuPT6e1kKRso9BkYLW2PKH35I95M8FEvVB gtiZJmSfBYRBgcw1su7bUKJexrXjuFbyNCGVw0pUpycAeQDXTdxWl4WjWnDdZKPOr+DrlLDf OK471JwRHfznZszDnjHyB7D2cKOnqtHTA+vSuOeRZk99E1YG1mZxz6lGT1LRAo8L95zGdYpn oHtC4a63jDzTHNnJjQzXwwj0cd4u+AdigkC/c/nZwtzkdF/XKTZ+pj3eNb1SHKMUZRo9gCIe +8sJMDExZjDGp8eMxrHpuHCjzPofosDbVkB+BbSvAGrFtlUEs8XFIjlSBG1FoChqxwE12dd+ Rrg0MbE060ujLaMlj1Frs3nQllHshy9pr/ahu97QSu1cgYsI7xhxX8jXwbYLPRWVjM2hc3io To8XYDKJDBoyaQBFcnjXE+8GcbcrA03JE2b9/ltWpIWPqSXcN+cQNxcjXKVRgTCv9TKMztNG 01ZVJD8Wau+S+eS5wUFD4nB/0tD/oTMnagULnR4cHrBrPXTPsc7gSNptTR7OOeLxuEPj81gi nh1zqt2Vj1NBq5wtOfsyTKR/jJIH0gP+1Gg6SN7HkBIDS+XHMh2MLp30dYaHZqJadzRtLs5E hw55YlMj+Q6/mil1584M+S2hHl9gsLebjk0ODTCm7v4BpzvOKLWBRF9bb6+VCWq6Fj+nD2eH wvnZTofIFPL3lY6MQNb1EoTkd6J7iWPEVqH7yBHVsXS655DHPcIeo44lQmzPMZiMJ1wOp1El 9mqMR9IJjXKSSqkOy0cGIx6fxGESMxRNUyRiGNpSxccVdk8NX0N3BrEXjs6n7FzTJbU7iebp cMgftNrx49nJxu89oO0qiVgMXXJPNqnLZHd/MIo78YaZsPv4Jff+fkvLC/yFT1nyC5PXHb7D sZ0X47Os+cNzodQBiV8rzHwoWuvv537QXqRxhuh6r4kOO7UigVZTjMczmTG53OUcqXf1ek0K pbAvORw2/v4397pDPl/KvSFUqg13z4Hejp2NbYY5Otf3ifqXZj1Kg1rCsnKDy4B+7f497fGo 3X6o7rzLZNFqWNagcDhnYVxwkE/Pgh5yGCXBg4KXhZRwCaYfiDpFNdGHRT8WPypRSZUyo+yz 8scVFcWvVWrVz9U96qfVT2sMML2ieUVX0P/O8LLxk6avml+0/Mjmtn3V/ibnSWedGnNfpt2e nNfIPOQL+H4WAMGZ0InIRvuXo9vRV6KvxIowLceWO96WeCElTF/OPtL59/nzPbbeB/peGNAO KoYeHjk++oEDzoOl8YcPSQ+PHnlq+uTRDx+3nHj85Ee4dMr8T0ydr5oe+d+Snmmk0+pmKnJp 7t1nrv2x6ew7m+kb+2k/7af99EekH/2zpN/vp/30Ly/dZbordtfYftpP+2k/7af9tJ/2037a T/tpP+2nPyaVZlrSl/bTv6h0ZT/tp/20m+Y7518///fzvylHy9lyX/ne8n3lR8tPlJ8sf6z8 qfJz5b8pf6P87fL18n8o/3Thc5VPLP7Fuf6lkaVfVh8+bz//xN2mu9+8rFt+//L3V5IrP15N rr5cm6v93drE66yv+/r6o+s3NlY2frL5ia33XfBduPhPTI//Cemj//+mi4KLAxefuid6T+2e b2xHt0vb/3Dp2KXFS5uX3nzp8UtPXvrrS1+69K1L37/089d//w2P7qf9tJ/2037aT/vp/51E EEQX+QKBTvuh177a8WukBfiNuhS+EuC3warJr/J5AXGcfJzPC1vaiAgr+TM+Lya8gsY4EuJC s42UiAvifF5G3C8q8HmVWij6euNN1kBl+BafB4TGeJ3Pk4TEFObzAiJi0vN5YUsbEaE09fJ5 MaEzHeDzEiLfbCMlrIbv8HkZMWg6xedVEtL0ATgyEKLTxUrnB3FeBPNa56dxXozLv4LzElz+ Es5Lcf4HOC+DgFICL5/naMjlORpyeY6GXF7Y0oajIZfnaMjlORpyeY6GXJ6jIZdXqY3OX+K8 vAV+BYItzI2jbClXo3xYi/PoxWPqMI3zBpjXh6M4b2xpb8I4cnlzS7kN9+VgcOC5uDFdLW3c LXkWt5/E+RDOn8b5dpw/j/LSFvilLXMpW8qVDVw+TtBEgogTHUQW5maIJaICvyeIGrEK/zaJ bWINlwzCq3WYR58lWF7FLaKwpp9YhokmpmDZOdh/k9jAVxX4XYGtL8DPBdxSBdMovJqHpRXi Iiw5hEdfhfM25hmHo2/DsbfgODQctwbHrBJlmC/D/BqsW2/OQzehjxNJmPM3r7JEBMNQgiOs wbY0nLcE50FjlIm7+bYH4NUSLEW1WxDGjSZOiA5VjMfyq8KziGlBEwPweh7WoNISpsReHLlx ajymNJ5lC9aWMb7oahGOfRH2XcclW7DVAqYcDcsb/BiDMCHqVHG/VUzbPO5fwS0qxAqcE1F6 AX/SPESNtjQu34AliH5rTQ7u4oHqNyEUVdhzA1JhBuZWcB8av8P6IqZoDZaVcD8OrxKGEsnE AoYBYXE3xnfxT5KnW1t2/U/hQJJ2DlJtGc9NE0E4RhXjWWtSt42YxRTdaGKdhXMhSdkdnRt7 d+TDxDQcaeb/8AqR47/9VfJ/yyq5XQ52uVTEknARtl2F9EB8XISpyuPUDv+m8VircKwK7MVJ 1TqmBRoVcWcWt9/kZx/H+C9geBGlO4gc5GniDhKPcN6CcKxhDDlcF/Gom5h3JzB9aSzr25ie HP6bTZ42WtN4dhqPX8GSXcGQLeB2azzvI1gXrOJ51jAOXN8yP0oD4hIeew1zbgW22sR1qNc8 hqPBy1v5ssn34KRk/baSxSYOkeb1rlzcTp01fL0A+yDqRngZQWuRmzfSnOdWDKpYHi5iOpXx qrkTzS7ymFbxelrGK6exym+lfQ1LwDbWXVWoq1rl9M6jczD8qbRtXQUN2VzHcr+JOVduyv2d MGjMfjtc+RYZQJhwuGzi+Rp6cR2vnG0sP+i3g1axtii9Kqac7JX2SBW36mv8J4cVl0f6Z43X QgjaC83Vxo2DWiJd91oyymnsVZ4zu6M3VkiVp/I61otIq1V5Okexh9OwEAiHZYzdrgbYK9UR zJkSzi/wcnC7Nrt1JQSxVkd4dhExmCpYG6M57sY6q4K5WoJliELnYItGXYwf8+wtGrKNX727 2mKjSbEGNP8rNuiP1Pm085Yxxhtj0K6mNJ+HZRyfGlJTwfZymbcVu9L9WnasIZWvbssQ5w43 V85Gi6fA8ZuTggo/1zksy6s83yMY53XexnC6B2mGEqY/x+eGHHNytcZ7I9wMNTgqZ1NWm5JS InZt+a367J+BF00KlTDuiG5VXtcv8Gu1DEdf4dfIrn9DY4u2zMtMsAHjq/OWQFZvjzWH3G5r odECtjLLe/TM7Ti+xnhY+1Zxv0brO2u3yC3arUH7W3svYx+xegveDbh2Pa3dVbNriRo8jGB9 X8OzLDavKy0SgvQWx6ENONquheWgnsewVHhLtdXkZasu4XgY4zm+gVfJchOGxrreK0t/PFVb LTyHZaul2SvTu5S4iOm48ifysWENkCe4ylOm0gLBAv5Ec+7S5TxsUW6xHZuvoY85zb+AMWhY vK49WrwER6xhjXNn35rz/RpWZpc+DUu2S6NWnbK31wbWFRyv5nm872xzS6/C0fUm9hu8R7mJ 1+8yhgDVt1r0P1UCGvZtlBjCtYeIYXh1DL/VHpWMwTIaatEpWDMLr4qwtAhLArDFNF8fwJw6 hu3QKGx3FNs4bowp+DkJr09gHTdM0PgaXR2E7SfhWKjvEHEczzEER5vGLafw2BOwdBx+D/Ht UI9BWHIUXqP8CNaC3HyTsBcXKYzxNpGDdAaW000M90I1hmdsQDYBr6bg+KN8bT8cewyPh+BH 8w/j/GQTzmEe0n5MIzQyGnMQQjSOr1DpUfh9GLabxvP3Y5w5aCcxDsOwnsNlCEOAZo7yuHLt EH1m+RrEIwTfOEy7WPVjGoxiaHbpNwi/D0PI0fgjsHYGW4hDsGcRYzqNqTfE0wxhO46vdrHi ODWIsUFURTQowvwE/Btp0m4Kf3KwTLWMtpd2x3D9bisOv37+cxBT7hC+4rgxiK9mMK9QbYTn 5RTG49ZZj2FJHMKt+jHG000JGcbSy0HfkE5ujkMtkHDzId62wtKQavo11gg3SqP+KM/p2+mC qN6PaYLgmm7O/GojRz9OJ+IdWXpmqUJP1FZrm9trFXqwtr5WWy9tVmurUbp/eZmeqp5b2tyg pyoblfULlYUorVKNVubXKxfpQ2uV1RnUZ7y0XdvapJdr56plulxb215HfWg0fDxJ+9FXNkJP lZbXlujR0mq5Vr4blh6oLa3So1sLG2immaXqBr3cOs5ibZ0eqM4vV8ulZZqfEbapwUnpjdrW erkCvxY3L5bWK/TW6kJlnd5EeIzN0OPVcmV1o5KnNyoVurIyX1lYqCzQy1wpvVDZKK9X1xCC eI6FymapurwRnamuVDboSTjLVG2ltIrmKtGb66WFykpp/W66tvjqdGoUdt06xlTl3NZyaZ0O TlTL6zUEbttsZX0DTZ2NxuO4OWyNGx+enphpjo7JWlwvXayunqMPLS5C2Ol2enqztLpc2YZA rFch1SL0bLW8CVEYL60vVFY36Y5cMtGcid7YWltbrkLMF2urm1H6RG2LXilt01uQBpuI2qiY 3qzR5fVKabMSoReqG2uQAxG6tLpAr61XYW0ZNkEDlzbotcr6SnVzEw43v40p3aDnJqyAbFlv ZBbRDBH0jfnRBGdtvbawVd6M0EiOYN8I6tOYoLpKX1yqlpdaILsIJ62ulpe3FpDQNaCvrS5v 08FqG8fXluZwhNeClhMDRM31ysbmOqQbZMLuBKh7c6w8pkCwCmfZrKwgLq9X4awLtYury7XS wl7qlThSQfGD6NTgVPBza3MNivFCBaGJ2ixVltf2UhQurdVtvjliCBwQ0mepOl+FMEdVKiRq i7Xl5RoWAJ7UEXq+tAFhra02Rb3BhODS5uZaVyxWWY1erN5dXassVEvR2vq5GLqKwZZn+UXR BtmLxWIDAYaGufMqvtPq+y7fYhy1eBmR+XwN4oRIU7lQWYYrE5N77zpHpNyz0lWqw4g5G3gV /I92vjwe6u/7fza7ogZJlrHLMl4zCBUaDCYMxthSaeyyNpSljVGiFEm2EpK0IakoZEsJlaWk JIkWhUoqSvne14xK70+f9/v9+eP9eP9+j0fGGHc799xzz3mee859AdYNROAFRvkwGUAynuo4 byawWqA9Hr4Mpg9YMyxjICuwo2A4LtgdWGsQLBQGG2m+6dnfXwXMECM0NNjDjwHrh2ewx8ZA sCMMDiD4BQDJqMAUf1otzn4GajoXszny9AIE/Tj78Mt+uHC/MF+4epa6qc+oG8z9t+YAP6Cn nLlhWkwO2IIZ2EYEr1AdFxjs6ecNf3qxBRKyESwo1JdtsIC0+0bYeEPhyhktASvUBAsP9QLo DSjAez0jpV+yyjF4MCXHaGYkzWYi3Dc48E/WCJvBRmYQYMaLTcAzGEAym5f1Xh5h3xTshx4D 5ff0YxveUo6KM9yDN3nN8hgA/WCTYfMDG1nID02ZaQr1ZYBVuXv9ZLmMWQtlwtOHAqAM8wNb BIyXY+h/JgDY3izIOHsbM7oTiUbGUexxtjQbR4op2RSnTLIHZWV1nBOFbmHjQMeBHjQSle6C szHDkaguOEsK1VQdR3a2pZHt7XE2NBzF2taKQgZ1FKqJlYMphWqOMwbjqDbAMVGAJQKidBsc POEMKQrZHiZmTaaZWIAiyZhiRaG7qOPMKHQqTNMMECXhbEk0OsXEwYpEw9k60Gxt7MlgelNA lkqhmtHALGRrMpWOB7OCOhzZERRw9hYkKyv2VCQHwD2NzZ+Jja0LjWJuQcdZ2FiZkkGlMRlw RjK2InOmAosysSJRrNVxpiRrkjmZPcoGUKGxu81w52RBZleB+Ujg24ROsaHCyzCxodJpoKgO Vkmjfx/qRLEnq+NINIo9LBAzmg0gD4sTjLBhEwHjqGQOFVjUuJ92BHSByw725B+8mJJJVoCW PTx4dmc8OPMEs+MnOJYJYscp7ohI5BwQjawH5SF2JPWt/Vs23ZOTJUdnoUvR1ega8L6Evow+ 8ztL/jtL/j/I9neW/J/LknNuOX9nyv//zJRzdu93tvx3tvx3tvx3tvyPaP47Y/5zxvybdH5n zX9nzX9nzf8fy5rPii8ZbB/xrdzPjje9foo/vX6KMNkxJkYaQ8BYYswxBuCnPujNAMgHn9M5 eOWLPIvMQyPY+EkC/Zns59ZgGjPPiyMQ07Kg96+/kDOfKvDT254BQT4zv4uFcn43BG85EjMw SB1nEskMUMeZM7381XFWjLAgEpPhDkL0/2iD82acHmz6SPYc4C11BHyKcKaTSoNYUincfKpx FnEf5yB5ULksqVhQtR2FRBIEID5uLrW5aJQEFwJicPOrcSMxSJYuConJtYfsIPVZNZJHpaMl EcvZLxs20AazhQg7ZkP4BcnOIoYR0ax4KXU59dRw8vvz3Zofb65ppaAW5rLE6RALUw+x0Kdy 0SgkCoXVAixWXgxX2LASB3YU/qqE5nznFskF+Apns4l2wHBjUQ72BCw0Dy7wYvmdGKG+fkE+ YcFBBGFoLlzJg+WheXkGBgd5EqQhSbiGHyv6I9E962aAIAvJwO1orPiPdjjrr2EfxggMwdma kCDpBXMISyB9SJegq6OnrbsKFPVmFaGYc/8IZ4IQP9wugEWTbEwIypAipyQdZOIXAmelTe3J OLI9dSlkStbTIJqa6GhomZD0CYqQPGdBkr9ckD0ntw+xkHKzBYzkQqBZSCEEqOdHsZBIRMW7 p7pj9W9X9FTpjYRkG3kv7n89OT3QWNgpuuXte7vIcVZNzkRLTUzT2j58qEZzokjrYPonIUpb 6j7ZleoDxdsKlhWtn3RT8VYSj9Ob15OjFtuAlisb8mxd+WIotr035KIlj6sTd48jf2zG44Q7 H+I8kcflvvBfLN9wTX//q/Mpa/dt3e+bFN3YocFHtqO12FZH50/IPApbHf8U7a1i7RGG778q FatZa+C9NFn1/t0Qg4yoxgGfAjeRr0efb1b6Ij9+ymN62cVrxjkx5iNSb9v1+O8PhhR49dV6 3wmmb7cj9vaYJX8KqNAJmH8ufO2iEc3SRIkFe2UjpAry6f0Zkqf1Ie/5e7AoNDCjfBaSD0iE C5ICIpWaixHDiCQ93Os2amhelzlaTnx83Udh4y1VS7YKScljxCGxaBF57Yn7NLMQ/pEVnzd9 LlM726BTJgTR4Q4yGGvIEqLkmueS40xmrgM8mAH4wG/7hPcIDtQM8feDazVnbmNCNb9vI7yL 7E0ESokHXSBnbl5gl1xcPEgkxgpaCVl8K0OouOUzE4SHh/9qAi/mn1AOg7Awv4oYWAVnSKJ5 /2CPaFhLQuqXm5i8Jbm+9cK937ZMq8Lw4IJPSd7EzKS7e6g6+V4Gxz6svtY8vmd0qlr5kk9T Lbbo0qXjD6K3PlDWVRHwXXh+8MYruQkhRVbVR8ED8goXKqv986u+zlt1zeBoZrxRWtX2+c7T +1xS52w/4iZco+GdlNUV8+yRA8IM72/eG6Uv0NNPqRd+eDC2XibrpU/9YXOmO9LOO9AqF6/q n/7lNnePIb9yY17xM/nlOhkkpr/Joc2GYqvutR9JHijazSs9bhyP9HWxzYTeT/aZBcaLbsWt 6iwjb7TeKRU2viNrQ9mG8JUiQTucpf3W166/dbvYqBfXqz+w2XBZS63LgbiXC+Ra/fcipvQg FjcSoNjQLBS7OpQwERVjOzTNRrGrs6UmAFBs2z+CFSqQEsfoZWa3e3rh7P182HcxYGPhq2QC G8x0IT0CgQiBlzYHzH4UobB/hL+ZdvR/af9LNIrfXaHQwJOUFR0pOqW0booZr/5pPD89Ps2s PL/FLUFzqRZeen/Epy0nZVjIC1EtElXoZrNXjZkfP2OkxnbyT8sF5Y35GDQqiz9VkXmPSSV5 DA9cFk0cwWbpPNILoQcvGy4i80GUuitJUKZgy6YbH0MPioW376lMvc67EzcifULn7Yb6x2EI y90dD/e/6or4uvdT0bp4g+pLMsXu6TWNO0qTi7tK1Drpn3Ue3NyQ8kx6eniDf8t23k1hj4Xt LO68RTRZWOXz6Dx1mfNly+GmZ6sGdr7vyhKS2Xd8cMeCuq7mHCnk9S8WhdgUrXRZC+JEvcJR xLkr9s2xQYtdY17rBUW/qxzGCrz6hkbRQCJbOHCjCMPNd8dsxYv8bqnoWXDV0uW+4/Y6/ZfT PvWrO5oqT5c3YDMgGtw8DwOw6Jg5RCbMgQQ4rgVjbWNLI2hDRLjIhVUjakEQgajmoQdpu+t4 MTS09d21NbSJWnoaelpLiBqeejoEbwaRqKPt7fETBFoEeT615epknVqgqyt3IfBE80bUwf8O gb9EqOCQUDYKAnUBegy0GCgwrL9u8A8NSFcD0mNDIGMWBDpA4LAyCwLJfznBNxT8kynCIEGY cSwSOY1BQYg/mDOahUIiuMVkepzqbZvkbY7aRdwbmfhys/pu7dvJRY4j9k1+5lx3r7YMP5nK dD3oNk9PpZaLjH2cFRlf5X26p/IVykG+3EA+ghRYPPEWsSo1c7dkK9/BtixJU+hkgdj1y+au 79W09+QkOes2UCVL5JqFb3azhE/qvCmWa0pSOB6zp09ZctBbKsEQP+2Etq4Lis0lvjpfpmnr uIa7VDSxScqjPFRwoCtKSUg1jVxIjDVMM3SihMsnfC0Vvr77Ka+oXaPaKoKr/vq0E8fi/dNU gt9eLX5ZTV7Q6k6NuUCXMN+XURBYG6R8bUJZpmkEd1Kg9O0tgazUJ+uz/WLzltwLxH3deXe6 oSJ9Cd9XA5G6DJGTtXGtr1l1px0UTMQvWOyMiGub7Mg2WnhfJOH53hxfhXjfZSevR1OVnvPK Wnl8OXxA1FrrguM6m3srL+ntm8b3lrodM/G/EXG7tNI/KTZgF/PUy4LPOb0SXfpTnjcCDXmf boktLarKv7z5dprjsSjnlvnm7h2yr6eWXyUIfNQ09CzQDV5na1RummyTK7DnyjbnD9d9djF6 jmRcbUpsCTbvr8WnjpR+OAsFDq+nnBhK29RUzXv167L3xaG63Occby+8U/k+tXmX5Fj0eqTN xUUxoWWdrnJGS53F++JHfa5SCjUfKu4xWNs2rG26X6pqv+AmluHrq90aeRjUPovJ172o2+ij wAnwACfwmuME+Blivtps7Jf84wnWjQ2n/HwpSgkHxtQ9kQvF0EAbCQuhBT9V8n1XVqCGahzc VPiBm7TgYACeQHX9vP08GGFeONLGMN9gpl9YJAzukC6kDWkRiDpakD4AdyKBXdSC4OK/d4T+ K3zPyQso7euxSFHd4o9f2F/9ZKAx007etuhWrzhVQWi0vbDdqigMws17xXOXflCUkrrIOKU4 YzWk9ADh/2Jz9XACj9DHuZiMNwmtMi1aCruyx8Z9JNWnNj+Pl3r5nJqfVydv37z3E/k2X9va krazxpijk8cDDvjcU3loZn82ru2pihle+UycjQNNcBCt/nl9cjIUtOudC5T9aVtXetkL2fRt Ex3Yd7zl9oG08+TkHAvESnPvecqLvU+kD3Zyx6w8OrmjcJ65CB8rZ8eIQ8RXZJaULe9OhDBk NlL+SN6s8qoGPadEOoJECG891Lcs9kAeA3VBak7p1MdD55C35Czp05NcDfU4gW/4fhpIpBAS +o44XBAafMzC81+eLmH4lhLCYID+xUHC3HwzPkEUCdcgoJgMDjbHJEMxe6NF5p5hrVvhqJz+ VBE7pdrPb3/QZfBYnscxxj+unizhyCKxvJW5BUVWoc7jPFi8F2TLcQoUCPihXJNcUpzR3z8X f29mghlhKGc7BPosh2ABmUGmsxyC3v9yJobXYcKh+jfPw0DWwum7G1ajTZf0Dp0vCu+5FWln jSzFh21wDRTEnr51ZXNSBf7O/KOJge4VTqgWKg5rm9kbteKJU2WJc5ZkvxQy7kxlxNietuFl yNEnV5L4uZr2Wjx5Yy/aa3M6ZfD53vV3o+uepY5xa+5ED+1XVZAL+fxhajAiEz/nI8+TkCpx avY+f37mwYo8/cM+Go12c1+6rzYSy9iDM3rCI0GcbCWs3EQwUGMKNL0MMZjeyY/tq+dn7Htz r2LBK+qe7Y06amvza15VbRUw3nzHnik7CjVXRnitdkUu4BeZ2/FAJOP98kvezmUams8nd8a1 2jm+yA5JDTijb3XnQ2TNKfEo98Wvjx5arM0dLuF+w0A6UIb1RuC6euVtk7Knk8NbLwwcOxGm U0Ft3CA/X2mTwHJa4oZVZiYiVWVlZ619mnKMp6MjZaOPiELeL4znr5VoOiIn22YypDZUOW7R qn6nmxhtpaRqoeC26qXj6+OPMrOblwZXxyiHcc8b3SRbc4hVp0y/WLreICFvE+N8UB72eM0p 8zfzg7/sJgac+9pn15Qof8O7Oltq13xPlIFGiUtSxaDs0wtnmz3OR9C57pDwtmdSzxZEnC7L TdsocT9lF3ajnCbxBG9QrmuiYk3u6x3Nsl2vpG1uZI1SHn9EegUnCGxt8mt6FvSyMP0WYfH0 3EbX1d3Wi/K6P2keMcI7iPnfwOZ/gVg8URCLy/2bK5ib3MH50/w/hgEx8f8IFBMhiGOQi/+O Qf6ICAjAbegRIR19jtNYwi4SILj4r0csLNR/+g4U7DtQwHcAmzv95hNTWBJf1B10iiVsrX15 7KKzbI7xIlX/oVW2pyq49SQwlMvbGwSle3X9r83vFnijV5/JfbZJ/y5ShGDcmTAn0nPXttR1 CgElRyiHh3zXdvQdsj/Hr95Qcv+kWnEUX8m9NJfmdRJcQ96bXhBpSvM1n5/mtb1dZlq+pvsq Hr3xtO+7lsB3S1fniY2bXX6s53kmyFMn4niuh5BG54oDEwOPeObcXR1ZQFn8fM6VXGz4lVSD 158H1FYJy1g7qhyNYj6ev7ScsrZ7ZMRkf+z9zec2xy26b1iauOZFgs0OibE8TZfB5GUaxVrO jeWGX4mdZWiD0nMlKXrbOrKj1d9THffL6ig26Ad5bre/fFioaKH8jpbxy+i4vR/d3rTRahJT d1XVyoYpuomrXGxVVtFTzNBfueT2ltKUYkn5wpPewwyZ9f0qlGy3+CeKazplLQ1pVy84GSmg 37RHuWrelR8IWSNkZxZeNoHorzqDYrn11IqWVS+642D5XD9PaEieUiVeYbqFPFjXwIx6zHyu 0Fdjltn4ul7SqSd277A1BSo8va9v2DWnZKr3rPeTuvSYzSNdI5bPKYsLsSrHC7f6RD/b7R7h dk5zxz2nw6trwlVU3o4ENqgkqSet0LWp699pmnCVz6rxToGJZtjBj0ETEThndeyadQezDG20 djw4G7/g0RHqeNrZKrPcgIyOx13xid995wjwnUO/cH8/nOcv45KF3weIoDCC0vwIe/YFkgmC 9LNf/Q+nPDviYWosRRGSTS6JcFH7XxZeJ7TLJ2hDqzjODc6g2uRa51rGUf6npA+wW2C1wFi/ ByVukJYbkch2c2tnuTkaZAtRZ7k547/n5v6EfhgUkwMzj8PEpEMxqVDM/u9CwqOhmFjI6Nt0 KKSY1l+FWZ7BHqFgZX6BDGakR0go3jcsEFrxnQAK0pYm4qQQVgj4L/7hjLwb+66Oc7cbCUqh M7fOXt/v3vE4qV8FYj5jcQUZj+mREvjO7jAfuUMCafP6PVIyjdO2dkQKJtd5ueHVDScamO2B sV+vGL3gb15WY34y/51fj0eNnE5B+hqvHclb95jZOnQLpmzpkLCUfLfceA+t7ewX/wFDHvzi Q88MFhXcuSAVnqr/ZMjzhqlBRJT8O+zW48lhsXvHW5RQZqr1u4Urj53kEjw04vvJF38wV9VI 1d+Z4iHD5xe0KiNtMHa8NumdmdqjqWVt1TqvgxSLn5Yoj7T1vptbkqmSnmE910BgjDehS6aB KP7kTaPGLdcj5yn6/Nf4668VFT89d79HNN6O7KxH3KAssb10XHnikfpSnF/GOZcE36DgwvKw hhVc3MeRqiqGLCOstbdAbZn1+/6k7ZLBolvJhZuerlD1ym9YQ3OPa5DyWJIe1/fg3cSYWF6W cv/NgvS20TUepAFXnsO7DLnDudu5SzfKiFxhMC68eXhtEeZKH+n6XJXRR16aw+kf8landSO6 8syqXd6lF/BZWghnRsu0IRY3lh4qMCKHS+tc6zh6NCcqSu6TxUGZ05/N5aPfH5mo8S+3TH/y amOExPBL3cxIccvprjJ5343PSj5N7XklEP3Sb1nJFDSCsdrX17cx0GO/QXu2I9WmJtpJLi9i HlE26jWJv9To84nWY2vq8uIPOW1wpFqQa41vHNrkyh9t4f8lMqeuOjBw/Q1aKHZOlO1NAgtz FmJhzqCQSCjm4L/tuH6dDvxxN5IbcxUGnxkl5kMTBGdfvAAufpQECHOh2a2ikPyPgRgCgLbD RV/HbLPf2oYjWO2LKOjmI2KjXyDPWUMECY4QPVc1+lf/SOPbvzcInnmoB36IKDJPKVrhv1o2 PTIk2IfJCPGNxP3BN2NYSAR9tftjl91ulD0CNXbzdbw/rbQ88WBYSX1nkMKYwFTK/QIEcaDc Kv/mFS71G51y/JNdykjjJo0AwRLTe8tYLCkjp8mFGW0aW0ez6kUNIkvC17VICZ5vZnlLfaDX 9i/V/lTJrH6f+FQjpf0Rz83kKrpcQ3Ol0VmTsYoTR1YruXhmXDlXvZl1d/UtfpS/g/RS/3Hb aa0P76bqqLJdVuIvxSYHByr8w/deTyfs/rpE41JsSvfg/c5pw4C3iPQviwrJwrgb7ZkLFEN5 SVOZXBbVuXLt2We23TczynBPhoaOrOM+YSBwlzjgL/Y5suOM1YcVD1s3NLRuHqWX86/Nun6s iSlwwOqS/m71PBZKBRxPFH7sETeBhRIFVfPYqrnvXwvEf33RNksn10Dis1VS4MeFIRJM/r2F iyDEThwTCLoEPW1tbXBM/KNGitxJvBiezesRIq/uP67gc2j9MS6pP4RMsK6ovjv9NbpveOhB eYevosORGL9BWR+i0EPVYe7RlYG1jR3vFalNqOWf2wNG9mf04VeNm02IC22fiB4zP0TRG61x GS1lWLc/ytUIYFaqTa7zV8E2fI5+40Vdp4N3NLzWw6PBInmnDoQhpWue3WxO6axYfPdmt/bj rQhPybpttzeq6nlc7CRpbhfLWlGY7dWStezWFzMtZXnxi8UbyucOu0pj9lo9zCmyfdgip/Ag cYOw985LF+nIfN2P9WpJ86eyXnwxFdM9d3NthxLK+8TU5q5b18Tn0RUu9fMaPug+dDmtI6qj QoJhHsL3uv1tXm9x4hKWz9T1kKRzuqLumTmnLx84kLO3tEVrIQLxf9iJ2LYNCmVuZHN0cmVh bQ0KZW5kb2JqDQo1NDA3IDAgb2JqDQpbIDBbIDc3OF0gIDNbIDI1MF0gIDVbIDQwOCA1MDBd ICA5WyA3NzggMTgwIDMzMyAzMzNdICAxNFsgNTY0IDI1MCAzMzMgMjUwIDI3OCA1MDAgNTAw IDUwMCA1MDAgNTAwIDUwMCA1MDAgNTAwIDUwMCA1MDAgMjc4IDI3OF0gIDMyWyA1NjRdICAz NFsgNDQ0XSAgMzZbIDcyMiA2NjcgNjY3IDcyMiA2MTEgNTU2IDcyMiA3MjIgMzMzIDM4OSA3 MjIgNjExIDg4OSA3MjIgNzIyIDU1NiA3MjIgNjY3IDU1NiA2MTEgNzIyIDcyMiA5NDQgNzIy IDcyMiA2MTEgMzMzXSAgNjRbIDMzM10gIDY2WyA1MDBdICA2OFsgNDQ0IDUwMCA0NDQgNTAw IDQ0NCAzMzMgNTAwIDUwMCAyNzggMjc4IDUwMCAyNzggNzc4IDUwMCA1MDAgNTAwIDUwMCAz MzMgMzg5IDI3OCA1MDAgNTAwIDcyMiA1MDAgNTAwIDQ0NF0gIDk3WyA1NDFdICAxMjlbIDUw MF0gIDE3N1sgNTAwXSAgMTgyWyAzMzNdICAzMDMxWyAyMDBdIF0gDQplbmRvYmoNCjU0MDgg MCBvYmoNClsgMjUwIDAgNDA4IDUwMCAwIDAgNzc4IDE4MCAzMzMgMzMzIDAgNTY0IDI1MCAz MzMgMjUwIDI3OCA1MDAgNTAwIDUwMCA1MDAgNTAwIDUwMCA1MDAgNTAwIDUwMCA1MDAgMjc4 IDI3OCAwIDU2NCAwIDQ0NCAwIDcyMiA2NjcgNjY3IDcyMiA2MTEgNTU2IDcyMiA3MjIgMzMz IDM4OSA3MjIgNjExIDg4OSA3MjIgNzIyIDU1NiA3MjIgNjY3IDU1NiA2MTEgNzIyIDcyMiA5 NDQgNzIyIDcyMiA2MTEgMzMzIDAgMzMzIDAgNTAwIDAgNDQ0IDUwMCA0NDQgNTAwIDQ0NCAz MzMgNTAwIDUwMCAyNzggMjc4IDUwMCAyNzggNzc4IDUwMCA1MDAgNTAwIDUwMCAzMzMgMzg5 IDI3OCA1MDAgNTAwIDcyMiA1MDAgNTAwIDQ0NCAwIDAgMCA1NDEgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDUwMF0gDQplbmRvYmoNCjU0MDkgMCBvYmoNCjw8L0ZpbHRl ci9GbGF0ZURlY29kZS9MZW5ndGggMjgzPj4NCnN0cmVhbQ0KeJxdkctuhCAYhfc8BcvpYiIw WmdhTFonTVz0kto+AMKvJalIEBe+fblMbTMkmnw55/DDIWvaS6uVw9mbnUUHDg9KSwvLvFoB uIdRaUQZlkq4K8W/mLhBmQ932+JgavUwo6rC2bsXF2c3fHiQcw93KHu1EqzSIz58Np3nbjXm GybQDhNU11jC4Dd65uaFT4CzGDu20uvKbUef+XN8bAYwi0zTYcQsYTFcgOV6BFQRv2pcPflV I9DyRmcp1Q/ii9voPnk3IYzUgfI80j2N2auL/mb2EXkZbfk5ufOrO+nF7YiCJNsljiiKSCVL lHYq80jnxhOjLGmPNBChp/+HCVcKze99idVaX1V8nthRaEdp2F/QzCakwvcDzJCVNg0KZW5k c3RyZWFtDQplbmRvYmoNCjU0MTAgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5n dGggNTEyNzgvTGVuZ3RoMSAxMDk4NTY+Pg0Kc3RyZWFtDQp4nOx9CXxU1fX/ufe9N1tmkpmQ fYbMmwwZhAECCRACgUw2EMMSIMQMEkkIQfbF4IKiBhXBcYFai0itoLWKuPCygMPSgsVqRRFb rK3WCiquFaH9WHcyv+99M4nQyu/f3+dj2//v85vzcu4599xz7z333HOXNyEDMSJKRCLThsnT 8vJTxt9UQ8TmQdrQtLhx2f5QfidR2SoiKbvpyhXqE/uP3UlUj7xhydxlly0e8bM0P1HlfUQJ 2mWLVs7d17TnOaKmj4leu2Vec+OcP1fVvoi2kKfh8yBILki/He33Qb7PvMUrrk6sK/ga+V8T BToXLW1qfG7uGQux0SuIvIMXN169LH2GbQzKL4S+urh5RaO0VWkktt4q7FvSuLj5wJg5W4g1 PEQ0aOyypS0rIv1pI7E7RX/qssublz3Q/sFHRFMmEFnzSIzVSPS803L5rKTiv5mcJhLw4Dt9 +wv66s0nPv5qx5nL7GSagqxZ1xcAahzTNYnK7fTVjq+usVNPSQwSDwqJ4x5qJTtNIIk4aIBu IVLS0S9HqSStYxtIIZOyWSlAA84olX5Dc3mySeEJBpkLkI/ToMgBuvoS3QJAzcRyFW2puS8q R7umsALjGNYeIBaJRDBpPmWvGCmlGmIm8aIe1Pjv6VL6DuDbaZVAwcuP0+XQ3Y58KegeUVdu oenAY8BiYC0wKyabCGwEThN56O7+rvYFKLWRM0otbVSeo7nA+8E/KL9D2wxFtBj5h1B3v0xU KHTQ1kbDdtoE+X0ob4LsftA65B8APxP1Bsd4s/EOyhQUaIC833nGF0SbFwFvQR/VoGOBVeiz F2gZcC17jtax5yIPohyUbkL/a4UcWBGjF6KdNSgvQb0+yN8EPgt2GECTgB7gBecb//lA2HUe edX/tK3zgVSAODwPKO+SJBCR/xbG9+b31ef3AXJL5Jt/Ro/VdhX9q20RgHl/9h9k2+nd772f 7bQQmAn0fN9txyEOcYhDHOIQh/9/gW2L7PlP2/DPguL832NrHOIQhzj8J4FRZI8JaKf4vhmH OMQhDnGIQxziEIc4xCEOcYhDHOIQhzjEIQ5xiEMc4hCH7w/kp2nud8nFv4P9d9sShzj8bwG2 +T9tQRziEIc4/F+GrsN/l/8V8GXgb4CfAF8FvvEfMS0GcgvNlJKpRK6mC+WxNBr5IeBHy9fR bLkv5OJvqVZSjfjbKSmTRp3191X5+t9XXQ+9PKrS/77qWpqu/IoWKEepSfmCHjZfRA+D3idx GqWU0kOGImqQL6ex7Dm6VfqC1nIL3Yp6k3g1JcpX0xphi24P9EWZ+HsneTlsvJU2yQdR9j7o UqCJNil5yJ+mTewj2iS1UD+hI+3T/x5rk/wx6BCUL47RP0K2mC6S7dD7E/1AnkcmQ5Cy0ZZJ XgRMJPd/66Pl/w8fwqbvc07+VQBfrf1P2xCHfz/w7ZRz9t9rAdNjskHA8cD+wIJYXtAcsY7/ J32INf+vsv/fCWJ/+lf3cZb/dd//q/uLQxziEIc4fC8gxdAV/foCloUcOK6STF0QDCfBpVEO 9aORNIOuoa30KD1JGnXSbjpOH7IhvJC/ZgioZrWXmqdWqMvUlZ6cnNTcF8X3I6D2BeSnUmrQ 6z2Beu3nrbeiu17knZ6nKfI2UeSosCQSiqyNPGT6Qxf7RvvzS8fv//O241ed/Izo2II3H353 9N9/I4T+zQDn/3aAlB7OTiE6TX+hOxJ/kbg/cU7igcSnE5vhCcO3XzLBOIdL/q4FFEqyorMJ VkpMsjuSe6WkpqVnZGY5Xb2jOn1yfX0v6NffP2DgoLzBQ/ILhg4bXjiiaOSo4tF6cXlF5dhx F46/qGrCxEmTq6dMnVYzvfbiuuCMS2bWn9NV9PKy7B9HcVOUhG67/Y7zjlQHSU/bevJ7z6/6 O5G8HuX/j8dA4JI1K1ouX75s6ZLFixYumD/vsrnNs+vrLq6dXjN5UmmgZMzo4lEji0YUDhta kD9kcN6ggQP8/ftd0NeX28eb41Hd2b1dzqzMjPS01JReyQ57UqLNmmAxm4wGRZY4owGV3rEN quZr0GSf98ILB4q8txGCxrMEDZoK0dhzdTS1QVdTz9UMQHPu32kGopqBHk1mV4upeOAAtdKr aocrvGqYzZhSB/6OCm9Q1U7q/ESd36DzNvAeDyqolRnzKlSNNaiV2tgr54UqGyrQXFuCpdxb 3mwZOIDaLAlgE8Bp6d5lbSx9DNMZnl45so2TyQajtCxvRaWW6a0QFmhSbmXjHK16Sl1lhdPj CQ4coLHyJu9sjbxlWpJfV6FyvRvNUK4Z9W7U+WI0dJvaNuBA6PawnWY3+K1zvHMaZ9ZpUmNQ 9OHwo98KLf2aExnfZtF4cnnd2rNLnVKoMmO+KrKh0FpV2zql7uxSj0iDQbSBujx3bENoLLq+ HU6smqaiN74mWKexNehSFSMRo4qOr9lbKSQNC1TN7C3zzgstaMDUZIU0mrrS056VFdgdOU5Z lWqops7r0Uqc3mBjhasthUJTV3ZkBtTMc0sGDmizO6KObUtMijFW29lMc0+Zzunqgqua2uNZ JizyjkdAaGqTCkvqvBjTCJE0j6BQ0wioAYIMtbQ5mJH5mrm8IWQfKeSivqbk2r1q6G+ECPCe /PhcSWNMYsi1/40EK+KkJ9RQ3s1rfr/Wv78IEWM55hQ2jtHzwwYOuDLMvd5ldhUE7qNq+LYx ODIP7vd4xATfFg7QbGS01il10bxKs53tFMjzBzXeIEoOdJekThclrd0lPdUbvIjkTn2bSNVM vp6fJHtar8p5IzWW9t8UN0fLq6Z5q6bMqFMrQw0x31bVnJOLlo/oKYtxWq/yOsnJYxx3Snop gnJmj7LI1Fk1ORc/Bj2o54SNJkSlLmHqWM3ecGE0DVo8nn+yUjhyWtTSybfVYmZqI/3n5ked kz/HPGtIgsGyj1fVzAiFLOeUIdSiHY6PEUQ81dR51HKNpmNl5uInHDkwQmDQqQXgsnKhgPiL imLZcxSdMT4IENE5cMBYbHSh0FivOjbUEGoMR1pne1W7N7Sb/5L/MrSssqE7cMKRPbc5tbG3 B+GreWzkwAFeURIKzWkjKRfdBJxtTGcKy28LapP9Qa822+/1eOuaMZa2kWT11DSUg+NU1uZl 66a0Bdi6aTPqdttxmq2rqWvnjJc3lAXb+qCsbreKo0KXciEVQpFRRYaqGFzTzk26vnN3gKhV L5V1gZ5vCjPSZaZuGaOmMI/K7NGOfHpHAdxCmsJytCTQrS1DZorKWqPaF8S0TSixi5I9xMWt ThRGoQ2ZmrqApTAwMjAqMIaXcHhEiNoh2QPdUYw6xrAS5mxDm1N1cZi1to0KOHfrLU2NabZC U8hae2SwXKid1RD6iw58+rcjmD6jrmMMoX09hUaZALHTwoiz15C+MYk4v9hfZ+WhqmmIQFFo GeG0nFWsiooa82qzvFd7xOi0Wu9KD4ReTcVuDaU2GucKhkIqHi+80lRbF01FERvgQktBrXV2 t67ThZj4NmtFVT2uOlxiD+np7dru3i5Hb4IJdXenNX1nb7BeY5eIVP/RzW8bTt5o/zilo52G ZoZmIB49Wm/RccwOZBNdQb0FWLJJt4Tph1MT7gRzxVpSxSaHbdJ7URuf5Ncp02noIm/lHGgI xKE7DJPlUecEhZZXLBoR+OdVYmcpiYNEbzxkH9WdY7FcdPmGtMvOzc7ryY4ViDtK7qDoNoGx 6EvWoy1waouC/h6VRjHmENb2SLHAR+qVxwlswLEzTmttaoSJOG/GN3khuAgCtW521IPioA6J m1NTI6oJL8d60pb4z2kSewLDFoWGxHC01mq1Iag2YA9hU+Bsp6opoOpcXJ+8jWLfqI6Opxqb P0hjaBrqkpg2p2bEfja3sdkrNldNxHvU+8JGGdbRtDqNnKGQFzEEE3PHQhnN+zSDb7wg+Fnm 9zY2i5vdXHGxa45eOWCu7h3RmrPS6wlChefqvoTjsNBmi6QpJO6N9Q1+eMIRSg6pRSEs+Hq7 +Hq6ptoG7GuqXR2r6lPd6EQOThgvckE0FFU05wpF1Nd/fNpif1u9Mfdbif6z1B9VNumt6pcI rbpbxaj/gFnu13j6CBSKwbOpM/RzARMlnKfkjod7A4gqp6iNVVQTOzai9ceLqs7uCYtWgyTY fQAg3tty2brqs3fCmVpy1dRLnHDswLaaNaUJ0gDx8BzqTW7JL/WnYtD+7Ybe7rB0QYcvw/3y PqkfHQdyqV+7v7d7t9RX6t0+yh0IS96O5NT8pNKBkootOE9PVaRLgTuA+yXxIjRLyobcjvQG YCtwB3A/8GWgQXxRo16qApcCtwCPixKpt+RqV9320r5SJupmYghJUjqdAkaAEuxMR6/pNBk4 C7geuAVo0PWEZCnwBuB+4Gm9JCClt99VANvT22/TSceCRfl6tjGanVmvZzsuDkbpxClRWjE+ qjYyqjZkaFQ8qCxK+w6I0uTc/FZBLbb8A6VpUhoGmQbDlyFl/BlKYozctFVKJQ3IJUNMEpCS O/r48rfsl2RiEpcYzSF35IDE2m2O/FILj/BTlExu/gk/GS3hJzsSHflbSi/ib9MO4H6gxN/G 8xZ/i27gx4XPkZYAtwD3A48ATwEN/DieY3je5G9SEv8T5QFLgLOAW4D7gaeARv4npHb+hv4h xxt6m29A8w3i/A2kdv5HDOuPSJP46+Be56/DtKPthUX5u3XGnxdj3LkxJt0ZY5LT8sP8t+1f 9kNE+TDTiKi9Ug6NoQIppz13CMIvo714vjvM3+lQ/e6tpYP5K6QBxWcLr6DnV0gFVgMbgMuA BnCvgnuVWoEbgFuBGhBRhtQOVPkh4IvAV2kwMACsBpr4y+3oJsyPtPvK3KVp/CX+HKXD44f5 r3X6In9Wpy/wX+n0edBs0EP82fZsN5UmoJxQxw5qB81DucKf7uiT7I6UOvh++M6NNA9YApwM nAVcDzTw/TynfY47GY3spUMmgmY7fajTh+lBEwUWuAO+cgSgKhLfyNHgkGxRt/h4wLfxXmRF 4rvzLnAi8d18OziR+K5ZDU4kvkVXghOJb84CcCLxzZgFTiS+yTXgkIT5/U/16esunLyQqaVJ /Cp46Sp46Sp46SqS+VXioS9lYduP2/v3h8c2B/z9+rtbcbfZx1qnstYHWWsza72eta5mrcWs 9VLW6metLtaazVoDrHUvGwFXtLJA5znZokAGaz3EWp9grS2s1cdac1lrH9aqssJAmHvaxxfo pFInHaVi0YGOHoPdJ4l74FEPYt6DPWE/0iPAiJ4LQEnNiSpnZgua09G/JJofNDJ/KZbPQVQ8 iGk4SMeAMiboIMLoIBo5iAaSkJYAZwEPAE8BI0ADtHNg+Ho9TUKaBywBzgLeADwFNOjmnAJy WhozcYdumDA6L2b4ZKDMD+LJwePhnkBvu8vut18orXexpGw2OTuSzQspLQ3vWckOkyPMbLs+ t33xuY3MpWZ+J18vtm6+IUbXt3+JrZttavftdZemsnsoW0bksSLysVzQEdSi54eRyyToUHLx x0Dz2121qJbU7hvg3sMSRa1d7i9dJ9wfusIc7Aeuve7fq2GZtbt/B8lju9yvuG51P58XNkGy zxdmIHtUXXW3a4T7iUO66moUbG53Xy/ILvd1rnHuhS69oDlacGkLcoEk91TfDPeFaK/CNdsd aEGbu9wlrkvdxVGtYaLOLvdgmOCPsv1hbD+X3qk3G5JO97Dp0wvDbF5ggHGjsc442TjcmG8c YPQY3cbeRqcxxZRsspsSTVaTxWQyGUyyiZvIlBKOHA/4xUeTKQa7IOKbUhnJOm/nIhWfYoqt j5k4XURaL6mKV00rY1XagSaqmq1qn03zhpkFL36Kt4zhZKWqmjJthL8qbIxM1Qr9VZqx+pK6 NsbuDEKq8XV4dampC7OIEK1xio9YdhNjjjV3OAW9YM0dwSBlpF1ZklGSPMZRNLbiO5KGWOr/ FjLO4XuXaRurptW1D9u+vXdZUMvX+UgEfJX2Q/FRzG72V3a6smI3+4sgwbrd0hj218qpQi6N qQgGq8KsVtcjlf0Fegidv+h6JpzSQo9UU3ZUb3NULxf1oddHEOiZzZSr6+WazbqezIReW0uf yoq2Pn10nXSVWnSdlnT1bJ1DudDJzdV10lrpkK5zKK1V6GhjdBWXCyrZLl2FZZFLV3GxLF2l 9luVvJjKrT0qt+o9SexbHVdUx3a8W8d2HDr+fxaay/x+1jEq2DRTfIzV4K1sBjZot105L0Pc yNW2pmDs8y1fw+ymeYLiThr0NldoTd4KtW3UzO8onimKR3kr2mhmZU1d28xAc0X7qMCoSm9j RbBjXPXQwnP6urWnr6HV39FYtWhsqOhrXOF3FBeK4nGir0LRV6Hoa1xgnN4X6aFeXddmorJg +cwo7eAJFoRtA+7xZWn2ZWP0GB7lybjeuQdXl22U4A9qVm+ZZgOKooGlA0tFEZaWKEoUn1XG ijKuH+Vx7mHbYkV2iB3eMvKvuKLlCsqonF8R/WkBQLTiCuHwaOpvOR+grFILNFa0rCCq0vpP q9JK8PLbZjRC2iCGpI3sliUkVIYjB6LCQRCOFEJJ6lEUsmIhM5tjiv84/1fEaLlYBa18bwcL ZLMV1BKUtOyqGo4doSb2odAeXKzEWdESxABbmJ+1dLcRM9vvp2iexJi7ccUVMS7mixUxGq2J Ki3dLukB4Sx/j8dW6M3q7vTPrCtNlIZLeVSKu/Ng0IGgA0HzQfOlvECyzy3xQrfZVOhOsFS4 jYYKd3erQT8peygTmKU8QpmyjzKIIu8DPxC0a37kA1EuKP8Iu2Y4hkTb6Ak2n56g/fRLdhq1 dtBu6iRxq6qg+2gV3U1rcVLOgORWmopHgfxulhnppDx6AGflA3QYuhfT9bSH0lhG5EO6gdZI R1FrDdkoB4OppqV0B5sQuYJm0jH5JiqkCbSElrHWSF3kzshdkYfoZ7Rb+nXkDCVQFjXhORz5 RPlD5A04YCb9iO6lY+wu804KoJdWaP6ELqfNUr3MIpdFvoIFHroKNsg0kQ6zA9yP1pvpfZbB VknlaOWnES3yDLRcVE/zaDPtYcPYOO5RZkYmRg5TGvq4Gq3eS+20C0+Yfk6vM6tyOvJQ5DRl 0gAaj/F00kvsgNR1ZnVXCTymwEv9qAglS+kX9By9zLzsab5UsSr5SkC5JvIKpdAQmg5rH0HN 99jn/Ho8N0jPymMjZZQIv/xAeJt+RW+xLJbHJrNa3o8v5fdLl5MJPQ7BM4fmw9+b0PqbCMZd 3MqPSD+VH5O/NvTuOh5JxIz46Mf0E3qa2TBSlbWwG9mr7B1ezmfxH/O3pbvlR+XfGhsx6ktp Md1Bj9HnLJmNYFPYJWweW8XWsh+we9lh9jL7gJfyGr6Qn5LmSculn8tleKbJLfJNyi3KbYYP uuq6nun6TdfnkfzILTQF8bAa1v+I7td/W3aEXsNzjN5mCktgiXhU5mHT2bV4rmd3sAfZNvYo 60QvL7O32Yc42P7GvuY4trmBO3GXEjcqL78cl9a7+X38CJ6X+cf8SyldysHL7jCpWApKS2HV WmkDnp3SW3KWfESOwM/5ykZli7JNeUz5pXLaYDXeiAvDi9/89Ez/M292Ude6ro1d7V2dkbco FXOIMwjvcMWwvhHPAsz3RkTcDjrKrPBdFuvPxrAJ8MwstoAtZ1fDkzezzexnuu1Psn3w0u/Z Kdhs4y7d5kF8GC/jk/Fcypv5ctzt7uKd/FX+lWSUEqQkKVXqL42T6qVmaYW0UtooadKL0p+k t6XPpG/wRGSL7JZzZJ/sl8fJs+Qr5Pvl9+X3lZnKC8q7BothseEWQ9jwF1yRxhirjVOM9cb1 xl3GV0wNiM6DtJOeOvuXfuy4tFqqlHbSnbxAzsRb0UuI51k0R5rIEal8G1vHr2OdvI9ytWEU H8Um0WnZB18/y7fwz/goaSKrYtNoAR8Sbc2QIm8HKZYP0kl5H8b2Elq+2mBl1/NTBiu1M/3/ AmC/kgbLfukFel06xozyA/RH2cLS2Un+iFSNKPi5PEapI490Hz0pLWfX0U5eSWT52nQ74ngS 2459oYblsy+kCF6IJyGKCqV36CZayP9AJ7GO19E9bI58Gd1JBWwVvU8PY1X0U5YY+htS2fN8 vhzivVgncflR8X3qrA+TlBS6mdVLmw2n+Gt0BR2RLfSm9DisP8KflCbKp5WpbB5WwHV0Cy2P rKaVSp38W3YZSayWcuXj2N1WSfmyB/QG7Cozsaftwureg32gVJoISQYiZwLiYjp2iM14NmGf kBFB87HGL8Yu9hJ1Gmp4mC5TEhl2HSL5ha6pNCPyMN0buYyWRO6igdgP1kZWocVt9C6tp21s Tde1tAxvp69hbU9QxvIjytjIQB7ir/FpfOO58wtv57IM+gjPk8iMUfZSSP49TaOSyO2R3yG6 L8AOey/Nxu33BEb5CXq4UDpABV2TeFtkrLQM4z1GUyKPRNzMQvMii2gy7aOfGRVqNPoxxxr7 LcZ7LTXzqZEVUnPXfPhhPbwg/q+JK7D/3Covl2+Sv6TbseY3Yr/ZinWzHSunU/+fGsSH8NgM FfELeSOVdXJ2wmAM83sDvUiRT0hkMconGGWaDMoJLu1DkJmx5QyiDL/9s+IzxZPsnxZPPFNM JeDt3yAZMtjj8DhykeCST9+o0oFvAgp9Tap8QPx7BQ2+WI8zTCEzbdTW+OvaDPon/JyUMN8R SDAVGyzmkXKxYSRjeSfOnKCSM++VONtceqkPpZwMloQXJPNIZYRcTCOgJxVzrjLGXrBYElZ7 HtiEizqsqi+eaD9pP4EmTtg/oZKSifYz7+GS3qHgAsXsxfbiYHDIYCemyRgw4L2DMkpKsg7n 5w0eEuwlOQockjSsIPX9wmNDf3qELZLMrLJr7zefd919+DDGcKnUwa/Sx5BAPxRjgBsjX3Tk 5A5VwpEvAjm+fkMTDBZMD14CFcWQ8InZZJIkTkZTsSXJ3GrmZtx0Aqm2pKHmN5kkF3MWsDmG skzr8kcyhOl+4VH7GX99se5YYeyZYiTMkVxUJHDIYOb3OwNWJhstpBjwmhUdgP2Z9CJ9ALBd KtDTDfmHB/5pyOHBUgdLP32668NoKt63VnVN4Q3KUbLTJDGGgKVvEl7Iko0muz3MCjpoS6IJ NOAwbkm8lCS7pEqS9LjjJ7eLia8/89lJ+2cnYVwJJpzVOzsoyciECeie+bhjaOHwwgKDEU+q nbFjP3pp4ox9q1f2He31M3/XlH3sC5b4yetnvn45GNq49+dd7i71XIuu1C2yXsAvsHOzxc4o 2SxssmyRGGgnbZEuTQxHTnfa7Xw6mC86k5J05kSnzaYzHweSLBY+PSnRncgTH0+OWS2uWP9g OUsyd1vey0uOoX19eArS0tNS7fzMajg6Z3Tfa1bvmzHxSNcUdpy9tW/3xtCM33595vVPuv7a ZRJ2X441OFLehWgI6na7aYmZf2mSlihGg3mJRbZ8qbAlJThoOM+0XjxDn+P6iZ8Wnyy2nygu prxPMb2f6sGIZWgxSjwsFbQtkigjz1+Qn1+QJ4Iy1+EZ5kFcelI9Ds66lrP129n6ruUn2V3b BN3WtURYsr3rTXYTblEWmiMs2WnBkn7MEGbVAZ++TJiFFZOFS8iQYYRx5GScMkuxZ25Fz1sT xNKBZZ+esMMyRJ5IsYbOnBSBB/t2Gg1M/P4uAysl7zCMKkCEpRiMfYcPL9x1uPri/KLh0uHD y2/zTcxsvATWlLIwX8AXY18ZrfslcxlfJvGJbCIM8RLPUpZBKVNedofwyIl6+3uUN/HkkMG0 HNPSTgHMSl6W6KbXME9qKe/Hwjt3osIeDHQtxihRod5qBhdDKo4OZAfJW6GzVdbH8ll9PWYa TWKWuw2Pmb3nMJay+NQh8j4vQsxJUY/tJinyZntKEQ9H3gyoKUX3SIxLW6QdEpeuJJYi/tkV g65F+oD4B4jFR3firOi4Bn0V2z89aY/G1VplkL/+OvszIr6wTjuwY3ZHWCorYOzRDV11mcrH X6Vg2U6PvC87lAOI+d6sS98PefSXoFnZspKSbbOlY7P4QI9vwQQyRYCbHWQVEkqzWpFahYzy ENyHkRzGiPUxR3fWc1v6FC0ZREvvYaXozCeBzIQEg2jSLiRkt1pFKmQ9TX7bZmCSbFjL1yWs S3o+UTEbEzJ4Za8JqRdlljtres1MnZk51bnQuDChqdei1IWZDc6V/CrDlQnXJK01bDJutD+f 8Tp/1fBqwh+TsnpMKrVHPiUrWTE9tZQe+SvWUEKM/wLvHTYWCDhq01vMAY936GCsU7Mdu2ep BZW6Fc14NdIVn6o1b3A7rFZrmAU6ax2JCQlRxmSzgemodbSQ2HataEn810mculXJFFOlqOqu WtqQ/dxtIn4w9Hr/SaSCrV+uszFXsPrlVK/xci1QXddpUDPtLmxI7VxN+EXkOKUBk4FJwBEC GDAYDDrbbClhKa9zkc0mZ4FpXyTjNaTEX+IXYW5PHl6Qn5aWjI3H4M3p6+tlTyvIH+6w+7w5 RsP0hUe3Xtm+omzB0QdeWfmD3Y+uWvXoo9evuqieH2UyG/34rI6uyOtdXV0Hn9j0FPtJ1z2n TuMFYcEn829BjB/Dwfs1YszCEkWEdVh6Rt7NWLq9Rd2MJeqLHqcEPLWSOKUWyjfw9fxek/y4 zMxkULhkVpiVs0MW3bsWMU/ExC+pwpHj+v4M5qOAQw9Xlx6uiXq4wluBTBGM3RGnR1+WVQng XFREW4miLYWpeBvjSmbCHlbM1lB0q1genREdkIneQErSi5hDnI31VI9jRgcckpyZDQFFMTOr Wfi6JLkIuwo2NHjc43UYDMZh2L4K+NedpUdr7nk7b4V87ZhV7ifHHZqFMRRjdRvhuWze99u7 SsDssNsyevUyTLeJBeVw6MwnAbPdDi47RckWCzVdKGRni9JsVyJKsq1ihNlhvhc2WdLTVbfd gYuLG6bkvSIMyjtMeSLA/CUifSZfLGHe06E1OZnrHQbMSQ7e3c/xQEJyLz49O0XIRNvtaFps GAkJfHq6OAd1b39Xb2JVi/5Eb3pngXGjlFGGvcp+w17jc6bnXcbx1qC1JnGhdU7iNcnX9Lo1 eV/yu1nvOk9nWfcnPNWLZ1vsJoPhkCsrxeXKMrmysFOaslySLdse5g91THYwR5hl7BR2kjCs g3Gr5ZzlbjlruVt6lrut1tKSfhQbrVjybC9fTSrZ2YiA1bGzBG/FS/kNXOZ7eB9ys/Vt+iKt x8b7mV/sv/rqxGFacvJM/QlHsogHJGsTB/kTsR1HT7HYkg2YnXaXvbc92274ReQ0GbFQTaBm YPd6HRGkelZ/OVatmFqb02i08WwczZ2LuDXFpq/elNjqdRQ5CuBScU6nenyFCKjhw4cNxbrV D0csahyTuAsZjLLxm0KenvvTzae23Xvtjfex3b2++M3Rzy585JcPzsx+4onS4qYD1z/z7tyF P7wv1OvIax89Ubd930PrGocgEmsj78lpiEQ/++ysUyIhMyMg5jfDRUwsGb8VGdbPa7ElWZOy LZZ+qdkuObufS+ln89qsGZm4SKl2sQhVo09EiVD35Yk9Hgc6Hkouwi0S5xgGc/JZ+7PJRfZn /PkCRXwMVmxptkrbLTa50nGx40qnNDVtkX1Bypy0K2wrU26xhVJudf7MZkmw2hJlI0N/TASC +IdDe5n4qMXGhnVaralyxh7+EGXyeQEzrFNgni35nLhIPisuks86BpJbZqlLVa5miHWkthrP qWQ8q5LxrErGFp9+dvgY+ew+jlF/+pSo79swMCPMRrRnHmV72AhcAw4EEnpOhg0DwuyuWHD5 T+rhFdv8P/XX95wBZ06IZYT7kYi1aKj1hFe7okpYnQijoNiO2HIRRHjxkL1WW5IFsbNzUVKS q58M7qlF/WyZGRmuVD2iXHpE5ecViKAS978ikAJxOhSmidNAjypjYQ/bHWAiwowiJW+Or7bT /aOFN+x48LqCCSnJCS3hWxbMvz2l0/PRk1cfWjh3zo0buj549ekIuynj3rXajaseSLmfX31d 040336zufO6y9jmz7huU/fM7D3T97T3xvpaFHdCOdx0L2bhLRN4+ska+irq9s9ZmiB0gSvdJ YuhmzD1nSzejdJ8thm7G3HPadDNGU0zZ1M0Yu09nk6lHJ3Y0mboZpZsxdDPmbiZ2jgUKa5Pr rPOsm62PWp+3KhOkCba7ZSkZWxZZDZJRsSRIRpyGNtshSU6RJFmyEbfaZKO0l+/FxZGzrQEL yTJU6JBFDvO5T/0XaVcCH1V17u85d9/v3NlnkslMlslGICRhGYhlqIgPMRIXAkGmYBWxAkrA pWIt0SIooqI+qVq1uGMtFUgIEX2KlLrUWn3VulStvj7EpU0fVR61QCbvO+feO5mI/mp/D5h7 v7lz5y7nfN//+3/LHXheyZaWtSiem1McTkWFv1JypfSjCVldzJZXtIjdqXHiRhMTG1X1QAuD LZzEQPThy+Q7IOzvI9/BO41+tIGq3l8I9yBe7hDxCa3WAYs6OYi3D7f6MhkaDK4bXc8Bspmm CW6Ppsd1oK92BvzE61m1OcOWN2RYrrS0lSaXQRFhn2xAy6oZrbs9o2XTGa28BNYNGSf9jL6i +sLUx/s0ThZYHeKSpl2EujAa57nS+ubmJseXQoCCmn3NwQof60N40+AafM9tzz3Xmx+HFjzE 9h075aH8fYDctw8uAUAgrDfFPwx+VaSMxO/piO0Jfs2dbdsT/Jo7pTYITxBDd0DwCQbBqOpk GFGJoSSCwRKbOFnV5LhEiW4gRowABaEUmgoUMIn7I4BHDBluY3AfgBzBuBabummTLmfGrihd X7rJ/4j/l9ob2jtxSfZHjLoY61eCtt//a8MMGP6AYeqAc1k/OXXW2AzxpmFmg8i9jF0mh14j GAjOMOsjF+RbYF1srbZutjjrG2NYhGJYBKIIK4IjHoZFNibtp9A4xkS3w54Tdxg7vwrLykZi 2Qg0y5EoD/CLjkEOkCZHcibrpNH1PKgVU+wwe+VGvlHdDX6SpbhGkK0rR0oWHtFimBLdbwDf 4IIOwgWDZglH6W6JbtrgOXcsNTnPYY4hL9AXn+M3i+ENMM0PcS4LuMYEAyJw4fTs/wjeufSa 3q0b5myoefQm/PbgrllrbtmDpEtuPPTCIOq21t+w7/67dsyaEsJ/+3n+svn5w//5/C07PoDb bwNNC4LfLGXq0CdFnrPMRGVoAWJRvCaR1ZGuA52K8+WJgK4kEFNlEaJFYy0rEbaI6oSp3wzT WCvsBkYvv/6y9StPhXID1r4cUaGGJVE0TcwGp0WnJefZZyWXsOeJ50kX2uclL5EuLblWWlvy hvR6yCcmyRxWOxAgzK4gZC5OpBT9gFxWu47hwuLoNcJF+4nH9C4SEd/F7KwaoT9VRfpTVaQ/ VSstqj8WYiyAKri3g7sI57Y2jgKMmtiT8Iwu4cFwAlDzSXqcBMpk9SnhBeGLw6vDXNhyd4DR oLBqdIRD5FDhELnmcD+u7KkvhE6OryzWtwHHcVKHCQNWUK4nCAHrrU5WJFP9nnaRAxDf2Rnf iRCv6DVUp3Q9HiinOhXQ4zx1mXF+WKeaHG1CYrqaRk2CSLyjTehXRTnjsyYQX4kCRbrGHu2J jJqxpGPq7O/iqU8t7h28/NU1/5Xff8/1H299b3DCrJtOW/Hg/Veu+hl3pnFhY1vjt/767rkL 83//3fqBH6KZ6Afo0We37D32Xu5nnf333vH44zBL54C/DPGPwNjfQLMTxj4dcfAPS5wMToUA UyNGnKzpK1kWk2mZRVkti2OmtFL+MzMLtHIBZqfA6mK0GmK7qOEaMMkadbW2HRo4zTpMYh6S bSBsFxiCQ23BHuO9ssaCrhBbQ9TWmqe4GRSBYQWxYrxtTziH3bkhPzBzvPkEe83n13NHtm64 PW/nj/a/sxV9ip6/m2GZM8FqomA1YaaCacTPDdtNr8bEE6OJG4P4Bs8ePdpOJQS+JmHrCeLw aZLiUB/NUdSbJENHTMf0AhIi0A/NCOul71hvL7ZgcmxlUCO7B+kRg9TkgsO5iJGJDuKDBkhK 1M137KIXIngXIjgXsp/mPUzPzbrnJ9tAOJYtJxvJack3gxT7g/ROh+/POxmcC41xL8B7Eatv GxdCtaEZoRnpA9onjbzciK5irkI/4C6RutQV2qX6qvANzHq0gVsrXa2u0dbqN4Z/43vOb2tM IsJocKbNo1HRYI6w60SRXSc8u+7rSKx8RkbyVBsvZuqL9q4v2ru+CAXqV5rZJKCAiRjTMrHZ j27pbYp4ph/xTD/iJUEiK7exiO3Hi3sqvZ0qvZ0qvaRK5cqgF6ong9kgDm4c+7zna6iDocmT QwV/UyDPdiZHh9JJZxdgoHzogx0lyRiAwI5kcgxZNSSBs3+wvTZJUcHxO7kVXUwXxGU9MHKj KSzE44JdQ2HB1oUUhQWhCBYyGZqXTo9rcYMxjyozsMUfKEKDYmhAFy5feuCZPZ8uWbbuxvzh t9/OH77lu2uXXHDt9ecvvm7SjI1nXr1l6zWrH2HjtXdcuPkP728+/8e1o/Zd99QQ0Pw9Nz+L zrpgzY8WnLtuzbGhto2zHu6+5mdbGDffRywrwdThecM5hV1qGXj3Kh/49sNULYmTp34hQhIl NUQvIz6qmD6aL/FFfKPq1ZoEyXDPMljDCDDtCNEgULd8wmxEqEY5Cb7JaO+rzzVRxG2iAw46 S4zIIv7rvV8V8gxFFzFMl7J1lC/5qC1+zVlHnutLpxpTfKLsyZNip4ayFWeH5lSczy4NLYst rlgVuyqxIXZD4q7Qo7GnYp+GDiQPJ/0nhO4NbQ2xk2rPE3BNYpaxgPCqEnIS9Fq74w17yWnL plYX6X5Zke6XebpPZJRh1KL91KHDhf3Uov1UNDHrG0m2No4ivnYn+FrPCqo8K6jyrKBqpa9g Bb6sD/s21o+wAnCBrgW4+l+gXMMu8EmmGrhVxdAHPamkkPTyD10o10kdIKcajgOEMS+QKuoJ i7MQBQfo0Klv4XEt1cTzwZoBxbd9NLOYRlS9g1Tvl28N/eCcM69qH4/GP7ms7xgSn7t54MpV f7v/53/ALz10yfd3PPqDq+5DZ1qrLjp19VvLtUjHEiS99T6y7sr/d/6z/Ef5nl88w7b8pG/f 3RvA/YF+P8EwaC2XprVEp66UhFhBEGUstHJsKxI4BbcC7SZPcyPmPsmtOXQRXzZg0UpDhkJC fCfPSV4RYIpTBmgOkprWEy+//DLb+fLLxx4h1bihQYbhOyFCFRkDrydnnFoKEcEXRWmmYwVZ LtrOF8mcJxcFngJXiEA17Wn3K0cctYHdBFV92v3uIW8j1ryNaHijoHhxa8hLsnohjeqFz4ri xcieIBveZXhbRGfLrg5kmBYNGT/rdYUvKFJg4kA7qe+jfoynyzFWo7VYukBeaF3HbrRe5J8T 9lgHLVXiO1EHbrcuULdZn2uf658bMqdxOmewqiLzHKfphiSIogayJGgiYhhS2jRpAjcpagH4 CLMs2RYk29gkpwXgW3KC56WEwAr9eHlWZiTtkyxGGO9GKqCimrW1JLNIZM9o517h3ufYjRzi +hHKqu3aHvF9jd2oIY28t0zxFRGvFrtFLN5mvvGmoyJReMG/CKhJLGoNDIDSt8YGpuxvJeWq AVJ0qYegZd3oCF07xVIIka19+4x9+9bxzhpY0sxt6pkztyVOn+dY3ry5vZzJSuLuoYOkjOt4 mBVdua8IhQt/4tsloZ8dm9WWShKDQE8lDWG4nuYpU2hqFbS1AjWjCjbF+lNsuloQWdz8n3ju e48N/uS+t9Hf7pxeXtLM7z4yHT2Vn4bnoU1PXH7jDWAzm4A9fgK67KPxyh+dihQoWLaW1GM4 bnpFR8X5FSvlNbLwvdil/HJ5pfoj/keqUB2S2Uh1XSJUKgNz+LhI3z8+vlCSjXTIst9O1NXV 1jIlpQmYoLJEwsdIEfhuvvDdSBGWRgAvNfpdpSOSFjRC3IT+oQPZKuImBJu4CEEgiiBI5EoF qnpCgKilcFbViOOOjFK841odVWmthBxXU8jRNKLMGjmWFhsF13hchKJ4AUgiScsNSbfWcJh6 Liq4dYYjvVRrHUFwKg8KrTbk6ifPjxQqCbnWQZJoOY2+b3Oyfc6f4cQyvGB+Wy1g3cSD+kg5 HtHEH606xHfIdh2Q751LbRsxTrKYkVCpw8dxESEhZUhfqihvZ+AKlGpy8sbpihR8NoHAN5E3 4fSWl1aev/jam+d0P7shfxs64eqJp8ycfs29+XfQsu+kT5w36azbN+S38rs7n1j0nYebq5/q Xrx94Vj2DF/o/LYZF9ce3SxqE5dMP+MKkkc+f+gj/jL+NaYUjaEV4nPxhaUYOQSdjs3H2QVE SjJN+rnMcuaS0m5mTelG5i7+MfYh/Qm2V39ef5XZX/p5qc+wS32lpWydUOOrK0mWnax3BOYE O6IX8EtKr7RvsO9i7zTuKtmCHsRbfL83/EyAiVkBK8aR0uqOmgylKsmajGWCAcX9CY2NJzjZ SpunMGnSzRErC3uTHvYmPexOutIRTiclBLhM3+odEtUUKZo4d77TQVGfoxMIcwmCG3b6wk7j RI5U7iC2XBHPKoBrnGlZGhfvZ5t6l0Jc5gdhx1KNdebKJjkKJwGLwgJXUV4Jc2JXNjdxYTFN nCgOBmziRrnevSfkf/nhQP7NnzyOTtz7Lho1+Znmvbc9+t/zlx1Y+8CfMB77P0efRRf97kM0 e/sHLzVsvvX+/P/c8mT+k/VPEa95L/iweWD3JsyL4zXtZBk6UXKs02clTEYKj7CikbVSz4rK yMDIqIwWBWRqErJCa8cRuoUaFfUQsbJSyxtWS3Eza5ZDccCorG9sVH/3jOoLz6gSX2FU7tvc CEsa23jiFdnxbFyUBImXOIkTopFYBAuqAhigsEIwFAj5Q6wQZ8MpZBuwiEglKRRSfCmmnlT4 6uDP1SgX385YX21qrpWFQ+GQHQxgsLGqVJNbnKkGy7oX/eOxeT/svGTlaatuefna/HaUueWh sSe1/XjpaVvzv+F3B0tP/W7+lX2P5POPntO0dfzYkz55+MDf6xKkb+B+UBzSi6syA3S+ggKf kCRRZFiOTJkiJ1RGEomOByy7RTyLPSWpJHWsxHROxgUf7+XBC2Am/wtgJstfg2ra5LNdK3Cn oM0Dtlzbof3HIRnh/7xEUYvnESN7Q8kdh1rOcAZT7ut+rvLYvWz9sd+za/jdW/NTfp7Xt5Kx gUCHuxbGRmZeo2NTTsfmZhEVhgeG5u4kTqoYx9T/53hkVacHwoWv/HGjoUye/7Wjsd/JoBAm PmIkdtGR+NIQ2F8egS3se8c+xNsG28ndT9o6eD5c6TLA1ycAX6vQI/TeY/FAPIgXVqPvSH5k s5WVTMoO4yomgSkABsnVIiSEEwYLwb+MULq6qnKEpVcWWXplwdL1jsoky8IYVi+kdYT9dGQo KXQLCn+gmkJJoUHOgld0V6PqUm+wS73BLi2Aamk6qSClAKoKDTSVaPrcs0eAapuVO+yOpEWH klCeQi4GhhPeOwWxDMlKgY1P4yriJbGSaAkraGmrKpguS0tVXLqiKqKXppiQ6U/BzgF/UoR3 5XxVCpWoYOwBHywScirFVLKwoI37YPSkHa5AxIj5M7n4LjZbWZkyaOJr51KEDJIDaNq1VJBt v98IU0g32BGVNR/tAyC4Pq7KNwLZQ2FxNAZoJ81rAZsDcJ/gY0/Fy27Ov7r5rfxPe3tQ+zs/ RejW9OOp7/ZdfO3ey1MT1yF8yw8PfgtP+Tka/GDFyifQd956A63sXdz/743Lu9tOXzPrup/u y3/Rfc4E5AMdeRDQvpxgB5ruMDwdNCHkD7ZwbEJWNiuvKljhMVYlQMURqiAVqYLkqcLODikp igKpOlEyBiqQVSkhoxlrgeSVg5SUIUrKct060rHq6YHq6YHq6MGuDjXp9m/sySpwUd/A+CTX +Ip8QciFoqSOknq7vlBfrnOTOyP1ua5C40bBNzjqVN/qaBNtocrkxlAHgYBqswrMalZfyrIM Arot8Zga5JRhrk3KCKQ5rgKWD+7FR/buHRT43YMP43lHpuOewTa4m2cAmK6GMWdRO604Ye/+ WU/AojsQLAhTdTeM+0dhwBlPhl15zXGYLAiFXY8680F3deW+DoJ1mLSz9Ew8gba19DS3OOuG RmddU+usK6qcdWnCWUdiThtMnW61JPmN/OM82DvwlZuZzcw2hhvDZJl25n3mIMPbSdi4kWF5 p7xI5ibiztlfvDn7qzdnh7OWE8TRObufe6OzyFmfOH/ujm6I1HKdXStaBwshEKk7UupUiH96 AByx29NGRv+ZvSSagXGeMPQRew6JYFCU4p+1CC8WLsGXCtfp1/kEmaJer0pArx/FermEKcsj VFwuUnF5WMXltKJ8A1vo6ZDSKslekdtXvWKf6rgFKjg8l2zJ0sKFmkv6UdKf9bf7F/o5P0oz tC/C8bGfevr8rutMZtp93nANWLmuw4XoAAJQJ7MzUA8jBYi0E0ZRNjnqS+Ee6VjVjyzljx8H A0cLE+nJj4vLz51xYc3ezmevefZltDmy5Qcnrvwh+9mxaP+vL/wj8akQGfJnEMzAZ9FxTbDl EzKSPKlaGSeMV05W5rBr2TdZ8TLlbfZtoE4E9Snlq+E3cOv5n3GfSrzCoXHcGxzpPv4gK9up FjZJFkDHe7SMTbb2wHvJXXNkXUrXe3rsENn+x+yJUThnVdUJkhyNnsDVRSLfhrBPlBVZUniW 45K8EuB5eAeIJAQAlBSF4TGHwLTAbhUWq4jh+vGkrNnIo838Nn4P/wHP8adIZJvaKKIkhPzb RFbsx2t7vhahwDWpyX815PtsmBxtIemE+mE+OpjrGiAZKOJYWgn8tLaSF2ALySmQziFYR2ih XZSsVqkVzdwWOXPmtvhwBoEE6W9N7HRyueTNwR7NR4b2YDYMgmAZvhbJMqwWmUiKBSbtPofW WT9sWKQ475PLYYxHRTMceZXHM2DUf+wLgRjKCGQKVDsjlQcyXDaQIVOyswrEYKYoN9FJjoy6 VuTqGZLEiMMhBYFjYSooenIj0LMZXHWza8MoheCf6Nu0F7+FxME78TVDzODhgwCktfjNwV8c uwMf+DTPObrI1dH+9wedPm2EwXPxjJQk+Rz8yE4RF1CV9SaPLXA69htz3MPHxRbCV8UWB3IO pSX0jWE9+uqYnOcdgnBXvwOM+pwy1DsYRjDhDizW8QZSneoAOgZhRG8BQIvj5CRD91E6BUgK Ak86/mqIpNnkY97UWJlBWJJVg5FkrKgCxSDLBaAjfRSALIa0ibh3/oV358d6R3TwksrWlD17 rFdf3UOaiupdFWG8jt4ykYK3QJcsXXJ0ydOlRLS9gkiYsmIgXYT+GcOZQYUuRS9xKJEBLqNd UTzSkordYtIFD1EwMiCOgcGkXS3kaFSgB3kSdzA2Y+GOrO7Sb8GbLnpYhtTJ6g+NOURDPjAp 52ZyRZ7EMYJ4djWDTSmA4xJ3mbZWewGGUpuhzTDZWq5KH2XMZc/mLtO/b6zTJRXzUkYfb8zC M9lpYlZq079tKHfgO9lN4iZpC/uIKNjYNIxGHgMQYUnT9UZeAlHSzjDPQFmEsSTJigpO0jAs Mk8L7W4b27vxFnAfY3fwSakfjd2pyYqXtHUzs1m5Q0lmtdUqUnfDbRtIhX1xP6xMxExVisoJ DPVFGiFSTNJcbiGrH3fsSvIL+W4ePDTe0uMjPChKGu1zrZFB6jtIPhPexYre7s8R/W2lT394 f2PWAM1zrruKpjlhBb6mkM6c+x+MBsRDGnqDwUNv0DTmzG0afFZTDFT60BfbDYV86PYLvd6X yhijUrRnqG9CxmiaQMWdDbDV7Quq71zRlQM0IcUIhsyXTvCcJ4/6Y9NNfJK/DhuACD08fgJK AR1DFch3B6pEZzeGouPQAsQ/me94PD+X3330s1v+rf0n7LEj07mXjo7jPjhKEOFu8HFlJG7E mFolG/ES75KX09zRYaseMZUiWoiWjcFfh9z6cYXP9+3ZkkaXGPiSKIEbkrDIspLMYSyLEscC jThaoBFsEY1gve07AaMEgffoE1+g1Lxj68B0szFqcLmkipJqu7pQXa52q7wqFcewblSbdLi0 Dpf8zWJZ7ng6XYhli9hafa6+lepLruvQl/mzTUqrmcw6jiqL55fYoQ92gTuSkrBgaOvO2EYS U4Em9ErZ6RkYwj190zNStskRmzIieCOSsOuLgtjkiGRrhfOEhFqREY0AvPzk/aE+P4iljlgK YpCIX2wvuCdUZPWOImmsxCDxy27JyY42I0Lpke/u51m8+/ljedCaq7nVoDHdR7vJLy1BpP0e /zpjMHHkcKKZMRMFrEAgHo7HOc7iAmpYjXOPhvuM5ww2HI7EcbI065vlnxXOxubyc+U51mzf Av+88IJIR2xO/IbwndiKJljWTqhycATXDBYpSdDjmn0dwXRSROLTRQ8jiKCLZHpFj3CLpM2A TKpI2CSZV9Er7Ipkwikoi7HuUlRqei7T9FTILETmZppoTuE5BTdE93cwQhHuRkvOHc50ePnP XEFZ2r788EIu1xXfrto08anKbJRGySxb9DwCk2riSN6MRscTLKa5ifG14HRFOXMuug6NfwlN f6w33/fMK/ndW15ApW++g+JXfHLLb/Nv4l+jZeievfmH3n0/v3nnC2je0/m/519BLSjeg9Tb 8h86GU9uEGxdZyJotMNoF/mWBPBMa2bgbOvsAKdqCQByJhxx8kX2iAn5yhbhng47LT0J0+NU OYwOiVYSJMt1ioeyNhknKZaMIfgXi+jeiOveiOsFkqL/q4mn49Nw0WKuMlxd6HKmxJ0OLw9H g12SythuaDQBZRgkARX56gRUUziBYV5SKR/IhWQmrr21bemtnX/Nv5i/Dl351L25U8euyV/P 7zbsRX3LnswPDv6cRRtWz/9RUCc557lDN/F/BfsJMjWYpTNw+4L0T9M4GpkQxGoJV0aSNoGy QIVQxzeE69OT+dbwpPSp/KnhGekcP7tibvpi/kp2Fb+B3cDfztzFPsg8xv6e+X3oQ+bD8IeR WAlfz9Txk3kux98a2ZT+fZqrCtWlW0KZ9IzIjJKTyk6qmJnukOb6Zgfnlcwr7Sibk5xT/j3+ /OCS9JXpm0puSr8TeTcdVSMoCL5oRzzDkI7WxniGiwQidfwknsNsqIYVa9KREM8IKdYf4zF5 w/CViYTJYqkyIcqxEUoTK1KaWFFBK5b2R8js+j2j9XshoJ9YL5lfv2e0/oIa+U/BsWRddx2u S3lqlPLUKFUw3FQaHIRasFc1QqNPaq9qtHbYXofNtc0NTTxrpXULN5sWzjC+ZutF68WcW8hg VhCn3LUing3yDCOakXS6MlETClWaOMuyYiW1bVE2E9S2Tde2m50HYMaQBW3ApCFAVSgspquF okQYMX3YOt61eR8BgAnpau5/163I3HvPA796Pv/U49vQSS8SHLho8MCWZY+B+b+d/xOKv3vB /LMX3ZOrX5e58uw9aP4f3kbn7X42/9Afdubfv3FM7m6U2YGU2/Jv5mHn/G+rJ0eJPt4H3n8r IEKEKcerqT6mbNVA9viSeWXnS8vKOJk+IiTRpUiXlSSZQCaKPohDBM0TVE+w+4f+1GPHWmB9 sKe8usVH3pdWt1ju2nTX8PlbPaVp53PY33LX5PPsDBCqjFNKTkmeqc4vWVayQv6+cYV5rXKd +WP9UbPf/Nj4yLQAy5M+M+DzmT5Tk+04TsVCimCTZ3f4iCyHwrFoIvz00J6ius0eJzMXDjOp copzEdBEQ0qM0NuR7V+FlEgibdwteM8GCh4y0XRflCb+BFp9zSUrl1d2V7KV5RF8XK9XAe4i 3xTuhK/lJhUksD4+z+56oOj+iFv7IUTWRT2IveFNZgx9Usd5UIcvPDdZ9IcQBtq6rkhZM2Na k3z2JEIhUBflsAYwkVg04wOuYsPLyJZkLAiRrfIyeBXIR2d8hxwlqeCsujQaZZAJrAOVU8Nw 8dXJJ36pNBsOhf0V7GgMCFtB0ZY2h6Xuw+v3/WbVr19rq5l96tChvbMvmtOQmvlf6L5rN532 4wfyjfzuWS9ccfcbpVWVp12a70Jj12yYqIqDl7LNE644+QLyTN78oY+4P/OvMY3sVNqz4mOq i/qQ0kVyoZMX5styZzDqCTEQppbR/fSiWr9WJKtFckmRHPdkiM0jrkJgT0COkK3pOJc9l1vJ XsJxVdXj2EzJiewM8dTSk8qmVU6vPpPtFOeXzqm53m9UkMIDUZ5KT6jyhLQnVHtCBdUrZ2dH qPKEtCdUk0zldCLV6OlKXMlWV403WyqmVZ00Zl6yo2J21VL1Qn2JcX5gUeQKdZW+yrzKurRy ZdVadr16vb7evNG6tvJHVbfqm8xNwYQbNjek0nY8HZPTtSjNMLUxm2sam2YWAfToDVfEr4/j eFVIb0hUV6EqPsQXSqV8okFOJEIspU6kbJBz6htklaNP/YwZcP7Gsw1VlYau8qmS0kRcEgWO xQKqqiyHbQKfiDfEssSGbgbuMRBiGmgBiAYUFkqidrQQLUcbkYD60bas1pBI+v3fnk1OzBOT 1sk7cilwB6fII9pDR6ZMC+2hcpqpRbWEdhoGnl1L7oeacG2sKaUd57G8rk8YI5S2SeRDvmV7 CGAXun/sswhQRMe6RaFc236aDHWr7Z4noyV38mihNZir308Wh8hIgZETek86JjpJmrRr2MZR 8Rtq8fFdKI4a4qEGnqZ0GtRQgrKhEOtVJMFcnWa3BG5ucou6ldW0zZM+E+XW6IOBcIgLU3sm 7i09f5e+4IWrLv7Zme3zJ+eXnv69xT/87N8f+Mdafre59dFt92Umorfndq9ae/Se5/Of34ne tC66cc63V047aXFF+Jz6CQ8suvjZ8773m6uNG266+uxZzc1LaibvvOzSV1ZeQn9ToRFY7W7S i4bCNIIVPMgVPUHwqgziP60yCF6VQfwnVQbAbx4nQNkY+h85yP14ZU/Saa3aJSQRHkP6eBHa idy6zsdZleK85IL8Z16+7U8e2h/z0D3vZHLIEaW+O4tTb+QXNqzB/bkDFv2tgCluuabwJ97L SAL9KQMIKii+Nk1xHxOiv2Hgz5dy6/NxXt+69cjnZOzug3iOVMUCaLLzexRpcy43V3pR4kL9 bn2shZssTedOkS4zH+Y/NkWNwT7yyKsgB0Y4zECRQQSGSwOBNPYielyI6LHlVkk/cCJ6nEuG UDLUHsILQ8tD3SE29LVRQl+HTgumXj5CSbrPgTneU/FsRyl4T4VzM2iO91QK3lPJBUlkP+w9 ncx0m5VziwyF4I2GCfUkThB8MLZ9SwWZwaoTOpPgADX73HiNVhdoocHHLdx7Xv7o67/NH1m+ 9+StV73Rx+8+tv29/LEHbkL6J+ysYzue2fndvfTXDRgZWNh08rwfPpFqMD/Ke2jPcw0cCK7L kUbUY44UZGZESFxcp/ms4HK8wcRGwQ7koU8LXk/y5N4OJaDrT7vHPeBtRJVuzwr2BCXmZYvI bm43J6r0qnsgFCV2szap79PIUmF4WeIR5se897L13su+5mbGyUKQduXKMTyqY2rYKmWM1qgt 1K6Xrpc3anu0g5qa1No1zGFVwm4Lt4w0leadp0yhzYfwbUWWkxIfkCSeAePDfABjXoZTfZJU GEleJKFFWKJFu5pMu4S6pY0SvEcoq+NsTWYBRjfjn2KMyRZfkm/ncSO/kN/I7+EP8jzfj6/r URducVKJXeSZePKKWM6vUMSiAxHnlyjcnkjSEumkCgPD6cAdjAlK+Lcdso3ISgqQ/LbXZT9z Ww3sPf70efT3bcj/eEATB+SRnOOfE6SA3cczkuQlckhMkULNTjKwGeGpgy/8Dl01uqy8AW14 bnAvv/vom93Lv/99rpbWDSEEEC8j7B//3XnK1PR0C+YOLNBVEaNIy8yhwcIe7Ig9PH0zh7tw OaFQhyhSPEehPW/IegKcz2NVBhzC00mzSD/NIgesDb0Op9HdFmFXzjZ31DJpX62djmSY8eCr xkdmMCf7ZtgnR+Yyc3xz7TkR6w7pDhP7IqSMZtGly1SaLRSL1gdb+BZtGj9Nmxk8iz9LOzt4 Hn+etiR4CX+JdmXQ5IMkO28DiTUxHfMpTvIsTEkJ0b4Ey/E8FkTQPgXgR9YN09QCftsm/yFU BOLq1h6eiSTJWrN9ZJ2dF5TkJMOT31MCHEZMhJekRDASCAYjtibLiaANou3TTDNp+QKW5bNl TYoEedNnARjDJfFsxDJNWQY1gGuK2LbPx0ixcDhmTZXR6UwSRux0JgivLMOj0/uSpNMvGu1H N2x3godcLNo2GIsMDsaig5HTTlo07UAhYvCS4CRYcH8HyWvxbStOiY9cgVquM6x9+2DRus+T iheg5iaoua/IKGyFPIbhmEAVfFZXnD+nluAm3Y3hD3q0LJ8lv/GBaLlmRY4ppDuLfGJW12zA ApgyhIOS2zFMUueOrfgdW/HbsPI3owpEOocRujd/5fPvV8YmKij86e9mVZQ0HPhl/qIn8y9V i+FA/kXA8ik/vv3PlewfB2P5v3x+Qy/7iyPTudyG5KKTjz7gIvoMsCw/O5dGGipjFZUrTE/u 7fAVuteNYbuxCxul4eZ3XiiYjvepPhxN+CPeRvm4ECNb1wEEM4pCKq61a/0T0QR2ojRRnqhP MsbZE/yK7Sc1aZssDLcQrbvr4gJ1dimpUCe9Gvbl6HIVp7lasUatM9L2eG6SNEklR/w36Swu J81X5xln2YvRIu5CaYn6PWORfSm3SiJhw+X25f613HpxvXI71y/tsp/jXpTe5N6S3jbesD/i PpY+Ng7YowT6AyaaD3h6iCxViSwBML/oIYJrs6rGBANWRPEJJAb/OGsQyRIYrIOLwZhm5Ym+ glo45pkDy5RlRP7nLRb4mN80dB1Zlu6z/X4Vpg3rKqv5FRUJFvbLit+fZGRw0TKLdT2psQFN Y8G9sCzGfl3XNEYaE0RBsLSkltUw4NiCXUllo7JHYZV+1L9zgetJ+rOK0Ju12q1XLNaCnbJK kokGgntTxJPUn3aI2F8u8mF0IDeQA4GaYG6EDa7jR5gbeUgY/pgmsbBWaV/xyrGwfZ3UPTj5 zYJN0MhdJTWEaAaRqD0Sz9ikNTie8TsrjjwtGM9I5fEM+cG0HSWkLrUnW1aS8UOEz8JLN0Lh Vr8dCp8gySCxHEgqqUuMtuGYdkbVSlMnIKY01aoqRMJE0vxh2OYPwzYiYZBGWmmx2Xairi8H JvFdukQqh9itV5B0ARr2c57VynhCXvsIKWdWjD0RVb82OIjrD+ZvLkuNDeY34mP46fx1l05p n4OuHWw79g+sNoxrT+QR+XVsl39peCHlXyrv0hsNhKIgQC8KAlxKVHiaRBMK3hCNYGWF323g gIhO9bv87FgRPztSFEkOczXTa8DwghftnwQvuzokeRLLTYZ5+6jHDhOb/ShrgMBFYcGShUzy bRFqzm9lJ4PA1cDCBiuW6pQxxv8x9iXwUZXn3uc9+77MviUzSWaSkIkEkwkhGM1BZRFkl6ko UVREQVSCiFhRw1VBq1W0n1W7XHC5uJclYRG05mut97pwwVbtT3pVWtGilcrtR7kVSPK973PO mTkB+/0+IDPPTM4snPN/n/35v+y16Fr+WuUTniXrgxcFieclnpFklfQ0Z2QlJMsKz/ASQxIF EfIsk6ERdrAQryo8wiEHUnbScVuSZbxksJ+n76RjtqRKs2y5R6bxothma4qiZihm1nT6IVgc 22zC1BXykmC2AgGS6gZFf3LDJDq2XdPdBQPOOYmFDpsDzt0XJBbqwDKUu7GlWjsynxex98XB ZAqR1pJ5FBPfTNkcxVYk5ZtEEVVJZXdh9csMHXVmwEiYjCD5JUFrCP7BC+OTLXGS15r7naB1 jc1WpPAk3SUvUXCAUEYssDZAKFZGrUWfNfDO16hqxvhzL0OpPw3soK9npg5OWLXqpnVo08ne gR+R2GAEjm43E2yi2Y6P5vPnT6Xy2FoM6GS1GppVmIQmipMkRhYVyfWVbV2ldA0plSp2Tip5 rB0HOjoH3nA1Y/5FFl8/hFhJZkVZrq2oKtTL6FscamUQi90SVq5XUgVEbgh6evE9S1AUJM/i l3CVAk8rciXWifJuRDjjWHxpk5QwSrSxgz1Z7VSQktARxfEzqbhG4lrsekw9ipUb6QrumHq0 u8M8aJ4sNUp3WO1wfoHYrZtoPd10vYdlc2HuGnp3JLq6qh3Fqoi6+mRbvJ2uhouUB/2HLwcl Q3sq9pF5DuJi3o2L883ASodGt5HgGAlV4RH0NzMmnfxPNnHyrbnMc33Miwsmv/zySeEa6F6Z y76A3uN+RTFUN0TKCjMmGi/QtmEVSKW5Fz8g5Vs7EYkXZqAZDG0zMyiaIVz7JqLRWizspGdv RWuYnfT8XjrOdr+CmijnJMCwxAAO7SHQ7HKB1EN7XHyohmlB7z385//G3yFG0dTkoUNsij2H qqfamGr4No2SJjXEtUTDCK2hoV0bHW5Ljm24oKFL62pYrC1qmD/qB9qaET+J/DTxvBau9xry 6oDbjkgb4y/Ub4/vrn8jvrf+t+GP68XzI6iSJK8sEjIHAuXJtlbiCEwnUjqajuUbGwrtbHvj BeykxqI4N79QXJRfoa5V31K/1b7NW20FHbFmU7YQba4KxS4fceMIekSqSe/UH9LX60M6t17f pH+jM/puTwXuKOqqyyr5lcczedQOEY4vHeZwdZ7M6eq1rn7WY6B9txV1PcVEd9Iv9Mac0Jlk 1xtl+dw5sUdDqZRAlf4v1Pg6uTnFKCOuMK+gxpnDekj+4dPaJ92CplKkeFBFuaosSWS46dav nURGliXaKUs6wcnsfJbUP8j5zJLuRYV87Sx84ayX3cnupC+19Tqb8CJlakfVbqrl2kk9heT9 ancOfegIu734p7dYe2Y79DFU1hRGtfe30xvaUXuUcJGQN4+KXp9MNBerbvLod5q8kKrJUQu2 VWzKvs7v5ek038nTfMjLLoRKDD7O+4ws8joUNkD78jGoaAArAA8VV16H6ga0qPNnjik3FRNC OCcDmc+beLECh9/hUl4FqrD5zz8nuZSD+c7D+OFBhw2t9OJuJ7/rMTpRsAiA64TqTu6gmHxe VfURO5kzSJE2VSczzSAzSiwaTYUcFieh1GveCeNeUGYjRTZo9yT5yTb421qocwhPzqEhYRkJ h0ORaE0twws67Qzo4oOYjgWvLN706sSbJrVet/8a1DL+3jtvrdgcu2Hfffe+MMOUotWvpqJX vnHjvObrF137VG3FXXMmvHjPtNXTQrqWyObkG844e253rPv+KfYVk0euPHLinrPHoI/rU2b9 1KZJ8y+dfvYtpPq2Bq9j0ntjUhV0ANbxbYhTjSzXyo3nuM705jSdTlenWlLnppam16X5scGO SEfiwsiFiS6xS7vY6IpcllgsLtGuNW6I3JDoT3+k7o/uj/8p+HX06/hnFQfSQ+l4hmsymkKj uE7D5i40ZnALuf0Vf2ePm6oZ1lmsCpMp7DbJ4ZSukEHEcgEk5gu1S0OJdnUxlt2nIFOxlflK j8I6M08KrFkl5nbdHfNqgUe8tl+HAFMhrCtQhIW0OIGSshwbQReElgPC7UWrhQp4TRes5jVd sE6XDmRGW0pJA8ZlmooXmRxN9yO0Dm1Am9ERxKZRJ5qOGETSqWTRIkI5UUGWFwJ0I8hBogBB NwJ0k+CijywrODRCvjKKwagIjFSieOXEtmHpQgLcZc48Bjx3EIN/YPiCcIrJnTCy6DgV3csw oPuQbOphZ7RcYfkkjJbzgkMonG/30rY1GMGjW5or6bBJ1VTXMaGojyfhjGf7lm25clO3Pfi3 1169ji7MeXjFS/9284qXuF0Df39o+kNv3zT4zeCHP0c/fn3O/Xve2ffmHmzDZgwdYg5ju5Gg r3B8iejQEc87lb0RbMkTDE8wPYFcIn8+r6DfaSCDqM8Z1FJsGdlAShFiKVZBelgQybkW4FwL wGMgmORcC7Dq97z/JpR2zDe6mskPsBRIKkqnzgueF50dnB2dH5wf/Sn9U+Yn2jPmMwlV1OLy YnoRs5i7WV2q9Wgb1W3SdnmbqkbUNepnNKNXX27caNxpMAbCZsCuHQWd+vPx11pHbaAOUEdw SG4YClX+jin81YHUtJza8mBuFI2sLoK9qU5S0Gt41Gcb/lo6jMoq+TT2XhFCtp53ini2i2dk u2cNjXa0cAY/BTizAWSTAFoJgNYFqbCnvMMetMOu8q4qhrN7BZQWOgVa0KGbSSZvIIBVFjyC LkF1l49wZrLwRqlo4MDQN/6xzN1SExi8xszFv112lPQ9LPOGibDqNLsO4n9QK8KAnVui9SST mwFsIQJsDBCLA5oAqF5FKM2r+SY3gf2nAPyqpaIQATDTsaXim1/sH/yfZV/e9/J/pTfF77zk 3heeuXvxg+ie6I69qALJLyF69aYnk9ct+fXvPvzVv2BNOQEj91NnRpsOgqZcJdOsltMK2vka 1xpqTX2PvkieFZqduoZewF0tXRWan+pPv899EPw4/nnw89A30b/EPweNGEmn8wmiRqckiE4V RtJZbWRkLN2qTaHHaxNCF6S+Jxe1a7TP+T9HjqOjuonCjK6YBtaUimBRWFVimzNOHqYqSzwG sRZE7S7751TOMoZpVeM74ZYtGjnT3Gch07Kt+VaPhfUqWSqOdrUCRH1Z4MEQPWvxZGFZoG0t KKkQTFg6wYTl9QlbXj+wtdv7dlixLg+IJTo3j/vNQdn2YiArePVt0udBkHdW8XVhr/CpMCSw BH3TBUaohCUMjoFQ6SxtQCQ4Z0ICEBmvLMzw6UkSyUMlpaQa4UlneAPry46DbpGF/JQVJel9 TW5hiJLEwRSDVYpOyYqjKRXBcDRlZ0ugHSowVa3ExGMb76CNNNb7CWbGXP3GnR/cvPj9u+b/ uKl3IPPSzSv+7bnbVj655l8fOPH0esT8YOY4Wj8+gQ68+/b/fnP/u28Q2zwF2+ZKrCvDGHER QFw0TaXCOOLt4rqkOcrVzHXcjdLVihh2GNDhnB+0ZxGpIgUsY4GPuOOhYwn2zMDY+JmpcYGp iXGpmYF58VmpKwLXJ65IreRXho/Rx2ImFUGGFo3OiJDyFxNJGevMDSZtmmwyJQvULvoFslY9 K9Zvw6U2sc55NIj1GBlRPvL/pnPuLUZtDbukUBnTPKpEzZu1gQyPVNdQ2KwhLZEm0UyutkDu dxC3M43Skd2eQ7y9GGkp2YPyMLPo2WkzK9jZhoKHFw9mrpqy80XSRl+CUAog5Ci1FIAHRtgI hIab2q48NLYcxM9hOB2D5JBXniMjUy6zS8dAd4fLZuKSA8BURtKuoMBE9WBrwI1yhX5qH8n8 sGaEYExbYlLmKJMOMqbMBl31JidBvcmCN5h++WVdTXmrpamr26finB7NkFAFhT9UBTRoPHPZ rsa/vvLl4Dco9F8fIB2dPCRvveeqBwb20zPVMcX7Vj2PitGn+1Aa+ygqqh/8ZPBbM7Np17Xo 0TXnXbuRRJxBDMMe7ndUFF3m9GqGJGTEm+Kj4nZ8afyn6s+05zUxodVrm+P9cTYOabpEulAh aoxqpGQUpvOhIMvwlLw+hEJDQedi7SgGbbY83O8phKg7ha7gUIKlGPoRBA3UvWeOgfDWzqfS hXUUittEBcVtDasgN2dTD/maaqKUqEY3a/M3t3Ep5DYufQV+FYxhAPv0zqHjQIZHPR2Lv4p2 UVXUMSRTXmqndM1JkgcHxaAoDucPdzlZHkI13G45Q64h0+IlgRdxVGNKgSRl8UYS5VG+YfVq lMcqZFlyGyVHgqQkfkbfEoaXDeg9kpHblNfsdM/XtLa0FtpI/wI2VMROhQml5tb164OJu1Zc OC85pnnW+Xv3Mj95oPu6woTvBX4uT5h/5QMnFxI9ce7gTOYrrCcIt9QIuE7zFYULNSq50IXK +BAvVcQrGpXaUGNNuzI6NFmZECoKFyvXKsflv4f1kTWNdefUnFN3Yd26xg2Nwuiq0SM6Gyco E6rGj7io6qIRi4Srqq4aMb+xp3F/3aGqv9Z8U2dFI3x4J72lrz4VFMDTMTPUKPBzegDQONSl b7dNLpUy5PHVKVWOhFtyLYQD2s/7/DcfUY9HVpYtyrlYbF8UmVE7Oj/aE2Ub8VWk5zSCFYqC FYqWrFAUrBBhIIRnv3KsEDmKMBK6VijqTNlgARvM4z4dddz9TLUYXW6gHFWd9gCZ9gCZdgEZ Laazrxt7jU+NIYNNG53GdOzjeWrFcC3VyKIBasVIENgZ1UB3lyLfyOEUNcAyGfF84/IqYpzy 08qapdvtnTH99gkMFGicY4St86DLHnXQaQXoxo4R9obwIo0wFBVMceDJ4zOuVgO3MD7rfDhY D7oj6ESljluPdRTWIBhyUcKOAHFmncMURexWtNUbTfSzoy3cpDSft/z2e2M6WrH5D0dueO+H r35/49V/2PDLr57YePuq517+/srnLk7MzDUvuKRt8/2o4+PHEXrg8Z6Ti/+xd+WLTMN7/a+/ ++s3f030yVqKYg5Br8dbzgR0BK/vcJSkrQ7YENnn2FZmPLNLY+GpcDReiIqWaoUYDlFGihNC iqwO82dUH6pUz7ex64pqTrJbRheGJNQvoQg4MxEbiDHq4TZEwCORNIoFFBkQ3EkJcpwEOWDY HQHyPhLp14BgkZBqwONj22Gqahq0qEQLowubI0ci9NLIhsjmyFCEjdAhD0QhDyghD1+hnDMY YuKvd4RsRZHBi+YAxUIzuZuDPm5HQZux3py1bzzkuBMYUjSoLxrC0WnhiTNifh+7O+8NWXfn jw5HlUdr4wSFJFUNekzndSGn82oSaSLWYBRJLa+m8oRSP7ldkSmZ4bDmGtW3hCOsUE6Q6I0B O0zUVo0FcOHD1tq+O/pX/GJK383XzfhhBw4H//ZI1zM/G7icfnLtbbMfvH1gN9Za92JAdJDJ bEqgZWc2Wz61Vl/m0MLCuLhbeDjpS5iVZc4ns57cV6QVL073BN4TBCyU3nTAF12VZc4ns76+ A9a9uown8J4gYMH3Tcv1mrLM+WS2lOZrK0qjyXWeLq2TNkibpX7pU+mIJFBSWloq9Ujr3acO SEOSnJZwwCewNCPxzO6hfvcdGorMHYjiOZ6VeSHHUex6dgO7me1nD7B8P3uEpSk2w+7Dj1jW yTPQc9gS1FiAGiuTr8CC0WQ9o8l6/WAsyUrIBHbsNPFUwC2DXYsIrPL+DYu6lvnLaMP/JHew MscTsjfYosXZi4ewvWFI3dvX18f+Ze/eE2G29sR+ih56anAmGgt4CaA1Dl5KM6aeoJZatTxB 9/d2DO/2UD1BKx3jLVrGE1RP0Fz3MldkuRx3FtvCreG4qMhxAsvSLBekkKbQTEhlLU4RfNek Bq6Jwgspy1iHfaBoFNsBLSfL6xSUVjqV6QpDpkTtNnIN3KlRSAspkPRUKiF/pZLLoIiQuQJr osSDoZerJp5qR0gmqGOaSYq33VTnVJL4yQMdR+mKWC0ta03RoeDRRdOoFU05iSRdSFLOij+l BTu5xRLwqrelJZah+C9V3r1WyOGkJ01nhLF5Td/gtdWj022j+1rGPXYB++V773172xP6BY+w 805seGPqAqzu8Lpn/kEm2pmAM+2nl2qS0nf1jMEiKcWzJXe+RDjvUtDbqSLvhIB8kb9EYgzt /3DHeEbyOMucqQDZEyRPIHOENkwVzGFukekAnwlCcfJIb6COFCuP9OH7AAdPQDPCEftu/AzP shzLt0kTMRz4M+SL5VuYm+X9zGe8sJFHNXytkBPb+TFSpzZdm8vO5S8W5kq3s7dyT0hv8r9l P+QP8l8K/8N/K4YDsswxDEuTcXpJxA8kUcw5Q/QMy+acwXoZL3OWdJixHGnrURRKZnciw5Y4 Fsoi1SJ5FM5AfsZ0RsvW4UCqPEHvwVhRXTJBJUeVlk8J9nSJB4rOIYR97U5qOtbUhDThTDBH gE/KIZIATUHSpNj8QB6IgnQVFVe1P1ZNXOhHJgDTdaFJu3D3MdIufDR/uNRggMPuaDsps7He 2D2ZvxcwUsUOBm7dAqI2RUJp6W6GlmIaGWbs6p7rUODbstRY0S6JFRUdZF5+awUZm39/awbu tlS5RPcwzdpNuW0I/FD/1ioYedwaIXefbDVh2B7fwSMV7rYo3jQsyUKRjwp8zCIxFMGfFgp1 wA2Zw9gaIy/+ekvSORx1zXVKCOUWZxh9NGSstVmKFbFJZXnHlDoNXN48PjQTCFgDohe+HFyM Xv9k8Mk7uV0nX0WbB1cMLKDT3x8ku2zdhe1nGzCbrD7depaK9N9hK0+xiaVDv8MCnmLpfO96 ml3bUeTAfAGHSdsYh8uk0OrcjzrTuXe2yuu3c9jnM7g0t577lGOn45sjHJPmlnI93BDH4lMi 04zjJJF3AmcpjKOj9RTqp46QPe/KHtM/yh5Thc9jcsDpxH6iG/h5Pc1DQ16Xs2vMqGnscGNG rBkpGbn8J/DoNNvVS8nOxXMv2119QIXieLl8LY7HapgbofPqESroU2bmsBnGsmz55ArfGU75 5KRPTvjkCh/XaconJ31ywiervgZezSfrPtnwyUFfuGb65IBPtnxy0Oeg+531gE+2fLLmjtmJ 3rwd6RKxpypaIcceZA9Kf4x+nuE+4I5l6KiYqZFiyYzEMDWVKT5MIiwB8TWJuCnvy6F1uQ05 OoeNrJ5bZyGLhbwlTPlZUDGFvGUIKI1hsyYCE4uG7CXYWAtqpZY31lnOYe5EXb0xL+lUHqRy i0NaMZZbl0RJ+KRk6ZOS8ElJQhlhkU9KggufhNx5kmhVCCqSKvnMpFefTeKP2k7RLTXeh9R4 6rnGVc+hYk0O7aMQKSvQaYooaQaUdMVpShqcCCriRg4nvRzIUTsEIYQDf93R29ncTrSy91Sn wikwQRzqKzt1+WkyyeMB6BjrXubQqHTCJpxkgtHHBqaroWBtSLWSKKCFvQDDy5D9UxfRlk05 gVUl4pUwdkS2L1EEieErsbh1Ce8Ets1khstbh2EYAYkC3zcEJJBM8YcmTzZvXLzisfQdb//r C701885Z+r/6Ll5w4eqxbO2j0y6/8uJdm7YP1NE/X3L52EefGXiM3rpy5YyfPDzwkRe9foHX dQR9AVmWIMfwQfo5c6f5GfPn4BHmWJBniX9QjXF7q4keN/fFDsSGYmxGDOmhSABHr4iPaLKm q/qwEFb3rXy9FMKmino2BhFrDKJXBeJWBeJWpRS3KqDvlGo4Aoqa4DBC3Ioff+sWOWW3+nnM GWJVIDRWEP6nTItBzwiJYWNHYvTS2IbY5lh/jI0xdEs44mEv4qEx4vldEdDQx/osyyVv+c7Q VT4ldLV8oSvr6uN+O3BqKDwtCtTZpT9OMHsUwtlhv8h7PEzAf9B5uBzPRnhLkkVZkBnerLV4 PYkMOeDCjtDHdRPnIWlLmhzB4GK4AECK83IlJTi59XkfltY+dfPH85+cYcp9DddNuulZtvax TeOXTm2+feAmes0N14975N2BV7GROn/oEFuH0aJRcTRE8LI9HHNHiQ+BTiG7IthXEykOvwgI clydyE8Si/xc8Rp+kSgWzLGBsZHW2HhzSmBKZHxsHjdPmmV2Bbois2LXc9dLC8zrA9dHFsRu QWGJ57RLmYu4i+RL1SXM1dzV8hJVjqZYwcIaMjQs9xbyVYBCpdybWQxlk5BnSwLchNL2fQLU edzSqVdSB8GlM3A2VHApD0Dot/VsrjBKQJRgChmBEUrtJKQ4+CnWlDD9QFL7WNY9kJWCNd0t PI7Da4BSdZLdBa5hCqq4VApABTl7V3mB8qaA2Yuy8UcTrUhTXmGyvOWj6paaqDMTJL3v7vTo R5LZne/C7mnXcHx5/AmkJAQtX7O52dKV3JUSS9w8UFRbFMupDCls1NniUfBRKrQ5m9pAtt6f Wjv/mft+8wcUue0v9386ePiVrWvXbO29Z+1WOojqHlwx+MeBPX/5F1SJtHffefe937zzNv4v rR1cxFZhVAWoSvQBaKHlqnmGebY5xWQ7M5szdDozQq2paA43V5xbsTSzLiOOjY5NTo5OTs4V L1XnReclF4vXqYvM66PXJfszvwt9HPs48bvKg6GDlQcyQ5lIDZs38+FWdqw5gZ1sXmJ+rvyl YtBULJ2JpEibBh9J6Qqlx4cBKu4DVLwEqFQxnt0nI1O25flyj8xmAFYZ2x2N+sLpspRj3qiU F5+V6Iaclg2ZrBIDxqaWo2AL3VIuIHoqya0k2vFiIEdR392B4TVemL7GC3NY48WxUxsvoNkM 2ypovEhPbIuhYZ0XpcaL/NGDp/dcOBP87cNbLijd0iOQntUVrHL41E7mjJIVg4QawYpnwyLh ELD211mMDzBrnxn7yLX37lt886e3XfLQSGvjipUvPrv8pi2Di7jXfjBz5gNDjz89eOL+C8cO nGCe2fPGOx+88/bvMWomDS5iDmDUmFQK/RJQs0Sh83RD7Cx6Cn2ryneGO+NT4usqN1RyhWAh 2Vl5fvD85Ozg7ORVwauS8yt7Kt/nPwh8wX+pfhUzR9DVaj7cTreqF9AT1EvoRfRH6h9in0W+ jH+RPEkbiNVCiZQi6HwoxWKoRPUWahhaqGGNDOXUP0UK0AYyDduYb/QYbCWk/isBLwak/o1S 6t+A1L8BqX8DHClIukfIFTQcFgfeORzG7IzllgeaUzeKtaNFK3tajfmUjga7vihkQf1Bcl+A 5L4QcQJtp1pYUXlqWt/N6vtS+l5C/2jH6fhw4IHYEMCDVXReUxIAD2U4PJDlNjWMdtP1w6rM jQ2PzXlt8Jsbf3fHb7qfGqh6aeVNGzetuPnpwUW0eNY0NBIJGwbv2vjg8fOYl/fs+fW/v//h vxO/5h6Kot/E6LAQ7Mpmn9UURCaLatgCex47m13ILmd5yRIlUdKClqRRjIgUUAaULNWvE5FY nQmiIF196t67/rP9z3PepQjuH7blcxx40PHDfFYn7c37cg3TAhPf+K6090Gz6+gyQvJLznG7 t2seZb61VgfurK5lqCu5gziV2JdUdjKjfb6k3490SnECtvn3PHXOos5LLzvn3HPPuixUydY+ 2T1p7LN1EzvnLxt4n5zDzqFDzBZ8DkexlRCNl8qbpVghTvJcbQD7et8S8G9jUjtsU6+ynPXJ NT652idX+eRMyYlcVWSrQ9VjpcnS+dli9dXVq6QHpbuzG4MvNv6K0aRoIhYdNaXxwyiXpOfQ tNmM5Ng8cZ40T56nzFPnaYvFxdJiebGyWF2s9dX21RlkzDo7YnT2EnmusqB2Qf3ymuXZnuyP 5J+pj9Q/1vjoqGfk59Wn656p7639TW2k3gvmqj2hxhOynlDvpOHcY4hQ4wlZT6ggkx2ByvZL xLqcKrOJTG2YVUZWJEjpsTreCG0q8c749Pjl8U3xvXHeiKfjN8Y/jbPp+ENxOv4ahlEYIxw6 GOwQOdwkjHAm2odopzOaJBpCkQJ0NhCiRoRGzqtYUkFXpMIC6zTUQqr8Cy8d/oUdJFhkUyOV dAIlsnE7GCs0k5c3Q3E65twSNRGHvbrjGfLKeIa8Kg4Zuji0GZDfjpMcy0lfWh6a7cUKpwG/ 37ZU+74G1EA+mrxNg8f70eApuQaH7BQLu72L3ltsSMB3qaprKMxv7m+mO5t7mulm0q6RpWJO dAjLJ+NcBmyViUC+IRF2kC+ZcdVjpJjJGmAoDfiPGBlX5x4nISSWgMnKLXE6gyi2VTSqP/WS h/Ez3T4KrA/9+ypgPyN/eNk0r1U3n+8m3RS+kPIwaQfLk32Ku6FPl2RhCKMAuSsxTUcdX9+u O6Oyhgs11lpmwAyaDF+tZZKUVC8kEXcGvqkM4YdVek2Sqq7RVHGEnET1dZLM59kklTYrSFTg 8EvDDQSjDfnVq1dTPt1NKhld5SeQE5xSCFUotbUVI50tXUcq8UQiXAH+X7jcDEz2CT51P9e6 2rqRdGthdNtpnAX4L6F5gjJs51bjvttWrWzN/ejNJ6aPG9Pw8OzbX7vE2qzetGjV4kikKXn3 648VF715+96P0Nmp65Zdff7ZNbFc8wWrp028tT6dn3TbNbFZ82a11aQqgnK2ZdyqeZes/95L WFtlh/5GN3BPUFF0A2SoMsMyQsqw8e6yLPhk3ifLhMW4luTG++0sFnriiEKqJiOGiphS3pCx 18gohllNVSPtO9w3l2qxGrtvKhoSxPHS+PnCUqFHWCewFA4fNgibhX5hn8ADvZrLs3YU1oFA WAygy9PJ1LiCy7x2HDBNAhPibJLSgBufOAGYsIteTMXQ6C0LT0n+YYfusFs+PUiM9WEyDEKM tdXSYr7lo6lJbmEiwLXEKISDvNmWliDscVi6LIHtlnnYiq+5uckNBHJRp0mMtHtYbbBrKszq 02biwo4rlzTefXfvtm3BfH3lk+vNc65+ir7qASQsGfzhAwM/mtqYIHbmLmxnDrC1+GvvcCro CdI4FY4W6EwwQkiLjtjxQKiQD6KsGIyoKBhRsJm28PmnWiLDsg4Rn08W8WUdIrlYlKQHEpB7 iELWIRqAVovS0EEUbHS0lG+IhtymC7dOHoWUVpTkGzRyyoeiqD+KotMSwOhAUg2JIwl6aWJD YnNiKMEmSmW2UgHPLc71kjp+yXGQECVlpH3SAYmVPMdBKjkObglfhsI9TIdBsR5yDRKUyaVp 8WGJXrcWfnpSwXEioHO6o93dZRGrmQRr6pqhkdlqsnMFw5usmqQ00XKKZw0Nq51BR+zKYfBb kK5ilAgPMOj0WqqdPsG6WqiZRcuU0Eznqg8ue3q6qfQp1g0zZz54Vt/P+iZdP731JvqRgd4f njlx5uyH7qXbT+zHKEiQPgqMApm+6rSJLB+xAvXdxAp0pJTK9zvjYrkTm7Bj+Luso5xIySKP +BJpQhYIMpvyfu4EoE7Y0cohqtpql4nV1qx2KRJIFURyQ2NT1YvvkXsvkxyvVFlVoOrxDcR5 UnWuQEXwDX60376jfmSByuAbQx1B1Uu1cjvVKk+iJspFVKTnihdLC9FCepG4SFpJ3YJuoW8V V0q3yGvRWnoNc59wr/gD6efU49LD8kvUU/Jr1A5hi/wW9Rt5P/WB/DX1mXyCOio34v+OHKMi cj1VK7fJ0ylbljg7EClwGMYFt+IkEcYInji7BO4G0HZQYO/IuQBeOEhd47MCz9IcpypktOTj PD43+GdPfk+eaipRS7TJgijmJDkkSTLF0HTOGbnnZJmSnfl5XpAlhkJck4rUatG2balHoqWd KLnN5no4msOSLWVoG1UrX/2WwPlwIj7QNdCViB0+2OVupFaqrFntw5ljyWChO9ZS/uOndiBs DnCt/WwOMKEebEHoF4NLfnkwl47lv35l8Aa2duDua268aAV9L6CSzLDuwKgMcF+/ipFVQiTJ 5vzS16CjubVGd/MZr8LElXop6BI+mWGlphKCTW/klS+PvEq+9i69PPJqlI8I+I4Qy0cQq+B9 vWGryPl63sw7z/oIS04OS9i6rzHU0hEBHxOKWD5CKB8h+wgmWE/GgVK174hDvgp4aaLeynjB VTX+n+nuoZ/42lRKskdmHSBxMxhHZ5CMd3Mu7/epGji2h3AATXq5M6rzi/4+3WkO6bebiGTZ 8Fi2GESpOB5CvIHRqqmw9ZdqIZqVWUt2yyqOHbbIBql7zA/3mO8Dr7Vb4wT0lf2niBFCDewI mZ5sXWo9aDFWxtlB3d0cmfUEixg2KV1VMFMVTlne3pHOFlhelYJ8UooHOJZieUVSdDFgUkEm JKTEpFKhZ6mc0CDm9QLVKowVz9LPZybytjBVnKKcZ0y0JgcuNWYFrhMWiNcEbuW/LywXX+F3 GdsDf+dPSPWKVU/Va3V6vVEXaAqNodoCt4hrxMeZx9Rn0XP0c8pGdRu1nd+l/wf7If+RdIg9 ZPw5cJQ/LqUUIOBT4dbknZFBxz2GLK+rVpKybrAByhIFMScYOZ2krnSB0ZCa03YOfWi3ETOm Ye3QAPkpDYWCvKxYtXLeuoidJc+zllirrB9YsiWzWFeQy+FcmFP5QJryR5scEi7zIPnruM74 X9IOMcATInCSLIuKqsqmZWEPYkovRwVwIHCBvVA29MyvLUHMCFYgkOeEEMcJOr7OOU0PaZou WoaRl8UQfjkhD3E1GUUjIcCKhqXqGny9APYByB5JRLUFDMLuKoeOmRoim4P0aAxG87O2nJku oxvlO8mENj3HlqZb6EbrTosQPc2xFZND86E8zGDl9+w2dCx4bCEEFfGpR7u6YjgowP+IEuyK fTdxiKsVLbj9/+ANEXSzg/ysdQd+p2xOzy4Na2sZNUO/OnQAB5QH8Prf10eNMjIBbwNrmN6e srkwu8wdIg7t2yKMQvB81ewpm1v8xCLi0IEtQsb5ZWD4BoWE4nDfdhxy4Q/ElmbfVmEU+Zit 1Bh6l/PxpU8svTzqf7k1dKBXzrAZivzebZQgb/r+9kA71RgAdtUtwfJEuVPpJisUSL+HRzv/ 7A8xD2AdglFgL2HqGDRlcPeu5zvZludfWd969vZNg327nx/xe2wufnrQepu+YeDxd/bQC0/s p1dtO7mXeLUG9mf+G1sOk847/oxW1sSmXqYVGUYj5XdQwgZSeJaWeJrX8FIwIAA3mvKwGmAD uOQOI4CM6rizm8KMePslxo/ZH4tP6D8x+rl+vl94x5AMO9KeYIJSWEuYrWissho9qIhNge+x c4W5ysX6Y+hx+XFlB71T/Q/lbf1dcz/zgfSe9gfzczkQKLOBBCwjppkeGwiRDGADkWWaP50N ZCHPMw4fCC8BI4hhmIQQxDA0s8QGYsq8QRuy+Sb1pkSbuRIfyJsa0nJ+ShDeBEoQeXoABS7Q 7lCrZeMKXrrDlrHLsMPmZ/A9sEXnebaeYe6gq6fjU3+BtQpSaF1HHS8COxHm5+bRw6exf4zM d7nLpOt206H/MIy1wPjxhnOL7wRgAelwodanxyragZhDqWhXq6PtDP4hj7dWtZtAnxZuR9VV 7ZKdKu1kMRcKc9A+A96IrcLpI84RvrjDqcIRaokSx6SNdMwwdchAdw8+8cenR6Yac72/H3wY 3f/x/rGDX9L1aPDbiaPObTkxqA78J5o89//y9uXxURXZ/nXq3t6321u6O93pdKf3dJJOupM0 gZA0WxISIKAQSCAsksQkgBGaLQkKiBDZBBEVkBkY0QEdxwUCBBxXMuIG6rjwHAF9n4eOM07U 33sM44z05VXd7gREf5+Zf36/LPfW7b5L1TnfOkvdqnP4Roo5Jz+F+YZgLh3/XhixI1wbnLE7 tA5u8OXnYEHDDoYk011X2erBb1WDBeXQ+UMvtH4y15A6OIO3GoK18iZYZ8gNGkbB2CwanVgh 1sd0GocipnSk4G0JBdMvpJvPpFs4uhOGOwUVaz2isYGG0j1uK/Eb6jTPypmYKkYw5PDnF3J0 I1HKdGkqs86n8Cl9qmJlsapIvVur8Ov8+qq0el29vt7YpmvTtxk7xctVndouQ5dxvWqTdotu i36jYZf8kOJ33Avak4a/yP9k+Jsqwf3DcM1m1+nNavVQMKs0vcJmZTVjNfdqGI1lqBHJQVnd ULSqqEaj5Ih2IbawxaDXe3RyAznQKIn68CjkBoVCrqeL/xViegNk42w4ZHvZhm19uPyohlAk ZujDU2OKcl1Mh+foXtZhXR+MPqaBLDTOKqdfCTSLOZT5ylolM1l5TQiSM/pISEMohMt7rY5V RJUQEiZoklmCfpqEwcxdvmThLjUuHkg3cwNCiSBv4HpXkN44TY32hVT4m5rn1EQGm6/L4BeS MVmvfUUFvJD0RRDBhmsXj0VL5FnREjURE0eNJdpUwNp66ofSBC4p/N9gowetz1tolpOYfKFF o5HLBWoKNnryHaMvOZs/KoSSStnrxCQg3uZqw4ic0iqT1itS8IteuxDMygz+Vy+/cJQ7f1Vd IX/7k5zfbV2gyWD9id3L1q5ajhf88Mazo+tvpb3ETyTzh6SXqOEboZfAT3MzxNR1uj78phTr IJyM+XI2JiMFKLMLMylfi1WTQgD7ZSGuBErk46ECV0jHy2q5WTAVT5U2yCZzC2E+ni9tl3XD Umm3bDOsl26U/QMuY6tF6oWANCgrkT4hPQcSKjWOc8ZCTJSXjIYGd+lKAA+XybFULvcAJvYH BprCGM8TBUnb5fNIJ6U+mkwwp4JqOe4DTS+xRkTiF/BMhJCEvlgQ3mhnqfarAalj6rnqNerv 1CIh8IObfqVeiuR3AzyLoBZ1oGuIQUI8b2TRcEudVHzStz7JSY5cghYuBYVVQ1yCDmGWcl+U lya+ENYVpnwxTt2fSu6SGlIkoDgaAK+UjkUnqSeltCRHrx2nVKSkTCbCW1wvRIWhdsPFwxoh 5Ehy99Vxa4lMmmYdSa3jw6YSYWBEnlaCDeQ/Pe26gKWzEI/IiSHfx+QfXUh9PZEwXilODlbR lyDJsCRiVzIsSXHEafTjx+Mz+FqmKfFqR2c7fL2DkYp3rEjM7pY9eu1aMhqI6DXsRWMJaCRo DPonIa01psb7Sr4twSU2eVUQQ8kJnIUCdKSksQiRq4T1jcJVVcJVW9H/pK763PmdEzvliF7l vPEqhNEa5hD+jegDIjJNqDY5BqbBW48iGcjWGfvw1sMMEDhuPaohxvA6JSkRX5kA+WnzLzoF PTeQaBwQluwNEEHZq5EZGboSK9JPG60vFOYNGegITfSG92prDixZ+tiB+JIDi+ZXjJs/f1zF fPal+GOPxeMHHltaMX9+BflHLHFWvxF9RWqmQZmoGMWSI3Sx4j26nWk70/fYP9V9mPZh+qd2 6cs5J3Kx1xfIDeQHCw4yhxRPqo4FXw9+HJQ3S/MLQk2hpSEcIubeEW9uYagP3xbLzMsx5OXl 5OYEswOivPyCMFOcX+CP0GNpKBAoIuccjUYdzlg5PdvmRFnbsnDWTpQXChXXOkDj6HCsdnxL 7MCdZnLCYamCozvEjKA779TQSXwbyoO0Y2wsWlTsLH6RHDqgmvRuG77tCJs+2kAfoLSMOtKV ChYzibsycYAYCULmLLJPZdolAlRIXHO5MZkNMpQYivFNdjQg0mIqL4GoKPOYzlh1aRl43J6R Xp1H7cUeuzfNK/eIvemeMteIHNBqDE6UCTYnmGSkZJGQUqmnPAf0Ks4JGQzZGBVmJ7KKzKkk kT+xUtcK03warTFjcShkjgWKiqJRaczpRGapjEOQzF8zmOpXcIpC/fQV6w3ZL2hIfFMWi5MZ Id26okLshh9FCTe5fN5kkPAkXEgRX3kJ2t86ze/u7+d3v/E2tL+0j//gqYOQc+AA5Pz6Sf4P vAlM29ZMWN0WTC+onL+/alqhe9zEfUtu9VfOfUj0wSn+od+f4nedPg2tp34PC07ddYB///ED /EcHD0LwwOMQOvDDn5mc3DvL6++V6iz5i/etecRr4w/Cm2OHuUtsRDjdiMPh0Cyg0LGToPDR 9EftvyZ4O6Q6kf8hQeOnBI0fRT4uVt8pdfTh3xxx9rhDdJ+fB3kv4LkoSByN22JcrRs07g73 ave3bta9UxqmIFOg4LbgtSAT3Il+jCkK2MN5H5D73XbEeR9bRMHkw01DYCpNgWnET8B0HUdC QC0hNVui8RKXuCQMvk6NRD3ZkBn4CVoi2UWZKOohm5+DTKE/nAnF3mGZ6Odw8/PezVoKHOIf Ox2OYW63lHSjMNG/N4MmksRNJBlr4F9gRm8aigBzcyyCf4mWqd32U5ufO990YsX65xwr7Mtq 4w9tvbPhvn8DKAnOfddDl96699T81Ysyqmsf3737F61Uhv4n3iz+O41XjQzotICPzEYFlGiL dNXaCh2r0Oo0aglidVpOwRr0LDZI+6DtsAyLKOvlKqVcxiKVmlNTwaGBEYe1T+tOwghkoECQ yvqw6LDoCQk9V42ewA4mn5nLMIzF+MkJyEOCEC69nLh8hejHK1euDCTn7gmrajlBbBBZYUoN ugupUWJahDQ6hZRTIr0MiTFm6LzriFZIPkUYQFggTIxIRph2aiN6Pc0JyrgYLfyZ/x7v4a9A 8xtnT/ev+kP3p3gzPtbZmahmQollePPV9/HTian4WKKacPYi+xSuFeJrLU/qFbj2Bg2qhW8M ruUlhdWwBn8GTAezGq1mmA7UAbgWJmNMbCWOwUwPsNCH5x7GNNDWrUeRhf3kYBLricsJIcqW EGNLmGNmPYzWwGCQLVJv5uL6v56nMbb4r+g8e3iL7SBmCoNyBS5poAjhdJEQiZ1NdqBLjdyX KDRxQEiCR+9E0cgQSrBsHN564AEEfMm104yLyAMG1aTy9iFUzmADcRgR0wd3xeQY6G3Bwp49 AU8TDlnIfcltzeWlEwdKUsGEqVsxtP6HPEMEEXJrduIvfjhSIlb+4zK1Fl8nmy5iLTKoW8gy j+mwuYgGJeCE9wUHhHn9yCEsKrk0OPHjr72qZEDy766nbxyc/RETXpajDMHeOsAmx7uTvZQq mS+FVDpC1eTJEevUbPzXe4VlY6ROXxBq9os2DdFQjYFBpcCUorfZT/4mDJ+jUEIIfPZjZhRF jF98xj71+ef0LgvwBTgvegfJUDyZ35TGmWTIv0SKgGVkqA8yj0iZr9g+fCCmkUikIJUVAXkE s0w+PRlmjbtSekVYU0A1ZhLpSZBTg+wEeUhmTCaJsQwDIIEkwEORdG4gOelHUlRcHI1ooaal q2xXaCG+gLOnOLoN7SMTWlo/C/ngPlI/G3pMqJ+VYZVmvMxMc/JcZVi5CNItZkaiMlt06Sfx PGSDzGNala9cDaQT9yE5nhczaMFqGy4JGF5GqoDahywZT7amIuSR6g7QF6GJy1QeJ7SpIFlJ T++oWWtjtOkoOaxYn5olaT2qUqXL0yldDsu1QnsuhamGpaQlToo7mrKtJL7ipNElIc6KxGm0 iAPl4LB6KsaOHmV8JGPbhke2jsjdf6sL7sEXSkrq3rcHgvlloTFcR9vyaVNrhsVHujupN4/f xhtI+4PoWaH9WpeU07u4iRpNmgh8+eSM35FmikjLA4TOygyLb056RzouT4d02v400n5LBmj2 6wMOnzTg/QxZAuk+CCBLziARBpJUSFwWyLCE0oFQg7boKp1zrBVe7qgARC5Oo1BwnEgUIG0/ npFusaSlZQwxlLsUFiyOCJ0Xn8xikHY9ppJE7Iqm3UwYYmekbFLnDoMjOKKyrmq60qiWpk2p KR0xrNy0LXDXyu3rKsfUT/3lji07mV9pStPsk6LhUgx3QGnQU5gz3NQ+dcHkaJ0+rXls46YO gpdrJ8EDh4DKBPOLCONvEeCviWb47nkRhDj65pOwkchTOMTr4BvwPJO6RmT919eIrP/cJ5p3 /RpA/7drvrj+HMSfhIrr10j/jWuk6O8npTdcw/0b13Do25Nc8hoOtaAGdiY7iWhBDfElMpEP hVAUlaNKVIumoznoduLsrUCr0Rux+a0LJ0+dOmvGylXDSu9c6s+Z2+SeUKWUjo2xSEp+bQ53 aY7bnVPKzLAV5hs4zmybVL18yZLbWipG391VHL6jXZd2Sx0WDy+rI79Zsxvs6Q1d7Q0N7V1M S5ZcnZ2X581qQaGLZ0pCZ947I6QWCYW4985wZ0hPI6UztHjjv3AehJJ77mzy/JtO/sn5hAIG V1ZRYSTsS+31qb0ptR/8XnLT8c37m7+/+dhz0/0Hn8d8mF9YmL+Tbv4eKYgUuGmJj4bJz28j BQURfAvdJtLpB3jd0LmJZ/ILw2HhZHiDfsfPotu/05N30hLzcJj6rAUR/lwkUvAZOYBHSKGO 3qybbODFcKgoUUVKD+XnF2JH6iReQgpf0cs+KcwvzCMFiiRhnTHRYRrUlrQC8LWvYnlSZaFa LLOxGiQGFSNWeVAMxQqHFaKY0VxIDW1ci67R1ThEvWk5KhWEsXRIN3MTE/1zZjdSwzaZ15yV CcvoWY1aPJiqViSsnfXRpbRROhcAhkdGPzx+bFZx5sQ0ee/wU5Oa9LvVk1zt7Cwq62/4KSAY 58+gdogwC4hHbEWZx1BAKQ4YuN8RUSdHZrJlUWjg/ACEBi7STkCf5NAWRosjDkYIQigR5hzR B0NkfO2j/BmygcheQ9a8eVmG5Ba+fr5pIawhG37N0uicOcOWClv67N+jVVBKni1HKjQqZpeI ZYH1KmhRLVdhFfayxSxmQaEUiaczwCj68LwjIBMhFDpzoT8RbuwnGjDUH2k8U9LYmOgnAI0W OYuATr50GRktM5ZfCw91tbZu/3LVnm74I29auAfEIOH/QWya90ibC5h6ZEf1sUyvsdiIOc4U kGiVuoBapSJCXoJApQTyy8jJY3t1BgOjpTRRI4ZsrQJNqPk+IPQaLU07Gbo4ECYfhMMc2Rfk N0KKH4Jg9umJcSkZ1FSEWV7+ve3pnRWhyPSyioqttfAxvymrtv7Ofbc1rO6YOBVG6to8gbFl U2IW6Oz8ZdH2jlUTKiLDCMXeJzUPEYqlEdBMimlM2oDIRuoLioANgZ3UNaaWiCTbJfslmNgB EsbyAqmvhtb6eb0Ghc7TdVW0yo3aCCmRWg9EQgPc+YEIYS6drkpXrJiSlXRoOScpg0FQL64s yNinm783b/XKmlum37qafxvKOmrK+GX3lU3Zdh9+VjLx44qysSuXVY2FRbCzLMIv6qkYtY7Q +hvCYz2htRQRCwUjEQqwUjEmNX2eRbRChInvDLxDFaBPp6dGOGYeMQ/wa7DnctYqGAWuzsn8 JX4bYviPSduDpO1G5CKytipmRHIpDqSlGQLubGnAZlMGsuXUn5x3JC/P4aUN55CDPocbbHho gNgeySZfpFstDTLAEL/KmWz0EHeKCqOGJPeSIGduONpyD0gXj5+15eCcKV2dt8x9vrPA5fe7 IqEsr+2h8kAoPzu2A8tD8Zd94dZ4bmBbvLy4cOSSna+2mKyhApvZbOU3rc5wlpZl2WkPOE/a 5CdtMhOztpo4PISVqkCGRR8gCMwU2CmTyPbJnpVhkBHwWykItYIlYkyB8MfMPE+bRXiZNAuK BhtD+ivhJikDYaSRNIY/v0+c4Y48kte5vKJmyqS7IZc/3TEpBpvXrFt7D3gl6WkZhJ9jOpdX juUf5BeWFcKOnp511PujOchM7EikJwisiuUs0EGDDhYooUEJTVKYRv5wM8ai+HYTmEzOjLhD AxqDXa5Kt6M+JrkUBkKNQrQrUtHG5A/QGJEGNXZl0VmNZVg/OHZGnFxcsvLIyhHlnUfiK46s KC3vPBx/cMf2Rx7Y8QA7sub+s/eue/f+mpr7311379n7a66WvXf6jffeffP0e8KsalLdWWyU SBfPcflbMhFg4k3QzD9ieR+T/TwoifUvgABCZyOkLk6XVpyylPGsw2N743s/ii5jqoobvc/m 3VtJ71hFfLQ/k7b70ROxlvEe6ErblIY3GaHTCM1aqNPCRjWsVMN4KVSxkOXz+zPim8QwQtwt xgExkT4KRfbbPtjje8p30scs9q314cm+uT482gd+3zAf9oEurtfXAoBenOXT6Xyc3XyS0MyH X3geKQXSEQzrSkoIqxspiM8kqaejH5I9ETy0HzUO/TidhJbRMqaoMA9TKVTGRFKElqgZiZP5 89U5mXV7ujruGWewljSU/c3YJxm3bP/85r3tUf+0dQ11y6q9Eny4uLO7KxquKivzuUflZ1zW N2yek583deX4qva66oC3NJytp7QZyTcxPKFNKbF4utePgPVRuLcYNoZhYwHMz4nn4LocqMyB tkBnAM9wQ7sR4jpo0sE0HVToYKMKNiqhhYEmtJSAzFES9zodjjyvVxQ3mzVleXFim8Tv1kCt hobJZDSh8jzIywuiUqfdkaHh8jnI4DI4fdBeSEB2RG+Xq1PkSnYPbWSAvr8nVCOUaxS6PiEa 2VNrmkqGxhvJNvgDdmYQlD5h4m0ZTlJSLIneUB4iq1iC/xprqfTUrD/aNu+xzgmKo+nbV8YW Ts7NrmmLpcc8hlErGord5VML4pv0vbrJyx6ePnN3x8imJnhYFZu9sqL5YNeY4Qt3zbY8eH/2 5DsrR7ZNCMplv7SUNI4rnjYi8757nHPun5NfNLfnlvhDubQnFvDd7Ag2QvCtRpUxq0qiYAHJ 3lqmXq/GLcQ1E7PtSqgiSkxK4H5YIZYR8PcCq8SENuVEg/aXR0gbQ2fCRH+e6ef6w2GhD7i0 STXq1LqAHfF6b+JO/NzO1/kNIt7Dd8P6XzNbr8bxHYkdAs9bWCnrIX7jfbGalZb7LNjPDeNw VA0b5dAqXynH4+VQLWuQtcuYCgmMY6ABwGoVxXU6hd1iNitsyGRSxhUI280mhdJoUipNRkZj O4lfQOlM9hGNXZrio2CkCnwMEzFHFK3gDglMFLTtdZ4ll8ohV5bbNzhZekgDQ7Bn+zHg+L9+ foy/bHwx7eE7Nj31zKanZz+1HZ9L9MF3s3j+k0/4s+++rd688d1H9hzeasD//Qyh9G1E5gVE rxI734V2xW4vdI113etivC7oyYLlWdDjgPEWcBtBZDQacZseejhYzsFSDWxRwXBVtQqPk8FU SZMENzFwKwPDALSEBERGWgk1PE5kitOEr1qd3U68D7PBrhaZ7VLVYIePDJwNU5EZDgtCUxDw PwWr0HI6ipiM6OcUxgldWVgLN8hSMHd/2Xv1n+9/wJ8j1g16/Etzb8Hpjaeh4q7du9etePop fPk1/sq77/Ofkjpugx7YcqKX+zP/Df9JoufNrVtfeHbbA8KMi3J+NXOZ8F2OymMZWyWwULJK gmskMyXYT4wOoteVTJyVSlkkoZyUE2HLUMxR3kVCXFKI0SoTRSVGjEuHqOJnLp/jX0s/IQbr Z4kIc5TZ802iit8MQfw2YOJxMaiOcMFKuJCGslAeOhRb0pQH08hfdnM2XuCHBj8scEODG+Zn QbMdFtig3QzrjbDUCBv0sEIP3dxmDnepNqlwp3yjHPcALCeGE1Ib4unpOM55t3ux1yvNd8TV 6px4phSkyjQFYk32QMCVYdeKXHbREEsGTCUQGpIjjUO2xM+wpRFYrYElTKGz9YvoGG7SCvTd wJYb1R0jBT3/fz44x1/etfr8V797+etz7zZv3Nzc0rO5afVTz9217vFDjGUG/58v8oBe3fyu iR3z5a/++Pm+/5g4Zu28pp71sxatTlgfX7fu0NPdq58myJ3KNwna2ozcaHussdhR4cDVdiix w8YMCKZBehrI0mCpAVoMUK+FmZRE96ihQg2FaqiWQ7sUZpI/dgGLbco42m4Gs1ns1RP0ZsXF Or3Fjhgm02jXqDPtskH1PgTZIfpEqH35M5QRJ2PHCeEnaYRor+DE6LSiG+kxt6hvUS8P+O0z EOC/vfrERfPTgbefeJ5/Z93e/d2rfnsIQnXtIP/oE0jjT/GdfJxfebRP/ScIgdT1wrYHTr37 4Jbn6PvCaQQ9WtErWEzjUpLjEUSEThe9Qkexr80SPilFiJUIZxiF47prX7JpwnGacBwm3/tF J8mxyTx4R6fo13ReifA9lRLZ5I5iZDEKbyjJ+Uh0kByn/4Ue30q+twj3s6LB6y3C+TZE5Xn7 tQuiRaIPyHMqUXds4uZx0DUO2sZCcwzqYtAyHKYH4HY/TPNDpR3GZkC1BQIcoBxHGguOSqis VI93eJ3OkV610xGxp6WNttq9zGg7K5MR45uYOino/pgzkf6B8E28cbq8Xp+aGbTFosQgEjQd sRoGVZ3WYLAzQGwINdGQNI8m0YaiRRc1Zql/1srdzZ0v3jO25N7/2HfiXLZ9ytaOOVtuG6F5 xVD/4PtbfvnR2mKRTGe9htxtq7eNn393lc075e4ZM3+zfkpW4zDvpHLfiEWPzmvY3lFrsYa4 xgdbo66aZbeYO55aMrzi/nM7+LdaH+6oHT0Sn1daLBaFpmRCQ37J7LGewuYdswkF51/7k6iD UNCOfGhfbNEGLzR5QOIxeXB7FtRZQGKBOjNUmsGrXa7doGU2qaBbCW1SaJdAEQM+BooxbLPD 3UR82GGWHcbbgZjpRi9ycA7scAQy02jyRo08U47lyO4gRLa67BrGahfJhkSDIKyJtBYEA9FU jUlJ9xPwUwp7vULoRGENj85odNoZOgsDnPQFjxqLOhyL955a8qvEs41znvl+9wNf7p/2w4uS 6u4nW/df9F9dyyzTf/xC069WjIf3VxxfFWt/E1wnHgf1q+1tr/FfP1255vWeipeOQ/XXV0as PEql9q8REs0i1LGhYTHnctkGGV4vheEsWB30lQCyaxQOlVZsT2PUGCkJYvqJxKZORfi6re7U ppBAIxpEjJFBOLB7QnO2z7vnyfm+V45JM+d2bZ+08o0HJjPVPSfi4ekPvHz71c9EJ89Fpo/y xHb+rffqU6naSJ8htSlE7bGx6wtgRQH4c4bl4GkuqHBBZTpUWOoseBwR4TJYIQM/O4zF1ogD eR1+RGuK8uw2pzNVX7+SQrxfqDGxC4iHcX4gzFGn78fg/vn6m4ba4br+PVsdrLtn+rJdDS7S JFv94vVVEzcuqc+Q+po7N0+8o+/e6lfI9zOW7ap3/UwzM8d1TB6zcII/2dwbTyAt30tQeovo JOFDcSxzswy6ZFDEgkbloEaAwo4cVtoqmVqqJJAe4kJSzwitAe1gn9PS0K+uVF/Vwuy8Odso F/yvHpM55nZtI1zYPll08urx+04uoc9vZRz/rPgoPD1G+PA/vcwMygcqB0/TiGooGDMpJMRN YhwO2XYZlrEyu0QqZ+w0TWCin2baCTUmLvRzF/oL8ok1RQnoLCIVGIG3XLqUWPrll6KTz/zw 2DPPsLPpfR8naJtLc4Ki9bHJP0jhSzkcl58j/UaOpBKpgy5hkEulV2QgkflkK2Q9suMykUym gywIAyNHxFnD4EByA7kBUkqwg5WJsUQCYswgSPKaUKSEI5VK9BNbsCfIoVd7aCJwWBwxkw4Y oYfBHuld/SB0P6cTKM+14ATRXP5yQvfaa/gzQAktvpxQik4mJuDexARC8LnX5opNBJdmFELn YlvXhaAuD4x5sCEXKnOn5+LKANT5wegHsR/q3ZDuBpkbqlzQmQntmVCSCZvt0G6HVivMMMO4 NDAZK424RQNtRJmysAGBPc2UYcrwWpHZZrMFnWavyaT3IifndDgZp7Mg6HVIQCPJlGCJ165k Mmx2q4VA1JyGMJExkcjFfi4RDl/sF9zolB8dTkrzu3r6+8E8wNF96iXhz/94hIzGguhxE+Cz xGqUgAvCUSZiui7tqWRnFz/04q/4RN/81pOAH205/uhdM0JLbwfTXxLfdTV//5fdo6rwhA1H 2xee6Jkw/t6+6OQlb4B671FwvLGgoHHDk28u6eUvNPGvQG4BZDxX88fN2y7smlS960+/WP2H h28VouL/ifmMWCdGFEALY9VRf6UfR7Mqs/Awe5UdDzNXmTFxqmeoW9V4hrRViq1WowcMhuS6 Wwh63MkgiHMUrMIodth0nCTNxogV1C6l6o78DQ41ULMzct1RcJJeQ42PpIaLhE2RoggMuXTJ pjOfHWILdrQ2P7Fi1KhlTzS/2MT28qOH3z4xxzt+UUVle6UrNLmtZ/LkKQ++07367PZJD3Re rcuf9+D8Ob/oGFm68OGGlt3NEarVN/KtMDIZqRS5YgYWe8T09YFDWMDOqCUiOrH34hla0/4E 7VkEo3SB38be3l6+VfTiP8eIN7yTih/0vdCfZsQKkp1IWAckl0kwkss9NI0ZyLGHhunELM3o IMEglYmJgY1AnhSOr9IENaFG0o2FzkE7C2fuJ32HdhPq/KW6SASY7y/wjt5eePEcX4KtiS+I EFkGV3gl7dkbr/03ltPckCg7ZpFJ9Z6YFpDWof1c+52W1eqRVGSTKRUEqwNh2qrFibNhOnQs pNuOmlJk10YIVQwBl86fZvaPsc1pDkl6Idc3zKUVMful0oK6FZWsMN40iZ/K9hKMuNEwND9W Ho1WRnG0oLIAD8utysX1ijYFbsEwDYPVZvC4s7N1bvfwQnemtFyKpaTn2DI1enHIzqkkHjsw Qq3oX7ngSArY6CfYSLwzpCc8rhtwkUaBkZS2QzX33IyTCNv25G1PrqoqW3aw9faHIqIDtF3u nMFm8VfK22qyg5MWxka1Vvvzats77qt98P21REFOmTJ54w+t3qhLK94vFeeTJv9XpPnh+TMf 7SiPLtjb0vRwc5jSW03IUC7KJRI6K8Yp5FKPiMUKHBSLpGIB6f1nqGg+00+c+KQDX0TfYUeM Llh7+NVXD7/0ErNnM0j57zfTaA38LcwXxHMLogmx3A1Z0K7p0uB6Deh0yBMI2HIVbrk8kzj0 Dhu2ZdvFCrnbZjDJVTaRhto31Kwv77/B8xnsU57BsTtTcpRkqHdpIzfoKuaL8KJnuut2dpQ/ p/9gVFu1ny3b3d62ZWpWryp3es2EBWMzey23Hewc57nlnkbrIWdNd/1DM2eOie9twMsSH8xY OzVQ0NgzDVsGRyEzCAbtxFqOxyZMKwABE/U+aHBCmxGatHC7EpYp1itwkwJWiHvEWJzXZd9k x/XEpIsjpI5vd4PbXZgXdxCfJmAXEys5064nDh8qT7kwQ8OURLzSQbYbjTigA2jFxZGbxi2j UeZmdCze1LKlsUSft7tp7t47Skd1/XbRsuN3jy5e8vyqWePL2ibm5ExqGznmjtpg3uRFopPb 2vesmBfOGz16xcGmlufXVtdsfXtN82vvXFgz95+vhuq6amqXTvQEJtxZUXXXzEJKBeJhZBBd 5SBW1OLY+IYIlETGR6gJ1WKCdj20qqFbtVmFF6rgPuLPovT49nzIz+eKb3fANAd4HeAgpPDG HRxwQTsNDeq0G0UCqK6TIEJb35j0c39EBGe0TBS9UYqmhhYl+lTbBwfMILNnbOukkuxMVf4j TfP2dpSO6X5u0bKjq2Kh9qdXzSoqa5sQ9I9vLhuz5NZQ3uSOrZVL59RWjHLmjxmz8mBz83P3 VNdsfG1l81sffrF6tqg8NC1JBf+EjqqqVYQK/+8smP+Pco54g6mI1kQbTBC8QfLDLmYXE61h RM/EZmvUernByLB6dph4FwEzKXhEYoNIPF4Ew0QgEYFIpG/Rg08/XY/1WCqTS0AOHiQxkDug LjmdOi3HPjnI5BZihGHGJjXq5XK9kbhxYglx3XtFbEpP9BOJkhxwIwoJLCHKa2JS9aTmHouI kUGcGq1gZTUKn0IjR0wOdb9WB3QUxOlinIwLInomj/ER61TCsIvP3MVzS0/BqbOT7lQbOKWY FSlUevUdUMGfZBcnlhJlXhTMTrcFc4u8/Kd0tGcXaX+QtN+AnCgPzYzlozzObRW5/Q4rID/n x1a/1a/IN+Z5kMKhwApkDN6ZC9tz9+fi3NwsZ1DZx2QfyQoq5IOOWeNi+q6pkViLOmFUuFEI MkiniaWGeZ10ZiYteYZGel3ko1TRyURHzhppjy0/2MqH4Y033zSFKhJ/HSicNc7nG10fuQy6 iS0jLdbRi6ZcQ3guN6y6Lm/6Xf/L3pfANXWli99z74UkhEAgYTXAZQeJEEBkcQFkjSJgAEFc AwkQCQkmQaR2sbii1drNtQva1tZpa7WrxbZTWzpabattx+7LOLbT1dp27DJV4vvOuTchqO30 zf/f92Z+D49JzvKdbz/f2W5CdQK7eM2m2PKpual+cVM0mtxI8YXjY9IKEhILU8k38ude/Jq9 BhwgjlpaUDY9BmVHoewwNE2GysVotghNE6E6BtXD3B4XFETFbYrrj9sXx6THISpOHsfFMXFx Caq4KB8ErkHFBUGKDlH54xPwaJWXdPgEnL+g5KPZvEtPENHwVp9shkQJse7xOyGbvSa84dp7 jWteXV9Wt/n4MsMOW2XoE2V/aeybCzvbFVUr7uaQtWGjcULd7e+vWffWLTM0DcumR5/M67ij 2XGfefz668CTsSX7wJJi8OS8gpgcX1TsjYpoxMbJ/Tl/2t8/JCieEnMwX/ukiH2CUiiw3BXu iRTRHDnYjM4eNs9WtBc2DNHOT52fOQsGzi26dX5KhuG25jPsYucXzo+dp50f3pnZdpfZsnV+ MtY25iQWOJFSMwoSxWIpyxZIUboUUVI5+BAjlSKZtySeQhwsL0UpEgnySqGxG/mkILcbnXH5 EFZlJqgWZkDYh5KHB/GLjb3QxVhgO7FmqId+jV3c7zzW77xHoM68ANQlsO+DSYxjEctKaa94 /CsVtIhOYVlvlILP6vd7uyKwQCwTL2DxMyiEBDgl88LQjXTE0OkBJoV5zXm43ykGvLw3HQBv igZv0q4OQ/FhaE0oSlCsVtBr5cgoQzUylONT7kNrWTSRRV0IRUUFR/jF+ftHx1MRXERBRH8E GxEcDzsQkZ9/ZEp09JgAFQyklEfGqGgqzfOA48zwImDEDjveO9rlTJxClBDtdiV8Ox/NHvjM +cWaj/obdDtObUKbZ91f6PzRuK0lM6dt84KB7c7dtO/2B2u2vbWy953b651Px706ZfGdC9p2 WnKNAy4Nsg3EfpqCQGm8hKa9ZGIm3kucQtOsjwhfcyAWx7D8wUCiPN5Qg/zlXjRZ3EYHZLIN B4YeGRigKw/QPkM/gK/kosM8dqQD7AwVXiBhwA1OgBsw5KoQ2wMRR8R/0w7pBgaIvpMvfk2f hlwglVTgm+ONAuPlcqUkThwInR4XS6RkEMK0kM/v37EfI7JaSMjKDhYWRfRpzdwVNXse/gOz J684VjKAFrXd1Jj8x4cVf40vqNPQP7vkXkXkvqogTyRFUh8GWIPAp6QoCH0+jA9+qtVHLJHE +zBKHwbWMj4c3mpj7VBenBftxSCin0ddQT5/MCB32LnIdgD/ejas/UPTAnNhC+k3yA6u8QqV C3sDBHsmJHJtD9hVZ5wtew8coMd95wymx2x2LoMg/jI93hkp+Dke715UckEAT91LxArDiiFM COMJqxTTJyMITMP0DfkP0Nns4gtpPB6vNMATRO0smLtViXqUqEGJtEqkDAyMZxklywSya6Rb pPQSKWqVollSVAKqkcn4eVHmtc4L9cDk6F/uT3eB+mhW7u/FipigeJoO8RbF418DoSWMEv+E 11iY/ZBYmP0yB/nrFrK+xV+Fhn9y94ZpnrsY6i7zy27YQZPbMxQM24YJ+ItUXml7vZ0Prnfu Zfci8A7lGDEtjQxBYWeY9RAkbr9gAK0Fj2/iolon0R8Kdq4ldrYUZNfBIBThCzMtQmL8VCdY XCxSimHjJ42XS5BEIqNd1r2BRu30MpqmRfhqu8B3hRgZxA6IqPxwyJg3j7y5xIKhu0bOT9wu 9gnrmfjej619dugJdt/T9DT2Eabxwm6wxm6mkay5v2ZPQnRRUInUwoL81QloNYfWqVBfMMoL nBZIT/dFeb5oqhhNEKNsESqmURaNvOKoMHkYF8aEhcGmKAo/DKDykUaqfuVhAH5WuuyJAFhd e6yr6e3Xvb6lpmbzG9etPHlbde3WN65puEGfRWc3r6ut29CSm9W8gV1Rt+PtlSve3l47e8eJ 7o1/2a67wE6y9htbdlknTrDucczdap0szE7RoHM/KoyaWpC4NGhtEH1VwLoA2juOUshhLaXw G+PrH0/5cX60n3+KVCrzCXNPUSOmAyKBItrFOIQbBbl+5Ceqwe4HLeMz2nc7nJ8NDFxYty6x vK3wJ3bxONjXTF9pyHPOoqfNa8+dlhJANH0P+xNoegys6z8p2L46E63KQH2pqC8JZYWXhNPZ YWVh9MSg6UH0dCXKVaJiBmUzqJQoPJriOHxWnaDxlUqN/qgeVM7C4t8rrhU2PA34QJv87V4m IWGCJi4qBIWsjkPd0KSKTimPbIikIzmVKlCa4uu71h+Z/Hv86Xn+aLo/yvNHyYBqrBhJxeDH YgBxGxGWg/wxN3kqYejD3Hn4Sn2e+/AF0pmMeeCAGfyd7bxM/DN6l5sbP6uKv92QOLyrUGRk 41sh/I3Ey6xfX5VhzMjSrp6Uv3GmywtqyqdXJpYvSzIyl7nC2nequLSAFSHFGi562CUiUv1X BebEWI5fwS9eAr8Igd1VQ8E4ZTD+5cI4OXlELw5/lZRTMSqVT0yoOJ4PtkFKZWiKSCThUqRk IpKQiYjMmPzyy+UmGTjq5QYKK+VUJpZEDUEBQcEhKJq//opmX/r4ZPzk/GnpuwZolaG/c9JD e5a1D81HE/s2Letz7kPZE8pSApxydjGn7W7o3RnMpm9HlbMMVeS7l9NgtIaBD02kDhY4luSi rhx0Vdq6NLpnbN9Yemk86otDKzhk5FAth1ZHoZ5wtDQMtchRnRytp5FMHBiXODGOosxqNEeN 1FSiPHFTIpOYmD45Ik6lEsdR6Vw6nT6RPLxIUTJGNiFGRUXII+iICHWMOoRRTcDL0BhViGsZ ytudf8ybfw7DfQmVy/vNmYDLb1BRgns1GuL5NAa+KOEXgYmpjHvpyuRL+pbnLChNVJVetWB+ fxfso3cblh9aUcw+wuY0Lpla0DYtaUzVjfaWm+emTOq8q9lw39JSlolqNgclT4yPzkiKUyg1 lV0N066enZFj3DjLN3/elMhwTVFyYp4mOSRoUlXz5GI77FEbluuEv2zPfEp2aBEFEhGKhzmW TfHG6wUarxfwbvPVoVfIsg0/UxHNfOpcdsB5HfMs89qFNOa1fozjJrBSJeCIohoLJswON4XT 9UGtQfR6HwRbNv5uYI0X6vJCq1i0hEVR8YKOo+VCRIqU4wk1VCUies68YjSFNQcLamP50xhW WHiwlZLoKYtuty7b3Z4TxjzlpYjPnzu1tWdKwEH0UZbd2jxdnaEzWRel0DcPdabUTi9MC09v vKaC3gRci2FsLASu/WGdObEeoVmwA5HKvFmG9qbZePzlEJphaJk/hWQIQidSUqgaDxy0AiEb QgaEEO3PUgwZJzS/YINd5WRyWUY2lsPH+WRF4lnMJWcQ+K9cZMLOjZ9p2YXO9D85J7+EssS+ PmIvWqz0R8Xs4vM3wuT1p6CY6GhlbHECk4c1HklR3hOB93g0oeCxRDmS+8l85b5+8TJfpcz3 FhmSyXz7fFGbL0r0Rb7SgRCUFILCQ5A0BN0mQfimgg4Jk0hDpJL4sBBlWIgkbAdZepRL0Vgp CoUFSNi0MBQWHgtix6J4IjyFWBXazqIkFqnCWVoFOgpXKcNVbPjtRCutWB8v0OgAjW6lUSuN ZtMom0ZJNKJbw7vD14QzE8JnhdPh8eF+MioMr1akNPJ17dUHedW5QzAokNchv2ZxX4vgzTos 5zz0iiE9VjOekDyay4yB8CMbIBeE6Fhvb3xnkKnAq50pDP4FD8EaCu+JzsN/cP4k92Ngiebn vPCE88RT9ytDvIFpfz+v0+8c8w0O8EGst0L+GLYR05aVG+CvTbvQD8uhTN3KhICJ+Xly+tzQ wqTZuqmBmiWFNPkWDfY6A1kPbinQBSnFlG+AREH5BsolCok/zvlIFFIkUnorxVLkhd8UYqU4 XqJQSiSKEFg2KmV+lC9FM6zUF0lh+eyrhCIVIpVKlApfsgoUI0oyrFf8tAq5WuIPPgYH5bAq HkREJWT5hH9uA7/han9/Es7x5IX1wisGLwIRa/jog3G5/pKxzvfeQCedTW9/qYyUiscin8PO BpQ2qVYpz3deTdfSEc4DqtRAWT5qGPrEU14/alJBpHe8F+vDIr94jtoHERcJ5/ygRobxI0GH IWfBgeTJlKEP5uHQKv8APwuKD/UFdsA4rMGZOODMfu9chCZAlpLwM+i80xmFTtGbnDelVMRG lOWgDkw9CqLbKaAeQM0siJOLWJZFf2aRDGjGS2VKWAYFBJD7SoUYFrUs7JbxnkdGy1Pw8eGZ jAz8EhQI0d213FwckImfMovOQrCcI18Q96NF0cypC1PohvCElMChTsY0tEWZFK+gv91N3xOZ nBrY3z9UGTwuSXnxIn8m5h1IJ8j6hG+Kv0RVU8EFPjQVHCwSFdIo5ClGzX/fOwvgyX6fwG/g vyOOEA+PKF9/milEyHcE/BqAavF6B+Bvgpw39e6uKh6aFRFodgR0zMVv6LX0t0gky0F1F1dT kkcBEMJwFvl+ejtgeJ8+y4iosxQ1FEuJHqGwZkgbPsJeS9q+cbWpXG3RgHU1/S20fQtt8bgt WSq0hUC/jfRZoDgJ6S6uJBQJUtIaA7vRFfQH0DqZtELPMa6eqdB2A+k5Bc0Tevq7edUCXgvp mY/m8D3dvI6FnteRngWoFtqkj9GIkpOupD3T3V6I6gXMQW7MqfTL9A1er/B06SbSqmBcrZnQ eh1phb5Ca4C7NQZa15JW0K/Q6uNuJU/LiNRgqy7eF9BmtIj3BW15QgL4gvYpOnrYWuTZEAK/ RPCFARd8Uoq/P8AnjYAnd5P49wVk1wi+9jS4H4FPSZHLAT7F/dsCGD4EuN3odZC3DV3NewPt KcsK0gq2AVlAw360oGEt/SFtIW2gfb6NdbWNdWsItA9tRPssw2uf/JsgpK3U+eGEilE/pE9o NV1PX0s/y3zDbvB6XeQnzpVYfHZLJb5P+CX4LfBM/i/Kfwg4FLhdkaTYrTwQZAtOCH49NDS0 J7x4zBxVnup8ZFHUQPS9MUWx3nFT488m/ilZmfz2cBobqabH5aVuSTuRHpD+cWbu+Pys+gkT sz/KeTBv68SHJ707+ft8Nn934dDUd4s+KEkqL9FeNz2wIv4XU4FHmvOb0v2eacZXlUNVa6te +/+Uzl2eqpP/hWR3p82/Of1tZstM52gaTaPp/2bShf4uKWM0jaZ/w1Sha9EtH02jaTSNptE0 mkbTaBpNo2k0jabR9FtSzXqP9P5o+rdKH4+m0fSfnGpjhDS/9mCdsi637u66C/9vadbMWVfV i+sPNdANSxqcs3Nnv9HY0Liw0dS4uLGn8frGvsabGrc17mzcM2fanHfmcnPvmPvxPPk88/yY +bfOPzB/aMH4BY8veG9h/sLn9SX6xfr79fuaNE13Nwc1NzZvaz5qyDOYDL2GJ4wyY7rxD8Z/ tBha9rZ2tp5ou77t7janae6i3EX7F33TnndJ0l2SFv0O6fr/w2lT+53tD7YPtL/U/lb739rP mVmzwhxjTjcXmBt+IXX+D6S1/+20xXyv+VHzC6NpNI2m0TSa/t0TRVF59LMU/n4h/pJlOHmC BucR5UNKDPnupR99u5BnqGL6WiHPesB4UaH080LeG+DfFfIiyuCGEVMa+gchL6HWeXkLeZkf 67XJ9UusSKa4Vcgjyku5U8jTlEh5SsgzVIzydSHPesB4Ub7Kc0LemxIFuX7dVUSlu2HEVKhi h5CXUCVBIiEvE9FBFfiXAVgGaPmqKkneC/Jy1XyS9yb1FpIXkfqrSF5M8utIXgKMRtKfCXle h3ye1yGf53XI51kPGF6HfJ7XIZ8XUU2q7UKe1yGf53XI52V+StUFkvfx4F+KeUuRk7yvR70f zqdwJC/HvKVoSF4B+cCUKSSv9IAPIjLy+WCP+jDSt5rkxxBaPM4ID5goj3wcgef1OZbkzSQ/ juSJPsUe/Is9aPl61Pu6ZNlDcVQGpaHSqWzI1VJtlBE+Z1BWygIvB9VDdZKaIijZII/f9VBv IhCp0FJImSFxlA7qWqG/g7KTkhE+jQC9BN4NBFIGqRxKTVBrpLqhpopgtwBdF50KwN4DuLsA Dwd4rYDTRDVDvhnyndBmc9Ph3NxrqEzIJbhL2ZSa8KAHDJ0AywFdPdDBOJqpdgF2GpTaoBa3 dgGPdrdMWA8mIof5F/lpIbrgqKlQboIWXKsnmhgpI4/HKkjKESpd0NpM5MWlFsDdDX1tpKYL oAxEcxzUu+yhBZ6wdkykn4XodiLpbyQQRqoDaGJNG8g7J3DkguVIvR1qsP463RYclgO3O4AL E/S0gxYKCSQvkUsKPeEJe4CBUMQ8txPpWv4l77kUMm8EVexDraAPM6HDUUkAbyISWN16S6Zm EV3Z3fJkA17sA8OYZgBn/7N+7kNeo77+n+Lrl/vBsJWKiSd0A6wF9IHt2ALJJMg0jujeCvyY CIVK0tIGNVibdmKbauJJNtJiImOoBt6HZcc6S6dyqRyw6OUejuXuAl46iZS8vC2EXwex32yi Y46Mxh6iU14HDrddXdC4zkq8C2sf82Qk/BkIXKdgfzUZ5xZCp5NwzfdtFrAYhbKe4O4kEnQA lIO04V5NhA+XPS+1jUPowXuK7bKaFrcMand52Dcu104nKRugTzOU1YKf4PHI01W76VwqAW+x bqKnZjJyrqSzbkFSExlTZjJ6XCP9Ut3jPmaSSwL45BG+emXsPA//qm49R4LLP23E913+5vL9 K0ngon45XxM9fABLwsviIPRcsdFGRk8P8R/8dyksJGLof1FS3vf0I7yKH/lW4Z2Xis/jGNQp RCLMrcuaLjwYEse7X/NRPmpbBMsMY3eNEJOgZRuJjSYyhh2CbfFaxTVLtJDRbCZSurQ80qvV xDJ6kjcIfnB5RLt0JCSRyI7lzKPSIBlJRMY02kncMhKr6qEOa6gVIFxtaQLOBZdEyWRh9A5H C7tbYy5u/jvz0G+M+5zqEhwVLhxchNubF0EdbyeX1xjJnGkW5oth7/61uczllb88n2HLVbtH jt1jZcDbm/cCo0CrlfiyRbC7mshsE+YZPvbgyKAn+uft7PJj3q86hQjOU8DzAD+vWNyeoqeG 5/NL49nvYAu3hvREdqsw57jih4HUdIFu+DEyvMbhyKxmFnwmycXjL9uWwvPYiBkdrJ3soSMD mWXMI+LM5TL+Cj4SfU2knwv6ytFNfUl0c+n+0t5Ya3w89ZTbxdfwamt41AzPRC4bqkm8txIq Le6y0cNDcNziLWQHbMMzLM91E+HFKMxUXW5besYS3oZpgsXtZJSY3Ty4xvVIX/rtWvWc4Xkp PWeakT49rIluoseOf9GOrtkArwYtgmaMHhwYyDumOayXRQDR7DF3OH4lHvOR30AkcM14eSOi uB4wWknEufL6ml//uWaZYf24ZrJhHXnGlJG97CRW8LZqEuS+8pyr/wWL2tzS24mXWgh2fhTx M6/njP6veoBrfiunSkhrFVUKpXqYLXWkRgt1eN2qg5ZZUCqG2mKoSQSIGqE9kViqnsxD5QBX R+Y4HocO3iuhPJvEuFKKI2Vcmg7wlYAL9y2hGgiNEsBWQyB1BPcMqK2AzxIBDvcogpo6KON8 GYmCPL1K6MXvFrTCnMhzWgv1nFvCkVxpCUUXZzOgpAP85UJrIeDWEnyYf0y/lOQr3XyWCpwW Eh1hzBhnEXBUQUq4tg4+qwGuhtAvJDLz3FYSGUqhnZelhHCAKacKsvJwWD+zhBZsI8xfBaRh qQqJDsoJN8P6K4LPauAc4y+D1loyQ1RBz2IiaQ3RXomgMyxtBSkNS8VbqohIg7WKdVAM+Rnw KnPrTkfeeV50HthG6q6etA9D8fIVCu9FRHNVpMRbo4iUaomtcKtasKWOyHEp1XriiSUEqpBI XOP2kFLivTz3Lu/kaVR5cMLTw7b15MXl1dyvjBEei6u9TrD05XrBWi8kOsF81bgp/xLm1D1c hiY9m6ttM3IzrBaro6fTyBVZbZ1Wm95hslpSuUKzmdOZWtscdk5ntBttS4yGVE4mKzc22Yzd XFWn0VKL+1Toe6xdDs5sbTU1c83Wzh4b7sNh9JpMLgF/ZKs5nd7c2caV6y3N1uZ2qJ1mbbNw 5V0GO6ZU22ayc2ZPPC1WGzfV1GQ2NevNnEARYKxAlLNbu2zNRvhocXTrbUauy2Iw2jgHlkNb y1WYmo0Wu3EiZzcaOWNHk9FgMBo4M1/LGYz2ZpupEwtIaBiMDr3JbE8ttJmAEFDQcw6b3mDs 0NvaOWvLL2vHVZnH99QZW7vMehuXNMPUbLNi1pJnGW12TCY7VaMhQDNq3ZiI4opt+m6TpZWr amkB7rhxnM7aZLJwlabmNqtZb1dz1XqHzdRs0nM1eiKjnUvPzclwU+DsXZ2dZhNI12K1OFK5 2dYurkPfw3WBnA6sUVzNOaxcs82odxjVnMFk7wQtqzm9xcB12kzQ2gwgRvjU27lOo63D5HAA uqYeok2XzhzQAKq3uTItmIIafxKdu9nptFkNXc0ONYd9BfqqcR8XARCsuw0k8+CsG4iaLM3m LgN2LBf3Vou5h0syJfO28wAHDL/GLW9qrE+b0Y71hs00TAB3d+OaSDSQZAIqDmMHtqnNBFQN 1m6L2ao3jNSenlcVuBiIYwVS8N7l6ARXNRixmBimzWjuHKlRGD6WHgEcGwQQgn7aTE0m4DlV JsOO1WI1m63EBQRVq7kmvR14tVrc7uwyQlKbw9GZl5ZmtKR2m9pNnUaDSZ9qtbWm4VIaQC4Q HD8ZzEvcwo4Zw2iuPFKvNMJeFyAqMMQbWM2LrCATVo1xidEMo4+oe+RYxqocMZplsmpsHDvx fpAbVGCEXq02PWjGoOZabDAywXua2/S2VpAZ6xh0BRaF7py1CUakBStFT6KJy89+uxSYIb3d boWRg/3DYG3u6gCL6PlBbzKDZpIwxhHScjVCOHkjmXBkMOJ4wNvhinBct8nRhqs93E0tuBvm 3tVsNoGf8rQxLhsfUIECGURYQjXXYTWYWvCnkSikswsEsreRAQuom7rw4LXjSsFLQMI0ENxu hAgNGLCtBS1dkVV+wANJftAImiZMdLdZO35FRjwMumwWYMZIEBisEHYJL4uMzQ6Xgw37MTi/ wUQGXh7v4vom6xKjx6wA8Q8PGcIPHmSdw54iNNnb9CBVk3HEyNV7CGrD5O0OcCYceGHw8gP9 1xSAx1t5CVdTVVpbX6gr4bQ1XLWuapa2uKSYSyysgXKimqvX1pZX1dVyAKErrKydzVWVcoWV s7np2spiNVfSUK0rqanhqnScdkZ1hbYE6rSVRRV1xdrKMm4q9KusgslHCyMRkNZWcZiggEpb UoORzSjRFZVDsXCqtkJbO1vNlWprKzHOUkBayFUX6mq1RXUVhTquuk5XXVVTAuSLAW2ltrJU B1RKZpRU1qYCVajjSmZBgaspL6yoIKQK64B7HeGvqKp6tk5bVl7LlVdVFJdA5dQS4KxwakUJ TwqEKqoo1M5Qc8WFMwrLSkivKsCiI2ACd/XlJaQK6BXC/6JabVUlFqOoqrJWB0U1SKmrdXet 19aUqLlCnbYGK6RUVwXosTqhRxVBAv0qS3gsWNXcCIsACC7X1ZQM81JcUlgBuGpwZ0/gVFjX WMkeCe9XLGQv0kT1IBnsOBZB+XOyW3K11wj7GwPZkxiY7cx+5hnmj/B6ihlgHhxxE/R73T6N nrWPnrWPnrX/75+18/elo+ft/5nn7bz1Rs/cR8/cR8/cR8/cL43mo+fuI8/dXdoZPXsfPXsf PXv/Nzt799jB6skc4SqfIjta44gdrnHEHpbsYtlINp2dzpaxk+E9F6D1EPnwOp2PV21oH9rJ UCR+4v2tjTwFhnEIz49T1MVEajN15X9I+EzCT3MbzJZWIR9s5/NT4BVTaOuwqLmiHptZzZXZ jO1qrkLvsBTa9E1q7vI2fDLHQxD8iNCAV8Qd8KnkyUXcpumNuMlbMnZ1+eofZUhE9/dG9ELV tTRC6VKNxNsrxY+hw70ojd7bJ8Ubsag3m0Zsf41mpkbtUaPaFblcRU0iqYoEWitRIp6Yp+Ck ifZAxirf2qQIlQeGtj7/BnrgxX3vPDZ3x+Y9/b2hNZpe9pCml9nTz9CIphWZwOLz/ZIXs5d8 /sMrhOHnNTI3t8gL+OombDJ1rLeCrqtJV2gCcEGs8KnX29tMllaH1ZIu1/jhSpFCpDMaOqwW Q3qkRoVrfBRBw0fpHjcN6dGaKNzOKEKH22tNHcZxNQ59RydXXVSoiQyRpU/Q5Gqy07OzcrLS G6GY41HUXL//d+HMV+OD26UKprCqKD1BE8eXImrb9PiQtbamhiupqcwrypyqGacpnVA4bnw6 /IvXxPLyqK4oTw1/eaDpRTGe+kVeFNOL/Cmo96F7EaJu/2jylIVVm6XL5//wzTqrsyhwR+HM x7fdkG6P8A1/M/Ovr+YOvEKtPMRUZP399pw9hxUTs470HjJOTDl7pPXIDdcdePnJe669+ULN vq8Xv7yi7s9PpvqdW7V8qnyb8TU1ternsrLqn7K874wOO3VnrUVbkfHVwMbB6Lzoiw7HNVNy 7zX+KWbNC4/1lIo2fqp9/OOAI+cfGJqZei76LknwPYarBwyftpxSv/XprmPBP0WfpWpOFk2/ ZeUL2/uL70t4aceia+RtFbOfOb/4oY+/PG6QL5478dSGZySr3ykpPnLshiO7T+ev345S81sO XZy6i3rsIfGOQ62DT1/YFXx6m7ObWXDzpOSZ757aML2/dqzelC/X0gyMort7kQQ04qWJAJVG +LHBrPJ0ZM/bF44sVAeEbQ3s2LnPsuHVOx4kHhQRy4ZqgpcrY8f/9I6utNPnTMH5JecfTdn3 Qtaj/ppaDBDFztBM12j7y/pLVhcJ9w3NNnNqh8tOqc3WjrTOdhOuTROue+xpbjNiKxIjgk+m AoimwVsMw9LLS4QQW6GZpil3lTX06kkCge7u7isRMNp+BbNDo8D8xrPYAwWUjPiS4chgL0ka X9u+z9/Z8d7T3I6jd4ekHJt+JF829tXHM9oP3nHu6EvO7dfIz2TlNL61Z/+CA98/dufYbU8e aNj76nvH2Xu37St/LFm8fchb/NgfPzh8btaC90+8X7v7OoUuL+nnBxMnzfui2Jhp9zlyseuT c2Wf+dVP2tC65LqbFu3N3rTEFJGrfejF5JNPzh4z51Trxrn3vvlweOO2kPlMOzv5mT5H0Fdh 8Y+ct2t1hz4yKlr6mR0XHr3/m2d3vbjhnVOD/qZ3V8wd/+msL85/XWU3LR8qfemqB5yJJ/VF vreEXz/PJ33yUdEHZ/oDp7zcRA8W7vuz8ejMig2nn7t9li226NyDx3vnVFV/uUEn3+XTMeWW t3ynfKPq0/R6Iwhin3sEscHP+3666vrqz8mPUlODnlqTQhC79ncJFUmaBH7QR3m2G4xcjamV XPaAYfF9dDqJZdmanPT0DA2k8XwsGy5qHL8Lf0I78wvt/zQarV13IO4F0Y3bl/cEXUhYeMG2 Vv3zubu3rN1c+uTdxxb0peVlpkbetPTnq/dE9aLHrzoW/jRztPTLF7f9eJ6N+G6Vz8UYy87v Wie/mBj6SVLU9+ythc1fnR4IuuGMYnvWhzmdtdaJXz1UItFoDz17o2ab77ElL/1ovy24+7X1 B289LF7FnYm8P+vbxc//xUFNX/f6+zd9+eZS54afH1q4dvIzT0XtbdryxxdX7t+0982HU96o PZ/17iuLb/5b5MWvFrcfu068xPEX+czyP39LHSmvuFuU9cls2dDVtx/5W+PpVd+/ud0/auPu j1eGHHrz6F0R6PBQ+X2KmzO3RJdn/PR83C7qkWdrjq6wJM+5/myOZfnfD36lkH7pikbLQSNX 8+EmHocb97xcIUbukcp4hKtjbzatPL4w94uLrc/Pff3IwQeefEGxVaPDzQEsxKJ7yjQl6TKN lJ9Z2BlV1br08ZoMXPRSpGRkajTpGSnNOZrxTVlG/bjxuU3jx43PyMwZl5M5IWOcASa/Fn1G Rtb4luYRIbDcYvik2uuN3j+EZGfHPN5x/9Eu+rZfDoFXjFDWTjuJguAu4MfgxeDA2H8X4Ldx muxxmhwSAvUeIbBOA2sVjxBY8k8JuKLgr5BwaHwx4wqELrK0hrpkODO9NKK8g6Peq3+++khs 1a6ZS98689PQK8+cfO7bf4yZdabmiKnM6+Tgsa/+emHbnNsWBOQkPedVovjL9p61T7c88N7B L+m62Ccnxy4t7Nj707dU463b1qleltx2YruqWLPn3uDDA2Vzvk8Zv/6uGxuyX6hUPRxzVP7K 273yPVnf7I05cmPc7uvXf5So+rglom9K6sV6ZsYhy4r+jC8fezStetY87/1BNxyJaH7S7nv6 zasS/MduLrkvY8WUzVPqtd2xfc798sPrPhEHzXwxpTF9Tu6izfffs7Z9c5L128G9XzxTEvJy U+X1j9eGl23cem/Hc5bEP/2UGHXkDLdHuv/bV6Xbb/3rojtMK3ZOeKuDc646efGFA1smSJyT lYe2Kvc8t/rls72HHqiLKwp9vHzV0tUn/vH6Hflh7yj7Pt1wV1vc2raJew4vr0z4VBxd0Tx0 +y1BMzIfn7Ww6q1pT+VsvJj6wf4F9xS1v7T0+P6D7TeuMK+x/eGLe8/f9UH4m7kXDC91TBF/ cvWK/Q89fffAsuObZ91zVcOxwLKm16PPXpg0mC79MW2K4d5s68Lq/CeLN1X1S9c/e23DD4db 1+jfu3Pr4JEbjlnLTj2XeuuZ/T/s03R8tUh7/+eblxx5RjzonPj9Xnu29yOzjof9+eD3tx5d o/pu+SJU9cSY6+2PvjEnJj+vIfSjtV+3DmrvS3s/fv3k+Se+Gl98U8TTN/ku6Z1ydvDtcTtZ emP5P85+QB9ndsEkIIJJ4Cw/Cfjog9vGk9ivunQBu4CEUx/JzQl9t3ynNqCwYAa8MT1MEzKi UuJ2VnDDFD5uxg3HTZ3VCsETXNfUYmrWO4xcYZejzWozOXpwcNdka8ZrMtMzsjI1uRDcM9JJ MVODi/97K+h/Ft/v2mne/9F75TePvbo9NezUM389/eK2mbHVD736QWhlnP/Xr933WsVDDg0X 8KXoZO1tQdpbx0y9ee/WuZqEd6n2z5Y981WfyP9HP3brN30vRx3LjFtzx3fnWlXqC8s+XRvx xaeVd+88FFtzdMPPJcclJ+Y/fGLfVHbXP3abb2l9K+n90pp9q098klSamvjg6qo6ne/HjPr8 ok2bNJY1f5+tuePna9/c8uhn0Vuu/el1xd/FT9Z06B4r2XRXOTWtrCUgMbnl/i0fv+F9/bRd /1h5X0CZUtJ718ozdUudaHtEtXgVJdeUnnnyw9jSg4Pj/qu4Mw+Hcm0DuBkzZMaWQY4l+854 Z0RUY08mWXMQJjGINLZsQ05jSNkluzBTtqLGngpDUoiyVcqRyBIRodLqG5R8nb7v6/zxXeev uZ73uZ7neZf7vn/38r7PWOXRtgbrooI6sod2RpylOoGrRTjKP73LrgDdkzC2Wn4Pbb4pBv9m 30sYd6QI4Fq3OFCAmfGzwZ7/1LtcMd8iXBAIQ/6iAG4Wtq9M4AOtHGECwjPWbHN4EhAeT+Ll LCUf0rGWTR+TRnxSGIbtTz0wmk/F5zv938WTzE28zE/dSym4vO+Y7SIrAukKmK9BAQswOETR p+hGaf+6X7ze7cdYccWUrwLBagMQjABDwGADEDT+jk+8ch36a7P+oj+88vcX6THNDswG6oOT VZeDBu4RLUxA5Uh/X3sCO6LkXkNoYi2yj+d8HMG51gZ811QMYZ45GKIzYnODZpslPCwCiiq9 ETwf2zW9E/RqpCERBm2NNxqZ2883aFaSPDoRf+QBqWk8ZZ5F5STz5BkFKQmfj28/jQZnIjne sY741AmY5iR4wvxSa6ma5w4rt1hwTjk7aPNnxIppj7AKot93oPYGojCKfvDWKR/M8kkYYugm zClh7lHtlpemsSda1BQPXqC/rAuD64X27fcTfwW03wh2dbAHbYHxcvY84c14s+uam22lssrE +5NRHRbWL3J8Uo6Wau7re0ukXxIIcZafPZ8tv40lSNC5DbOVIEqeg99RunFfv3Ls/XRY9fP8 Yn+1WtMWX0kemUD4Lss4XztDfd66ysoyk8OteXrLJKI4KZcPcHuhx3NQsDVXQrxLf1Jx8sai UYdSXz+atE9GwUjK0W7KerbwaWZO+w7v+nBZf5bNrwLF6dnkJlmrmvIjmGhqoFOVFxVRSL+0 Z47H+3MM+mjFlyGL1jjJNrf6HJFTPC5gjDLtQGLtqPhYdVk7virYCtqnizQvTSkrCC6ppKQF CD5OPoUIkFBBF2/yotjHSdMps5Ht4g9fbjVry3qFffYO5OodDQ9r9Wgd95oqSr+Hkl/mbLF3 6DcRovZ/UMnVRv7O79mGuPAZILOGAGSo8zcUcCb1rH2p/2MYEH76/2KK0QCwppDyv6KQ3yMC FAMbGmhATXMNGuqrTRSw0vzHIxYy+K/sAK+wA8xgB0PnSuY++HELIy/3e10ic5tsuz5fYyue pyek4DlpZ36plkVDEIK9fqKZfevgds/bPP3wOY2bmSxlrZoPQLwovd5oDqLLqT9SDkkdpeVi z026H+wZyt5fAVNqpj2+qHglhI32KO1A+yFB6KRb4Au0pQyPykTJJvP7lQZXcf23kMwBJe4L dwkLOxyo/IuG159puJR6uagFF1LwXMq9OmeXnj9l5XjgQCzAyk9wNFAQQQ0pmNmPzxXtuEVN rOXOh/g949lxFXuwf2ZG/0zE49CK0Cihx1rlcbgX0WaRgvNUlQOjSTuVr6jatlzV+oLurWTG lFfQkjX+6MkhKb0xtT4jribdrOnlcmL/9XNcl3+TjLy7eJ05Kv6d41yXJT0u5VRdo7i/tKOA XE2HrJyGdIbmXvX7x8uTrwhLFl10m3YSPTIsh81xPD0ijesVN9ayvFVtoy3FPNcdYq/yQPK5 D47LwjCocolpuK4UTHYcaOSrrBfq+914QpPKNSmJrROoNTi+e7Sp2S/kmd+E1BDdMLNl9qaw zUBE/LQJFigqSRiats+jfRoscxtpSg8PnXk4YzyBlS9CyBUWhR0mjcc4BztWqEQ+sjnnQA+S k3s9Q2iWS1RK1Nlu1jR80iD6Ftu+lr4CfRX/1HdeS8FitkoI3KHULC0z1cgnZae3PM01XUwr qzOkHM3oefbwdNw6O2cY7Jz8Cf6+w/Oncclv6wN4wRD2rTCm/av1I30m3X/n6l+gvDHi8VPe AUYl6V/jhZoOTxXdQXVLRm8D7NbgtpJANaOYUIyjsH8r6cPQW4bWMpR1PShxBFQd0ehVzB3c gDlLwBww3YA5vV/D3H+Z3x8Iz1s5eTFIeDoQngKEn1m/SUhmIDwC0P62HBjEr/q/wiwXb/wx xpV5EJz8iHifY0h3fwKgsz4BGNi2FS0mwrSPaWWbgJWEvONqqW6ttEtktI59LTq7rpfekWIi PwvEDs9HFWQ8syIKInv7/Q9LZMPTNg/jkzP10sJ6iOxJTa6OSCWtpWa/bkLElwbtF7D2nfQ9 Fy8seAzg6RJqBek418iksFhD89/72ZOP9wgaCy/s0ou17Cr77PlcixUpnz2OESroqxYJStEc mXRpM8AEh0guIMIKk/wj4hfvyoANFW7GcN/Ivwhlz55x/+COTKUoaCt42mLxomweXnYZaaMR i42JC4aKTz/t7KpXm/WSvjJGk53pGlzgpGXKpWeYcGLg85uiH4o2owVG5lqU79nnVmE1Ybdh N29fvjJW8XiA77TFblsNtK+s4InyRdmlp0o7xDwyKg5Eu3t5F131b9aBshSCFOS0yNoIEzd4 Y6XJm+HEE8LefGG7iwLHdBRcLzTjLJ2jmkXw6ulRQ08Wlub5qVmyw50F6V2vcHjd5/as505p sQSxdLOUB4jyNjg5Vc/9eVsI0jCke4dT7tVTV5Xp9LdUh7R+podUw/oDC+kFbMZG3Jkk0S4m +Zby7ALt3UFb1W73nD+fFxIi8cEoVbTk4x5J0pvcJbrnVeP0kZcBwYLTU9sziQLGyw8rJd0D xmkfPsW+hJOmPHbSPgEzkH0JQ0MBBPwZTHeOtakZnWQjQQ3ejBYPmdWFlWt/LO7IxzVRT2fb +FqbGu1u1GvLDrSHkYw8PxPzmuoJhCNtlscQHCHmnSgypAwgQ0rBIBAQnvpPg+vn6cDvpRFK +K0V4/NViNmYUewb6y6Ms/jegqM4gY29fIDk94EQFMO0xfwpqi7Fv+P9pWsuAVmqmp1KF5TG AJcNQ9hR1oAVRYH0s903vu2T4P31nZ6Vd4iIVBmS1H/UbCuij/dhPycfd6LYD2yGkEFMKhyj XXzmx0vKqbfeIC1YY5c5dIdi0wrtX790Zk8cl6xk48kHEWbpzMIqh9nvXhW5C+0OwbNbCFd7 +BUM11gHJ86cG9yiiW9qS6toWCbBde9nz9wFnZQM752THkj5o/GzOH0XL7Sv0yi9RuB1KE7t ks2I7cWYmbmRF/ebriUnbjEuajFI4DWPqRJBjgBJbUagROfHS5hOy48LrHx6KTLUOe2GEjnO NkdF5kt7E5j56iR0LSPuZ/kHIT1wWR4RqGre67ABJWFQQL/HkbCkSdaBIkyt8vEppWGcJRTN QWFRx1FyaWwywuDuyMGZTSUHTXpgxd1f4nl2wVW5x8+qz2/PraGSwXIM90Tq+zNiQZHBfIxD m1dFM+EfC8R/XmfbIJM4QGCjSMK/1wtBjMXXe6AortXEMQq1HaWpuloE+1Ei3bYhYnyf22lc rPqtGJ/XjtB5wlfxQ8i0Iit4oXEaXghT/FS0A3rvtWR0C01WzXdIfbHh7fagMX8V69BEoapH xS/v2AyxNwd4RxD0hzXkzhWWMgvK7mjV1Ya8sxxuzpKF51eCjEyNAiMi0wiNBnEp9SdO6ECV THDQlE5NE0hnXLTZ2cpC+8actI8PCtvkndXTkpT/PKsDNerBoiF7zD98LOttcT/9zI9ikCCD da+aet8XNWXzaD4tkwbJp0u/yfXp7pjsHMtWmY45I1oe34Wp/py25UhD+7EpqOsE5/vhht0W HHeO9bzjrGuLCKHdMuA7dN213jWmowrdW1ossjelr27gPmlAR9h0IjIx9MGsesxrrjkvLYej BNUaG1/GA/gXjjW5nQ0KZW5kc3RyZWFtDQplbmRvYmoNCjU0MTEgMCBvYmoNClsgMFsgNzUw XSAgM1sgMjc4XSAgMTFbIDMzMyAzMzNdICAxNFsgNTg0IDI3OCAzMzMgMjc4IDI3OCA1NTYg NTU2IDU1NiA1NTYgNTU2IDU1NiA1NTYgNTU2IDU1NiA1NTYgMjc4XSAgMzZbIDY2NyA2Njcg NzIyIDcyMiA2NjcgNjExIDc3OCA3MjIgMjc4XSAgNDdbIDU1NiA4MzMgNzIyIDc3OCA2Njdd ICA1M1sgNzIyIDY2NyA2MTEgNzIyIDY2N10gIDYwWyA2NjddICA2OFsgNTU2IDU1NiA1MDAg NTU2IDU1NiAyNzggNTU2IDU1NiAyMjIgMjIyIDUwMCAyMjIgODMzIDU1NiA1NTYgNTU2IDU1 NiAzMzMgNTAwIDI3OCA1NTYgNTAwIDcyMiA1MDAgNTAwIDUwMF0gIDEwNlsgNTU2XSAgMTEy WyA1NTZdICAxMzFbIDQwMF0gIDEzOFsgNzM3IDczNyAxMDAwXSAgMTc3WyA1NTZdIF0gDQpl bmRvYmoNCjU0MTIgMCBvYmoNClsgMjc4IDAgMCAwIDAgMCAwIDAgMzMzIDMzMyAwIDU4NCAy NzggMzMzIDI3OCAyNzggNTU2IDU1NiA1NTYgNTU2IDU1NiA1NTYgNTU2IDU1NiA1NTYgNTU2 IDI3OCAwIDAgMCAwIDAgMCA2NjcgNjY3IDcyMiA3MjIgNjY3IDYxMSA3NzggNzIyIDI3OCAw IDAgNTU2IDgzMyA3MjIgNzc4IDY2NyAwIDcyMiA2NjcgNjExIDcyMiA2NjcgMCAwIDY2NyAw IDAgMCAwIDAgMCAwIDU1NiA1NTYgNTAwIDU1NiA1NTYgMjc4IDU1NiA1NTYgMjIyIDIyMiA1 MDAgMjIyIDgzMyA1NTYgNTU2IDU1NiA1NTYgMzMzIDUwMCAyNzggNTU2IDUwMCA3MjIgNTAw IDUwMCA1MDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCA3MzcgMCAw IDAgMCA3MzcgMCA0MDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDU1NiAwIDAgMCAwIDAgMCAwIDAgNTU2XSANCmVuZG9iag0KNTQxMyAwIG9iag0KPDwvRmls dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAyMzQ+Pg0Kc3RyZWFtDQp4nF2QwWrDMAyG734KHbtD cZIy2CEEQkYhh3Zj2R7AsZXMsNhGcQ55+8lu6WACG370f+KXZNe/9s5GkO/k9YARJusM4eo3 0ggjztaJsgBjdbyr/OtFBSEZHvY14tK7yYu6BvnBzTXSDofW+BGfhHwjg2TdDIevbmA9bCH8 4IIuQiGaBgxOPOiiwlUtCDJjx95w38b9yMyf43MPCFXW5S2M9gbXoDSScjOKuuBqoD5zNQKd +devbtQ46W9FyV2ek7s4dU1SLydW1XPbZvbuSlPSso+IeiPidPkiOVYKZB0+jhZ8SFR6v6I0 cigNCmVuZHN0cmVhbQ0KZW5kb2JqDQo1NDE0IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNv ZGUvTGVuZ3RoIDcxNjgvTGVuZ3RoMSAxNDQ2MD4+DQpzdHJlYW0NCnic1XsJdBzHdWBVd8/0 4CQGNwGR7OEQlzDAAAPi5KEhcfCAKYEEKQI6luiZaWBamJke9TQIQHIUWpcZkFoxMeKNlMg6 YlmULEpDUopBPcWWaZNhNruy/dbeZ5uKvHboZ8UW9JgXydoVBXB/VXXPDEhQ6zi72ZcuVtev ql+//l3Vg0eEEUL58BJQ022DXl/z25d8COEwjN4ejMrxAzv9/wiTfwZjgeBBQ3rF++KLCOUl EbJ1jcbHot/9cAOBPwWcA2OR6VHXj+z/jFDh+wiJ94QVOfT+U+92AS3oo7YwDBQWZbcBrXXQ XxeOGlObzgvfgv5bCHE/jmhBOfDOyCcIVQzB2PmoPBXnJWEe4O2AL0UVQz76re97Eer4HPSb YnJUOf/suwcQukmCmhvXEsbVDSgE8x6CH9eV+G1/UwPz2XchxO9FRFYb93gtHlt7YMXGjxyV DkSe5098aZG0P3x3oR6hxYHsn4nN0M2l+OSBVmxeHEAo5yhCV7+X/bPUjPXM0JFfoLsRI8mh AuRFnbD0feEAoyGuxseQDTmEt4W3gZtSq0UhXsqFiRs9uwYlCfkvS5dfsNfjr6JmsRknD6Vm BYRox272HZvRzqxaNHtDcv8XH3EtOvGvpeH4h389jd/1Ef/4326v/x8P/+L18omuf7cyc2aU FSOeNLgCqh1lBiW6Lg5JX7hxLK25dqBpebz+Jb3DvwOz1z0P/T6LfqdHQCQb5kOm4ZD98trL Gy/vuhy6rF9+4epVhC67Mvsr/oGWXxWUrnjnOl0hf3tH+/oWX3OTt7HBU39zXW1NddU691qX tGb1qpsqK1aWl5WWFBcVOgtW5Ofl5mRnOUS7TeA5jDy97r4RKVk9khSq3du3N5C+W4YBOWNg JCnBUN9SnKQ0QtGkpZh+wBy9BtPPMP0pTFwgbUQbGzxSr1tK/tcetzSH79g9BPBjPe5hKTlP 4V0UFqppJw86LheskHrLwz1SEo9Ivcm+g+GZ3pEeoHcyJ7vb3a1kN3jQyewcAHMASva54ydx 32ZMAa6vt+skhxx5wFVyp7unN7nD3UNYSPJVvXIoObB7qLen0uUabvAkcXfQHUgi99bkinqK grrpNkl7d1Kk20gqEQcdkU563po5OleAAiP1uSF3SL5rKMnLw2QPZ31ym7snue2+S+UNnjn8 tb1DyazuOYz2Dp1BO68eOrnjUE/PMNmtsHvoixS9DNDL7rtUyc/0lqsS6c7MfFFKPrN7KHPW Rd7Dw0C0wdO/Z8gFXLt7j0pEjD1DVAIgisu9wCQZI2IygRV3LxkZuUdKZrm3usMz94yAsSpm kmjPtOtUxU7/mav/A+3slWb2DrldyVsq3cNyz00ni9HMnunTO/zSjqUzDZ6TBU6m6ZP5K0wg Ny8TUFJzFKLoBAKuLVVjwpF7B7hIUgpKwMmQO8lVdZCX0oFmgh2ABs8wBo2qoL+RmYIuYghb VYFbmvkIgSO4599fOiKbI/aqgo8QAYm7pFwO5i04WV+fvPlm4iliN5gWONtM+60NnoPJfne8 QEr2g8rQwBAsGu7ygspdLmLlI3N+FIBO8tDuIdaXUKDyFPJ764eT3AiZecuaKdlHZg5ZM6nl I25w59doKJckHdWpfysKSot6w11JXPoZ0wqbh/DplU4KtqqZgaFqeeZIZfXIzNFhME0fhOLM TJ9b6psZmZHnrh4KuKUC98zJ/v6ZeO+IJdLc1beOVCb9R4fDGJSabGHaSBZ1D/GV3DCDuEp+ uAH5c1FfH7BS6HT4t0tzXNup7T5oHqINfpk1X2fNi6w5zpoXWPOXrHmWNU+zZgdrtrNmG2u2 ssbPms2s2ciaTtbYWSOwhmcN9t8G7TtQL0L9KdT/DvU7UP8K6utQX4V6AurLUI9DfQHq01C/ AvUpqEehPgQ1CPUApfkqI32CNS+x5museZ41X2XNV1jTw5otrNnEmg7WiKyxsYZjDfL7of0J 1B9BvQD1b6Ceh3oO6jegvgb1NNRXoD4D9U+gTkMNbfcVZxVntR+bwwf9O8Rjz4rHviQee0w8 ponHIuKxUfGYIh67Szx2h3hsWDw2JK5zrHVIjtWOmxwVjnJHqaPYUegocOQ7ch3ZDofD7hAc nAMOomQR38/1D27F/cm3gqg/ICV/O+iew9m770ja3FtxsrAf9e/dWp7sqE9yh2k2m8NXT2L8 Hx+pJInsDML46iOPVZrt8DAqrb/+KV/S6x+YfhOtwe1IhHfLaXHNd0UyOgijx+joMTJ6jI6W 41MDyNcvHxlZhZYhnH7wZ84uwexVibgDQycdaOtw912sPc3lZIM8I5Wu4a2lBfHNVLgNrvIH Kt8QED6OciCec+GAyINKphq2NGwhU3CLJ1P55Owwp8of2OCqfAMfN6cKYNgJqvx/dqv4fZ8f 3HCmGUoQD3Ff4O4A6M9RAN5PQg1BfQK+UGa50wwHtUBNArQT/cp2AfmQTsdb0Ofh3YP+Jyju UTqyEQVgPgDY56DdDHNBaDGlMYuP0vYP0MNA+5+409xZ7iydvQXo7iQYrHCnbRdgnNB7CL2C 3oVvT4zuR1+CuTPoB2QVUJ6FW/PHuBbKEfxLPM8NwCgm+wOdccCeBX6/iX6C/hkX4814Br8J OIXcFygvbLdDgHMOyg8oFVJ24QjWsI7/CGhe4niuFahq3GHuGS7JneWHhc22C/ZCe7sYASoY 7nY8coKEhNqtaBB2DqB7U1RZ+T7m8G68F4fxl/EzwMM5PA/lQ66BuwW0Tsqf8iNCrvCebdz2 HJQL9n3iUw470LbBB2MFklAVWg9S9cIeu4HnELoH3UfL/VA+D7p8ED2NnkHPohfRSfQG+jbZ E11E76KPQTsroBC52nEn3g9lGIqOH8APgz6OZJTH8F/g0/gN4O/v8I+4NSA1KxGQnnH5EPck 9xr3d9x/4X7GXeJ+zf0Tj/gs/gAf4BP88/xL/Pf47wnbhWeEZ4V3hHds2Jakmiq0F9vvth+B clTMEsfFh8U/Fp8S/yq7EZWBXB6QayfaD1JNgySfh0v8DLXaSSivodehXEC/JnJAuWpKQkon 7sF9eB+UYXwH3ACiOIGnUhJ9FX8NH8evgSw/gvJjfBH/HP8Gf0DLx5ydK+XqU/INcIPcfm6c +zL3BPcX3NfBI09zb3I/5t4FGS9xH4GMOXwhX8Kv5nv5Pih7+Tv5Kf4h/gR/lr/Iz4PdcoVN wmZhn3A3yH5euCS8B5bkbLytytZq64IStsVsD9iO2L4CHj1vm7fnUq0U2ovsG+xftD9tP23/ iX1BLBFLxbVQGsVmcVCMiAfFl8RL4q8cL2dtyVKz9GwPegm+g75xTfS+Dt79He5uuxdV4Ivg DffyKwBLIrHH5YqRLJU7TbgTB3EtWOrv0cd8FuoXzqP9/J0oYgvwOeL76DhOCF/AX+f70Mvo efEgfpMf4ef5521V9g1Mn9yT/EvitDgi/go4/ZD/ki0sNuIttiP4OHcLRLSOd6Pf4o/Qf4Cd De5mdB79ETqMD8KBM+t4GedBrJ3j1uAjtuf4U8IzfK/tAVwHFqy0XeAfQa2oBOWiWrQWfN0G 35Dko5Ajv5XwhyD6eTgg3P4V4g+x8EP8l/BNdRXZrvJn8C8R8i7OF8yjWz6Ad3NTi9PlrHI5 XYd4tHCIQ4vIduGTjkPCBfKDy86rF8UPbfNAOQfoVyA32oC+6q8V7I6snMLi8gqXO4fLd5Zs 4DvLKtfzPpu0rqq6wV6PfA/m4s5w/hzXeqq+npvDj/g9iMtYJKyuLvEW4Nx1Ves32NuQVFlr rG5wFhhttjLD+/jqOW79qbY24QyWgNf5Tu/CwnxnwXwnrc7CMqisZZMwOE9HyzrpXFlnc1MZ xqVFUMuqqmtwW4uvRMQAlJbQN3zy0W5ZVVvr+mr3WnFpsxPvtB14v+STp/jof6rC2P3nV5zO nFrMb3JJC65GfsuKygV7UWEevzE3/8qKTtzek5e/atvGktKybbfk5jW0VOErQtm2xU+u/KMw PvDKd+a6P90qVGdz96/MX+jIaeIecFUsSNhZkF/JTddLn/5i+10bV+XmuDuri4rWttXl5NQQ vc8i5JgFG5bBCdGFtqG96C70nD+/Y3MrHt7X1tHF37q+fB9o9xuDiFu5arNteI5rP13pfXQH 3ED90q2P3tz9aHblYPahm9H+lavWt3btByXfWYPX+cq53fl3wl3SX+wrmsqf8q+bqnl8d5/Y P+Xf7ePbzmAXavDOl3WCSr3z8/Qf0zX9V9bpRbdQMxQs/Hae4IH+O017eL3NTVisqa6pqW5d DxonH9aiaC8pList44kJyrCd9EvKykpFu3stYLUT/dvaMfTAGKUtPqp/WILJOujDtHttlY+8 S4r55GP9xRPf/8307ffffZeAOb24aJtwz6qKmS9eua2jpPR2jheffPKl22Nfx5vCuPtJ/r/d H29Y/0ll89a6gdnh1l341l+qfv/Di7dUY6W5uYkfu71hY8udY3+2Oz44GHN4y0pztq/Pzln8 mPu20L6wzeVwSINZK5sPH/rC/u794+e3rLc337Xwts8hoPI18T0zO1v2ffr+41uba2vfHt/+ Gy88cME5AaabAKvlwanmRR0o7K+qQbUrwp628Jpwa3PFurBQWFAbbl0hHMpDtXlrawqMug6j 0jmH9/sLC33G2hoDlRpZa+sKK4Ws5xBRMKgaFM0K0TLVvxkJ4Pkw2Ane3u4Ejbt8pSXOYrvb hd3OFpcLlOdc73bTEVC2E1ToLGtxrge8kiKXE9Rr87We6Kqz8XWdnXVXDuAPPv4Y8lXtyvLm 2a66T39d1znrO36qmRvwBT49vLKcL20+JzxLUD9ZqOvC84s9K8ttQvNCsq6rq44baL6SOI7f 9Pn4lxaS5SuxD/LXiasXHU9A7qhF9agR8th61A6+vAk95W+orLvZ0yR4C1FufmVNfWOzr2V9 TlVZa1tH54aNdjvOae/aZJMeLKt6sLCwzEuyx2p7zipvE8Fra+/o7Mppbai7uX7Dxk12D5+T n8W/gW+Da7XPn1PzeH7jKo/R0JDfeobbh7K81JGJqj68RJ2Y5QewFpshKnaWpcfBhUsEZzFy r0WtBVWtbe3MlYlvtpMsUkxctQactKQUtxcVtfC4DNvKbFisKhJ5vqaIj+DRxb995+Li3+JR 385H5YfOtL41Xbcpa0VjtO9P/77zuaEHt3BFtb/d2FKOt9ctvof7HYs/xUPli6+2NO38sfcF IXz4TxaffmfxP+M2GH7qcEVuydhjTzc+L9mqaja+0XT4a/n4c67FN3HP4kVctWbxp3Zv5eIH dT9ffMOJb1r8Ayc2SP4/gWbtl2j+X4PueV0oLCkVxC3Z+CuQVirhnQeaInAeZ/NnoWK+wA65 JvsN3IlW4w2nbIUFW3IALscbUAlWgIiNvLkgScQQ9h9CIobKEgJRIvVPknHbW10luMTV6oLA Ri0+BNHvgm6bFdMn7O2fbl44gs9M4ZVnz+KVU3hu4cizZx959Nuzs7Nc38zs/U98ExcufvDN J+6fnQm/+vC3vvXwq3BHPIHf5BaEXGCk+K8R5trhiOMx5Qb+NTcVweF1ghsApIGFJJOexSCP stAGf7YD7pgPogcFGxxCO/159kMCiM4/zj0uZCHyge14TvDSw2XBCbFFIRJnzU1VTleR6Gx3 OUXbritncfCcjT8XFDZdORsA4JOFc+wGUW2WX+C//pcXruf/VOD+9PuUsX/j8oep8vq/v0Lt WIXPpn479iHrN3cMPtRmwhwSbe+ZMI8qbe+asJCBY0O5tv9lwnbktNtMWESH7KUm7EDF9i+b cLbtZdiNwTnIZ3/JhPPwd+3vkL8ICOQ7JtfxDIVF8hc3x8sUzgKskONNE8aoMKvWhDmUX3zU hHnUVjxlwkIGjg2VF79iwna0tvi8CYsYFb9nwg5UW2LB2TlDWZIJ56BQaYEJ5/GHSw0KZxM+ V35K4RzCZ0U2hXMzxgsIbyZcBHBhRQWFizNwKulaD4VXZYyvI2srNhLYUZoezzX3fVHyNTW1 SbvUoK4ltFFD6tb0uKbLhqrFGqUtkYi0Rx0LGwlpj5JQ9INKqHFvWJH2q7GxENSENKrFYHJS 0RUppCTUsZgSkgLTUr+uJqTtWiSqJCQ5FpK6w7IeAXirOqZEtElJjUnNnZ1NdA6A5kYpLzsv m5DOIKjp6pgakyORaYn8MTckfW4iqIZkaUdQiyU80hZd1yahJTQGDVlPSIYmBbVoPKJElZgh GUDNXGEoUwalLI3KURXoAYtkOgFkLb71RCMISTfySLqi6WNyTL2PdMgGuhJR5ATwwDj3SXIi Q2kpfXgoWSOsK5YkcV07qIYUSZZABVEtpmoTCWAgpayEYkjaqKQSmWCXuA56jhlAi1ICcWAN lUqLKYQe4MaBVw30QocnDEWXEtMJQ4kyVZNlClMBxR7T5XhYDQL6BFgQ+IcFo3JQSaR0DqqW oTIWRjVdGuj2SIRVQ9M90rgyHdBkPUSGgAJIqMvB8QCYxUNECkkhXT0IwyE1Ma4YBkGQ48C5 nEiwblyne3pA91MeSTGCjR6ivUkFnAva9LajaoRoLRIC+YCeFpygQsDGshph74A2pcDApBoL UdsHI2rc5I7IPimDHgIyYaRR2hGT5FBIJZ7syfBYNRaMTID6zY0nVSMsBTR4gVwMG1RFiKW1 C5ZSR0GFsSCIk5gIhin/usrMpGkRpvkwvBLEd2SykzQWISowmYyTkURQTSQ0IlxAIeoLaNEA TIeV4LhkSpahmKgGRslkSo3KY8B3igFFBlsz9ui2EQgXMBF4QzQAPBFihq5FtDFqfRNNiQVV PRgBz4uBenWZ4oEXRpQg2YZ4jBwlHkaEoWJR6+laQKb+HY/ADoAN0QHRBLEMqBQN4AmI+rDl WAOayvyY0QgBE6wLUo3qyr0TJEZHJ2J0W2KWDE9NOynoWyNzliVJjMtgNIioJTzHrd1MIxjL ZCmQVQPcUdCZTHMHIRwEfkYnImTzkMxYAXKTCsl6lPWQSlYQZkOqrpjckomEMR0hwvaB6x6U dVUxppms0bgcNIiFAhORiGIwQyigm3EzW2k6STPUtfcTzRAW08wBzOilksOYokUVQ1eDErMd 0cq9E8A4sYcWmR6j+RBS4BjbjTIHCbExrYE9ythERNa7pF2DXTTl3w4bEd21NjY1p9AaTLSM aAFjq9TNZPCwMZUIAowRt1Sisj4OssBMRnd0+bOEqJrYZB9kFYXma4MdDV4goNENgtpEDIQk Kk2T2Dsd16hfTIcNI97l9U5OTjZGrelGiFGvoU+A6uOKl1rZO2nx7k1TSUzE4xGiUILSKA1r E5BNpklCBKZU5h/09IDYNVgui0fkaaZKmr+AO/DJGDUrREdUNQx20hGhImpQiRFaMJEgGjGB UYkmTGgJVpodOBNCE0EDrAhHqkqSiqanNgBFTUIUhDM4m5RTaSuU5l6LwTlSq9ZJSjRATJJC J179GdxSdJqhwIGIV1kByDZgljJpbaAaqFVhFzhgiDF1cnxC8o1FNDm0VHuyleqllE21CQNy KJx2REyCE1Yi8aUahVtGbNpEJwZR6ZkZVgPEURpRDGlIR1EkowgaRAa0MRSCtw7vF5EEt8Am KG0A7UIqCsK4hhJQRwFXQt10dZy+ZRhRAYrBN7WEtgC9CLR7YGwMhWEuQXsKtApgH4R3CDD3 wpwCM/sBLwaYIbMl2KOUGls5SVcRzBClQajGKA0JBdA0vPthXqW422FdBGRSaI9JRHgNU7ki 5vhWSkOBvgbUJbqvhJpRJ5SmjHVspJlKlYeyabW4Xp5DjXIyRinKVA+EPwJHTY4/hyZAlyrV tIR2AEzoJJCHak6nWp40+xYfzDo63cuAeYmuioL2iUSEcozaxDB5W7qHAWNTdN7imUCEI9Xk j2nRWp0wub1W32T/RtOSaYkIn0R2IvkY5VhF96VmLAl0qm0F+glTD5k691HMxA087Xr/8GRw S1pC/VqbxCmVg1QLCqUvmV4QpVjEXycAk2nges8ifBrUoqOUW8tOTJY4fSdMzTO+0jwx67B9 0rbSKG2LP0Y3bupVM/0ljT1B7aZTTqahGtTSmV5t7aYs8YI07TEamXHAItwz6hNmDDL9sx2I LwSpNNf7uW7qjrWZWhilFpfQAEQXsYelVYOOk5FxWDMNvqWZOcXCYjwwG+p073HAYtHiSVkp RK1CoumgiR2iMT5O7WKkKMhUhxKVMGFazZqN0/WWnB7T76coRPCCILEn5XuTVJORVH85aUdp zFi+FqF+o5seGYKRIEiXtgSTWKZrMmGikymqcQ/dV6UWTcd9EHBU4H6p7iy7T1L+iEwBCjGN NNJsEqN4IaorKyd7bpBjCUR2mjC9f6nEk5RCmGYHzYSYvTJpy6a+GGfL+S6LKZVqLkgxg6Z1 EjRLhTP0r5uUrWjSqI4zfT5sQolU3pFTMhGPj6S8YKkm4ymcBM2MCRpzluUCpuU9prRReLPV JAaIf0rX2Gx5j4lSmspnaEqlPjBm6vt6DSj0LA1fo720tBHzdGFRxHJDlPIWyeDMoLmPnG5j GbG/lJpCLaECZpB6dIieU8x7dbrCosdyYYRqwpLGyjEytTeLAcsyaWulY4/wE6DjVv6OU89L pPIXOzvY2cTOZcU88SxqbHzCPOvD12WsAZhVl+TjTD5CpiYyZ3Uzkkl7L1BWUhxMUO1Y0lrR snxOXS6TMv/WUuuujUnrHJfNSAuZJ++N9By/TralkWD8jncpZlfNpDtq+pmcce+wOA6a+iG6 iKQkD2Xc9dInDbGVdddLaz1Eo37UPEWYZkPU45RrdGutIJ47bd7SiGX7zKx7kPKi0jw3vcSu xPtkSs2KoQDlN0JxMyNCMf1m/Jq7FdnBus2ks/b+lM9YWlxOcwnTgmn+rr85jNG7UZSO6dRr pCVxZ/kK8T/ZvFV4TIuTu8lYxv2Q3QLHlsiW1pxs3tCW84E9NMImaH7UURciN61B2lq3/NtN iSy/awVKTXA/u55awzXUlj9bWGSrGdlMNnPYGJ01TL8IZWRLhWZHneZbLbVm+dlR9C/5LrG8 2oqTfeZdRcm4Xxso86vBa3KgZUgQpPknZlrS8tLluNgLlovT/Gvli2kaHQbAXUDbCzFDSiO9 hS9d3Wieo166z4Tp9STLejNi2WveGzL17l2WF3LKxGm+tTzUokK4H6YysbsJiS12O2OaUpfk j/S3h26eU5n3sjj1huklXpm+f0nmzcJIZQLZvKUr9Eaumre29DedZakIlUihMcD4YisSKR9Z OjKaksGT6lu0ltMO+04I0ZPYMGORfaWqqZuKlrJ+pgTMoybNsyB8A51Npm6Tmbet0LK6J2vY 90gt4NfRCIrS20noBtStXP376TZNPX2HYhnIylXXnoCZEmTG1FK+NmT4AJGEycK+YKzI1JH1 9cluvjF6uss3lDR9Xi691VvWyYxTjd5A2T2UfdtZ1rTohOlJG/9MH2W/ZcRMy6SpWxGimlom /kP4DaQySiO6FaV/W1EyejL158xfW9j93sL4OczH6AqZniohRH6l4dkfAa92kP9jt+yDzbaW /FUwFImNmbCQYDD5f3nCHYnpKKn/G7P/h9gNCmVuZHN0cmVhbQ0KZW5kb2JqDQo1NDE1IDAg b2JqDQpbIDBbIDUwMF0gIDMxWyA4OTJdICAxMzFbIDQ1OF0gXSANCmVuZG9iag0KNTQxNiAw IG9iag0KWyAyNzhdIA0KZW5kb2JqDQo1NDE3IDAgb2JqDQpbIDI4MCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgNzQw IDAgNzgwIDAgNTIwIDQ4MCAwIDY4MCAyODAgMCAwIDQ0MCAwIDc0MCA4NDAgNTYwIDAgMCA1 MjAgNDIwXSANCmVuZG9iag0KNTQxOCAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xl bmd0aCAxMTQyNy9MZW5ndGgxIDIzMDYwPj4NCnN0cmVhbQ0KeJzsfAl4VEW28Km79B7S2TqB QHJDQ1iydRK2QITOThKWkASSoJF0ks6iSTqkQyAoiCiLATTOICrqE1dAdOgkiEEdwSeK4sao OPN0HB2NCwqCI6IC6f5P1b2dBRQc5/d7//d/3krde27VqbPVOaequvsLEADwwZsA0tyCuISm 4Q3rAEgxti6oqLc1PpUZNBRAvRnblle0NEvPvNh2BYDpehzw31WN1fXzegw+AFojvh+srmut umaq5QhAqBVAd6rGbqs8EFR/CGn9HeukGmzwm6L+AmkF4vuomvrmZQu2aUbhuwtA/LjOUWF7 eMeDEwAiLfg+qd62rFFVrPkG+6cgvtRgq7c/8d4mN0BUDcCwskaHs9mTBd0AGS/T/sYme+Ox 2SklqNA7AJpHgOrGlWytm1dmWeSb/B2EaoBej+SaV9JnZ+Mj4z1BvRt1gZofEVfP8OmFT43B jXrqrvAEeUy6wL4e71VEW7itMAY49s6BEcwwHYCvR76MBv8x9yyIqMdWMRHf18hPzh+qOH9O 4PRqjl0Ctq0bSHr23DlzQcLSpAL3AvhUfYq8IAHc/+Ffaa9KEYW7oq86uX9COPwvXeJXEM/k ugIW0acwDnbyf4XHWd9i2I7ybfbi8mtghzoRpuCYnapuKBOug+3ePhw3jr8Kgv8jWWZC8a8Z x90GOf8J39+v36/fr9+v/4sXp6T5QOApRIZhVUH/AsUxnMEXdvKCeGm6oyASxo6DqGiAOEt8 Ai5IkyZfgJI16G3+r9Xgt7kEKANqFSPaRYCRkAJpkAnZkAeFUAlNHg/2Sqw1A2bCLCiQWz2f XFguWtGVyzotedrUpCmTJyQmxFviYmOio8aPGzsmcvQo88gIKTxsxPDQYUNDgk1BgQH+fkbf IT4GvU6rUatEgecIRGeYM8skV2SZS4g0z5wZQ9/NNmywDWgoc0nYlDkYxyWVMTRpMKYVMasu wLTKmNY+TGKUkiE5JlrKMEuu19PNUjdZOK8Y4U3p5hLJdYLBsxksRLIXH3yJiMARUkZITbrk ImVShiuzpaYtoywd6XXodWnmNLsuJho6dHoE9Qi5Ms2NHSRzOmEAl5kxtYMDjQ9K5coxp2e4 ss3pVAQXPzrDVunKm1eckR4aEVESE+0iaRXmcheYU12+UQwF0hgblyrNpWZspFqqDmyQOqIP tG3sNkJ5WZSh0lxpu6rYxdtKKA+/KFeWOd2VtbwnJCa6mzxaWOzSpnUTKCzeBzmeVR3Zq9LT Syg3/7TidQPRQ/m2jJBaib62ta2TXNvmFQ/sjaD3khIkGhOdm18cgVKbMzZKVI38YqYBEiUh cSgkbaNqygrbzRm0pewayaU1p5pr2q4pw8ka1uaC/NaIzmE51n2ejyAnQ2orLDZHuGaEmkts 6cM7AqEtv7Ur2yplD+6Jie4w+smW7hjiqwAGn4GAva+PQQydQii119SESmTORhdxSRUSSlJs dnGjp9CbfQq0VUxBNLxKCFq0Fu1X1macSidCHG00S23fATqC+cTxwS02pUU12vgdUJC6S5/L Yb8XdkVFucaPp56iTsOpRcmms/eJMdEtrlxzo1Fy5aLJIK8YB5VMjUOTR0TQWd7QbYVyfHGt mlcsv0tQHtoJ1rioEhdXRnsOeHuC5tOeVd6evuFlZnTnPSyog1yayL4/X6MpIKNmqouYLtFt l/sxfDKkDkEc3ZZXHGlr2xAaWda2sQSnJhNDsa0t0yxltpW12bo9q8rNktHc1pGb29aYUeZV qdtTtiHUtW1jSQ1Bo7oSZWu4AtKK+VCuRIa4UB6h3AJz7ryFxVOUSXMJo/Evu9KcUVmLLrSq /BqcL/yzbaTeFtFmdGWfiaB43GjjEfMrxEUCXBBodJFkJjaenQJcBCc+28UHT8HOmBQjWLgy sGLNw4qWggNYj2D9COsprmyPJlwikJLGDUOb3Mblwv1Yd2Pl8W0Wvs3C1aWdi8Eay6BIrPSs swqhVQwyImRkkC+XDOFY47Dy+JaEb0kMYyJIWC1YeWyzIIYF249wcez0FIcYcYgR18lr4VkE 6VAk9iSvefMuYkmZy6WiDqmMaypsw/oRVh7pye157E3FDUVqn+H9DFYODuH9XQZtx/tTDFqH 9zsZVI33pQwqYuOu4UJgOVYOarnhsAwrB35cKKRgxTUY75tYbxYXhth2vH+PlYP5XJjVQmYQ 8ibxEG4RuY1wEpmLyzI5RbgZQN4ED3CL4DbgJJhLV+pTwB1IMXEGpLIN7y6sHOqjx9nQI3QA 70cY9BGnRZw8TrAOIVoIgaGcxhhiHMrd103MnZrw+/YRs+eQNUxjuv5lLvz6l0XO9G13QPi3 3e0BJsjMRAf399NYnyFnEdKSpzqdUnhKAOki+XhYDSedUCJOwGcHGiIErGAij0M1MUIEQg93 Va8ymnDt6HQGhneTEvmxoNM5Gh+Fnc6o8BQdmacQyoZqfiyuxSaS3lV9d4Dpz2QIEvoUpmKL T1e1JxwJ6a266vV+plPO/eEnS7q5rZ3hJ6q7uXirPs10xGkKf9M5NvyNp0m+6XZuq9Vgeo3i 7sO2pyhSV5rpkepu4eOuzaa78Xlt11rTHdXdqrlW7X7T5urb/U23VXfzY7vKTKudSPmp8Gsp SxuOLOjKMpVVdxN7V5SpuPoZzVGiR5H2ddb5h6cMxVApYuLvhiLBF9Ziz5+giL8SHAjthCJS BrEIbUdoJkQh9GhX0b8kVKWosy40/FkyB+rY8LSuoldDsdnPqsX203UB4V8XdZPZneHHi/bp RiJgOlZEe31GmT6nmK8XbQ5/rKibM1uNWaZH66Twe+pKwrfWrQ2/FRttXXNN6+uYfdbVdQsf oMrXFXULvqjyMuzeavUJz+QySSY3P0Qbom3vJiHWPHX7v9TtL6rbH1e3L1W3l6vbF6nbF6jb 56tHaUZqJE2YZrhmmCZEY9IEavw1Rs0QjUGj02g0Ko2g4TSgAWsI8Q2bEbY/7GQY2oFE70N/ IcQVwOdyuQWpJNd1oAJyyyXXmQJzN9HNW+gSzanE5Z8LuYWpIa4pUbndGsh3TY7KdWnzrizu IORWzMfr2XLcTYbS9zWhdCXeh1TD12wKpU/Pmk0lJcQJTqfTFHXxFdIHkdy81mfRyuWgxnvS XnX4N+rwSjXtyi3AnnbW00572r9Rt8s9ISNcW3ILil2PjShxJVDAM6IkF32wQLqqeB85T85m pO8j5+ijpHif5jNyHpd3bNd8hruGXLQywwM7OYd44KQPxDPdDnaKB3bT7QPxSD62p3fY7QoW yWfU8hUsgcjUSpALUqumD8QbKUEJo1YyUmJ44gSK19HkRFpOJ8OJWQlNDKcpZiXiQK7LynCK ihCnrojhkONQxHCKyHFKZyBK60+jKILLOEUyTmCuFycwF3FII5rr24LizsyIzIwN6TiG/5y+ 2dhbp9OemVFjxv3hpdGqS34J2tPQhCZUMOEnnMHrCT/f1XfZU7sqnlvTQvdjZeYMO9Yy14aW mhBcRyWpY81zykYtsqy8ooY+bXbXc2Z7umuNOV3qqGj5ie4W2l1hTu+AlozC4o4Wqz29s8Ja kWG2pZd0NTYvXDGI1y19vBY2/wSxZkpsIeXVuOInulfQ7kbKawXltYLyarQ2Ml4ko5bGYl5x hwZSS9Kukp9dnF6HkVUWGlGSajI2TmdhNi0iZGXo0wKQHaDHrZEB99o+WGlXTEpMCu0SgHUN odtwpStk5bSI0KfJDqXLiM1+GOeK1cF5NRa8mpvxr3mJfHM2sxZ2sTeGRBvphZHjbMbFLaOm m8vIqHFZN+BOFHfaKtqQqTSMNKcvwTwAIPbAcHE/jKZVsMJwAM/7WHvo093k6aH99MkPY7jA feA5Kf4FArD/a+40+A88t3l+5sJRsZc+Usp4BKkR/59F2kni4CzREz88EMdBPDhhLxyAb6CX HIPtJJ6YoBSX0aHwRyw9xNfzd+yfDhvgdhJMQjyrPZs822APUvDFNfMU/7lnF9J8yPM8GEgI JMIEbN1BVMTPs9DzOuTDYlgPxwjnuQZ3AiL4wUu4EzBANGxEnKEkTKjyPIQZcDLQz1zr4AF4 hKhJEp6GZ8Cd8DnZy5UKrZ7nPSc9vaCD8Ug9G7aCC84TIFPJYm4oH88/4ClBCXxRkxl4Up4D NmiHLfBf8BB0Uc0ITwIRt4gbzi3mzwl+4g+4aGjx1B2KXKbixsEOjXAd6rcR7sNRD+K4R+EQ HIaj8C70wBk4D27iR8JJMplJsskC0kIe5xK4Em4z9yh/Pf+sutJzD/Ifg9JNhRw8uzuwNMJm pLQDnof34VP4kUwik0kKyScFZD1pJ0+RF8lb5FNynqvi7uQe4V7kSwSVOKL3mPt7z3jPF54f 0MPVaKXh7LPzCahVLlyJclahhZpgKZblcBPcjDLfihI/AA/Dn2A3dKK2h+BleBv+B75F+3BY RCwalN6P+BMTlkSUYwpqkoKSXElKSTlZTFrJOrKJ7MC9+AfkM/IFOYtyjeNmctdieZ47xH3C C3wYb8Yyk7+Lv4ffye/mvxJChBghQUgUbhNvUVlVm1QvqE6qe8+vdbe6X/P4edagBrhZgTAI xzIWJkEW7h3nQyXqUA21cC16XTNafRXqsRHuwPl6CH2qG57F8t9wBK32PnwAH8E/4XP4Ar7G LedZOMd0GE4iSCxJxd3bQjy7VZIVKP0dZAvpIF9xOi4cyyhuDJfBVXPtnIt7D8tn3Glei2Uk n8oX8xX8cv5W1OMBvot/ke9BTYJRjzxhnpAvVAnLhHXCBsElHBU+EEGcI+aJ+eJN4gvi++J5 lVaVrrpJ1a42qA/ifsSs/YrJ43dBdH3MPYe+s528Q9pR8zvRD16Au8hwLgWmwEzBLY4gJ/nl sBKuhpH867h2JJOHyc2IM194l0SitxVhZCWRqbCSfIOYbliDnheOPt8Ir0ANfIaenwL55Aec rVDo4hIwzon4BLxC9qrvIYvx3OCHHrKFSTIHbZuIkbUHdsIWInnqhbvRX17yqOCwEECWkWTN LM9RVTfs5I56P4Wjh0qRftHDo//ldYhCN4nuBJX6GRJNjxDk2JM8DzqV2E2i9vI8l6NVI0bU HgLZmm7czENI1Bzj6eTZ3yXPMZ5Jnm38LhlmJBt7k79LRjDeEuEX4TcabwSd47zEHzhvFeEc SMIB+vmf09NDDmNmxFMXpDxJRfiH0M1FWv10evWR/T5v+nA+N/GEewP4bqLpMpYuCYlCHr3J xtOlJ2BG79cz0or3nPTx+HCktCTeEoBsghNMQYEq88jIiRMmbSaB7uNtWXZ7VlZlpdhz7vWl lVmZ9kp8o7zD+ePci4y3Gq7oIKje0L0qFQf8TdDN6TvJTVw3Z+hU3yTQN/EmVTen69JU3Ucl ON17GmuPrGe8hZj5CFq5TfdOJnp3DL3zx8kPbg35gXKKR/s+jWuEGrPZYWt6pjZbxwk6NKpW xFBVqYig0/CiFre3WlDp+Js1QCSi4Xk7RwI5nB6NSmVXQ6BaDRoCnE5bJ6CwRusQtVqlwgnR 4FwRnnua1GF/nTVQ1IKaaNTW4LCkN9VEna2/qi0kaijOUWnU1aVXpxV3YivaK2R274mkJP+k JKoGLafRsDOSk9aJsVHrVhxcFxtCH1F+SX7+SeuMyQfVycnrjAfVxmT8o0qXYkxG8FgIal6D zj7J/YGzd8cy9wfcoYNknbj/bAqJc/9FSHKrcRVY5HlfPIXWHgaZ1tGjODLKIA3niA+vGwIq vjWE17X6aSXEyxmucgZmh65pYV41+8Qc42elMGP2iRknCMoBWJMob1yt1JHmkRAUGEYSEyZN DlYJZgn8JviPSkwQxFMHXz77tvvDVV/etvxw63MPuf/xtHunO/cQcb67l8wTnn3mbfdHb/+x Z/WVy166/zo8Whb+nSw4spV+/rwTPfA1nCk9FFijdVqVKPgQUahTq/NURKXSc3wdToBWU6fT a0iOD6+x6/WQbahoUUIAvQHlRXvOppbsTfZPiiulLoKiByfJ/uktO3lz77ecD63nPxD3u792 n3F/617hPoFSPI5SrEUptDDPGiWq9ANE0HpF8CWE5Ojj9ASF0GohWzdQiFLZakyOATIkDZLh ce499zTyonua+yvkf9L9nfvbXrpebwcQDjMb5FjH8lydRqsVCKdTawS1XaW6Hz02xyfOhxAd Kt+O+Kj/c4x1qZf3GRlCO6A7xSXTEBmo+nZM58dJqPtTd6C7R9zfe5SLOpvCrem9js4A/Z7+ MeTOwzhrMHC8RhJniLio2Xmeuke28NEgZqikTHwzMbm/pD6HSDvQfsVIQ4QM63ikwWHAaNr5 bTxXxjfyq3iez1EjRVFsh23AraJkVRVtMtlS7yyWlirz6BV+Bwkhd/XmifvPzXJ/h2OmAKjO IRcDHLfqXtVhzL6q5gWp21NjXYUTJBGdVnubHMECBmqxKASKosCrNZrbOB5bMafq9cUGCDQY QKfmcL3lCU6tQa/X0lSgEjWgNxCtjtdwuE84I6nPcGesujOSGGeYa7jfsN/woUH0NYQbZhgW GYRFht2GNw0nDYIh2+cqRZXFTTTWDTTWhw2d3TsspLd32FA55P3kwA9RIh+LDAVfEP2DH7in xtiL0JKIgAiemDHucYvjTwpJCRnyg/tf/+U+9L371QfcJ9FEboE7m8I/cH4RrUpkienMp5dY Z47jItW7uIfVgkTiVBy9WcgM1TayG3MhNZVsNU6NqR+P/AQTHE+nS2AOr/Y6/HODHP4MA2iy kv3OqwnNFouhNCCC0EnE205i4JaSEPT2NvcX4v7zU/iXUdQXz0/DTF3meR8nqgfndCj6X5BP K/CBrSptsJPPCTU6tdnDBuSlM7NxCcK8hAww8xghQs4/ATQpBZsSE2DiBOAX4cbreXeG+6D7 SXfOa8T+6mvuL3evdx1C/p+JPe5k9zPu59yp5DCZ9jYpfxOzQM/7p291EOntt3Bh5Vgs+jEf C0ZfDtetHzLEELwenUTj7xRzhopxQ0mw3o4OlB0yKP5xWZw7dP9Quiwqgs44gYngBPXlhDCC K6RaZUZrJCZMJxMnjImMItvJuG+OXvdA27x33V+QkJLa/LhUy+q54v6SQxu2vjY2uPd2flVY Rvz8MSNwLsd53ufpyhkJS60xWnUk0WTrq3Rl4ftH7A8TRZ/MEdbwBWGrtTdLu0fsDtsdrtWM nKCdr91iEMgz3BCMbBPnYw0I4VtH8SGt/lp4L9TpmzNW5YzoJrFPBmWPuUqx8WnZyD3MysYe Y4+c+EtxEWPJX0XtjIXpgyv+mMlo9UkTJ0SOiUWlJiUmmPhdb9Yvnpw5dOSubSPnZ5195b5j BV9d0zazPGflqY3HdjUcEr5/6q5po0dHRN++1rzgvtInj2995NYXCicnVFYfPHrN3e9Xoa7B mEvS2do922rk1DT5ipoZ2rlaFx4xuknuXl6w70c8BK0+vqIktov8NtElcuKznC+eOd4lo4Fu GUoX95T2JvewrDwwIQbzMe7T7h43ZhL38XPzhV0468WeHuE5tK8RzwJZ1jHBQZODOCGYN/oA +BX5qHldcJFaP+xG4EsIlxMWWK3LHrGwud8vadZiRsM/tnrHW3C5RF4ThxBcMtEt0TTBIrWf YjD+T8ToPpX3wNVvu18j44+WP57t/ucNO3atuPGxx8Ses8Ods9JI1rfnSWpOTk3Xxk17u26/ 1UVjOgc3N38QrkI5V1gjNRb/EUn16hXqTWqetxj8kp7kn9RzD/MP6zmNkSM6jdoXNzfdnr1W XUBgku5WUW3Uqbs9B6whWkOSOsd/rj8h231LjMY8mo/9Fu7vT/M9dD2LQsvNPhE1w7sNkNUq JVGlUQGJQdPRlYNlpwj2i8j5MnJl7sSp8y3hM4qI+xvBesu8wuFfhdzbM9E9Eze7VyjlOjxT /geFJGBZg+VlTo0lk6th5R4+gV/Dv45nJVpuFV6+dBGHX6Is+738Xn4vv5f/7cI+W8jiF/b9 6oT+/lSGCQzBN+VHnXjIf1WBeTzrPavAAgT0wSLuZt5VYBX4w8cKrIbpSIcHIvBIZwjxV2AB ouE0g0Vs15HpCizAWNx4UViF7SpSpcACjCIzGazGdg1pU2ABIvGETGENthuIS4EFGE/+wGAt SnGePKvABIbzjQqMdFRbFZiHCarrFRhp9sEihKhcCqyCUaqXFVgN16uOK7AGEtQ1CqyFKWov TR1/kOtWYD1Uqd9SYAPUaKYosI/+Dc02BR4CVwU2MFhHbRX4hQKjrQIPM5h+E+sfFKjAAlgC zzCYfmurCUpXYJQ/KJLBQ+j33UHNCixAbNACBhsZnXQFRjoKfgC1edCDCow2D7qZwYFUnqCX FBjlCdrB4CBsDwz6lwILkBD0DoNNFN80SoER36RiMP2GO9CUp8CIb0pgMP1WW2darcDoA6ZK Bo9gPtCmwNQH5LkOZ/iPKTDF38jgUdQHTG8pMPqAaQ+DYxj+eQWm+P+gsGaAnTUD7KwZIL9m gPyGAfiGAfiGAfY3KPYvbG20V9kq7NJOqbDGLs12NDiasUlKczQ1OppszbWOBqmxriJWSrc1 2y6DJMVJlJxU4KhbQtucUnYDjoxPSrLEJMVLKXV1Un5tdU2zU8q3O+1NLfbKNHtD85KmVinL 0VxTWyHVOiWb1Nxkq7TX25qulRxVl5bpgtGpjrpKaSplF7/A3uSkWAmxiRMVLBkphiJBGtih AZphCTRBK0iQBQ58q4FaqMC3OdhbjT12bLNdBhfbiQ/2H7sMXhX2Xo5vJuPYfGksfj3/Z/4g vx/vHVCI/Y3sU3ob9tkRdyfWQsSl8Gwc18DGylgSUnYgzUZ2t2F7LcOQsKUOx8cilM7abf8h JQni2GgvdgH21qE+XjwntmXjU+YZD0lYLBCD93j2+8M6LBLkI3Y1StDM8PORkhNrE7QwW6Zg WyVro1iUdzlK4mR9kiLNxXInIB9qS+kCK0djy1LFxjUMtjGulUy/pQr91j5dJJjJeDtZO523 pXi3MzyqTyJMQsiG75VKywSYzLS9tA/U45ha1i8/nczH5FmQ9ZPxBmvuQA/4ed3oSGp7Cftk rWxsFMWpQ7gJqchWGwPLsEqMn9f2/Vp4R5f3aVqPnCsRswqrTKEZW2TKTsadyu1UPMSp+Gkz 85pWJjeVq1GRrgpbHUjTS5fOdQPTtZZ9g0NtUsfotbLvcuyI52Q29frpYKvUMmmpFauY99mZ x8lyynPptSzVn3Km89ikWNjJvKauTwN5LmQPrGX29kad8yLfsSuaN7Lv5ZYoVqbyLWGjG5Bj P3fqHXTuxvTNDZUwUWmh+s1nfKsYJcrXwajR0TbErWMU7YNGVzNt7cx76xQbOll02pjmSxmN aweM8FJ1Mh+UI3AxcrQxT6plVeYhexu1/zK8RzM9qX7NzAJebesYn1o2E1TKFiaN7AeyBWIv EwupLNKobFP7skQ8LGB0nH0ZJwHpJMLEC2gNpBTTR+nS/GoVC0rMC2zMm+qZLtf2af3rc+vF I+T86GBrjQ2hGiUPeTPjz42wszwt5yWvL81F6aqYHnYWtTSqpmIWjmPf3S5FavUXUItFXOrz cQy/HqWMw3sz4thYJMSx6FrEvLlOwaWjvNi/nsvAKKVz6W1ZxLSpZH7Vz2cO6laINqG/U0/D rE/hudhKdc7E+yzWTr+FL8A7XT2ycK3IwDKbtRaCD+hYLWQzLWfUC9fN2kGZtpFlokbFY1v7 Zv+XzWF/TNUqa9cSFr/erNPK8p6XJ7VPi5IxKhlug5L7+uVpZu/1A6KPemmdMt8NCnWbsmux s5mifk5zR4nCjWbvFobnQDm864s3a/+8ZZyMYzNbEeWsZmd61Sgy0sxC22lel2O+P49fbC+H opeDZah+KksVmj/FT85dcmaWV7KBOdzBtPiZGZKGMq0GW8rOsurFXnEx5/6M0MJyIs2G5cqa YGOrv52tXD/tHXLmbmD48k6h9aK5kOepf/bltd+hcHUyOhXKClvxi+ZcUnxRztpydvDypTmt UsnlDhbpNMs3DdhnRfdhNw3wW2/Gv5ylqHT1jP7A3UA/Pe+q42T+158jvWtPP6ZD2XPR1bOc 0XUy7rI+slwDvbteWddk+8tR1aj4h9dLL/ShS2nU7x/ZTPeLZ45auFVZI+2MtlebCvasUPYv g+eg6QJ791Om+jnY6lnJcOzIh664SwfkgV8y+156ckzSWG1RZqM/xrz0Lp5H2VqyBs3Kbu2n 4tg7Y7YLbF31b0nbb+WLOVQou9Ry5W2gRLI+1IOm9lGYj/mfngmmsJ12DNZ4hGNwFzUBqwUk Fo25QH/dNAHGYss4xJjMfq8iYZ2Ee4gkVr0UMxUdL9RjYDb2ZvolbI9YzfovjKdGlgFsyugW ZQck5w1vXNhRT0lptyu6Sf/Wqurti7tA3v6VlOoksfssxFjOMJYz+1YqXrqE3eW9/RJFszks WpYrfU7Fr2oUOav61mw6poB5LJV+CfOEJYoMTUqWL2J6OpUVxP6baEhrXp9lG1nWlk9yY5Sz gIPNXn/+ccKFMWtTYknO3PIp0NG3mlNK8llWzksDM5l90LgLc0M/J3mHWcH2ona227Yr3kKj dQmjTduW941wstzQrLTJtvKer35ra9qYtN6dg/dkIV1gT7pOfavs92VLVrBRlUo2cCg7jGMM v5ZJ6BzQ75WC0rGxTNY/qlLxogqWJftHLWE5LHpQXNmZfbyWb2JrkLNv1ZMUX7Wzta9IiTy5 7beyn13JI/2ZrJJFoOwVtRd4RTPzChujK/XtC7w7rVrWX9vnhxfrb1NsUMs0lK082A6OATlH PuuNUeJY5rAci+M3scevPzVcnv4v+1RPttClcWl+lFd6OeqXXAY/i82bdz9I7Xu5T/qOobzX whnkQKPh0tgLGNVL48xk89jCPme8HG6ecl6hOyvZA1v/DdtdRjchXJguTBPShEnCFMEqXCHk CkmXoV74Cz9DzaU6knjEuBwezRSNaN/LzcMskD+/sgGv/Jo9nf4/lJ+8CCvse6dA+n82AuXm QF/L6kC9Sjt+7cy13/sQNbdtdcB5y+qAHzhC4odYDCqN3MOJIljKVLooFRHI6skcEbblW/Is 0QNahj8Ytmo4JLMyl62TDpYzaDRPp8UiDaYnGN/ys4cttv311JiMT14zJuXv2bbad4ZlNXcA 6zguMOCWPX9p+2L7wT9PPHTPpvWHww8XLLjd4tMnK/0ey3Ljf8WHW0ao+PmCLsC0wN5UW1Bb 3SAVNi1xNktz7M1LHU3XxgdbgiiCPmCIFyGafbIfH20ZL3eY+0fW1tulgmZbfWNtQ7VUYG9q qa2wS/kOR3P8BEuCjB01Z640KzslNXtWdmGJlJKWlpFXmJEeLY2tGJc0WRrMwxIW7JM02TIx PsEy2YLXQnxNik9IjFde/99X4Mb7B9qciMDfuAntfgt3443wdqx0qub66JjYG4d3qDq365/y 8yl6r+BvSz55JXF85ztntFdO+PZYu1trOPJ+6MJ9r39+Zn3HfQfWjf5qRbHRec2yVxcH9b5U fGbcruKrtwi9MeV+xTcOP7x489GRxXFHXwsUb5709ObH9szOOfb1tJFPLLh7ZcS9dWsP5GTd ec2eRycdPa+NeXtP0j0cj059gUvwKNdUv3vXiNPfOrbq3HVHd55+vPW8eP6OKxabd0aN/XBj gP0Wd/Q6ctvCreWH/bavOv3Uc4FP/WXB3ddqyjNeevCR9ybeII78R1OMsFbcfr3W9MfAtFPf m2a/q771HmNdsVs38c7Dt9z/odB47/gVtluf/0K/eOuOQ1XlqVfcsXlkwl0jb2k7W6kZ9d1b Z9F/X8c6iQuCP/ttfS/tRMS5zOKbbzmcub599NeBZf//OfHj8WMso2XCYZcWw6up/mc1/VUi eu2ju8g+fhZf2qEO0GQ3NNubGuzNlhvvu8ilN+AsrKMuvct2Ys8Tm9qz2v++x+/q2r/rbihv V8W//oZn/e2Zf82euvnYO6oZ9z3x4LKFx388X5Ext1vfYDn54KRdMdoPv3GM2eUzr0ycOPeG NwrnHnkqOvVv+iObuq/27F115JMte24YmZ1qrHv7LhdZ8NALb8beP/X0DTuKH/3rSPunG3ct u/fZ/8lKrbkyZkXvkxzhf8Kh68vO3b3o4dqut69rjCo3h6VL83abgw41cz9m/2vMsKseX7t4 oibqzG3/+OjJLV9s2J77ifPlmdr7XO9teC/oD4f5T7WjF6g+n/Nw1iN/Kcp8Z8qC7yJefyFy WszohDfu+Xi/NevLv9VntXx6wPKQ76o3bvjbtJXbfrxjfHxU0NmXA0984Do2P6UxMyZ6pWW1 9lGsvtt4jnCcsbVqS8NNriN7iX/DfQf22BcPlJhDh7b9hNV/foYSLfHyhI/v84g0R329vami 1lYnFTiqmpfamuxS3pLyulpnjb3JKaWlMJecYpkQP8li6XNJ+pqQODFpYtJCy2pS+psLEZ9p SZcHXbF06dLYFhzoxIGxFY76uCZ7o8NZ2+xoao1LyyugPBxNjbFSeauUb6+KjaZ+HTurMJ36 8qT46ZZkmc7E9Nrq2mZkmJ0updXZnE4pUYqRZtdWNDmcKEK/HAtsdbWV8lfJLQnxeouWjlcF cPML4gMsfvRFE6ArsjlrMPSaHQ3xRssQ2RTqfHtlvaOhMj7MMpy28IFB/eQHfEPt7df/TD8a WLowilbjPgjbNdxqQmBP+1uROyo/+yroBU/9dSlzdT86xi9+Izak4NGESR+9U/PPib3Z/n/b ct7+ZkGg9JzwyvLvXmms33z8ta7d4y1bE4qv37vz2tHVdx/4eOmX4qcnP9ny/RP6oY/+Kfnm /9OstQc1daXxhDzUi6IjQl3XrUddEKYx3gTKK6VwSS7kOnmZexMfVac34QbihgRvbhCk2hAV BXe2Sq1YpyoPrZWxtXa1Pqb1gYvIgt06OEpodZ3FnY7b6ljUkYqPPTcIAbZO+1dnZ/LHvSff 953fd87ve5w7p/hffZ6lxjWeiWa8OuYq860KSHoy6121GVGRcdG3Z7aDv6Svtq2TtM2e9ti8 6+Au3farrxkWZQbK74x71Xq08EwO3qBSNPZ3vddvaZV91Hgu0fjV/XfvimaU/xiTcaCvybRO UmS7uzl6U1qwZ3qU96w0+2TCue8v1qxsPeX4rJ6adSWy4K2+jWVVBx1I04JHT9iZjyuXnb8/ P+qHRfRs/deHM/JvRO9efmFDkS72UOYYGMiNAck1NCAJhnbnD9HiCFSARvKPE8ViUYSkDq3Y xL8JxRV+dK1/Uvn2m5fUTwp33EvrcKt6IwP19t8gkAKSiCOwK0Rn8kjEQuEz8UvoFJTv/MKd XawoYoxfAHcbiiBiKQrBS7PRgDhlmAzCqwbEs+HwjLpE/5xCjiv2Zsyb9wuBUR8QHa8IiI5Q hU4vsDMs53Q47TTHAGcoYHiyMV4+aljGwbCM287IAO3OB07OC3xehr9y4eVYp51zlSFen20F Y+cA55EBrpAB4UUYssvHi4ml7RxfEGFp4pgixs2BBIgkESl5futCIUfhJCW000XbXDySkdbC DgCay0Be5KiKR43PLYJmoByAM8xlmZU+xst5s0fKeVgEig4KjtxTGVC+mp4Et5GGFRIrYeCA 3uNzczREZXUyq2RwC0F6MpqchFhIDMoVl7H8HRW+SCrS01NGmQM/d4tFDtS4mcIIA7IQM5sx A0XgJNAQpFqHEXpcAzCDZlgd1hF6ApZhOcJLGwhDXgagtDiwkDgw5sJHggyZI3IJNUbhAL6S lJlQU7rFgLTkzMfVFKCMvApixc0ESeQZhskTRgMwmTE1RahxqAcN6HEDBWHzUxAkaYHzAcxC aY1miAUZBEkOegAIvUlHPMeMLzKZcZIEYa/gIhjUOouGtxIeRSBuPW5Wa+HroJdGM8glKAOv ngufMWDCIEa1RYeZgcliNhlJXBaaZCGh0wGDkUJy8NAi6fCQgtpoIPEFFgiewHQyqGIgKML6 XGcQrBF6ZQYaTI/l4aQckDiO8H7y9YK3ocGhlI6EK632wNh3wy3zOEZzscDphWmByQduj5un lcPJ5JMDgYBxMDJsPhhACFMK9UPkLqFdPgZ4C2nIA7eHAzYG2D3wr/yQEdoLaLvdxw5EoMPD FoViBikZKDdQAjKVR0BgcqQxxZ/8a8J8cNzlKfDIC5wOtOIQn0mAuGI/6kf90sg3K7XCyj5c OEYohAMJ0rEwq0gkMIPGTn+hfbhIqG1IMgK1ojGxo/IhCpsV4bTMwcE53tDKOsOVeCinAJeT tsmBi4OxMLK7HDglo7HDMt3vxWNRKcx28Deq7+E7tfd0DWWWbm7p5rjmD8Fd1/G/lueW796z +uRKqTZmMtOxLLFvgapq5eH7U9JKu9/5JNKfsmWZtrZFkIaQp7NTn1VHzykS5CU/1OrkbO/5 zrVPNJ5Z71yq2dOz7fZ3zwRtzXfY6cEPRO7Pz9rLlaUa1e4N1f3rK1MT5N99mJb6+snH9wKz FQHxazAHp0HXUd9vUD9+phkcccivqziP/m5olcaJFMMLixj2GOG3SMWosoPOCCuKFZPFkzry P5Zf1BRMIarUZcHlyzPRFcPExyuWokvqlH70V9/LcAx8taz/o38Wz7PnNCsabHdCPONYH8Pf 3ps3qtkRB4QCNnNxXus47c7JmUyurYBk9502RHX1t8drk75dQDYFF+1NyzoaJaya2rQvZ92T jje+evT+vxOoY2veSNpafensJ39//arn2riH7eTJadNSug7f+vPGbzovUw3fOAt6Sc25a3ud rdaXN0b1rTii6sl68NahhLobc3bFttCF8us3NzXf9enc9NTat9NfkcxXprNd99uz4iTbrPsv LDx45KfkR1sTuyTx3Vvapmw981Q5oeUD/GFjYHUDcuVGf153Q+XNsf7DWZMiCt88tvfey1c+ u3y6+Ivets+ftnduuBXf/LexRzVx1tSDxhtxt1rrldtkpqyc2y8FbzUv6dxSu37C9Xudd46t 2fmRbfNPZ+oDwq9hv9cR3iWpIiD8Eg6d4OlXcfz//mT7ogP6SAovRqcOZ/Cwz2VCSOChfySK ifyhRKFQKJVJSenKlCX/Q+DxO2ov69euX9VP0fvntlyUjSZVhX9VVJDqOWD69MeGugk1TdnW B6dSBbcF3Wmq+H9eODDvcuzuuD1Jk4Oi8ph92xsF4zcXPPgTKyiOb/w+aJoRd4qsKf1CFPM2 qZXcLG1mu/Nn5n/Zsv+HK+brTWR1417t0x1J63KW1O1MeTcP+ceGEydqmnZ9PLUtodP1nypp d68q4dPHx5MF/wWL9wCNDQplbmRzdHJlYW0NCmVuZG9iag0KNTQxOSAwIG9iag0KWyAyMjZd IA0KZW5kb2JqDQo1NDIwIDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDE5 Mzg5L0xlbmd0aDEgODE3NDA+Pg0Kc3RyZWFtDQp4nOx9B3xUVdr+OfdOy8wkM5NkkkkmYWaY JASGFCCBBJAMpNA7gwk1IYWAAQKEIgJGUdAo9l7Rta1YJgNqwO5iWQv2vhZ2XVdXse3qKgL5 nnPfORDY1f+31fX7z5s88zznPeWe+t6TH8kPxhljdnzoWG3lqIoZBf1stzPumcAYf6Jy1ITy q5qr4hnPzGBMKZw8vWDgtY/W3YO8s1Crtn5JXetF716EsiddgvwP6le3eXe1vlHM2LYLGNM/ 0NS6cMnGd9UhjC1dy1h8YGHLyU2vVu4oYuwW1LF90NxY1/DtxJPDaM+K9gY3wxF/Z8Z+pCuQ zmpe0rZ2xDjjAaQ/YmzRHS3L6uvyGvrezNi9hSg+c0nd2tZ8c/abyG9Gee+Sxra6q07ftppx XzLSZyytW9J43YGv5zP2KfpbuLJ12cq2bjfbzHjGQVG+dUVja9LC3mmMnXITHvcJE3NhGLpv 9uI1H8+3Df+apZmYsPs/Wf+s4NfHrpn8/YFD7XGfmgYjGccURoZ6BnaY8T3mbd8fOLAt7lOt pR6WdofwuPuxdmZnw6EVcAHbwljiYO25nKm6AL+A6ZlJf6V+EJrsRay+wDYrzMQUm15RFJ2q 6D5g+d2PsKxTtB7AJk73elmQsexnqQ/G65QcL+PdIk+9T58gRsqSdQlHe8OfZ//fm+F1dsdP 3Yf/K6ZrZDf81H34e8xg+Pf0V93/85qHf4fpiljtT92HmP3zpjzNrvyp+/BzMOX3bMw/Uo9/ w1r+1X2JWcxiFrOY/eOmXM3NP5hXy/b/J/vyczG1mJ3zU/chZjGLWcxi9o+b7lHW9B9/5hJ2 3n/6mTGLWcxiFrOYxSxmMYtZzGIWs/+7Fvs5M2Yxi1nMYhazmMUsZjGLWcxiFrOYxey/23js t9FjFrOYxSxmMYtZzGIWs5jFLGYxi1nMYhazmMUsZjGLWcxiFrOYxSxmMYtZzGIWs5jFLGYx i1nMYhazmMUsZjGLWcz+S6x790/dg5jF7Cc2NYqM6P8k1YEUlLKa6dhSpFOYHR4DVDzrzSay BraCbcss9cZlP9ut/c9P8Hv/ys+7v8b5+gu7l6d313+yZX+f906Itp/41z1Qx6mXMwP/VEt9 efz/aKX9H1b0/18p7MeN92jv32EVf09hnv4jeef+s135D5v6L23tP7qzgrM2n9m2csXy1mVL l7SctHhR88KmxoYF8+fNnTN7Vk11aMb0aVOnTJ40ccL4cWPHjK6qrCgfNTJYNuKE4cOGlpYM GVxckJ/XPzcnO8vf2+NKdtht8RZznMlo0OtUhbP+lf6qWm84pzasy/GPGZMn0v46OOp6OGrD Xriqji0T9tZqxbzHlgyiZNNxJYNUMnikJLd7h7Phef29lX5v+LkKv7eLz5paDb21wl/jDe/X 9ERN63K0RDwSPh9qeCtdzRXeMK/1VoarVjd3VNZWoL1Oi7ncX95ozuvPOs0WSAtUONff2slz R3BNKLmVQzsVZooXjw2r2ZV1DeEpU6srK9w+X43mY+VaW2FDedioteVdJPrMzvF29n+k49wu O1tQG7A2+Bvq5lSH1TpU6lArOzq2hB2BcF9/Rbjvug9cGHJjuL+/ojIc8KOx8dOOPICH9dl2 v7fja4bO+/d/eqynLuoxZNu/ZkKKIR6ZJuRLzdA39BDj8/lEX87pCrIFSITbp1ZT2ssWuCMs WBCoCSu1IucRmeMMiZx2mXOkeq3fJ5aqsjb6vbrZFW5f4M3rj9nXvrPxjXxvWM2pXVDfLLiu scNfUUHzNqM6HKyACNZFx1rZWViA8nW1GMQiMQ1Tq8MF/tZwsn8UFYDDK9Zg0fRqrUq0Wji5 PMxq66O1wgWVFaJf3sqO2grqoGjLP7V6FxvU/X5nkde9YxArYjWiH+GUcixKTmVHdUNT2FPr bsD+bPJWu33hYA2mr8Zf3VgjVslvD/d9H4/zaU/UamFsx5WWhcXIjdkmb7XiVmvEasHhrcKH f9RwZNixXFpSrOio4d5q7mayGJ4SLSHUMe0goWaXjxFZqqhaPsbtq/GR/UiX3NE+6bPDph5t 2eE40id6zg92jUqLDvX1VjZW9OjgMY3qox2Mtva3+6mIuYg+GDVMYjnHyCw1GycXPgXNaC6x ii5vmE3xVvsb/TV+7KHglGoxNjHX2vqOn+4fP3VWtbba0V0y45gU5ZdQKsx8yJYJpRx7sCrg lsuqpUdr6SPJMcdlj5XZftGvjo6GTqZmi63s7uSa0JefUxOeHKjxhxcE/D7Rz7z+nSZm9c2o LcdZrUK481fV+b12b1VHXVd3+4KOzmCwo7WytnkozkWHf2xDh3969XC31vlp1Rvc68SzE9l4 Pn7GKDSlsFGdfn7W1M4gP2v6rOpddsa8Z82ojihcKa8dVdOZhbzqXV7GgppXEV7hFAmvSIiW piFh0sq7dwUZa9dydZpDS9d3cab5TNLHWX2XQj47PShHe1AQt5P6Lh3lBGVpHXwm8rVT6dxo aRNy7CJnN1PEfUtkknUyMcFBsz5oCsYFrUq8gikVrgg8u1E2jrMdVh7P3Z1oc5rm7uLtnXFB 9y6tpWnRku0oKXztR3zouSjWoyE8jwYeOjqC0KzqHVaG9rVPlBglDLvQ1Yw9hPdJpbdB7L/1 Nc0dtTUierAU7FV88zD3j2BhxT8CPTZYw2Z/46iwxT9K+MuEv4z8BuE3YufzFI7FFkG3o9aP QIwTU83cnM6aKpr0dnV3z6j2PefeX+PDWZoDzKoOxwXwctNnj0O50QK1cI8Ot9fXiX6wULWo a8weW1+DcykbRJGx4Ti0EBdtASWqtDrivKFSPfZanV+TcCN0tNeEawLiodWLarTzag+zMf6h YUMOtanPEQ8qqOlI9A/Ugg/Oujl7i6A49I1NryaPG0k8rIYmyWhFz+v9yKqv9dIemY6zTC8L s5s8jYj5upxGDWZ3NJOJYanZlnhzOC4fDeJbaEu+iDn6bGNNDXVeS22JFsCz7WELepTTYyqj FTA7yBor+oLvLeiqKPqoaGZqF5vmX4vQKTqttWREdjg+e2wd3m5U3wKPv0RWNokgaIm2sYe8 RjFyK+YdIaGr+1b/yb4ehtgh3n5i/zH3LhxUVtNxvCM8O5DX33S8N15zd3SY4v92BZovU/wR 1pxKdr14K4DFhtP2m7dSvCr94zqVSQGNucYd4/x4gyjZArjoqDg+Pm9DjSiFLk/RYtkPFuI9 ConXtNZ4h32YTPFoihazI7zw2GTzkWSVAC6D2fl0h8BQRKzFXlnsDrdgZ8oiYkW8HV67f6hf fGiVRwvUYpGOHAtsf+w6cWja673VC7DZ0WBVbUdVh7ii1tdFpy36pPDSwDFN4lxwbB40JIYT bp/ira3x1uJqyqdW+3xunEawtwn3VH+deBVMofFMmaVdVeo6xBZnuKnUuMNGvJia6hr9PrxB wiIC0eyLPuqix4a5Ozr8HWHt3FahMJrPwbEbKwjfrQF/XaO4QjeJG3SjVrcK3dVmR7TmrvTj LDfCrc0lJg6hb4H4qO8QF/S5tQHMhKMjscNb2oEQPBdvD11O/cxavKrEG8mrLXWdGylMwliR qkFDVDAuWxSkIyB6syTQOdeYfdSjfS8LUGGT1ip6Nq06PEUW0c6TEMsDYSW1BJli8HzarGoZ p1SRPRbTG8Sucova3rAyozq6PFr9saKqWy4YVYNHe4dEz9eRt418D81xY05/0I+XgzpyuvKU 8gQrYR7lySi/w0qUt1hIeRP8OviNKL8GfhX8Cvhl8EvgF8EPgx8CPwh+gIWYTnmbFQEzAPWI agBuAl4B9OwktMSZBfU5S1YeYxVAA9AGXALoUfYh5N2EFjnzKmfsjHPxcVjQTVKcLsVpUrRL caoUG6XYIMV6KU6RYp0UJ0uxVoo1UqyWYpUUbVKslGK5FK1SLJNiqRRLpGiR4iQpFkuxSIpm KRZK0SRFoxQNUtRLsUCKOilqpZgvxTwp5koxR4rZUsySokaKailOlGKmFCEpZkgxXYppUkyV YooUk6WYJMVEKSZIMV6KcVKMlWKMFKOlqJKiUooKKcqlGCXFSCmCUpRJMUKKE6QYLsUwKYZK USpFiRRDpBgsRbEURVIMkmKgFAOkKJSiQIp8KfKk6C9FQIp+UvSVIleKPlLkSJEtRZYUfil6 S+GTwiuFR4peUmRKkSGFW4p0KdKkcEmRKkWKFE4pkqVIkiJRCocUdilsUiRIES+FVQqLFGYp 4qQwSWGUwiCFXgqdFKoUihRcChYVvFuKw1IckuKgFN9LcUCK76T4Voq/SPGNFF9L8Wcp/iTF V1J8KcUXUnwuxWdS7JfiUyk+keKPUnwsxUdS/EGKD6X4vRQfSPE7KX4rxT4p3pfiPSneleId KX4jxdtSvCXFm1K8IcXrUrwmxatSvCLFy1K8JMWLUrwgxfNS7JXiOSmeleIZKZ6W4tdSPCXF k1I8IcXjUuyR4ldSPCbFo1I8IsXDUjwkxYNSPCDF/VLslmKXFF1S3CfFvVLcI8VOKXZIEZGi U4qwFHdLcZcUd0pxhxTbpbhdil9KcZsUt0pxixQ3S3GTFL+Q4kYpbpBimxTXS3GdFNdKcY0U V0txlRRXSnGFFJdLcZkUl0pxiRQXS3GRFBdKcYEU50txnhRbpThXinOk6JDibCnOkmKLFJul OFMKee3h8trD5bWHy2sPl9ceLq89XF57uLz2cHnt4fLaw+W1h8trD5fXHi6vPVxee7i89nB5 7eHy2sNXSCHvP1zef7i8/3B5/+Hy/sPl/YfL+w+X9x8u7z9c3n+4vP9wef/h8v7D5f2Hy/sP l/cfLu8/XN5/uLz/cHn/4fL+w+X9h8v7D5f3Hy7vP1zef7i8/3B5/+Hy/sPl/YfL+w+X9x8u rz1cXnu4vPZwedvh8rbD5W2Hy9sOl7cdLm87XN52uLztcHnb4eU7hOhSzoj0GuHBnTnSywk6 nVKnRXoNBbVT6lSijZFeVtAGSq0nOoVoHdHJkcyRoLWRzHLQGqLVRKsor41SK4lWkHN5JHMU qJVoGdFSKrKEqIXopEhGJWgx0SKiZqKFRE2RjApQI6UaiOqJFhDVEdUSzSeaR/XmUmoO0Wyi WUQ1RNVEJxLNJAoRzSCaTjSNaCrRFKLJRJOIJhJNIBpPNC7iHgsaSzQm4h4HGk1UFXGPB1VG 3BNAFUTlRKMobyTVCxKVUb0RRCcQDaeSw4iGUvVSohKiIUSDiYqpsSKiQdTKQKIBRIXUWAFR PtXLI+pPFCDqR9SXKJeoDzWdQ5RNbWYR+Yl6U9M+Ii/V8xD1IsokyiByE6VH0ieB0ohckfTJ oFSiFHI6iZLJmUSUSOSgPDuRjZwJRPFEVsqzEJmJ4ijPRGQkMkTSpoD0kbSpIB2RSk6FUpyI acS7iQ5rRfghSh0k+p7oAOV9R6lvif5C9A3R1xHXDNCfI67poD9R6iuiL4m+oLzPKfUZ0X6i TynvE6I/kvNjoo+I/kD0IRX5PaU+oNTvKPVbon1E71Pee0TvkvMdot8QvU30FhV5k1JvEL0e ST0R9FokdSboVaJXyPky0UtELxK9QEWeJ9pLzueIniV6huhpKvJroqfI+STRE0SPE+0h+hWV fIxSjxI9QvQw5T1E9CA5HyC6n2g30S6iLip5H6XuJbqHaCfRjkhKGSgSSZkN6iQKE91NdBfR nUR3EG0nuj2SgnjNf0mt3EZ0K+XdQnQz0U1EvyC6kegGom1E11Nj11Er1xJdQ3lXE11FdCXR FVThckpdRnQp0SWUdzG1chHRhZR3AdH5ROcRbSU6l0qeQ6kOorOJziLaQrQ54qwDnRlxLgCd QbQp4mwCnU50WsQZArVHnAjG/NSIczBoI9EGqr6e6p1CtC7ibACdTNXXEq0hWk20iqiNaCU1 vYKqLydqjTjrQcuosaVUcglRC9FJRIuJFlG9ZqKF1LMmqt5I1EAl64kWENUR1RLNJ5pHg55L PZtDNJsGPYuarqEHVROdSN2dSQ8KUSsziKYTTSOaGkkOgqZEksUTJkeSxfaeFEneBJoYSc4D TaAi44nGRZJxL+BjKTWGaDQ5qyLJG0GVkeQtoIpI8qmg8khyO2hUJLEKNJIoSFRGNCKSiPc7 P4FSwyOOGtAwoqERh9gapUQlEcdo0JCIoxo0OOKYBSqmvCKiQRFHf9BAKjkg4hADK4w4xNks IMqn6nn0hP5EAWqsH1FfaiyXqA9RDlF2xCFmKYvIT232pjZ91JiXWvEQ9aJ6mUQZRG6idKK0 iH0uyBWxzwOlRuzzQSlETqJkoiSiRKrgoAp2ctqIEojiiaxU0kIlzeSMIzIRGYkMVFJPJXXk VIkUIk7Egt22BR6Bw7Z6zyFbg+cg9PfAAeA7+L6F7y/AN8DXwJ/h/xPwFfK+RPoL4HPgM2A/ /J8CnyDvj0h/DHwE/AH4MGGh5/cJzZ4PgN8BvwX2wfc++D3gXeAdpH8Dfht4C3gTeCP+JM/r 8QM8r4FfjW/xvBKf43kZeAn6xfiA5wXgeWAv8p+D79n4JZ5noJ+G/jX0U/GLPU/GL/I8Ed/s eTx+oWcP6v4K7T0GPAoEux/B58PAQ8CD1uWeB6wrPPdbV3p2W9s8u4Au4D747wXuQd5O5O2A LwJ0AmHgbsvJnrss6zx3WtZ77rBs8Gy3bPTcDvwSuA24FbgFuNmS57kJ/AvgRtS5AbzNcpLn eujroK8FroG+Gm1dhbauRFtXwHc5cBlwKXAJcDFwEepdiPYuME/ynG+e7DnPvNCz1Xyz51zz rZ4z1WzPGWqJZxMv8Zweag+dtr09dGpoQ2jj9g0hywZu2eDeMH7DKRu2b3h7QzDRYF4fWhc6 Zfu60MmhNaG129eEdiubWZNyZnB4aPX2VSHdquRVbavUP6/i21fxilW8cBVX2Cr7Ku8q1doW WhFauX1FiK2YsqJ9RXiFblh4xfsrFLaCm7u6H9mxwt2rChxcvyLeXrU8tCzUun1ZaGnTktBi dHBRycJQ8/aFoaaShlDj9oZQfcmCUF1JbWh+ydzQvO1zQ3NKZoVmb58VqimpDp2I8jNLZoRC 22eEppdMDU3bPjU0uWRSaBL8E0vGhyZsHx8aVzImNHb7mNDokqpQJQbPMuwZ3gzVLjowKQM9 YW4+qtAddL/v/sKtY+6w+xG3mmhL96QrfW1pvHxyGl+Wdmra+WmqzfW8Swm6+vavsqU+n/pe 6uepuqRgat/8KpZiT/GmqE4xtpSJM6o0LqsgHlCsjdWT4s+psjm5zelxKpWfO/lmpnIv54zb QaoJZXZyp6dKfZCLX6LTM84vYDMC47tMbNr4sGnK7DA/K5w9XXwGp84KG84Ks9Cs2dWdnJ9X o/1OQjhZ/FKJlj5z61aWOWp8OHN6dUTdti1zVM34cLvQwaCmu4VmKFITmLdy1cpAdfAE5njf 8YVDdT5sf96u2GzcZuu2KUEbOm9L8CQo4qM7QQ0mDBhSZYv3xCviozteTQnGwyPG18c6ZUaV zeKxKKEyy2SLErSUlVcFLXmFVX81zh1inPTkQNs8fMxb2RbQvpGq4atEMiC84ntlG9Lia5WW ZoEfNSoGmr8S1iadbT9e67/d+E/dgZ+/0W/yjOxWzmANyibgdOA0oB04FdgIbADWA6cA64CT gbXAGmA1sApoA1YCy4FWYBmwFFgCtAAnAYuBRUAzsBBoAhqBBqAeWADUAbXAfGAeMBeYA8wG ZgE1QDVwIjATCAEzgOnANGAqMAWYDEwCJgITgPHAOGAsMAYYDVQBlUAFUA6MAkYCQaAMGAGc AAwHhgFDgVKgBBgCDAaKgSJgEDAQGAAUAgVAPpAH9AcCQD+gL5AL9AFygGwgC/ADvQEf4AU8 QC8gE8gA3EA6kAa4gFQgBXACyUASkAg4ADtgAxKAeMAKWAAzEAeYACNgAPSAbmQ3PlVAATjA WAOHjx8GDgEHge+BA8B3wLfAX4BvgK+BPwN/Ar4CvgS+AD4HPgP2A58CnwB/BD4GPgL+AHwI /B74APgd8FtgH/A+8B7wLvAO8BvgbeAt4E3gDeB14DXgVeAV4GXgJeBF4AXgeWAv8BzwLPAM 8DTwa+Ap4EngCeBxYA/wK+Ax4FHgEeBh4CHgQeAB4H5gN7AL6ALuA+4F7gF2AjuACNAJhIG7 gbuAO4E7gO3A7cAvgduAW4FbgJuBm4BfADcCNwDbgOuB64BrgWuAq4GrgCuBK4DLgcuAS4FL gIuBi4ALgQuA84HzgK3AucA5QAdwNnAWsAXYDJzJGka2c5x/jvPPcf45zj/H+ec4/xznn+P8 c5x/jvPPcf45zj/H+ec4/xznn+P8c5x/jvPPVwCIARwxgCMGcMQAjhjAEQM4YgBHDOCIARwx gCMGcMQAjhjAEQM4YgBHDOCIARwxgCMGcMQAjhjAEQM4YgBHDOCIARwxgCMGcMQAjhjAEQM4 YgBHDOA4/xznn+P8c5x9jrPPcfY5zj7H2ec4+xxnn+Psc5x9jrP/U8fhn7nV/NQd+JkbW7my x8VMmGv+PMaY8TrGDl98zF+MTGGL2UrWjq/NbCu7mD3M3mYL2CaoK9k2dgv7JQuzR9mv2ev/ 7J/A9LTDJ+uXMKt6HzOwJMa6D3TvP3wL0KVP6OG5GKkknfeop9ve/dlxvs8OX9xtP9xlSGRm rW688hK8f+KHug/glYt092CRVrZA27QaXxqvO3z34VuPm4OpbBabzeawuayW1WH8DayZLcLM nMRa2BK2VEstRd5CfDYhNR+lEF40fbTUMtYKrGBtbBVbja9W6JXRlMhbrqVXsTX4WstOZuvY KWw92xD9XKN51iNnnZZeC2xkp2JlTmOna0oyeTaxM9iZWLUt7Cx29o+mzj6iOtg57Fys83ns /B/UW49JXYCvC9lF2A+XsEvZZewK7Iur2TXHeS/X/Fex69j12DMi71J4rteUyH2APcHuYXex u9m92lzWY9ZoRuS8NGlz2Io5WI8RburRY5q/NUdmayPGLsbWER3pWvhP71FjdXQeRclNKEmt 0DqIVjYcNxMXYAykj46IUpdq4z/q7TkrP+aV83FNj5m5WksJdbz3h/Rl7FqcwBvwKWZVqBuh SV2v6Z7+646U3aalf8FuYjdjLW7VlGTy3AJ9K7sNZ/t2tp3dga+juqcivovdqa1cmHWyCNvB dmIl72X3sS7N/2N5f8u/I+qPHPHsYrvZ/dghD7FHEGkew5f0PAjfw1HvHs1H6cfYr5AWpSj1 BHsSEepp9gx7lj3PHkdqr/b5FFIvsJfYy+x1Hg/1IvsYn4fYC/oPWAIbiR//d2Oer2Hz2Lx/ ZXQ73vTpzMm2dX/bvab7W3UMa+IzcIG8A6u0k52Ln9iXHi3JPcys+y1LZju7v1HngHMPvaVv Pnxj9+dMj6i5Un0JUU5lRlbKJrJJ7PLwmYHqB1g8bikpbCi/5x5nRYUpz/gQbiAK8+IOY2Kc lwdtOiX+vvT0Mv99xYatqmNsF8/bWWbcitt52aF3D+0tOPTu/sTSgv284J197+6zf7nXUVow aN8r+wYUuoPJ6fH3taBqsf++lmLVsLVFdZSJ+sG4lrKgYtzagkZcZYH0vYG9BYG9ATQTKBxQ wx0+h4bkBMVoTDb4e+crxX1yBg8aNHCEUlyU4++doGi+osFDRqiDBvZS1GTpGaGINFdfOjhL nXzIoGz0l80cpO+VbkuON+iVDFdi3vBs+/TZ2cPzM42q0aDqTcbcIaN6j2+p7P2W0ZHpTMlM NJkSM1OcmQ7jobf1CQe+0id8X65r+f4S1TBsTlmWeoXZpOgMhq5errR+w3xjZ9qS7DpLkt2R YjImOqy5FXMObXZmiDYynE5q69BExtkd3QcMAcz+cPaamPWgvXZE6wglvrAwtaDAnO9ypXd1 f7TDzieCv9hhi3K8xt/ssGr80Q6LYMUR7JU1wGo1u1DcbLeJDxQ0m1HK7EIR82782MW6Hwmm IcGyBk+1uFLjC1wD8g2e3KmeUGJIH2JlsMTUUsegMl7wSmCf9o4f6BhkP6IcpScUDBrkGDSg cC6W8W+24TraCBYtWy6Bw88TVKH6cL/jiLNIrF4vJZUP4lgyIZ2GgCnZk5bqSzIphwepFmdm srNXskU5PJqbkr1pLm+Ssb+72VuY5Yrja/R8syXdk5O2xOZOsqabrEa93mg16RZ+f4nRbFR1 RrMBS3TlEf8t/bKs6bnugyeqt/Tql2aJS8p0YkvfwJh6EG//ROZhI2jvJ+EnaMbSleRgXJzr u4QG93f6haxsfxl2c3QLWxNc37UkNOjd37UgC5u1TNuiYmD+3jnawHwYjbEoHw6H2KHqwbEd T239PjkrK5k7Oh7dVBHODW1pufCCps01/RXPuc9uHpnpU2/yZVae8fDGaecuHHrwswGNl4u/ xb6h+4C+Ef0rYYtF73b2d+b1cXXx7mBc7/gCc15e7yKzSDlY7+KGvBSLmpnTkNlsb9Y3y+UU i7lvYCKWLrG01L5voKO0VAzBdnxxuXLHr5vB8P9ctxSnvtGY5E1N8yYalcPn6Py52O1x6uEr FWOiNy3Nk2jMcbV4+vuwaH11fKA1zdc3oyktK9VoMep0+FDXHDzDalUNcQZ1/cGzj3if7O0V C3aoSHmqV790i7e3+Nt1zId6DeZjEAuyBjEju5hZce4cYA84isSvaOQMc3Rh5WwZAceHw4al ln7jbUiNzoYWkUqxiANf2Ye5eE1bysTAMMeHLSjpLf2mJVpWTIUWd0p7zEWfPvmq/9hJEGvs FPGol5qampKi9ljua0zO7Ay3z2lWZ9qyCkcWLdS2ry/ZhPVPrz1zdmFm8YQB7rxsn73GbPzU WTg+eOl5IyYNTEsyYhLUuATLV/0qCtIPTz4yGc/4MnOqFo4smlk50G7xFQZzP05PU971Dw+k Hb4rrUD81Vlt9371GtyBcxDJH9DiiadsGLe4S0UkKBWRoNRuFx+IDqUiJpTez7/DRi/ofl8E lYJosCmIBhuNrVG/RbBiDpqTfFWW0j5uXUI/8c9RrnFFXVy3I2GifgImGCeE9hsFjFeicaNU CxdmWdElau5scY1LEHV3tmiVMeM4Q8fvvmLaexTAU1Id0UDuVHO0cO9M7qWIyR6iXmN0ZCSL CDv6ytn1556YO3DBhfMnbwoakz0u7Mm4W8o3VJRVD0lzFs0c6TshWNUnDUEB02o1rZk4c+Km zgVt958xurJcsRjjRayINx6qnH7i8AXrgxWnN56Q2K98AM7hlbj936o+jX23WTuHrcU8xxaN w7boFIG/2Gmz8wm2aKC2dfFvg4ksmISYG3TgwwsnS8eJzQ7GBcbl2JzesU4xddiOIrzswXxp s6bNWWdAK2huOVrSRUWPRBvMjpgJY49tGZ0jp/YSNCi3KoY4kyk1M8uZVlg81G9KpChqSMxI Tcm0G7NHDi3NjPdlZVp1KlcXpPRyxMXFmZLzJww5FDZZTDodPtQzTJY4bEqLadPgij421WQ2 xyW4sePGKI8r6wwOlsWK2SwxK5G4tOL7eTU2VR4/O2h3eJakxam54ZTlA6+2tqkro3ukVNsj CEpaIErSCqXkhltSllsHXt2iFYzuh1JtP/Do2/5/tR0GD1HWpfkcKTZDQd3wUbNL070j55cN mJZrtKUnJ6fbDWfljs7NKvLYrL0G5mSNzVc+sMbrEHhGFgwomLxoeNXKyYGcHJ6vN+lUVWfS H56en+8tKvdnVRX7AsUiHrcoz/AX9W6Wx6rEiHf0TmdY5ROD1nTznj7Le9ucvVqdK4+u6Jd7 ErVRxvcx72k5mv+/WMfBIq7SKur4i4rOqDdZbE6HLcPrT9HbaTBpfn+qq1+OPynBl2LUcd1L DleCUW/QW1y5mYdvw7B0YmyKywob7clNNelMhoRUpnBz9zf8N/p5uEP2ZdliHPfos90T7VXo +Dt70d979dlBLY2Opr+zt0c3i9Wc6LQnHX+/etAo7jcZiUYHNzn9GW6/05QQl5br8fR14UXa 1+PJTYvjq0xWsausJnW3NdGqN1gd1u9LfQG3xeIO+Hx5aRZLWp6I8/u79/O7dfO1HpbQezlF aWBe5lRK77XY+6G/ixg6a98j38r3CmcQXpfosn1Pj073UYt+qNOXGm1uZ4rbbuAOQ1JWhrs3 InBcSlZmRk5qXFxqTkZmVkocLxYXChUfSrfVbtbrLTbrQW9mH5fF4uqTmZmbZjan5aLP56hN ylX6VT1n1Z0z2j4as/rcQG1W3UEtLWb1uYHHzGq0P8bjPClOZZPBnpqY6LIZUs3JvlS8Q+L4 4S3H+Apz1M1yWvnzUh0ecKzPbmfMjp+JZ+lm6ybhvm9jqbjz9GEFbAgrY6PZZHYim88W4qfn NexUPkF7gyyd0twyo6Vk7frh63Nb2/q3eWsbshpMYyZYJ7Bgha7CXliUXNSyvq1hQkVRUcWE hrb1LcaM6jmujHErVk9aPWrdxqqNAxcvHbw0fda8XvMSp81MmakMHWEYYe6Xn5C/euPSeTNH 5OePmDlv6cbVxpymBb1zWMFzBc85UksLyHD3fG7gj39wUSPx76khTmPJP9a/YA5zFaT/vV3U ltnfu7ho0MA+UU6KcmqUZb7xuPTxfHy+MeXYdPZx7cvnqa8UFhUVXiI+/jJowKABWf/T3nfA NXW1D9+bhD0VUUSQi6iAhnATQFDqiBAgyjIMxR2SAJEsk7BstYAL9yiKoyq4rROp1daFonW2 WletVnFvnHWv/znn3oSA2Ne+v1+/vu/7JY8kZzzn2ed5zuWGK2y9C+WB1/ogLjeIIYLvb93h AGOsEfftBjKYx2uPc4ODufgBOPluMHx/DrFLYYs5F7yRoPfu16Agbi3o4GWgkQqpfQ7e8J28 wJC3MaA1hySDGQSN9M4KNG7BZb8Fk8Ec0Hj/HpvOOMastbjFsLSuhpethj4Wjg2HsVgZ0Bp+ jcqHtIUfmE/INsb4LZxWdsy2frDVVtdMZ6EzPfTW8ZzroLe/x0KawjQ97xo3XTMmfZnC9HH5 4LjrEuRiuExh1lo5t3Z1aeNodRu3cWrp5NzS0Qb/HcetnN3AqJNVW5eoVkRrZ8tDzJNWzV1b N+9j62Jvw7hqAU4d4Nxhwej1dgcTXHoyWZYs0K4xjp9xdwUkmr19zHBo7u5kaWHfzKHBk5zs oSXaoLe0NBJY6f0PVjMYpNVTcAVvXQlSUGAQyWV6u3pHMXLfTrZ6mgHW7P7PALzovwJ++XuA kfYX4MY/Dcw5//vA8voPhPl/Am/MYIb/DbCIawCr/oPgpRnM8L8NVlH/NsSbwQxmMIMZzGCG T4KTZjCDGcxgBjOYwQz/Y3DZDGYwgxnMYAYzmMEMZjCDGcxgBjOYwQxmMIMZzGAGM5jhfwAe m8EM//8C+lu0AEY7jP4/7RnOaISJ/m7PEfVgm4E5sjbRbSbWnrWLbrNMcCwwN9YVum1pMm6F 5bJe0W1rrJPFGLptgxFWxXTbllFuxLfDUq2W0m17rJPVC7rt4GhpbZDTEesDcOi/p8OtW/rR bRyzakXSbQZm5VZIt5mYm9tEus0ywbHA7N2W0G1Lk3ErLNxtLd22xlxbBtJtG8zZ7QbdtsUT jfh2WGe3Z3TbHnNt7U23HayYrbvQbUesA8BhYjjLBgjX3EJDtyk7U23KzlSbsjPVZpngUHam 2pYm45SdqTZlZ6pN2ZlqU3am2pSdqTZlZ6rt4OhGdKXblJ3XYATGw0iMi4WBVhx6QpcWU2M6 8JOB6cFYBHqyGfV8MzEYkYOWCuOAGT6mAEBgIjCWiWWBOR3qycCnDGDngncpwHTAYkArHYzI sDyAkQCoyQCNZKwAtQgsFlAuAHRzEEcFaGUiSQjwo0bPBtMaeRBGmUksCLQ6GnuhGBvxFwMK GoBLAL5iwAfSkGDZNG4f0MsCo3A2B8inM+qTjJ5QpkMSfEyeDGQHAusN+ulgBo6KkRUa6kjR UdOaEohLDpiVIH0N1s0Da7VoJAdgSZHVCDCehcbiMCGQCVpHjtapkF3D0XoZwpBhSsATWlmK 3glaIgMugcZ1yKdyIIvBe/V6wHk9kEIOVuqAFSKQNnKkidyohxj8KMEKSkJKHzHiQdC+lgOK kKoY4EFaBaCXB1p65Af47Lt00FYgmbTIFlBf+Gy9TNpSFFU90oniqUIaSZCkKsRFh/wkRF7J ACNi9Gw3LdKRQJ+UL+RIJ8oWOhQVOkBVTMcr9JiGHjdwUQI6CmQfDS2lCowoEVeKpg5Zql4C yFGDdDE8+4+yLSW7AkUNjIQsOnKhVPA5d/D5gXrUUyFfG+KashnFhfKjitZLjWybjjDrJTbV CFotH62jtM4GfQ7au6be9EXUlIhCAbJDDr1LTe1tiD4VHclQf8ovWhQNhhiVIV/DyNUYtaFk zKRxdKA3iqauB1pQHso1ekmMYgTuAGUDvQyZRwIkESP+Epo/B2WXTOQrOPNhvur2gdapdOQY Ir8LoMIDmePjka5HPKUoEiGXbKMP6nfmh3kyk45rjREbRi7lcRXAl6HY+X+Tb23NGfe/JuPG AkkkmB/aZf70PIFFo6hQI8n0AGC+6oYFApAi28KVyg+ih0PHXCBoF6AYykRRBH1TAEbhE04p GxuoUjQVSAYoQQaSlspzFK2mYlSH4lyDdKesYFgHvZqGeFCZpgBZmrKM3uhtA7YhL0jo3A13 ORvZAOJp6KgwzdMaZFcVnR8oKjK6L6ZzsgxlFDnSkJIuHclh8HJjj+npFVT8aD8YyTDqwP6k TEBVBSmyqZ6uPtT+pPiyjXwaa0Bl0Tz6SalZH7FZHq2pHO00BdpT1M7/0PZwDVVZ/AC+f4MI bpo6JcO/a1vT/UFVd4Kuz3rkOUmDOtlYg/qq2FiucJMYgJpQulCnBUOu1BpPHlJUe1Uoj4g/ qikVe+IGUUXlAzX9TmlFtXPQfqHykxTVMTmdWyg6EFOBsv/HY5TK4iraM/XUDTtEbnKqyEL5 Tk7bGWZ1B5QvZbQOhhOGwcoNo5qNPCNGbSlmOF81znONd4Jfo7wgQ3k6D50o5Mj70KtiMAYt lAkwDHOBNM1hjXKnP71767NF/WnAIM1fqU6fWA0Ij0Y0Yg00CE9jNMMnEVN+MkQNdTpR0FWk Prr/rMIZovLjVQ56LtG4c3QmZxHK31QUyGheVMZW0X5nI521dPUxnCuoc1Em7WdDHFNxpaHP OxQHNTp3i5GehkgRY/VVvnE++xt8YbSQGOkO7Sanc72U3qsS+qytQrKa1kw5Oo3rUGzSMn7c t6Cd1LDOA2/7m9hIanKFYLofPpkeVn9VY8BuOruxG2U3g+0br1agqwJ5I70NctWfwep3TX0l MviQjRmuzuBVmKEvM4kQDbr+UqB4yzKpsJTU6UgWGV2pcoy+NM0llA8DaY/r0C5RGGUw7OuG sfTpVjWt8JSWppWmYUzXWyIP2VH5b/rRUA1y0NUlZRmZiQRS9A551ttlBMCQmNQO/Z/kYyrz S5EGhorXrUEWp05juajd1KlbhWqEocqYXp8Z6kRTOaXhKh3KFZSv0mm9m6654o94VGvUXoei VIWoU7vowyvffzcCDPUtBhOg2QQsCvT6g2opQiNCMEaALCoCM6mgFwlGI8GIL8BIoud9kaf6 ozoUA/BSUI2jaIjAezzop6EcF4URqA97fQF+PKAF1wqwAYiHAFBLQpgiRDsOjMaCTwGNB1dE gJEU0IftaJQFKX7xYBV1DSGkayIlaTIYJ4waNpRKiDgaJIsDPRGgH0PP8gFtIaIH5Yf8o1A7 3ihnFC0pH9kIUoY0I4BEsagHR1PAZyLAS0L8+UhnStp4pEMUmKd0ESAJIGcOrSuFB+2TSs9A H0H5YgHUa8VHNohB0tTbLwJ8JgLJIf1oMJuMKkQCWBmJNE1C1hPQNoPaxqJevVaUpyKQNtCq 0AaRoB0HfqKNthOhd0oWkQm1hrbrj+brsSj9+PR7BLJcAupR3ohAvWTkKzjLpn0pQno05tof RaIAYfGRxknGCIlC0UtJb4hOikeCiSQUP+hbU1kMUU38yR6hqBjmU2hPf2gXaHU+sgmUK8nI +WOUwd5cQ/BIbhgRJ5do1Tp1hp6IUGs1aq1YL1erOARfoSBE8swsvY4QyXQyba5MynGIkaVr ZXlEgkamSi7QyIhYcYE6R08o1JlyCSFRawq0cAUBKZNBREf4EcomRGKFJouIEaskakk2GO2j zlIRMTlSHeSTnCXXEQpTOhlqLdFbnq6QS8QKguYIcNSAKaFT52glMgKKmyfWyogclVSmJfRZ MiJOmEzEyiUylU4WTuhkMkKmTJdJpTIpoaBGCalMJ9HKNVA9xEMq04vlCh0nQqyQp2vlkIeY UKoBQcBHrNIBKlp5BpEhVsoVBUSeXJ9F6HLS9QoZoVUDvnJVJhAKoOplSrBSJQUG0KpkWh2H EOqJDJlYn6OV6QitDGgh1wMeEh2b0CnFwK4SsQa04RJljkIv1wCSqhylTAswdTI9IqAjNFo1 8AaUFlBXKNR5RBYwLiFXasQSPSFXEXpoayAZWAJ0VAFe6gwiXZ6JCFOM9LJ8PVgsz5ZxCFpN Xx2hFKsKCEkOcCklNzSfChhZKwa6aOU6aFGZWEnkaCAbQDETjOjkowC6Xg0UyoUqiQngACXF CwaPJEusBYLJtByRLDNHIdYa46qbgXU3GA8hqcBE0AVdOLygBqbXa8VSmVKszYZ6IJcaIzMT WFwDhyVqoL5KLtNxYnMkfmKdP/AiEa1Vq/VZer1G1y0wUKqW6DhKw0oOWBCoL9CoM7ViTVZB oDgdxBlEBZiKHIlYl6FWAYMDrHpmuhyNRiEHgQPnOESaOgdYrIDIASGkh8EKh6EhJMC1ehmb kMp1GhDAlEM1WjmYlQAUGfgUAzfKtEq5Xg/IpRcgrQzhCEwF4katNTQyIAf2h7qDOJDmSPRs GI65YC0brjEwAP7Jy5JLskwkywNM5SqJIgfEfr30ahWIFD+5P7UtTNABhT+TltpFINaB33V6 rVxCBaSBAYpDA61wZAE/OeAC9gRMJVq4c6TqPJVCLZY2tJ6YMhWILKAOcB9s5Og1IAtIZVBN iJMlU2gaWhTkJRC7FDp0iBztkyx5ulwP85NDMhA5Qw13CxSZNjWbSBfrgKxqlTFTGJzgR8eC TMXJk2fLNTKpXMxRazMDYS8QYA6jc4o/cC8KC7QHIJmmk2BTyesEjRELMU5CM49QA52gacBe UoDEhszdME1CUzZIlA4OidA5OrR5gN7ABDKwCgQ2sIyUTWRoQdKDWwRsxEygM7QxsBXwKFhO qNNBslNBo4hRojbE2adrAQUS63RqiVwM4wPsM5CyVHoxlU/lCmAZP0ixgbZEEp2pT/ojiaQo G1J+aBIP5Vk4bBJubDrcoPSGaYUcxCnFG9LSUpUKcECbCGrIhrlcngE/ZcggmhygkC4LbVhA Oj0Hbl4dHKSjBGgYCBTXyWCKVmvkVEb9qKjUhgcsqU1DWxoJkZelVv6JjnAb5GhVQBgZIiBV gxyKZBkhk+gNAVYfxyD4pXK08bpRIQ7SWK7MpOCq1Hq4ZahkLqe3MRUp9JQuC9aDdFmDnSs2 UVQL2ev0IJjkwEXGyvNnBoD7LUZAJCVEJffniwSEMIlIFCWkCiMFkYQvPwn0fdlEf2FyTEJK MgEwRPz45DQiIYrgx6cRfYXxkWxCMCBRJEhKIhJEhDAuMVYoAGPC+IjYlEhhfDTRG6yLTwB1 XQh2IiCanEBAhjQpoSAJEosTiCJiQJffWxgrTE5jE1HC5HhIMwoQ5ROJfFGyMCIlli8iElNE iQlJAsA+EpCNF8ZHiQAXQZwgPhmU3HgwRghSQYdIiuHHxiJW/BQgvQjJF5GQmCYSRsckEzEJ sZECMNhbACTj944VUKyAUhGxfGEcm4jkx/GjBWhVAqAiQmi0dP1jBGgI8OODfxHJwoR4qEZE QnyyCHTZQEtRsnFpf2GSgE3wRcIkaJAoUQIgD80JViQgImBdvICiAk1NNPAIQIH9lCRBvSyR An4soJUEF5sicxzMtwXMtwX+gm3NtwX+vtsCtujHfGvgv/PWAOU98+0B8+0B8+0B8+2Bxtnc fIug4S0Cg3XMtwnMtwnMtwn+424TgL1J/a0Bhr13wyZgTb0Y9DfyMdwPfLLRN/v/7BXJLLO3 xwEOnvyp+A4OCL/wU/GdnBD+uk/Fd3ZG+Gc/Fb9ZM4jPYH0qvosLwAefGPwLBRbCh2stgEsw 3B1zwKdi7sw+WAeAwQPj3Rrh9jDBdQW4PgCXAzA+g9Qb4Rab4LYCuB0BLg9g8MF4n0a4R01w WwNcf4AbAjAEYDy+IS7AqMdtA3DZALcrwOgDxpMa4SpNcD0BbiDA7Q4wEsB4GowXa2vc2ram ZgV4zZ9vbYFbW1lb55eAV74lE7dkXSqEL2sct2ahViFWyGTi1hbl5eXWNri13Z7CPYVLAZQC KAFgY4HbAAoGEizc0mJTNVxng+M2NAmKhg2kYWOL29hXg1dFr4pesxFMBWBridtas1gs/dRx 48ZN1VuxcCuaTKEtzrC1MNIpZLFwW8uZ4GVrh9s6VA+vHg6ols8iZhGTAYwDYGeJw//GsUli djjDzkCMpmaHqNk54HZO1W7VbuV+5X4zY2bGQHXGW4+3Lra2t8LtbRjg1S2qGLyiulmzcGtL mmChPc6wtyxsSNLeCpK0d8TtnS95XPJ4+Nlx9lnFWcXB2KNH9009MLXGvsbewRp3sGWCV3hm DXxlhiNDnr1UTb0cGAwHy2rjC6uutrDEHayPwheKbEPcw33PkCpUmXSbo6PaqbDN14rT2QRf q1SxiYgCrYJNRMvU2ehdC961MtCGv2VmE7FiveqvYSMZcCQH+PFcAj5bUCJ5lpHFnl9Z2nSa EDPhuQNuxSgv9hwHhgoZOM61I20sLTo7MhnuFhgptrTtbImz8OJQBs4qTyL7kWyTEY+lbQs9 wEaDkIDOQ2p0hQLPzz0gkN4mxFgtljFHrz2d/G3qa6/dc8M3rpL0S20/urzYLYUsZtWQxcy1 5UwGzmC4BAERf8wv7ILnuMu1SOAfSQejtLgFkCsPiclMYVm6MFKSuC5kM9ixdrHtL9ZlyVWZ erWK60w6wkErFyuRTKpUq6TctqQHHLF1cW3y1i7Xm/SC80wXt/r5ZLlSFpCkFys1RGIEn2zb yoHbhexKhnJDQ8JCggaCbphJlyyq+lskcyDt4LydCysuIVHE9SU7UN22qgi5Bt7yiUwSEIKk +G5RIbywgKDQ0NCAMH5oF24H0ofSyKNJjZKoG2dkMd7O1MK4BcYsxp0wMG7LKAbZeb2dT5vV h0v8WnS5WpM1xHKcXw5/YvPVX68JZgyvWB/1na3DuhUnHaIEtzYu9niiG/pe/ea7eQFznrXx KXnWr+rmwv6pb+OOLA35/rr4SGYLRqvIF5Nco8sDbGdgG49MrO4jPRS26/LUzndqJgR917na fdNL3wWWpCasdofLvsJjfYbPG3n1co1668xu0Vec7dZqSwaPaR/heOabVd7BJefW5c28ftnp i69aTfCZ1vrkgZE/rni2KZG9ZODRgZvwA6XF+/DXrgzZPdWuVljARItZk4dOC51qs2RXxiWV 8vSl8j7nL5YuHjX6t5YZ1XinwATfVwOvv3jkedeR9Sxb0LbF6Grp3PPHv38f9fOI3TovBhPs o2XFuA2wiAXpCUzq6chqyWpxavcz3qYSrtON1qWPeuzmvhrEcLJBMeTpw3IjWxa28Al+8Zso SmNb1+t17uuqzptqQqqcyGSI4MWKI/uSwvLocsGECPpem0SraHSDVpMth6OB9K1OXaDRjdCL yIkgKjkAhRxgaQ02poWFFY6zYsk+ZIyhTzImfEYzyMvLa4qBTPsnlPWkC5S3A8uetDWQZFo3 2pBMGCXzBmG/P1gWM+VaYtfM0vbV6hm7etV2XcmOm8RendaDZzvi6JvBrVjzyIQT7+2Xjr/Y YS+rm/Xz+Gt41UVVhCz+UneOQOOfcyJBntAyv+rnz3s8aL0urnJDDk/U3qJs5tmYc7ciX88U t0wb+lNl55Q5S0SD91STvlb3z8T6FlTVPO8T4tA6bhl3/+8n3dtN87UJ7hX68+IYj8k5kyMW nfVP/nZ1qKLF4oP5iq2tv5mYvyxUuguffe9Cry+HNXNOLrUYeO7LKr++zRcHF08J9Bse6vwo 0/1Use58Le91bdCyq71CvHeEDuJlqY+c7XwLF0tmlZXcuPNwE2Pjy+eD39QW1QSP+bbfhTZe 90T3XpHFljhIY7dN0ti+25NejCpKvP0epbF9plazA2lszN+SLPzIjtSm9zKdl8qIJHkmutEJ HAu/4cJF2SyUDONyeSSAYCqb1XdJ/d8iHz3P/Mj8v8xGJZO3ta+xmrGgsMD1Tcfhb7Ql7Fd/ LCsrmRu1ddmRYZMCuwVx2s7Kf/XFGq9ifMuoI+47mIej7u6f//w1y/PxeNv37VQVjzO77/d1 u+7n9ZRVypfcu/qD69Q6lwUhF8M0yerwe+sFNqRwz64Z5Hz7I7mHnuvmtMz7Zcr20gPW44m6 tqtDHo3ce0mP9Z184vdZd8/kv5v2av3wku47v/fakF62e/+4ypkbzmzsfDL5dci5n0bOvtH2 /b2R2Ue+tM7VX3LuF3PqEXYwJnaZVcj1NIe3X3x98MbAq+Ofnlng5DV95bVxrfacObzEEz/w NmaVy+ygMu8Y3ou97Zdim3clHR6r8h9U9CBMVfhk+z0Xu7uGbFQILPIFlW46wHRjrMyx1rhx pzJN0tWRM+njjg3veud95t7BJw5uX7u1xmUeKYLTzVggFy2PJgWNK00wyYNdC5fOvCCS5PI6 S8LI4PQQmTgguGt6cEAwLygsICyoCy9AGhbCzRDzeCHBGZIGKTBGJb2eaHGy+JtWoaHttihX H85hzPl4CmwyQ6k1OpQFQbiAOAZRDAIYxu8w+BZAhgaQYSgFik1SYAoJTismKVDwLxkYsuCf sNCT9lBwcMHynsUgsUbbmVnMwDHLll7n++9NPOiTsLRf/q91L97+tPN09aOXbVLrkg7Koy1O 7zty78qb+YPmDGsW5ldtIXC5tKCgZEfG2vPb7zJSfLZ298nnKze8eIQNLJ0/2eOozZzjCzwi yTUrWh74IXrQ087BU5bMGBBaE++xsd1h55/OFjuvCXm4od3BGe1XFk2p9fW4luE5qQfnfX9m 3B7V2HLe3W+rAhNTh1hWuk496CnZqrO/emZUR6dOcwWreGN7zO3RX5jnM+ldpfOBydetXfvt 7zyQO6jriLmrl5dkz/VTP9q34c5OQauj6fFFW5Ldo6fPW6GsVvn++MLX62Adscau8tHPdgtK r4xYJB9b0eVXJfFu/On3NdvKuti8695iz7wWa6onHH1QvGdtSvsIty0x4/MnHH95YlHP1r+1 mHRz2pKs9iVZ4WsOFMZ3vGntHSt5+/VXrnFBW1KHJ/za5/uw6e85FyqHLY/IPpR/rHJ79oyx ionab+6seL3kgvuZrm+kh5Q9rK9/MbZy/Y5lP3x+bG7q8lEDjjSPTj/h/eDNZ/u4ds8De0hX hKqHJ/bcGjkzodxuyq4xA54dyJwoPr943r6DU4+ooy9Xc0rrKp9tIpX3RghX356be3Cn9b53 4U836EItN6cea31q+9PSwxM9HheOwBO+a1Okqzo5qF3PbgPcakvuZ+4Trgr8vcOU7kOP3wuO nOW5Y5Z9bnGPB/vOBlSwGNNjXj64wDjGXAqKgBUoAg+oImArbpkVjHK/R+Mj7DCUTm1tZnec 9NVjthRv3ZIJopHbmmzVYNDGGKwgDDtTebN9fd4UqdUgeYLQlWfIJWK9jODn6LPUWrm+ACZ3 MpQMJoO4vJAgsitI7jwu6gaRsPvPnaH/VX5fUqGorD0fM7vTF9mc1pd3Xrm6f34/n8T1P19w i2/vdP+XVb/ErteTRLO7VqeT57gKS9v0nr1h3mCy4zks+9bnO+9NsnJ67sia93DSUa8jQe0n Lnr8R6YH+83nN0s879yMX1axxyfp8LRXgmM2x4duPL6pN2vpy5WKrzJ/9fs9KmnThOPX/aI4 vusmJKSI7K8x2a9HzJxJqiY+SSMXvRpzpqzqlnfZmBcnXJ5Yb01Sir4VzFwSg/WJzmjm65+x uuzaScuiPktfjlvVLLqFTfGScXUp+e/wBZ6J1uMxZzKqbutFn6jt+wKSl2xsm8/n5h1dWBs+ 9qsKMWOLp0Plm+cLN+M/t+ub/P6lRc1ews6Q39cCi6winYwZx4Jkgg+TfN7k6RKmb08nFgvE 3wTS2dKGrgmuOBzByKJ5VG4umkkWTSts4biueHivVN+y6x1c3nS6bJs0J+3a8grJcvHfHp7F zgXrW1b0KV+xPlY34A8rF46MTKSKgpAEdag8opw/oeenn4uN0/AbjzCVo4KQbFIQYsgoMtKk IIT9lTMx1COCovqJ52Fga+eyyTWDmZFdLtz+dn3e+Z8L+sXhlRz9yEFKe5e1P+/6fMY2zqnm S6cq07f1ZxyJJ1wS518Y1etK/+0bByzwuOyJT1i3Pf/xlOP3wvH7V3bNsLU4OC3mysMk1wsJ a2dfuzltxOnCPTdKH1sGjmfentWpfTvN62dvruXP5zg8t7qi2eEWv2h6tq12zraKrl9nBuzv 53gnfXDPlvOmED2vWLnzXh7l9snldu+stTt4R9P9/Xhbl9q9tuLpD3/d1upu/JQv94d0Hrps 990do+16f34qSet9nzy8PV82eBDeyraF44lzLeY9/ez7jAFVAYE3X46fcLRf6q1FmlLFuq6x p54V7P7GbVS6/4OlC/2DLfPc0w91b6v0Kn5od4C9/VhE1fWX90Zvubp8tT5kW/z+kT7NO+ba fSaaOnJgVESLHVVVm+IyDy7p/b6wwLtwsSuZcat386HuBxe38z4ecbvz7e1/xBxlnzrLK4zt 2Cmm/bCBd1IfrLw4f9HhbuqdRb56y2b3c713Lyze45v8XeWI7pMqcsXfqipcVu7+Jvphc/Xb yTzF5ne1/Q5O9TmUsXOR58TmUkb3gI1pM7Zd876+ZdNhybf5yRan+JzEdaWbVuSvrSqfm+P+ 2+yJLjntAnmrrVXlg6Z22F3+YNxh7zN32yYcWnBfeOk5LlNPsht9UH7whurOqrKfuf7vHfcP Gnw2rk3F2VeBi3tyUlpmH3JZ9pYsthpFFlukG0qB48wTqBQwG18GFJX8LamYR5LUhvT/lA1Z f0XABWUjjEeGdKWKRhfU5ZKw+49fsRQzPqwdDFg7GKB2gD239uErrbMHZ/1Z1TfFznHBPzz+ boD3kt5tOmXfHpj4zTbLMHeW8Icva+zbXgjN/rH5WbuHYXvnW2462PU03oLb++QkhwLpxDGl w9srNi4Wfn07a+iJ2oVJm23ZNRt/W9N5wyibjb/OTTs83N3idkbuLZ6oY/PAm2utE49VRW4d cnYfh5mzNuvJEeWTboMrWv4R9cOlMOk6lTQkf2W5xCngZK+vXly9aOVwenDBCqH/TYdd5S55 u0q7P3h9tfNAZ6+4VL+lo7SXmnfbKhx6tq4uYtbY3z7f/PmENr/1qJw65NakhHHujysC067N DA/YEDRg/9Ye73gnq5jdKzdvnB025sSiQvbT+NRZ3iEdarqqpF8m/fC10/rWPuOO/PEDc8K0 58MeHhftnlo6cUe1t77DMDe/7476+oV1mNe1T5djX1TO3uDhs2pNxj2x14jLfsJFw0qudBhy 0rtvD9G+Lf17tmc+/GXUoMDTPlc1Q5z6ReVVvcAu71jHKB52vtq1amebUyl9b3atcLrtI9zh ti3yC8G1PTXaUZe0N9vX7o6av//BXo/+58dOuxcnJFetnV57b9CSjW8ubMq4sqes6PO6M3V9 bwr9V7n4rVw1OrPwxuT0/GGbA8f92v/rwbvz/Pwe1Slr/GawZ/QKTdhzeXzkpH02sftPrYgI 1M95rnqRTwxguwwZPmdBj4Sgcec2lbS6uDj+j7mbdkSVK+aduHSmZKqxdtaB2nm7ifJXXzyb vC5pbVzQgsGyb2uLJaEbvREYv2Fd/aAom17xaAO6MbgzI75vYRF/+c6qA9xffCYFkwOp4gZ/ hZpQHlfed4LwL/3SB+xbsGvBZjVelAwjg4bxeKjMDTUpcyIykYw3KXO9P63M/Ql9PVm0BApP sIrKyKJSsmiW0UgcJlk0luxpYMfAWwb9q8ss+FcIQDO5UqwtkGh0nCy9kuxlJMAgg9vyCE8s FoMPPoH31Iehe+rUdzAKQE9HfztEZvyODIfwbOpCLPPxhBXzLiUXuHNOntVntltoN7fZZcns +b3njj5RYD9zj2wYh93jRY32F+XYd7t63rI9HL47es2yJ/Lzkt3tQlaUDZGNmzl6SlRiyln7 2V+ccO/r8eSz3lNExze9zb7aw4rjv/BG9zYrTm3xzCvteuW29FBk9/xRPk9cRq+cqR877Y8j HRlRnfZOdt6+fI2F/cK6rFdZnDnlnXp2yh4glHjZyFUD5829NvaP6hlPojpffBN+fGfIA1WH Ddc3+tYdv/DEceN8v7J5cY7d7R5bTzrjVcNzu/Jwf8DPgxZ/K+xq+6Pt3h/Xb7i++bfzriX9 BAPCeCN93b+s/MP3xUV2N0I+b3PapCyVetVWfU0vC8uVeCe/HsU9XeIy7Kqr4p5envGlh9p1 tGBV7vVenWTLaoaI0ifUeEq6lE2oPffkxeOWFQt8L/+0ouz4/SES/tVBVl9P7GGZZ/mLZWWO V4tdYvGWh7//2Ia1q5Z/wNHv/kVZ4L2yZxWD557FzlRE7Ux7UrbCpm+M8/xCr+OY//7KhSt6 CvLahvx4YunSJaNGtXsVM8dr7eton8Kni1/szt7at+zK3Zx893t3QucXuPV9f6bKJyvnxsZX b6bctSu8Iw/f+IasY8VOr63NUUpmdf9lUWp8wu7C/u0q8pvxvEc94NtW9ny9+ujyIXsqShb2 H5kaHyOo7n1oYe4g28KY7LcFS/bsVCpHHBLpXBxGJf7ELWZtIotZ6xg4ThbN+acLV9O/Dqy/ OVJetA8mHzqIbZhce9M7L0CK+p4d15E0nXUlfeoXsrggtb0tjVw1/fGjM0XNa/13KmeO++6u +0VSarLEnptKJpd3KvRr8qu7yR8+TaWiY2H7j+7sZONfERGNajOrGMeSoqevHPvdYvVAX8vz 3KGiwO1V/ax6ch09R23Ii04evDs02CnU+WRSRvsUy3OiWa635i1oKdcOYm+ousbxd+7gGGX7 Wj5xdrTix9nSvuf3TmbVZj3gTvj14reH18+qm7ay35fq/DU4a8fbHVu/P3i77u3+idi5m9sX SZedCD+gODDs9e3XP7geLwtT1HW2fPwgemKz/OOe7/uH/3RlQNvUWwdKrJvvXamY//X119X+ sheffcZcF/NtO/4o71U7brQ4OjPi9aA2dQm5bvxv3q6JcZocnrJtxN4dK3kXJM67ugyYbsHp 6TFzyNJpN2+5T7pVOu+ngmc97npkFzuOwA/vSO2YtdzBq7Zj8tm+7EHekyuKGX7geNK+3keW 3GKGKxhqhkJz+j92Id70nTaTmBxCupmGpF39HUMcMDfOWHCd0C+Ou3BDeFz4GvhBREbcHhe+ ONHvwN2OU11Vp6qzPBd+V9DokgnGCjfe5UvGpP5Mj7Q+Zfq7tmP7+Ae5+x8Y8uTc1cf3v1hb utDnFi+z+V37K+dOT4vvMKLjstoFhUPnB5zoMlTWYs1vVzeOaam8w291XH/hvfqBTUXvxY/7 jPyyk2jgYq/7jKoAYWmk96n7L+2sxHdTCsZYF4wp07gMK5cN8rPwyjiw+WDGolP3xRf5udFb 3148d/1t8bvrkrRjP1zdXOYg33di5JxHT3Mjv7+0r+CXdz8v32a3hGuRdD122/bvvVKGVDwZ d3v2xWk7NtkV3XVZ1KPLiOyvjw7h/3J7+enzy6punTtvP9plwNne7FOq7b/6h4+729uheqxV v8vdnqxNi908ORd/sHGv/+OcFZO5XX+fFon9H5Hg2m4NCmVuZHN0cmVhbQ0KZW5kb2JqDQo1 NDIxIDAgb2JqDQpbIDI1MCAwIDU1NSAwIDAgMCAwIDAgMzMzIDMzMyAwIDAgMCAzMzMgMjUw IDI3OCA1MDAgNTAwIDUwMCA1MDAgNTAwIDUwMCA1MDAgMCAwIDAgMzMzIDMzMyAwIDAgMCA1 MDAgMCA3MjIgNjY3IDcyMiA3MjIgNjY3IDYxMSA3NzggMCAzODkgMCAwIDY2NyA5NDQgNzIy IDc3OCA2MTEgMCA3MjIgNTU2IDY2NyA3MjIgNzIyIDEwMDAgNzIyIDAgMCAzMzMgMCAzMzMg MCAwIDAgNTAwIDU1NiA0NDQgNTU2IDQ0NCAzMzMgNTAwIDU1NiAyNzggMzMzIDU1NiAyNzgg ODMzIDU1NiA1MDAgNTU2IDU1NiA0NDQgMzg5IDMzMyA1NTYgNTAwIDcyMiA1MDAgNTAwIDQ0 NF0gDQplbmRvYmoNCjU0MjIgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGgg MzMwPj4NCnN0cmVhbQ0KeJxdkstugzAQRfd8hZfpIsKYR1IJIRGSSCz6UEk/gNhDilSMZZwF f18zk6ZVLIF0xnPHdzwOq3pf696x8N2OsgHHul4rC9N4tRLYGS69DiLBVC/djfAvh9YEoRc3 8+RgqHU3BnnOwg+/OTk7s1WpxjM8BeGbVWB7fWGrz6rx3FyN+YYBtGM8KAqmoPOFXlrz2g7A QpSta+X3ezevveYv4zQbYAI5IjNyVDCZVoJt9QWCnPtVsPzoVxGAVg/7ESfZuZNfrcX02Kdz LniBlBIJopJoQ3QkqpCiPVJcIoktUpIixRHRgeiAlO6QEk60J0qQsgjN3lwlvx7vPSUZFXym 7Ji0OwpWFNxSkEym1FVGXlPqKiWTG3E7jMqLxxtJqesNdV0upwgusv8Ol4td5n+fmrxa6weG jwQntcyo13B/R2Y0i2r5fgBV7a+4DQplbmRzdHJlYW0NCmVuZG9iag0KNTQyMyAwIG9iag0K PDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA0Mzk5MS9MZW5ndGgxIDg5MTc2Pj4NCnN0 cmVhbQ0KeJzsfAl4VEW28Kmqe3tJ0ks63dk6nV5ud2fpJJ10h2yEpLOxhbCrCRBJgAAuCAgi MCDgBgaXGWZAxQUdZxSJDp2EQAdQGPd1fDPujp+iMrhGcR4y/kL6/qduh82Z53vv/+f75/v+ l3NTdarOOVV16pxTy+2kAwQA9JgJsH7SNH/gb9k9mwDIQqS2zV3UvuS6cQ/1AxTfCEBPzl2x 3KH5IXw/wNhXANT3zl+yYFHT7GaULV0DoCpecOWq+a6H550AmIy0HUcXdrTP+3TtVmwLX2Eq WYgEfZH+JezfjXX3wkXLVz7nEOOx/gJA4OCVi+e2b1l/xVaA4xMArCcXta9ckjQnYRTyx6K8 Y1HH8vaXq696HkgVr8+4qn1Rx4gjH0pAEuoBio4uWbxsuZzU5UF+NpdfcnXHkq6MfjvAqDBA vBX4XNUA33zy3nOzDZXfadI0wOEhe+QJjt9avUV3Why8NW6XphAoaBV5DojVzmgDXBLXf1r8 YXLcLkjl/ZyD+HlcRvcDPAdGyMW2FLEfLkazDuC4FLmMlZKfgwgacbsYhDziUfAE9gDMpyYi UioyURC1TDgCejkEK2fGxgWY3lTnwJLjlCDeHh1NgmonORACcujDvwGwpeIEPlPQqMpJBpem Z9Iu2M5mES/8CMheokPerXSX7DxDoyB/ibQSbNfwY/mfAmyzGhP3JYjz4QWOBUAbcPyJfK9C vxg6xeflp7H+J0x/EJ+H22Nt5cPn96XaJT8hXiw/j/zVKPfaUB9/xP70wjK44z/SgdlAF8Ny 8Hw6tivEVMJugzLEWYhDtDx6jwDyi1jPoeXQrLS7DcxYnoTjSlwOUyXKZCLOx75zsd8B5E/n dJTNw/lI7DY5gmnWf8dWw3AO1DYS98/sT4DoWp7+mX1yOBMjF9B2kd//s8cZhmEYhmEYhmEY hmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmEYhmH4/wWE38P8f7UOwzAM/6dAtv+rNRiG YRiG/ynA/y5JWBq9S7U1+qhqS7TrDJ29KG9iH8sHhWKYKOyUD7JHMV2J9RVYf14+SC+RD3I5 YQ7SO+WDYlB+UtguP4/8caxXkRsrxCGvWI6ynbBYuAe2sadhhfg+bBZE+W52Ejb/62b9/x7O 2GsYhuH/FtRPyM/8FF9MgtWK3DioVD0OlT/mq+ZBpfgy3MbLwsa/5/8YtG+fG098BFb9lKzq 6lh/qmNQKYyS+5Q2v/7PxxiGC0G9HO7Q3Dhst2EYhmEYhv8GsKGUEfvOC1FhDUs0AQT4AgnF 4MCSGVyQAwUwEkZBNdTAGBgHk2E6zIRWuAzPuAfgcVJE32XXObQOr8PveeWUIMvAvx+TBXlQ MdSqDls1wVSlVTtc8Q9agSzLn/zkMxef30TJ6Qc+e+vITZ+FP54LcPbbQv91EPCcPg2H4LB2 UBtVZn3uK0eUxr7Icz4gkwkiL8XFJwAYjInnMW2ZOE8XuMGblZ2Ti/MFKCwKBGFESWlMoApC mNc3jB4zdtz4xgkwcdLkKVOnTb/o4kuaW2bM/Gd/m6WL/QPiocP/UPZNnr0XK/8P8neo9qLp oeqqUZUjK8rLSkcUBwNFhf6C/Dxfbk52ltfjllxOhz3TlmFNT0tNSbaYk0yJRoNelxAfp9Wo VaLAKIG8Bml0myPsbQsLXmns2Hxel9qR0H4eoS3sQNLoC2XCjjZFzHGhZAgl5/9IMhSTDJ2V JEZHJVTm5zkaJEf41XrJESEzpjRj+bZ6qcURHlDKTUr550pZh2WnExs4GlIX1jvCpM3REB69 YmFnQ1s9dtcdH1cn1XXE5edBd1w8FuOxFE6RlnSTlCqiFGhKQ0U3BY0OlQqnS/UN4TSpnmsQ Zp6G9nnhyVOaG+qtTmdLfl6Y1M2V5oRBqg0bfIoI1CnDhFV1YbUyjOMyPhvY7OjOO9x5a8QI c9p8CfOkee2zmsOsvYWPkejDcevDKauPpp6rYuemuuaN53OtrLMh9TIHr3Z2bnSEH5jSfD7X yfOWFuwD21LP6LbO0Tj0rdyIqX5UhKvPpxKbVIfUwCltlzvCWqlWWth5eRv6I70zDFNXOXvS 00P98hFIb3B0Tm+WnOFqq9TSXp/RbYbOqat600KOtAs5+XndxsSYNbv1hqFCgu78QsdZnlJS xHmpcepZcxKukTQOoyDsmOtATZolnEgZzzrKoHNuGYohtBBsFZ6HbrgsrK1r6zRWcDpvHxY9 RsnR+R2g26WBry6ktA9RVB7jd8CLPDjOxhfyz5TDPl84N5fHhboOHYk6Vin1Efl5KyL0a2mJ 0YEIzQeTm7FZS4Ufbe50cq9ujoRgDlbC66c0x+oOmGPtgZDf1xKmbZxz+AzHchHnrD/DOdu8 TcLw3aMsektY4z37YzAmJzUsrAiT5J9gd8T4jdOkxikzmh0NnW1Dtm2cfkEtxi87yxsqhZPq mpmVDpWolSlcjMRZZ4V5pTkhLHjwR6VE8ryIWoOhqFCIY3TY2DY2lrfEOZ3/xUYR+ThvpaBz zYbUDFf4LqyPvKB+gXoJnQwVFry0cfqMzs64C3ijcdvp7BwtOUZ3tnW2R+T1cySHUersZ2EW 7lzS0HbGoxF5/2ZrePStLTiJhaQCo5VCbbdENk3pDpFN02Y09xtx6980vbmHElrXVtvS7UZe c78Dd1qFSjmVE3nFwSvQSDDQe6hGkbf2hwDWK1xBISj1uRECCk1zhkZgboTGaMbYQF5loBAe 2HMjQowTOiMtIE0To62PSWcPSWuQY+Sc/UD5ZYczY8C3irrpzefHg7LIWvJrEmA6e5WGwQZ2 9io+r7CX8Y3Tzl7uVdnsUJPADkIhphCmBzCFMYnyYXagt6EhEIog9hUouCc7J9CvMNK9gfU1 SewA7MC0G9NrmPCowtyOibIDdDceqHYU7u9JtiqtIj21tUOFkrJYoTc3P/BhTRyLwDeYKIuw fsiOterNLggcrzEggd9g9gHBxDSA3T/JDoFPETrU484N9LO9bENPhd1Qk8J6wch6wIFpMqYl mI5gUqF2vfAhpm8wyZgEMLGdPR/fYn+S7SBXkO3Y613wSw0JJdjXCetEuo6uY3T2ATQZkQ+T lJ60+YGIfLi3I30+6r2eLOOEJ9iNJIUrJB+mu3uKgqEIogIF9aKdFOzNimGnJ4YzHArukWLS acEHDqKdwpiO0N19LMScOTjQX3srvKMCB9n1/IEKDfTZQ55ZwcwIznPWPBT4utdTEDRjlTvm sifZBrRRp5LrOc0fMHLelJmBBI4nTgm4OB7TFNDzLkYH4xCFtN4xAZOnrlkR6gkEeZue3KCJ i5aOCpgOYIejICifCFk8o4KpnhEzA0aPtzig8uQGE3D8iBwNuT35wYQKfzBwt2eXZ7/nRY8g ekqQGygLpFXkVJRVsFRPCna4J9tT5hEOsg38AY8GQka7wc6Vt6+003h7YRBn9W2vXZn2ev6A HYUs9tLZ6t1qOlu1W0Vdj6G89jE/Dvx+KO4xuyvgknxT+ZTW9eQEFeTiRlnXk+nA3j7dl+kL BjLRGDzS1u2dMCkQ8OYFa+Lkr9k6KMeJfY/Yh/gLbFIRdGDL3urRgUyO/RUBE++pIKhUMUqV /r1BgVfHjS/mGA2pIGcwFVEowRZ0eQsDAZc3WIbjfx+K8+LgWq/VGeh8EocibB1/wIsTK7CX 2lV+VbWK7aC76SH6GhV2sN3sEHuNCYtR6g7G7MzPqtkkNpuJhpoKOoDOnY35DkwfYmLgx7wa 02KlthtjiMAkzLFH3FP8mFcrpWoexWDA3I6JKjKzfyTDVwphPayHDuATxgf7C6WXEigkIUIJ AS3BexSkpOBZZUrUhGri6c+ohFduHRml5KVKbg2lF+vuKNbdWKxbWKxrKdZNL9aNLdblFeuy i3U1RjoCr9k6auU5Oa3kTyv5ZCXPC6U7dMcduicdul85dKscussdunaHbrZDV+/Q1ehIFSkD HYxS8kIlt/GcDO4xNBlAe4gM4p1dx7rRyBacrKXHW2yPUHOPtxqRpifzgL0mjaogU0OQK2Lq wiQMYQZ2gdMJFPH9gJwCiVyM+Hc93lx7hDweQ128zxoL2Qle3or8FjKJB/FvoEup/xqKFPzg EL6vR7oSm93LUY2W3AMSHwQHCCqDrOjxFiD7yp6iq+01ieQKHJOTF4JbEWvAYOG4eqiZ1JN5 v/0gcUIm5VXY411lH8T2nh77D8GIhvTY/5c7Qrt67J95IwRrf0He9h770SKsheLtnxQdtX9c dIv9T94IJXvt/+Z91f6qJyKg4L4iRfB3XqWTxzKRiPL3F11qv9N7v/2Xsb473YrQDWjMrlCS /Xqc0jXSUfsS7GaedLX90lhXrZKiwUXHlNo01AfRpKBCnOjlHSfZxxQtsI/2dtnril61V0mX 2ivsSN9rL3cftZdKylgFktI8NxMnh5rkSF32rKIu+0WlB8lzoCadmHyhAvU69VL1Zer56kZ1 SF2mLlHnq11qp9qsMWmMGr0mQROn0WhUGkFDNaAxR+QjIR9/BTOrjBypBJ4LStlIeU5jb2iU aCiMh3ASa6SN02rDpb7GiFqeGi7zNYa1k2c2dxNyewtpDB+eC41zHOGT06QIicPLiyjVkrCp ERqn16aicJhuwmvA9OYIkXmLm6z8NQCPMxK66TYrxy033dbSAskrqlOrTVWJ5aPr/0HWNpT7 zkGq70JItYW3NU5rDu+ytYQDvCDbWhrDY6Y5ZjX307X0Zw31/XQNRy3N/WQ0XdswldPJ6PqW s2IYUGtQDIN6TUxsHWRyMYzudYrYpTExO7ZGMQ9HXGwn2BUxO9nJxTDMuFx3l72hvttuV2SE JdClyHQJS2IyHkXm2HkyohGOKTLHRKMyXIoi4najSJGbi3S73CjQ7XYp7Cnn2FKMvTbGXquw rzrHDsbYu2LsXcj2/ZOgo/Y/k2i4bFotaZzc3K2B2ha8NCs42bikSomDxL5R6637SQZ7F+Lx vSEOXzzjpVqork71GSuJv1WVEFYhTY2Ji490pl5n3S8AmpyLJyBZN8TKr8mv4SwMZ87S81fY IVbqdSOdOMjOIZYRyYk4CMZxwTSMyysawrltiKT6FkhtuKwef4bQMg7XXHPNsmXLr+GALbzT GsOj8GbZ7fXiy2dbfYsPX2Hrl/+EAaAxnIuNqnkjtboBXwbrW5Yt8yntfL5rYgXsmxd/DMtj NEUUfMvO0gnvdxnvxUfQphH5g97MDOUA7vMFU72+YL98nG3oNgW5cAtZxvXD9thbrI9lSr/L gLsHlQDxdgBxAtgxZbClkAogf4TpM56i4+XTIu7J0YXyx6wK94atQykGHtgJt5N4WAvXQwME 4DfwElwBS2AK7Mbb9XHyNoxBn3jgWsiBEAxCMmmH0XhQ5sDtkCK/hJyZ8uf0GO46d8MG+Ctc A2/BXHgOr6vbSRDcUAavwCh5ASSJ70AJ3Axb5T+DWiiG38I78vtyFMbCr+EdUkmmsfViFVwC q2EN3EpSSC4pI2vAizqshCfgMDVq+yABT8aJMB2aYQHsEfhOJ8Jk2E3eZHU4UjNsJiPIYfkx PIY92DIfakgJ9cn7IRNy8WAfCdVwE/wK7oK3SQEZxYqEfkjBObVDP9GTZOIih+R7wY5PE8xC TW+FbbALXoaXiZ1Mp37WJj4a/Qz0sBg1XAub4U34lsSRS8hKGmGPR6vly+Ve+RlsXYrj1OPO uxKl7sTZPQJ74TD8Hm3yDrGRyeRO8rWwXAwMboj+MXpETpa/BQPqehEshKtgHdyCvrkfnoL3 4Ch8TwSiIYnkKVpI32N64X4xRQZ5o/I5nx9q0ForYSNswqcfWzxLHCSbBMly8hbVUwO9kl5H u+hX7Ba8S3wifCrXyTvlp9Hmn4MaJHy8MBW9uha9dgf67jH4HfRBBF6AL+A4nEBLXk42k27S R/5GzfRx+qZwWnxHPC7fJ5+GeLS2B/KgEJ8gWpB/OnkJar8dPfUivArvww/wA7GScnId2Ug6 ye1kK9lGPiQn6c14SfyAbWOP4ivuCwIRAsLl4mbxiGqKuj26LbpdbsTZJWHfxRg3VWjDDozF ZRgT96Ide2AfHELd/gan0C5JOFs3GUmmkpVkDdlA7iAPkHfpWHo5XUyXMMJsTGJZbJNgF7qE PwrviavFzVFvtEUuUE7IOIyGkah3Mz6zYT6OshqfzWiH3XAQvfU8Ru3nGM3fwSkcjaKf44mF OEkWacDnIvR6M7mUtJOFZC15iHSR98jX+EacSl30Dvor+hD9E/2ULWW/ZPewXvY6iwqyGC8G 8GkUW3C+XeJfVRepblHXqueoH9G8Mpg7+MLgB9GEqCWaFZ0WvTF6QG6WV8jXyg/Kj8iPy7uH /l8Uw9jFd1/0Pf+UtwBXTiNMgEtR/ytgKcZkJ/wcfoHPIziHXtgDz2DE/RH+BB/Ah/gcg8/Q s18qc/oOTuOcUolEijBeSsksMofMJ0vIauW5ntxF7ib3kDA5RA6Tl8jr5G3yDjmCz0nyN/I9 NdEk6qeltJ6OoZPoVDqXdtAl+LJ5F72HPkz30f30WfTyW/Rt+hcaZRnoiQY2lrWyS9Eiq/DV 6UG2j73B3mTvsI/Y92gbAX3kFCTBI1QIC4QbhCNiNtppnni5uAOfp1TxqsvxzalX9bLqM7VK na0eq56sfljdo5ZxpeyGLbhKzwOMuJ0kh85ELRl5mu4hvySv0h5hgOpJC1nNgOYLeRjjTXCM 3sI8pIqtJFZcx7fBOLw7rwE9vY+Oif1fL1wd9RjdZTBdfF2wkEfwRnUz3mknw2sYP40oswn2 g0d+BxLhF/IV0EdScEV1yHfjWlhPGslhXEML6FL6hXCaGTFCP2LvYtwcw7VfTLapXoZZ1IfR Ngp2QDK+x2Whl1YRBy2AGXA324SedkIa5ApXiriHk7/ii80uuo3eQvfIL1L+P+VEmCGMwWvf Edz3c/Hi8iX8DnV7ib5ObyF9goo8SCahDhlMg/HxPLjpfdDBriECXU//XXgH3qXldAbLI38V ihiDyeinG6CFfEk08BjZRr/Hq/lWsh5n/xfyJf0LLId/JzIdZHfQheQF8jxJpj5SywohSj8i c1AbN3wtpuBlsxTXkQrj6hjdxebjS8Lr4lPsfaGJ7QWBPElK6WnmoPWkiZXJA+BRfc900Tfl OqinsrxFiB/8Bq2zFN6Vn2H5Qrsw/lTfqddoCtnCFonN8l+ja8UbaBXMFz9Xj4JVtA53iNfw LNoNueQbmo52tyOlAi2VIvz81Ck6BWz0OPkOVpI7cHW4cSbTcefYDQv4Gw/aToU79F3wA77b PAVN7BrcZ/bCMxjta3BvT6Jz8ZxZSKbiBbqACMp5wP/K9VuB/95lPfr/CTxNu7CUKf42GoI/ 4L53Ma7FP5PNuOrG0nKhGabhWXo9uNjb7Fu8OFL+/+nEDJGvYDVU76Hke5U6QueHkkAUvmcQ pxa+J5CmUYnfUxYh43u1v34fr08nKwcrJxpPVDYNVkI1lo2nMSsqdCY6Ez2YkQwBTjvY4dMh Efcoh3AYo3K7/CHtRO3MuEPU9sYxIBG2O6S1TLRqXSkp6br9+C6mIq4eeJhEyOJ9qRMz05y1 M1N9OEzTwImBE4MTGzrqj0F10+DJyuqiQiKVlJSaSktKS4KBZItZrWIqTLyoklzeEcUlpM5b lJ0WiDfnWzwZWUk5qypUSdf7Kit9uZWVZHzfoe2kasQMf0qeJ6e6M/rs1sSy6H0KL9dXiVbx 4g59P2prRAuvCmWtNpB4Y7zdarTaBdziEu8yPmoUylXlmRNU9fo6g2iMB3t6IkTIjT0aTSKi kC6FOXFa8QPwUvpAYkQ+3BMcgWj9vrwRiWmOXz+vTMznw9mcndhApXGAJJrK8aeocGlrK7SS pBI+wzNTVDNn0gVVutWWIOjNxlGSlKX3pt0WnWPX6ZLG5Eo5cfqRm5lE3FebQ640yWtPz74s GP0zyV6XV1WanZlqy10TfRdDkuiYRFNwnnooDcXF6616BzC9lk9kr4oZcQLaCAn3QZrh4KmY K85pSxJRTRLT8ZxKRMdVaPC5c+N0ozpRhezr8qpLs+0pGd4NOCSBW6PjWSfeCY1QuU+tISRJ m2iKkA29BsXxDb1i3Egc8+I+Q52YlljbT40wFAODR42DA0YculoZVu3N8o4wlppICjqeWsxk g+va4uyt+8j21P5rtuyPzjB+8rtNnaRWxrtatnTLrjcGd548CER2RsdTuzJ+3T4tjp+oTUr8 B+OH4gzoV7tIxXRU77PuyVyLk61/p0ZpckqyxaimJAvNYBpRTHJd1wZztkaiCxQ1xJ8lfYxq RJ+IRp+PvmPvfPQN2oJqoB5fRmVixJPQDP5QApjN31TryTo90SfuJ8tBoH37oCo+zbLou9js vzo6AP7WpQPGF4sK1TjSiOIsLzdAcczyKrWl0e9WCYVMPTI7p/rWmz5yFWd7TAZNoTYx2VdV G2jZG0Dbl5DVtIPIuNYzeuEGiiswca9I04RFt/NRjjYZj4J/EKeldpbSjpzBH3KIfNNN2K5B /hx17cW7VWY/7hS/6FHF42awvE+blnBGwQGoxpal5y3AXb6Rlbm5I0f2juQ5Jv6b89XyAE1j ndhTCpT2gwr7AnVCBJFJ6bJHu8yAKBRvsNgt1JKWepVi+BOtuFBwiIHqAVTvvEEuWPG9fPli 2pVbMTIHx2SdI3MV0sjBvJG5OSM5EXVwR2WagedYPJ5j9T0JThUOH9KC2vnNujSSNqRFBneD gfaFdAlVhmR7Mk1Oc53V5aujXBt/K6rDHXK+QqTk732jUpO9MdVGRu++LKDGU0RTmZVb1Vib uohtGhnbdUae2l5Z5zAbtMH4RHNuVe2Iug3FpjJuMw/5szCLLVN26OI+fkNsZRG2PaQXhVbs WpWOuqdp9veTEbGlUonbM/j53nwStxTclpOcFuXxCKWnXuSJLZt6As8QeE7+iHXh6nfhjW13 KFGdpramWP+gedcqinl6YzGLyG/0GhOLXQo2cfxByGtOLT6Ed9Z37exe4RH2mPZhl5DmmMXm OzdrBYfaZn4wrjyd4VJaGrJIE3O06kv9tmrbJBuzpRcmPquvS4mQUG9ebJcPxXsn+vMm5dG8 NP+Os/q38v3eeGLwaGzBYWAdqx48SpRtkbS2tiovvq38AAC+ELySS62ymM+5YGgvEi48DhZ6 9ZcSU559SfNFIzKdhZJU1PWr7U/kVUQPrp455BzStC5CpJbqukmL3GabeXSKqyCQ0/zzxxe3 1F784a7o2+gpDGQfxhD/L6pCm2I5D/lFaAOzQLKQypwaV5ykcqsTJOKXqqVJ0mxpsXSddLu0 XTogfeo46YgXnaIkugudQVehu8HW4LrItcg2zzXfvcJ8jWun6w3Lm863pbfcSV5XobnQUmQT ciDP6s/w24SsUFpFsTeUVFGc5JFMZrckWZwulyPOFG+LszmdEWoNjXc5M202LdHYtBkWqy1D slgkp8vsdLokk2QxZRIwEwJuj9kjJSVpXcBsGRlxcVoNcyW6qAskp8XsFkzeQgux8F/FxFcU WyKsdp90nSuUZuXOV2iuCKvqA06BIQqeFrUhHQkZK4oNxI+XO/Q+m9jn3Sy5wLGfzWAz0a8+ 9KsPD7yTPt+JY77WRFMKP+da8fZgxKe60lTu58G6UV/g06w1PoM41SdgIRXwUDQePptrvjpb U+uNlWrRWFmprsQgJz5fKz8zYSlZShgGREpychA3smCAH6GlpU61ikdJCpLw5oA6OgX7Ao0h qaYpfvCL+JSaHJsxPs4YXdPpTy2ujI8ujh+/dAnLfSh6LblIvOLUXZPSsi22DI8nIynPvuyx A9WlqY4C6vGw1ruEidHewc/574fkj8QHMSay4I6Q222si68zzlItiF8etyL+2sybjduM/GV7 T4LuYdNzJqoyEBohTSGtxr1FE8xyMEuEJu1LnJeqBW5/ltlDN+ESqe3J2sTtvMdcDif4b0hC pozQmMbijJC5fEcGyejI7lgbWzR4l/h80Icr5ygadfBodeXAV8ajRYXQuhRPKSZlFTC+TpSV EgyUlAZVguRy48owuYOBFIUkPtjhFkT32Kvqem/uap98LLL53Vb/VdETBx6W4eavyY7X5/6s JDXVnSteER13VeWlDVlz1h49+Ptnv1yzYfdvN5/+xQfkN8f9ZrMfV8fTeKd8SJwA6ZAPH/ZD hvxZKJhY7vddYl2Vtdq3OasvU6Uz6206YgEbsWZkZJotZrPZIhXo8goI1WnMBdkWszFnP1sH Kowxb0q1aj++wvjlwyFtUvkSP/Fb38jYzwhYWMMek8FMzBGybG+B1pxiLojbT5ZhvzziKn3c Mkvr+OeqZnk978eMV7De7FQFh+LzkRBKLTeHEst9sU+zmo7ybacVw7Tpc94Bxlo1bvIDPC7F H4cj3458pNTpEEwWs54KklMJtZLSJGVbEokScGhbt3I1wI2K5CWQbpJEtPfPXPZ19It/G3xK N8manWRzH88onkCaou85Lab0ivuI7uLVW468PULM8lwX/faem07dufcSD01ItOWuY8XtpVm5 3tPaq63GTFFbE2olo//ty7/wG8Wf0OoGtHopeTT0cChtTxq9KW1r2m/T2MaMm7O2ZdyZ/4j1 kfwDQp+pL2NfftyCjBUZNwMTDWbDuDQWDFnLBZelPM2VZKlKtxKDAYjBaAR1nl4/W2NT29y4 tRQUl5Y+6bcVqMZS2i7aVNYbU1KOp9usQh7J8/hseWA0ZuL24nZ7SgvyaIHeYLDk0ZQCm8Zd lu1xG1WPqkOSqdqvJuqMR62hlNRiK0b2PtuYYuuWgi35WA4lp2cU78j/Jp/mp5fTXcSv32V4 FO42cld7FFe7iZvLxZtTit3otfW8jq4v07pT3GWK6yvOcz0uipj33RhFGYnV7kgsCtxDUcDx XgwCNwbBeQFw4tiJY/zs8TWdOO3zHfW3+o6eiYWBatyoKv8+IFoLBr4C43fkAqRwYkVln9qI 8kS5MPiGNitcmcpiZBKPGK8kxTauYIx4YThJpU5FLAvvFhK98551m1bneTZnm6RRczbckJSW WL/y6S9bPetPfaabaM02WT1fZ4xosiSwP0z3qNNdNYWPi2zws2lLouaqPF9xWrS6xpVu1nd2 RTdiYJkycm5ggbnFXp8n2l9gH+EuSDXxiPoDRlQLRpSfjO2zuAyJVUXc+DfgSSTqLfo7vY94 nxD6Evd51USvB4L+xnjR6Xi8JNtSbMlZC/3+9mxb1pl4sRjMNovgIZ5Mt80DBkOmLdNss2X6 Czy0QKfXWzw02aKxFWZn2jBWQB1S09fUH6qpOmsLeAu9Ie9k7xKv6E0vgjcMPCIyWUMowWSw 2W1+G1tvIzYeCYVaHLkwDovdp88LhFgY2GLutw2533ZmE7Ch/20/3gROLm1C1y896/rK/8j1 cJ6f/97zG9Hza59R83sY7ha+Cxwe83fsTDrnae8ZTyuO3v5Az8prq723ZRumLN6zwlF6RcIg ejg9O8nq+caWHpyQIGTM88aPK8/eLAqDn45fFTVVZo2qiy5Y5PZkqz3KrpGznhXNLUv3mDzR R6uya5uMcXha3S4fEV/B06oEng5NSMLjxK0rN5cXjSuaYZpvX65drluVu8J3Y8I2+17o0+63 vBf3Vnai1Zlhs6ab0vAqF6DxpsTETJfT7Eo0uJzW9HS/x0DtlNIIo6EEdTC4pcTP9PM8Wis/ xYYOs5JNcAA38jKIx5PMkIOj5vDTLKejtGPWmTfiz40n+SnG11rlV4PH8KqAZt+oKfDp+fLB WvmPNmHgu/CQQR1MlWg2cRMnKUuFrxo8+PmbqQpvgm6KB57ymcHQkfdUh1f7+F3RF5+976n/ TcmXgLdRXW3fOyNpNKNtNDPSaB/tGm2WLEtyZDv2JLETL3E2Z8FJnATIRkjIQhNIAiSsWSih BQIFAoGytJCEQJwEJywJbaAfbb+/dHn6PV3+Flq3hYI/+rUpLT+x8t87Izuh8Pd5ftszZzaN pHvOe857zj3j7xf6F17t8KSW+ExEkemd6rbHl+/59sDPq5/seOB/3zb45tc355zuiA9Fv3k9 0aseqv76T9XfvV79iJPgQGc6yvsTCRhOem+rPteceBLSt78IJ/6qbUGeFzMYSWdR2tSJkBSA 9x+HYVvFiam0YuNbgWQLEvPEh/lBL7kzCAma9BM0BzkX7+egG4VHO8P67S63O0AzAk0znJ0g oJGWZIZmXa8SPHAjJDAEr9g5Gy3ROXoHfS+tp3e6KjQuOqRLWLzcUKKVeKKItxVRLu2kz9Lv 0O/Sf0FXIrOnFQRtGqNHommRllQ/yl/mR5G3UqGBUaQ4aIUztdGKYEYrpwWtRGubemcauVha CXDq3mCQx1IFHF0DnHrcFlDlsURFe5Ej0kbvtLm1kyZuTLaqMqLu71RohFJakQX17EtC5Uvm wjTcXkKryiWtX0IhL2FWzSc2ptOxLwKQimOzUeHphJ+aRn9inevNOEKRjwKeUq+ZMJsUKZuL fRh0N8ZUkAVyW8nCyqInysdi0CZ077jwvzZK7giPdP8aANRypPt6wjfoJiDE37oFjd58uDBA cGFjyT/NO9V/hW+BfxU4Hvov/z/8TML3lp9Y6b/Lf9JPxv0wG2btrSCPVgG89ZIBt6EpCSbT UPD6683QB1PIqepgIEvm/XYhmvDHdXl/Pe+PG8l6Qh2MFnb0TfT35puYeWNMqUjyKtfUZ9GV JK3zk7xH8PPxDHoxx9j9XEzCXhpC1UtDwo8MkAl4vILH40VfIuLzCj6fN5vJRKSAIEkBjud9 8VjM7/cZ6wFJEIDw+yDpkTwF2esJSCxyyU8f9yBr82BjmPKtogfr1+UvqvuBJnX/mFDyqPHd ai8GPTs8T3hIz2vE3aABYagXZOD1iklSUEYqKWZLUardQKrdEEvFju4k3VLwiJLokQpMy3rV ipEZs6OqlYwMq7RA3Uzj1ANZy1loFyvjmQhb+x0zn106lIrox3IS9YixduRLLOuL6/7xeD+A 4WPzuZDu/WG0AniFLRcgBzaAaGHIYRizOkwCatkLskoYIccjhZrQwHg80UjsuZnkYc9aPtQY /Mzpjc9x0aNvMt7pslSfeffCB/KOv0rl1abqJJP36kwwAhOhltmMfvpnr+raYxRlmbH+wtM9 6YTgj8WcbP/DJPfZS7qZF05dG4slUNwoRG8k/xZ2UTHsvb538T2DC1lwEl6lbKZ4kZOFMtcU nwo6uGmO1cRW4mmXaS6/xXXcRd4OoYkz+00qYUzGZH+SIWg/43OihBQbE2b6kBAc2IR4TuAh 4LlYNBpxYqA5kiYTw2DLMQo87eRTMsc7nCzM8SjpVARBafQhwl5wtynCBmGn8ISgE4bI7CAN HsYsUDE58QVOfIETGxOP3ezZwWS2qEp/VJWK21Nqc8507nDe6zzq1DtvSdG86BR5Z0plDefG DCY9bihwZDj9CY7d1eFxk1FB1fZ5QzH+f9qHhuPjMEhbiyDdj5M15I8g1PheOKF5IVw+isB/ IQqa/nvgU7/3FaeZLSZ43NweyonBUPWNaHXi/3jrFzPV+dZZ3qTgj0JLon+JCSn+F6TnqnIM uQrkoRyh3ObPvqm78cLgsoZ4QiUKnD9zC3m0JUvGtErde/rX1Qp4GLxwIhhGbl3EQasTbRTd Tb6mcLu709cTnksssPYJ8xwL/UsCKxxrfGukLfw2303SncI+/0OGB/gDvkf8xx1n/K8FvJTV yBP2BkB6Goy0iJNZuxlRALOyuGRWpi0vmldEcI+g4tIpoUltOgVFBh06p8PndIq7pBuC4skN iPJjssAOfKIqB9EFvB6rDW7EeiogUxJQPhaO4wS3HBXDhkuZr5qKkf+z650to9XVv3zspyte rsLgzuVnXu1ZfN9Di44uveGb9+mv3fyH7b+shi7cPXzt6/D6T+9Srn7v5Lvf2/erhev2wOeG dv8Y5bg/AkD3T9zTAGRYVNwGwklMC+2OPRB6NPYM9WzwJHUixBgYmMIWtxQxZqMrGWoOTdUv kLfHniIOhU5aTodej5mcYbZiD9vYVr/MMH5ZNnFOFPmB6PMDuwlFftlkCjhFhA2RMfqleB0w NkiSHRCc3cj4I86kLDrZCE6UdVAcTMk/M2FmLBL8cW6nEzpxTE/SKAdNqrZ962WMWCXETi0+ q/BA8dmJJyhQpHUiPoyPneAqzjFafIkXj2XGEAWQGi1GrNhe4SpfmiVfKta0UNZaoSYNNg7A kFqeQ1pKjBt3jbfFEzxWVa24BxXC+ZN37qheeGjJ19fGyyuZ0T+Y1vTl35UrV761sWPd4Iqb bmm/Uj/9xG2rvrM1XN13RyqYMsRiXc+QurtzkTr96BH/wuNXrthiR1Z98cdIa99EWouDerhX udnopBMtqU4wPdWdXgjWgO3gBmlr9kHDI9nnU6fEM6kzdfZnDccpwuBz+vZkSTJRX68z8xa/ 2aRj/CaPgJhwPBzzx+t1ugAvCDwvhMLhAIAC8pohmMzVeZJ1EAIPETebTSZgDIcg0GX4gizw bAZrLYAHPlsMYAX4AprkXUhiS2+ADfU/02GFCgR/gse0i68xKl4lRUhlvGJzt/I1ysTX9MdP clXwsZNcBRFDdRO/C197F/UUepedPOSxhRSQA+QLl3m/seT50s9YYQRj7ZL+L0XNmg1oJmAd C5b/1gfuwnlRzeeFSENCi3r/kgtRjZqVUDxCAAWxVWhGQfb9YvqszSjJvIoe/Zup25Pkg5ER V89UMzz9m3NvH70jv+xa0+gVSuHwf9x8czBD3A/Z6spZjSkXZ4zFSJQT5W4gG+Zk6xQY+/ae 23/hr15/3xWGGPEr+sy+9VuMuEfRevE93Xzk/5rhPOXOOzO35oglliXWJbY1lvXW9bb17M2W HdYdtu3szuzOugOWx6wHbKwMUpZidm52VWh59ibjduumuj3Gu1J3ZR81P2J9hN3f8G1wxHzU etR2mH2m7rncKfi6+VXrGXaw7mTufF3AWTfbNMvcZ1mUnZszGARR6DZ3WrvZO+oMtqylTkfJ /iEyoDDyckfk41DIQRKvwDoAQAUdtFMNxSKg2TTHHA7m83kijy49EdkdDu4Oo6zrhBR6N0SE tIiIxaDbW8RS8YYTxVyoLbQzRIY8E9OHOaWuxP0Q5WrNarp24iB4F0UCnECgC4EilsBpWAYt sPzSzbVsbaB3GOn9fHpErZeM7w9gU8C2MfIRO4IF2sDEE6t7E1RrtCLfUPPIWkmjNmGCLMCp 5WZjOXIYXwawEeBSfgIr37ohTB295/bdUu6HV/vqfvbshII0p8lgtftTvvjqsO6J21ff1gfT V6z74daW1ZsSnuaQBP/Rld9z+Mlr2if0/Xh5/ez+fd83GcIiQQbqq60tsa2PbJs1dUf1vScX rXpjjTNtm4X0fy8A+gLyFCGYViIkxp4FueoTFqjSZM6EGLKe3E0Ed4cIFhogfIU0AgaEMHm1 V0IsyIMNeOxIo8J6WQZ5cY060z4GJcQHFAEQodcgIBieM3rCspc1/YRTGTFSpSrTdZqMJDUZ CBY1auzyFHd4DnqOImo8RAReDtMe0RNmVp0iu8cyNk0V6TRy8Sc8OE9TqbVY8dQyKixf5vhW D2ZKNd8+kq7lTem2lgsoWWhpaRnz5ult7F8GoCuXxlvvoo0J6XMQqXS08oViaBqO1agiEbX6 eRmJhREchSMwozOsj/PZ8D3XVs83KLPrzKPHTJ4ZKX8uBd2zN997hS+mn179xszWrpjvwsIX k/H6WMxt7/8a+d2WTdcgvViqq8k3ES4p8NZrxChAWCWeAzTx7RPGNFFnIGq5EYf8rP52FgDa qGuErL4RcCpDwFlPLj3awDZ4lTBpoChCp9ffrjlsUtcoE5A16BtlCnC0KHqIISIzCCFLnSZQ Fo8G35opATcwyhDd2cgcOAU3aWMOc+rwwRnn073/nW5BzqY2Td6S7h0FiCem0Vq/qy6NhpNC gbBfnTue2j61vasd0X4qhBYLYYXPO6sfVH3QKVRXU2THp3s7MftuqK4mPlS/8d+Ox2FMN/4d AdTrbmchpI3o+7Hoe37xO/o+9/UglAkOfT8AZIql1Sx8UklNzhumqMWBwVxBKxKYMqUN9E6a ADSk1UGgAXgFDQINKGg8hsi7tkOgS7lSuWgjIFEbFxENDJ4wX1Qzxtq4INvY1vs7ZDzIa2zD EtnS77S5PLQD2tLI5tBAaWKXXh0pbZRgqBENTyPx4ehfq/Md0AV/X/1Q0F/7z9EOw5ZOzFTz F98n3yD3oJhegr9QXHTQGCrBO+Adqf3wG977U9+oO9xwMm3KY/IqmoW2p51P1xPlVHeQMIfd JbM1LBet+FwFbbSJM8WlIjkxD80K2jUj0nnK+Yv4+3ESEjodQDEoFo87zBZnIleIx5y6ekem wR8fIvcrPEhEw2FAyUCnkxxxweGI54Yu/noQseXcEFmnWDwe1uQoy3EHa9lrfg1OATqCBA70 +cmX40ccuGqCZ90UayRWBA7WkXeQX1Mn4nYe6ys5XiP2gwx5KzJiP1JSXbHoVys58UTRv7Ov dND/sZ/wF8oO0VFmCt/VBr4WwWt1z7ODs2Rc7zw7iCCvSldtH5FsVdpqx9EHUSWv7b8kjtda +ns/OJ/G5ZLzCPufjIxXWtiR9FjUT7vaAPb2w9COp/fsFfQHcLGBfXsXPm9EToU9dw7rFaBg sUlNjGtNzE2zF15xBpQu/gwU0SJffB8kLr4/Af3U0mOS0tJinP6KBm1at7ER8Xp1i1MbgcRG Kqx2g6iXYZ7/xnedJGM0WxyJSeGO+1rTaafj9utmTu9ac+b+61dOnO2Ivql0rjzYnlm389Bk cs/owkUWmjXTrH+Ra/W6dLJ+Vs+h9vqtaw7CK9fMVbo3+VrmVY/tap/55M/fmzcd214Z255+ H7L6KNQr7CIvNDKQomeDBfpXfLp4jXBhqaC8s2jXo7Q36nIBscP6Z9mZF3tdFhjyQCtCJEBH XZLFKlgs1lA0UAkldJRl2BM1mSwx2Wph8cNpio1C+r6X+hFFSBSkrnK9ioxIhFFgQW+Uyhct GNJySRVxVeC3t6iIRm9/1vKO5S8W0jIEm0/ELKIlxgwR0ks1gxmLGsMjowiX47NfI8ijpMem ZZF+EevHGuUqfx9JX4B/34V5PeZxcCNWJVIpWesGwvlXAmrBIEyVSBzUtVkwA0XMfHPZvTOu ++pQ9c+7HjoI8xFWzDrSyeXTr3jt7kWtA8fi+n2jvcu777v5yeobxzbqxK0Oj4Wj4v/nn423 wsKBxav3466UFjT2axHuZWhRpgJchZTxqg5kYDpRJ7eCVtikb020yl8l7g7tSRwino6ekAaj rIT4uEfn1nsSkmy4Mw63JfYmng2RTr2arB2zl1ThVAXCY+mgfFQmZKQhi9s+BHXH/VGGiuG2 eC/bFsOPyoUDlViCNIG3hQ3uhAUpKGdps8y0LLXobBbJQlg8Kfx0oBIwoFNthpmGpYb1Bt1O wxOGFw1nDe8Y9AZ3Mj1fm8XdiNj1DLaK5YhaA0+nkQbUWh379oBWSdqIERNCiKlDiHkFSAgp AYyUfkyrkA5jNXDgmV21E0LdayU0TVxKhEnv6p9t2XfwEAzdvW5t3JeUkrYcw/tLV51tn/OV 5b0PLfnlzZuf2PUwlE8tmtyaCcsBPpgVTA6rsHfHI4+svKF3BbJ/BFHdXGT/OcSTv6M8TgWg EHbb2kzIcTJoMSnlliKDVyZXsVQ0KYUGtFsoFb2Mx3QNc43pt8xvTIY2x0zHUse8Bt2ll4Wb iuVSV6CreV7drtKD8FHhEcez4CQcYk74jxcHS9a5AMYh/FsJml3oUgZfr75oohIrTVQiUbTh K+Ep5Wg8zq9lIGPKVeND8G9KXK7L53ojQkMlH/c2lSMCyWPskSBHSnwcZXDxhmiQqgxd/OWx QKWCPbfJ5bKa+BY5zrOIzpGD8aO8CVsGU0afs/B40bSXwXyqjD75lMeLKPZNURhyOLcf8CxP 8JoD508jB15GNmD1Ihvwog/pVfxRdf4TwRULxY68+sde6HW3oGSshSl86/OoRK534/DoJ7hq mWbPf875to1cDk9sKmoPIUZpDaTIdFScGlWgat58I56ARHIT3DTm4FEqppG2f+ti+Vr7mQpq DGegvgTo5la/7bPTFi48K9x5vxLOBBJfv2FOz/SNrx/Yvqo8I36ViTLbHCGx5O2u3FL9eHLd agTPfZ8tXxZgOItrmWP5TflMZdlN785v3vWV/XDOmnmZBrg45pQ9Dqudio1er8yoLnu9Zyb8 Dva7CsL+RoR9D4iBqlK2saaYi3XFdMDIGgmuzzibJmQ6FZtANwc6qS5jF93JLDIuYOfF7td9 U/cMf0x3MsYm8LBPjJfosM/eZgwjhm+kjbTeC4y0Iwj2ehUj02rx+r05L+n1miJRjtInTKZg k9aa5kmALgLDWrQilVp3yrParAq60UErtLrj6e+OdWWkez8db2RCrhRRs4H0SE1LwI5hXasP A60kQyPHgudXsIOxM23GmqSwpM2teP8YklpExskzP4Zn8V9gTxlwT2IthzpP3bKw887bHSP/ dd8DQ9B5/5qVkxc8t+HcAwPbt5fqV/4Bbi2E+m9uXuH/cGj9fjjhyPzmvulXT0x67MnGhztS RdwrWn20OhUx731gClx3CpDo4yzMtpF4DPl56TaDIk4SJ1eAjutQ5GQxgo973BGUNaJVB4J8 h+JEiwstVrbYgZmFpVQjsuaQTtfRDiMKuk9kCF6rsNEoMDTsnxjNAna/N0rb1I4W3NTCjiJ2 jfntf3qVdCicSEgkMWWyLhLVScSUxGTEvaSEgBb0Mu31l93Vje+K7ya1ywmJLTehdNRF08S8 /BBRPSbWW4YIUmHzvIJge6RdEqV2pvCrGgrPD4yOjKZHRi71AagfBX0mdniM/EBMd5Bed507 Zz23S8+es7b0j8OtxsR0aNjQ5yEw4fSiDV24JdBGKC1CWzicXdgWwqsOhR/jXP1qTkVFSIJS UXipq3CMDJXVUkmkUduohd5az1sNpbiCTCzl7ruuq/uarYsXt6Skhpg35mApmk8v7Q5ZJ77w grVvcmOmudz9VOf0xXVRKeGhLe62wpSSt5PcOLnaU/3t47+dNynqloO5sNPJWylaT5WvXZH6 kHhmsjip/8bJ/f292Ug+6mZzRivFyKWNzX8GyETerk7VpRFKc2AimA4ZpXLflCe55/lDzqem HJn2Incm8Io0OIXh1rBrerayW3se6TncY7DbbFJrt9Da2m2zt3brWkOueGWvcYhsOJYBCG/3 K1LurYZohuqIumycXegkcjpjPF9uDZkjcL+us154jSwAH8gjtqwj6xU6aW6KrE1OavK9imgS csEgiXxuqpTEBmqLy0U2Cd9JwuSp3h9Mx43tmN9+gNsPEcf9AHf6DmOVqosmVBSfH0HqH0EI rojjFS9c28AZd0/Y4myzYbiOSRvbymLYIllTKlJpDaJqNBZxzaNW4MCKQ5pURbymbpEaq4M0 FFoJaBjTvdoioEv7v8Vv2PjmmpIQ7frOk8WGrR/cc9MPr6ikvbfUzb79uls//VHPsmxvf+fG +5dMKV3dLldDs/ta5j977w961jaTPavLuTtWrTIFM6xdCNmz8WKpY87u3ublpfRAgJ8WTcsL y459C/a9Gwg+Nmvx77f3XtW08vHRzbGvTJicbr2yNzHVaUZMLIm88WHkGcpwprKOm0vNTz6V JK8xXENfG1ib2EpvDWyPb08Y+8C1caKvhBlCiUcLhEQqnckAXih31C2US/lyL4xkcVWLMpsl b1DweoMgA8oZKVsnZLN1kXodlc0wLpO3UQ5667KssJdH0XbQTMWCQzB6zBzz4jCbIchj5Z9m 1TqXp5jVSh+q8JXUo4gdqDJVVKXCNZU+zsKsu9ErZkVvI1O46wtF0N5h/AjCCPvJ+JwhaGtr QYFXf1m7IpJgnB+PBd5drPXmcyjvGWtQ7HmxgJhbGT+wGQxPQKaA5wRp6DJX6tCCmMRvTvJC qxDWXEA/hFwN7+SlyGwltMjMj3W/qr9UBDaqu1SJ6K/+6eQPB/KKb5toN1nslQlSeOuCcCwX ud7pFvyx9n7X7pRXeRB2RdISF3Po910oQe745MbJS6oD041WzpKZwZd21OdimRvh13rSgsuZ 2iT9amrff+puvMkjG8gEjsFXXHyfqNM7gQkkYVRJiNc1lZxbmkpcWuFKadwg2m+G7gh0ismO 0EJZzid7zWCDYYg8oHjMlGy2mZM2KRASAoGQ1xRIyaEAK+51IoUet9EbSPMQnHaMXGYbgpGX k2u5gOItqcXxpmatSI6UF1DbB5A2A4oU1PZ43lnMB+4NEAF3KiAGUswNd30uG9bcsGIK4Egd UCxohW/mtKiyluv241r3H9matlVdX0awwCcj7Jhya/NNGPWiYhbaLKr6KiLSHt48YauIim2s q0idlxr3zfxl+hwjWOMKLcHv4xb2ZHNT41sCb7E5Kk2R9sXtrcmi+7ag5HV26J1NWj97U/X6 0SnTrKzAZvvE1dNK9bHYfHj2Op/TZ0qoD+IjZP4JIbMBnlDy5rBQKSkWW7GkOEolhS0xJsbs MrnNc8Cd9mdYqlFsK00V54s6b8wd92TJWniWYAIxZFlCCQKKKDAu6GRzId/QC4DZIDNhE4JC W9vfR3B9V+U1uY8atN6CBEnodJAXBBdyU9GEHUJdQk7YZRCQLHZr3mLWmfLmhmp6CPoUh6ze UnC5pGhciEbjUAeBDoftgj0h2O0JmEBvbE5AlIihT9OAPk5aSCbTFrMhKTOB/Z5E2JROshZP KbBXGoKnTrqGo0PCcPx1Mods9R4go0Q5DV85VvhpslYBT2ouQd1FjCVZsyo1MDBNpaS7mBRV Fq4WulUnMDz6R9ybNDoyg/0jMg38MNKw2mlScwMa/BH+tahgvLxpwAVqZnN50ZR9mzKyLcaW XXh9M6YNuDzSr9qVVhuDjSrdjl/WyUTVSuRjJD0RJykSgX/MeIju6vCmVyZw5kgmYoInmJ51 DSuC853BMs8LdrHYHFn3lXxKlAf2rDoAp/v0sYhYQA4geeXj090WmmXicV0i3uOf3nnrz2XZ Hu9z71kQaoYP3lB9TLf5SjfvCjIRbFkzEfqvRJblh0mlmwaQAxKUFE9pLpjr+1j6VNQxQVPe pJhmmXQmf4djoezL+3vVJ0X9pMQ5BI5z2ExcQHZw7KUL1zKn4SvollHFTMY4wMGz3DscwQ3B ZoUJ0JzIBZgbpl+qcmtdfRxSHMr7OdUdFNxtHO4TwnuDMad2lI840NEQOooLBJzCerXzNnft VVYRHbVoV59wVTjF+fkOo344Mnz+o4F/dQdI32M6HXhb6wZWW6RMJvw+DF5B5AdeilRqYR9+ CejhuN6urD7v5q3IhVUCS2c1l+INQWgLxWUxh9Kkhf2CTbAn50t3leLFcHQD+fz1dpdExZAm Ihff11+HWFYf0aHc4UYRY0IW9tOLzEstC4TFEwaaBpqXtMybs5q/xrkms9W81bktc2PLHvLu zN0te6Y8Rj5qfbT82JRvwUOWJxufm3C0crTpaPMLLc+3P9VxYsLJppOdsWvLqxvXtJNzQH/7 nDnknvLu9m90kCsq28qbm7a3b+l8qmKQYaySmJabt36uPhTuq/ZgPM+V5+T7eoGliYJdkyxM EwQ9xXq7fVI9RfW9BSjB7ZaSeQTgPNPUJDW3Cs3NraAT9HVKXT1CV1dP3NTV2dnc3MQk56LA 0drc08WG94ZwtHcLsfwQNhB3LKlYS8uSv00SySGieHJ9EzzaBJswiXc0K5FSs+L1Fdc3w+ZZ KP2PtR5pPg3Pgk6CPN5zZM7bXRotUEWkpApJFYPoRequW9tNZdRdRcwVi+u7Pu4iutxzk2Kz 2CUm515iCpfPlyI3MXL+/MgAi5jkyMBGdPwy5jCetuNJ03H2oB9rHLlEI4ZRZn/peUCgicsD z4D6o9mb3YK4QwtaQNhc6UayjL+BrWJTWWdFpwmgHezThFijGuEwf7mt45SSLF96rpLiGi8j IOIXGEjj5VlGZJyRoHyFjPBjLikBX71twcSlC0tNhcnitKfumz2zrpm7LkobGMZdKYTcOxbG I7nkIokgTWZbKrf3xpkdDx3yOdlQrOW1onvJA6dclCxZmmlyT3XiwVk3TQgqhfqZVVi/vb1t ctOk6vYdVitD8ZlOh/zVQj6S/zqctN7Mc26rNb3jDw99RAxcFfJ6XImLYHNj9efE7rk87YyY MXISKDoeQcgpw3s1DpatcTDlQI2EGXNO4CW8Od1sag49JzA7uBVuz+4JPJt4Wj5NnI6bFsPF 8hlILqQXBhYGVcq7JqARXsP81OzS2jjCzecJb1rlu1mN76L0NANB9mAEInKrA9RlxDcNymkp kxUymWwmPUZ6s5kvIb1Yn4tL3iFi/7HS21mc5qRRsMuoBp7RTqqiSRU4xmVqNDijhcCM6iMR Wf44AzOYBmf+HzQ43TsyPHw+/UUm/CU8GBnvJlgzXfZzbPjfkGFcz9ioxj3yS3jvF3iSFg7H rQ7Z2bk7X/ne4sIk/zYHS5vtpTZpoK+pLpYJf8Xp4X2J7if6c1LhwZPBiMcciBuQOVWg+OLk Usvy6qIu1spbUvP5OyuJbDy/Gd7XkxLcruyPnpy34hli00bRGdIZooj14qrzILIZC3CDI8ok I0GTBoZ8mn/B9YT3GHfM+brLsMjV776T/6prP/+Y6xmOKvNN7ml8l3uBcT43l6cYs9keNVGk Xi9GdSb8P+YUjtrZ01ekdk4p3UsdpAjK7cH/Rk5JqEVtoKBzQJlSAkoBLYES/g8beaCAJ4Ae fNerVZpqVUJcPNYeBUJpKnYx2gOAUH3YAGotUbUKkZpSajMlHDl4sDp8154jz0HvHXccenZR 5/3/WNZ1zz+IWQ9Wf3n46N33Q/nwC1MHrq4uemfpKvgU7qMJVLvJ/0CjEAEF2Kf0zIP3mB8z HzG/atFXHD1gqnWqozM1z7DCutm61XNYPmV8NXkq9bbHOiU8C8y3knlQDCuAhJZofcFqBU6P mHc6rELeEenwDsFvKVY5nI/0gijMxSHw5obIe5QwhocMrCBilbSZ9HiUMaFX2TzQ0yB7Pbif 5lZAIYOuK1HYrpOaSKhCcQRLlCKVZlJQoWZRG6gnqLOUnjpNNiNGkj7ujUSG1FnxQsmDp+LU mXbOh3a8/uLHHuh1N3hED/6vfk0vzR8vCeER3/a+K8eOjGpWOzZrshGoyeFlSUPNlas12S/h gWp1tjaPoumKqpVyAO550NqQG7RH18aTBNwj1UrWZlTgmx3rDvX331J95L8Lvfkup1jspatJ ZmBSdFSUgv7ida3XFNeumjOpq37tT+vJPX/cufKejb+uVpy+anW66JTssZhuwg5ybZ/gDVCJ Ub67adP+7189a94/n8WZXhZp+wdI2yGQg1MVxuA1+CZmu7M6tYI6gNiU0VsktsDn7c9xR8LP xp9OPJ89VHciYdofP1B3yEuuhLfGv1pHdrq7vfMhWck256ZCMstkc+UE+RCAuWCIZVhTnqEh fl45GEsH7Ww45EIZvhzS5lZjUb8fqx9CiQ0JLBtK48q82WFiaCubl0MsC/BMWAjuBjICDn+G /Zgl2J19JVaJo0UKF1nN1WGhBD3omAcp1gVdWNsuRFtdKMF0rc2zIptnCqfgH8FY+T091vye Hvjgsrq7pt5/mfPUKkX2Sk3Pl+u3NkemRe3xSruoKVVV6xdmMi/V1hvLHPmD6imnKEgFphpi rnLF6wN779g0e+rylae/sWXZtMWiNG1GZVv1r1PyE3s3P0bu+ezBGU4xZDTHYkba1r4Ojrwx o/GppQ/B6Wv6OqZv+KYyp7r4dM+M9lVwCubyKQSCiUi/SfCpMolAMTCEltlwHrmEXsLMST5P HrY973rGQ9/p2e+5mCb36B7WEQFJgqAj9Gc5mQe9kBCChETAUM4CLUPwoBIWYgYDpGSILpKk YEgIBkNBiZFDQTZPK/QsmqRP/1/SvjzMjerKt26VpJJUWkoqbVWlpaQq7WptpdbSVkvl3ru9 tNttu922ZYMhbtvYeMPYmJiA8YI9AZyAMY5DYkjAW4BgA15CwCSGhAQT8pL5+PKSL5O8mIRM npMwL8t8GVq8WyX1Yodk/piWa5GqWm3d+zu/8zvnnnuFSvKigGeib3FypySdJU7Ktec4KdHK SQLcAnCDgT0nuT05hAMI92XuNe5d7g/cx5wG+r4HXopzzuzsxtTSTU0HBSN3RaVPuaRG98CX FSk13R3tm8jaATnWooLYpNRpFBqFp3IrE15Geek2MHrw+YeHRH8o4Gpx+lUoriUsZqZ1+OaY N6bhjlzgzDa/vYgNFesMiG/rCgc7yi1eH6XRak3Syi92DG923oOuX5e0GkidXN9xDUZSv4Gt n0a+JbFZAJwBlqxqCZXZRdjNbWF1hODNRzBMmTdgMho7FqZAFQyCFTBCPg9Ukj75JpLG1UIU p8/DKD9nf9PlJDyChUAPIG8CuXBpHgDgLVPbu9wvuD9y2Ge4h2FLXuJU3DFtW+gQc4B+06UI gBw0gjTc/IHcMdclF+r6dOYi6AK3QlMg/yzbgJwC+1OtNg6Z76oymlG+eq2xr8UV4pJxjfGh Zq7S6WikO5RG4ynR0Sz2SqLNSi8Z2ehv2oPq1XMq/Z7MrtnP7u5b7re2OIPtQc3mW2aPku6z 4oMbOMY0Zol7oLe+sndHV9pfzj90UFr9ZMCQBF2P37OwEgmUf7y29ea9aiycktG8ALbnLar7 EC/QXEDUUMxtgkpYMpe+qv4D+l8mbCF7APkLwARPG7LUhJk5D4d+BoIK9SImM1CpcRzxuL0s YNwer0tNq4AW+ieaVqmwR5BjKNBQBJRpPgcNCZl2+CK0g0T7zZgPQz/GALaOQ57HzQdMFwFA cBiIGKwOKV/KXXK860AdShTrk6txfddFsUpKyuyQo1aHnJdyyJykBIzjf4G0IqO7Oa1loiIL yivY6uNKFAHkvAvSoB0F0epyGZBvNWKETcp0eYCJOP+JOoqXmQe1zX3C8sWvuUmCjrqG/cvm F0uJInf8sP72zy9R3Vf/Y3X8zAq3xcrbxui9hVAhnt+Adoa92x5BmmPwlyF2y+CwtFvbRreh 1tZMb2ZBea3jLvsOx9fsbyB/s+sWJhfMWKvDZtkXIEvsWB4p21F/JFpCT+tAKVSNDEZWRP5s /4vjzyXcNqNcpnT6ULhYanM41aK9TIXCbHtSFJu6OI6XEQ2CYT6qbKOosstEsFQ7VMZlitQf 0N2EyeEfW36WgnqJklx0jpLsrT5qkFpBPUx9mVJTMFKUDGKQlZIgGeQOWdmGMmaVkhhaGZE9 a7M3jomccpRoPpJLsxJ7jMVYul3HOikn/KP6bd+enCowKZHlVCArz3JV3gDannx8wdGI/+fI UeE15U45nzx9LsG0ni1XpwaUGg4FdrDcobJIaPBVw43IsHHZXUTJ3oz8ZsAtDTcv3CbHjwA2 NT440e+wz69X0ho8nC9cL7graKGAXX4ubCQs0WHv4HBBDCeM5KxT769MSokRzqK3xwZ8sxZI +WAqsjxM2/1rX9gy04FtGv/aHt5q8a1z7pwRSvCB4sB/1n/7Yykz6yho3cAaLN6bHHcU4qlg /l/q39zNU86OX33nJ7NlJCUgkg4oVVz/Jc08B0BEIlsjkgFuptZRdDH2suonflXUPcPdj2LF ANDq9MBgNOEuHAecAJnODnAfR/isKWvVilmhDzpnDrtk/SyT25lYq8JxbKj1D66PXSjnklz3 ug66fuBSu5iI7wCH9Cs1OgZbazU0GFoRei2kCr2C8bIRI5wMhWSOa7yP4qzoYBT6Jfjm87h7 uYPcMUimXJqTOIw7j7rPhrM/V4aSFEhcgwZ+lVTqY5XR4HF5fn65Wv7TNVoexwRKVWwz3YfU qKCS3HM2SqDlzpka8FMibFRh0wTw+yjWojXtdO22+Y1ETeRjEsk89CXb94Ku2XQbncRmVQbm bDo696MD/rO+1oiXZbpiXLZbFFOzf3re+UP0ridEXTN3NAu2elxejMNlp1lUa9exaEyOgcMG Y2WEGY59irkp9gtGHbOn2LKjj13BLovdzq7zrYk/HX4xTliVsZR0W2OkJakMscBmammkVJSL 3sZFKe1055jYWwC4kMCB4JvxUAiKf9zNsjTtIlBMpdaoLTQbZ9w+IkVUCYyAvfiSepfZAizn sYJkAO/TB1y7mPgB5H3mPPqQpGcPuIODwgoBFc5jqTOx991KLtdWlY9n4q1uZYwvmc+5JX9r 2i2557kx90XYqwms+EKji5o9BPXb+Pg1Em7jNdhBDbu7YU5Ys8OuulLNvDghT7xLgBCbiKmR 2tRQL7TLF1lognKG5Yyl5JJHAiwlJtAYCRitKeVsjXWTprxhczgQhUQN5E5u1FcEHZTDCbAl 3c+tbterCo6kEC2ZvSNrf1kIzqzfksAFM0+LnhbgK1s1KnAU2z9uffvsmpTDouODdl+8Xcy1 LHrgK/XfFtEXx2eD038d45waofN4/Zn7A+gzsvY4D63uXtj/PUAr3WKUxQKO4DGkHVRsiAMI CA9kzb6f/go4SZ+KnWh/vkr2QcMknbf4t/jfor/vV+t4Q2w+j6lohkFjsXhFqpSliD+AMowv ItkiEakSg87T0tpxoOdNxCLLeZ+9Ta9H8NY3S+FkMkSoYnTFf+DLgR8E0MBbRvRq90XQi0hA OMPsishS0kNfrUgzZuUqkqe1UunljJLxYePzRpWR6cvSveeBTe7KudBP/rom173GldXCfn2N bBShK33YqByAnlQZpJik18nse6MmUZ6OD7U+kO1P9otTYrCpBCnHdAcaDsmj8pNj8o3UWL4A e64xhHNLhrZGF/O3hlyeuGh2C3YYKLr8lUXzKcZodxfCfPXmQqjot3d8cXl7KeJ3JThOYEwG KvUUXVE7B/qcXmx/Licc2Z0eIfVJf8hE60h37lD9xKDPmRyw3jk3UQ2DaP3DuVmPI+hPcE4y 9FHx/5lm5lFB7tmb6j3YXtizRUBJS49mQMbV1qqjGTpKt9PPoC+iF5kXI+ezb2Jvqr5Hf48x 9rOj7BoWU2XSqZTaE/cyGcaikr/3Jh5xs1p/Rq3BIeUSBq1T1Xqg+KYNwYW34mGv2X8eXJIK GYtEWHNmi8+CWiKGrU6ZGg86jznRec57nV93YpwzDV/DnP1txf7XCqBaGCysKGCF8xgvGVXv Z2TVk5FVj7K+gBOS68HMscwfMti8zL0ZlMukM1IGy8jUWpqg1lrDcGuyPIJPFNl/FamO/1+Z WUFjeRlliRlEyZwqykh1uZELiYPNwNEoZGqQ7JQNahBcM7mMEFSozYRnvoCFGonMWQHGmChv LgxlCI1pRjgtJCrr6m//9PDnc77UzJDNqKW0alxjLvTflCyaih32vA7b3/apR+u2vi/Ovn8e R1oIEyX6o9l+afD79WX/eXo05QtLOnVKq9YHBlZW0B1PdGmCMBwD+o+vavTIt5SVsnikXbIg hzWGw1bXYa/XatUQ7GHY8tEz5sN2eDiHHdbRwis/ay7R9hdlrSyZtK7Jj0w6OG3g0f8PzsFd KWlmMjlzJlq98eRbyj7ZfDbtKFcF7az3qOQ1fm9G/l0S28K3zb0w53tB1dxBry8UcgOkWqmg Xb29vkWjtkWLRiso6nOHbG53qLMLvxmRqggM5G570e+vapSkvm+GEEOGCdMhl4Cb3Wioomoh FrlXRkYXhdzk4IG5SnFdbyGTC7Y83/Wj3ouARxZhmyVype0q0Wb53cpFTrcT3q8/j2184aXJ mb9/gtT+l/Grf7o2PW15qSGc5aqiZmVRk+v/bgbTPsgOprK8joOpuXyHLKrQGwpyNLizSQ95 Cupq5ayCTpTjhKfqcaAf9yvTW/5BYlPhfnDk9sLerwy3lqSEvzXICLwKVdkIKTM/o9t92xlL qLOFoW9b/dqm21enAn6a4klXbN4TK9oBvm6+6HnLatFRjkRvcOni9mw8Rz9s1xgoUwXL1Ht/ Wn/htRa3wPJcxm+38VpcrW0Z+CwN6uC4xFgyP95/6/y2aNphcduTWqj8PnX8VzrzeKXdpbeQ vpr7nrZwmg8sAP8x4CK0Znl1d1Tp/1Ww/zuQIWCTtu7KgOdj4PnIk8mTqY/6VNGetp4TXszY f3/m4SJWLCGdXV2SxysILAqG5mHzoJBnBajrhWQm45O6bJLUhYDOIeAb5rghTSw2RwgnW1rC SDtBXHAKanNPl8RiwjxVUiux8yMC2yWRpXXF16CnSkLayyBd4CUkAzrP/lEC0nls20vzqfPa oOk8Fpd081lIQaw0XwHH3uvBUbt2lbx6IzaUKUwyPBRLElOTGJkQ61MTwtWTJV/KvgkTZQ3H TcCPoch1K5Ph+MRAShMq+YKS7XZC9yF+0hAhRV0HH8xd37tpa/2Xj8/szQW9IQeBoVqCrLTM z4XXrT1ri84pMzv//Ui0ko3HvJH6EZIkKFdrOVhbBNEgOt5ZTkdIlzh8tNYJEdFdz9e/0BYS sryNshGQ5XFtZODhNeAF8FUpkAf4q6QLJR3/NaPIGCyW0HxmVzGcCYdnoa+BToa2Z3QGPVl7 5gOoJBd//AF4D/obD3JIasm5u9yowQn004Z+8cgnjf0SB/TfBN9A5OVmeiHr8Wc865QhWXdb K2kFx6wgbT1mlUeBVVba2xgAnlbSsWlzfM7V8V9PK4idnnS9rkwD/POCi/c+udACKqp/WF4B wOuqVehhdbmxLqIG/fAMJO7z6Ifyuoh7lk6ui3jDkoVoIlGtwq2iLlebpwhCIquQJaqlqrkI jpgh4/uQMJJSVuvuRQaREWQFMoZsQLYhn0G+K92yet28BQuWLd7+6WJ54x2RxE23CrP7DNou SYVo4cPNCeWEICTK2GJ3Lm0jSZd77sCdmzevXNXTcc+OfPb2tVbH/EWopq2yCD4Cy5d4mSU7 1i5ZsnYHtiqgN8WgJgusQlI/v1JKXXn3imwIqVSKfPcKecVSgqfkFfl0+qbcB1KNI/lO4/4b bv67+2Gb2PiA/O164eaRah6dzePEdfyG5zceb7x+4/PgDe8/8fewH6dzufSj8u6vYkbMCPJZ vZCFP8+KmYyIzpf344z8Anr/5L3jz6Vz2axyM/iufK2+TN7/Vb75UfkMewzu0vBZ/T1RzPwb fAIOw5NF8pvdDXfgm9lU63gfPDuUTudQrnlTHYcnH8i/9pNcOgfpULzhuwwzyMcfT9RcoRpk trygdP3x+oD6PyD7ngC4tP2xp8DoXjC6GyxeDk7UwJZ1q1ZFjz546NDxEwhyHAXHMcdxuMN8 4agtHI6WdoFd0dEoiIZ9FjocHjq1cMGC4XhsZyKxc6dveMg2PDz0+BJQWgKWDC8ZBn3DYHio pygNff7za9bs3D7UP5wQY+FAFDOAqFyl4zy+cKfmmPDAA9uFm5F+QQwIDoOhXTQj1bfF1NtQ hVQhg16rXr48flmZGgT3jZOUmAIQbKJFrNXkbR8pDyDug0xqAaIrJZcSNS/Df42LoDbtspi6 ouyymXRjRJzHTBhuwviArOomPHBj8T8lq2Gl/ChuUv+D66pC3iqX08IbK2ox60Un7LaiknUi HzChuPI2FaxxtTkULg/EKJdVuKja/bl+NtGS49NrV68QvLmgw0QHKIbXW1ENRXTf3Jujt/bU x+7xWbKdC1dt6wrkeKvZ5SM9IcKBqmhDqD0b8jp0xa19X7dGq9kQSeer/SOr2kMzIvYU746h GqMRM1jsusqtc2c4flvsb4046fnrds+JlMOUyeElfVHcYFCZrSY8Pdwphhjdo1i2/rP1Jw7u Gbh112yvmRHsZq/LzNmNpA3Vq3X47M+crIF3AFPnNuUffOShDV2UL0xZ3RThsRlIO6rFDXpP qixVmafBWyBWxe1hLrtm5YgUcgpJB5fhPFrCYLXqUJzQqpccfHHUEustlO9Z3eHk43aLz2mM 0HqLyaTTGEwakB+5feNYEGL3ZH1AcxfE7hugXzp06AKIHQM9jyx6BC08Ao7cDe7kwYMPpCBG d/V5Pa/6fK++6uvrsfX19Zw6CtYcBUuPgqPwSSmWy83qOXP82WfdhMFwGbzxhs/NQH3JuJke +Fj/nc2bNm0c6D886/CsWb71G23r12/8xnbw+HZw13awfWNxIwhvBBvXr1iwZP2pU3v2vHpw /a0bZw3295T7fEGPu08Gtv/VN944vPlVzTnhqacOCjuRW4WRwcGykAqaDQQBNIyFQKrilWw2 JVbfhhC/Mgl0MUWOX/5vwP5JaIe0aRGbQBezkxCXa97h6Sf9Vm0S/LXgFM6dUzZQoPzYdMQ3 cDtxI8Q8vA4FraZxx9SytTYv2rzDWpB1yjTYT00qCjVA/8kXmybhz8r16aJ6LYE7zbaWeMjA m9uHVogMb9djWoPu6/XVNWexd3TDvvmBYsRBMn6L3gmDKUJrs4Q7y3lGbbHZKetn6xtuKW65 79FRZ2vSmwu4QxqVSmMwmzG10JKxGmxscMai9ucs7nAh7DGllqzdvcSZT/kiIXecMBB+Jj2v Qwwz2l+WB8QoK6y8+9FFocGZsUTEkzJTZtIdtM+5c7QSp3GwIJiNhln+h0HeRLJcKmdzMPNm tVrZAEm6YaSNDtcfXvK9N17cP2T1hOwkS+llfa0zm0xarcHdcduguTx7/qxeNFS/8xf1iz/6 lN4VZIMtvFVt1RPwFjXQ2MJ+h7jk8x+Awd9VDa4gs/jYjj6jJ8kFcn7G4KJINeFoW7px/fKw IdxXHty9vJX054RQVnBTDGWGZkRo2lfcsXE5rdLpZA1+GlrSd6ElnUQugZp0qOfioovo/i+B U1vBka3gGQHs5R/j0X/Zs3Nnh9dzyee71CH5pEu+DsnW0SH1QUOCB9mQuqWnz549De0InDjJ uk+dZk4jJwE4edJ3mrGdPs089xzcSfAx9q3b169f19V5qPtQd7dvbJ1tbF332P4tJ7ega7fs 2IKOboGuZ93Y6NwFY6dP33vvQ5fWdXrcHbIthU8duv2S5uzLwlMPCdu3P3Xy5NNPIWPScmGo v/+fWVQqVRVFaBTyEhNZaFnQh8Cf68xJMQsSeX2f+pPtCf5y02hMl8mGXIc3WBoexDLduuBt yvtMf5v/mX39d8aFF5r+Zsp6lDsn5u5MWpd6MkagQtOMD3ozDFevVRMukyvb4tf60ovnSC7I 8ToAkfJcffVSe2vP6Mb9w1wh6iIZjtQ57WZoWk6yY+lAd+KB+oYVxTvuPzTiycfoLOeJykZF mM0qsU/kdCjlDoYjvFv7dXuwnIlaoovX7xulCy3eFt5MWwkdZtK4PYnZ1daoz/ibUl/Ka47X ltdG5nKVTqO1i4/X316mtZIUmc/ZexfWYrRAk6of2dI2yhUWRYNj1jLRanXzVsLJpYPo/PrB oW+9cfHgiMUbhiRg1asMdtJgNhK4jpj15N+eR4P1bf9W/8a/jpmZoINv8dsmLaowd7Efn73t sSefenCDp4o7ovzQEztmmbwJL99KWOx6A6WxGzSEIzu0Zv3qVmhqgeUP1IpenUMLdLbxq2C2 xuV0QORpDE4iNr8nNjKvwyHXuTwAFf0i7EPEjwjIi1LbGx5wUnVBhZKNVJfFxTIBwS3QvOCC D7fLp9fa9FqzSa/Xcoif9KN+v+BW4wLuluEfUOM2NQywEKBWaxla4AMBrZvTm9TAZRH8Zj28 dB57G4I/Vb08nr2sPCAwIdwBnYIwfCcLHUOcBK/vUynOATK/DOx3svuaZYSXIbYvT3oFUQYt D2FVACLlxeRKA6VcJOxvTDrBITC366lgqpJAfdR8lc0ddOjrd+H+BGsARP3SUMAf0tWAzSsA PNAjYZ6PziRFWi0IKOEMunX0nvtaBQcLBLAOrJJn+7wCd1/H3kPiMGoZRJ6UqD0hcI5XyOcZ HjvuPOdE/cq3ZLp7laonqWgugt5ib1E9NJioSlVJ8qm1Ntg0JqNRe6cWjGjHtKgWIGo3m0gJ g7Nnt0sdghoIcX21XdAaBfN57PswuspCTpB3FkgH17KlEki9nVXca0qc8JOQK0Cp5EqlavI6 RXJGTLblhtVRDSsr+BtWq8LtXky2XllCKglfWRI2HBmOKQbdeKLBu4jszDhj+DJB5Ko6cGDt 7n7al22fkTU52ovhZFWy+Gb0La1mjKKHiGby2Qih8aVLdDT8t1j/zLWzo2R8brsrbRLoVEcM DfIFW8zHx6oD/uycUoQ2YSqVI94lVmtVATdQRhylUBVs93hH2u2Jl0Ok5qMnDYn+FVl2RoZD URgpzP34qqoDIrWIPCct21c8XkTvLIJEDOyPglgUnAyAvVbwqAXssYCXCbCNOE6gI/oxPfqy DpxSg6NqcEANDiPnELQwVgTFIkJnmJkMyjDgGAI2yYEIh9wE43ekzaxMQ/cJsN8ZwNjwRLGY S0DYnrH5IG9fkZm6GfyBVE2Z7lirXREbSK1dmeDRaT+ADzVy5rDNZXZt0mJhgl7zTWJU0mty 3mycx7wuz/Luvv3bam6jTpxTi/XsGFvoj3mG73xq/bJDa9s0OnbrM+9s9eZTYZOTJx1+qx99 LDSaKM2obD1xW3pecMGWbm+8d1kGzWxYUWm95eFRriu8+ZsPzNKZTBq93hOAlv+KvMI7RLP8 nVlHpfja7I4seiEOTsXB3TGwNgbWRT8dRfcYQBC6LL1Dj+7FwCMo2IMCtdxAYhp+/JSjVPD7 m7UCPq+XXkyDHhqE6QKN0jbK4Q8KDptg1RdyAu0VkOvh3ITxNBzLIIZmfe36NgQNn4E3gp7m EloNSFNTMU1+ArTo0e1fW5/T4EREWlLpvGvL+kK9l+hfbH9Jq2kr6QY05c7g8ls+Ndpr1+KJ oc3dbIcde69z4+cGve2edG10OBhN2FVCpRfdwITJpIf/6Bt2C0ebg5Wb94x6Skzv3UtyGIYA hQteh63XhjwtLbXbbFbq6fhLcTQejcUQgB6nzlFolQIURHWm3FYq5TxuA+ElvF5fJmfL5Fbl QG9uJIfmWhKZTIsQtwIrIAyC2x6L2d0Y4eUhB+RKAjHRZkqTWZTEw7VG3mGy/fY1GeB6QQC1 wpWsLKvhER7kr7zgm23EYwr85NWHJpbobSxko7wqr1E2SRrhAvZ6yYui3owUuHDHZ9NS1KXn VwlqTa77vqUaTVDk82tvmksLgx/9jkhUEh7iWa222K7D3vvAQOmjec5Y38QmCp76Y9aQJRKv f9vuNtGMPT239LFgj7SH0WE2SkY9KN9sz+/A9hSRr0jD+6jDFHrces6K2ijKUoWtY/WICACt 2UwmEeB5j5sl9B6PXu9LRG2JRHQkMZZAE0EhmsgIogWxIHrYcixUtizGUiwV0AsibMeXPYFo UOD1SFX2PdVGQ9ZuaM9JRp0WfzfCb9nSG21ZU76b4ZMbc2oR/uu4F/ssh2FUtCP1+ubPBNuz MWtgtaDBZ3Tf328g8726eoIQO2K04ctaMtupQz9E3zfbCa41ZK9vwr3trfVHHIKlJV6PS84A 9EcCk+qIokHfDDsf5JvMuBoyYw/yujQ60jPWc64H0xfA/jzQtYILKXAiBb6QAqeSF5PokaRc s7bHBrZR4LjxnBG90wC2IfuQ4wgW4HjA8+Hunh5IhuFo1EezNppm/Rwnj1/3WWSrt2ei4QRP sw6OFxC/36Fr6+mR2mRydCSmk2PqHTkLokwnBSmZI8UpKwcw5JPbUaZL8e/ocrJlp7NlvlBo 4tEv0wA+oTWbitHRkKGiihZQLNS5LL/y2I75lF7bMrAs3bmRb1epu+Zqwbe1bEvIaywtf/e2 9V8ay5hJaenW/V9cKC7LMpzZaLcaVQH0c2bGWBotc0P3P70gPicwb0t/wOP8rRFKpgjKcajB PyPz87RYWfPgvJld3bu2rOgOOW2Ezkg5lDo3iGE1ZBOoDv5VWka7XBGPFsdLqE6vdzidJovF 50FtXh+kB88ICnee5Ez4sTLhSCRQLJX8XLXSHgi0t/sySVsmk1ydASMZkIlFk1VE8HFcuL2U yZv0KC5oixDMkiEZ89AWRyAsRFwQ0pfrTT01dWZpKKsmTUwEB0poMB3ZSmwg1nZOXFO74k3x JWabF5Ud5JDCBJxxuXew66He/P4J8UboK/fi2EiX3pit6MFb+owU95q/ROigqKgXdK5cOk4O 10sDeiLXqaunCXFmjJENQezQgR/qxY64x9iJ2n/PZW2hIM9T8R5x/KfBLBXzQUPQuGe0At94 IG0LRaaZRQhyhCPZnfyg2SvocdgrHhiJpUmLxWOSvb3d5fJpdDaNRo5qdat1YJEO9OpASAec OqBDgUZnslsUBfayy6NBBWSCNuTdhOua7rwaijQrt5P/k1qgybLgs/AjtlTjHsNxQgdtHX7E 1q4YTXxVh6c7BXusEkMrgRZKgB+VSVWE8W9zLTZeaH4O1Vfh55CASbKQZjMhVaulPfA/qyNK xZIsv7fiOhuO60q41WJxmpxARzhpHe30ETobQeggf+IpHJhwL47iLxHgJAH2Eo8R6BixjUAJ ItyRTqVimWw2z/n9DF0s5Nk8y/rCMVs4djgGVsVAb2wkhsb4QBgv0hiXz8ZSoCpIGQWMYd5p JcwsJ/gtN4DxsgJF54Rqbfqrf4RDuU2ntO1EnApqzUB2n4qM79PunHpBgSVugkFHMwBo8ASG /RMsYqBJJqqv6m2x1u7ajnmHr4SrpQKnr+d0iaTV8IMRrV7sksGYlmKM/qSOaIBRKKdD5tlg oLVb8Oux93igsQXLo+1b6hcqc2JmGDc4aVPYBpbV32WSFB8VBFdshoD2+NJWGZEGvpqr/xkg 0U7aYkf5Zp9iXbBPA8jdUtuLVvAMlLBWsMcKbrXeYUWtEK0uQSbgAILgKpWPddlY1rWaBb3s CIuyMMZkORUi+OUu0Lug0rLgBii3ZKS+LWcSpmF1CqSTbX2lAWHYgNPwOfHFDNc1G/p0qTvO GE9rNUmh9sCJoDD80feJdDXGGo43muZ/Yy86Wjpbxs86eYPHum6s/nvBGatEUKnx0eEnfRVy 4y74SXMgJRlWo2ApCgZQ+WvhZeBuYhkbCxCWOYcABxJC8giGQ7giHjdwIz6P2+bxuEvuUTe6 jQVulnM+w7wMpTsNQwjSZPHKcaqWIHxO2uZ00rTTOod6kHqCwijqhPO8E005gdOZyOdEMekJ zgyBUMjLyYPyUiqRtCWSyUg4nQD+BEASIJGIOCmC5IJCyM1a9R6vNykKCEPTWpWANqTYj69l YZBKKns5U/NRE+lAhi5s6X3TuGAK1I3w4AaikDP+0EHWatchHT7Vusj4xBPYO/L6edN6aALT 0Ftj/A2vJTG+AP62GPwULNRlO1q8piM6Y3amvl7QJysJH/msavxn3M2qpzXajk6ivh92XcSB fwd3h1M0gb03nkT/F29r6RXHfxXIO0KCINhTs4voyEffxEzjF5wRMglf8yQLLPqsy21S8cq6 2f9H9UfYqyHk9xIB/dwAeZFETSQpN28VYDYAMOgCsRMYwF6xgBMW8AULwB6wAMtZANCvAHAI gL0AbAVgEVglg4GLhILBAM0wVptNfo8yF7BxgRcQcBA5hqCbkPsQdCUChiGBB44EwIEACEA4 2GjOLTAkNBZGD2MEvaANWIMCor0A+wsgKaXLSIW7YX+kyGlGYWlYwL6/Mw3l5RWQiVYofDSN 5Wtywhp2SnMN6wlKkdevvs4bymvsg5fAkcOG7g49+DThzSV444eeevcTGm1llr6+RwfthyZe cC3sgkwy7kfxeCCf5Xmdt5j66BXMN/5DZ8gCYyxB8Io9EXRNq8gjKNIPlV4RKj0XjDvulMTD beDxCNhmBntMYIEJbDGCBUbwsgGMGY4b0B0YWIqB/bKp3Y2ia8BJcAH8f/a+PDyOq8q3TlWv 1Xt39b6Vet+lXtSLWm61urXvstVaLEvetFjybsuL4mw4jh07IQSSON5IwmRiYhtCIHHiBZIB /OYBgxOSF4ZHJoEZyMwwQGCAefMxH3H73apuLXachfm+9z3+kM/n1qlbt6v6nnPuved37qm6 BMl4cSK68snK5yqJyspa9p1roh4NaOwOhSjm4LLxGeYdi2Vs+97NHppqfl2IMwdfpUQZ1HIS C6tE6017nvrbTYOHV1WF+/c88Pne7L2bG8VXeaSQqwy0JVt2DGYDeh5PJOCq/I3RzGShodoN 1zZfuLetes3B3jVfPjrbX2nrPTzhWeVURlO1puhIsy89vHVDQaWKJNPG6HCT19cyMjmFlZAs 8QqyQicaOPa/eF4Ip4XAZxq2LBQyJ50OB438L7nMFVfEGSeMpsz0FA3N9ACN03odZgazy+uQ icVRhcasd2jJeNRBOxbD1WslbyrKgISRm1DXDXbDSgsBVk552cyNrEK7eB4qwVbNDWEWfEKd 7+zKeDp3P5irWeFqFwghs4IsakXWRKVHdk6ZaCJfoZY5Y6MtflMoZbJHkI+JS0yRruTQ7d0O maj4J51X7kbNJOllMbyjxu212ot+kcLdNlXvX+ZS8PnIclqKz7GWU4+tx17J9jy2Hs6vhdNr 4fnVcGkYnhmGY71wpvtiN/5iG3yxDXbLDsrwA8ikpLBLAgPiSTF+loC9rD3tw2EQNgCuVKVq FIrmQafLxZjV84OD482M1E11yJ2tSyWT1RrUm/00rVSpNB2OGoVoZN6+ou8xsb4IAwSiCKlW RqGS4RiTe2/O60Rj4y2iKTeaIJ+vZZ4js+BaC7E4aM3uBsbju50h4iMsdDey0KH7RqpCK3Ye Otb9NEfsseo8lZmQwBeLq2sG6zxCi2Vk6+0ZhTveEglkqlyUJaJUgyu9fTAhKdmyvy11gy03 RW625ZGzD88ORDn34wSXEDIOvIBn9fnFslihlsZ5UrFQzMeFUuPv+YEVdw1/rLmXrP0CsvYI lsfOI8/LD1/0veTDLwB4GOk3pSPhIBr3rJVBqrIy+AwACCvTiLSNtNVqQKOkgB/NC/NCoVVr oLSGDQYwqJTaaNwR5AOaUPNZh8FacinEQrlW5VBUhh0Y49WhcbQ0jM4FI6PRedR8y+7ALEwo U8z0dgi5bLpXI+XAZAXBs9ltzFvRS4sEC16auxyoZPvP3CuxIzd0lqf/t1glEiklnXwOGrT8 agY7B9HkJn2ClEC8mYTjpqa2pkRFYmh76qS1O0Vee1ugFce2jaQ1nlqn0aOAKzhe/C+tTWqh 5RyHgwo0VLHRSU+Fnaeko23RZatyAWnxu3VprgP+hFvq1uacy5B+OWi+K15/l2BikF3YL7OO iz54xgfHfTDou8+Hv4jBFzE4isEh5MMojJ1dXQhlGBmNiNPJZLbH4/X6fT4WRS/PhrBRDJdh VtQxMY34Kc3zGvxezaMafLcGxjXQp4GcBmJoUG6s8AHmkyO32xdNn0tfTuNH0ifS+GwaptMw nIY0LXY0dnW1NaJulRWhYcvjWekEJ80sMCGnQ/4eC8jfU6RKYIWd2coHc4cIn0dLeBwdpt6L zPELXQ9B8hjjLzNdiln0YTtbaYAr6cSuii7ENUs155aJWHcS/7UNV1Iid6hSZc+EDFpfjcPV GLOm1h/uduYSAbnFJbR22HDcX9ds8nTWOvsa3I3VltjwvmZXfdwn15oUNvxZoYJ09trVVpVQ F6xzW5OJpLUi39wdat3UbJcqpFYpdEgN0vq+KpU6kA+lN9VYc809lbnJZic6q1MzuSZbEYIS sfPESDbsdDA7WOJ2uxkDGq/Ct+EEjlNqtUgisRrNlNFs1mqMEsqodahJB5hFpengnStvX1lw qw8tQsojVyNsADhSirXFyuGhsmDmnTbGW7AnOKI4AgvumGnH9xF8M1c5yaKbrMoGTKLXdlc1 xTxy33LiR78Uq0lPxCi8VmuOqSiTUuBw6IN1Tvw7Gn+d95eoPUeRN/BH1J40diGrSla1VOED YkjX1NDVyHnmCgSMB9UbqaYi1eer4XQ1HKp+rBqvlkfoyJrItshzEW4kolmG4IXT41kUw31J D6f18Jge9C8hC/REgjUCjcxZobdwobrGkaaRHL4WlLHRnkWhhnKsZ+TGiC5EygkuI/PQb76I jf3AnGfLX4iG3xI3R0rPkJZPcf4oTNQ5KfEOecIRWLd22Nl7Z39QJt0gksTqSfiBMFyPfN99 At7mjfX3REMxxU4uN9vMIDZjOO8p3pa+M5xusAk8LRMZuiMKE/Yayllht1No9C4OGKp0Q5vi tYktCXhI4ZRVxdi3wey+/i+cjUjWNPaFrJcGq8KKW61GJGdSQIoFVqMeITO9UY+Qd4t4rxgn xRodqRMzGghodEi0Op1eZaGAojTPaOAoEmxW36Nfoyf0Or3IaNVQAhArHMqSkS2Cz6CvLOFh 3RyCWEAKZUgsZ9fG5sbdkRIgRv2T0qpgXpI8Zo8VIkS4E7iC7wgahHgVrKYtlXYSusj03vZr v1P1cORmv5UREi7RufQSg+zar+A/Q81qvc5ux/dOX9MQ8VC6QgKsPO6//jPeDJJHEnsnK/R4 zwfgNMJPTHv30W6Xi24JQjB0IQSPhODeEEyEdofwgRC0hiAkU2s0LVawGq0ySqWCSonsORrO 0sA8XtRDb6M5WRnQMlpWk0xEVlZBVfiZ8IXwd8LE0TCEI0jgYp61KpKN4BFJpVXM0YSqRAmv SwUahxujSuIrLZ9fqbvCvLAJubCREthi3H35q5FyfJw5jDJmiLDcSLlCqZS1X/m1kZFX2b7M jnnM/iQqYIbAklkyrr4K5oOSJfGyErYncLOI9mqFCOG4oFokoEwuAwmPkPagkSTwJDTpDIGI CLYIw3d3FaW+THHAX8elLC4tI3olHTRySYlafu3/wEtjdY0VPLtdonfqFT5NEYdf2OqMtI+L 1LFp5pocX3ftcSJQk6sQsrGE42h024E0Ug8V2eUVtElF6cKRSABZJFlDJms9Pl2g1mPQBXgm v14X0KWEZBLZbpJnGg/sCuANDACWB+gAcQlNoSQcIaGDBBlpJStJIoCqMqod0AUoXWBAt0f3 ko7Q6Zj9jnhoIvd407WeWiOfZ+J5aj1WE48y8UymZL4+W1sbi15KwpkktCSPJfFkMuaxm+hA 2BGxkbVZHcUD8lZWX7wJVDMLw0hVhxg/4pCUWQRGHzeE50fYczA3Zcnk89VkMtlCTaR+eVmr pdcSlheM56KUKguhnQ8iuRdi+RkikSjpdosoU6WQRr4iMelkHhcJ20ndsuVT+fPrtD6fV0MW B4TxCI/bdbmi2hcii/cLNeHm9S1vD0mMrribUbDNqs17Tl6Q0LRZrDAgVVLRwcbLxR82d7mE uMPBNSK/RP2bb9ryRpUeeScgdC9v/xlYPc0xS6nfIS3fhrRchV3Jeqsq/UgF9/GBz+ULuVa/ l/J7/X6vXKGWSaUpYasQ5wvVWr5WyCivXq2l1Nqj6tPqF9XEHvUhNa5W09IKqKjQ6vVsyqT3 ghfOeMFrt7m9WqnbrqcdNtJfqVZwQSh1yG5WUwkVpRavQ83FNpjDGwcqOePvV5bW8edL5hSh VS2M+VICNefGWbMs+jgZSZEDfzCHnEjuw6QunMj5ii9nBFKxJewUFT2kd1nILk3Nkiqj24zm ebs5YKgoXgWprQFNbqjTyGzpUPHkP9BxSmVSCh0Ola8h/F143B4yiuzY9eulSDH3MO4imXA+ D3vrjU5MkyUBc1eI5FkAx0XiKubF/OCvRn74lesP8/+NewYbxFZjv8o+uHcl7A3fF8bPOyDm AJcDztvhjASOSGBIMiWZlRBtfEgmG7p7epoHBlcPNTQ3W5hHRoZCQy1D4B2CoeW9/f1rH8O+ iHxC/qh2FB+1+yjKV2G3kl8hcZI87jvjw+/zga+5e7lvdHVoaHW1VmYyrbYPYli2f7m5h+ty 9Qiqsw3ZdDpLMDkWCoSs0J+rctZbv4Jcu3eusq9tuBKRl/pWlF3+Qg7iSIR5tKwcE2E1Kb9h BWwxDoPFqafz6Tz2eYjF5PmwK9qauVPz0zg6P69TFVJ0BWf1xNmzL9/Wf2JXQ3T04Ap/zCSM Oo1ed8CkiEed+U2Hm/a98fILo62Hdo3SdDJRY2/u0VEqSqlVa9xWNTFEgLQi4Q2Irv1U5K8P Gbma5sCWmR1VsBUuPfjafbn4xs9P9Dw4ndFVOMTegJE2grVuXb53b49n1dnfPrzjh189YLcH DEKXRWVUUAqZo8b/vscREBhCdrXTKXU3JX+G/0Py9IXzzUzPu624iruXey8Wx76SXdscZ/IO 9nqe8eCH7bDXDmdtcJKNSCVtLTYczUeTSnhJCi+y8ZjzIvhrJicBzvDhBB+G+FN8/AjvLA+f 5cFLGMQx0GJuDK+OxzGD0YhwQ1LObBMmd2KYMBCPRwKE0WBQ0zLkczFJY+wiW6QSee5s5mRp ffLWUPnmNTUCn9fSfHqXUskmCc+lH3BlThwPdayN5h975L7JTHjNgyMNO9YP+WzB8X2PDu98 5UhHfu/T3/rxtuq1Lm9YKbeqvMRrUqtueG+jqf3I//h98d1Th996rMfZNJZRd905FB4888cv fB48QPzoZEEtEokNZuYdQxjGd3I7MB02hJDUpmPdcKbrYhd+ugkONMChPMzkIZEHZx5ezMBT GXBl4hm8cRnEl4F7GVxOwnQSziXgVAJaE+BJJBP4AROMm3aZ8H4TcE1qE/6w8Skj3meEWdVx FX5cCTolXBbBCRHz0Mxd2ZBU2jOsA7D0rKB6VnhWHFuBr+ho77FU+/09PR3mNk+V3a4HYZtg hV6nrsEZsV+NoA/UV965yi4VRyvfviqfR76lxIUPhMo+8M8pLYvfwWwUEOIw4Mlpk87rhO0z JVyFHOG4I1rO2cHLmQ9zMfkQTnh4PMLgcEueBsGFdTxD9einJwwuafGrB/9waYtE79IbrWab mabltpgjuqK2YvBl8L8Bm/f99Ox4490vbs/tnBwNXft3MldI2uS/FslF5ujfaTQaocEowbd9 B6i/toxOTxfiOE603H52rT7iNVA6ykEzmRCO/Jr07m8caE7u/+GpzT/+m89HzBYZ7rBmVmUI n6tZK9PK2N2lkIZ5P0YaXg/i7DNPFZ4v4LsLMFmAQgGaCuAsVBfwr3fB2S54MQ4H4rArDgPx yTjqAuCOQ1M1XPTCOSuctMABAsaJXQQ+QICGAC4Bj+CgwlfgeGFFX58jYY6DNI4csVh1ddBm dzjG67OhYC6Yy1mGR6nh0WOjMDrQP8w1KZXDwwPmQrW92h4M2bMyLUlm++LZbLyPCOY6CoLg KFZRUjSjZzbTAvUqRtsL+QE3Kn0hR4DNDWBSgEaush3yo7riR2qbuHVaAVtQHl/ZGNbCAg1r C7KPUjpxpOAkCF/3jpY3T3yhfXXaInTe7+aJ6HBK/+Q9PD4H1BZadNfa4zuXVxs5nrv/9KY4 1x2pUP9Gi2yCy/tQ9RdfFrkl0aYgde0Xwbqcukgpl9GekJZXrFUZVTKBHhmSJ9PaEBMW73eo k6NtRHVnaLFtvIVsYwT7j+yxM8Mwu/LwyuMrL67knM/CI1nYlYWBLFRnG7O4OwsH607X4ZN1 cLEWzrngpBNmyAMkPk7CAAkUCVwS+oSPCPF6SxZkWchmM7I6qKtLMC9eXj04sEps1+tXFfr7 29uSiY5ER4dlFVCr4BgArOooDNb56/yJpL1NY1Eo2rJt2cSqQXO/IAF8T9kWmKkTqX+xJTBT 560iXqxtLM4UGbllNhiygfkEhw+3hDlT4NzSFPAbplLidkZX3o/s+T+Ay6s8XIGlqrY2ofrD yVlHYUWHyfOAk8t3JuuMD+wUk/yKEGqr6NpZsq4nZlNyukr6+nADuKRw6oMZj5rEr73Ld/a0 Fg3KgKUqpuMUtwf8fonLpyIcDjozXIs0/uliE/cH3E3YVuz17MD0ZkhuhksJOJMAZxgeq4IX fXDIArst4LYMWCYtRFIKl/hwjg/j/Wsa8vmaxqamNpPZbLVYOtvaLDVbqK1YMlWzpWa25nAN XrNlDaLtIWZgN5PTvbKaaL6tyWxpaIi6FWazXkEko1uGOzGuEDlF0VejaCRfyFKJXFGk6q6y OSpsGvWI/BZ5EOVslRKC+ED3ds77Q5wbsvgWJl3O/JyrKkef52IbN7tSCyaRIH5gbGhtq7jj tYd7M1tPfePvd3py6bgpEKNsNpF73M0lY6v2NW86/9nNrc7k2ns6bJ1tDYYOrojkW2N5hxgP k7F80CQZD0ze9cR4ZqzJKTV6jQabik9KSJXZoawcXN5ur5ZqFWT3Q1fv3PLm5cd3ZLlCiUCi 8uiLy6msJb4q72zY84WLfze28YkNUVJlkIFIGQz5ZTaHgnA6JbZ0sHji1D9+Jm+synk0Ppta rjWIKNqoE0kpKc/cd3S21NO5zDyfx76XPXimHo7Vw8UsXPbAWQ+c8sBhD1x2wxk3nHCDxwUz 4gNiXCPuF0+ICa4YxkSgFhVEOE8EYyT0k+Cwyipln5ERsq2mz5hwkykXCAbTtbXhWMySAyqH evUzgB8G2API3wBYloulM3orRQlyGXMtGQ6aQeBn+3UpnY6dzNlIHgv9D92Q9oK679sf1n/L 76Rb0OuCr8taAQtiFiJ/1cgfJma5Qj6nd2T09APburxihOiNdtphpE35lgjqpMnJh5773hZ4 Q5TujDnk74qUdCiiJK/9Z6IlYldw4iq3ixZbHO788OTWuL7SqaH0lM0cqHHkRlPrT+zorlLb wZYZSr3/c2en2eVVIeCI62O9aQwYlEI+gTSwCzqzr903A0MzUzOzM8TKnTC+FTRbYXwLTKD+ OAX8DdoN+Jn1F9fjx9aDoLOl877OY52cqSwMZuEFPzzqf9qP7/Yf9OMOP3D9aj9+wQpnreCx wnkDxA1NBtylBz0BAgI6OzrsGyapDR3tGyYnJ7q6u0dGR1f091vGJqixsYmJsTWrV491tE9P dUy1W6anqOnpqakNY2PTe7QYSYbyaYd94/TUhtH+kbE15lGlhMtNRjMZ93aTaVQwMTm5otvc uXF62t3eiVT55tXSYjzSF4N0mGmY6axX2XUK+ZtX0Eh97SdvX2UGZza8nVoUQJsDN4syI1jF HxKUVt/nX0F7y3/Eh8CfuFK58FjDh9nHDSv6i6LDbmZJn8/DcXZptRZBoj4EiciY0+h2es2K ZLU7O3Vv057f/eRbLZSysCp3x5aRvFOk95gNdrpCT1fk25kRf9nkoYeP5kC0lcBhs7ChP+Wi fi6mzFUZWnLtN2J3usqv+y3n/Z9St3GsuW/+e/HfHiucmGmARM+DG+t0dgSU/CxQypaA0j2A wb4/tvVrLXZLrLGrz6P02jVoMnAa/DWWVG9k4J7VdS7Zn17lROy61GjT+/8aGjCZbEqewyGN rusj6jl/epKzZsf7xfHi208mNp5CY8Ls9Z9xH+euxQrYG9ndx/vO9OGHGd//cid4OuFIBwg7 oK0d9O1wfxu0tYE7+1IWj9c11eFD4akw/mIQngrA5wLQH5gI4AO+SR+udb7kxC9UwKmKL1Xg e40wZYSDGjjIgXsJJl05rahFAxHU1lpkfOBTfCrvQVPF8729A3kWZMUUerEYa4lWCmvTacyO oDMDqZj0UDQ+lLIXS7PDyFUmsPFR3h3r33FuOavPj/CcOTNAAIxbrspjJgWOxtvf2xK3SnUV KpVBZ9Logip3yuXJh01d9z63tvv2QqBu++Nff3Pbxmf35b1d2z79xVF567517RG9MTPW2nF4 70RfvV9rDDdzhc7swPqNMTrh1lgcFrdD6alQV6S7Q9PfOTWa2XJ08I7/+Mk3jnS3fOr8pt4v nXny0ztcztA9p7787DOtdbetTqfHDh594rGDkf497bYSUuMdQuOHAhvAfp8dvtwHrMqaclCd g4l6GKiHxnqI1zNIbSoFopQxhX85CaeScH8Sbk+CJwn6JJBJGDO/YMb7zfCCCZ4ywSMmuMcE u0zQZ4LDItgrgjpGGWmhkImDWOOBQH93T09rSzOmaG1VKCyqfkql6j+mAlV/a/dyb9jhwDjN DQ1SJvAhUBkU0vQcSistTTLJz+XR/dY5vay3Nrdi/xH6nFvUKq108eOfwHejNQur/4u7N/G3 xpDP3PKpNSlX3fIAXav7Z5H4Ixy3oZch8AbUAvxX74OvbGkco7eYKqI1BvLat4WNhWqrDP+p SMSrGrq9o2EkpecSX3VltB/psH328wOPba/XCIp3rIw7PBTX4bBl+mPM209ri03CzUjHSuwe yGQ/Pbh5w2b8zIaLG/ATGyA12TqJu9aDdj0c7IWD3XC0FQ42wJ4GmGiAgQZ4IQuXauBUDdxR Axtr4Fzqcgo/kYLWFCRT4E3BjOWABZ+wQJ8FuBa1BX/KDH1m0JgZLD6AQbNl69YZwZrBwUvT cG4aDNO+6RPThGAapi38LujqyjFWUScQ3HvnHfvpRDC4f9/tt+/cgSlnlDMzlv0UtZ+6jwJq /8y+O30RpxMj7Duat26V7b/TfLtgeMW4jDIqZbXz+P37ZeOIvneDddzaky9lIoy8x1hBeXX0 4wH+CMyndnA+sb3MYXwLdy6JIR6PxucevWZzGdwuNpXkBmu6rK3zrjsy4DH60S2k5oj6rY82 p1cg+CYk7r+wJRRZ//AauntgaKCnwj+8Zl3EGXdQXK6dlhgpiX/lkdW9h+/Yk/Ft2Xtbdape vkugtIUTlPDa/yTtrfkaFf4Wl59dP5uKtUYtMi6X8+zH2V2sb1OifnaiQ91y/NjnPrXJFRnM uRWuZUFHAEjKpHT2NVe6uvb0xp+++t6dOB8vTloajCXwwK1oZt7eev18cQ1nljuFjUI6ez9/ lXYV3t8Hh1bA7hWwpwue7oSDnUc78ROtZ1vxfa0w3QqHW+DRHBzKQX8OErnmHD5Zv6ceF4R1 YdwTgBYfpHww5T3sxc9bIWaF2wiYImAlAa0E3M7kS23E8TYc/qrwtQK+s/BwAXcUYoW+AqEt AK8AhZU92fr6fC63krFN1zf8cM4PJ/ywyf+AHx/2Q4cf0n4I+cHgB6Ef/CGXa00PU5UOybgm UyiXK7QXKqJKUqut8Pux9mh9/TIE6KOYjE2MKUETxtzYaC37Cj2EP69+n02OUaYWbG1hrZ49 /DjjhFsEbRfZJWOn7tJTl/P5NDfCmMVL/7Bv9PS+Zm/zqmgo45RHrGqb1apSOk1K/8oH1g4+ PJ3WJUeaDt7dtPOxXndNcpkPlypVQotD6RrzEPxQ7+a6qlXNAWPtmob28Yxx5AtvFdekxg73 pMbb/BTtlAd8OpOOcte4KzeP1tXvOLkyNbVpd+M9725e97k1lVwxJQMOh9C5ivsUAW2wP++p yK6tq161ejrfeuC2meTM1eND5SjDbdwfY93Yo9mBkx3nOvADERiP7Irg/RF4OgxHw1AIAydM hfFLPjjng1hrfb3f4XQamWxSo15vCfqpYNAfdLv8mQbkABgdfrfZKQjqK7kaTSUmlWLIV4iw oVjkeabY9RBlyWlgcgMW3Mo58Pj2DXgCSukRi96AWJo0oOxKlvs5uD4wesx7kviftr7+tSPe qgrKY/YH7Y2T+eR9bcVfCsV8jiOOwPC1h8jEUEtSC8btq479+qmC1OjSG2jkydF0rpXBHbnN D516grvaZDfZNYqgzuKp9trqIxaR4P0MHbDqxKV+KAyNrSR+KO6+6/FufaVDg3QTNAdr7Pl1 mfETOzormb2Xsc9c/wWf5t6NvLrXs9vDVQQeieC4NRalYrEoxPbEoD82EcNjUa1OJxOLrU4b 5XTahp0gdILTdncUoraorW2gDysUOupzuRrkrbV1UG0dHQ35ttr6tgZzLuwlBJGoTitT2SyW qMDpFQv4hZpYB4bjaApj9PBO5Mr361h4Xxl9J/JqRM68kiD15i2yNRh9XC0/KLXwSo5SZkJp CWT+/QNcBgdUOCF+8+tDS5vTzL1M7YNbVYWIm3cIT7BbhDPY0A4B4mEgi78afjA6MbeLlVSe SloVldbaRftYNQ5qD7P7WK2UuHNjrYs3FO/2mrU6dkfxFkcqaJcimB17P3/kfHBlLpEfKY50 8Uq7XBnSdF240um7DR5qDVI6jX+75e3m5Vc5LyiNCuHC/uOB4EPEty0yX21PrPTWW0EV90Fs P7Rmr1zcB6dn4OwmOL4JPBth1/J7l+P9yyeW49zl6uX46V4o9D7ai2t64WzbpTb8RBIeSEJr Ej61f3+kMgRYVRWGWSNhKhIJn52FqVkYnoWOWZiNTEQgElZrNBKStNppym6n77eftONCO9jp MKL2A31Ta9e2NzQ2plMpS2c71dnZ3tnc1D46NjTU3Yxh++/81OyezlSEjlUhy4p1byPSDe3N 5sZKN/Cqwhq1REGbTGGB3U3y+NiHGAazoDISTaXeifwEuQiVig/038icSzD3oP3N1lLKG1hs MCUf84NPNv35NsR29D9nQEAjN/qfKHurbt47xX/9xCY2YLCaRqYmnH/2+NHYeOLEI3euM5Jc rtSgEYpVPGa7tU9uiV8iJHIF588acZQIoipBZtZKgNmqDYuV6X7s+hxBEvbC11n6T1yJJz6E ZvHXERXxInGSOMl5mvM018f9Z76U/77gecHzwq+WSKQUi8WnJHske6QPyB6QD95Ar8tfV6wt kfIJ1QhlVQ9r1NqQzqY363+r/63RZPwn852WY1YjrazAK75pm7JbHQ2O687rrl+7v/+XTB76 k5GX9jk+MT0+T1eWaImWaImWaImWaImWaImWaImWaIn+ksj/2hL9P6UfLdES/Tfop8FloZ9V fYahsDP8buSBqD/6v2Lbq6vjWHwsPpboSnw7+WxqIvW7mnvSG2pdy7jLNmfsmXN1M9nJevX/ Jwos0cdTznETfS/3vfzlhu/OUeO3ml5uern5rpup5TsMtT5xI7V9tu2z7f/U8X7H+53P/6VS 14nu3y/REi3REi3RJyF2y5AVxC/RJ8GwuIEtYXjALOwRw+OYGP9WmSewfvyhMs/BAvhflXku psP/pczzsCq8WOb52O756wiwKqK2zAuxg9yOMi+RcrhvzO1jAhLV35d5wGTUz8s8jvHUiTJP YH61pcxzMI3aXea5mFjdWuZ5mE5dKPN8LD1/HQGmU71T5oVYXr25zEv4uPo5dGXgEOheUtMb ZZ6DhUxfY3kuU27GyjxT/o8sz2PkYw6VeSQTs5Tl+Wz5yjLPlNewvIAtf7DMM+VbWJ55Sb+F CJX5kvxLfEn+Jb4k/xJfkn+JL8m/xJfkX+JL8i/xJfmX+JL8S7xESplPsDzJtNH/aplHbfQ/ y/IiVE6V2yJC5bFyW8SoXO5/v8xzsCr/2ywvReWCQKDMczBPQMzycub6gb4yj64fiLG8ii3f X+aZ8nUsTy2SIbVIhmq2/nNlnqlfkomGLf9JmWfKX2Z5PXOdoLjMo+sEfs3yRqZ+MFnmUf2g juXNi+5rXnRfK3udiTKPyoNNLO9gr/O5Ms9cZwfL+9jyvynzTPmTLB9kr/ObMs9ch5W5YJH8 BYvkL1jULsGidokX1Rcvqi9epBfxnF7OYDQWwaqwMJZAXB+2ARtHfzuxrdgW9H8Gm8W2sSV5 dLQD8cznWlQ+xdYIoTP12CZENLYclU2i789gO9mjcfR3HNXejT7H2JoSRC3oaB0qHcf2oJJu 9upb0H3n7tOBrj6Lrr0LXYfGmOeaJtF11yN+PeK3oXM75u9Dz//6KiyKONf8UQILsL9hLbrC NlSXRvddi+7DXGM9trFctw0dbUClzNld6DfunG8TI4cpth2bPvT3TLCyoLEcOl6HzjCla1lJ 3NjG0nW2lltKs3fZhc6uZ9vLHE2ga+9B393BluxCtcZYydGofE4freg3MdKZYr+3hZVtmv3+ OFtjHNuM7slIeoz9pMu/aK4uzZbvRCWM/LbNa3ChHcz5GfQrptA3dyIp9CFuM/sdGusqt2U5 qruZleRcu9ayv5KxiTH2NzCt2Mi2d+K/ZU8316z52N/Ryv7qTWWteNAVpthWbp2XrRfrZ+W5 c77NCXQnxk7+b3vXAdVUtq4TEkBAsGBFkIMoRUM4oQjoWAIEEinBJIDYMCQHiIQkJkHEClFR rOioqFjAEbHTVLw2VMQ2XgcVRx0L1kHsBccub599khAQy9y15t331nIyJNl7//vv//fvcw5q E2+CcxPfCBKf5NaMdxig/t+tFnP486Ni/r9UzOd50BSlQJgJqYBWBvyBxzEevCRam9zADx/y kgFeGNhFZJUS+gLnikcnCtKrtdJDof1iqC/uaQbJD8TUo5X8x21OAXoooIWErfGQqxrGLgb6 F4GZnwb9Sdiv1sdUR41A6Qjkj8HMxqBmYkin0MaeBnFBBuUooA3EXpGWi05jIeStgJFLBlRq uIbvioN66GLZMi5q7Q4iS5SfzcTrbaDpx0158bl3FHAsBntw79K0OYLXIiGXppfT0gIJzIdU 6CcRrJrWfJaqtVQC60kKK0dX5S19L4cZkAaRTAKQyzBPW+dO6PCf+tawCnS5qYR5r4aRE+nz vjULdNI/12ugQQ7glhC2qKE8HS4qYeWkwfzB/4VKGUQL4RctJXJP2CyriKqXa98Jq4jvOP4o tCiEaztRX20EH5wSx7qv5SiB2DJtZJq46ypEovWyEuIijmoSrZ/p8LSj6xC4DVJoXRMCNM9q GoyMEH4Xa/PgczRrWQkuENVxOweQ3MELg2iMy0iCmIXBqArBHO6hBEChW3PX8oxtgZCu2upt QguV3mM6bf5OD/pOzEdsW/AI1fFA7PTZPB7MEXHSZQ0G+6VU2yuasvtrfUyXlV/uZXjkIvSV ozI4NxDxJrIA08pKgLks08adBm1WansMgT04Mgih/4k46/KYyCuF9mxCSJADrkRPkekzRUhq 6uUt8ewfiIXeQ0JoO+43iRbrxdpaFQHuydoaaTrfILCjSbU546LT8cuxJeFdr1k3B9F2NfCR GHYZaTOc+dzGr/CD6CuB+3TUraMbrQW66XzfcrcUnhglLezW6dV00mqqmqZOpIshDeK9HEqJ 148xgwzBcYuIkApwa+qwhNZxUBdM26lS9LE0xBIihu7aiKtglUj1Oujqunkufb9XDTs8YaVh p2me002eSIV+TP4P46jrBvhJUKb1DGaggRi+4zKb/DIeUIgMeof6K3hMIL8YWqDreAOaobgQ cJRDxGn9bE2c/XRdpsk/uk7W5CNDTGm+SwWxgohVnNbu1nuu8AsRVeqtV2lPlGpYv1KoAb5u 2NH/0wzQ9Tc2iQVXuaQgMIoG3ZIHZzhgDgEoygMrUWAUCGYDwYwzoOBr151hpKJhH2IDukjY 4wgePPAeDsYxEOOCSAgc46MQQB8OeOF7WaQRUAYLcONDSh7kHQZmQ8EnS0uH7wgAM5FgjH8P hihIyAsHu4grBY62JxKaCsA8orewuVYcKFGnWRgY8QB/tnaVCXhzID9cf1x+EPwertczSKsp E/oI54zzDAAahcIRPhsJPiMAHR/KZ0KbCW3DoQ1BYJ2whQU1wCXTtbYSdLh/orQreIxw/ULB q8kqJvQBG2rT5L8A8BkBNMf5B4NVAewQXLAzEFrKh95jaX2GWxsKR01WEZEKgNbgXsV9EAi+ h4GfYL3vePCd0IVnwK2576LhehMVYR9T+x4APceFIyIaAXAkgLHCV2naWPKgHS2lRsNMZEEq JrSYr8+QIJi9hPa67CRkcA00IeThsTXURZfVyFdqhOCiW4/URvpzv+BeZ0Kf4Hrx9ZK/xJm+ BfFAGT6IIBFDwuQyuTpNgSEBcqVCrhSqJXIZHWFKpQhPkpCoViE8TIUpJ2JiOmJpycbilFgq wlVgMgG+J1SYJk9RI1J5gkSEiOSKNCW+B8HZo56IE/7hQ0N4QqkiEWELZSK5KAnMDpMnyhB2 iliFSxIkSlSI1JBPvFyJ+EvipBKRUIpoJQIaORCKqOQpShEGPuLVqUIlhqTIxJgSUeN2cARI qESEyVTYQESFYQiWHIeJxZgYkRKziBhTiZQSBW4glCHG1EKJVEUXSJIxFRIOpPDkyUIZLkuI qJVCMZYsVCYh8vgv+0k3OaAlD45aCMQiLmESkVKOa+sahSlVuGQfOopCakAMaSP4bgR1mEAv Azo3UClMlcgSEG58PLAAcUP4aqFMiqUBVZQS4DsaEiURqYEhoUKlGJOpEYafp4deIKJKUSik EmB/vFympiMx8hQkWZiGpABPqHGf49OIWo6IlJhQjdEQsUSlAHGgIUKZGFEoJWBVBEhwxkIV osCUyRK1GrCLS4P+1nlVDRZAcJS6L/G4BBr+CaOiV0ehlItTRGoagmcT2EvD9+gESGRIaqJE lGigWSoQKpGJpCliPPV02stl0jTEReJKRNeAHHD4mrZEMuDeVGIqtRL4DcSiSQC+Xc9rIPSA iwRIUWPJeKyVEiBVLE+VSeVCcXPvCQlXgSQE5siBKPCeolaAZBZjuJk4TSImVTT3KCgwWZqW HA8IYAj8kyiJkwCd6ZaWeMLFy6VSOUwAratpSJxQBXSVy/QJrwuCS6JarRjg7o7J6KmSJIkC E0uEdLkywR0fuQPKWG1puILwwrRQ4YrhbFqv5dZq8LyWIhSnuIC7ebwc2IS7BpuISUF9Qnc3 r3bclc3q3dIyAg+OChYDsBu4AAO7EpRC4BkxDYlXgtoF2SNKFCoTgM24j4GvQETBdkQeB2pW hjtFCPFGl2ffbwWukFClkoskQjw/xHJRSjKIiJCABYkUeMYF59jMWoSvBZwLrlAjMQYYSog4 tEqHpErUifi0QbrRtOmGa69blkpAnhKycV5KAnKBBFhEuIU0JFkulsTjnxh0iCIFGKRKhAUL WMel4MWrwie1WQIsdAeGqzCA4YADHmutl1pVlSh4IJIoGq2noRKpifLkr9iIl0GKUgaUwSAD sRwAM9RlPCZS6xKsKY9B8oslsPAGECkujJNPxAz6BkA/vGSgPniRKZoyRbukShQCq+KwZpUr NDBUiYtXAaBUS0CIQPEShf41B+D1xmYhfG6QIJrJYyEcPhLB40ZxAlmBiDOTD8bONCSaI2Bz IwUIoOAxwwUxCDcIYYbHICGc8EAawhoRwWPx+QiXh3DCIkI5LDDHCQ8IjQzkhAcj/mBfOBe0 Jw6oRMBUwEVwgVpWHBYfZxbG4gWwwZDpzwnlCGJoSBBHEI7zDAJMmUgEkyfgBESGMnlIRCQv gstnAfGBgG04JzyIB6SwwljhAjqQCuYQVhQYIHw2MzQUimJGAu15UL8AbkQMjxPMFiBsbmgg C0z6s4BmTP9QFiEKGBUQyuSE0ZBAZhgzmAV3cQEXHiTTahfNZsEpII8J/g8QcLjhuBkB3HAB DwxpwEqeQL81msNn0RAmj8PHHRLE4wL2uDvBDi5kAvaFswguuKuRZhEBJPg4ks9q0iWQxQwF vPj4ZkPibz+XEsErRPz6aiKY+RZ1EqSeTHr8N6gJ3t+iDTGglcOrypRv7aHkUfZTtlPKKP+i lPy4j//jPv7f8O2P+/j/3H184jnsj3v5/z/v5RPR+3E//8f9/B/383/cz2+J5j/u6Te/p6/z zo/7+j/u6/+4r/9/7L7+N685A/7WtW/TbzdOAPuwb9IHkocDavV3aCE3uPL9fp0xgEbfewWe BlHreyy8pe2m39SEakMNoA6lMqm+VI/vvLr/zvsGZFTv6aRvco4gyclCeBqWfYf3ZLBTSUgP 4LdvUbOAHpPhdyH+Zywan2490ugA+k/r/5G1ny74n7QQS2UJ2u9dVMT3weDHlqlMltGQgDSl lIYEK7EkGhIqVMs+n8XvzxJrWt5kyB/82K0Fn50IUXbLUY3dEhOzvpnszNeWZFOjPI2dBkxN NyKTGRaomYlxPyuKkY0xCRWamPczIVPJGh8jMjWPjw5HaQYztht6ptuSfoIvLmybcniQxY9Z g/EX6mDAjNpJeC40O7BDqaup9yf3ev774JveIwV5mm58VEM9imooW/MoRmQjI2tPoOKhje1e nSqwuoVChQ+hlnptycZAr1SoJiWSamJtFMlnWKMd8EEba/NooSpRIktQy2WM9qgVPmlqbcrD xMlymZjRE7XFZ8ytOzc9UjF4EsVwQO3xdYp1t6Z1/DGTG18tTFYgEQFMtGdXS0Z/1A/1Yfh4 +3r5jQRDX4MhmlH6j2jWFjXH1y2sKUxuAMMZ7UOMesoCJAr8+Ucgn4Ww+OEDfL08A908fYL6 uwUxUC9GH9SRMMi2VYP4xFMkVEPuZehgsjGJoiG3I4F5cyMNmUxa4vdcxBo9bDX16K7rk/ib n28bdbjfriPzZ4wPGcfmr8up5PX05Ytm7nl2/ykF3ddwMzEu6fiOOVtEtU65g2g5WbMtdrwd 8uitRYT5TNkhTad2d/e9s4hLWNzRxDx9YdGe/Vsv/EyixntUzt4y/MVjZfuFc7t0SWq7LeXW H5X/Zhx81U9eTiFzaeU3evRie8gyZ/qUv85bUN1ze8kGbleO06reG19svhq4a8DAwk2cWhej pNo+5tzzi5Yn0JkFsRxOrfuJy/z+LygJ00wiBlbeqE4vupa3ZX764m32IR3v3PTXJI3bOeXa whCnqDthsQVPU0wH7etfubBLw0GezRPByAOW8m0xW8M7HA45ZUQBZfSLhmwGPGKM2gGX2llR u1A72cosx2yQ+q8dXGt3kE6vO5rjlT0DppCdI7Ub2iW9k6PXmyu8IIX546HvJ74v61dc6V3W DhXgBPbUMDQE5eQF57EyA7QPnkRKKT1ZFye6SJ7srkiS4LPu2ud+Knd9GPEowiCCpKQDEnSE SRtQl8bGpmQyNRQdhrJ1Y9Qo8yetgNTU1NYEYMqvcFaj1ri+fah4CmpZUtq0qEcKniWycROk 5ZptPbp3etmt65C/qj3bPbecqJ7xSlFD33ks1D4IOXfsGX0au6vi+OmcE+I1PU7HBo+4GPs+ bvyFNWfG+9w57kB/x1atPHX49TPO7w+5R+ych9DmS2t3IeNCp2luIKb+L6N3mcn5BeNHPxje uMg4N/PNsvKZ7uXjqhlx7R9LzcjVY23Qwl2llkPaHwwSvigevu7Yr11D7o/wtiv7ZP/b6veW R232m18YID37Kv4v48ROmtWXIl6+yG7zZmF9YY8rsX89H7XKus2Da8KhfV6be7yRljzqkO5E 69dNHrOkJtumpkryqMLa309UP1kRF+nU50/1xwU2nfPRo7OOWgdPH1fUWLna9lIZqjEBJUO5 b4BilVa5hZdLr72mQRSrNPSaBUCx6f8IVrigTkTR2xuuizGEL0mAT/1AYPFfXWBAMPNBfRkM DxS8vAgwaxqi6n9EP+065Qvr30Sj/dGXfM+VmMzguG1JLhOtn7xvzwCHUbtW7lxYszEjryql ivZUM7RveQY/9aWIbH7grM8sytCAaE3I2cf2ez6mJ586umSM8YlrUTGkW20fRt/4+HxvtnNF yrAPKaXKEXuq2Lmeccbnli8rqPDrtWNhx7CguD88up/d2mt0FLtEzjqVMDFuDDr3F3eXKvuI vlcyr9p06JNxtOFVAr0uze7VbduUhvAzJz7UVVikB7s2/vZvSUlbi3EPE/6c1SM37GNy8IAT V44IhS+Wd8y3NN0pcrjcsMq2cVJkxpOCtPuIJtb8j9387gJytOWcJQuPTn0uyEy/FXdVoxrs NPbZ0I7n/S46USxnz2XEmlvM16HRDOCRKQTc9MHhRt+YQ9uQ9ZVKMYCrQusx9g5ZkfcpT9Z1 7f/ghWCud/cidDi+3IEKAGNjEBrYotF4oR74yNi6n4cnijI8+ol8Ua84b0zo5uUX5+Xm5eHp 6+br2d/DTezrzYgXenh4e8WLmiEgWya+F2F8QbO1q49Pr93Jm0+nGC3/MgK2ClByhQqCIMgW kMYgiUH+4ukbi7+5oT5uqC9EQKEBAkai4KxigICsbwrQgeBXRKjRtrji1mRyI9UIJbWoZorG iEwKy+F6TX+u+HnNnYs2IWs6TE9yOlbQu6E2sKb3vrLxbbJWrf6VUafIbexkV2zqN+MuOtC6 1w2rk8sT9sumv5m6fGO2xufnTTMvcIyObN8R83RJeWE8yWpDaJ+aa3VjTI1Ou3hhA/1m7lje d9HpvPttBth+GjxlKGdZ2CJBH/N7JSfMn0zwOZ47tv+rQv/A9wfmFFse9r7iNCe2MeGpi/r1 PJTaYV7CmRDvceMd6ioXms4cm7tt7QR7VyezDjWvNBfO9zd13Xl/aXL2DNKpzaOeVFOx9/lW 0fwzL1ZmvVzf+eeTJsdEPKERN5pt++p9SsfTu982HJXE7s9faymZ6fxw5mC7JEblE6vnx2YF zHnCWGNC8phajsz7VxvHB1HF3WpKD3Z+5PNYfCGps5Hj8Xmecwacy91zeEUMLY/Mn0WOfTHl yOTiRzWXeX/FpmQExnTxdebvj3g5dkLt60vDrzEu2oi8++ZMXx/vE/tbpOfT0tMHaI5bA3s+ eZ/A3nXfv7LdvOEjNgQZCZ1Gdq8Yvax+81BF3Sg0dGp6TUTChoInVg8H7X5+L63nrVcjusv3 ZyVPuo2M6NN4l132Z9Hz0qHUrkERNW2lSzpNe3L69l9ON3oMpCYMp7fb2PW1f+OQJVmMN4UH yu4N4F3r6zljmHgJdhnrsOfq+PJdUt6HivkTuhyjnVWtzqsf0+YIi1XgmvmIzEgeqz4eBeBS Y2IKesBTogeYC7skekHot215gI2FaGputtQp6+cXNDG5excKyEZGd7Rrs0kzfbKCNOxHwGbv JtjkyeUAO0HqSuIlIqEaQ5gp6kS5UqJOw7Ed9UG9UE+Gh7cnih9UPRhw6Iniw//eCfpb8L4+ X1pSe5W9tO/UJHr3Wwdv36laNdwxYsfZ693Ce7d7cq7wXOgONYp0eGh6UbC8M2dZD/+lO1eO Rp3+ICXdn3LwUZZpu9dW1JXPss7Y/+rZe87aFw0JtrQPU+rm2j2oC/8l/4gj//TCd6zfzKrH FlUX+1M3vN0k/Tnhksu1IH5xZvU9lyC68/ZMbiSv7V0K7f347GxUNudlDLr23fTfc8ruO+RM f3Pe+mWbcn4ybxcrez2bNCw4voOza/zmnLsXTDKGbXg7q7BDcCczzfpZjyMnfSKvtotoM5vU Hg16XH7DMWj/MTfB+qKek5iM1DO5tQNn/pwvNNptZ1ny4XVuKflsrxBB41vjyqOIhQ7etwGP FKLt9IhjjFLAhwGct3q4tMCX21GpIP8y0fYmZtqW0JmMz5DQjJUENmdkoxkL0ztZbdeMGxrl nHOvj/WHvrfM+ctj7m7MF20U/uPpqWmftqNL/rC8gh2hqhENptZ0DI0gmgIHDUZZeQF5zMwh 338s1i8rgUQcymFDEBg0BDYKuptBQ/D9O0di3I4Agut3HoeBr9vnzKscTQnsf71+147Uq2fT hoeRS+jqCaOS21pvO3toyuK99JqOGxYkx+2NNvo1HLGOWHV98tDb0fuLRqy2vWVHzty+f9KL +dWPBpKf3D602Nz45EL27Wf8zte525berVs4/mL6kT+XvTBxn02pX9K3dy/F+78+3J20im75 2vS24kC38LWLksyVy/fm+61JcKsabvUgbvSQLivnI0Num9p4vD3DGDaRMaif0uLkA8Wgxtnm 1rVHzYWLnl3a2/Vh+PwZVd79xv5S8fDANAv/KTV8pcMT9PT+SdjoUeSu5p2szv/RaeWrn/4V P6LMzb3u7ezMM8Oj7q9VLJNu9wut+SutYmu3yXGuTzfkunqZpNrEnRrUM9le88ziBG3/bwFl 994+mrb7zsbNau+94VUTHDs6TbT4ibdgwsiggE4HysqKwxJOrvdvTE9zSF/XGY2/799xrM3J db0cqgPq+9Xvb2CfodVc9kgPderL7h078kHU0003Vq09PUB+MMNZbdLhyUSHilzNEWfBnpLx g7LyJwp3yfKtN1VsDX7WUf5xnoe09FPt8JMLHE/FH1xrN6ej2GiQW1HM4r13He7tLj4t2jVJ YFzDpEdsX1ZcMGlbWd6KFJsrS+dYp/Ry99jcRpY3akGfiryns047/P6wJ/fU6iecm6/JmDzL YtpJyck/ZQ8Kc84yXButqkaNvhzWI//yO/d1Q+iRXZJOWf/yEdWYTkY1xnG6VmCVfZ74GzRa XgVkzP1HoNgDRYmCdP2egmy6IGCAtuHrgXr7EU2jPxwyUHz4X79g0Rh93juM8N5hBHoHqLlt z94p29vSd1yWbdW0D/Pa92LPCIf1/j36JtWPjNi618TXhsrZN6Oybc/rPknHO162eOZ7dJVJ 8Um/i+RODP8LWZZp4jnTl43rLS1ax1lTnzj2fG0uv9ScVll0ZUu/nZPNii6tiDk9zsa4Pn7i fQ+eU0f3um1tIn4rCywfc/kYnZKyLfHlr8kvB4zO79IQtO+mr3i7TOw9aVOeqJ3bhaE/v7lz w9Ty4ui0Ao5rneWhPOvUQ8sGPX1/p9/I9vZhUS4bJitvdhxQzhl7+fHjgCUzr0wpnZLZ48rg kgVj7mdxZ9m8yHePuZs90G2n54iq8sGfPC6UUQaVlBYt9Z1+fm067VV41BIH7z6VfjLxDP6+ Ne12dHec9WvDPkrmwtexz6p5FQuWzTlw2EHdJ7aby54zzi6+fVb6Dev/29SSpTttHQu3xD8S 2o+/5cJZGzv3dp8xFxxCBvOO7Y4e0pvy7NzkUe4XHe8oxrQbHpRa9oZ068B2I03s1cOdyw72 qIkMqfPLb1fvyDnQbW/gVNbdI5XKyTeVdb1rK4JWVT09aht9debCR2EctHDbotpHo9YXfbhe HH/7SE7GlMe/Pw6p47gWWrtsKpyWkP7nvLhJsaXusy5Frxldkeri8vxxcqXLYtrioT7cI7dm B2YdMwutqikIcFcvfy17MwkZQbMeM2756sFcz1l/FM/temNdeMOK4gNBedKV52/+PneBvnc+ Br2zvpX219Q8W70u6a7f0MmI2ranOYkPnwYGkJjN++pnTdnwikfpNsCIkR3wr07G4bceFJ5g nHPM8kJHEs0Nv4HKzQvLC8nk/K17PqBuQdWCYtVflMSinrEeHrDNjTVoczw0Ag03aHP+39fm vsJfjWasx5VHqBk5aMYyNGOJ3kl0CpoxEx2iE2dE7uL5rcsssVykApZJkoXKNJFCRU9UJ6ND 9QyMUK+eHogdKZSEkRLgrfxY+OCVeLSQBkYq7a8QYPpfpKAjdq1diCW8yCxYeVOQZkO/cFmd 0CvXYkWHW6Klq/xXTDuf1jb7CBZLpw1+U6k8lzzz06Eh981PD6wI3vLLS8lVUUUv74KcMdis 7GnzgyIiL7ddOvW8TYjty5/85/Oqiz8m3RlsSnfN/XNQj4Ka3Xapy/xu14tPBQ6aNNnxpfW0 TdnqmQsbfnUyCup7dF77/Ru3GLfNfZz4LpG+PK/vkL5JIzgiezOJbOTKFXdnNhxe/DKo340P A6sPej+V9dl5r8j5cfX1l1ZFq1xyVoZZDbJ40Sbrd/tKj263n1W5nR21bhfHz/y4+dHjO3be K71ytfPc4awRvh4TnG1mlDQ4v7lBG4BIVpbGZCXK5IXl6sqhxiabyH1dBmuGWIfFWxwuC3t1 a/EMW3nnaazCifeG9sV+qRzDi8ustBP1z8ms/ePlmxdd8lc73/p3QU71kzEi5p1RpmvmDDZJ NTlnUpJi3+mQULj72bXjPaiHapknrFye3MDcH+X8lT96xWXS7/lBB2Ne5hSYhbDbr0q3rya5 VpXkFgxhpfb0Pn5+w4b1kyf3esdebr/tfbBj+qt1byqSykNybj9MmWTz6IHPqrRuIY2/lzkm pvxZ9O7D/IcW6Q8kA4s+oI+poYtqa1OSRUsGnVsbFc6tSI/ulT+pg4fD5KdM85Ih7zef2Tjm SP7c3OgJUeFs1mH/U7kTR5mns5M+pq0/cjA5efwpnsracnLEvxkaajGqoW43IpPRjOX/7cbV +t3ApkcjeRnHcPDRJrEZhdHW8LkL0KJpZMGwQg1XO6OOTRupDABtUyp2rZgU3Hjbtg3avqZg M+/mkYHnULHBlraMKFSQ1ze9tb/FRfe3aci1v6GF/0ZYWr5Teu8vVrYgTSFPUAoViWlIi95M 1ZBJSwe2e3NMXNZ+xt2NGdLgbYtrXEpSP8V16nF9btxE9ey25zbdHnurITV706a3wbWR4bXW 3ltL780X9ejqMP+1rcUR0ZmEB8NuSqokjVkfB22xKc/jXfSfc0C9MFHIfhB/ln1ja0r6R1K3 kl6X0vvZtX/3R+rt+rEjSu/2vYFaoHLzzB6LsMEBAyc2vOdPe3yhcXC7A07qvBTPx+TCsfc3 +net5Ez5RGlnG8/YdHLx9RPx05wFo8ukAZNCLs438317bs8K+bx67u0LM8592N6fUbs5/IL3 pLCPS0ePHqUeNbbNgf71jV7jq2qzIrib1g/PLvQurx74/JaFZOiECaGrSKPML+4sWmge7jxn 3bp8jZELOJ70boqRCUNj1BlMdYCpuei/diHe+nM2g5wcg3YzTEmLpueFZCBcv2LMaAfvG4Pj GUh1FD8mtszI3bPRJYP3rRUsdNjqfbpu2gaOhrOqxSUTnivZQ9+SeH0HH60ZdpJWW/Wqveny 7e92s+zOZjpfMkkxWimZW36uhn2y1uXtT/M3OQfcteOPclC+W1L0MMtjF9Ol9+9Hqxbc3PG+ 6L1xpu3wq8tGW1clC9NmiY3dZ0a1522m/nb42vYhgT2Mzq9P3C2MsTvxnkR5Mm8l7aBt8fm8 v27u+HQ5aOuZrlSXUpfzZqqpmRe3+w+uM6PW+Q86b97x7WbEb1z9y/Gma9rXnt+wPo5vJpNg q8T7V3sLGXek4c6VxU5etXvn1ZlNPb4/strzlw1G+eN7XO7PMttrLVIVc9M9d0XvGHlx/bq9 3AaLskFRA/YLp2bXB3Z4c6nXit4zSMV9VpfaSPYuePsEBOB/AP41928NCmVuZHN0cmVhbQ0K ZW5kb2JqDQo1NDI0IDAgb2JqDQpbIDBbIDc3OF0gIDNbIDI1MF0gIDVbIDQyMF0gIDEwWyAy MTQgMzMzIDMzM10gIDE1WyAyNTAgMzMzIDI1MF0gIDI5WyAzMzMgMzMzXSAgMzJbIDY3NV0g IDM0WyA1MDBdICAzNlsgNjExXSAgMzhbIDY2NyA3MjIgNjExIDYxMSA3MjJdICA0NFsgMzMz XSAgNDhbIDgzMyA2NjcgNzIyIDYxMV0gIDUzWyA2MTEgNTAwIDU1Nl0gIDYyWyAzODldICA2 NFsgMzg5XSAgNjhbIDUwMCA1MDAgNDQ0IDUwMCA0NDQgMjc4IDUwMCA1MDAgMjc4XSAgNzhb IDQ0NCAyNzggNzIyIDUwMCA1MDAgNTAwIDUwMCAzODkgMzg5IDI3OCA1MDAgNDQ0IDY2NyA0 NDQgNDQ0XSAgMTcxWyA4ODldIF0gDQplbmRvYmoNCjU0MjUgMCBvYmoNClsgMjUwIDAgNDIw IDAgMCAwIDAgMjE0IDMzMyAzMzMgMCAwIDI1MCAzMzMgMjUwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAzMzMgMzMzIDAgNjc1IDAgNTAwIDAgNjExIDAgNjY3IDcyMiA2MTEgNjExIDcyMiAw IDMzMyAwIDAgMCA4MzMgNjY3IDcyMiA2MTEgMCA2MTEgNTAwIDU1NiAwIDAgMCAwIDAgMCAz ODkgMCAzODkgMCAwIDAgNTAwIDUwMCA0NDQgNTAwIDQ0NCAyNzggNTAwIDUwMCAyNzggMCA0 NDQgMjc4IDcyMiA1MDAgNTAwIDUwMCA1MDAgMzg5IDM4OSAyNzggNTAwIDQ0NCA2NjcgNDQ0 IDQ0NF0gDQplbmRvYmoNCjU0MjYgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5n dGggMjI2Pj4NCnN0cmVhbQ0KeJxdkMFqwzAMhu9+Ch3bQ3Gay3YIgdEyyGHdWLYHcGwlMyyy UZxD3n6yFzqYwAb5/z/xW/rSXTvyCfQbB9tjgtGTY1zCyhZhwMmTOlfgvE17V247m6i0wP22 JJw7GoNqGtDvIi6JNzg8uTDgUelXdsieJjh8Xnrp+zXGb5yRElSqbcHhKINeTLyZGUEX7NQ5 0X3aTsL8OT62iFCX/vwbxgaHSzQW2dCEqqmkWmiepVqF5P7pOzWM9stwdj88iruu6rq49/fM 5e/dQ9mVWfKUHZQgOYInvK8phpipfH4AB/tvJw0KZW5kc3RyZWFtDQplbmRvYmoNCjU0Mjcg MCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNjAzMy9MZW5ndGgxIDExMDg4 Pj4NCnN0cmVhbQ0KeJzNOgt4VNWZ/7mPmckkIZOQdwi5k5v3YyYJz4RIJi9AAyEkATOAksnM TWZgkpnOTBJT1CKKYkSaVj9x1aq11opYvQGRoVWham13V7duH+y22tYH66MrLd8u6lpMZv9z 5uYF6Of62W97T+45//+f//zvc+69A0AAYB52AlSs77BW2R//iwGAuJG6ydnv8Jd9u2wCJxcj bbNzKCSVvHh+Dy54GEAUev19/VfVvMcjPIb3A33ekV6IOXknwPxHEX/RrThc7zXoV6CsD/Be 6kZCwoP8ZSgrD/E8d3/oGvMa7n3ETwJwIa/P6XjlzMtbATK8SNvd77jGz6XqqD1rkF/qV0KO fSdetQKUSohXDDj6lbFH7r8JIPMsgCne7wuGInngwnmg/P6A4t908Pt1ALEVAHwQqK8i982i 6++r2pZQ+6Eh20D54HtrnqE2wq//MFEUiUyuNLxriEU0lvHTC0dD7ORK7DdNHvrUYnh3embq +jqjnITlwDGcAxNYYSNCfxYfiMoQXiFjIIJBvEdchGh+dOQfhF4uKY4XRcIRvY4T9RdIhs51 jRLYzkpnj4n7JleRRYZY8vyu6VnhFehjwF+jOPcYnBafAseFUv5eL3025P+tZPPnoPnLrBNc 4PmqbfmyF/8EbP//tuESF6ftgGTg6UAy8dbB7A0DF+0RigviF9dRcWny6jnYxi8u77Ova74K IewSwIZ9HBgwQsLZ3LPrzrrOBs4ei0QAzppnsIS3tfaTC6Nks3XWrbysdkVN9fJlSxYvqqqs sFrKy0pLiosKC/Lz5FyzlLMwe0FWZkZ6WmpK8vykRFPCvPi4WGOMQa8TBZ4jUNYsr+qW1IJu VSiQ16wpp7jsQIJjFqFblZC0ai6PKnUzNmkupw05ey/gtEU5bdOcxCTVQm15mdQsS+orTbIU Jps3dCF8e5Nsl9QzDF7HYKGAIfGImM24QmpOdzdJKumWmtVVQ+7R5u4mlDcea2yUGxVjeRmM G2MRjEVITZP94yRtJWEAl9ZcM86BIR6tUjPlpmY1Q26iJqh8frPDpbZt6GpuyjKb7eVlKml0 yj0qyA1qQiljgUamRtU1qnqmRvJQd+A2abzs5Oi+sAl6ukvjXLLLsbVL5R12qiOxFPU2qWlf P50+g6LwpMauW2bPZvGjzekeiaKjo7dI6oMbumbPmmlvt6MMXMvlr+oeXYWq92EUWzok1Mbt sXepZA+qlKgn1Kuof4rcTCnd2yU1Rm6Q3aPbuzE3maMqtI+YD2dm2o5H3oDMZmm0s0s2q3VZ st3RtGA8GUbbR45k2KSMuTPlZeOmxGhgx+claEBc/GxAmZ5jEGOnUEv7dGQJtUi+HCtClZwS WtIlo0/Laacsh1HncmTDy05wlerCjHjUmMbuUVMNpdP1qphvkqXRDwErQD7zwVyKQ6Po8k0f AgVpnUzXGs5PwWppqVpSQktE34g5RRtXMnxJedlQmKuX/SYJBwwftGFsHfYaK4bfbKYJvi1s gx5E1F0buqK4BD1Zh8FmLbWrXDedOTk1k7KRzuyample3i1jJT/FNnOKaiiY/kswpc5vdteo JPVzppXofEuH3LJhc5fUPNqtxbalcw4WnV8+PadB6vzGLj6L0yAui2ezWJRbp5kp0hWnCvn4 p2NF7QrrDViVjEKkVaqpe020txvN5i+4KBw5S1exYWaZZqZaUzoXXzEHn2Ne3CiPBgsFXEvn 5tFR45w53OAN4zLZu2HcRvZ2bO46bsI3u72dXYc5wjV2N9jH83Cu67iERyejctNUikkUgxaC BXuYM7CprON4RO9iswIjMNwZJsBohikaAWeYi9JMjIZXOYx3JtUnc4XYCrgC8JFU5NvG+vWs r2O9lfac9bA1JyfMWQ4/SIeyw9nFOOTZYt/MzKksTMqpLaR4mm2Ftzjnjccyct7E+1BhVc7e 2qqcG/G24j2EOOUrfKw4x1fo6/fd7LtFWAapqVhJSYkGW5i8/fTG5JjkmGVjYXLCVq0fe1Y/ dkQ/1qcfc+nHrtSPrdKPLdWPWfRjpfqxfP1Ynj7ZkGQwGeYZ4gxGg8GgMwgGzgCG5HDkDVsp fUYn60x00Am0Fxhs4mhPX2yxgDli4OAKUOfzLVxLRwNpUU86oaVHUj/qkMPEiJkV5QaiJrVA S2dDurq8tCWsj7Sry0pbVH3blq5xQvbbkapyezHinV1hEqGkPVn0ED0OhET23J6ljXY7pA7V pdclrUysXtV0ia5b60tnrvTS2VdL28gzkEMGQY996Ig+5w49pXYgdYxRxyh1jFHTs9W7Wjq6 1Mey7WoVBSLZdnKk/qhtJz13u+VmBe9u9bYhd7q6q0eSxm1HtQO5oLvH6aajQ1GPykqTapOb pPH6nZeY3kmn6+WmcdjZ3Nk1vtOmNB2ut9U3y44m+3FoJT3jJfvnqLt1St1xKCE9F0sMkx4q soRqbN1/CY376XQr1bifatxPNbbaWpnGZg9NYFvXuAEa7LjZ2XiEizViLrqzzPaGVJN/JUvM CnP69Vk/EoA8CrF49sXhczQebzpVXl9eT6ewYOjUPPqI1abSr19hzvoReVSbMiE5UW6A0sHS C64gvSC92dNEb7TkeOQkt+twUk5Vqb0UxKugUlwLOXgv4O+ELIDIm9p9etIeOSPuAHlye+T1 wgQs0ae0O3o58OviaijGgn0ezsJzpATa4GTkVXBCFzcM5Uj/JhzD77Y/QBN+N3KQSa4FKXIf 7IMCuBEehGohM3IU1sJ7hgRIhTyoIT7QQQp+c91PXofLoQVlrMBX0lshgP0GpH9MluMMASNc hdrvhHvhOfgX+CNkoEQLnCJ68nHkx9AIHWjDTjgOfxAbxNtgPnwLfgAH4SfwH8RCHiZ/4v8c ORp5OfKfuKoYKmEpbIEebN+G7yLfD+CfOZn/XiQzsjPyaOTnsACtP4Re/wR+iro+IhLZRJzc I/zI5F8jA5FD7I00hVqPrR69aYUQfB85T8F5EoNtN56TdZxzMjGSRncKSPgB3YGv1v1wPeyF 29GLe+ABeBLeI3XETV4hf+biuV3cCbFN36pvjTkx8ZvI6shHqCMOzGjtlbAD36ivR1vvgLtw 5XdR14vYzsIEWUpWkJXkctJOvkluJt8n/8OVcq9x5/l5fAJfxtv5bv5a/i3+E4M4sX7ywOSr kbbINRhLPI4wnvkYtSbohK3ghyAMw7WwC63bj20Mo3cIm4rxPIHtBfg9vI3tHXgPPsDvahF9 NJISbBXYVhAbuYJsJNtIHwmSA+RpEibPkZ+SP5Fz3GJuKVfNrefauT7Oz4W4MU7lxrkT3Gnu v9HKGr6ZD/Lf4A/xz/M/53/J/w6r/grBIXiEQeFOQRV+I5wVzgmTIogyNovoEB+ceGiyZXJL pCCyItITuT0yhu09jPFC9KYACtGfNsyqE3qxcvzYvoZtBGO3Bz26C+7H2NHoPQ1heAar9HnM 70vwKvwO/fs9vAUfwycYHOpfCjGTclKJ8b2MrMa2GfM0RK4lu8h+cg/GeZwcxXaSvI5eTqKH mzg7dzU3xF3L3c4d4O7ljnMnuVOYiQivw0yk86v5Fv5Kfgt/NR/i7+Lv5v+Bv59/gA/zJ/mX BE6oEdqEgHCjMCY8JDwp/Ez4lfC6WCGuEEexqeJR8VnxHV2SLku3WNehC+t1hhHDu4ZJOAI/ g3E4euEnE9lLTGQcfkje5QV+F/cy18XFcqfIbuEXpBAzUEtA3A8D8F9oYTb5JbeMXMk7yWaM 327SS7bAd/gF/EP8FfCyOEA6+Dbigg7hAHwqvgAOcZQ7zHPiKD9BPuEOgRv2czsmDkbsZB50 kIe5R7BiroNaKBYy4RRXLRwn+Vwxd0L/BAnDSr2Or+ZrDAmIPcy/jWZ2GBLIn8DBv4X7503c W+3cI3gmvENe169H6yb4J5HnOlhJHp5MhIOinesmC7iHydqJGyf+nb838gDJ4N4CmEicqOca seI2Rh7jnoO/wIHJT4Q34DnuNdiIp4aT7Zz/wr03jCfNJviUi8f91IHniB/Ppj78vOzD72ce 62eFbaFO78SvPVFw8mDUiU6e5zJj9IKTQIaheHl6aavpXO26idpW00e160wTtVBXO1FL78qK RYnmxHxzorlPgE8l/uSnNhHOgyScpF/1eKLCW3iexkE6LDsGJH6+HjMUJtc/lVppis0Mk2xb nHFxfKWweP62DGVfeqnpo9MTp09D3cRHtXUkMam6urJivswXLFm8dFEVfqDq5yfr5FwNvamg S9dgragXuXpLeX19uaWe9PGlS1Ia165dm1Fy/gVLfb3FYrNB9Dc04Sye93rc9wdta5fDcm6N 4BbCIJYba41rjVuNXuO1Rh0YjEQfY9TpY0QwcHycEIsfwUK2UZdsNOoIx/PZRoIgAX22ISZG J2LAjGEu9JRN4I1xJ7iv4dvMD/G0E7E3kk+OxNLAZZjOnc48cyYdI5Z5pq62trbaimETb7GU 3nLdi7dY0ulAkqppo3/62lr8q6yAq8hVZP4iIpNF80Uz4d8+6Jp41j3xY/ch7pGJm0gdf4Lc /tenxLWTQefEwuhXv+5V9NAKv7WVr7ZeaR2y3mwVEuSFMbm5OfLCjNzccnlhYW4uJy805Mom eWFKrizJCwty5XDkW8fSwCqlW6zWMPHZbGnpyWlp6akoszAtFcHUVAygNc2aLqWVc5Y0wmek p6Zw1sKCGHzTs/4GOtIq09IyJUt5YY70cgLhqBCjKSGjovJlc/1RfINqZaWDVUPrp1lpegcr 6B2gsaitpX1aNU11YnUiDUJi9ZzQTL2BVVaQq8wkMTktddGiFPOSRVXLli5JXFwgy0vMhJhT 5Fy9LuWCWcLnTZzLym+rmCyq2JSX2ro5Hc+vD8hpsst6ZV7qgvw268TJiivl1IkPheCn11yX U5Kfv1gK8EOh9vzzrwkM+XR0mrzv/K3Rin6T344nSDEsg0Hbwq+XkOLSBXholqDGxXxW/KLy kiweOLEiN09OCBOzLT61ykAqquTYagxSXJjojy3aK31YkFEl4uutLbbcWpCxvPpDc4mbBWrd mXNnTBNnTrfSMEHdujN1Z86YamsTWYjSqlldFBQWRHcA/ckGtwOihQVyri4lOTUtldIgukWW pukobVEVWoYcJFxkuWPTXd97dntDZX5qYsbOPKvNvm370++2t0++/9zj71/9zK/u+859vTtv s+Zm8tsK5a/tXNI6tKZ8ZW6FMeHmpLR1lrL+/luHhva9MvnHs6rnH3frMl84duzEz+/p+HZF HovM5Co8OVXc6UXwuK1ooS07ZaUBsrLztsTrs6tSYoV5JWnS3sSPYvgxQjKKhLGiWkNMRnGY zBvfjxsfa+TMaXTVdBr9R9eZ74n0AGgcsZUtLDQmF+Qn5OcWzC/IjyvKh1ijPE/KJwuTsSuM zcsnZhN2OUnZ+YDVQkpLTbWsbm64AS7vHLElpS7IKkjLz0zPvkNYkJpxB1pJkIPy3rAMzxV5 KaunZVpU9SysfHKqFr0CVl//lHMoRWfcvfult4a2+O54c0ND2dLK3R3XPbHjka3Bqpxlgx/v sRU19XE3/OKmGx+6/oEjB15KTyRbbvW2vHjwG79125c8Hf3N8lfca/wTEAvm48CTp2zzYvSQ Ga/LiIv/i5meF6Wtp00s81jxsw477rVTB+4+deruA6e4+uh4CmVVaW0I3v1bNHLv/6VxRZ/T fvyVtLf+vhp74VjMDU3/6roVpn6npu+YigZz+NzZo8E8nhxbNViYxSPiM3KfBuNzCO7WYAO+ yz+owTH4PnxEg41Egl9rcCxUkXMaHAeLuAINjicvcnYNngcWIZv+ui7g6QRxQguDRfovS8IW BusYfQeD9Yw+zGADg29hcAxKCuP7UBQmECc6NJiDeeJ3NZiHdnG9BguzeERIF5/UYB2YxJ9p sAEKxH/T4BhoECc02MjZdHUaHAsuwzc0OA56DW9rcDy/N+ZyDZ4HW+P+lcHGWT7GUvvjyxkc N4s+j8LxlzHYRO2PX8fg+QgnxUdjkjyLP4XFIQqnzqJnsLX9DM5iuqIys2fx5MyC8xj/TgaX M/hWChtm2WyYJT9uFj1Os79zxK/0OpyKdFDqdCvSOt+AL4QkqdEX8PsCjpDHNyD5vU6L1OQI OT6Pqd7rldo9fe5QUGpXgkpgSHFN8dV0jPT3+LxSzZASCFLeSsuyCqlonccZ8AV9vaHidqVv 0OsIbNKml1gqKqNL1nVO60JDfX0Bh989MpukSE0Bx7BnoE9a39vrQTcqq5dXd7o9QanXNxCS nNg5PANBqdPTrwSlVmVYavf1Owak1QFF2SE5HX5PyOENSo4Bl+T1DSsBpyOolEm9nr7BgBIl 9ziCHqfkHxxwhgajnoZ8fUrIrQSkYU/ILTlQiderONmUr1fqd+Acdh6nwysFPX0DUTF9yoAS QIp/EEMWVKQ2j+R0OwIOZwidtkjSRqT1+gJSUAmFqDtzxFABQadHGQh50Elp2BfYwWiOIFPf 7/eie+huyCfhKinIYkdDMIhMngEpGEJuR8DFghK0uEMhf43VOjw8bOnXYmlBKVZ3qN9r7Q/R f7y29ge3RcVYKPULrhhWvEhV2JLp7ErBQT8aqES1WyS7bxC9G5EG0ePQdKbQdGdAcYQw+i5P 0O91jJQxF/0Bj5ZH6iA67FcC/Z5QCMX1jDBvvZj2ASoLJ4IShlADeqmGMjpSrhlz/AGfa9AZ KpNokeLaMrpmSgEGa9jtcbpnWTaMSj0DTu+gS3HNWO8b8I5IRZ5iSenvQVtm2FHC51nL2F00 w1hgoYCH1c2MArp8WtYKFoEiD2oJKf10pwU8qNXlGx7w+hyuudFzREOFZYnu+Fh9+gZD/sGQ 5FKom5THrXj9cyNqkeoHRjR2mhAUiPFxe3o8aPPnFwrFrFrwWcahFXwQgH78KPTih+cIYj0w QuLxwbQd8ffxnpnvgBCOA+DCPgAu/h5+nH+WP4H3cf5H/OPQiev9uLIX5504SnAQ7078VKbw OpREpYU0LgkamWw/6x1I9zAOCSleXG9BqInRHV9aUj1K8uLYjpQ+XB2CIMMUHBXkHcLedZG8 GvR0BH3uQRpdXcP4ArhmSm4lWrcMKhAqwtUetDaAM0G8e1FKMdPQB4O4mkZq0wWrl+DqCpQx W8s69O5iv6IR9aGsAPtsdyP+WVwKixflG0ZNA7hGgvVoTy+zT2FWV8NyvGkcPSwSvUxWCCGn BjnY2iCT6kHrFAa34jjMIudjtUC9WI26FGw72GpqnYet97IV0TqREPPhSuo/5aFRL2N6PSw+ AU3+FHcP46H20ioYRKoTZQ7OyWmIxUPB0c3kSsxfikmsUpwsnl6cc85aRTMjMduj6/o1mU5m scS09mmeT1lDtQwwHVEeP7PYzzJN49mGa6g+N8uyg+mLZprWrgQbNb5eVpcSw0JMazQ7n23N lAVBpHiYFXS2V4vMMJO3YxafQ7M76n0/20HR7EWzS2Mmabqo1Jm6m6qCQU2Sh0UrOHenz6oU 6pubeeHHfWHFNsyaBSXOrUuLZouV8fejLiv2IeRxMMsoFoRtc6yxTPN+tTpoBXo1XmWWlov3 LvV9kP146mWRn+07zaqdxSqauxEcB7Uchy6xp6JRd7Iqd7DaoLXvYnx+djaMMMpUFv3I6blg P05lMJphP6uvflbvIc26HmbHVG692m4fmLYruiLI9kDgIkrvtA9l03ho+py9ODp+hrtwDa32 Mq2q6Uka1Vs2redCD6KVNczi5GS79VIxG9Y89bC970U9LubnpWJP13gZVIT8xTgqrJKicbmU 9KgNXza2M9Jd03s4eoKFWOZmzptLeTCl/WK7VsyqAepJ1JcQ0zf1TKPyo7662Ik6wE5Wx2d6 Gq09x5yqip6WPq2fOT9pVEPsdAsx+cp0NqfkuNn+8X9ujVrY83ZAy8yM9Kkd4tGiTOuH2tvD Ih3N7Zff7VNz1gsqf2aPz7zhOBjPFP4me+NR5rwBKXPecdjZJywUKoUWYbVwGfbVyO3A6NC4 U8vqkSPAzs5Q9D9J8tEfAiJm+v9GL3kRbSyivwy4vAN9GiwEo3AZhTfjezy9/xdiOsX4DQpl bmRzdHJlYW0NCmVuZG9iag0KNTQyOCAwIG9iag0KWyAwWyA2MDBdICAxMjBbIDQ2MF0gXSAN CmVuZG9iag0KNTQyOSAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAyMjI+ Pg0Kc3RyZWFtDQp4nF2QwWrDMAyG734KHdtDsdtdQ2B0DHJYN5btARxbyQyLbBTnkLef7IUO JrBB/v9P/Ja+dk8dhQz6jaPrMcMYyDMucWWHMOAUSJ0N+ODy3tXbzTYpLXC/LRnnjsaomgb0 u4hL5g0Ojz4OeFT6lT1yoAkOn9de+n5N6RtnpAxGtS14HGXQi003OyPoip06L3rI20mYP8fH lhAutT//hnHR45KsQ7Y0oWqMVAvNs1SrkPw/faeG0X1Zru6H4jYXU937e+HK9+6h3MoseeoO apASIRDe15RiKlQ5PwmYby0NCmVuZHN0cmVhbQ0KZW5kb2JqDQo1NDMwIDAgb2JqDQo8PC9G aWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDY4MjQvTGVuZ3RoMSAxMjMzNj4+DQpzdHJlYW0N Cnic5XoHXBTX1vidsoW+SxMpOsuCInV2EWmK9CIqSEeNsixLLxsWRNQYIFgCKPaoUQFjL3ER jVhBnzW22BK7iWKLwRJjF/ifGYpgNN97/9/3ve/l983dO3PKveeee8+5Z84dQBhCSAduJBKE RTpJ3X95cAYhLA6oMfIsmXJYXfYpYJJA85VPyKO83d32IqRlgxCuTFamZB38w1ONECcY2oxP ySxMfrlgyAkQuBj4FakKWdKhOWe5IOsq1EGpQNBby5kBsgwBt0rNyps4+DsyH3CQgUdl5shl yRuS3yAksALauizZRKWGBlkNsBu0p7JlWYqAmw9+QUgIY5DNyhxVXpsnSkLIeA/DV+YqlPrn X2gjpLEO+kxFzNygfuY/9fPxeoOfITM+Yq7V392+wTzrVTXpCLWG8914mYBqs+1Rex9eZms4 QvzbCLW85rt1cTqvWJZyDhkhHCoGdwEyRO7Q7x45HnAoXBqbgziIT54iYQUJ484nSiIobcQh MRzj8+B6TzIaEUlRyPsx9fgx1w5bhSS8TExd1MUFQ7AIeRa0gydPhDYz9X0p/4nX/7SuvPL/ P9m8C2jBf7cuf7ML7/BwQ0QwD8wUKhe92xAE26bnBUyC5PzTQzjRH6YH9cCi/2l5/5aLRBDp EBeesMcfT338uK0NIdibRW1terf0br6LC96ubq4DnaUS2snRwd7OdoBN/37WVmJLEdW3j4W5 mWlvk17GRoYG+kKBnq6OtpamBp/H5ZAEjiH7AHFgAqXul6Am+4mDgx0YXCwDgqwbIUFNASmw Zxs1lcA2o3q29IaWye+19G5v6d3VEhNQg9FgB3sqQEypT/qLqXps9Kg4gGf5i+MpdTMLj2Bh sh+L6AAiEkEPKsAk1Z9SYwlUgDpwQmpZQII/yKvV0vQT+yk0HexRraYWgFoAqQPFylos0Atj ATwwwKMWR3wd0Eo9TOwfoA4R+zMqqAnrAFmSOnxUXIC/mUgU72Cvxvzk4kQ1Evuq9ezYJsiP HUbN9VPz2GGoNGY6qJyqtW8sq6gXoMQEO+0kcZJsbJyakMUzYwjt1EFif3XQpCYTB/t6bE1U nFrDrx5DUXE70bC2otqQIn//eGY0fb+4GWzzXtC816QmM6IswCSNYtCyshmUunpUXHeuiLnH x4NQB/vQiDgRaC0OqKCYaUTEsTMAoZiJEyjJ0Jhptk9YIQ5gKAnplFpD7CtOLUtPAGOZlqlR RKFoq+kw751tP6NhAVRZVJxYpB5qJo6X+ZvXGqKyiMK6EG8qpCfHwb5WIGxf6VpdvQ5AW6c7 oOjisRDbnIFA686lxhiNxCHgImpKToEmcWI1bu3G3BRuqEzuBs3gisdgRdNg/RLKBB6MITjW AjFV9gyBI4ibf+tJkXVQuNaCZ4gBGXfpcjngd8JqOzu1rS3jKTw/MC1o5sXiLg72E9ShYqWA UofCkqHwOOgU7+EESy4SMVYur/dGiYCoi0bFteMUSjTbiryd7OLVeALDaezkGEUznKJOTlf3 BDG48zZ2Cxup+f26fnoCY4OAVA81ZvwXbEU7H7ZPAFVLcqzLwuP6ycrKzfollFXEg2kCYSuW lQWKqcCyhDJZfVtRopgSiMtqQ0PLlAEJnVOqb2ssN1N7V8SnYrCoauf21VAb+MURZnh8O4Sb EfEOyFsbBQaCKvpCvncw7FbzrcFSeBDeMng2QP0S6gyo06GmQFVAZXhjoUZDnQk1GWoi1IRg qeucdJ4V35JP8fvwzfmmfBO+Md+Qr88X8HX52nxNPp/P5ZN8nA9JhtqACMVDI32xUHWjHIUm UurnkeJ6THPUaDVH7Iup9UNRaJSvyU6E8RqnzVK72anxmewuq8faajFs9jQzZoMBG2ubNsus 4xkfj4zt/nyZQMG2hiNpqKw8wQIxJKwbGwtIY/QIj6vlI994v7HtzzpcSxNGSDATxfsaC5Re 7HCeIpOpZrsgbq9DWmB5bQglOlAZloOPgw/DglyKYekyUaaDZTLVU2S2C1vXwRIAWQhz7PlS ELhxbrLAQ0bEv361feT6Z3uyoPyjjeSQzbCFc5RzFCW2Q/BMZDjYKLjLIYdcgJXhYXgTcDpa o13oBWbDlnjsId4XOIfQYQYnQ8kYMobjxMjj2iFJh6yucaBASyjX0XP0gikdchhJuVDKoOzB mqE8xMPZMgpfCqUJbyJGEHUgnxmhmtxIbuTgUJhxSChS7ub20jHWoS65NqzUcmwbI5OVOgpf ycpDhBFhTDgSQcRCYitxmZENEgmOF1vGQMngTGVGeFe4Em44t5j7Ey8SMshJaAWa8N6KsnPE i5EKHeJkEBPxpZgNyHdk5oanYeW8SLwvzGMhrCnogcWjRGIrOoFeEOawFrsBx9pnASNBZWeI o+uwIjZgg3CsjDDGm7g/AfaQS2LNTMVHQbZVBPlVEViBQDxEeQt5n2DkJ1gz5CQpiJNCnEdO rc2CZjT0IdwltLNQJLQWCUVFBGopwlEr4hx97VZEHoX4tRnL5eaTMZDFiLwFiItNwVs5U7g4 l4uTY5BTs7u7kxNy+qOlSeguoQ0wochIJIQuZMybDXgTltt6cUHrRfC5TilBiORZItSIvJkM EPJtbj7oCGcfb31E6MCPwIWt/C8godTBYfJMCgXHy23apPYYAgYTNMNN6I6GtjQLe8HIThIa E2lgIuFA5CxFRkIxAGJLZATratM6u3U2rMqYZ8+wMQta39bXt74FfWbDonOfY6NbVz9reY1z 6zESWIjRsEMXPeTEs+QcbWQy1s3oM+51ziaIYnqobquWpmY9ZuythWOGuKYGjuloa7M44sN5 lK+poamlweAwBUNCQ4/A9TT0dIFi7q1PcgxJkkOQGoSuliaG6/F1d2NmsKJaGO5tjm3kcjk3 caStQ/An6mIYDoJ09XjcC/xSmHJzL/dPYKrMSju1gK3c3YX68OsFqz1D19GO/5ng4Ay+o0k7 wAGgk8ABABMRmAtjE8zAVWQgcuXcf6subV1MmBHGr73vjSLCv3lbG4Htad2PpyzAB7b+AbZq zT+MlR2GucOZhucD64HDKdRqKwcj6kFZTcaDMMjbSXwnRkFWfgdUG3qnhTG+swZmLcIWEDFE 7KtWTmxLFONDcub8jaw6ShCK+B8oi9HKf6Vg1F+UwP+7BexkjsV0nUkOo84DHIa0umAcosnh DpjoRie7wRykjU52wFykiS51wDwkRbeYEyLJBTnamBEL85ivH5iIhTVARAUm6YAxZNwF40gX 39sBE93oZDeYg0zw4x0wFxnitzpgHkrCX7CwJjMuMYaFtZhxiTQW1u5GFzBjdcAGAOsThSxs yLYpZ2GLd+35xu9g7W7ytTtkxqZlpyRBVVHOVJJClZaSrUiiEgsp37QURWZOAdWPCs7JzFKo qJBsuSOVnJNLjUiT5+aocpLzKL+cXGVOriwvLSfbERBlYW5aSmoetZ6SuLtLP9YuXJbnSCkV 2UmOlE9mJhXBdFFREQqVIneCAohsb9oBbhIqqlCpoCJzMvOZrir7dh0+1CtCkZKfKcuNUeSq oCUlcXRx6ZqY87sppqngoJmXK0tSZMlyM6ic5I8oibJRDspFWUiGMlEkyoNnNkqCey7cY1Ea YCkAtT9ViELOUJOQAuA0oGQDlASURFQId1+WpgBJOagA8H5QgwHOBPkKtncI9JAjR4CS2XEp NAL6yAHKAX4OUPOA5sfylOxdBpQ0gLLZXgxHCWPlsiOlsq3XQ5UgdyjSf1leOIszkBI0ZGbO wD6gcSY8I7pGUbEYMwcFyJjAztqxx9g0cuiAJECLAh0ZiRSsKTP//K5RVci+xzr8s2MxlBSQ k8naJoblqTpkMjo4Ihcof7aY8wetmMbeZVDz2DVhLJrFSs4AGrNu/9pKjuzmRYpuGIOn9fCr ds/q3p6NX+1ZsRvzDfiDF/sltj2u9fZCzPct9uo9iC7pLeVq2E4Pnv5CB+Ph1SW9xUDqi2OY RJfW5vLbOTiHg+gErqYdFyOxElccI6sj6HDavhvFfGWfInM0mC1h4NAq1nAKUF2BvJhCUz3l kYK4T2qr1OVPpvTOOz3u1KHFMLihG12C74FqjQuG9T7rVlESb776E9V4o0+ufkPrdOmJkaBO 8QpJX9qCS0STmgbGsJ/TIiEkUVG5+ao8aqQiryAnN0PSizZiGmgZ6HY2aA8NEnvatp0hftcz LQtCSJ4sSwkRgIqEcJEmV1AROTl5koG0tL213cgwaniIj2/I8JCoeMrHzy8gPCrA356ykQ9w d6V6jkH36aXj7kq7SKQ0e43upUMPpCW0q9TZxd3FffR//gSKq7qvOcZBRPEsWPcv8eJidM6R epw6xd7Bsdi8lrt1rdYOoU7s5ciL+beOOdtuPf9cY8zAp/fntGpo/3DFbPTOk3efz6xd3jjD +sFncQJV+sTjnxq1HI57PmBj3LhFZItDojCu2Pz7TxdcsIxzunDCkFM6aNeCDdtGDLv/0NNy c8ySqaJlmdMbhwV9lb5tzaALbzUczm1z/xonwKHfcwkC9JJF63pNPjJPf6pQMNvyxPk6A7sx 9/ybtCauWDX16Vpebp+b8Y9OlN76csHwKyNlj+pWvQkcEj5Qq0oZ83y27ee9Tt2WNxSm8VSO 6oU2Zc+aN6w/+8lJze8FGpWn6rbYLDpYOKB03tW2XSm+wWvmCJoaZC+XRd6ef0Y19GXL8rDS TdFnWoRyOV1C4nQJkVFN4BiOC/iTssbmJM4P23Wwxe8XQ5Plf0cnBp+VSt16OvGgLieu7tRP 80/6dcxM66Mz86Td2xtIoxS5WSrmNZuvUlCyPCo1L0+p8nByKigocJwAnZl0w1Gek+WUq5Qx itISSX/amulMGPT569nTJZjl+35cgukhoGviJRiGGifJZjzYupaQm9mZyq4X7TCyqC6fM2R3 /3mlhu4Ppp0aMI+bHLyKCJt1L2zt4y3jzjj1PjL3yfYVk+eKTt1vuzXy8dstC+Pq5Q53Zj8f YHJSOTv8H82Ldntf2Wd9zzf6x+fTfufeLV9iLnlK6J0fvszK9qqZWWXJU/WjtSNuGa79ufLH I6kHZHHrc8+/pIPDLjnlyKlLX35fMvlA6B6bQ8Wpd++UeG8K9Kh+NXTQyeG7o3xHT1JMbi1t OhIUtWnnkN+Kjpi+OOhcXHzMduGbz8d5zJhjeOWEY/7vjzLuDFmfsM8X2xC2Ycy6oZaSKn2j V6qaPiXlpN2vgfjwrMq+4Y4LQ20nckvzhsyttA+SsFvpm+J6ung77c3lQ0TncHjgnuAwNN2J 09h0K8YoYJMcuUrZ0ygMxUmVJ8vLV9EaYBQLA9gEiPZnQIocQjN21kqYHoxNfxmAgWjalrbp FIxjxuZ/ZW3agJFiTWrTmp1dCD6txRD1SJLAuY0fiAIOT8PkCfYml59Z6UXUaT+o25My7YC4 uTJQ57TpiH1Pp0yiaKlJavm83dIlj+fXexpx+0/2wrlolWheqYHmocW3vWMPcazvbdkiTF9/ 2/P4ffHzBQM+8Y5+ujpy+dFBHu4Kvkq1Snp2y6aGI5zBbQG//ePeZaszp+Tfaqx9c9PsVouP ZvoiiAL68BZ73R4F9NB+VD548EzhGa/n8t9ueL8fBJQSO3pA+0awfJccg5czCa7re5mno6QP bd7e2OiDOalERPdt3xgm7/hMBKB88vNSc3LT8go7Xk0SCU27duxqKS2ROks60P8Fjf6rTboe 37tfecfz95FmNlVfTRxH/7py/Szr8S9bFw7/Zkfr8pWU15RRK79eWZkgzTjjm1T4cNOEY1GX f3+wbLp5ZVVpct2hjEmJ4h8tBl/Xw+bdW3SwwSF56dLUfkt+8LBv0N4e129/4F1NL7dF9utt 3Nf9FvKF761Svd1LM6Nlm0qm1CQ4FAy/v2RbkufScHMJ38qwav3duXYmd4YslhsmxHEUVRau ETNerH20AD9sdq4hOqDuy6IGj9+iFoz8tmXtpKy8kVtMTizSsBGh2DkJaa67Q/V5g2PaxrxZ lazJX3O2OCb20Xee44yLC8jLz/d9W7SwVX3y8x/XmuaOHfz9nsf8byzpOu60Y3VUgcG0Gx2b dB1dvJouXsl4P0YWL6WLvyoSjPlB+Sgtd4V41FTDrSNmtx2vyf3326/kv/BxgrHhwntajbOe fmXi0lyPWV0sED4dmyCtWqF13Iszd2blMY87ot8fx863314ddDTx0dufTnh6jl4/KCqt1Spr 6LETG65zplyTzBpSJVCm727VDzNJa3z7g98t4Wgq7NfEyVs29D5q52rtsE9Ro19mrSf/5kWU +SvRsR+NnkZsyvaT8lpKer28nZKpM+r53icRR/bePUi/pSQaMy0WDjAdccECX/2k6Gdi25g/ aq8djX2oCDkSEfXdNsJGv23Oj4/5lVPrvzq00dW+aVLTuoJbE6rRD+lD958dVPazj/46l3Sz 9Csuv5w3J5vWBZBHRzu7ZY8w10ncobmy4tyFqKGBJ82j1yiv6HvMmJ9ftfZsNUSFcsgNVO1R QVPGtZ3FZuFa3ReLybSL10i02EBKcg3w6EiJAS1kEL6BZqxMlQrvtjwwioDWZYg8A16EIikr Jzup04yaHzPjx3yCSVD/5BNiWtRuc9PunCR4v0JwZl6v4X4+HdmBs9RdKpG6Sgcx2YGUdmFQ Zwali2v+3RORfMy5iY8I+8ssd7ZxzuVe524FLNy66dzt05IhFgdn7B4ZzHlVHrPebob8qP9l +pjhngcTTXcd/PVmLhoemPz19cTA7BUv/Hfd23X6wIVnnouC6keNO1OQYjk50tbhV8vKKSPb 8O1mztW/LnxgsmvCK9lZpLUgYaBnyHT7ukuz5zs6ZLTcit5QvyH7Z+UfKxO4Tu27vgTzhjg4 mF0mCz0Ma+t4733gzUiwKZeFLmlMGj6a43097GezuoCLPGLyklf5vZNdTOni9QxfTBbXQO5Z ZDhg7E6z7046P9y9Iv6zF7e/dzyoM9CmJm/V/0YEEaRrLQlrRNc3CM9f9F66bt8dehijal/S j/ahh1YPqfac7t6RgchzMx2zOuWwiYIyI42hOilzc5Ly5XkqJ8ZVGU8FL3UExns7jA1HZMqJ 09c+HRF0YPYXafoZK8cv6se7V3nx3IrRV/qnWVj8MTjaJvKa0Kr/vG/jY7zvHxyx/LcrG6cu +HoIZe/ye/+RjUfddyjkZ1ySL0fu9ZkaP2xVxI5nLUf31kzm1i++uPjhGa2B+ck6V30q/6Ge Vxq733fStMNzDa5Ebb4+1ecqteW+2bEDUsmhWfePv/4idH/cfOnBn26dnLTxxmf8ZYened7z KXarndh7j9uLkxkHTm0YPsfii8N3sC9TN9ytvMcLt5Ve++n03hOTLnnotW31L4s9auqaxOv1 2eTc0EBujc0YcWyf9Ja5ls7eZ/JD9bFsrqh0UM46W+3Pvb51sXu+4zMtvsHt2KehmyuphnoI R8cgHNV2HFX+tPz/CVkKbGgpZClunWcPF4kEztPt6N8nTJZg1J+TGx0mueGzyc3KUqPIi1q0 7sCFbR5mB546Tc5yFY94erbidsuWlkP4wL5WR27XXI36bSqeF7TxijTO2HDUALcnU7duq/AI 2u4+MjvqgETbI+vNyZPHw5eZfbv24qVh/YZuP3S8ctHNkN+zLt5f5HWdc/rxmmjXzU4JJ4tk vjUhUcP0THaEXpq/hB4dlJ+07dzua99t1F4eVq/yNPHYsG1GhXqmekRY35HC7c5FN3Q8knL8 jwzcO2z+13vWWLziiEcmDKg8Yft76dIlm9dd0VRO/nGgz5zVO5KPjDWz+MZZ9+sownTo4jn1 J+4OIfP8zCtfuN+p2xQ8KcNWNxGTuU/IbvFazAs1fIIFthihn4MuhzVxmoqscYyAIGcD62H1 4aD2t8h4BFyNjq9hRhj7L03dYvGH4izdu6uDIU5q99FEkSgfJSI/5NPtfIMF0nrskYqJ+xya gMeHcquAuJtLfT5/u7whuKDg24pLd3ofit1munfbzvF4TUC6e/yrnf2XOYxY8XZlk1uZW5Kl 742dTrand/zI/f6BbcPPptOmXBnFH/KH5bnzjVkzi438xyd9kXRw/QL7sitzXIfp7bh3XlY5 YcIvl6zbrEoXziJjohbUmHt4lex5uHpGhXlFaOH47SGvx0nTPPpGbc4fcSPpLj34SlKI/5s3 B819P71TPSTgYQaq2uS7d5ewLqbpzYWVtsUX+45cGb2vf6VyzcpMs7aospI9xaFramqTJ63v tfY4tzHowZq6+xKjyCG2ZEObKvhqeX+/t/J7D61mjNk36Mw9yTPppXE3CiftojelTR/2pkLY YDYrKl5SQqZDQEvG4XQJ59i/S2jokQX2+DxaDQfy3l121iAk2t0/v4Ke7zAt9lPtO9wInLer IynRJwUzn5x65u42x/pa8JDw8he9FfTYbs21JSPp4dWWRdRH/2ARyH6mzqvpV9T5DYA5qfd8 A+cVKnNScmXK1ML3Yx1ZXFRQ2HyxIXLfcwvFiYm+cd+n7GxwvNDkf8bwwJ3nEQutJ5S2XEbq vNBgq7krFx8/JVgj6HU9r+DU+vszJlq2TsuJejbbq0romxJQ/OxXp2XH9uRnt0nIyfeLbbxp rdZ4YtL1q0fGPzWv2iZLimmI1ME2rE44Gm71+tGR6D3kVUlqWOSd/M01JfhwOI8Hv1sWrqQE dweSC+swdf/xH+I+8Cmxp7vE0ybdvUXr3Ud9DJyli8OR6LFJukQqlTpDlYz+k7M43SwYb/TT vrB+DhvTL5Jzzd83ZwmGTI3noz31yQe+N7PelxutX1Easf+L1qGPpnpsW+SnPjblgqjoyXXX CNXJVzfWXvC367vuh29s9ZeVDH12N7jG5sZEnc8dW/5RKtT4VDcvMTT48NWQiIwJL6teNjhS c3pPbh5apaVaMnHRd/ltt4dr3fr23P3EDX/YWubbLNerSROihRmnDxzbmFG0rCp5fZRu6zxv 3trUpOU+ZzeEnmx8mhZWvqpw+sVY4VuLcvk1SVJEw9RFZ8hM/JZ9xWdFEvmbByfSR732ejDW zs7K6fZ+n8CKNyhaGu1zPeWat61g8deXnwQ3WfHfrs78sukXjbq7/ZdTgY+IgZVVeQUDbqQu erb1O+2g+mXn3DfNnI/Q/wOM9zODDQplbmRzdHJlYW0NCmVuZG9iag0KNTQzMSAwIG9iag0K WyAwWyA1MDBdIF0gDQplbmRvYmoNCjU0MzIgMCBvYmoNClsgMjUwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMzMzIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDYxMSAwIDY2NyAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCA0NDQgMzMzIDAgMCAyNzggMCAwIDI3OCA3NzggNTU2IDUw MCAwIDUwMCAzODkgMzg5IDI3OCA1NTZdIA0KZW5kb2JqDQo1NDMzIDAgb2JqDQpbIDYwMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDYwMCAwIDYwMCA2MDAgNjAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDYwMCA2MDAgNjAwIDAgMCA2MDAgNjAwIDYwMCAwIDYwMCAwIDAgMCA2MDAgMCAw IDYwMCA2MDAgNjAwIDYwMCAwIDAgNjAwIDYwMCA2MDAgMCA2MDAgMCA2MDAgNjAwIDAgNjAw IDYwMCA2MDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDYwMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCA2MDBdIA0KZW5kb2JqDQo1NDM0IDAgb2JqDQo8PC9GaWx0ZXIv RmxhdGVEZWNvZGUvTGVuZ3RoIDI0NjYzL0xlbmd0aDEgNTI5MjQ+Pg0Kc3RyZWFtDQp4nNR7 eXyURdJ/VT/PJJPJNRNCTkJmGBJCJiEccoWBTEjCFYEAARICkoNAFFlBDhEE4oFHQAEPROFV 1lsjMgkoCaDAiusF6427yq4X6K5sdHVFXSF53m/3zIQk6Orn93n/+T1FdffTZ3V1VXXVM4GY iCKQ6OSZPC1rYLeM2quJuAa15VWLKhZvifrH34iSLyESN1StWGZ/KqI6mmjQOKLgjfMXL1g0 +6GKCCJHE1HQawuuvHa+6/nbZxNlv0uU/mZNdcW8U9eGP4O5/gkcUoMKyzN8FPP3xnvvmkXL Vr55975VeH+FKOnKK6+qqjgz/+zdRNWP4L1mUcXKxd1iQ5ehHeuRfVH1sgptp6mCyPuEpO93 FYuqs2+auoToxjCizFWLr1q6rC2VpqP9Vtl/8dXVi3cfjgU9aTcRWV4kudegM+sHem8dPDfS fdYcYib5PJwypULmJ7JuizSCf9qsnzO78Bqi+ssHedCTrfeBSceNYGOWfq69JfBosiZiD9WS Vb0L5FlUioYvsa7qoR/nzWQis+l+0yBMmeTLtQqaL6JMJhGshQhhErr+MfUzDtPKPEUBnuKJ eXbykD3lmP5F21pJiVjgITYMA6Mr9TvlTqm7fpwWyN7IJcFn2EIH6BSwjT8RcziTPqXN7KL9 fJw+p9NoqacX6QQd5Sh6h77gbnych1ElVdPd3I3eJxvNpHX0AJXQg9jTQoyox25qKY76UQ3t AZZQM22iadhnChVRFb0nRtJn7MbMxAdpM2VixFqMeJ/W4ESep710CNR0pytpC9pq0foG3Ull NIKGYdV7qIXvEW6+G31sgHWYX640DTNdgHqM88F+P8jZAlDmh/M8BVRcR5v4KkW1Ygsf4Bys EwVaF2GmSrobOIu85KIh9Dh9wmmcSiOxm8X0OZ/BPm+jBtAyDTtbh3GSphpgFG0xvsH+P+RW TsE820F5FTgfTAtFMUVQNzoHTrroY8xlwx4kloB7PqhRME3BfnZjTTdnC+IG3s8j+F1wbwbW bAZn3qMW4TZa6XrMfg/Wy8TpRfAKns5VfomT57IGc8re67BPiWuN0+Io1tys8AG8t2L1WoW1 mDmA/cA3iTXgWgnGSZTzbMKJSJwGLkoEFQrXYYezwK9nOZG20Zu02jjNUShHkOA1AZQpPQle 3UebRZJUEJEkkmTqw8DDa9Aqe/sU5RfKv/yIBYECINKPz+C8U6GFGijJpSbsUmB/D3Ik6A7B qaAa53UAbYIv58vpGciG5FGAcwEu+Ti1ph0XQnYX0ijw+UAHfB4j9kKyDoFXAX7W+vkZ4KmP n6vaeRnAFMi7PNP31fpRkLgiWgytlPUBRDvky023gvow9AulRGGGfBxgM3mM89hPrvE9pRvv 0rdKU6ux4ntKS0vBDamjd4GOeZCbo6ChCiskkRutVVSJU9vAB2gm6zSGZ9AG2iMiISm5VEwT uAC0vwa6Z+IMC2g5p6G0BbhcSfI6QLOS43pygv82uoYysIqkQFqLCVRinKOrKQ1wDXrEgSIf FetARYaio5T64qbR1dnNhHTHgN7N4N1qyNUs5NF4ywaspEGUjPFbgNKSPAb6r8E+J9IYcgAK MftjdAP1phsx6g6MlvbkeViEvTTI+AonthIjFmLlbdDwAVQjSi6CGIWZkOrbhFu7gZ7iY5Dt B7g7PUw7+Roej9Ot4aU4q710GFZjPfSvB01G+Vv6if5GD9FL9DQdo5045fVoPUQ/UBlfg/73 GC1GC/odA78kvqkgMPMCzu4w73o1p5yxfT7M8QDafqKnRR5v5HLuzS/zy3ROQKn4JN8LPMkP A1/jD/kvPA+W7Ttex8U8lM0czH1oK39Dn4sJ/Bb/m8O5D9twshf07zWhCRYaP8SPcD0v4qmo 28GVXA7ZS1FdQilI9bSCDvlsBuelbsnHApDPU7CU/6J7gf9CrwegCwBQIu20r/5evpHfA+VP 8Gvon4RzcLXngfL/wQPad7CFJVXR0HILvQ4O3QvJP8wH+UdFpzIWKPv3x6/wTe17DdT593pR /gBPkah4IDHIx5v2vOsT5uePP+cEnG+HPMBbSO8Jle+Fvst2My1ReSM3qvo2SLV8/zdolQ/2 o/byFK1Q7wugozfQ72kHLAlQxOO0IRdUQZeCHx9CNsIhAQ+DE3PgH5hwDq8B3sNp3IhWucoO 2sFf8lk+C/1eyM/yd/wZp4oqcM0LvcmlVP4YNZ/xV3wEM74MLjyAtd6H3/AnOs5X8DJQeJwO gkY3ZPk2SKCNvoK0HwS8TPfDftzMcwAvAA7y/fzRBW63c0FKiuRzkpIH4rGAEvo3fcA/4rz+ hCppT2E3QcN9vI2P8ut8GHbwJUhuM7ugGXF8Gedra+gVNf5Bfp4f5Rd5H8ClIE2B0Q5HwYGO 7xdgNHoD2+/P34od746fw9OwSvLOCNwOvxW73hwdsUr5HT6UNMg1fmEMZ3E0nQXCFsI+R8OO rlS4EFCJ8RKLINl9YVvlfTcaNGMuyMNGLuNxfAgwTsE1SoukJAaksYsW/db8F7XtV7TwZ/Fe 4PYOGvpL2FVzf0WDL9LYX8ulRgfQBJBPwGr6tfyiPGBNfyVvtw6/kAesxa/l7fyEVYHX+W9V Rg58pf1cfwkjoaV+a+o/f58lkvksH8gbB9FECW6Vw7wTOrwU8mbhr0Q0LM1hXsrHeBlgFw1Q VuErPtz1FAJchyVvVNzTcNPvoH0BO9cRMZ8Lvtx6ESUSQcMd9B8OV77IvcpX6Q4/KAryNgXe hw6UXnQMWjMVyh718I9lTS09C01F3IvSCIw7TZ8p7+4ArGB31ErPzg3tisG4PcqzOwrf6U5Y Vukvu6FlI9FLesq/V/AhvJGjkLk7KRMxzRdUjYjCDLCAHjP0NRhgwVrQXM5q9wMDPqdcOWAD fk8bISu+sbLNAgqkt9nV9vhszP5OHqjEgB0IePf1AJ9PezN9oSgOzCI1Pq2T/ZG2pQYxXLry wK5AScZzk9QNX0O3ANYA6ukR9J2O+2gBPQ9fUnrIBxBV2sC57n7uZaPHJNwyW2ipgnpw6CTS OwBvIM6S8Baok/FgE85DxoS5eGtBZLaRdkHC9gLrsepqrCp30Ey/g2dXq1osfqhsLz2JaDIK sIgzOR2QSX/HbcjwjRC1cauIEBGItzwqClxFq8QQ3CgHkbpxTx2Ud4HqsU2BG3IcwYN4Ipfy YPbg3Y3oDyliIBm75UB3RrAbo99Dng2Qa6Ro8Wou3wxfXJhN7lWOgT+/n99VazrkbGok4kF5 m/py7P1zjHPzU9yTXxSE9Q6CzjTMbpbjIFXvYUbf/XYF7/MrUB+89eciTuVYHs4aTuItcGEE boDBvl1CgsfCmyXgFhqIu1qe9Uacw4MADyKCjbiV5cn5ZGU5eN2MSORFFbNfD6k5qEp7Ma6e /gPZScN7NvR8K/zy4cp+2mTEBQvYF/eKzK+FRiYhopArJeB0JfaEf++huRgXjZ3K0esw515w 2S3CRTgxIA3zzqT5SnNT6BJo6GZ1c8XC75cRuQV6NBP6LSO4TbC7YQB5i5lgqySebr/vnIgn FvpB9oijZHjhAS2S2id1ADefGiHXeRF8kOtLDGjE9fC4MqAVAZQzCcy1DJphxY6kVk+BHbQo fY1WfAJd8LOf4JMiBl7XVj7B/YxvtNdQ2qplwy9/CfK1D7JwEjUF/A7Sneh/kvdr2cY3/AeM ygLIM/4rr/Zbi4AN89mxehnpX4Q/54k8CLt5IartjNJDkRZEWp8AdvxmIDEOUhHAwDeEjt8S OuIeZSsz2y1Rx+8MXTHw3aHr94eOaIXMSAzEyNJjkSitVOA7hcTpGD8MdZux18ou0OExEo1E 7gAd26ADnaHLOBHOp3FKWxVaunwKlHK7pQPIMTsAR42j6m7qCGQsAyRCxzoDGf80ZgDWAhKN YEm7ohG0cC3Xq3lnqrh8+a/t8df28lvW7gBS62TsboOODgEfIJcd5hZ+WKhu9zRY4GjFXflx VH43QJuvpZ0DrwFkXgWQI+HRwLqldaAnMKdbpMEq3AdZDTzym2Iq7Fs2fS6/CSCefYhPARpg J0cA0vg4/8MP0sKO51Owp9mIEGSvOBHhn0dK6QjEHymQRPkVQcJm2scMPXoDVkreXjcA6yFt Tu6tuP8Y3Qh4jGaAojjcQvLGasEoL9q24W0h2pJgcz6hE4i+bRwDaxyrovP58MTPcSy9S9/A U4riQr6Uh7CTQ+mvSss1epvaYLf7w14PAGiw5Wmw4SNg0d3AVLSOwFyXQr7PYmQptcIzt+OW K4Kdj0WdrBkgazoI5Wb4VTfznXwtxs5BXPiCSIBvH4hrA082hcNu9cSNnwRfpye8k0wJ4M0e ymnvFQ1cJy0oPN+xAJuyQbXQ3DfAg5XaBpxDIu9EL6fysiRs40dEjOiOCKKETiIW/FRFFcch Cx+Azv+rKKJjrO73K7vG37/o1Qc89S55IB7vGpdf5FkHPPGu0Qbh3nsBqbzRt+O+K4W0t9Ak jofPSfAzT0H6ZtAQpGtxopHtX8kzlSw2QJaq0X8WzmQtzmAY5g5W3x8bMHojpGM4RyIKHsDz ABo8hSLRn5cDKuEdu+kj+KFv0Xuoj4bsRHMxT1LSM467IVo/y0sUXMJ5UrL4n5Cw48p/SIX0 DVa/ZpTg9PZ3tTKYyQdhPuhq2dgE6FgvPfbnoR3psOWR6i6SHkQx8kiUpA2vV3BAfbEL2HZ5 D+Pm5pk+oCN0BOcL3cXepa4uQ//F8E1KlK8tbzF5a8lbwBfdruY/8secobTfjbX6US2v831F 55VcA1u6ElDLKbixatWtspw+RXkEvIcEcCKTPwGsAZxR4KZofpmf4yaMms+7cGvvx8qn4N9c SyHUnyIR5/yIGOcsLM7b8M7eAnzAn/OHuPX/gvRZEQXv8qeuctsuK5Cb9rZohsNKX7dHXF3z QFSWBdkAXjRXIA9EmmOh0aMolotoInyXdCoAF27iH/go/9AeyXXVgV9Ym7dB+uZC33fSVNiM Upbe3j6aB10KgeWIQB6Bk3gAZxsMTygULQvV6civR8/SAMXlT+F76rAiNtiRKMQEW2DBFtFZ +APv+dQG3upOPon8Xl6gvmwRPyy/f8ovmMAPgf/hLQo28t/5O/B8MS+mJ+g8oBQ8iafETniv +sbkS7tYEOU5htFFX+cu+irXMeaVz/VYSX5p1AB/xIm/zg/zH/hp0QtyssuXwvYWAY/xDv4b /02wD/g+eLov8iMqjpVfdy96UGvG3v8Fq6m+G9NO+ILboD8rEHfG40baDZxKfSgf8c6dkNnx 0KdX4OPFw1vqjvOIxdzTQKkNEdpQlOJRt4Tuon+q30Rq6D4+gvl/z6P4IGR4Eez63ZSHuGqy 0tcl8M5L6UpOQox8K1acTn+FR7wVY38wPqGf0DIaJ/gtbv0yaFs0LNYaaHg0DcYNuB7Uyy+D Mm4dChsiIQa4R90dQ43X2i35HmWvA0/A5i4W6UoX3kSEvl/+zqlOLE958RF+iASVUdj5H9ot euBL6sNo+aWbQ1rmwNl1/RIbsOTz+H/A0295IV+F09ulRiLQQxzam0fRa5ykKPVhD/8vwcd8 vwDz25BpL97TyI6SmXpB2rKgd3m4BcaDs8Ww9aXg5jy6CtbtOpzqrpRjaod29MzELZGrel6K k50Bu1bWtafx2a9AlVF16tGLfp/+Lw8H0YUfuoWQe+3SQf54bQq8RZDVFtWxOdnuIOqdkoo9 EywLZfUfMJBo8JChCAZHuGlUjsfXb+yFIVNJ/kjvf+b+dlJ/w6P9vw37/+7UPHkl04s9OaNG ukdkDx82dPAlgwYO6J/VLzPDld43rU9qSm9nL4c9uWdSj8SE+LjYmO7R3aJs1siI8LBQS4g5 OMika4Ipo8A5ptzuTS336qnOceMy5buzAhUVHSrKvXZUjencx2svV93snXt60HN+l54eX09P e0+22t3kzsywFzjt3uP5TnsTz5pSgvLt+c5Su7dFlSeq8mZVDkfZ4cAAe0FcTb7dy+X2Au+Y FTV1BeX5mK4h1JLnzKu2ZGZQgyUUxVCUvLHOxQ0cO4pVQcQWZDcIMoeDKG+CM7/AG+/MlxR4 tZSCinneoiklBfmJDkdpZoaX86qclV5yjvZGulQXylPLeIPyvMFqGfvlcje0wd6QcbhuY5OV KstdYfOc8ypml3i1ilK5hs2FdfO9satOxV14xeRReSW3dGxN1OoK4i63y9e6ulvs3p1TSjq2 OmRaWoo5MFakjCmvG4OlN4KJhdPsWE2sLy3x8nosaZc7kbvy7a/aWSBryq+we0Oco501dVeU 42gS6rw09VpHY0KCp9n4mBIK7HXFJU6HNyfRWVqR36MhmuqmXrsn3mOP79ySmdFgtfkY2xAR 6S+EhXcsVLe3qZLqLkuFU9s5y5Ii53gIhNdeZQclJU7saZhMqodRXdUwdMNTyhjlnYcTudwb kldeZ82W9XK815RiddrrzhIkwNnyz841Ff6aoBTrWZJFKSftoob2QNnrcnnT06WIBOfhTEHj KPU+ODNjRZO43LnYakcG9lEReFtRmp0F9jsc8oA3NHmoEi/e2iklvnc7VSY2kifLVeoV5bLl cKCl+3TZUhtoaR9e7oQk71Wq3t1rTm3/F2mN6VZQk+3lmP/SXO1rL5zmLJwyq8ReUFfu521h cac3X/uw9jZ/ydstr0RLFP6SSNRUK4Rydntn+VIS5tVT8C9ICfW8pmAzpFLVsH2M11o+zpeW WhyO3zioyfiXHKWyC8P8ZHqzXZ3fR3R670ReWJ0GgvVUUVg8q67O0qltDCxQXd0Yp31MXXld RZNRW+m0W511zVqqllq3uKA8cKJNxv4Nid4xG0uxiRrOhrQKGt3g5FunNHj41mmzSpqtMOy3 Fpc0wlHLKx9d2tAbbSXNdlhdVStkrayUL3b5QoUMQW8UZtU/sdlDVKtadVWh3quamFSdOVDH VNUkfHVW30KpaiEPruCqJt3X4gn01lFn9tXV+nqn+Xub0WKVLftJ/omAavQ90mrkFZd0lAel ZMpgoMXLTu9q50pHAwZ5r3Zeqwp1XjtsC3p5q3qU1tXZAU7MXzWjxJeC/V4uk6n6pyZsGELO Hpi7VBp5b20lJqibXTfL6YANScIsviqHfI3oUapmwDls6wFlIISXxcZh7XDj9EGeJmTZKtsT 0XtgrcxDw1XeGDIoJzdLO0yLgbuBbwB1mot0nb9Go2SkOUBZu0m179QOkBd4GPgmUNbsR81+ 1OxHzX7U5GhNxNo+7bnG3slYeu+e+N4Dv85N0PaQARTaFm0DOTD3Zf58rj/fhDwd+WZ/fru2 oXFEcmRuCN4RuiE1gAJ729E4dvLAZlUY6laF7YGa7XtQk5wbr+0AVTtA1Q5QtQNUfY2UMet2 1G9H/XbUb1f124nVVI6+/qn8hR2NkTH+GhRyLVqpNgM+erJW4s9najMaByYfyi3XpmPq3Srd qRUj3aTSuSqdrNJ1qnWdKl+lylepco4q5/jLMs3qkCarNFKm2lRtGvVFzRRtgsqLtAL40sna ZLzLfJI2XuUTtbEqvxT1ccgL0S8K+QRNfafXxuM9H/k4vMt8rDamMT+5f+5ivM9Fm8B6sj4f NOSDpnwwSdZsAu4EfqRq5iJdB3wDqKmerOUD8gC5Wi5GeDCHBy0e0jQPIAcwShuFlpHoOxKp R3OrPbrRy42V3OCVGzO7cTxuHI+bgjU3Urs2mPoDPcAiYDnQhHkyMC4DdGVghQwtk3pjLofY iKgoWbP782SxQf42ovUUGxp7JntyQ8ReKgKWAxcDa8XeRlNUZG40+sm+WcDJwLnAdcAHgbuB ZsrxtXhCRY7I0SaLyZoO6e67x+0eqPJBQ3x5jyRfHpYwMDL3aq0v2NSXHgRqILkvSO6LrQbe koECotOHDgHfAH4ElAzvA2b0ATP6YIN9ML6P6hWk+n0NNIAahKgP5u/cx6RGJwOzOswia9NQ k4a3NIxJQ9801H6ElNUI2V4E3AQ85G/rpYS5lxLOXpirF6jNQpqjSpFIk7VejSIksgn85ezI 3BzwfTIQjeJ2cPN28O12aUqEVOJIlWb5yxtR2kiBEZuAu4FBWjOgL6APIA3QC+AA2AE4Ua0n TnMzYBPgDsDtgI2ADTid6N2uQy4xd/BVg9cN3jT4wcG7Bx8aHHxAVADKRbnHQjEx8AWibOaE XKvQaTaF808q3aXSq1XqUWmsJ2F2+KnZ4a/MDr9vdvg9s8NLZodPmh0+ZnZ41uzwJq70xLrC P3SFb3aFz3CFD3GFD3aFD3KF93WF59q4lGdSOL2g0tEqHajSXipN4pmN4RRykMvIYYYGcJ+9 juuTTzuadG5MvtHRZEZ2g++tzJeNkJXPJfd3LEjO8NWk+rLejud1zEDT+WkKZpcnI/jV4LnB nuDhwf2CM4PTgvsEO4OTg6PNUWarOcIcZraYzeYgs24WZjJHNxkfe1wyIo0OssosSJeprspW +euBCl7lHchmQRPI200rFIXTRnOh93AVFVbavd9PczaxBV6FyTmavVGFVFg8Os471FXYFGxM 9Q5zFXpDispKGpjvKMWbV9yKW7u4pIkNWbU+UTrwzcScsf72RH9eWirHlDTofPvtpRSzIicu J2qUbfiY/J9Jyv2p68IT5+r4AkqSvFsLp5V4n0oq9Q6UBSOptBCck/5+sxgmhhTkN4uhMist abbUimEFU2W9pTa/9EI/sqM+v5kcMlP9yC77kb1Lv55iqOyXIjNfv56qX89O/RpGOgryGxyO QJ+Rqs/Izn0WdO6zQPVZ4O+j+fo4OvQJ/pgcqo8j+OOL+vT8DX1SfrZPB25Wj3b9l4ebaQKf aMhbJYOlcmdBNbDcu2FFTZx0VuzNlMcn/HFUanllVY3MK6qb+ISzOt+b58y3N0xYdXG7d5Vs nuDMb6BVBcUlDas81fmNEzwTCpwV+aV7xlak7+q03G2B5RrSK35msgo5Wbpca+yun2neJZvH yrV2ybV2ybXGesaqtZTUQyzNNLoU3rnK94hQCwS4HH7a6Bjr4lFKmkc44tYm7teJn6BQBCth CHzDgbIpMzczVzZBy2RThIyJ/U1xa0c4EvfzE/4mK6ptztEUV3B5Pv4tXeov/MZ/S+Wz7LKl l6lc/Vu6bDlQHpT8k5FlhD3khimrnAz7LJRllhZZWm1t6dLSZaROdelykvMtk8mF6dtLyzEz L+0oBrS06yNlw0U+xHRLlzN6yY7L/YIj/+zIhWlIEumfRf+CSL+TEpH31Cpxg5PxkR8/lf9r Q7a3tRqGeB8GqtiPvqcYcI9Ki3miL6d59K76+4x7UTeI/0RPkociUf8uaUxcQm66i66h92i6 8Q1qHfQwfU0ZNJxqjDb1e1wbr6GH2fcX8sPoHfmblHBrLv0MjGM699fq+Qb13aqYtlIsvYEZ 0w0L3veIJOHGqGJ6XZtrzjD6G9/yYf1Vo5IeYrc4oT9Dx6iFe+nUdqOxwdhu7KAI+k5Lan3R GGAswqjpVE7L6TpQUEsP0HEuFSPFIeM29f8gqlG7j15nFwSqHB7eVPS+ibZRM71Ab9Cf6TQz R3Ia1/I7/K6JWo+2HTXGG5XGVVRAk6iIatGaxCmcK2Zps7Rd2vutn7V9bPTE3MW0glbSatqk /o/I+/QX+pA1YRHFYrq2ixJppPrfC1vAswfAyVfpIzbzJZzNHr6ZnxYrdK31KG58nbqDg+MU 97fQdvD0UdpNR+lNegtzfqN+lY3H0U/n2byG1/MdfDc/yk/zM3xGmMSfNU27Xv+jfqbthGEx 7jeexLqJ1IPs8H0zcAaX4jyP05fYXzpncA6/LVwiQ2M9rLWtbZAx1lhnvGS8T07qg74j4ecW 0ESaCaqvpRvpAP0RY4/Tn+hz+gFc0tjCUeCFnZ08lafxclCxi7/mVhGD8xsmrhSN4l3NpR3X Z+rPtO5t697W2PZ1m2HUG17jReOYOt8hWCcPJzCHFkPB5Ik9i3VeolP0DzqLNYI4GbSO40Ls dxvm/4jPQ5zMYq14Whjwhjdrr+rx+ra2SW2L2ra17TEuMSZCtjQ4YfF0CSAb0iR/j1uqfjt/ WP391h5Izwn6iuO4J/fn8TyDS7ica/gqXsxLeDVfB64+yXv5AJ/gD/krRM9Bojv45BJV4gZx l9grjooT4pRG2jTENEu01dpd2l7tTe3vulXP0PvrE/Vy/Vp9lYlMWlCM+dj52POLWitb7299 sa1fW37bwrYNbUfaTrR9aoQah4zTcE37g8ZSWgAa12D/N9Md9CDk4ynQ+Al9QWdw5t+CFxqH cAIoTlbnlge6J4LymXCZ5gNq+Arwv5bruZEP8mE+wq/y6/w2n+SvBYP6foAR0ILpYj72cL+o F17xF8BZ8R8tFVHAQG0Qooxy7OYW7Vbs517tpHZaF3p3fYA+TV+nv2zSTPNMW03bTUdNr5i+ DLIGlfltxAULgkc7Jo7oo7QraSeiBU37Urwt3LxGnOPHRRIfwWpJiL+KRJ4YAd/oAKR8EUUH bw9yBDlENFmDy+Uc4j6Rqc3UU7UwWib/ckvMEjeLcnqMD9I5MQ6StkI7LnaKudp2/U59FL+P eOOITiKcv6dcyuVROLt3aAlOKFPbrcu/3SaTWTtvWiTCjVv0L0xCext2cCQL7TWexS1cJGLA rRHiDnLi3cotyMdDA/8CyW+G2zlM/1jbKCaID1F3Jd3FR7DHA3SlOMAP4VyGQR+v5iLeoQ2g tbwE3BhOV4i7qZdYLHpBnqfTv/kG7g7NPYez6S3mk66Fiyp6V5Ti1N/kKNGP10JOF9EGrqMM buXDdExsoSFcrb1wPr41TfD5Fm7QxlEDn9Nf1V+F830OnEyC5JrhcH8Cmd6OVf5IDi0VUjOM TAJxHfSpHLpuE2f5OnElXc7btH/woyKXJlO1tlSM4a1tZ/VcbRA4th/WJC9ouJlMblOSfglO /Asapf6OkoJq9I9MN8iy9o72nVFqONrmmiLaTtIqcGccrNsG6NI4+oBj+DKeohuiUDeMGVQv dusnjVgOYwe9ZUDD2p5lN/c27LzECOUpkPDL5P9j1Dfo6/Xl+nW4m87Bat5Md9L99AfcJo/g 3uoDPl4Kbs6G7bkcd0R/GkiDsbtRNBpWSf7GUUQzYE/LYSXn0+9oCSzv/9DT1IAbqhD8uAzj 5tMVqF+KG2o1rYX+30IbYQO20mP0lnhKPIiY91bxklghLqcP6APtZc3DM+hd/TZ9HU1DTDyF u2HloTilZIzbaLyD1fpSIqz/JdBSyL1xxjhhPNH6BuZ7TP7VaNBoOhOUR2k0mb/XE9gE+wYe 6gtM8uegYBrTEBTcxGF7BZNJlwWNLEEmFJ7TNJEQEizrnmOKN09eHeeaZP3OPbHVPcn6vXui tRVBvrvVLXFA/0E2hy3FYXMs0Om8XTt83mOic2TXD0Ofzhifik9NJvVb9mRP5InQ06HCHGwh K3dbloDp93m6hVNCaMwz1lFsGZX0DMKoYA4+KMbjdmjjSRTnsn4/p+XUKeupU5ST02JtYVvU cPwb0B9mUQsKcvZK7aOlDr5kyKCBMd2jNZUGOVGLKrEvVcTaomJFishyOvtV93GNHJUuE/3O 1ln2hAS7eCwutFe/fk7LefNIV4Z7ZHqmW8ZHFvG4dkR/W/09cnlDhKlJ3OyxsCVE/q9Xy/sh +8UjFCpe8ITZbYdsb9g+sn1tM9n2cwwJ8cIeM3S/STzybH/zVYjLDor7cJt/w0W+fXzXYm3F br5rAe/cVjf4iW04/Lu4UMBaY4Ls8fH2IF6ginEJdpP+dltCanJyKn/uy0HLZsrTR+oTwdky z4D4suRkQhz4uLVMf9wcWRYSYu5xksrMsWU2W1yZ1WrmsuBg88n+YRwWbzcXXR/noizGkc6Z +J3b2gJiWmTWeopk0Xqq9ZRVUtgCAm3RkqzBNodi6iCHzcdsm8PHa7ElrltUXNvGngkJPXmZ LPMyWRbJbbNV3SOx3brF8kOy3HaZLMswdL8I1ruJdZDCBE8YHRaUYBLxelW9FLNT1s8pa6Jc urtjsN7t/ONi3cqViCiPG5/CxfsGQXcPnEejOVT/c2h8xKJm7klKOieCrxiV0lkIpvceVjRl qEy+mTwse5JErP+5MVP70rSIrLTIkx0SEsPxIdowGh4yhseHlIUsDFnBK0NuM98WspXvC3mU nwx5jp7jl/nVkBP8Of8j5Hv+MSQ2NIRDm/iVZ7XQUVQW0sSNIKrM/HyWxtr7tiY+0HAQh/7d nFac9ynKkttZMmcOvAdF11Ae4hfZj1tn2xJt8RbxcGh0hC3e1PunkpT4yLDupidiI+IjQ0Fr JeXqw3HONrrR07MhiM0hIb2JoynEQlIqe5MNZQiruYyb+Kk9ZCmz5YbwU2TB7RQmtsLi1pOZ DzYGNXOTqPdYsjBnfBRNvj6uiZ3rXRSfxXFKEk61tOAfxX8X1xJvRXKLuZ8rYo31KPI4VcAe 5nRjH+HBzIrNvfpUahtjQm3xvc5/r4X0ireFxoix/FNYvC2+W1tRW1E3FMJgd6q5Tr8c92c4 fL+hjcG9QcuPnsTuvSND4xOS9MlRjH+RUVlROVFaVHwPv8GZM2eJG/YG4tD6veRgQAbVCWud 3vQB56+UMqbdLdMOZbFPCqUS0nek+CkRZLobXF2ouHqzp9ehoLfCvg3TOnGzI5fLbIqz4HBu KDgruSq56+csMdgaRs1ZQRwExhatBmMdHRnbeuo3MPaCaLDPoMXqC88vU5zVLOd/8HO2LUhx lr3sDXDWBot+CBFWOvXj5zyuIbbhUcMTR2UMzRwbNT7h0owxmUVRRTFzE+ZmFGX+mB7povT0 jH4sRKbFCkvliQnfFP5g+P+y9y1gcVXnomvteT9g9rzfM3tmYA8wwwwMzyQYhhAQEgII5KmI ExjCRMKQAYzYnvqqWmvbaKueU59pq7dar48a00NSrR5vPcZ6rempVm1tEz1Wq1c07RftS+D8 a+09w0ASr+33nfPd811YYe31/Nf6H+t/rD1hmOMFuKBUX1DA6t1qvSFQSroKeb6qjOdLy9yB srBKQpvk8ipGLpcwbhVTbjfSJotli8FiMRrcdoPe7yJNbV7kvcJ7o1dyzIu9pU6v1+V0+50O R7iszON0mJxOh0Gv9zDlJthFUSCgBnpjT0gX8YJLGFHZy8O8w8g77IzjCIRfYbw2birjnXGd qhHpsc7pdZ5wnnRKnTM4/IMKhteX84YjeC3SLzx1UK9u1M8sPBVnYaxOj5G+C7Tzgl4K7Asf jLaMAmPC1xBVvBciV1DHs0JxjqpkUH8NYFqi/dSwgfq7ThYJES4Bk677hx/bkJKdOwf6bZj9 ff/e6Kkf5zf8TVU6W8E2NJBfyntf1nSJMl2FA6Jw42UdEklAIvnc3Kt7v0U16r+SvAlP/Inq 2u/i25po87Neh8N74Bu/876Br5t/wUoOgMFolbxHhP+vT2fr+DpmcO5O4gtsBRnaDjLkAi8n hofjTzxc9kDoX9XPaF5Ry/aXfTl0J3d78d2hh4rlnyu6vHgiNFW+X73fdEPR/mLlZjbJXq4e Z8f144Zxo2IDt8nXXrQxdG2hLKZbw632rS5uLFsTatGdyypVUTvn8jmLnWXOaEBXFlJOs48X PRuVtHLtxZdw13JfrriFu5c7xCnDSpfFHkLIbWGUshDGbmUFVygJlBTGuKC7lLcEeaXH7amM xSxKxqIMFOu0Xm1U26jt0g5o01qFdgZfHS8tL0Z6Vs/o9Dfqn9If05/Qn9TL9Y7qYIkHI9D7 zEmiBqs2TAsyQc7pXtG/6d+7idhpcDiAXyAMICazIBiGVeB8WFchcELYj15qyD4rK5qn456i sMGk1hj5UHGZqbwcF6sD5ThsKC1HRRq+HCNycQI/V155Jdrbj/fuBVPQ31+sD+RpMIWF8DnH aKMvVldbW1PNB8CzitESFDHaS40re+cz9159Wfe9iTlqeJ/BpQNd56y/ed/8QXz/eZeu3X7X DfP/1iew+9Bltw1E77iw74adhOVMbcC1u67rmk8sbbtXxS9dS95kLRyXdkgfBE/2ePzSchOO okbwySUyi9myxZo0DVlSkXHThGXc9phVXeeqrdhg2VB7vvX8mt3WkZprXN+MqqsqdZzTDyGu stBirYtxAY+uAEkMmsBjIUNxneYGqac4VCeRMiFVIa+8yMfzjtVOXlfprYxWNlZKK+2rrstj wqZZ4MCmuTlC/kZCeYH61lWC4yfwAJ568AHRxkc0vRsfKTpvx7bDyLXw/qOgu48svI/cC+8f slisLpulXvjZjvv3IjjpoqNI7RYfhBTwK+QkQROqitXWibaNeGLBiKSmptoALZJXBbuhtzKy LZM3J7bE+XVBF2YfG32gW282WEI9L6TOv7Dtwutj17xz3TGpdw1hybteh83Z17Q95C3vHGjd 9o3H5//PhQNmi94avaA/4Gx74KatD3we09eh2+DsReHs1WBD3DHgTcsvl0v0msKQweDW+F3e mkDA7ZKo5KDXDuo8jeQZD+vsjfItDGhhk8MaMhrdjuoIIShTGaqpcUeC5aiMLWPKQjzvLvfO 4NF4g4PBvCZQxDtqEF/sQUjjYDRKP69z4Q9dCy7G1QShmgp3qw6ojqlOqE6qZKoano+gcrac KZ8BDWwpLgZz6FH1GKOGDw0niZGu3ZAWjHTDptm5BlCYp4jmZPv3zsJREk/PHPEi5+g/OC2z iP2o/6WGXEE8QbQaCmU7cu3A4H6s99VkHU5RA+ZOjeiZ1vgWx4gteDNzLeHZJwnCir30zEgm SMvc/8DlNkH92ZiaeS/Vm/OPLWrH+eOk5YX5jQO05wOSDwCXfgtq8l3gkhe9Ei+PSiOygJYr 4EycOeqKetbKqrQVpgpzo6vR0ylr1sZNcfNGV5e7y2Mm79PuiWu0taxWq2PdKruX1l21yOXy IrddydC6rBbLZAxoOpuB1IPmWr3ZbNC7bV7ebuDtNobhlToevHpiKvVdLGbt3FeOZ+lPwzFy UIgVm80Zmo/A7Hy2CjVCWZc+5+kvcbDA08ccocYc9a0wN3+CqiLqb0nXfmJZamWynv4VIN3b gG4+NBqvB7GuIWLtc3pqQL07Qax/JUpxDZFihtc4iWDqVFjlCACmRoPdf+90XvD5dj8IFgSg s/myk5OYRZ0MyOjPJjcCOvhlJkIk4ZOLCAJHj1KkfptFBnd6HHbv/IXLEMLIBvg8BfjUM/Xx xjfdb3uYVrSh/il0DP0cv+r6mftj9DH+2K0uRkF30MPXn+va6rrPc9jzEnoJv+R+D//OXbDN g7FWb1i3Gc0snDhEClrKc+PdOqzTeXWMrtSo0xmMbq23mLSzyN/tZ/ylvN9fzLu90RoqMLGq 2lisptYd1choXVklVSplUrfGaRaA2bDO5rUxtlKTzWY2uZ2REuqtoVB3iAmVBkOhkqA7MrNw Q9zlxohzud0ezJgwyT31CIF9NUETBLPuuMZTDCGnx+Ny85jUN7hczvo6RmLmnUwkGqzlo1GN Ris18lolH6yvd3s87rpaTzCOXsTe4EAwHXw4+GRQFowHS6uDcUONLrg/eCx4IngS2maYN+Jm txcPYGY/fpF8+lvqckkZRuqeYabjFiMnkZqkni7ji8bjxg+NUqN91dOi0tkEAWuDw87O2vSr osK//r1Q7Q+F9trYtx3EmaOtLJwNqoaoFmpoJKqKVmaFEJedJX4eOHjUG5eBwxey5Z2N/iUn pX/vZzxSp08LhUAqM3v70V4cwAH9MrcuK5xVOOvwnWEIc9dF80+wt1PF9BOSn1tD8p/itXjV T4nHV91K8vnnwcv23m7AA8zx5cdyLsy8RDVjXjtIdQSk+kqQ6jBOx8GpwiqX3cU8y2ANljud 2OKUavRUygpLDYWFejjBxSFBmkpwSWm4pCQUdherpXSIokqiUEglbrXDROtgn6xWExzuIg+p +31Vbp/P43YXORlswB6X0wTihJ3IGOKLiz18UREoxMt+4DTxoAkgmrgMwmqNWo2VbpcH4ttw 3IlQOF5cowt3hQfC6fD+8PGwPOyIMBKPwUmGGw0DxrRxv/GkUaozYqO9fPXFOe9iL7FVrODk hUCLvC0ozgZRcQq3IOSKadV1kVDzBdviOqw0lTRik94FGetsJF7cdhoM/M1Ktv80lUt9El8A n10WlqmsgJQZnbvldoHHJG+llu11ZvR2oq1wLZUJqfWTc5Z5/O9InlnUyQwaAY9vBDy+AmTH n8QXntM9Y2cMb1vetv2Z/bPhlOWUXf6s5TX2NcMvLK/Y3mXfNSgcrMNgtlhs0mcNf9F9bJTc qbpFew9zv+x+1T3an8h/olRezXxF9lXlFdrrjdebb2Zulynr5HXKKlWDdjVbZaiyrLYpy5iQ NsoWG4otUdsaRvG47kn2UcOjxkfNj1ietB2xKx/UPcTea/i28TvmeywP275nV241nmfpt93N 3mL8huUO2zftyhZji7nFssHWYd+h28H2GJSlttW6WmOdeZWtU7eBbTEoNXK10il3Kkt1QWPQ DF6dHUuVRl2BFCmsxVKVvlgtKSwmzj+HKtABJEP7TMUK+0FH82XiBdIc8fpnG2epk2mlt4z0 h3jrcHD7+0EmDlnULn2jYWbh44PwZGcW/nTQYGu0wDNeaHI2WmwWd6ONZCpQ7wfBUYOu98hT NrPwi1xdYyD1p8lTJT6N5FmgbzSTecLzVLxQyzaauQLDWqMHMjyz8LuDRntjgfhkyJM1N2rF p21m4Q/xAr1xLS6ETOsnpdPf7wvvg0PbwbsyMeAwQZwEzq/FoKhmAn6GesIG6ciXPrz++fnn cc3z139w/eYPnvj+X7Hi3ic+YFrvm3/jAN6OC7EObzsw/+b9L+DW+edef2/+FfKnlBjqzf4I NEk5qsPfOox8Cz+Od3K+tSGT1bb2/JrhyqlKiSK0unJD5Q7HtspJbjJ8ac1Xa+4t+17li/zL 3p9zx/mXyz/k9eDqVLZ4W32Xhq/xfjl8k/fb3gfCR7nnfG+HCjw/XPgTUiEd9apColeV9aKq lnhRa8wh0YsKe7mykE/uLw8HvBFUy9vBqbIx5cgTjcSB9JDpGiMRpa00wJeVES/Le4S5DJUz B+IFCBDxsFXFLsRjfgb3H7rctR8c5hlcEicfAur2H/Af85/0S/3ENOr0cRZH2ZMsw9rrN4wu jS37977V/1Y/8c/AAH08K2oeeucALCG3DkT95Eean9V3q4dIyCBGQo96tdyRhVNA+VOPhbQ1 Fi9I6qPVXCVInRgNIYiHwA71g2icVfcIGgdiUmvWHDF8sLgqJoakeLOghQ4s+tf4kztfueaO HVd8NU5q43c8kJ7/6LdjB8+7f3r+eUY9v2GpSnr2H3bcXbP2jj+QVmz9UU1f92h93z+BJToM uskEumk9ejNedk5Vh7Orqr9qn+Vay3WO651fWfXNdep2rrWJISJxf9N96162vm39yKpwEiSN ttqZhd/EB0Lx0nPWOGw6mQnhusJYRUASqSYRqV5j5xsaqvXFzRpOpVq3GSLTyA3B6mJfMwSn QaWPhqd1xQOetIfxOFpNxfFKPsDHm9Kll5fuL7279OFSWam95c4j2ItsuXD1rVkwHMSeZGNW MWgNsXPgfIiRq3UVNSpCFAthDTABE32yPCCFeFRuNnkYq8VqEW9XzWJIQwdCK7AAOBCkiTZK viGodoMVy77zxRvuiXRcNPxA09btb/+vX11NqCv0/PCuu/65taXin352wQU/f/AR6VoXYdIv PCRGvXZ/ItZT5dW73MEvX3jj89dXkK7fkfD1gn+8a3TdLo/ZEWhru+aLPyIfIITT3QCnO4C+ Fi/TqbQ1LBw+CFJrSZDKKGU15LLGaLfUgpdvDxjAD2HgMNlncPoHLKuHuBNMeDrOsa6o6yLX iy6pztXo6nINuMbhTD3sOu5Sut4tJh4euYQ5RR22t+CYkNdMy2LD5ZHi6YLsy724yBaYG39J 45c/kvyX8/cR6kgeJNRbGr7M/5rINt43fz19BshH6EStFsKfiwcVSGGrQB22DaGL3F9nj7n/ bPtzSH0fus/NhGwqFvx6mhPd/JhKv24zUdqHSEFLHaJClq0ys6zJ7NaaLf4y0gSqZZxnEM/y F/HHeCnPl0LkXhZy+0NIQ69dbWkF1im8irQCfKtSRqGQMG4Ng3120tnudlfZ3G67ze2zWc3g QnuAECA+thC48VabyWq1WS1lvN/O+0y8VsJr/D6fVqthyP/hDOEQX2Hrtj1iO2mT2kigr7Ey fNQ8YH7SLDFD/eCCFVuP4KuRhTl2MExvUIeuCbGn3u4/1T8L8j/bT/mTdaVJikazDvUZLk6X X4xSh/pTG4jnTH3nvf3gKwEjCX+pghLuywK46kytzL1T89ubrKaCApMVr7IZCwqN1m/ha+X4 ygM2E1RsuF54xqVrVWat1qwS8k8skvfy6ySG7QbuXwHcb2aq4rcYavBqX32gpjmu7bJ0RZrq z9MOWPoj59UntGOWsUii/q7IjfXf9c8YZnwz1TPNRw1HfUerjza/it6v/rBxtvmP6Pf496zf BmBj2NCsNzQHWH+A9VVXxbCvurrZYDB4fNUmn686FmANrAfHTBjHGLA9LK/j1UbewPt4jnes 45v5ar6GX1PJx3huhrk07gLbpVY6lGuYMubDalzNNzc31tc3BgKRSLCZmCtDY5OM5TGWabUy t1trsbgxadbrZFFZo6xLNiCTyRwtMT4ArYeCw25YifSru9wD7rRb4rav/yHmQWhs2CwoP/um UzYQAvJeg2hA+6a3bIZsMGYn/COdtM0OlVxjv6gmqeqczc+I4BC328PG7bFGNm4thwwccNZv 8DSyhQUWyLSmRtGn2S7KWDP5vKZh4aWDMAf8spcOwjT6hJkG4hnBZFqH+eT56FIQOvih4kXh VC38Pm4stDbqdeDz62VmkoFnRQ5x3AhNPht0NpOMtelMAnx4xuD5z/DUF4Kfg/Mdre14+RX+ soZaaMh6/KKtPa2B+SbeTy9f5v9A8mvn752//1paP+VxsKYq/OX5L3lJ/bdEZV2I1+N1F5LS 26SNY7bOzeXu/H80v04oF1rkjAS/kw0M5vvxd/LuOQZB5kdA5mP4jsPIv/DOQau30T+z8E68 BvzOH/ixKqCK2QP2WCqQisl3GC60DLh3+KRK35D/Zv+9fukffX8KMHKfKmD22QPS7CVYjeiu OThSL3CHfG4353M7fP5QJbQcZCM4MsM8HdfEIpHKmDsUQ1nHrkZ07OxG8v7dQsbkXjqVFZEx VcFQIBgsCrjLAn4/Zv16JLGrYgFjJR8q4kNlHF/m8BkM9L0SmKQA3x3DsRnmyUNwwHk9C6W4 zscjQ5dhP7ncrMqLGvs3zZ4iN5unSHRAjRFRd7MsvWtraMia9zyt9dESHXaa96ZcGhWefSQV S7QXvDs7eHfF4N0dRDa9TbzQ3ovO5MD932XpGzkzaPf+cn5/jNTeIVkvXo2renJyE2PY+fU5 uXmcieREJYhfy7vjY86Zn5PcIn0H6VFrnNdrCv+AUEwD3sAfQHMpNWpWaUC4SMWqK9Tdaona bkjen39x2Xim27ssVosfM/jfVNxPCHeQ0q//5Umyuuw9coVHdPS/L5wneUe2C+lQxyFVicZe DSf21XgBFFQqu2oMp5TSwhl89DH5Jny+kryt16LzVU9EC3HhK6z82cP4eUQ/EiG+sZ9D5HVz P9A3+5ZbfCmLVzPfUdv1Lv1cPzycsnV/2WZRs/Zi2f1mDQtKHTfMzzE3U1qsjXPLacFqDCp1 EW6kb+AFKnySpcJyGsgW77lF3jKNz+ffvD4sayK32H+hngtEXl8Az/kB8ilbVIbe+EF72UgZ Q07PQ/FCJMOyKD1AfqXHRppYZ9TqdNqsfo/a4i9R9atn8ODBEp/WAs845/eZPEirMSnIfxmw elXcFeTzpxg7wsW+K1jMzuCvHAyVXZF9m7p3VnxpRu7V6Gsb4Ohb8O8UcXrPfh1SWbHxEYsY tRwsVBqUINcg6trcK52yhfcf5UzBIxDw8aCBAsoiu/g+h7wYyMpzjTxn/mPWLNGM1YIvTfxl KTNOZPqZr7+R+dn09M8mXr+V1sdfveXWV1+99ZZXpe/8dQ+h4XePTp/Yd+nxy47iX9KL4aMH Xn/9wN2//jXQ9iagbYPkCqRBVtwWrzdYpBaT1SJ5Dj+neZn5lezXipc18osVKT2TZJLSlDKl 3l0wqk8ah61Ks0+i86kkGpVC60P0HY69kT7BgpBnvMBc8wj5cxsV6CIkQTPMdXGbwSePkzc8 cRiTlj8pf1F+Qn5SLpPP4DcP2soezL3FBjszC1ElebdIQg/ifC15KfZDZIFA0ASBIGsqNFmP LLyJjAtvHizw6D319YuUJCqGWF2NhVxxmUimh3gqbtR5GjUmyJRqyBQkg/b3426DplFhgrBZ QzKLSW9dayKZ0UQM4AxE/AYoqNVaFmZCxkh03gacvXbI/WzHJhTwo5pqVBVDinx+NczPPv3j +Q+w4cdPY+PmNw4ceIP84oefmj+J9U8+hfXzJ//lrt8cv/OOE8fhJD0AlmqHZB/4sua46fOF OKzqUu82TBuuN9wqv9OocPmJwGu8RwNerz/gdznNR5iHwIeJx1X0ZtzvDBWTEV0lnUUlJcVF /pCm0ET/GIBMUYCNyFTIqouK16CQXN3I+qQK8xqnf43L5VTrFCcVjMJRjkxckS7QHbgicGPg QOBkQB6wh+e+tqjhhJcWwjuLxtlZYj/Ed5mC5Vj1WQP978vJf1k9TP6P40FnEVFwJx7VO6qB rtsp2/Ui2w8ZTYUWg4tyl/wRI7P4WaPFGFOx7FVPLuxnmHu+07LxSrtRXWgMVNvrbn8ST5Kz MreHGIvn6TWjZOdLN29OOox2hTHg2PbAfDWNMg16K/M4VcaYITrwJtBEBch3GEnBaS7QIFyN ihRKe6Go+4Ewb9GPa2GJGJ3RAJe5CYsGxyZ96C/XETUnm4YNkEu7i9EO6UXSTqQAHW9FXhRE UVSHGtG59O+yDKBdKI32ocvR0fjgyGh3X98F2y79fH3D+GRJ+KKhoo42rXJ9XEr/8IqLK2oI FxWFGyTbXNUVJpa1uTo3XJLJ7BxuXfeFy2pjY7sNlp4tjHz12i2Q/Bfu8Dh2XLZ7x47dl0mG /erCskiE9w+j6G9eWBV94dgLhInRaJQ99gL7AvASSi+QYv4vHYejwpP9qTB+2eDTxgNpTAE/ +fMVQfFpFJ9W8ZntVyyrL38u719eL14GP7ue5LWK6uqKm0n2x6rKqsoiUpqvi8HPg1WVlVVM D8nnHKSBuTo3du6hiupYjA7GR0nf/AUk/yMZfDMpSW6FrAJq869UVVUehwr+RyhsIcA+Bxl+ IhatmWuD0i0VFdUMJw6aV0Dhd2Taa9UV1REokA9S14npptx3SeQSbobUj6/Gr50tMQ3MF5l3 SZJqZCrZc7Ln5HcISVFP0wGVRs1oKkjSdhd4C24vuL3wtsLbWJO+DNKo/hH9bH4y3H6mZEyR ZIqdIfWvpJW0klbSSlpJK2klraSVtJJW0kpaSStpJa2klbSS/n9O5pGVtJJW0kpaSStpJa2k //qEEFrNkO9qol8iwTiEP6xF/6CohdZImUGFzJdQ9htA4sytYlmaN0aGbMwvxLIcuZgPxLIC jeXGKFGFxCaWVcglKxHLBYVy2frsN0HgAuMGsYyRxrRVLDNIYfqaWJYgznSLWJbmjZEhremQ WJajQtO/iGUFqsuNUSKb8TyxrIIxL4rlAoXE9GvyjSZSCayldZ6gZfJ3lVjnSVqWk3YXomUF aXdpaVlJyy5aVsFGPRK1WBZoKJQFGgplgYZCWZo3RqChUBZoKJQFGgplgYZCWaChUC4otLnC tKzO27+G7K1sPS1r89oLSbmsj5ZZsreyIVo2QtlQlqFlU954M6WDULbktdvp3C/SspOuJcB0 543x5pWL6Piv03IZLR+g5XJafoiUlXn7V+atpc1r12ZxuR9xKIYqUCWqg1IfGkFJeG5CaTQG v5NoGo3Tlmb63STjNE9Ae4qOiEBPExqFxKEeaNsF8yfRBK0l4Um+jesSyIfoyAJIbVDbCa1J tA9auij0MVg3u04HQJ8G2FMAhwO4aYCZQoNQHoTyOPRlcutwud1XoCoo8blaHQrTPSQAwjiM 5WDdBKxDYAyii8WxG6A2Aq2kdwr2OJHDidAhRfEYPet+hiktOLQO6juhh7QmKCWW4ijASYuY cnSVKegdpPiS2jDA3gdzM7RlCkYNUcpx0J7lB/meJkKdFJ03Rmm7hs5P0hFJtAfWJJQeojkn 7ig7lqPtE9BC6Dee4+AiHqR/EnaRgpkTQIVmcZ8pcS+dS/BJ0N0RWRiia5PdX0zxHP675IjI yy5Yb5RCWj5v9Vl3UwJjUxSrdI6WpWgLHTWRw7EWVlgFsrEUigCjG/Ui8hdU/2tPgpr+rpyG /y6noY1+go7sikDbSHsnoS9JpXW5BJKdTAHccbqusINhusIkpeh2ijVHz800xVLY1WSO0tnR pC1N+U3oQeQtSbk5RMeNixwJ0xM5RtcZpzgJcwdFKEmxnqCwx+mu98CoSdpHZu2k+8hSeDm1 JsUZAu8yp7UM53AI5+qL3DqdOuO0PgRzBqEeFjlHToiwbji3znIMUpRL+yidBqksn4lm+0RM U1TKR6k8Z8/ectqTOaO0VALjS5dIz5mhC3v4e2mbL5sE0i5oy1BpnKScG8xJ45kwyK5++r7W 5MkAwUTAZZKul9VWGSrP01R+iDyP0TOcOCumguwllkiVcBbTYi5gJZSJVhgXdQPZbZabWThk JNFAnyajgh4dEzmzCD17QlIilTNUW6Xo3xudFHlL/Ius3iY4jFLs9uWovFSqw5QzCVoeEuXg dB2z/CSUUF1L8FyNopCSVEeSNS6mmiRJuZqANkKhXTAi2xcVYQ4s01ul4uld1BYTOYpld/O3 WIbPqIk51zIYHVkYnDsnzbuhTeBTVmqS1IqNihp8Ubo/zbpkpfLsFoZwrjt3cibyLLfAb0EK kuJau6gsj4l8D1OcM6LmF3QP0QwJSn+Bz1k5FuRqXPQOhBXSAFXQ9GM5SUmgRQu7XJ/9J/Ai R6EExZ3QLSXq+iHxrA4C9D3iGVn0OsgKKWqFJqhsins8O2+h3LvUxgK3S/NoNEStzOgSPXM6 jp8Cj2rfFJ2XHX1m7RZept2ytF8+m1BN0Kf5eGf3tej/LJ6aRUuU5WGY6vs0XWU4V0/mScg4 /Vb0USpvI3kWVtj1TrqXpGippnK8zNclAg+jIscn6CkZze0he66XytJnp2q+hRewzLc0S2V6 kRL7KB33/J18zFoD4p+NiZRJ5u1giOZkzUW67IYRg3m2Y/JT9LGg+YcoBlmLt3qJFk8AxDTV OGf2eAXPPGtlFumTtWSLNMrXKUtnTVBdIfBqp4j3mW1u4iwczeSwn6BSOkahC6dIsLz5Fv3v lYCsfWtDLbS3C7VCbStYyx7a0g5tHGjRHujZAjXybQDroSUII3rF/iDl1FZqh9pg3GZq4wQY PZB3Qn071XGtiKN1UtsI4zsBFpnbgrbRNVoAWi8d2UNhb4LWDni2iOPIjGZo2Uz//ncnOpdq QWG9TvrtqBwdL9hEYad90M7lMFy6q3a6YnZnm6DWA/DbxN4mgN1O4ZH9k/Vbabkzt89WcadN lEYEMoFJvsugg9ZI62Z4dsO4Xrp+E8VZ2G0nxaEV+gVcWugOyMoREVdhHKHPFrGH8IjsrwPS IlZNlAZtdDeL9GuGZzfsnMA/l36bBEfHdFAuCiPX0fkER4JtB60tYiVwqpli006/rZuDuU1Q aqL7XVyrS9xLTx60pbTbSvsXRwn4NYl5M6VcF60J3GimtT7KK9IbFnnZQ/FYvupWKoktdFQT xbg3JyGtVHqF3WelU1ijK28nwnqEt/l7yUo19ylnRICS7d8scvp0uhCqN1GakH315lY+G2Q4 m/dzsYrKOq5vJMltSo+lJ6fHk1xzOjOeziQmU+mxCNc0Osr1pHaNTE5wPcmJZOaS5FCEKyho S+7MJPdxXePJsT4ypyMxnZ6a5EbTu1KD3GB6fDpD5nAEfEUVx5NHXZjrSYyOj3BtibHB9ODF 0LohPTLGtU0NTZCV+kZSE9xoPpzhdIZbl9o5mhpMjHLiijAmDYtyE+mpzGASHsOT+xKZJDc1 NpTMcJMEj/Y+riM1mBybSK7hJpJJLrlnZ3JoKDnEjQqt3FByYjCTGicI0jWGkpOJ1OhEpBlg pgBKp7BOgpvMJIaSexKZi7n08Nlp1JPcNTWayGT7VueDKdmUGsykyS5LtyQzE2TF2siqmDgE RnT3buprSwMKQ9zG5OTkaDKTm8FNTI2Pj6Zg48PpsckItz09xe1JTHNTgMIkIRZp5ibT3GAm mZhMhrmh1MQ4EDDMJcaGuPFMCnoHYUgSnokJbjyZ2ZOanARwO6cpobLkmIQOoGomWxgmK4TJ k5Izt53xTHpoanAyzBExgLlhMie7QGqM2zeSGhzJ29k+WDQ1Njg6NURkJrv79NjoNFeSKhXY kjccIHzabgUupsZ2cZnkxGQmNUhov7gAmZ6DtYZSoCQFq0wm9xBGZVKw6lB639hoOjG0lHoJ gVTAMEAnDUtBPjU5DlI4lCRokjEjydHxpRSFkzE2LQ4nDAGAQJ+R1M4U7DlSUECkZTg9Opre R7YskjrM7UxMwF7TYzlJzTKhZGRycnx1NJoci+xLXZwaTw6lEpF0ZleU1KIwckCU6VJgLxWL CbIxAubMh/BMh+ffxBEdZMTPCZl3pwEnQprkJclROFiU3EuPKSHlkoNaUNBNmDNBpRnwBhIk YdauTAIoMxTmhjNw6EB6BkcSmV2AM6Ex0Ao4CtO59E44bGOEKAmqKLJy9tmxIBtKTEykB1MJ Ih9D6cGpPcCRhHCeU6NAmRICcQm2XK+oKX5eSnc0lASAKYEPZxzH7UtNjpDmPHELi+JGdp/t Hk2BnAprE1gZQVfCCvQQEQzD3J70UGqYPJOUIONTgNDECD2wAHrnFDm8E6RRlBLAMAqITyRB +QIEwmuRSmfcqnDgYUnh0IiUppvYN5Le8yk4kmMwlRmDzSQpgKE0aFS6l93JwcmsgC3KMQj/ UIoevNWCiCd2pi9J5il8UIHkyND9kEM2vigpYtfESAKw2plccnITeYhmyPITkyBMKWARHF7h oH8aAch5a2vherta+7Y29bRw7b1cd0/Xlvb1Leu5YFMv1INhbmt7X1vX5j4ORvQ0dfZt57pa uabO7dzG9s71Ya5lW3dPS28v19XDtW/q7mhvgbb2zuaOzevbO8/l1sG8zi6wK+1wEgFoXxdH FhRBtbf0EmCbWnqa26DatK69o71ve5hrbe/rJDBbAWgT193U09fevLmjqYfr3tzT3dXbAsuv B7Cd7Z2tPbBKy6aWzr4IrAptXMsWqHC9bU0dHXSpps2w+x66v+au7u097ee29XFtXR3rW6Bx XQvsrGldR4uwFCDV3NHUvinMrW/a1HRuC53VBVB66DBxd1vbWmgTrNcE/5r72rs6CRrNXZ19 PVANA5Y9fbmpW9t7W8JcU097LyFIa08XgCfkhBldFAjM62wRoBBSc0s4AkNIfXNvy+Je1rc0 dQCsXjI5f3CkALyWNI2ASDQyRiONnWgaF0A8sRvq79JYKNvfK0YvQ8I9t+Q2yfclT0iehN/D kiOS/7lyz71yz/030Hblnvs/755beHu4ctf93/OuW+Deyn33yn33yn33yn33cm2+cue99M47 S52Ve++Ve++Ve+//5+694WwuxpgJaiey9TdozJlcEoMml0SZNM6UeqSV0o3Sc6XnQL4KRidA +xFfXdBZI/gR/C0Jojq0CcZn6GfCCAzxM9cIzQfo9xpjdPpPto18UpoZGh3bJZYtE0J5Lfz6 mzJ7xsJc83RmNMydm0leHOY6EpNjTZnETojTT+sjl2fCCAof0zXg130nPE3Ccu5bKq5y3yRX lV3bdu0fC7CCOXCV+ypo+gKDcaWmQiWXhQoljEOGKhJydUiOpfiqOgZLD/RWnFcRzmtxfdtz hQs10NRFlW2aEpEY57UkVfjygElNJQs/laYOn/LZh19/+/1W5TncbQOjB66y9VZcJX264irJ 9w5IGMwwRvLnwQ4/ruvc+u/DyXq64cMVBbndYhnsax/dpmSzVG5kNvdWGiv0pKI0/kcxVx0V 1dbFmaCbobs77gwN0i3dICWdQyMlwoxIigKCdCqiIg3CE5ASFeQhICgGUiKhhISigHwzoMjn 54vvj7feYi1Y++y595x7zm//fmeffQciS8cgD09f92A/XzgFQIZtxIfhm7i6IP18XeCsADO2 hQhG8+O0+8gJP5wDYMP6ITD6H34zT6SriGmwI9Kf3UhNBWClI4VLAbKANFxaUkZC6gTGlDli Aqi6f2RkJAAR1k8Mg6gYqsH5AJ4Di9VXzdMfezStbqrBrmFqICelqiklglCXRIjIItTgcB6A 6+CBmH/5QKYHB/wAGsR5dIJBuDgQNIgcB9NOBEaDQDgFtuJy0uTgS6VX1wz67KoKo8dp2j7A wNfxc5+ruNYLvSySYBaYCT+emd+HPDm3pb36OxmTzhK+9DEBOfrCxN1t4fxq971gmnzCBFxO 0gcVI7IVFOxUYtFtufS7HQ/Uzj/Ql2aWZi1k4Jt7S/gKRcLdmbJBPN+Tq393/WNI6ZQZ59Tt lrVjFxiQLm+TbElVhuX5fTNUO5ktyR23ol8rV943ijh5QZmCEzzb8/wUg95yL0Vkd0QrR9fH 9AhOB97EwpUdl0QUSG8v8qnEuQfxdsLJXcg18iYY164+Z0yTBG8z92BDNvrTZMLF3HyDuttC +WKkc+Wocdqb5jICSiqXIF/G0gI6wRBMGF1BgwgxM4ILsGCmlIUMSgulppDcubFhlGdvpSVy fODZZBNlJ8vnfQixcEHpAdoYai6Jrecmmv5ES8rbp7brhWq6JevJATPsB9ig+oAuoFOsVawR p/atJuAc6COK/L5Oos5+SDF/b09sq9i3kkyQ2OEyYldxfxExoBTFfASwwiPAxCUuLj4IBNUD jgPa320AHHfsWwehoaG/6sA18E/uHAzAsOPlgWIh+O2WEIKf4hGCRYlxUn9H3n1QRwxj5JhV MSd9hGz48sb4nU3/6bfhBsd8RnMLSDLx085sPPOlZ8/WmlzbHUh9rIzDvDghkKGXNzrqdmxo iIcyvVXCHhfvizljYHtec45CXUKqRaWOBof5I3kuSRlqaxqt2OQVpcExej9o5eW5oXZVpvg3 VZ6PtyqbrF+Iz69LXpRNli8QY9yUO2GkbT44GUNEa5N0zCvxvCvdyWyf4wrdyuY0dot5zx+3 3S+QvghTrwo9PWC0Tlwceoas3sYv0qAjW5VAVXhsRkyNNxJSQbWbaFo7qTUbXySnJP85x0kj tfpcerSqpdtp0iGudOExdP1MTsM11xHxl3znKwUWADQeJmQg80dYrJssr3ys7tUn4X0W6z46 a8QYFjvzj3AFP8B7EPRsR/0uruymnu77BRnMwmLLwfB9MpMGZOBwBID5kTggsx8mEPyPjO+b H/IH/r9koxbLZzJDtXjROiI3kPXORRF3bstx2DRkV6WMXEUV94T0CK+glQWbUKah684gotYB 6ViIspolWndgie32bgyytyvNDvfBKwtrnCmSd5avdz80p/K1hxzfCakLtLrdo50n7oQ7lJlR 1i7LWZlCpa/p9ALBMHCT09ZCu9ZPo9f9lJMdkHBFjL+HzUjwedxLRkoeVNfGprvoXDjL5jRz yIZB/4OduXbiGC2Bvce/e9aSEJ985/42lilPfxepJffgeaej41omVQkpfpUzx9hGDvNemDlq uSx8nh3tQPSi0ZTBDGRJGp+W0nX6g1lczJTTS3SQIq/9qjLVsOwoL4T0XALcgYg4+TsbRWNm JPKAbniwdHMozHoEoMNIhRyhq3KYHRtHovk8ZLmQTmpxzSxBkqEaMMa6KaEYwriqCaj/JDQS AAJr4cKEEOIAAEcIOcsAEk6Sro4iErJOEiISCHEZERlxKYSIi4wk3M0RgZCUcHP+LwbU9nWZ NcJ9gr5JJy3N2Yi83hcCzvxjBvwlQfn5B+2TIAYtGBhjQIzBLxa+DthfIoC0CCCzz4CORxjQ HMDsVY4woMZfdvCdBP+ki2CABDtwGAi0BwUDOD9FMwQNBuHoZxlKnPngfyl/ZpRRN5/yjDfv vTLujQn1Ee479V4EiTm5j+Bz/nl71Cw1+LLRbwB5GOdrsoeZ7i2+Z7ZOZ15NRUtfunb2iQ64 81al9UpaU7kbDlmpHs/Iqzk7fHAfv4SrvOzZykzBC33F8wRyzF8VI5V1MvQvmPEQzdY+IFoO kL6fZy+1Wa6qvt0aX0PaIfmcN95hz32FP/hTEgClTHLv15U86cUx152Cf9Y+r6IggE2Al5By ZBP9ZFgKX6BqPh2ZGo3Te91meRDqul1CZmnav5aduF5Ec+kh3j1nE0ewoaU28+Z2CFVf4+eN Lk+HlpICUs+zfO/OKrJ4w7uXyT7ci1WLX4bn4+EgTjexJ/1GwLVoUUM/UtdG8156yeWJNw2Y 636SeLzcUN7tjsvWwsUg01iQw1pkZ0TN+5Exk48OISh1a1oZPtMWo3X7gIlPz4xfwUcZnSUF s84UuUk7PDYXX6nraxXmuqnOurztrt0wr9pNnmRsVaoJduQ9wdBum7FwXdl/zgbQOx0zYuRe WrZM9k6h8cNsOOvUphWDX0siMmya3Ypn7412/dvqD3XKUDpNoxESnzTqqOW+6Y+8r5nkoe7G ouRX6T6p7imlJcK3ylvrZ+VMXgmKRx93SXMdc6W8/dKrqcHHZKc9OYD2nvBAUG7xgh1Bp4ZG mUDcexAcaR983wJDl2g8fIwGrBxoAJEjrYfEPvUz/7yBddhnUyLCdN7ES2vCLiAGWggGjXAG gO6/GgkPwYqBodABbXL/oE0TPz8Md2Kg6+nm6ewY7MquEhLs4RfoGRyO5XZAGpAAxOEISXFA FsPtCPi+KQ5gzX9vB/1X9F5U4lM78VI7XfC0tyjDVNv0TE+OMZdR5cA4vQE3+fJQ+ZBeZTDA TvkOf9Qsk0Yng0k1vSrbFuB9geM9H9n2PhGf/BMZNHs1sZ/tkTh3fMHahjuz8E7kXALL4pzB lZJOLtO+lC8ajwkH7asHa1ShpZ+v+Vxyf8b/StO0Jm5wll9TlO9WnKG5CckbiPC2V2oq4Bu/ bg0UfDnzNKt+niPrzNYwbJ2gyRRp0qCRWqSNc1zLjZJPwO161psneKjjpZ9jyym1qAnRRbFL 5mFfQbksRgTncCgAzaWm11yaLfdEzIqqWcNU4KH9eRPyZy+VOIIbWUhrdz7l1YEGOHXN9j7j dnexE3+n9wrMjJQD5IeMgwtAMH+O0PkvN5fEWDc5FIrBXxxAgUf4TRJoQNgWHACVfcDNqFQA lRJDTXYLfVLZgi9rlge2IzhFZJpp/eZqifNVx38cnmiK8ErakuPFZZV6QVYb+DBRV8DoQBR0 AC1Ao1itWCVO6e9viw/dgZgesVS+LwhmRwRBG8Co2xFBkPl/tsTY51A7uOvf3A5j5poiK6nb FqIuNb7QUBn6ciDcWB9UKxocYIMkgVUM3I282Cw6QlV6HunUbAl+ZMAOM8oZj1Cetmyptspl nmIBxd1qCVtLHnwvD1qevnuRCPdhivb0qinNuGFF+pu5FK/RmM63GWt4YucgC2mC3Jz+2x93 3oTliJJ+wp/2b6U3KLjgTRSY2Vwim+8u0mNMtuhkq0SbncyuNI3PiPjcDz9+Cq4gFEj8cNFf Ye8cEWyii8jxwuqzZrp3BsnRPZJC9lfa37VGEatGjpgGciwDfS1hrrY2IDoiarLhF9TZm8d+ c7OqFxGb+3wurt/YYr7AP8PnlqzeyMfw9pv0EU4CK6V5AhJ4oYxOvQqsSDb0KvED4ZbHavWz n99HNc5cvR4s2WzQE8BFxXuK+JjJ+YATmmrUrfX1NfruD4tU92LCOWIKaQC3eVUqe8aHhZwc g2oLQgstG9r9wiNjiBg9XkFtbocTixYr117nFPTJ+bWh+ILxKJdPcbTnoTv5zG7Xeikklpxy bPAtgV1rv6m1SuW3m4Twqfs6YfzwPFevW1sBSzyVC1hBpNr6YvMbjtnGmj7nhjAz3BEVUaNb GTVlYRX1xZdDGJ+nx8NCOMUQ1wl8i23O87QXr8T2cTx9x2rYm7usM/kJ5OqXSBz10PPhW9/F 8qwBuMAeWY+N7Zg+U8nYF7FCJVFzWu9e2JVdAI0fAaBxnb5LAVnq8MG323/OAlAJ/wgVIwDg ICAF/k5A/kgI4BjZkEEAkrIHoiG1b8IBrPmvJyxo8P9qBxirHWCMdmBirmL1SyAFs2jlmO9N NIW+xJ2121YcRapMgt4LJ4xuNuPJMEJ17kR3k7COS3vfpxojXpXpysGreSg7CqKGqz5JJA13 iT+TcZLbp7pQJ3/Bw354Is+0jki4u/r5DaGqCMLqZ5et+04y4i64nZpHmPBSic1VEBg9rldv shu7JwoJqfBYf4Rcl7Mtod3QvDMp43LL10Uy7FqxM7nIE+VLWzOv8UlHbcPLdATmSO8Ww0Lv ZiisbM8InaBg07fgL40InKSSa9KxH1taUks7+zyyLjKO6bli7Xm7+UTDWMa1EjHrN6nyIlXi Vj1Nil8RT+ohCrV11ekyZ4YLYoQ3DSzSOCR5umV9XaJN7+STVzJwxT7auAOJS/nksDpo0n4+ I761gyOYx4Ge/3Y/H78MT7bscanHp2vTq5i5ym+4vXdk85ri1ylwSJjmsXvCoatocq/RUokb sjoUYSM2yjXjb0durBlav4Uz1XoLjHZ42UFT38Y0Yq47J1tCvsCl00rfrH5a401nd2DEZOAc 90S7Zk7PShez5cuzKe/1dYDyigsT722KqnfGa9ymO7NQkUtPl3TndATKYfzXyqPcY94mOYU5 1InFPrPMt20P5ef/sITs5r8ofFFZ2rBz6px64j1CvZ6RMjWx4MxPvlth7FbCMLuTmbmKhuKx L2oS6F4XGmxcrmnVLPbJHp58mnD+UDuXMNq58Av5+yGev8xLGA4voAZDSViJcEz3a0hqOCr/ rav/I8pHM55AETkwPFXtN2pcg6nF8gfwIa5ECeDEgbhhD1ANi/WLdeN0/q8zH0zcYqIWE6yH SYkDIO6AQOzLnP0RmTMBjACDIzKn+vdk7k/uHwygirCDZ4eisgBUBoBKO5wkUQiAOgsofe8O DKIV/6s0y8XPOQjzZJ5Ix8BwZ/8gUY9gJKB8eAMwIMGKYGfB0cPBft0eeyDvsF+uOyjvhmOs oG+FZ9fD8rsoO8uvEjH3tbiy7EmzcEbRJ2PB7px5xJcpp5zTc1QvRw2Hk6R2ujqICitudQcO Ic9+vas0T9Qn365148q650vndk7Jsiw719jUqGRNI/MxkvTTw4y6zOvHVJNNBmt2vWcU8UUF 8t4qMJWNNLKEZshOL7j0qiuERXCtw6KupQafTdl4xAvWFOxKomi5egOXJG/J44uHaGaxoJKg t5WOMxuhp++J7Mtvzm50XFzXFHq9Iz/YJrniy1M1W823NDi+Tladw5+VrU+mQLxGkPiUrRtB P73aIzJgU9igI0t0n6jrfmXVbN3zlzQJxhpWMogAPsbo2g2+rdfCcuye2XXWiR6+fuVNwd3K uHjXQIL8imglmL4bcUe9/ubUxWhmP5oojfJTs8qCrle67Uyc4rpZnKWy4iZerG+t0Zbk8k39 XpY1uGznrDJjg58fr4gXijeEVxvCRn3X0bFx9dV9JujdCZUHZPzLr13F3md9LLG9PIbztESz zXo9q4xQV5siJ4ZtEEegpzavTEkjlFXy/nBpaVFEBOcX7Uy2im0trpjNwq127ybdrOl3IWGM 7xelc8Lpdfee1nN5hLyt/rKT/I44ZtFTvnoHWILqXZiYCEE6pykMFVgYGLbHWHKWhFEiOCJW VIhqlbav91+16yxJyLMMsDDQ1uhQ7c07ZUMUo+29G17U2YZEevWaBMFII4x+h6OhNQAaegsM AgGozH9buH59GvijNFKMuocln28gJoTASY7WXTCj+GERw8mAo14agOvHhVA4htquRHSUp6S/ xl1xsIq4A+mN5bPYfQa4HLmEBG4BmBULxvzqv1Owf3uTxu/bez3Y94jCS3hjuP8wss3C/f3c Ax39PcLZf9JmKBqE42T4u/du1sCTMlWvuwulJX1vWUVZntGoXU9zP+csejEuQAuKe1fskbr9 dVPz0RMDIR4uZpx3mC/Q8n+V0RfXGnJ6eOPLomWZ0Ae12QVFDaXHOu4OdqjtuGnDWgTOAkFy w7mTEYCBtrUZS9IkJ0qgSXqghYXPVM0x03Ht6nBw+LOdpjAFu+Rw3xuBjbw941131/1DfXeM QzjIJp7ml/FxhEg2MA/kxti8Wz93NWo8QPPadhiF2kvNDA4CjznU77PcK/6axYWhLRo9dHRC EU9Mt1yNyBZKN8cCOt6TAbbFKHkl9bZQ6NSlSxSWt+ILQc2fjR/hlXjNb8ryRZ7XC708f0GG /uNGCRrMj9mecP9YIzw4GkyDaaLch+aFfy0R/3Wd7Qgm7QD6o5Ak/lEvBGE6P/Tgwsmxx8hw OFwCkJCQgEuc+B9E6uOce+a8IXhv7fhvaksmc18mXcB8P6VMWKxILgyFUEaNNvOwg4UfNLgj MjwH0BGJTGwi1ZS8a9eZCG59aNZ51OqC2rRcg38tmkKEDNHyuF9prDXGsGSF6tpsEOhMu4/L VEb4oumHEufSQsPQdGlqS3tm/9Ho+bG9yUbP0pNVTplWJ6rwF/AZHu0E3X4alU/QkZfC23tF 7p2gu24ZOEy5brBTN86j7obiUwo/lStBXwI/gzaayAz77duuqdM63Jppsx6x89pux2eQrhSL eng3M7d5rHCFskRWVaUpNRtNKm8foubtVfqbKJ9B1KOG/vKJ7OXYvuZTUj7ZdDaXP9NHhTrm L4jirttKt2mm8fNZzXANz/X5Xn8aIzmuXHsFswD/AQfaLpQNCmVuZHN0cmVhbQ0KZW5kb2Jq DQo1NDM1IDAgb2JqDQo8PC9UeXBlL01ldGFkYXRhL1N1YnR5cGUvWE1ML0xlbmd0aCAyOTg5 Pj4NCnN0cmVhbQ0KPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6 TlRjemtjOWQiPz48eDp4bXBtZXRhIHhtbG5zOng9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRr PSIzLjEtNzAxIj4KPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5 LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4KPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIg IHhtbG5zOnBkZj0iaHR0cDovL25zLmFkb2JlLmNvbS9wZGYvMS4zLyI+CjxwZGY6UHJvZHVj ZXI+TWljcm9zb2Z0wq4gV29yZCAyMDE2PC9wZGY6UHJvZHVjZXI+PC9yZGY6RGVzY3JpcHRp b24+CjxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiICB4bWxuczpkYz0iaHR0cDovL3B1 cmwub3JnL2RjL2VsZW1lbnRzLzEuMS8iPgo8L3JkZjpEZXNjcmlwdGlvbj4KPHJkZjpEZXNj cmlwdGlvbiByZGY6YWJvdXQ9IiIgIHhtbG5zOnhtcD0iaHR0cDovL25zLmFkb2JlLmNvbS94 YXAvMS4wLyI+Cjx4bXA6Q3JlYXRvclRvb2w+TWljcm9zb2Z0wq4gV29yZCAyMDE2PC94bXA6 Q3JlYXRvclRvb2w+PHhtcDpDcmVhdGVEYXRlPjIwMjAtMDctMjFUMTQ6MjE6NDQtMDQ6MDA8 L3htcDpDcmVhdGVEYXRlPjx4bXA6TW9kaWZ5RGF0ZT4yMDIwLTA3LTIxVDE0OjIxOjQ0LTA0 OjAwPC94bXA6TW9kaWZ5RGF0ZT48L3JkZjpEZXNjcmlwdGlvbj4KPHJkZjpEZXNjcmlwdGlv biByZGY6YWJvdXQ9IiIgIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8x LjAvbW0vIj4KPHhtcE1NOkRvY3VtZW50SUQ+dXVpZDo5NjY3MEU2Ny03RUI2LTQ4N0ItQTY0 OC1DNkY0MENCQTMyOUY8L3htcE1NOkRvY3VtZW50SUQ+PHhtcE1NOkluc3RhbmNlSUQ+dXVp ZDo5NjY3MEU2Ny03RUI2LTQ4N0ItQTY0OC1DNkY0MENCQTMyOUY8L3htcE1NOkluc3RhbmNl SUQ+PC9yZGY6RGVzY3JpcHRpb24+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAo8L3JkZjpSREY+ PC94OnhtcG1ldGE+PD94cGFja2V0IGVuZD0idyI/Pg0KZW5kc3RyZWFtDQplbmRvYmoNCjU0 MzYgMCBvYmoNCjw8L0Rpc3BsYXlEb2NUaXRsZSB0cnVlPj4NCmVuZG9iag0KNTQzNyAwIG9i ag0KPDwvVHlwZS9YUmVmL1NpemUgNTQzNy9XWyAxIDQgMl0gL1Jvb3QgMSAwIFIvSW5mbyA1 NDAyIDAgUi9JRFs8NjcwRTY3OTZCNjdFN0I0OEE2NDhDNkY0MENCQTMyOUY+PDY3MEU2Nzk2 QjY3RTdCNDhBNjQ4QzZGNDBDQkEzMjlGPl0gL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGgg MTEwMjg+Pg0Kc3RyZWFtDQp4nDzbdbwV1cLHYX8cziE2CHYHgo0tWCgWthig2N0dYCuI3R3Y 3d3dHajYLXZgXLt9Z69n9nv/uM9nzpmZPWdm9vrOusOdbLLqP//9l+q/p5hssibXFzpdVujc Xuj6fmGLAdilsOWU+KOw1YL4oLD1+MI2hxa2tcF2vfBjYfuxuKSww1o4u7DjSYWdlizs3A/v FHb5pLDb0oXDZsKThdGjC2MG4X68XTh8JB4qjL2jcMRvhQunxsOFi24tXOwTLt4I/xQuWbVw KS47vPDAPYUHdy88tGXh4XGFp33sM+8VPnLOPnq2MPHRwsebFz5ZuPDpqMIfdxX+HIjh+KHw lyP723n556AmmWb7wrQ9cBZuL0y3EcpFzfSnF2acrLDwaoVFeqL8KVm0XLEsthz+LCxeDjcD Ny6sVf6GrH1cYejqhXV64dPCuk8V1rumsP4+hWF7F4bvWdhgQUwqbOjIRjjcEf8VNvI3bDJz Yc9yxbKXH+69Bcp5yT69US5j9u1eGDltYVS5KjmhD8ptmhPfLZw8XeHScvPlsgmF++8tPPBr 4YUbCi9uUxi/SeGlcwrvv1H4cKrCT+WC5+dbmnSavH+h106FvjMU+pUz0WlAOddtS5dT17bM VYXh5S5o26B8O9p2KVe6bddyn7WNObgwdrHCuSMK48oFaDvPBuf/W7iwnIm2izrh88IlKxTc u22XPV+4/MPClWsXrirXtu3qcve0PTZf4Ylykts+XKgw8cDCxy8XPrH5py8UPitf0bbPy3Vv ++L7wpflZmj7qpzrtq/LxWn7BpOuLnx7ReG7EwrfH1P4YY/C/3Yr/Dis8NOGhZ8HF35xen4t F7Xtt+ULvy9a+OOoJp17ldumc+9y4Tr3f7ywYLfC0M6FddYo7LVIYe/9C8eXG7PzCWMK15Yr 1vm6lwrPTCw8V65D588WKHxezlLnn8t41vmXMsi1N+4r9Cg3UXu/MnS1z1W+0+3LlhusfXC5 P9s3LlezfZMzC6PL9WsfU466/dwyJLSPK6Nw+53la9F+9/qFV48ovFbuwfZJ5cy3f1dOXUeX OQpdy8nq6Fb+vo7u5QbraJR7vqPHkELPMmJ2TF6+eB29ygnp6F0Glo4pyt/eMdUyhQXKt6Nj odkLC/sEg0fHIt8VFi1jXcdiDxYWL0HpGHBiYeAzheHlTHRsWO7Ijn1PLoz8qHBKuVE6TrPP 28qf2XH7lYUXypnvGO8Avy+3Tcf/yl3epWe5qF0m37Qwd9lZl3nLCNZlULnZuyzXpTDkgMIq 5R7ssu0phe0eqao32WRTDc54vISX8QpebH5Wt9aaE6rtdp2nLFU/DDqhDZ3RC+3oQBd0RTd0 RwM90BOTY2n0dhCvWpoCU2IqTI1pMC2mw/SYATNiJsyMWTAr+mE2zIHZ0Qd9MSfmx1yYF3Nj HsyHRdAfC2EBLIiFsSgWw+IYgIFYAktiKSyDQc7Za5aGYGUsi+UwGMtjBayIlbAK1sd6WBWr YXWsgTWxFtbGUKyDdTEMG2EEhmMDbIiNsQk29fe9bmkbbI3NsDm2wJbYCtva/A1LO2IHbIft sRN2w67YGbtgd+yLfbAH9sRe2Bsjffqblg7FIRiF/bA/DsCBOAgH4zCMxeEYjTE4AsfgaByJ o3AsTsQJOA7H4yRH/VZFW5fWzk7DyTgFp+IsnI4zcCbG4Wycg3NxIc7D+bgAl+IiXIxLcCUu w+W4AtfiKlyNa3AjrsP1uAG34ibcjFtwJ27D7bgD9+Iu3I178CDuw/14AI/iITyMR/AkHsPj eALP4ik8jWdQj+XP4Xm8gFcwHi/hZdRfrgmoh996RHkb9ReovpPfwvt4B+/iPUzEB/gQH+Ez fIxP8Cm+wuf4Al/iW3yNbzAJ/8N3+B4/4Bf8iJ/wM/7Ar/gNv+Mf/Im/8HchdRv/xX9+qJsR xehmdDO6GVGMYEYwI5gRxQhmBDOCGTWMYEZ90xtqGKWMUkYpo4ZRyihllDJqGKWMUkYpo39R ykhktDFqGMGMREZMI4qRyGhjtDH6F4mMmEYiI5jRxghmJDJqGKWMUkYpo4ZRyihllDL6F08X EcwMgv5FG6ON0caoaLQx2hhNjf5FKaON0cboX7Qx2hhtjJhGG6ON0cboX2Q3ShltjBpGG6Ob UdEIX5Qym0IUI5FpRrEay32Lo43RxghfNDXbQhQjfFHK6GYkMjIYUYxSRjcjfBHFiGJEMYoX 3YyKZiQUL2oYNYwaRjejhlHDqGhkMNoYNYwaRvEimNHGqGEULxIZjYs25iSoYSQyghkZjAxG BiODkcHIYGQwMhgZjAxGBiODkcHIYGQwMhgZjAxGBiODkcHIYGQwMhgZjAxGBiODkcHIYGQw MhgZjAxGBiODkcHIYGQwMhgZjAxGBiODkcHIYGQwMhgZjAxGBiODkcHIYGQwMhgZjAxGBiOD 9ZQmMhgZjAxGBiODkcHIYP2MGRmsZyH1g3XrCySD9QNdZDAyGBmMDEYGI4ORwchgZDAyGBmM DEYGI4ORwchgZDAyGBmMDEYGI4ORwchgmhmsnuQkKzKYn/ywOVM8cqUy46uW2tEJbeiMbuhA F3RFT3RHAz0wBSZHL/TGNJgSU2FqzIBpMR2mxyyYETNhZvTBrJgNs2NOzIG+6Id5MRfmxjxY APNhfvTHIlgQC2FhDMCiWAyLYykMxBJYEstiaSyDQVgBy2EwlscQrIiVsDJWxypYFathbayB NbEW1sNQrIN1sQHWxzAMx8bYECOwETZHs1xVnd6xtCk2w9bYAltiK2yPbbAttsPO2AE7Yifs jl2wK3bD3tgDe2IvjMI+2BcjcSD2w/44AIfiIByMQ3A4DsNojMFRGIsjcCSOxrFO3buWjsMp OB4n4QSciJNxKk7D6TgDZ+IsnI1zcC7G4TycjwtwIS7HRbgUF+MSXIYrcCWuwtW4xp/5nqVr cUc1Zp2/fGvMuh7X4UbcgJtxE27FLbgdt+FO3IW7cQ/uxX14vPnp+7Y+/QHcj4fwIB7Bw3gM j+IJPOnve9/SU3gaz+BZPIfn8QJexHi8hJfxBl7Ba5iAV/E63kQ94X8b7ziyDyzV91l9HerD rX/3KT7Ex/gIE/EJPsPn+AJf4jt8hUn4Gt/gW3yPumr/w4+oq/Yz/sQv+B2/4jf8gb8KZVZX Lf2N//AP/rWK6x6JjERGG6OU0caIaQQzShmJjP5FKaONEcyIaZSyTPyq6+DsRgYjmJHP6GZ0 M4IZpYwMRkwjkdHN6GbENEoZiYxgRiKjqdHNCGaUMjIYwYxERjejqRHMqGj0L4IZbYxuRjej qRHMqGhkMIIZ+YxuRjcjmFHK6F/ENLoZ3YxuRjcjmFHKyGDENBIZ3YxuRkyjlJHICGYkMpoa 3YxgRikjgxHMSGR0M5oawYyKRv/KVK9CPiOYEcwoZSQy8hn9i1JGNyOYEcwoZSQy+hcVjTZG MCOYUdFIZJncVfen73tUNDIYwYx8RjejmxHMKGVkMGIaiYxuRjcjplHKKGVUNEoZpYxSRkUj mGWOV3EsBDNKGYmMREY3o5TR1AhmBDOCGcGMYEYwyxyvOiFGvuhmdDO6Gd2MbkY3o5sRzChl lDLyGcGMtEY3o5vRzehmmepVCGa0MUoZbYxSRhujlGWqVx28QTyCGYmMYJYZX4VgRjAjmBHM CGYEM9oYpYw2RimjjVHKaGOUssz4KpSyzAYrJDISGYmMREYiI5GRyEhkJDISGYmMNkYUI4pR ymhjVDQSWf9v4mU2WJ0lVasfX+tHsfpRpS56vmw+LFxbPyy0BnHdbN0h9Ten3ll95pUy0hql jG5GIqON0cYIZiQyYlrmf+3dJ+vcPIj3WwchmPWksJ4GlklhtWbQnBReMHXZoFpqQye0owNd nIlPLXVFN3RHAz3QE5NjGvRCb0yBKTEVpsa0mA7TYwbM6Fg+szQXZsLMmAWzYjbMjj6YA33R D3NibiyBeTAv5sP86I8FsCAWwsJYBItiMSyOARiIJbEUlsYaWAaDsCyWw2AsjxWwIlbCyhiC VbAqVsPqWBNrOcmfW1obG2Ao1sG6WA/rYxiGY0OMwEbYGFthE2yKzbA5tsCW2Bo7Yxtsi+2w PXbAjtgJu2BX7IbdsQf29Ld/YWkv7I19sC8Oqb5At5/T+gKNwkjsj/1wIA7AwTgIh+Lo5s7G t3Y2GofhcIzBERiLo3AkjsGJ1c7uaG/t7DgcixNwPE7Cybgcp+M0nIpTcBnOx5k4A2fjLJyL c3AexuEiXIgLcCkuwcW4AlfiKlyNa3AtrnPhvrR0PW7AjbgJN+MW3IrbcDvuwJ24C3fjHtyL +3A/HsCDeMghfWXpYTyCR/EYHscTeBJP4Wk8g2fxHJ7HC3iped2Xal338XixkOmbv9u99btX UP8zka8tvYoJeB2v4U28gbfxFt7FO3gf7+FDfICJ+Aif4GPUQ3pdmfr7Vw9B9Rmsr+03qI/6 W0xCXcPv8D/8gJ9QZ/AX/Izf8Cv+wO/4C3/iH/yN//CvkyytcZKjqdHUaGqZPlZ0gcJGTCOt EdNIa8Q00hoVjbRGRaOpUdFoamQ3mhoxjbTmwubNcHl9M5SZYsUMbgZnN2IaaY2YRlojppHW iGmkNWIaaY1AR1ojplHY+NrHUBKFzXnNI3u7dWSSFQGL+malapU7e7VWEeFIckQ4khwVjaZG mbNkc/Mhrc0FOnIdgY5cR6Aj1/FAELmOwkZvI9BZvrnrg1u71umodnQ6qh19iD5EkjOqufmt rc2lNUIbuc7Q5ipftFZR7Wh4xDueGaLaZbpaoczR6ShzdDp6G/WNzGeT6oPumqX1QeIdKY94 R8qjeBHFqHb2aW4+rLW5CEeSo+jZvrnKca1VPAlE5iPsUfsIe2Q+WhxljrBnz+bOHm7tTObL /La6oY0MUftof9Q+2h+JjERGp3NMc5+/tPYp15Hy6G20OIqesdUGd8/f2kDYyzS3QtGj6FH0 KHqZvFZIeSQy8hmdzjnNXW/d2rUkR5Kj6Dm5uUrrcSTCXma7FcocZY6w58zmBi+2NtDwaH8E OiIcSY5AxyNAPCxEoCPQEegIdAQ6Al0mqBXKHGWOMkeZ82h1SPe0tQ5JoCPX0c2oaFQ7DzU3 aBUv4h0pj3hHyiPekfKId6Q84h0pj3hHyiPQEegIdAQ6Ah2BjkBHoCPQEegIdDQ1dZKlNbIb uS6T14qXodOR5AhtRDh6Gy2OQEeSW/e8CLeGdC2OQEeS83XzDO7VOoMCXaar1TdHWqPT0el6 6lXPBuvn5HqqUD/p1M9grc21uJ6nRoujzPWUtExQu/Qt08CKdnRG0Jyu3nN1Oc5qqQ2dMCV6 oAs60EBXdEN3TIHJ0RO90QtTYxpMi+kwPWbACMyJfpgJM2IWzIzZMCv6YHb0xRzYEAtjbsyF eTEP5sd8WAD9sRAWxAAsikWwOBbD8lgCA7EUlsQyWBrLYhAGYzmsgRWwElbEEKyMVbEKVsdq 2ABrYm2shXUxFOtgfayH4RiGPbEHtsBG2BibYFNsjs2wM7bE1tgK22EbbIsdsD12wo7YHbtg N+yKvbA39sG+GIlDMAoH4wDsh/1xEA7EWByKwzEGh2E0jsUROAZH40gchdNwHE7FKTgeJ+BE nISTcTrOxRk4B2fjTJyFcbgU5+ESXIzzcQEuxEW4DNficlyDq3EFrsRVuBXX4RbcjOtxA27E TbgN9+B23I27cAfuxL24D4/hfjyKR/AAHsRDeBgv4HE8j+fwBJ7EU3gaz+BZvIYX8SomYDxe wst4Ba/jDbyJt/A23sG7eA8/VaP+K9u1Rv0P8D5+xP/wIX5obnBua4Mv8Dk+wmfNVca3VvkY E/EpPsH3+A5f4ttq8wmdW5t/ja8wCc3eVvmst/sZvxTS7NiEpVub/4Zf8Qd+x1/4E//gb/yH f+1TIqOG0cbIZ8Q0ahhtTI/mQexRH0REMRIZwYxERhQjkRHFSGRmau7litZeRLj1KtOpi3xG 2COfEdPIZ8Q0EhkxjURGMCOREcxIZAQzEhnBjOxGhCOREcxIZAQzahHhi7RGPiOfkc/IZ+Qz 8hl5iQxGMCOmkdaIaeQz8hlNjWBGTKObEdPIZ+Qz8hlRjGBGRSOYEdMIZsQ0Mhj5jHxGN6PF kc/IZ3z7YyyIp5nIZ5k3Vhf1B0sqGhWNh5Moc1Q08hkxjXxGTKOiUdGoYXQzYhrdjKZGTKOi 0cboZjQ1WhxNjW5GTKOUkfkIbTQ1HgGiqVHYSGTENAob+YyYRj6jsFHRiHDUN7oZaY2YRmGj sFHDyGekNdIaMY3CRkwjwlHYyGfENPIZMY3sRnYjphHTKGzkM2IahY3CRjcjplHYyGfENPIZ MY0oRoSjvhHTKGzkM2IaNYzQRmijm9HiSGvkM2IaUYzeRm+jqZHkyGekNaIYhY3CRlMjwhHT KGwkMvIZMY3CRkwjwlHfCGYEM4IZwSzTwG596mf9KGVEMZIcLY58Rlojn2U2WG1eD4BKGRGO +kZTo7DR1ChsFC+aGoWNfEZho5uR1ghmRDGiGFGMKEZMyzSwQuOif5HIMt+s0MYyDayY5E+p W1UPJXUmpLxMCqtV6qA02z/h3bJU/bAr2tAJ7eiMLuhAL3RHN/RAA5OjJ6bFFOiNqTAlpsHU mAXTYzrMiBkwM2bCB3gfc6EPmlWrhtj6FPTFHJgT/bAA5sHcmA/zoj/mx+JYCAtiESyMxbAo lsFADMCSWAJLYymsiGUxCIOxHFbA8lgdK2MlrIIhWA2rYl2siTWwNtbCOhiKEVgf62E4hmFD bIAtsDE2wqbYBJtjM2yPrbAltsHW2A7bYjfsiB2wM3bCrtgF+2IP7I69sCf2wd44CKMwEvtj PxyIA3A4DsHBOAyHYgxG41gcgbE4CkfiGByNU3A8jsOJOAEn4yScjdNwKs7A6TgLZ+JCnItz cB7G4QKcjytwMS7CpbgEl+MyXI+rcCWuwdW4DtfiNtyIG3AzbsKtuAX34g7cjrtwJ+7B3XgE 9+M+PIgH8DAewtN4DI/iCTyOp/AkxuNZPIPnUVftRbyA1/Ey6nJNwCt4Da/iPbyJN/A23sK7 eAcf4iNMxMeF1KP31/gKn+ITfI7P8CW+sHk9stfDb92qb/AdvsUP+B6/4yf8iF/wM37Dr/gP f+IP/I2/8C/+cWRyVuZ4FWoYGYwMRgYjg5GzCGZEMTIYGYwMRgYjZxHMiGJkMDIYGYwMxlgX I2ZkMDJYpnNVx5yJqGHUMGoYNYyclVldxaxQwzLHq5DByGDkLLoZUYwMRgYjg5HByFkEM6IY GYwMRgYjg5GzCGZEMTIYGYwMRgYjZxHMiGJkMDIYGYwMRs4imBHFyGBkMDIYGYycRTAjipHB yGBkMDIYOYtgRhQjg5HByGBkMKoWwYwoRvEigxHFCF9EMcIXqYvwRepijIycRc4imBHFyGBk MDIYGYwROuIW4Yt8RvgiihG+iGLELcIX+YzwRRQjfBHFiFuEL/IZ4YsoRvgiihG3CF/kM8IX UYzwRRQjbhG+yGeEL6IY4YsoRtwifJHPCF9EMcIXUYy4RfginxG+iGKEL6IYcYvwRT4jfBHF CF9EMcIXqYvwlUla9UU38kX/opRRvOhfFC/6F8WL/kUpo3jRvzxYPfl/fX395B8ZjAxGBiOD Eb7IZ4QvohjhK1O2aWZo7Uw3o39Rw+hfnml+7IetNWUwEhn5jERGFOvJXd6ttvtmqtZ2ahil jIpGKaON9awu2hhtjDZGG6OG0dSoYZQyahiljIrGpCKmGJnYPKRVW4ckmJHPfN783cGt32lj mfFVZ6mujERGPlMnsvmm8JubW9spbFQ0Spnvmqt80lpFMOuJXwQzP1arTJqutYreRlPLvdTo O1mn5iprllUa3v81vP+bNLr1wzZ0ZLKunRdv/bAdndEFXf1hnSx1Q3c00AM9rVnvenL0Qm/M 1Py8nVqfNyWmwNSYCtNiGkyP6TAjZsDMmAWzYjb0a37eBa3P64PZ0RdzYE7M09zg1dYGc2Mu zIv+1Srt3VurzI/5sAAWbq6yQmuVhbAgFsGiWAyLY4AzWF+AgVgCS2IpvISVsCKWwdJYFoMw GMthBSyP8VgLQ7AyVsUqWB2rYU2sgQ0xFGtjPayDdTEM62MDDMeW2AgjsAk2xmbYFFtgc+yE rbEVtsU22B7bYUfsgL2xC3bGbtgVe2B37IU9cRD2xT4YhZHYH/vhQByAI3AIDsZhOBRjMBpj cThOxFE4EsfgaByHY3ECjsdZOBkn4VScgtNxGs7EGbgI5+BsjMO5OB/n4UJcgGtwCS7G5bgU l+FKXIGrcRVuw3W4FjfietyAm3ETbsUtuB934HbchTtxD+7GfbgXT+BBPICH8RAexSN4HI/h RTyFJ/EMnsZzeBYv4PlCDB6pR+HX8TJewQS8hmYwq0GnHvw/wJt4A2/jLbyLd/A+3sMX+Agf 4mNMxKf4BJ/jM/yAr/AlvsHX+BaT8D2+wx/4Ef/Dz6jb+Ct+we/4zTmrG/cX/sQ/+Bv/4V8b SGuM83EGy3yzok+zAQfUDSiTyYbXhw1vAxveDTa8PmyUd4pd229obSCtEdrIZ8Q0uhndjG5G N6ON0cbIZ/PfLndt/7i1axWNwkYNI5hlalkxa7VBx/StDaQ1QhvBjHyWSWjDC8OGF4YNLwwb XhhWLNTc2dDWzpSyzDCru64+Wf0hplHKiGmZWja8aGx4RVgxoLnPsa19ymfENLoZ3YxuZkhz g7taG0hkxDQSGfmMREY+I5GRzwht5DMSGRGOREYwI5ERzEhkBDO6EuGL8EUwI8IRzIhpVDTy GfmMfEbxIoMRzGhxBDNiGsGMmEYwI6aRwQhmRDiCGTGNYEZMI5hlStqzfxn1K4z6Eb4IZpm8 Vle6vvV1M5oa3YymRn2jqdG/6GY0NboZTY1uRlOjvtHU6F90M5oa3YymRjejqVHfaGr0L7oZ TY1uRlOjm9HUqG80NfWZ0M1oanQzmhrdjKZGfaOp0b/oZjQ1uhlNjW5GU6O+0dSIaXQzmhox jYpGRaOiUdGoaNQwKhoVjW5GRaObkdboZjQ1ahjdjCRHN6Op0c1oanQzmho1jG5Gi6Ob0dTo ZjQ1uhlNjRpGN6PF0c1oanQzmpq6m5oawYxH4mhx5DMeuiOfEdOoaJl2NrwGbHh92PBqseG1 Y8OrxYaXiQ0vExteJja8TGx4fdjw2rHh1WLDy8SGl4kNLxMbXiY2vExseJnY8FKw4WViw8vE hpeJDS8TG14mNrxMbHh92PASsvr61gGTzzK1rH5Yj5g/NcfPr8tS9cNOCDqjDZOjCzrQDV3R QHf0RA9Mh97ohSkxBabGVJgW02B2zIDpMRNmxCyYGbNhVsyLOdAH/dAXc2FOzIO5sSjmx3xY AP2xEBbEIlgYy2BxLIaBGIAlsQSWxlJYGctiEAZjOayA5bESVsTaWAVDsBpWxRpYHWthTWyI dTAU62FdDMP62ADDsSU2wghsgo2xGTbFFtgcO2FrbIVtsQ3qVm2HHbED9sYu2Bm7YVfsgd2x F/bEQdgX+2AURmJ/7IcDcQCOwCE4GIfhUIzBaIzF4TgRR+FIHIOjcRyOxQk4HmfhZJyEU3EK TsdpOBNn4Hpch0swDs2AVe2vv/bn4zxciAtwMS7CtbgMl+IKXI6rcCWuwdW4ATfiJtxdjWCz jWuNYLfgZtyGW3EHbsdduBP34F7ch/vxWPMTXmx9woN4AA/jITyKR/A4nsAr1V5mT2svT+FJ PIOn8RyexQt4HuPxIl7GS5iAeuJXD82v4e3mpw9offobeB1v4U28g3cLzX+W2XX2nVvbfYOv 8R6+aq5yYWuVjzER7+Oj5iqvtlb5EB/gS3yBT/B5tUGfbq0NPsOn+BaT8D3q1P2Hf/ED/mnu bHBrZ7/iF9Q1/Lm5yqjWKj/hR/yNv/Ab/mxucH1rgz/wu3MmnxHTyGfEtEwmK+QzBvGIYkQx vlUR2ohpXM2IaYQ2khyhjRREIiOtkdZIa6Q10hppjZhGoCORkdZIa6Q10hppjbRGTCPQkchI a6Q10hppjbRGWiOmEehIZKQ10hppjbRGWiOtEdMIdCQy0hppjbRGWiOtkdaIaQQ6Bp0YkCKR kdYyYay+VfXlUNgobDQ1Oh1Njd5GKaOwUdgobBQ2mhqdjqZGb6OUUdgobBQ2ChtNjU5HU6O3 UcoobBQ2ChuFjaZGp6Op0dsoZT0bjMJGYaOw0dTodDQ1ehuljMJGYaOwUdhoanQ6mhq9jVJG YaOwUdgobDQ1Oh1Njd5GKaOwUdgobBQ2mhqdjqZGb6OUUdgobBQ2ChtNjU5HU6O3UcoobBQ2 ChuFLZPJCp0uk8IKU+6oYaQ10hoVjbRGaKPMEdpIa6Q1Yhr5jJjm3ubQNbEeuiKRkcgIdG6p VpljmtYqngTiSSDqGy2O0EaLo7BR2ChsFDYKW6aIFQobhY2YRlrzSPPT12x9usJGYaOwZW5Y 8WRzzdGtNYU2shuFLVPE6ntbj5hCmzeb293e2k43y8SvQnbzcnOVL1qrqG+UOeobZY76Rpmj t2XeWCG0EdoIbZk3VghtmTf2GljPESJ1kbrIZ4Q2uhndjMKWOWWFbpY5ZbWzepATxUhrmVNW fAXZjaJH0SOtZRZZ7aUul4pGaCOKZRZZrVKfnuYssq//V3T1w04IeqAdndEFHeiGrmigO6bB 5OiJ3uiFKTEFpsZUmBXTYVrMgOkxE2bELJgZc2N2zIY50Af90BdzYU4sjHkxD+bHfFgA/bEQ FsRSWBSLYHEshoEYgCWxBAZhWaxRXaNlvmpdo9WxGpbDqtUqg/7/Mi6PwVgRK2BlrIRVMATr NfcyrLWXtbAmhmJtrIt1sD6GYTg2wIbYsrnrY1q73ggjsAk2xmbYFFtgc2yFrbENtsV22B67 Ywfshp2wI3bFztgFe+AA7In9sTf2wn7YB/tiJEZhDA7EaByMg3AYDsGhOBxjcQSOxFE4CUfj RByLY3ACjsPxOBnn4RSMw2n4v5ruO/7aen7geC9EdWckpIzICtmR8euOjB8RSalbkyhC2aOM FCpFadPee+89tYf20NSWUtrbOdfznL+ej/t7X5/rnMd1rnO9zvt7vo9ztsQO2ApbYxtsi+2w PfbAjtgdO2Mn7IZdsCv2xKHYC4dgH+yNg7Ev9sP+OAAH4iAchsNxBI7EUThxfGKeMj0xj8HR OA7H4gQcj5Nw5nj5w9Plp+BknIZTcQZOx1n4G87GpHiT6+65OA/n4wJcONDkdLsKV+JiXIS/ 4xJchktxBS63s8kpfBOuwdW4Dtfiekz6dyNuwN24BTfjNkwadyvuwO24C3fiv7gH/8K9mDTu P7gPk6rdjyfxEB7EI3gYj+FRPIHHHYlJ6p7GU3gWz9hEIvO4D5PiCPlM6pLI5DOJTD6TyOQz D3jymdQlkclnEpl8JpHJZ0KbfCZ1SWTymUQmn0lk8pnQJp9JXRKZfCaRyWcSmXwmtMlnUpdE Jp9JZPKZRCafCW3yOYxzIyQy+Uwpk88EM8FMMIfZcITsJmfJZ2KaKCaYaWPamDamjWljijcM hSOUMvVNfdPGYUQcoY3pZuKWUqaUKeUwWo5QynQzpUw3k7pEMcFMFBPMRDHBHMbAEYKZqiWR CWYSmWCmjQlm2pg2pmpJZNqYpiamaWOCmTamjSlC+pDUJYrpZpqaNg5D4ejKN3nmKF6imGCm lElk0pqmppTpZmqYUqabiWKCmSgmmCllEpm4pZQJbaKYYCaKCWaimESmm2lqQtuBo0wsvsgk E6lhSpluJpgJZruNF6w+XaCU6WbClwwmn+0zXrDddIFgJqZpY0qZNnb4eMGF0wV6m8Kmm0ly ujlMnzNnmy7QxrQxTe2Y8SaLTjdR0YQ2+RzmxhHymVIOc+PMtafrBDMx7Zzx/+0y/T8VHYbJ 0fkyuTiK6TA+jhDTpDUVTUVT0VS0SUXHv2Gdedn0FuQz+Uw+k8/kM/lMPpvkU4QT4eQz+Uw+ JwNj8plgDkPhPDMnY0QymAwmn0nyZERMWtPUxDQxHYbQ0c4mV1pRTD5T5smImLQmn0lr8jkM jKO9TAImn8P4OPphGP92eYnnD8ds9K/n4jmYHc/DizEHXoC5MCfmxgy8CC/EKzEPXoJ58VK8 HC/DfHgFXo8FMD9ejVfhtXgNXocF8Ta8AQvhTXgj3oI3461YeGBIz4iP+OH78U68wyk8OTzv xrvwXrwHi+J9mInF8AF8CB/E5PY+jMXhvgzvG474KJbAkvgYPoGP41P4JJbBZ/BpfBZLYWl8 Dl/A5zELy+KLWA5fwpexPFbECvgaVsJXsApWxmpYFV/F6vg2vo41sCa+gW9iLayNb+FH+C6+ g3WxDr6P7+GH+AF+iZ/gx/gZfor18HP8Auvj9/g1foXfYANshA3xO/wWW2ATbIw/YFNsjs3w J/wRO+DP2BJbYytsi22wPbbD7vgr/oKdsCN2wc7YDbviAOyJPbA39sK+2Af7Yz8ciYNwIA7B wTgMh+IIHI6TcDSOwrE4BsfjOJyIE/A3nIKTcRpOxRk4HWfhTFyMc3A2zsO5uADn4yJciKvx d1yCy3AprsDluApX4mZci2vwD1yHG3A9bsKkanfjn7gFt+FW3IFJue7CnZg05x78C/fi35i0 6j48gPvxJB7Cg3gED+MxPIon8PhAk4A9jafwLJ6xiRomg8lgMpiADWPgCFFMBpPBZDAZTAaT wQQsfUgUk8FkMBlMBpPBZDABSz4TxWQwGUwGk8FkMBlsEjD5TBSTwWQwGUwGk8FkMOVKPhPF YQwc8XbI4DAGjtC/9C/lSvFSw+QzNUz/0r/0L/1L8YZRb1TYycGSusa/TF1htckLl9QwjUsU h79MXWHr6SbamDamjWljMpgMJoMJXzLYMuOdnTfdmRqmhulfapj+tfJ4wdPTBVKX1KWUzRpt suJ7ppsIZoKZYCaYaWNq2BrjdWtN14ligpm0JphJZKKYRI4/zXWOFXecLlfDNC7BHH9K6hwr XjLdRDeH0XL0OEzOXRFOWhPTxDQxTUwT08S0DUa7njX7dNeCmZgmmIlpgpmYJruJafKZfCaf CWbymWAmn8lurnUJX2KamCamiWlimpgmpolpYpqraTKYfCatyWfSmnwmrYlw0poMJp9Ja/KZ tCafSWsinLQmg8ln0pp8Jq3JZ9KaCCetyWDymbQmn0lr8pm0JsJJazKYfCatyWfSmnwmrYlw 0poMJp9Ja/KZtCafSWsinLQmg8ln0pp8Jq3JZ9KaCCetyWDymbQmn0lr8pm0JsLDiDjvEsPL +hGTS54MJp/DiDh6rkwu6SqawqbFKWyamqamhpP5L4VNRVPYtDiFTVOH2XB0XyYdU9EUNhWd TIOT+W+YKeddYvo0HL99OMun1Y5+OBeei+dgdjwPL8DzMSfmwLyYGzPwIrwQL8GL8VLMg1fj 5XgZ5sMrMD9eiVdhAbwJr8Vr8DosiIXwerwRb8C78Ba8GW/DwngrFsHb8U68A+/F+7Dk6Ohu vP/06H4EH8ai+NB4kxumm3wA78cHsRgWx/9hCczEx/BRfByfwPitxU3mnd7Cp/BJfBqfwVJY frzg/6cLPofPYjl8CUtj2fGC9acLvoDP44tYBl/27JicKCvgK+Plh0+Xz8KKWAkrYxV8fbzg 9umC1bAqvorVsQa+hm9gTayFb+JbOBk/xA/wbayN7+I7WBfr4Pv4Hk7CL/Bj/Ag/xU/wc/wM 62M9/A6/wi+xAX6NDfEb/BYb4U/YGL/HptgEm+EP+CM2x/bYEltgK/wZ22BrbIdtsRv+gh2w I/6KnbETdsUu2B97YHfshT2xD/bGftgXR+BAHICDcRAOxSE4HIfhRByFI3EMjsZxOBYn4Hic glMx/quWTeefnrSn4zTPh8m17hycjTMw/kObTZeerjsLZ+I8nItLcDHOx0Xj5RtNl1+IC3Ap LsPluAJXYlK8q3ENrsV1+Aeuxw24ETfhZvxnfF+On96Xf+IWh2By1b8Nt+IO3I67cCcm4bsb /8Y9uA/34n484IaUJA9qkwf1ITyI/+JJPIKH8RgexRN43M4mwXwaT+FZPGOT4BAkn0lrspu0 JrtJa7KbfCatyXXSmuwmrcnu9LNvhHb6SahOt1yFmxwQD0DyOf3mDaFNaBPapDW5TnYT2oQ2 oU1oE9qENvlMaBPapDWhTVpT38Q0oU1oh3lzhGonu3lhlsKmogltKprCDvPmCIVNPpPWdDpp TXaT1mQ33UxohwlzhKYmu8NkOkJv078UNr1NWpPWdDNNTT6TyGHCHCGmiXAiPIyPI5aHDKai qWgqOgyhI1Q0TU0UE8zENMFMTIdhcoSYJnzJZ2I6/WILMU0wE8zENIlMPqff3yifCW3ymfAl mAlmgplgJpgJZsKX0CafCWaCmWAmmAlfEpl8JrTJZ4KZYCZ8SWTymUQmnwlt8jn9OkaJTD6T yOQziUw+k8EkMtlNIpPPJDL5TAYTzAQziUx2k8jkMxlMMBPMBDPBTCKnH6QjnwlmgplgJpgJ 5vT7G3Ul6Uk+E8xhRBxdficXJN1MN9PNdDPhy0uxvIhKRdPU5HOYFEfIYNqYNqaiw9w4QiJT 2C4ch+je4T2wbZYb2Hahge3WHdh+zYEdnh4z52YLDmz+8MAW6wxsedWYuWZtOLDSfAOrLDOw 6sYD6906sP4CWAxXDOw34YGBh2cMPLLKwKMPjZmx18IDe280sM9xA/veOXDqsHzGaQ2cvsjA 9e/GsgM3DLc348Ylx8w985GBpR6bbbb/AfDeyQUNCmVuZHN0cmVhbQ0KZW5kb2JqDQp4cmVm DQowIDU0MzgNCjAwMDAwMDAyNTggNjU1MzUgZg0KMDAwMDAwMDAxNyAwMDAwMCBuDQowMDAw MDAwMTcxIDAwMDAwIG4NCjAwMDAwMDA2NzQgMDAwMDAgbg0KMDAwMDAwMTAyOSAwMDAwMCBu DQowMDAwMDAyMjY5IDAwMDAwIG4NCjAwMDAwMjQxMTcgMDAwMDAgbg0KMDAwMDAyNDE3MCAw MDAwMCBuDQowMDAwMDI0MzM4IDAwMDAwIG4NCjAwMDAwMjQ1NjkgMDAwMDAgbg0KMDAwMDAy NDYyMiAwMDAwMCBuDQowMDAwMDI0Nzk4IDAwMDAwIG4NCjAwMDAwMjUwMzggMDAwMDAgbg0K MDAwMDAyNTIxMyAwMDAwMCBuDQowMDAwMDI1NDUwIDAwMDAwIG4NCjAwMDAwMjU2MTUgMDAw MDAgbg0KMDAwMDAyNTg0MiAwMDAwMCBuDQowMDAwMDI1OTg2IDAwMDAwIG4NCjAwMDAwMjYw MTYgMDAwMDAgbg0KMDAwMDAyNjE4OCAwMDAwMCBuDQowMDAwMDI2MjYyIDAwMDAwIG4NCjAw MDAwMjY1MDkgMDAwMDAgbg0KMDAwMDAyNjY4MCAwMDAwMCBuDQowMDAwMDI2OTE2IDAwMDAw IG4NCjAwMDAwMjcwOTggMDAwMDAgbg0KMDAwMDAyNzM2MyAwMDAwMCBuDQowMDAwMDI3NzA2 IDAwMDAwIG4NCjAwMDAwMzIyODMgMDAwMDAgbg0KMDAwMDAzMjQ1MyAwMDAwMCBuDQowMDAw MDMyNjM5IDAwMDAwIG4NCjAwMDAwMzI4MjggMDAwMDAgbg0KMDAwMDAzMjk1NSAwMDAwMCBu DQowMDAwMDMyOTg1IDAwMDAwIG4NCjAwMDAwMzMxNDAgMDAwMDAgbg0KMDAwMDAzMzIxNCAw MDAwMCBuDQowMDAwMDMzNDYwIDAwMDAwIG4NCjAwMDAwMzM3ODMgMDAwMDAgbg0KMDAwMDA0 MDIxMiAwMDAwMCBuDQowMDAwMDQwMzgzIDAwMDAwIG4NCjAwMDAwNDA2MjUgMDAwMDAgbg0K MDAwMDA0MDc2MiAwMDAwMCBuDQowMDAwMDQwNzkyIDAwMDAwIG4NCjAwMDAwNDA5NTcgMDAw MDAgbg0KMDAwMDA0MTAzMSAwMDAwMCBuDQowMDAwMDQxMjg3IDAwMDAwIG4NCjAwMDAwNDE2 MDEgMDAwMDAgbg0KMDAwMDA0ODMxMiAwMDAwMCBuDQowMDAwMDQ4NDkzIDAwMDAwIG4NCjAw MDAwNDg3MzUgMDAwMDAgbg0KMDAwMDA0OTA0OSAwMDAwMCBuDQowMDAwMDUxMDYwIDAwMDAw IG4NCjAwMDAwNTE0MjAgMDAwMDAgbg0KMDAwMDA1NzM2MiAwMDAwMCBuDQowMDAwMDU3NTQ1 IDAwMDAwIG4NCjAwMDAwNTc3OTMgMDAwMDAgbg0KMDAwMDA1Nzk0OSAwMDAwMCBuDQowMDAw MDU4MTYwIDAwMDAwIG4NCjAwMDAwNTg0ODUgMDAwMDAgbg0KMDAwMDA2MzkyNiAwMDAwMCBu DQowMDAwMDY0MDU0IDAwMDAwIG4NCjAwMDAwNjQwODQgMDAwMDAgbg0KMDAwMDA2NDI0MCAw MDAwMCBuDQowMDAwMDY0MzE0IDAwMDAwIG4NCjAwMDAwNjQ1NDggMDAwMDAgbg0KMDAwMDA2 NDg5MCAwMDAwMCBuDQowMDAwMDcxMDEzIDAwMDAwIG4NCjAwMDAwNzExODAgMDAwMDAgbg0K MDAwMDA3MTMxNyAwMDAwMCBuDQowMDAwMDcxMzQ3IDAwMDAwIG4NCjAwMDAwNzE1MTIgMDAw MDAgbg0KMDAwMDA3MTU4NiAwMDAwMCBuDQowMDAwMDcxODI2IDAwMDAwIG4NCjAwMDAwNzIx OTIgMDAwMDAgbg0KMDAwMDA3Nzg5NiAwMDAwMCBuDQowMDAwMDc4MDkzIDAwMDAwIG4NCjAw MDAwNzgyNjQgMDAwMDAgbg0KMDAwMDA3ODQ0MiAwMDAwMCBuDQowMDAwMDc4NjU0IDAwMDAw IG4NCjAwMDAwNzg4NDIgMDAwMDAgbg0KMDAwMDA3OTA0MSAwMDAwMCBuDQowMDAwMDc5NDQ5 IDAwMDAwIG4NCjAwMDAwODUxOTMgMDAwMDAgbg0KMDAwMDA4NTM4NSAwMDAwMCBuDQowMDAw MDg1NTc3IDAwMDAwIG4NCjAwMDAwODU3NzUgMDAwMDAgbg0KMDAwMDA4NTk4OCAwMDAwMCBu DQowMDAwMDg2MjE0IDAwMDAwIG4NCjAwMDAwODY0NDAgMDAwMDAgbg0KMDAwMDA4NjY0MiAw MDAwMCBuDQowMDAwMDg2ODk3IDAwMDAwIG4NCjAwMDAwODcxNTEgMDAwMDAgbg0KMDAwMDA4 NzM0MiAwMDAwMCBuDQowMDAwMDg3NTMyIDAwMDAwIG4NCjAwMDAwODc2OTggMDAwMDAgbg0K MDAwMDA4Nzg5NiAwMDAwMCBuDQowMDAwMDg4MDYzIDAwMDAwIG4NCjAwMDAwODgyNDMgMDAw MDAgbg0KMDAwMDA4ODYwNCAwMDAwMCBuDQowMDAwMDk0MTk5IDAwMDAwIG4NCjAwMDAwOTQz ODcgMDAwMDAgbg0KMDAwMDA5NDU1OCAwMDAwMCBuDQowMDAwMDk0NzA0IDAwMDAwIG4NCjAw MDAwOTQ3MzYgMDAwMDAgbg0KMDAwMDA5NDkxMSAwMDAwMCBuDQowMDAwMDk0OTg2IDAwMDAw IG4NCjAwMDAwOTUyNTQgMDAwMDAgbg0KMDAwMDA5NTU4MyAwMDAwMCBuDQowMDAwMTAxMTUz IDAwMDAwIG4NCjAwMDAxMDEzNDIgMDAwMDAgbg0KMDAwMDEwMTU5NSAwMDAwMCBuDQowMDAw MTAxOTExIDAwMDAwIG4NCjAwMDAxMDY5MDIgMDAwMDAgbg0KMDAwMDEwNzIxOCAwMDAwMCBu DQowMDAwMTEzNTkzIDAwMDAwIG4NCjAwMDAxMTM5MTAgMDAwMDAgbg0KMDAwMDExNzkzMiAw MDAwMCBuDQowMDAwMTE4MTE0IDAwMDAwIG4NCjAwMDAxMTgzNjIgMDAwMDAgbg0KMDAwMDEx ODY3OSAwMDAwMCBuDQowMDAwMTIyMzI2IDAwMDAwIG4NCjAwMDAxMjI2NDMgMDAwMDAgbg0K MDAwMDEyNzg2MCAwMDAwMCBuDQowMDAwMTI4MTc2IDAwMDAwIG4NCjAwMDAxMzQ3MDAgMDAw MDAgbg0KMDAwMDEzNTAxNiAwMDAwMCBuDQowMDAwMTQwMDU3IDAwMDAwIG4NCjAwMDAxNDA0 MDIgMDAwMDAgbg0KMDAwMDE0NDgyNCAwMDAwMCBuDQowMDAwMjExNTI5IDAwMDAwIG4NCjAw MDAyMTE4NzggMDAwMDAgbg0KMDAwMDIxODE2MCAwMDAwMCBuDQowMDAwMjE4NDk4IDAwMDAw IG4NCjAwMDAyMjM4MDIgMDAwMDAgbg0KMDAwMDIyNDEyOSAwMDAwMCBuDQowMDAwMjI5NDk5 IDAwMDAwIG4NCjAwMDAyMjk5MzkgMDAwMDAgbg0KMDAwMDIzNTYwNyAwMDAwMCBuDQowMDAw MjM1OTEzIDAwMDAwIG4NCjAwMDAyMzYxNjIgMDAwMDAgbg0KMDAwMDIzNjU0MiAwMDAwMCBu DQowMDAwMjM2ODE2IDAwMDAwIG4NCjAwMDAyMzcwNTggMDAwMDAgbg0KMDAwMDIzNzI4NiAw MDAwMCBuDQowMDAwMjM3NjMzIDAwMDAwIG4NCjAwMDAyMzc4OTUgMDAwMDAgbg0KMDAwMDIz ODI4MyAwMDAwMCBuDQowMDAwMjM4NTU5IDAwMDAwIG4NCjAwMDAyMzg5MjUgMDAwMDAgbg0K MDAwMDIzOTE5MyAwMDAwMCBuDQowMDAwMjM5NTA5IDAwMDAwIG4NCjAwMDAyNDYzMTQgMDAw MDAgbg0KMDAwMDI0Njg3OCAwMDAwMCBuDQowMDAwMjUzNzQzIDAwMDAwIG4NCjAwMDAyNTQz MjkgMDAwMDAgbg0KMDAwMDI1NDY3MiAwMDAwMCBuDQowMDAwMjU0OTQzIDAwMDAwIG4NCjAw MDAyNTUxODAgMDAwMDAgbg0KMDAwMDI1NTQ1MCAwMDAwMCBuDQowMDAwMjU1Njg2IDAwMDAw IG4NCjAwMDAyNTU5ODMgMDAwMDAgbg0KMDAwMDI1NjIyOCAwMDAwMCBuDQowMDAwMjU2NDc1 IDAwMDAwIG4NCjAwMDAyNTY3MDMgMDAwMDAgbg0KMDAwMDI1Njk1OSAwMDAwMCBuDQowMDAw MjU3MTkxIDAwMDAwIG4NCjAwMDAyNTc0NDQgMDAwMDAgbg0KMDAwMDI1NzY3NSAwMDAwMCBu DQowMDAwMjU3OTI3IDAwMDAwIG4NCjAwMDAyNTgxNTggMDAwMDAgbg0KMDAwMDI1ODQxMiAw MDAwMCBuDQowMDAwMjU4NjQzIDAwMDAwIG4NCjAwMDAyNTg5MDIgMDAwMDAgbg0KMDAwMDI1 OTEzNSAwMDAwMCBuDQowMDAwMjU5Mzg2IDAwMDAwIG4NCjAwMDAyNTk2MTcgMDAwMDAgbg0K MDAwMDI1OTkwNCAwMDAwMCBuDQowMDAwMjYwMTQ2IDAwMDAwIG4NCjAwMDAyNjA0ODUgMDAw MDAgbg0KMDAwMDI2NjAxMiAwMDAwMCBuDQowMDAwMjY2MzM4IDAwMDAwIG4NCjAwMDAyNzM2 MDMgMDAwMDAgbg0KMDAwMDI3MzkyOSAwMDAwMCBuDQowMDAwMjgyMTE2IDAwMDAwIG4NCjAw MDAyODI0NDIgMDAwMDAgbg0KMDAwMDI5MDg2NSAwMDAwMCBuDQowMDAwMjkxMTkxIDAwMDAw IG4NCjAwMDAyOTc1MTggMDAwMDAgbg0KMDAwMDI5Nzg1NiAwMDAwMCBuDQowMDAwMzA1NTIy IDAwMDAwIG4NCjAwMDAzMDU4NzEgMDAwMDAgbg0KMDAwMDMxMzU2OSAwMDAwMCBuDQowMDAw MzEzOTA3IDAwMDAwIG4NCjAwMDAzMjA4MTMgMDAwMDAgbg0KMDAwMDMyMTExOCAwMDAwMCBu DQowMDAwMzI0NzY4IDAwMDAwIG4NCjAwMDAzMjUxMDYgMDAwMDAgbg0KMDAwMDMzMDY4MiAw MDAwMCBuDQowMDAwMzMwOTk4IDAwMDAwIG4NCjAwMDAzMzcxMjMgMDAwMDAgbg0KMDAwMDMz NzQ2MiAwMDAwMCBuDQowMDAwMzQzNDgxIDAwMDAwIG4NCjAwMDAzNDM4MzAgMDAwMDAgbg0K MDAwMDM1MDU1MSAwMDAwMCBuDQowMDAwMzUwODY4IDAwMDAwIG4NCjAwMDAzNjAyMDggMDAw MDAgbg0KMDAwMDM2MDU0NiAwMDAwMCBuDQowMDAwMzY2NzA5IDAwMDAwIG4NCjAwMDAzNjcw NjkgMDAwMDAgbg0KMDAwMDM3NDI3MSAwMDAwMCBuDQowMDAwMzc0NjEwIDAwMDAwIG4NCjAw MDAzODE4MjcgMDAwMDAgbg0KMDAwMDM4MjE2NiAwMDAwMCBuDQowMDAwMzg4Mjk0IDAwMDAw IG4NCjAwMDAzODg3MTggMDAwMDAgbg0KMDAwMDM5NTA0MiAwMDAwMCBuDQowMDAwMzk1MzI3 IDAwMDAwIG4NCjAwMDAzOTU1NjkgMDAwMDAgbg0KMDAwMDM5NTgyNCAwMDAwMCBuDQowMDAw Mzk2MDU1IDAwMDAwIG4NCjAwMDAzOTYzNTcgMDAwMDAgbg0KMDAwMDM5NjYwNCAwMDAwMCBu DQowMDAwMzk2ODg4IDAwMDAwIG4NCjAwMDAzOTcxMzAgMDAwMDAgbg0KMDAwMDM5NzQzNCAw MDAwMCBuDQowMDAwMzk3NjgyIDAwMDAwIG4NCjAwMDAzOTgxMzkgMDAwMDAgbg0KMDAwMDQw NDk0NiAwMDAwMCBuDQowMDAwNDA1MjgwIDAwMDAwIG4NCjAwMDA0MDU1MzggMDAwMDAgbg0K MDAwMDQwNTc3MyAwMDAwMCBuDQowMDAwNDA1OTk4IDAwMDAwIG4NCjAwMDA0MDYyMzYgMDAw MDAgbg0KMDAwMDQwNjQ2MSAwMDAwMCBuDQowMDAwNDA2Njk5IDAwMDAwIG4NCjAwMDA0MDY5 MjQgMDAwMDAgbg0KMDAwMDQwNzI0MCAwMDAwMCBuDQowMDAwNDE0OTQ3IDAwMDAwIG4NCjAw MDA0MTUyOTcgMDAwMDAgbg0KMDAwMDQyMjc5OCAwMDAwMCBuDQowMDAwNDIzMTM2IDAwMDAw IG4NCjAwMDA0MzAwNDMgMDAwMDAgbg0KMDAwMDQzMDM0OSAwMDAwMCBuDQowMDAwNDM4ODY2 IDAwMDAwIG4NCjAwMDA0MzkyMDUgMDAwMDAgbg0KMDAwMDQ0NTY2NSAwMDAwMCBuDQowMDAw NDQ2MDI2IDAwMDAwIG4NCjAwMDA0NTQ1NjQgMDAwMDAgbg0KMDAwMDQ1NDkxNCAwMDAwMCBu DQowMDAwNDYyMDg5IDAwMDAwIG4NCjAwMDA0NjI0MjcgMDAwMDAgbg0KMDAwMDQ2ODk2MCAw MDAwMCBuDQowMDAwNDY5MzEwIDAwMDAwIG4NCjAwMDA0NzQzMTUgMDAwMDAgbg0KMDAwMDQ3 NDYzMSAwMDAwMCBuDQowMDAwNDc2NTM2IDAwMDAwIG4NCjAwMDA0NzY4NjMgMDAwMDAgbg0K MDAwMDQ4NDIzOSAwMDAwMCBuDQowMDAwNDg0NTQ0IDAwMDAwIG4NCjAwMDAwMDAyNTkgNjU1 MzUgZg0KMDAwMDAwMDI2MCA2NTUzNSBmDQowMDAwMDAwMjYxIDY1NTM1IGYNCjAwMDAwMDAy NjIgNjU1MzUgZg0KMDAwMDAwMDI2MyA2NTUzNSBmDQowMDAwMDAwMjY0IDY1NTM1IGYNCjAw MDAwMDAyNjUgNjU1MzUgZg0KMDAwMDAwMDI2NiA2NTUzNSBmDQowMDAwMDAwMjY3IDY1NTM1 IGYNCjAwMDAwMDAyNjggNjU1MzUgZg0KMDAwMDAwMDI2OSA2NTUzNSBmDQowMDAwMDAwMjcw IDY1NTM1IGYNCjAwMDAwMDAyNzEgNjU1MzUgZg0KMDAwMDAwMDI3MiA2NTUzNSBmDQowMDAw MDAwMjczIDY1NTM1IGYNCjAwMDAwMDAyNzQgNjU1MzUgZg0KMDAwMDAwMDI3NSA2NTUzNSBm DQowMDAwMDAwMjc2IDY1NTM1IGYNCjAwMDAwMDAyNzcgNjU1MzUgZg0KMDAwMDAwMDI3OCA2 NTUzNSBmDQowMDAwMDAwMjc5IDY1NTM1IGYNCjAwMDAwMDAyODAgNjU1MzUgZg0KMDAwMDAw MDI4MSA2NTUzNSBmDQowMDAwMDAwMjgyIDY1NTM1IGYNCjAwMDAwMDAyODMgNjU1MzUgZg0K MDAwMDAwMDI4NCA2NTUzNSBmDQowMDAwMDAwMjg1IDY1NTM1IGYNCjAwMDAwMDAyODYgNjU1 MzUgZg0KMDAwMDAwMDI4NyA2NTUzNSBmDQowMDAwMDAwMjg4IDY1NTM1IGYNCjAwMDAwMDAy ODkgNjU1MzUgZg0KMDAwMDAwMDI5MCA2NTUzNSBmDQowMDAwMDAwMjkxIDY1NTM1IGYNCjAw MDAwMDAyOTIgNjU1MzUgZg0KMDAwMDAwMDI5MyA2NTUzNSBmDQowMDAwMDAwMjk0IDY1NTM1 IGYNCjAwMDAwMDAyOTUgNjU1MzUgZg0KMDAwMDAwMDI5NiA2NTUzNSBmDQowMDAwMDAwMjk3 IDY1NTM1IGYNCjAwMDAwMDAyOTggNjU1MzUgZg0KMDAwMDAwMDI5OSA2NTUzNSBmDQowMDAw MDAwMzAwIDY1NTM1IGYNCjAwMDAwMDAzMDEgNjU1MzUgZg0KMDAwMDAwMDMwMiA2NTUzNSBm DQowMDAwMDAwMzAzIDY1NTM1IGYNCjAwMDAwMDAzMDQgNjU1MzUgZg0KMDAwMDAwMDMwNSA2 NTUzNSBmDQowMDAwMDAwMzA2IDY1NTM1IGYNCjAwMDAwMDAzMDcgNjU1MzUgZg0KMDAwMDAw MDMwOCA2NTUzNSBmDQowMDAwMDAwMzA5IDY1NTM1IGYNCjAwMDAwMDAzMTAgNjU1MzUgZg0K MDAwMDAwMDMxMSA2NTUzNSBmDQowMDAwMDAwMzEyIDY1NTM1IGYNCjAwMDAwMDAzMTMgNjU1 MzUgZg0KMDAwMDAwMDMxNCA2NTUzNSBmDQowMDAwMDAwMzE1IDY1NTM1IGYNCjAwMDAwMDAz MTYgNjU1MzUgZg0KMDAwMDAwMDMxNyA2NTUzNSBmDQowMDAwMDAwMzE4IDY1NTM1IGYNCjAw MDAwMDAzMTkgNjU1MzUgZg0KMDAwMDAwMDMyMCA2NTUzNSBmDQowMDAwMDAwMzIxIDY1NTM1 IGYNCjAwMDAwMDAzMjIgNjU1MzUgZg0KMDAwMDAwMDMyMyA2NTUzNSBmDQowMDAwMDAwMzI0 IDY1NTM1IGYNCjAwMDAwMDAzMjUgNjU1MzUgZg0KMDAwMDAwMDMyNiA2NTUzNSBmDQowMDAw MDAwMzI3IDY1NTM1IGYNCjAwMDAwMDAzMjggNjU1MzUgZg0KMDAwMDAwMDMyOSA2NTUzNSBm DQowMDAwMDAwMzMwIDY1NTM1IGYNCjAwMDAwMDAzMzEgNjU1MzUgZg0KMDAwMDAwMDMzMiA2 NTUzNSBmDQowMDAwMDAwMzMzIDY1NTM1IGYNCjAwMDAwMDAzMzQgNjU1MzUgZg0KMDAwMDAw MDMzNSA2NTUzNSBmDQowMDAwMDAwMzM2IDY1NTM1IGYNCjAwMDAwMDAzMzcgNjU1MzUgZg0K MDAwMDAwMDMzOCA2NTUzNSBmDQowMDAwMDAwMzM5IDY1NTM1IGYNCjAwMDAwMDAzNDAgNjU1 MzUgZg0KMDAwMDAwMDM0MSA2NTUzNSBmDQowMDAwMDAwMzQyIDY1NTM1IGYNCjAwMDAwMDAz NDMgNjU1MzUgZg0KMDAwMDAwMDM0NCA2NTUzNSBmDQowMDAwMDAwMzQ1IDY1NTM1IGYNCjAw MDAwMDAzNDYgNjU1MzUgZg0KMDAwMDAwMDM0NyA2NTUzNSBmDQowMDAwMDAwMzQ4IDY1NTM1 IGYNCjAwMDAwMDAzNDkgNjU1MzUgZg0KMDAwMDAwMDM1MCA2NTUzNSBmDQowMDAwMDAwMzUx IDY1NTM1IGYNCjAwMDAwMDAzNTIgNjU1MzUgZg0KMDAwMDAwMDM1MyA2NTUzNSBmDQowMDAw MDAwMzU0IDY1NTM1IGYNCjAwMDAwMDAzNTUgNjU1MzUgZg0KMDAwMDAwMDM1NiA2NTUzNSBm DQowMDAwMDAwMzU3IDY1NTM1IGYNCjAwMDAwMDAzNTggNjU1MzUgZg0KMDAwMDAwMDM1OSA2 NTUzNSBmDQowMDAwMDAwMzYwIDY1NTM1IGYNCjAwMDAwMDAzNjEgNjU1MzUgZg0KMDAwMDAw MDM2MiA2NTUzNSBmDQowMDAwMDAwMzYzIDY1NTM1IGYNCjAwMDAwMDAzNjQgNjU1MzUgZg0K MDAwMDAwMDM2NSA2NTUzNSBmDQowMDAwMDAwMzY2IDY1NTM1IGYNCjAwMDAwMDAzNjcgNjU1 MzUgZg0KMDAwMDAwMDM2OCA2NTUzNSBmDQowMDAwMDAwMzY5IDY1NTM1IGYNCjAwMDAwMDAz NzAgNjU1MzUgZg0KMDAwMDAwMDM3MSA2NTUzNSBmDQowMDAwMDAwMzcyIDY1NTM1IGYNCjAw MDAwMDAzNzMgNjU1MzUgZg0KMDAwMDAwMDM3NCA2NTUzNSBmDQowMDAwMDAwMzc1IDY1NTM1 IGYNCjAwMDAwMDAzNzYgNjU1MzUgZg0KMDAwMDAwMDM3NyA2NTUzNSBmDQowMDAwMDAwMzc4 IDY1NTM1IGYNCjAwMDAwMDAzNzkgNjU1MzUgZg0KMDAwMDAwMDM4MCA2NTUzNSBmDQowMDAw MDAwMzgxIDY1NTM1IGYNCjAwMDAwMDAzODIgNjU1MzUgZg0KMDAwMDAwMDM4MyA2NTUzNSBm DQowMDAwMDAwMzg0IDY1NTM1IGYNCjAwMDAwMDAzODUgNjU1MzUgZg0KMDAwMDAwMDM4NiA2 NTUzNSBmDQowMDAwMDAwMzg3IDY1NTM1IGYNCjAwMDAwMDAzODggNjU1MzUgZg0KMDAwMDAw MDM4OSA2NTUzNSBmDQowMDAwMDAwMzkwIDY1NTM1IGYNCjAwMDAwMDAzOTEgNjU1MzUgZg0K MDAwMDAwMDM5MiA2NTUzNSBmDQowMDAwMDAwMzkzIDY1NTM1IGYNCjAwMDAwMDAzOTQgNjU1 MzUgZg0KMDAwMDAwMDM5NSA2NTUzNSBmDQowMDAwMDAwMzk2IDY1NTM1IGYNCjAwMDAwMDAz OTcgNjU1MzUgZg0KMDAwMDAwMDM5OCA2NTUzNSBmDQowMDAwMDAwMzk5IDY1NTM1IGYNCjAw MDAwMDA0MDAgNjU1MzUgZg0KMDAwMDAwMDQwMSA2NTUzNSBmDQowMDAwMDAwNDAyIDY1NTM1 IGYNCjAwMDAwMDA0MDMgNjU1MzUgZg0KMDAwMDAwMDQwNCA2NTUzNSBmDQowMDAwMDAwNDA1 IDY1NTM1IGYNCjAwMDAwMDA0MDYgNjU1MzUgZg0KMDAwMDAwMDQwNyA2NTUzNSBmDQowMDAw MDAwNDA4IDY1NTM1IGYNCjAwMDAwMDA0MDkgNjU1MzUgZg0KMDAwMDAwMDQxMCA2NTUzNSBm DQowMDAwMDAwNDExIDY1NTM1IGYNCjAwMDAwMDA0MTIgNjU1MzUgZg0KMDAwMDAwMDQxMyA2 NTUzNSBmDQowMDAwMDAwNDE0IDY1NTM1IGYNCjAwMDAwMDA0MTUgNjU1MzUgZg0KMDAwMDAw MDQxNiA2NTUzNSBmDQowMDAwMDAwNDE3IDY1NTM1IGYNCjAwMDAwMDA0MTggNjU1MzUgZg0K MDAwMDAwMDQxOSA2NTUzNSBmDQowMDAwMDAwNDIwIDY1NTM1IGYNCjAwMDAwMDA0MjEgNjU1 MzUgZg0KMDAwMDAwMDQyMiA2NTUzNSBmDQowMDAwMDAwNDIzIDY1NTM1IGYNCjAwMDAwMDA0 MjQgNjU1MzUgZg0KMDAwMDAwMDQyNSA2NTUzNSBmDQowMDAwMDAwNDI2IDY1NTM1IGYNCjAw MDAwMDA0MjcgNjU1MzUgZg0KMDAwMDAwMDQyOCA2NTUzNSBmDQowMDAwMDAwNDI5IDY1NTM1 IGYNCjAwMDAwMDA0MzAgNjU1MzUgZg0KMDAwMDAwMDQzMSA2NTUzNSBmDQowMDAwMDAwNDMy IDY1NTM1IGYNCjAwMDAwMDA0MzMgNjU1MzUgZg0KMDAwMDAwMDQzNCA2NTUzNSBmDQowMDAw MDAwNDM1IDY1NTM1IGYNCjAwMDAwMDA0MzYgNjU1MzUgZg0KMDAwMDAwMDQzNyA2NTUzNSBm DQowMDAwMDAwNDM4IDY1NTM1IGYNCjAwMDAwMDA0MzkgNjU1MzUgZg0KMDAwMDAwMDQ0MCA2 NTUzNSBmDQowMDAwMDAwNDQxIDY1NTM1IGYNCjAwMDAwMDA0NDIgNjU1MzUgZg0KMDAwMDAw MDQ0MyA2NTUzNSBmDQowMDAwMDAwNDQ0IDY1NTM1IGYNCjAwMDAwMDA0NDUgNjU1MzUgZg0K MDAwMDAwMDQ0NiA2NTUzNSBmDQowMDAwMDAwNDQ3IDY1NTM1IGYNCjAwMDAwMDA0NDggNjU1 MzUgZg0KMDAwMDAwMDQ0OSA2NTUzNSBmDQowMDAwMDAwNDUwIDY1NTM1IGYNCjAwMDAwMDA0 NTEgNjU1MzUgZg0KMDAwMDAwMDQ1MiA2NTUzNSBmDQowMDAwMDAwNDUzIDY1NTM1IGYNCjAw MDAwMDA0NTQgNjU1MzUgZg0KMDAwMDAwMDQ1NSA2NTUzNSBmDQowMDAwMDAwNDU2IDY1NTM1 IGYNCjAwMDAwMDA0NTcgNjU1MzUgZg0KMDAwMDAwMDQ1OCA2NTUzNSBmDQowMDAwMDAwNDU5 IDY1NTM1IGYNCjAwMDAwMDA0NjAgNjU1MzUgZg0KMDAwMDAwMDQ2MSA2NTUzNSBmDQowMDAw MDAwNDYyIDY1NTM1IGYNCjAwMDAwMDA0NjMgNjU1MzUgZg0KMDAwMDAwMDQ2NCA2NTUzNSBm DQowMDAwMDAwNDY1IDY1NTM1IGYNCjAwMDAwMDA0NjYgNjU1MzUgZg0KMDAwMDAwMDQ2NyA2 NTUzNSBmDQowMDAwMDAwNDY4IDY1NTM1IGYNCjAwMDAwMDA0NjkgNjU1MzUgZg0KMDAwMDAw MDQ3MCA2NTUzNSBmDQowMDAwMDAwNDcxIDY1NTM1IGYNCjAwMDAwMDA0NzIgNjU1MzUgZg0K MDAwMDAwMDQ3MyA2NTUzNSBmDQowMDAwMDAwNDc0IDY1NTM1IGYNCjAwMDAwMDA0NzUgNjU1 MzUgZg0KMDAwMDAwMDQ3NiA2NTUzNSBmDQowMDAwMDAwNDc3IDY1NTM1IGYNCjAwMDAwMDA0 NzggNjU1MzUgZg0KMDAwMDAwMDQ3OSA2NTUzNSBmDQowMDAwMDAwNDgwIDY1NTM1IGYNCjAw MDAwMDA0ODEgNjU1MzUgZg0KMDAwMDAwMDQ4MiA2NTUzNSBmDQowMDAwMDAwNDgzIDY1NTM1 IGYNCjAwMDAwMDA0ODQgNjU1MzUgZg0KMDAwMDAwMDQ4NSA2NTUzNSBmDQowMDAwMDAwNDg2 IDY1NTM1IGYNCjAwMDAwMDA0ODcgNjU1MzUgZg0KMDAwMDAwMDQ4OCA2NTUzNSBmDQowMDAw MDAwNDg5IDY1NTM1IGYNCjAwMDAwMDA0OTAgNjU1MzUgZg0KMDAwMDAwMDQ5MSA2NTUzNSBm DQowMDAwMDAwNDkyIDY1NTM1IGYNCjAwMDAwMDA0OTMgNjU1MzUgZg0KMDAwMDAwMDQ5NCA2 NTUzNSBmDQowMDAwMDAwNDk1IDY1NTM1IGYNCjAwMDAwMDA0OTYgNjU1MzUgZg0KMDAwMDAw MDQ5NyA2NTUzNSBmDQowMDAwMDAwNDk4IDY1NTM1IGYNCjAwMDAwMDA0OTkgNjU1MzUgZg0K MDAwMDAwMDUwMCA2NTUzNSBmDQowMDAwMDAwNTAxIDY1NTM1IGYNCjAwMDAwMDA1MDIgNjU1 MzUgZg0KMDAwMDAwMDUwMyA2NTUzNSBmDQowMDAwMDAwNTA0IDY1NTM1IGYNCjAwMDAwMDA1 MDUgNjU1MzUgZg0KMDAwMDAwMDUwNiA2NTUzNSBmDQowMDAwMDAwNTA3IDY1NTM1IGYNCjAw MDAwMDA1MDggNjU1MzUgZg0KMDAwMDAwMDUwOSA2NTUzNSBmDQowMDAwMDAwNTEwIDY1NTM1 IGYNCjAwMDAwMDA1MTEgNjU1MzUgZg0KMDAwMDAwMDUxMiA2NTUzNSBmDQowMDAwMDAwNTEz IDY1NTM1IGYNCjAwMDAwMDA1MTQgNjU1MzUgZg0KMDAwMDAwMDUxNSA2NTUzNSBmDQowMDAw MDAwNTE2IDY1NTM1IGYNCjAwMDAwMDA1MTcgNjU1MzUgZg0KMDAwMDAwMDUxOCA2NTUzNSBm DQowMDAwMDAwNTE5IDY1NTM1IGYNCjAwMDAwMDA1MjAgNjU1MzUgZg0KMDAwMDAwMDUyMSA2 NTUzNSBmDQowMDAwMDAwNTIyIDY1NTM1IGYNCjAwMDAwMDA1MjMgNjU1MzUgZg0KMDAwMDAw MDUyNCA2NTUzNSBmDQowMDAwMDAwNTI1IDY1NTM1IGYNCjAwMDAwMDA1MjYgNjU1MzUgZg0K MDAwMDAwMDUyNyA2NTUzNSBmDQowMDAwMDAwNTI4IDY1NTM1IGYNCjAwMDAwMDA1MjkgNjU1 MzUgZg0KMDAwMDAwMDUzMCA2NTUzNSBmDQowMDAwMDAwNTMxIDY1NTM1IGYNCjAwMDAwMDA1 MzIgNjU1MzUgZg0KMDAwMDAwMDUzMyA2NTUzNSBmDQowMDAwMDAwNTM0IDY1NTM1IGYNCjAw MDAwMDA1MzUgNjU1MzUgZg0KMDAwMDAwMDUzNiA2NTUzNSBmDQowMDAwMDAwNTM3IDY1NTM1 IGYNCjAwMDAwMDA1MzggNjU1MzUgZg0KMDAwMDAwMDUzOSA2NTUzNSBmDQowMDAwMDAwNTQw IDY1NTM1IGYNCjAwMDAwMDA1NDEgNjU1MzUgZg0KMDAwMDAwMDU0MiA2NTUzNSBmDQowMDAw MDAwNTQzIDY1NTM1IGYNCjAwMDAwMDA1NDQgNjU1MzUgZg0KMDAwMDAwMDU0NSA2NTUzNSBm DQowMDAwMDAwNTQ2IDY1NTM1IGYNCjAwMDAwMDA1NDcgNjU1MzUgZg0KMDAwMDAwMDU0OCA2 NTUzNSBmDQowMDAwMDAwNTQ5IDY1NTM1IGYNCjAwMDAwMDA1NTAgNjU1MzUgZg0KMDAwMDAw MDU1MSA2NTUzNSBmDQowMDAwMDAwNTUyIDY1NTM1IGYNCjAwMDAwMDA1NTMgNjU1MzUgZg0K MDAwMDAwMDU1NCA2NTUzNSBmDQowMDAwMDAwNTU1IDY1NTM1IGYNCjAwMDAwMDA1NTYgNjU1 MzUgZg0KMDAwMDAwMDU1NyA2NTUzNSBmDQowMDAwMDAwNTU4IDY1NTM1IGYNCjAwMDAwMDA1 NTkgNjU1MzUgZg0KMDAwMDAwMDU2MCA2NTUzNSBmDQowMDAwMDAwNTYxIDY1NTM1IGYNCjAw MDAwMDA1NjIgNjU1MzUgZg0KMDAwMDAwMDU2MyA2NTUzNSBmDQowMDAwMDAwNTY0IDY1NTM1 IGYNCjAwMDAwMDA1NjUgNjU1MzUgZg0KMDAwMDAwMDU2NiA2NTUzNSBmDQowMDAwMDAwNTY3 IDY1NTM1IGYNCjAwMDAwMDA1NjggNjU1MzUgZg0KMDAwMDAwMDU2OSA2NTUzNSBmDQowMDAw MDAwNTcwIDY1NTM1IGYNCjAwMDAwMDA1NzEgNjU1MzUgZg0KMDAwMDAwMDU3MiA2NTUzNSBm DQowMDAwMDAwNTczIDY1NTM1IGYNCjAwMDAwMDA1NzQgNjU1MzUgZg0KMDAwMDAwMDU3NSA2 NTUzNSBmDQowMDAwMDAwNTc2IDY1NTM1IGYNCjAwMDAwMDA1NzcgNjU1MzUgZg0KMDAwMDAw MDU3OCA2NTUzNSBmDQowMDAwMDAwNTc5IDY1NTM1IGYNCjAwMDAwMDA1ODAgNjU1MzUgZg0K MDAwMDAwMDU4MSA2NTUzNSBmDQowMDAwMDAwNTgyIDY1NTM1IGYNCjAwMDAwMDA1ODMgNjU1 MzUgZg0KMDAwMDAwMDU4NCA2NTUzNSBmDQowMDAwMDAwNTg1IDY1NTM1IGYNCjAwMDAwMDA1 ODYgNjU1MzUgZg0KMDAwMDAwMDU4NyA2NTUzNSBmDQowMDAwMDAwNTg4IDY1NTM1IGYNCjAw MDAwMDA1ODkgNjU1MzUgZg0KMDAwMDAwMDU5MCA2NTUzNSBmDQowMDAwMDAwNTkxIDY1NTM1 IGYNCjAwMDAwMDA1OTIgNjU1MzUgZg0KMDAwMDAwMDU5MyA2NTUzNSBmDQowMDAwMDAwNTk0 IDY1NTM1IGYNCjAwMDAwMDA1OTUgNjU1MzUgZg0KMDAwMDAwMDU5NiA2NTUzNSBmDQowMDAw MDAwNTk3IDY1NTM1IGYNCjAwMDAwMDA1OTggNjU1MzUgZg0KMDAwMDAwMDU5OSA2NTUzNSBm DQowMDAwMDAwNjAwIDY1NTM1IGYNCjAwMDAwMDA2MDEgNjU1MzUgZg0KMDAwMDAwMDYwMiA2 NTUzNSBmDQowMDAwMDAwNjAzIDY1NTM1IGYNCjAwMDAwMDA2MDQgNjU1MzUgZg0KMDAwMDAw MDYwNSA2NTUzNSBmDQowMDAwMDAwNjA2IDY1NTM1IGYNCjAwMDAwMDA2MDcgNjU1MzUgZg0K MDAwMDAwMDYwOCA2NTUzNSBmDQowMDAwMDAwNjA5IDY1NTM1IGYNCjAwMDAwMDA2MTAgNjU1 MzUgZg0KMDAwMDAwMDYxMSA2NTUzNSBmDQowMDAwMDAwNjEyIDY1NTM1IGYNCjAwMDAwMDA2 MTMgNjU1MzUgZg0KMDAwMDAwMDYxNCA2NTUzNSBmDQowMDAwMDAwNjE1IDY1NTM1IGYNCjAw MDAwMDA2MTYgNjU1MzUgZg0KMDAwMDAwMDYxNyA2NTUzNSBmDQowMDAwMDAwNjE4IDY1NTM1 IGYNCjAwMDAwMDA2MTkgNjU1MzUgZg0KMDAwMDAwMDYyMCA2NTUzNSBmDQowMDAwMDAwNjIx IDY1NTM1IGYNCjAwMDAwMDA2MjIgNjU1MzUgZg0KMDAwMDAwMDYyMyA2NTUzNSBmDQowMDAw MDAwNjI0IDY1NTM1IGYNCjAwMDAwMDA2MjUgNjU1MzUgZg0KMDAwMDAwMDYyNiA2NTUzNSBm DQowMDAwMDAwNjI3IDY1NTM1IGYNCjAwMDAwMDA2MjggNjU1MzUgZg0KMDAwMDAwMDYyOSA2 NTUzNSBmDQowMDAwMDAwNjMwIDY1NTM1IGYNCjAwMDAwMDA2MzEgNjU1MzUgZg0KMDAwMDAw MDYzMiA2NTUzNSBmDQowMDAwMDAwNjMzIDY1NTM1IGYNCjAwMDAwMDA2MzQgNjU1MzUgZg0K MDAwMDAwMDYzNSA2NTUzNSBmDQowMDAwMDAwNjM2IDY1NTM1IGYNCjAwMDAwMDA2MzcgNjU1 MzUgZg0KMDAwMDAwMDYzOCA2NTUzNSBmDQowMDAwMDAwNjM5IDY1NTM1IGYNCjAwMDAwMDA2 NDAgNjU1MzUgZg0KMDAwMDAwMDY0MSA2NTUzNSBmDQowMDAwMDAwNjQyIDY1NTM1IGYNCjAw MDAwMDA2NDMgNjU1MzUgZg0KMDAwMDAwMDY0NCA2NTUzNSBmDQowMDAwMDAwNjQ1IDY1NTM1 IGYNCjAwMDAwMDA2NDYgNjU1MzUgZg0KMDAwMDAwMDY0NyA2NTUzNSBmDQowMDAwMDAwNjQ4 IDY1NTM1IGYNCjAwMDAwMDA2NDkgNjU1MzUgZg0KMDAwMDAwMDY1MCA2NTUzNSBmDQowMDAw MDAwNjUxIDY1NTM1IGYNCjAwMDAwMDA2NTIgNjU1MzUgZg0KMDAwMDAwMDY1MyA2NTUzNSBm DQowMDAwMDAwNjU0IDY1NTM1IGYNCjAwMDAwMDA2NTUgNjU1MzUgZg0KMDAwMDAwMDY1NiA2 NTUzNSBmDQowMDAwMDAwNjU3IDY1NTM1IGYNCjAwMDAwMDA2NTggNjU1MzUgZg0KMDAwMDAw MDY1OSA2NTUzNSBmDQowMDAwMDAwNjYwIDY1NTM1IGYNCjAwMDAwMDA2NjEgNjU1MzUgZg0K MDAwMDAwMDY2MiA2NTUzNSBmDQowMDAwMDAwNjYzIDY1NTM1IGYNCjAwMDAwMDA2NjQgNjU1 MzUgZg0KMDAwMDAwMDY2NSA2NTUzNSBmDQowMDAwMDAwNjY2IDY1NTM1IGYNCjAwMDAwMDA2 NjcgNjU1MzUgZg0KMDAwMDAwMDY2OCA2NTUzNSBmDQowMDAwMDAwNjY5IDY1NTM1IGYNCjAw MDAwMDA2NzAgNjU1MzUgZg0KMDAwMDAwMDY3MSA2NTUzNSBmDQowMDAwMDAwNjcyIDY1NTM1 IGYNCjAwMDAwMDA2NzMgNjU1MzUgZg0KMDAwMDAwMDY3NCA2NTUzNSBmDQowMDAwMDAwNjc1 IDY1NTM1IGYNCjAwMDAwMDA2NzYgNjU1MzUgZg0KMDAwMDAwMDY3NyA2NTUzNSBmDQowMDAw MDAwNjc4IDY1NTM1IGYNCjAwMDAwMDA2NzkgNjU1MzUgZg0KMDAwMDAwMDY4MCA2NTUzNSBm DQowMDAwMDAwNjgxIDY1NTM1IGYNCjAwMDAwMDA2ODIgNjU1MzUgZg0KMDAwMDAwMDY4MyA2 NTUzNSBmDQowMDAwMDAwNjg0IDY1NTM1IGYNCjAwMDAwMDA2ODUgNjU1MzUgZg0KMDAwMDAw MDY4NiA2NTUzNSBmDQowMDAwMDAwNjg3IDY1NTM1IGYNCjAwMDAwMDA2ODggNjU1MzUgZg0K MDAwMDAwMDY4OSA2NTUzNSBmDQowMDAwMDAwNjkwIDY1NTM1IGYNCjAwMDAwMDA2OTEgNjU1 MzUgZg0KMDAwMDAwMDY5MiA2NTUzNSBmDQowMDAwMDAwNjkzIDY1NTM1IGYNCjAwMDAwMDA2 OTQgNjU1MzUgZg0KMDAwMDAwMDY5NSA2NTUzNSBmDQowMDAwMDAwNjk2IDY1NTM1IGYNCjAw MDAwMDA2OTcgNjU1MzUgZg0KMDAwMDAwMDY5OCA2NTUzNSBmDQowMDAwMDAwNjk5IDY1NTM1 IGYNCjAwMDAwMDA3MDAgNjU1MzUgZg0KMDAwMDAwMDcwMSA2NTUzNSBmDQowMDAwMDAwNzAy IDY1NTM1IGYNCjAwMDAwMDA3MDMgNjU1MzUgZg0KMDAwMDAwMDcwNCA2NTUzNSBmDQowMDAw MDAwNzA1IDY1NTM1IGYNCjAwMDAwMDA3MDYgNjU1MzUgZg0KMDAwMDAwMDcwNyA2NTUzNSBm DQowMDAwMDAwNzA4IDY1NTM1IGYNCjAwMDAwMDA3MDkgNjU1MzUgZg0KMDAwMDAwMDcxMCA2 NTUzNSBmDQowMDAwMDAwNzExIDY1NTM1IGYNCjAwMDAwMDA3MTIgNjU1MzUgZg0KMDAwMDAw MDcxMyA2NTUzNSBmDQowMDAwMDAwNzE0IDY1NTM1IGYNCjAwMDAwMDA3MTUgNjU1MzUgZg0K MDAwMDAwMDcxNiA2NTUzNSBmDQowMDAwMDAwNzE3IDY1NTM1IGYNCjAwMDAwMDA3MTggNjU1 MzUgZg0KMDAwMDAwMDcxOSA2NTUzNSBmDQowMDAwMDAwNzIwIDY1NTM1IGYNCjAwMDAwMDA3 MjEgNjU1MzUgZg0KMDAwMDAwMDcyMiA2NTUzNSBmDQowMDAwMDAwNzIzIDY1NTM1IGYNCjAw MDAwMDA3MjQgNjU1MzUgZg0KMDAwMDAwMDcyNSA2NTUzNSBmDQowMDAwMDAwNzI2IDY1NTM1 IGYNCjAwMDAwMDA3MjcgNjU1MzUgZg0KMDAwMDAwMDcyOCA2NTUzNSBmDQowMDAwMDAwNzI5 IDY1NTM1IGYNCjAwMDAwMDA3MzAgNjU1MzUgZg0KMDAwMDAwMDczMSA2NTUzNSBmDQowMDAw MDAwNzMyIDY1NTM1IGYNCjAwMDAwMDA3MzMgNjU1MzUgZg0KMDAwMDAwMDczNCA2NTUzNSBm DQowMDAwMDAwNzM1IDY1NTM1IGYNCjAwMDAwMDA3MzYgNjU1MzUgZg0KMDAwMDAwMDczNyA2 NTUzNSBmDQowMDAwMDAwNzM4IDY1NTM1IGYNCjAwMDAwMDA3MzkgNjU1MzUgZg0KMDAwMDAw MDc0MCA2NTUzNSBmDQowMDAwMDAwNzQxIDY1NTM1IGYNCjAwMDAwMDA3NDIgNjU1MzUgZg0K MDAwMDAwMDc0MyA2NTUzNSBmDQowMDAwMDAwNzQ0IDY1NTM1IGYNCjAwMDAwMDA3NDUgNjU1 MzUgZg0KMDAwMDAwMDc0NiA2NTUzNSBmDQowMDAwMDAwNzQ3IDY1NTM1IGYNCjAwMDAwMDA3 NDggNjU1MzUgZg0KMDAwMDAwMDc0OSA2NTUzNSBmDQowMDAwMDAwNzUwIDY1NTM1IGYNCjAw MDAwMDA3NTEgNjU1MzUgZg0KMDAwMDAwMDc1MiA2NTUzNSBmDQowMDAwMDAwNzUzIDY1NTM1 IGYNCjAwMDAwMDA3NTQgNjU1MzUgZg0KMDAwMDAwMDc1NSA2NTUzNSBmDQowMDAwMDAwNzU2 IDY1NTM1IGYNCjAwMDAwMDA3NTcgNjU1MzUgZg0KMDAwMDAwMDc1OCA2NTUzNSBmDQowMDAw MDAwNzU5IDY1NTM1IGYNCjAwMDAwMDA3NjAgNjU1MzUgZg0KMDAwMDAwMDc2MSA2NTUzNSBm DQowMDAwMDAwNzYyIDY1NTM1IGYNCjAwMDAwMDA3NjMgNjU1MzUgZg0KMDAwMDAwMDc2NCA2 NTUzNSBmDQowMDAwMDAwNzY1IDY1NTM1IGYNCjAwMDAwMDA3NjYgNjU1MzUgZg0KMDAwMDAw MDc2NyA2NTUzNSBmDQowMDAwMDAwNzY4IDY1NTM1IGYNCjAwMDAwMDA3NjkgNjU1MzUgZg0K MDAwMDAwMDc3MCA2NTUzNSBmDQowMDAwMDAwNzcxIDY1NTM1IGYNCjAwMDAwMDA3NzIgNjU1 MzUgZg0KMDAwMDAwMDc3MyA2NTUzNSBmDQowMDAwMDAwNzc0IDY1NTM1IGYNCjAwMDAwMDA3 NzUgNjU1MzUgZg0KMDAwMDAwMDc3NiA2NTUzNSBmDQowMDAwMDAwNzc3IDY1NTM1IGYNCjAw MDAwMDA3NzggNjU1MzUgZg0KMDAwMDAwMDc3OSA2NTUzNSBmDQowMDAwMDAwNzgwIDY1NTM1 IGYNCjAwMDAwMDA3ODEgNjU1MzUgZg0KMDAwMDAwMDc4MiA2NTUzNSBmDQowMDAwMDAwNzgz IDY1NTM1IGYNCjAwMDAwMDA3ODQgNjU1MzUgZg0KMDAwMDAwMDc4NSA2NTUzNSBmDQowMDAw MDAwNzg2IDY1NTM1IGYNCjAwMDAwMDA3ODcgNjU1MzUgZg0KMDAwMDAwMDc4OCA2NTUzNSBm DQowMDAwMDAwNzg5IDY1NTM1IGYNCjAwMDAwMDA3OTAgNjU1MzUgZg0KMDAwMDAwMDc5MSA2 NTUzNSBmDQowMDAwMDAwNzkyIDY1NTM1IGYNCjAwMDAwMDA3OTMgNjU1MzUgZg0KMDAwMDAw MDc5NCA2NTUzNSBmDQowMDAwMDAwNzk1IDY1NTM1IGYNCjAwMDAwMDA3OTYgNjU1MzUgZg0K MDAwMDAwMDc5NyA2NTUzNSBmDQowMDAwMDAwNzk4IDY1NTM1IGYNCjAwMDAwMDA3OTkgNjU1 MzUgZg0KMDAwMDAwMDgwMCA2NTUzNSBmDQowMDAwMDAwODAxIDY1NTM1IGYNCjAwMDAwMDA4 MDIgNjU1MzUgZg0KMDAwMDAwMDgwMyA2NTUzNSBmDQowMDAwMDAwODA0IDY1NTM1IGYNCjAw MDAwMDA4MDUgNjU1MzUgZg0KMDAwMDAwMDgwNiA2NTUzNSBmDQowMDAwMDAwODA3IDY1NTM1 IGYNCjAwMDAwMDA4MDggNjU1MzUgZg0KMDAwMDAwMDgwOSA2NTUzNSBmDQowMDAwMDAwODEw IDY1NTM1IGYNCjAwMDAwMDA4MTEgNjU1MzUgZg0KMDAwMDAwMDgxMiA2NTUzNSBmDQowMDAw MDAwODEzIDY1NTM1IGYNCjAwMDAwMDA4MTQgNjU1MzUgZg0KMDAwMDAwMDgxNSA2NTUzNSBm DQowMDAwMDAwODE2IDY1NTM1IGYNCjAwMDAwMDA4MTcgNjU1MzUgZg0KMDAwMDAwMDgxOCA2 NTUzNSBmDQowMDAwMDAwODE5IDY1NTM1IGYNCjAwMDAwMDA4MjAgNjU1MzUgZg0KMDAwMDAw MDgyMSA2NTUzNSBmDQowMDAwMDAwODIyIDY1NTM1IGYNCjAwMDAwMDA4MjMgNjU1MzUgZg0K MDAwMDAwMDgyNCA2NTUzNSBmDQowMDAwMDAwODI1IDY1NTM1IGYNCjAwMDAwMDA4MjYgNjU1 MzUgZg0KMDAwMDAwMDgyNyA2NTUzNSBmDQowMDAwMDAwODI4IDY1NTM1IGYNCjAwMDAwMDA4 MjkgNjU1MzUgZg0KMDAwMDAwMDgzMCA2NTUzNSBmDQowMDAwMDAwODMxIDY1NTM1IGYNCjAw MDAwMDA4MzIgNjU1MzUgZg0KMDAwMDAwMDgzMyA2NTUzNSBmDQowMDAwMDAwODM0IDY1NTM1 IGYNCjAwMDAwMDA4MzUgNjU1MzUgZg0KMDAwMDAwMDgzNiA2NTUzNSBmDQowMDAwMDAwODM3 IDY1NTM1IGYNCjAwMDAwMDA4MzggNjU1MzUgZg0KMDAwMDAwMDgzOSA2NTUzNSBmDQowMDAw MDAwODQwIDY1NTM1IGYNCjAwMDAwMDA4NDEgNjU1MzUgZg0KMDAwMDAwMDg0MiA2NTUzNSBm DQowMDAwMDAwODQzIDY1NTM1IGYNCjAwMDAwMDA4NDQgNjU1MzUgZg0KMDAwMDAwMDg0NSA2 NTUzNSBmDQowMDAwMDAwODQ2IDY1NTM1IGYNCjAwMDAwMDA4NDcgNjU1MzUgZg0KMDAwMDAw MDg0OCA2NTUzNSBmDQowMDAwMDAwODQ5IDY1NTM1IGYNCjAwMDAwMDA4NTAgNjU1MzUgZg0K MDAwMDAwMDg1MSA2NTUzNSBmDQowMDAwMDAwODUyIDY1NTM1IGYNCjAwMDAwMDA4NTMgNjU1 MzUgZg0KMDAwMDAwMDg1NCA2NTUzNSBmDQowMDAwMDAwODU1IDY1NTM1IGYNCjAwMDAwMDA4 NTYgNjU1MzUgZg0KMDAwMDAwMDg1NyA2NTUzNSBmDQowMDAwMDAwODU4IDY1NTM1IGYNCjAw MDAwMDA4NTkgNjU1MzUgZg0KMDAwMDAwMDg2MCA2NTUzNSBmDQowMDAwMDAwODYxIDY1NTM1 IGYNCjAwMDAwMDA4NjIgNjU1MzUgZg0KMDAwMDAwMDg2MyA2NTUzNSBmDQowMDAwMDAwODY0 IDY1NTM1IGYNCjAwMDAwMDA4NjUgNjU1MzUgZg0KMDAwMDAwMDg2NiA2NTUzNSBmDQowMDAw MDAwODY3IDY1NTM1IGYNCjAwMDAwMDA4NjggNjU1MzUgZg0KMDAwMDAwMDg2OSA2NTUzNSBm DQowMDAwMDAwODcwIDY1NTM1IGYNCjAwMDAwMDA4NzEgNjU1MzUgZg0KMDAwMDAwMDg3MiA2 NTUzNSBmDQowMDAwMDAwODczIDY1NTM1IGYNCjAwMDAwMDA4NzQgNjU1MzUgZg0KMDAwMDAw MDg3NSA2NTUzNSBmDQowMDAwMDAwODc2IDY1NTM1IGYNCjAwMDAwMDA4NzcgNjU1MzUgZg0K MDAwMDAwMDg3OCA2NTUzNSBmDQowMDAwMDAwODc5IDY1NTM1IGYNCjAwMDAwMDA4ODAgNjU1 MzUgZg0KMDAwMDAwMDg4MSA2NTUzNSBmDQowMDAwMDAwODgyIDY1NTM1IGYNCjAwMDAwMDA4 ODMgNjU1MzUgZg0KMDAwMDAwMDg4NCA2NTUzNSBmDQowMDAwMDAwODg1IDY1NTM1IGYNCjAw MDAwMDA4ODYgNjU1MzUgZg0KMDAwMDAwMDg4NyA2NTUzNSBmDQowMDAwMDAwODg4IDY1NTM1 IGYNCjAwMDAwMDA4ODkgNjU1MzUgZg0KMDAwMDAwMDg5MCA2NTUzNSBmDQowMDAwMDAwODkx IDY1NTM1IGYNCjAwMDAwMDA4OTIgNjU1MzUgZg0KMDAwMDAwMDg5MyA2NTUzNSBmDQowMDAw MDAwODk0IDY1NTM1IGYNCjAwMDAwMDA4OTUgNjU1MzUgZg0KMDAwMDAwMDg5NiA2NTUzNSBm DQowMDAwMDAwODk3IDY1NTM1IGYNCjAwMDAwMDA4OTggNjU1MzUgZg0KMDAwMDAwMDg5OSA2 NTUzNSBmDQowMDAwMDAwOTAwIDY1NTM1IGYNCjAwMDAwMDA5MDEgNjU1MzUgZg0KMDAwMDAw MDkwMiA2NTUzNSBmDQowMDAwMDAwOTAzIDY1NTM1IGYNCjAwMDAwMDA5MDQgNjU1MzUgZg0K MDAwMDAwMDkwNSA2NTUzNSBmDQowMDAwMDAwOTA2IDY1NTM1IGYNCjAwMDAwMDA5MDcgNjU1 MzUgZg0KMDAwMDAwMDkwOCA2NTUzNSBmDQowMDAwMDAwOTA5IDY1NTM1IGYNCjAwMDAwMDA5 MTAgNjU1MzUgZg0KMDAwMDAwMDkxMSA2NTUzNSBmDQowMDAwMDAwOTEyIDY1NTM1IGYNCjAw MDAwMDA5MTMgNjU1MzUgZg0KMDAwMDAwMDkxNCA2NTUzNSBmDQowMDAwMDAwOTE1IDY1NTM1 IGYNCjAwMDAwMDA5MTYgNjU1MzUgZg0KMDAwMDAwMDkxNyA2NTUzNSBmDQowMDAwMDAwOTE4 IDY1NTM1IGYNCjAwMDAwMDA5MTkgNjU1MzUgZg0KMDAwMDAwMDkyMCA2NTUzNSBmDQowMDAw MDAwOTIxIDY1NTM1IGYNCjAwMDAwMDA5MjIgNjU1MzUgZg0KMDAwMDAwMDkyMyA2NTUzNSBm DQowMDAwMDAwOTI0IDY1NTM1IGYNCjAwMDAwMDA5MjUgNjU1MzUgZg0KMDAwMDAwMDkyNiA2 NTUzNSBmDQowMDAwMDAwOTI3IDY1NTM1IGYNCjAwMDAwMDA5MjggNjU1MzUgZg0KMDAwMDAw MDkyOSA2NTUzNSBmDQowMDAwMDAwOTMwIDY1NTM1IGYNCjAwMDAwMDA5MzEgNjU1MzUgZg0K MDAwMDAwMDkzMiA2NTUzNSBmDQowMDAwMDAwOTMzIDY1NTM1IGYNCjAwMDAwMDA5MzQgNjU1 MzUgZg0KMDAwMDAwMDkzNSA2NTUzNSBmDQowMDAwMDAwOTM2IDY1NTM1IGYNCjAwMDAwMDA5 MzcgNjU1MzUgZg0KMDAwMDAwMDkzOCA2NTUzNSBmDQowMDAwMDAwOTM5IDY1NTM1IGYNCjAw MDAwMDA5NDAgNjU1MzUgZg0KMDAwMDAwMDk0MSA2NTUzNSBmDQowMDAwMDAwOTQyIDY1NTM1 IGYNCjAwMDAwMDA5NDMgNjU1MzUgZg0KMDAwMDAwMDk0NCA2NTUzNSBmDQowMDAwMDAwOTQ1 IDY1NTM1IGYNCjAwMDAwMDA5NDYgNjU1MzUgZg0KMDAwMDAwMDk0OCA2NTUzNSBmDQowMDAw NDk4NDk2IDAwMDAwIG4NCjAwMDAwMDA5NDkgNjU1MzUgZg0KMDAwMDAwMDk1MCA2NTUzNSBm DQowMDAwMDAwOTUxIDY1NTM1IGYNCjAwMDAwMDA5NTIgNjU1MzUgZg0KMDAwMDAwMDk1MyA2 NTUzNSBmDQowMDAwMDAwOTU0IDY1NTM1IGYNCjAwMDAwMDA5NTUgNjU1MzUgZg0KMDAwMDAw MDk1NiA2NTUzNSBmDQowMDAwMDAwOTU3IDY1NTM1IGYNCjAwMDAwMDA5NTggNjU1MzUgZg0K MDAwMDAwMDk1OSA2NTUzNSBmDQowMDAwMDAwOTYwIDY1NTM1IGYNCjAwMDAwMDA5NjEgNjU1 MzUgZg0KMDAwMDAwMDk2MiA2NTUzNSBmDQowMDAwMDAwOTYzIDY1NTM1IGYNCjAwMDAwMDA5 NjQgNjU1MzUgZg0KMDAwMDAwMDk2NiA2NTUzNSBmDQowMDAwNDk4NTQ3IDAwMDAwIG4NCjAw MDAwMDA5NjcgNjU1MzUgZg0KMDAwMDAwMDk2OCA2NTUzNSBmDQowMDAwMDAwOTY5IDY1NTM1 IGYNCjAwMDAwMDA5NzAgNjU1MzUgZg0KMDAwMDAwMDk3MSA2NTUzNSBmDQowMDAwMDAwOTcy IDY1NTM1IGYNCjAwMDAwMDA5NzMgNjU1MzUgZg0KMDAwMDAwMDk3NCA2NTUzNSBmDQowMDAw MDAwOTc1IDY1NTM1IGYNCjAwMDAwMDA5NzYgNjU1MzUgZg0KMDAwMDAwMDk3NyA2NTUzNSBm DQowMDAwMDAwOTc4IDY1NTM1IGYNCjAwMDAwMDA5NzkgNjU1MzUgZg0KMDAwMDAwMDk4MCA2 NTUzNSBmDQowMDAwMDAwOTgxIDY1NTM1IGYNCjAwMDAwMDA5ODIgNjU1MzUgZg0KMDAwMDAw MDk4MyA2NTUzNSBmDQowMDAwMDAwOTg0IDY1NTM1IGYNCjAwMDAwMDA5ODUgNjU1MzUgZg0K MDAwMDAwMDk4NiA2NTUzNSBmDQowMDAwMDAwOTg3IDY1NTM1IGYNCjAwMDAwMDA5ODggNjU1 MzUgZg0KMDAwMDAwMDk4OSA2NTUzNSBmDQowMDAwMDAwOTkwIDY1NTM1IGYNCjAwMDAwMDA5 OTEgNjU1MzUgZg0KMDAwMDAwMDk5MiA2NTUzNSBmDQowMDAwMDAwOTkzIDY1NTM1IGYNCjAw MDAwMDA5OTQgNjU1MzUgZg0KMDAwMDAwMDk5NSA2NTUzNSBmDQowMDAwMDAwOTk2IDY1NTM1 IGYNCjAwMDAwMDA5OTcgNjU1MzUgZg0KMDAwMDAwMDk5OCA2NTUzNSBmDQowMDAwMDAwOTk5 IDY1NTM1IGYNCjAwMDAwMDEwMDAgNjU1MzUgZg0KMDAwMDAwMTAwMSA2NTUzNSBmDQowMDAw MDAxMDAyIDY1NTM1IGYNCjAwMDAwMDEwMDMgNjU1MzUgZg0KMDAwMDAwMTAwNCA2NTUzNSBm DQowMDAwMDAxMDA1IDY1NTM1IGYNCjAwMDAwMDEwMDYgNjU1MzUgZg0KMDAwMDAwMTAwNyA2 NTUzNSBmDQowMDAwMDAxMDA4IDY1NTM1IGYNCjAwMDAwMDEwMDkgNjU1MzUgZg0KMDAwMDAw MTAxMCA2NTUzNSBmDQowMDAwMDAxMDExIDY1NTM1IGYNCjAwMDAwMDEwMTIgNjU1MzUgZg0K MDAwMDAwMTAxMyA2NTUzNSBmDQowMDAwMDAxMDE0IDY1NTM1IGYNCjAwMDAwMDEwMTUgNjU1 MzUgZg0KMDAwMDAwMTAxNiA2NTUzNSBmDQowMDAwMDAxMDE3IDY1NTM1IGYNCjAwMDAwMDEw MTggNjU1MzUgZg0KMDAwMDAwMTAxOSA2NTUzNSBmDQowMDAwMDAxMDIwIDY1NTM1IGYNCjAw MDAwMDEwMjEgNjU1MzUgZg0KMDAwMDAwMTAyMiA2NTUzNSBmDQowMDAwMDAxMDIzIDY1NTM1 IGYNCjAwMDAwMDEwMjQgNjU1MzUgZg0KMDAwMDAwMTAyNSA2NTUzNSBmDQowMDAwMDAxMDI2 IDY1NTM1IGYNCjAwMDAwMDEwMjcgNjU1MzUgZg0KMDAwMDAwMTAyOCA2NTUzNSBmDQowMDAw MDAxMDI5IDY1NTM1IGYNCjAwMDAwMDEwMzAgNjU1MzUgZg0KMDAwMDAwMTAzMSA2NTUzNSBm DQowMDAwMDAxMDMyIDY1NTM1IGYNCjAwMDAwMDEwMzMgNjU1MzUgZg0KMDAwMDAwMTAzNCA2 NTUzNSBmDQowMDAwMDAxMDM1IDY1NTM1IGYNCjAwMDAwMDEwMzYgNjU1MzUgZg0KMDAwMDAw MTAzNyA2NTUzNSBmDQowMDAwMDAxMDM4IDY1NTM1IGYNCjAwMDAwMDEwMzkgNjU1MzUgZg0K MDAwMDAwMTA0MCA2NTUzNSBmDQowMDAwMDAxMDQxIDY1NTM1IGYNCjAwMDAwMDEwNDIgNjU1 MzUgZg0KMDAwMDAwMTA0MyA2NTUzNSBmDQowMDAwMDAxMDQ0IDY1NTM1IGYNCjAwMDAwMDEw NDUgNjU1MzUgZg0KMDAwMDAwMTA0NiA2NTUzNSBmDQowMDAwMDAxMDQ3IDY1NTM1IGYNCjAw MDAwMDEwNDggNjU1MzUgZg0KMDAwMDAwMTA0OSA2NTUzNSBmDQowMDAwMDAxMDUwIDY1NTM1 IGYNCjAwMDAwMDEwNTEgNjU1MzUgZg0KMDAwMDAwMTA1MiA2NTUzNSBmDQowMDAwMDAxMDUz IDY1NTM1IGYNCjAwMDAwMDEwNTQgNjU1MzUgZg0KMDAwMDAwMTA1NSA2NTUzNSBmDQowMDAw MDAxMDU2IDY1NTM1IGYNCjAwMDAwMDEwNTcgNjU1MzUgZg0KMDAwMDAwMTA1OCA2NTUzNSBm DQowMDAwMDAxMDU5IDY1NTM1IGYNCjAwMDAwMDEwNjAgNjU1MzUgZg0KMDAwMDAwMTA2MSA2 NTUzNSBmDQowMDAwMDAxMDYyIDY1NTM1IGYNCjAwMDAwMDEwNjMgNjU1MzUgZg0KMDAwMDAw MTA2NCA2NTUzNSBmDQowMDAwMDAxMDY1IDY1NTM1IGYNCjAwMDAwMDEwNjYgNjU1MzUgZg0K MDAwMDAwMTA2NyA2NTUzNSBmDQowMDAwMDAxMDY4IDY1NTM1IGYNCjAwMDAwMDEwNjkgNjU1 MzUgZg0KMDAwMDAwMTA3MCA2NTUzNSBmDQowMDAwMDAxMDcxIDY1NTM1IGYNCjAwMDAwMDEw NzIgNjU1MzUgZg0KMDAwMDAwMTA3MyA2NTUzNSBmDQowMDAwMDAxMDc0IDY1NTM1IGYNCjAw MDAwMDEwNzUgNjU1MzUgZg0KMDAwMDAwMTA3NiA2NTUzNSBmDQowMDAwMDAxMDc3IDY1NTM1 IGYNCjAwMDAwMDEwNzggNjU1MzUgZg0KMDAwMDAwMTA3OSA2NTUzNSBmDQowMDAwMDAxMDgw IDY1NTM1IGYNCjAwMDAwMDEwODEgNjU1MzUgZg0KMDAwMDAwMTA4MiA2NTUzNSBmDQowMDAw MDAxMDgzIDY1NTM1IGYNCjAwMDAwMDEwODQgNjU1MzUgZg0KMDAwMDAwMTA4NSA2NTUzNSBm DQowMDAwMDAxMDg2IDY1NTM1IGYNCjAwMDAwMDEwODcgNjU1MzUgZg0KMDAwMDAwMTA4OCA2 NTUzNSBmDQowMDAwMDAxMDg5IDY1NTM1IGYNCjAwMDAwMDEwOTAgNjU1MzUgZg0KMDAwMDAw MTA5MSA2NTUzNSBmDQowMDAwMDAxMDkyIDY1NTM1IGYNCjAwMDAwMDEwOTMgNjU1MzUgZg0K MDAwMDAwMTA5NCA2NTUzNSBmDQowMDAwMDAxMDk1IDY1NTM1IGYNCjAwMDAwMDEwOTYgNjU1 MzUgZg0KMDAwMDAwMTA5NyA2NTUzNSBmDQowMDAwMDAxMDk4IDY1NTM1IGYNCjAwMDAwMDEw OTkgNjU1MzUgZg0KMDAwMDAwMTEwMCA2NTUzNSBmDQowMDAwMDAxMTAxIDY1NTM1IGYNCjAw MDAwMDExMDIgNjU1MzUgZg0KMDAwMDAwMTEwMyA2NTUzNSBmDQowMDAwMDAxMTA0IDY1NTM1 IGYNCjAwMDAwMDExMDUgNjU1MzUgZg0KMDAwMDAwMTEwNiA2NTUzNSBmDQowMDAwMDAxMTA3 IDY1NTM1IGYNCjAwMDAwMDExMDggNjU1MzUgZg0KMDAwMDAwMTEwOSA2NTUzNSBmDQowMDAw MDAxMTEwIDY1NTM1IGYNCjAwMDAwMDExMTEgNjU1MzUgZg0KMDAwMDAwMTExMiA2NTUzNSBm DQowMDAwMDAxMTEzIDY1NTM1IGYNCjAwMDAwMDExMTQgNjU1MzUgZg0KMDAwMDAwMTExNSA2 NTUzNSBmDQowMDAwMDAxMTE2IDY1NTM1IGYNCjAwMDAwMDExMTcgNjU1MzUgZg0KMDAwMDAw MTExOCA2NTUzNSBmDQowMDAwMDAxMTE5IDY1NTM1IGYNCjAwMDAwMDExMjAgNjU1MzUgZg0K MDAwMDAwMTEyMSA2NTUzNSBmDQowMDAwMDAxMTIyIDY1NTM1IGYNCjAwMDAwMDExMjMgNjU1 MzUgZg0KMDAwMDAwMTEyNCA2NTUzNSBmDQowMDAwMDAxMTI1IDY1NTM1IGYNCjAwMDAwMDEx MjYgNjU1MzUgZg0KMDAwMDAwMTEyNyA2NTUzNSBmDQowMDAwMDAxMTI4IDY1NTM1IGYNCjAw MDAwMDExMjkgNjU1MzUgZg0KMDAwMDAwMTEzMCA2NTUzNSBmDQowMDAwMDAxMTMxIDY1NTM1 IGYNCjAwMDAwMDExMzIgNjU1MzUgZg0KMDAwMDAwMTEzMyA2NTUzNSBmDQowMDAwMDAxMTM0 IDY1NTM1IGYNCjAwMDAwMDExMzUgNjU1MzUgZg0KMDAwMDAwMTEzNiA2NTUzNSBmDQowMDAw MDAxMTM3IDY1NTM1IGYNCjAwMDAwMDExMzggNjU1MzUgZg0KMDAwMDAwMTEzOSA2NTUzNSBm DQowMDAwMDAxMTQwIDY1NTM1IGYNCjAwMDAwMDExNDEgNjU1MzUgZg0KMDAwMDAwMTE0MiA2 NTUzNSBmDQowMDAwMDAxMTQzIDY1NTM1IGYNCjAwMDAwMDExNDQgNjU1MzUgZg0KMDAwMDAw MTE0NSA2NTUzNSBmDQowMDAwMDAxMTQ2IDY1NTM1IGYNCjAwMDAwMDExNDcgNjU1MzUgZg0K MDAwMDAwMTE0OCA2NTUzNSBmDQowMDAwMDAxMTQ5IDY1NTM1IGYNCjAwMDAwMDExNTAgNjU1 MzUgZg0KMDAwMDAwMTE1MSA2NTUzNSBmDQowMDAwMDAxMTUyIDY1NTM1IGYNCjAwMDAwMDEx NTMgNjU1MzUgZg0KMDAwMDAwMTE1NCA2NTUzNSBmDQowMDAwMDAxMTU1IDY1NTM1IGYNCjAw MDAwMDExNTYgNjU1MzUgZg0KMDAwMDAwMTE1NyA2NTUzNSBmDQowMDAwMDAxMTU4IDY1NTM1 IGYNCjAwMDAwMDExNTkgNjU1MzUgZg0KMDAwMDAwMTE2MCA2NTUzNSBmDQowMDAwMDAxMTYx IDY1NTM1IGYNCjAwMDAwMDExNjIgNjU1MzUgZg0KMDAwMDAwMTE2MyA2NTUzNSBmDQowMDAw MDAxMTY0IDY1NTM1IGYNCjAwMDAwMDExNjUgNjU1MzUgZg0KMDAwMDAwMTE2NiA2NTUzNSBm DQowMDAwMDAxMTY3IDY1NTM1IGYNCjAwMDAwMDExNjggNjU1MzUgZg0KMDAwMDAwMTE2OSA2 NTUzNSBmDQowMDAwMDAxMTcwIDY1NTM1IGYNCjAwMDAwMDExNzEgNjU1MzUgZg0KMDAwMDAw MTE3MiA2NTUzNSBmDQowMDAwMDAxMTczIDY1NTM1IGYNCjAwMDAwMDExNzQgNjU1MzUgZg0K MDAwMDAwMTE3NSA2NTUzNSBmDQowMDAwMDAxMTc2IDY1NTM1IGYNCjAwMDAwMDExNzcgNjU1 MzUgZg0KMDAwMDAwMTE3OCA2NTUzNSBmDQowMDAwMDAxMTc5IDY1NTM1IGYNCjAwMDAwMDEx ODAgNjU1MzUgZg0KMDAwMDAwMTE4MSA2NTUzNSBmDQowMDAwMDAxMTgyIDY1NTM1IGYNCjAw MDAwMDExODMgNjU1MzUgZg0KMDAwMDAwMTE4NCA2NTUzNSBmDQowMDAwMDAxMTg1IDY1NTM1 IGYNCjAwMDAwMDExODYgNjU1MzUgZg0KMDAwMDAwMTE4NyA2NTUzNSBmDQowMDAwMDAxMTg4 IDY1NTM1IGYNCjAwMDAwMDExODkgNjU1MzUgZg0KMDAwMDAwMTE5MCA2NTUzNSBmDQowMDAw MDAxMTkxIDY1NTM1IGYNCjAwMDAwMDExOTIgNjU1MzUgZg0KMDAwMDAwMTE5MyA2NTUzNSBm DQowMDAwMDAxMTk0IDY1NTM1IGYNCjAwMDAwMDExOTUgNjU1MzUgZg0KMDAwMDAwMTE5NiA2 NTUzNSBmDQowMDAwMDAxMTk3IDY1NTM1IGYNCjAwMDAwMDExOTggNjU1MzUgZg0KMDAwMDAw MTE5OSA2NTUzNSBmDQowMDAwMDAxMjAwIDY1NTM1IGYNCjAwMDAwMDEyMDEgNjU1MzUgZg0K MDAwMDAwMTIwMiA2NTUzNSBmDQowMDAwMDAxMjAzIDY1NTM1IGYNCjAwMDAwMDEyMDQgNjU1 MzUgZg0KMDAwMDAwMTIwNSA2NTUzNSBmDQowMDAwMDAxMjA2IDY1NTM1IGYNCjAwMDAwMDEy MDcgNjU1MzUgZg0KMDAwMDAwMTIwOCA2NTUzNSBmDQowMDAwMDAxMjA5IDY1NTM1IGYNCjAw MDAwMDEyMTAgNjU1MzUgZg0KMDAwMDAwMTIxMSA2NTUzNSBmDQowMDAwMDAxMjEyIDY1NTM1 IGYNCjAwMDAwMDEyMTMgNjU1MzUgZg0KMDAwMDAwMTIxNCA2NTUzNSBmDQowMDAwMDAxMjE1 IDY1NTM1IGYNCjAwMDAwMDEyMTYgNjU1MzUgZg0KMDAwMDAwMTIxNyA2NTUzNSBmDQowMDAw MDAxMjE4IDY1NTM1IGYNCjAwMDAwMDEyMTkgNjU1MzUgZg0KMDAwMDAwMTIyMCA2NTUzNSBm DQowMDAwMDAxMjIxIDY1NTM1IGYNCjAwMDAwMDEyMjIgNjU1MzUgZg0KMDAwMDAwMTIyMyA2 NTUzNSBmDQowMDAwMDAxMjI0IDY1NTM1IGYNCjAwMDAwMDEyMjUgNjU1MzUgZg0KMDAwMDAw MTIyNiA2NTUzNSBmDQowMDAwMDAxMjI3IDY1NTM1IGYNCjAwMDAwMDEyMjggNjU1MzUgZg0K MDAwMDAwMTIyOSA2NTUzNSBmDQowMDAwMDAxMjMwIDY1NTM1IGYNCjAwMDAwMDEyMzEgNjU1 MzUgZg0KMDAwMDAwMTIzMiA2NTUzNSBmDQowMDAwMDAxMjMzIDY1NTM1IGYNCjAwMDAwMDEy MzQgNjU1MzUgZg0KMDAwMDAwMTIzNSA2NTUzNSBmDQowMDAwMDAxMjM2IDY1NTM1IGYNCjAw MDAwMDEyMzcgNjU1MzUgZg0KMDAwMDAwMTIzOCA2NTUzNSBmDQowMDAwMDAxMjM5IDY1NTM1 IGYNCjAwMDAwMDEyNDAgNjU1MzUgZg0KMDAwMDAwMTI0MSA2NTUzNSBmDQowMDAwMDAxMjQy IDY1NTM1IGYNCjAwMDAwMDEyNDMgNjU1MzUgZg0KMDAwMDAwMTI0NCA2NTUzNSBmDQowMDAw MDAxMjQ1IDY1NTM1IGYNCjAwMDAwMDEyNDYgNjU1MzUgZg0KMDAwMDAwMTI0NyA2NTUzNSBm DQowMDAwMDAxMjQ4IDY1NTM1IGYNCjAwMDAwMDEyNDkgNjU1MzUgZg0KMDAwMDAwMTI1MCA2 NTUzNSBmDQowMDAwMDAxMjUxIDY1NTM1IGYNCjAwMDAwMDEyNTIgNjU1MzUgZg0KMDAwMDAw MTI1MyA2NTUzNSBmDQowMDAwMDAxMjU0IDY1NTM1IGYNCjAwMDAwMDEyNTUgNjU1MzUgZg0K MDAwMDAwMTI1NiA2NTUzNSBmDQowMDAwMDAxMjU3IDY1NTM1IGYNCjAwMDAwMDEyNTggNjU1 MzUgZg0KMDAwMDAwMTI1OSA2NTUzNSBmDQowMDAwMDAxMjYwIDY1NTM1IGYNCjAwMDAwMDEy NjEgNjU1MzUgZg0KMDAwMDAwMTI2MiA2NTUzNSBmDQowMDAwMDAxMjYzIDY1NTM1IGYNCjAw MDAwMDEyNjUgNjU1MzUgZg0KMDAwMDQ5ODYwMSAwMDAwMCBuDQowMDAwMDAxMjY2IDY1NTM1 IGYNCjAwMDAwMDEyNjcgNjU1MzUgZg0KMDAwMDAwMTI2OCA2NTUzNSBmDQowMDAwMDAxMjY5 IDY1NTM1IGYNCjAwMDAwMDEyNzAgNjU1MzUgZg0KMDAwMDAwMTI3MSA2NTUzNSBmDQowMDAw MDAxMjcyIDY1NTM1IGYNCjAwMDAwMDEyNzMgNjU1MzUgZg0KMDAwMDAwMTI3NCA2NTUzNSBm DQowMDAwMDAxMjc1IDY1NTM1IGYNCjAwMDAwMDEyNzYgNjU1MzUgZg0KMDAwMDAwMTI3NyA2 NTUzNSBmDQowMDAwMDAxMjc4IDY1NTM1IGYNCjAwMDAwMDEyNzkgNjU1MzUgZg0KMDAwMDAw MTI4MCA2NTUzNSBmDQowMDAwMDAxMjgxIDY1NTM1IGYNCjAwMDAwMDEyODIgNjU1MzUgZg0K MDAwMDAwMTI4NCA2NTUzNSBmDQowMDAwNDk4NjUzIDAwMDAwIG4NCjAwMDAwMDEyODUgNjU1 MzUgZg0KMDAwMDAwMTI4NiA2NTUzNSBmDQowMDAwMDAxMjg3IDY1NTM1IGYNCjAwMDAwMDEy ODggNjU1MzUgZg0KMDAwMDAwMTI4OSA2NTUzNSBmDQowMDAwMDAxMjkwIDY1NTM1IGYNCjAw MDAwMDEyOTEgNjU1MzUgZg0KMDAwMDAwMTI5MiA2NTUzNSBmDQowMDAwMDAxMjkzIDY1NTM1 IGYNCjAwMDAwMDEyOTQgNjU1MzUgZg0KMDAwMDAwMTI5NSA2NTUzNSBmDQowMDAwMDAxMjk2 IDY1NTM1IGYNCjAwMDAwMDEyOTcgNjU1MzUgZg0KMDAwMDAwMTI5OCA2NTUzNSBmDQowMDAw MDAxMjk5IDY1NTM1IGYNCjAwMDAwMDEzMDAgNjU1MzUgZg0KMDAwMDAwMTMwMSA2NTUzNSBm DQowMDAwMDAxMzAyIDY1NTM1IGYNCjAwMDAwMDEzMDMgNjU1MzUgZg0KMDAwMDAwMTMwNCA2 NTUzNSBmDQowMDAwMDAxMzA1IDY1NTM1IGYNCjAwMDAwMDEzMDYgNjU1MzUgZg0KMDAwMDAw MTMwNyA2NTUzNSBmDQowMDAwMDAxMzA4IDY1NTM1IGYNCjAwMDAwMDEzMDkgNjU1MzUgZg0K MDAwMDAwMTMxMCA2NTUzNSBmDQowMDAwMDAxMzExIDY1NTM1IGYNCjAwMDAwMDEzMTIgNjU1 MzUgZg0KMDAwMDAwMTMxMyA2NTUzNSBmDQowMDAwMDAxMzE0IDY1NTM1IGYNCjAwMDAwMDEz MTUgNjU1MzUgZg0KMDAwMDAwMTMxNiA2NTUzNSBmDQowMDAwMDAxMzE3IDY1NTM1IGYNCjAw MDAwMDEzMTggNjU1MzUgZg0KMDAwMDAwMTMxOSA2NTUzNSBmDQowMDAwMDAxMzIwIDY1NTM1 IGYNCjAwMDAwMDEzMjEgNjU1MzUgZg0KMDAwMDAwMTMyMiA2NTUzNSBmDQowMDAwMDAxMzIz IDY1NTM1IGYNCjAwMDAwMDEzMjQgNjU1MzUgZg0KMDAwMDAwMTMyNSA2NTUzNSBmDQowMDAw MDAxMzI2IDY1NTM1IGYNCjAwMDAwMDEzMjcgNjU1MzUgZg0KMDAwMDAwMTMyOCA2NTUzNSBm DQowMDAwMDAxMzI5IDY1NTM1IGYNCjAwMDAwMDEzMzAgNjU1MzUgZg0KMDAwMDAwMTMzMSA2 NTUzNSBmDQowMDAwMDAxMzMyIDY1NTM1IGYNCjAwMDAwMDEzMzMgNjU1MzUgZg0KMDAwMDAw MTMzNCA2NTUzNSBmDQowMDAwMDAxMzM1IDY1NTM1IGYNCjAwMDAwMDEzMzYgNjU1MzUgZg0K MDAwMDAwMTMzNyA2NTUzNSBmDQowMDAwMDAxMzM4IDY1NTM1IGYNCjAwMDAwMDEzMzkgNjU1 MzUgZg0KMDAwMDAwMTM0MCA2NTUzNSBmDQowMDAwMDAxMzQxIDY1NTM1IGYNCjAwMDAwMDEz NDIgNjU1MzUgZg0KMDAwMDAwMTM0MyA2NTUzNSBmDQowMDAwMDAxMzQ0IDY1NTM1IGYNCjAw MDAwMDEzNDUgNjU1MzUgZg0KMDAwMDAwMTM0NiA2NTUzNSBmDQowMDAwMDAxMzQ3IDY1NTM1 IGYNCjAwMDAwMDEzNDggNjU1MzUgZg0KMDAwMDAwMTM0OSA2NTUzNSBmDQowMDAwMDAxMzUw IDY1NTM1IGYNCjAwMDAwMDEzNTEgNjU1MzUgZg0KMDAwMDAwMTM1MiA2NTUzNSBmDQowMDAw MDAxMzUzIDY1NTM1IGYNCjAwMDAwMDEzNTQgNjU1MzUgZg0KMDAwMDAwMTM1NSA2NTUzNSBm DQowMDAwMDAxMzU2IDY1NTM1IGYNCjAwMDAwMDEzNTcgNjU1MzUgZg0KMDAwMDAwMTM1OCA2 NTUzNSBmDQowMDAwMDAxMzU5IDY1NTM1IGYNCjAwMDAwMDEzNjAgNjU1MzUgZg0KMDAwMDAw MTM2MSA2NTUzNSBmDQowMDAwMDAxMzYyIDY1NTM1IGYNCjAwMDAwMDEzNjMgNjU1MzUgZg0K MDAwMDAwMTM2NCA2NTUzNSBmDQowMDAwMDAxMzY1IDY1NTM1IGYNCjAwMDAwMDEzNjYgNjU1 MzUgZg0KMDAwMDAwMTM2NyA2NTUzNSBmDQowMDAwMDAxMzY4IDY1NTM1IGYNCjAwMDAwMDEz NjkgNjU1MzUgZg0KMDAwMDAwMTM3MCA2NTUzNSBmDQowMDAwMDAxMzcxIDY1NTM1IGYNCjAw MDAwMDEzNzIgNjU1MzUgZg0KMDAwMDAwMTM3MyA2NTUzNSBmDQowMDAwMDAxMzc0IDY1NTM1 IGYNCjAwMDAwMDEzNzUgNjU1MzUgZg0KMDAwMDAwMTM3NiA2NTUzNSBmDQowMDAwMDAxMzc3 IDY1NTM1IGYNCjAwMDAwMDEzNzggNjU1MzUgZg0KMDAwMDAwMTM3OSA2NTUzNSBmDQowMDAw MDAxMzgwIDY1NTM1IGYNCjAwMDAwMDEzODEgNjU1MzUgZg0KMDAwMDAwMTM4MiA2NTUzNSBm DQowMDAwMDAxMzgzIDY1NTM1IGYNCjAwMDAwMDEzODQgNjU1MzUgZg0KMDAwMDAwMTM4NSA2 NTUzNSBmDQowMDAwMDAxMzg2IDY1NTM1IGYNCjAwMDAwMDEzODcgNjU1MzUgZg0KMDAwMDAw MTM4OCA2NTUzNSBmDQowMDAwMDAxMzg5IDY1NTM1IGYNCjAwMDAwMDEzOTAgNjU1MzUgZg0K MDAwMDAwMTM5MSA2NTUzNSBmDQowMDAwMDAxMzkyIDY1NTM1IGYNCjAwMDAwMDEzOTMgNjU1 MzUgZg0KMDAwMDAwMTM5NCA2NTUzNSBmDQowMDAwMDAxMzk1IDY1NTM1IGYNCjAwMDAwMDEz OTYgNjU1MzUgZg0KMDAwMDAwMTM5NyA2NTUzNSBmDQowMDAwMDAxMzk4IDY1NTM1IGYNCjAw MDAwMDEzOTkgNjU1MzUgZg0KMDAwMDAwMTQwMCA2NTUzNSBmDQowMDAwMDAxNDAxIDY1NTM1 IGYNCjAwMDAwMDE0MDIgNjU1MzUgZg0KMDAwMDAwMTQwMyA2NTUzNSBmDQowMDAwMDAxNDA0 IDY1NTM1IGYNCjAwMDAwMDE0MDUgNjU1MzUgZg0KMDAwMDAwMTQwNiA2NTUzNSBmDQowMDAw MDAxNDA3IDY1NTM1IGYNCjAwMDAwMDE0MDggNjU1MzUgZg0KMDAwMDAwMTQxMCA2NTUzNSBm DQowMDAwNTA0NzI3IDAwMDAwIG4NCjAwMDAwMDE0MTEgNjU1MzUgZg0KMDAwMDAwMTQxMiA2 NTUzNSBmDQowMDAwMDAxNDEzIDY1NTM1IGYNCjAwMDAwMDE0MTQgNjU1MzUgZg0KMDAwMDAw MTQxNSA2NTUzNSBmDQowMDAwMDAxNDE2IDY1NTM1IGYNCjAwMDAwMDE0MTcgNjU1MzUgZg0K MDAwMDAwMTQxOCA2NTUzNSBmDQowMDAwMDAxNDE5IDY1NTM1IGYNCjAwMDAwMDE0MjEgNjU1 MzUgZg0KMDAwMDUwNDc4MiAwMDAwMCBuDQowMDAwMDAxNDIyIDY1NTM1IGYNCjAwMDAwMDE0 MjMgNjU1MzUgZg0KMDAwMDAwMTQyNCA2NTUzNSBmDQowMDAwMDAxNDI1IDY1NTM1IGYNCjAw MDAwMDE0MjYgNjU1MzUgZg0KMDAwMDAwMTQyNyA2NTUzNSBmDQowMDAwMDAxNDI4IDY1NTM1 IGYNCjAwMDAwMDE0MjkgNjU1MzUgZg0KMDAwMDAwMTQzMCA2NTUzNSBmDQowMDAwMDAxNDMy IDY1NTM1IGYNCjAwMDA1MDQ4MzcgMDAwMDAgbg0KMDAwMDAwMTQzMyA2NTUzNSBmDQowMDAw MDAxNDM0IDY1NTM1IGYNCjAwMDAwMDE0MzUgNjU1MzUgZg0KMDAwMDAwMTQzNiA2NTUzNSBm DQowMDAwMDAxNDM3IDY1NTM1IGYNCjAwMDAwMDE0MzggNjU1MzUgZg0KMDAwMDAwMTQzOSA2 NTUzNSBmDQowMDAwMDAxNDQwIDY1NTM1IGYNCjAwMDAwMDE0NDEgNjU1MzUgZg0KMDAwMDAw MTQ0MiA2NTUzNSBmDQowMDAwMDAxNDQzIDY1NTM1IGYNCjAwMDAwMDE0NDQgNjU1MzUgZg0K MDAwMDAwMTQ0NSA2NTUzNSBmDQowMDAwMDAxNDQ2IDY1NTM1IGYNCjAwMDAwMDE0NDcgNjU1 MzUgZg0KMDAwMDAwMTQ0OCA2NTUzNSBmDQowMDAwMDAxNDQ5IDY1NTM1IGYNCjAwMDAwMDE0 NTAgNjU1MzUgZg0KMDAwMDAwMTQ1MSA2NTUzNSBmDQowMDAwMDAxNDUyIDY1NTM1IGYNCjAw MDAwMDE0NTMgNjU1MzUgZg0KMDAwMDAwMTQ1NCA2NTUzNSBmDQowMDAwMDAxNDU1IDY1NTM1 IGYNCjAwMDAwMDE0NTYgNjU1MzUgZg0KMDAwMDAwMTQ1NyA2NTUzNSBmDQowMDAwMDAxNDU4 IDY1NTM1IGYNCjAwMDAwMDE0NTkgNjU1MzUgZg0KMDAwMDAwMTQ2MCA2NTUzNSBmDQowMDAw MDAxNDYxIDY1NTM1IGYNCjAwMDAwMDE0NjIgNjU1MzUgZg0KMDAwMDAwMTQ2MyA2NTUzNSBm DQowMDAwMDAxNDY0IDY1NTM1IGYNCjAwMDAwMDE0NjUgNjU1MzUgZg0KMDAwMDAwMTQ2NiA2 NTUzNSBmDQowMDAwMDAxNDY3IDY1NTM1IGYNCjAwMDAwMDE0NjggNjU1MzUgZg0KMDAwMDAw MTQ2OSA2NTUzNSBmDQowMDAwMDAxNDcwIDY1NTM1IGYNCjAwMDAwMDE0NzEgNjU1MzUgZg0K MDAwMDAwMTQ3MiA2NTUzNSBmDQowMDAwMDAxNDczIDY1NTM1IGYNCjAwMDAwMDE0NzQgNjU1 MzUgZg0KMDAwMDAwMTQ3NSA2NTUzNSBmDQowMDAwMDAxNDc2IDY1NTM1IGYNCjAwMDAwMDE0 NzcgNjU1MzUgZg0KMDAwMDAwMTQ3OCA2NTUzNSBmDQowMDAwMDAxNDc5IDY1NTM1IGYNCjAw MDAwMDE0ODAgNjU1MzUgZg0KMDAwMDAwMTQ4MSA2NTUzNSBmDQowMDAwMDAxNDgyIDY1NTM1 IGYNCjAwMDAwMDE0ODMgNjU1MzUgZg0KMDAwMDAwMTQ4NCA2NTUzNSBmDQowMDAwMDAxNDg1 IDY1NTM1IGYNCjAwMDAwMDE0ODYgNjU1MzUgZg0KMDAwMDAwMTQ4NyA2NTUzNSBmDQowMDAw MDAxNDg4IDY1NTM1IGYNCjAwMDAwMDE0ODkgNjU1MzUgZg0KMDAwMDAwMTQ5MCA2NTUzNSBm DQowMDAwMDAxNDkxIDY1NTM1IGYNCjAwMDAwMDE0OTIgNjU1MzUgZg0KMDAwMDAwMTQ5MyA2 NTUzNSBmDQowMDAwMDAxNDk0IDY1NTM1IGYNCjAwMDAwMDE0OTUgNjU1MzUgZg0KMDAwMDAw MTQ5NiA2NTUzNSBmDQowMDAwMDAxNDk3IDY1NTM1IGYNCjAwMDAwMDE0OTggNjU1MzUgZg0K MDAwMDAwMTQ5OSA2NTUzNSBmDQowMDAwMDAxNTAwIDY1NTM1IGYNCjAwMDAwMDE1MDEgNjU1 MzUgZg0KMDAwMDAwMTUwMiA2NTUzNSBmDQowMDAwMDAxNTA0IDY1NTM1IGYNCjAwMDA1MDQ4 ODkgMDAwMDAgbg0KMDAwMDAwMTUwNSA2NTUzNSBmDQowMDAwMDAxNTA2IDY1NTM1IGYNCjAw MDAwMDE1MDggNjU1MzUgZg0KMDAwMDUwNDk0MSAwMDAwMCBuDQowMDAwMDAxNTA5IDY1NTM1 IGYNCjAwMDAwMDE1MTAgNjU1MzUgZg0KMDAwMDAwMTUxMSA2NTUzNSBmDQowMDAwMDAxNTEy IDY1NTM1IGYNCjAwMDAwMDE1MTMgNjU1MzUgZg0KMDAwMDAwMTUxNCA2NTUzNSBmDQowMDAw MDAxNTE1IDY1NTM1IGYNCjAwMDAwMDE1MTYgNjU1MzUgZg0KMDAwMDAwMTUxNyA2NTUzNSBm DQowMDAwMDAxNTE4IDY1NTM1IGYNCjAwMDAwMDE1MTkgNjU1MzUgZg0KMDAwMDAwMTUyMCA2 NTUzNSBmDQowMDAwMDAxNTIxIDY1NTM1IGYNCjAwMDAwMDE1MjIgNjU1MzUgZg0KMDAwMDAw MTUyMyA2NTUzNSBmDQowMDAwMDAxNTI0IDY1NTM1IGYNCjAwMDAwMDE1MjUgNjU1MzUgZg0K MDAwMDAwMTUyNiA2NTUzNSBmDQowMDAwMDAxNTI3IDY1NTM1IGYNCjAwMDAwMDE1MjggNjU1 MzUgZg0KMDAwMDAwMTUyOSA2NTUzNSBmDQowMDAwMDAxNTMwIDY1NTM1IGYNCjAwMDAwMDE1 MzEgNjU1MzUgZg0KMDAwMDAwMTUzMiA2NTUzNSBmDQowMDAwMDAxNTMzIDY1NTM1IGYNCjAw MDAwMDE1MzQgNjU1MzUgZg0KMDAwMDAwMTUzNSA2NTUzNSBmDQowMDAwMDAxNTM2IDY1NTM1 IGYNCjAwMDAwMDE1MzcgNjU1MzUgZg0KMDAwMDAwMTUzOCA2NTUzNSBmDQowMDAwMDAxNTM5 IDY1NTM1IGYNCjAwMDAwMDE1NDAgNjU1MzUgZg0KMDAwMDAwMTU0MSA2NTUzNSBmDQowMDAw MDAxNTQyIDY1NTM1IGYNCjAwMDAwMDE1NDMgNjU1MzUgZg0KMDAwMDAwMTU0NCA2NTUzNSBm DQowMDAwMDAxNTQ1IDY1NTM1IGYNCjAwMDAwMDE1NDYgNjU1MzUgZg0KMDAwMDAwMTU0NyA2 NTUzNSBmDQowMDAwMDAxNTQ4IDY1NTM1IGYNCjAwMDAwMDE1NDkgNjU1MzUgZg0KMDAwMDAw MTU1MCA2NTUzNSBmDQowMDAwMDAxNTUxIDY1NTM1IGYNCjAwMDAwMDE1NTIgNjU1MzUgZg0K MDAwMDAwMTU1MyA2NTUzNSBmDQowMDAwMDAxNTU0IDY1NTM1IGYNCjAwMDAwMDE1NTUgNjU1 MzUgZg0KMDAwMDAwMTU1NiA2NTUzNSBmDQowMDAwMDAxNTU3IDY1NTM1IGYNCjAwMDAwMDE1 NTggNjU1MzUgZg0KMDAwMDAwMTU1OSA2NTUzNSBmDQowMDAwMDAxNTYwIDY1NTM1IGYNCjAw MDAwMDE1NjEgNjU1MzUgZg0KMDAwMDAwMTU2MiA2NTUzNSBmDQowMDAwMDAxNTYzIDY1NTM1 IGYNCjAwMDAwMDE1NjQgNjU1MzUgZg0KMDAwMDAwMTU2NSA2NTUzNSBmDQowMDAwMDAxNTY2 IDY1NTM1IGYNCjAwMDAwMDE1NjcgNjU1MzUgZg0KMDAwMDAwMTU2OCA2NTUzNSBmDQowMDAw MDAxNTY5IDY1NTM1IGYNCjAwMDAwMDE1NzAgNjU1MzUgZg0KMDAwMDAwMTU3MSA2NTUzNSBm DQowMDAwMDAxNTcyIDY1NTM1IGYNCjAwMDAwMDE1NzMgNjU1MzUgZg0KMDAwMDAwMTU3NCA2 NTUzNSBmDQowMDAwMDAxNTc1IDY1NTM1IGYNCjAwMDAwMDE1NzYgNjU1MzUgZg0KMDAwMDAw MTU3NyA2NTUzNSBmDQowMDAwMDAxNTc4IDY1NTM1IGYNCjAwMDAwMDE1NzkgNjU1MzUgZg0K MDAwMDAwMTU4MCA2NTUzNSBmDQowMDAwMDAxNTgxIDY1NTM1IGYNCjAwMDAwMDE1ODMgNjU1 MzUgZg0KMDAwMDUwNDk5NSAwMDAwMCBuDQowMDAwMDAxNTg0IDY1NTM1IGYNCjAwMDAwMDE1 ODUgNjU1MzUgZg0KMDAwMDAwMTU4NiA2NTUzNSBmDQowMDAwMDAxNTg3IDY1NTM1IGYNCjAw MDAwMDE1ODggNjU1MzUgZg0KMDAwMDAwMTU4OSA2NTUzNSBmDQowMDAwMDAxNTkwIDY1NTM1 IGYNCjAwMDAwMDE1OTEgNjU1MzUgZg0KMDAwMDAwMTU5MiA2NTUzNSBmDQowMDAwMDAxNTkz IDY1NTM1IGYNCjAwMDAwMDE1OTQgNjU1MzUgZg0KMDAwMDAwMTU5NSA2NTUzNSBmDQowMDAw MDAxNTk2IDY1NTM1IGYNCjAwMDAwMDE1OTcgNjU1MzUgZg0KMDAwMDAwMTU5OCA2NTUzNSBm DQowMDAwMDAxNTk5IDY1NTM1IGYNCjAwMDAwMDE2MDAgNjU1MzUgZg0KMDAwMDAwMTYwMSA2 NTUzNSBmDQowMDAwMDAxNjAyIDY1NTM1IGYNCjAwMDAwMDE2MDMgNjU1MzUgZg0KMDAwMDAw MTYwNSA2NTUzNSBmDQowMDAwNTA1MDQ5IDAwMDAwIG4NCjAwMDAwMDE2MDYgNjU1MzUgZg0K MDAwMDAwMTYwNyA2NTUzNSBmDQowMDAwMDAxNjA4IDY1NTM1IGYNCjAwMDAwMDE2MTAgNjU1 MzUgZg0KMDAwMDUwNTEwMyAwMDAwMCBuDQowMDAwMDAxNjExIDY1NTM1IGYNCjAwMDAwMDE2 MTIgNjU1MzUgZg0KMDAwMDAwMTYxMyA2NTUzNSBmDQowMDAwMDAxNjE0IDY1NTM1IGYNCjAw MDAwMDE2MTUgNjU1MzUgZg0KMDAwMDAwMTYxNiA2NTUzNSBmDQowMDAwMDAxNjE3IDY1NTM1 IGYNCjAwMDAwMDE2MTkgNjU1MzUgZg0KMDAwMDUwNTE1NyAwMDAwMCBuDQowMDAwMDAxNjIw IDY1NTM1IGYNCjAwMDAwMDE2MjEgNjU1MzUgZg0KMDAwMDAwMTYyMiA2NTUzNSBmDQowMDAw MDAxNjIzIDY1NTM1IGYNCjAwMDAwMDE2MjQgNjU1MzUgZg0KMDAwMDAwMTYyNSA2NTUzNSBm DQowMDAwMDAxNjI2IDY1NTM1IGYNCjAwMDAwMDE2MjcgNjU1MzUgZg0KMDAwMDAwMTYyOCA2 NTUzNSBmDQowMDAwMDAxNjI5IDY1NTM1IGYNCjAwMDAwMDE2MzAgNjU1MzUgZg0KMDAwMDAw MTYzMiA2NTUzNSBmDQowMDAwNTA1MjExIDAwMDAwIG4NCjAwMDAwMDE2MzMgNjU1MzUgZg0K MDAwMDAwMTYzNCA2NTUzNSBmDQowMDAwMDAxNjM1IDY1NTM1IGYNCjAwMDAwMDE2MzYgNjU1 MzUgZg0KMDAwMDAwMTYzNyA2NTUzNSBmDQowMDAwMDAxNjM4IDY1NTM1IGYNCjAwMDAwMDE2 MzkgNjU1MzUgZg0KMDAwMDAwMTY0MSA2NTUzNSBmDQowMDAwNTA1MjY1IDAwMDAwIG4NCjAw MDAwMDE2NDIgNjU1MzUgZg0KMDAwMDAwMTY0MyA2NTUzNSBmDQowMDAwMDAxNjQ0IDY1NTM1 IGYNCjAwMDAwMDE2NDYgNjU1MzUgZg0KMDAwMDUwNTMxOSAwMDAwMCBuDQowMDAwMDAxNjQ3 IDY1NTM1IGYNCjAwMDAwMDE2NDggNjU1MzUgZg0KMDAwMDAwMTY0OSA2NTUzNSBmDQowMDAw MDAxNjUwIDY1NTM1IGYNCjAwMDAwMDE2NTEgNjU1MzUgZg0KMDAwMDAwMTY1MiA2NTUzNSBm DQowMDAwMDAxNjUzIDY1NTM1IGYNCjAwMDAwMDE2NTQgNjU1MzUgZg0KMDAwMDAwMTY1NSA2 NTUzNSBmDQowMDAwMDAxNjU2IDY1NTM1IGYNCjAwMDAwMDE2NTcgNjU1MzUgZg0KMDAwMDAw MTY1OCA2NTUzNSBmDQowMDAwMDAxNjU5IDY1NTM1IGYNCjAwMDAwMDE2NjEgNjU1MzUgZg0K MDAwMDUwNTM3MyAwMDAwMCBuDQowMDAwMDAxNjYyIDY1NTM1IGYNCjAwMDAwMDE2NjMgNjU1 MzUgZg0KMDAwMDAwMTY2NCA2NTUzNSBmDQowMDAwMDAxNjY1IDY1NTM1IGYNCjAwMDAwMDE2 NjYgNjU1MzUgZg0KMDAwMDAwMTY2NyA2NTUzNSBmDQowMDAwMDAxNjY4IDY1NTM1IGYNCjAw MDAwMDE2NzAgNjU1MzUgZg0KMDAwMDUwNTQyNyAwMDAwMCBuDQowMDAwMDAxNjcxIDY1NTM1 IGYNCjAwMDAwMDE2NzIgNjU1MzUgZg0KMDAwMDAwMTY3MyA2NTUzNSBmDQowMDAwMDAxNjc1 IDY1NTM1IGYNCjAwMDA1MDU0ODEgMDAwMDAgbg0KMDAwMDAwMTY3NiA2NTUzNSBmDQowMDAw MDAxNjc3IDY1NTM1IGYNCjAwMDAwMDE2NzggNjU1MzUgZg0KMDAwMDAwMTY3OSA2NTUzNSBm DQowMDAwMDAxNjgwIDY1NTM1IGYNCjAwMDAwMDE2ODEgNjU1MzUgZg0KMDAwMDAwMTY4MiA2 NTUzNSBmDQowMDAwMDAxNjgzIDY1NTM1IGYNCjAwMDAwMDE2ODQgNjU1MzUgZg0KMDAwMDAw MTY4NiA2NTUzNSBmDQowMDAwNTA1NTM1IDAwMDAwIG4NCjAwMDAwMDE2ODcgNjU1MzUgZg0K MDAwMDAwMTY4OCA2NTUzNSBmDQowMDAwMDAxNjg5IDY1NTM1IGYNCjAwMDAwMDE2OTAgNjU1 MzUgZg0KMDAwMDAwMTY5MSA2NTUzNSBmDQowMDAwMDAxNjkyIDY1NTM1IGYNCjAwMDAwMDE2 OTMgNjU1MzUgZg0KMDAwMDAwMTY5NCA2NTUzNSBmDQowMDAwMDAxNjk1IDY1NTM1IGYNCjAw MDAwMDE2OTYgNjU1MzUgZg0KMDAwMDAwMTY5OCA2NTUzNSBmDQowMDAwNTA1NTg5IDAwMDAw IG4NCjAwMDAwMDE2OTkgNjU1MzUgZg0KMDAwMDAwMTcwMCA2NTUzNSBmDQowMDAwMDAxNzAx IDY1NTM1IGYNCjAwMDAwMDE3MDIgNjU1MzUgZg0KMDAwMDAwMTcwMyA2NTUzNSBmDQowMDAw MDAxNzA1IDY1NTM1IGYNCjAwMDA1MDU2NDMgMDAwMDAgbg0KMDAwMDAwMTcwNiA2NTUzNSBm DQowMDAwMDAxNzA3IDY1NTM1IGYNCjAwMDAwMDE3MDggNjU1MzUgZg0KMDAwMDAwMTcwOSA2 NTUzNSBmDQowMDAwMDAxNzEwIDY1NTM1IGYNCjAwMDAwMDE3MTEgNjU1MzUgZg0KMDAwMDAw MTcxMiA2NTUzNSBmDQowMDAwMDAxNzEzIDY1NTM1IGYNCjAwMDAwMDE3MTQgNjU1MzUgZg0K MDAwMDAwMTcxNSA2NTUzNSBmDQowMDAwMDAxNzE2IDY1NTM1IGYNCjAwMDAwMDE3MTggNjU1 MzUgZg0KMDAwMDUwNTY5NyAwMDAwMCBuDQowMDAwMDAxNzE5IDY1NTM1IGYNCjAwMDAwMDE3 MjAgNjU1MzUgZg0KMDAwMDAwMTcyMSA2NTUzNSBmDQowMDAwMDAxNzIzIDY1NTM1IGYNCjAw MDA1MDU3NTEgMDAwMDAgbg0KMDAwMDAwMTcyNCA2NTUzNSBmDQowMDAwMDAxNzI1IDY1NTM1 IGYNCjAwMDAwMDE3MjYgNjU1MzUgZg0KMDAwMDAwMTcyNyA2NTUzNSBmDQowMDAwMDAxNzI4 IDY1NTM1IGYNCjAwMDAwMDE3MzAgNjU1MzUgZg0KMDAwMDUwNTgwNSAwMDAwMCBuDQowMDAw MDAxNzMxIDY1NTM1IGYNCjAwMDAwMDE3MzIgNjU1MzUgZg0KMDAwMDAwMTczMyA2NTUzNSBm DQowMDAwMDAxNzM0IDY1NTM1IGYNCjAwMDAwMDE3MzUgNjU1MzUgZg0KMDAwMDAwMTczNiA2 NTUzNSBmDQowMDAwMDAxNzM3IDY1NTM1IGYNCjAwMDAwMDE3MzggNjU1MzUgZg0KMDAwMDAw MTczOSA2NTUzNSBmDQowMDAwMDAxNzQwIDY1NTM1IGYNCjAwMDAwMDE3NDEgNjU1MzUgZg0K MDAwMDAwMTc0MiA2NTUzNSBmDQowMDAwMDAxNzQzIDY1NTM1IGYNCjAwMDAwMDE3NDQgNjU1 MzUgZg0KMDAwMDAwMTc0NSA2NTUzNSBmDQowMDAwMDAxNzQ2IDY1NTM1IGYNCjAwMDAwMDE3 NDcgNjU1MzUgZg0KMDAwMDAwMTc0OCA2NTUzNSBmDQowMDAwMDAxNzQ5IDY1NTM1IGYNCjAw MDAwMDE3NTEgNjU1MzUgZg0KMDAwMDUwNTg1OSAwMDAwMCBuDQowMDAwMDAxNzUyIDY1NTM1 IGYNCjAwMDAwMDE3NTMgNjU1MzUgZg0KMDAwMDAwMTc1NCA2NTUzNSBmDQowMDAwMDAxNzU1 IDY1NTM1IGYNCjAwMDAwMDE3NTYgNjU1MzUgZg0KMDAwMDAwMTc1OCA2NTUzNSBmDQowMDAw NTA1OTEzIDAwMDAwIG4NCjAwMDAwMDE3NTkgNjU1MzUgZg0KMDAwMDAwMTc2MCA2NTUzNSBm DQowMDAwMDAxNzYxIDY1NTM1IGYNCjAwMDAwMDE3NjIgNjU1MzUgZg0KMDAwMDAwMTc2MyA2 NTUzNSBmDQowMDAwMDAxNzY0IDY1NTM1IGYNCjAwMDAwMDE3NjUgNjU1MzUgZg0KMDAwMDAw MTc2NiA2NTUzNSBmDQowMDAwMDAxNzY3IDY1NTM1IGYNCjAwMDAwMDE3NjggNjU1MzUgZg0K MDAwMDAwMTc2OSA2NTUzNSBmDQowMDAwMDAxNzcwIDY1NTM1IGYNCjAwMDAwMDE3NzEgNjU1 MzUgZg0KMDAwMDAwMTc3MiA2NTUzNSBmDQowMDAwMDAxNzczIDY1NTM1IGYNCjAwMDAwMDE3 NzQgNjU1MzUgZg0KMDAwMDAwMTc3NSA2NTUzNSBmDQowMDAwMDAxNzc2IDY1NTM1IGYNCjAw MDAwMDE3NzcgNjU1MzUgZg0KMDAwMDAwMTc3OCA2NTUzNSBmDQowMDAwMDAxNzc5IDY1NTM1 IGYNCjAwMDAwMDE3ODAgNjU1MzUgZg0KMDAwMDAwMTc4MSA2NTUzNSBmDQowMDAwMDAxNzgy IDY1NTM1IGYNCjAwMDAwMDE3ODMgNjU1MzUgZg0KMDAwMDAwMTc4NCA2NTUzNSBmDQowMDAw MDAxNzg1IDY1NTM1IGYNCjAwMDAwMDE3ODYgNjU1MzUgZg0KMDAwMDAwMTc4NyA2NTUzNSBm DQowMDAwMDAxNzg4IDY1NTM1IGYNCjAwMDAwMDE3ODkgNjU1MzUgZg0KMDAwMDAwMTc5MCA2 NTUzNSBmDQowMDAwMDAxNzkxIDY1NTM1IGYNCjAwMDAwMDE3OTIgNjU1MzUgZg0KMDAwMDAw MTc5MyA2NTUzNSBmDQowMDAwMDAxNzk0IDY1NTM1IGYNCjAwMDAwMDE3OTUgNjU1MzUgZg0K MDAwMDAwMTc5NiA2NTUzNSBmDQowMDAwMDAxNzk3IDY1NTM1IGYNCjAwMDAwMDE3OTggNjU1 MzUgZg0KMDAwMDAwMTc5OSA2NTUzNSBmDQowMDAwMDAxODAwIDY1NTM1IGYNCjAwMDAwMDE4 MDEgNjU1MzUgZg0KMDAwMDAwMTgwMiA2NTUzNSBmDQowMDAwMDAxODA0IDY1NTM1IGYNCjAw MDA1MDU5NjggMDAwMDAgbg0KMDAwMDAwMTgwNSA2NTUzNSBmDQowMDAwMDAxODA2IDY1NTM1 IGYNCjAwMDAwMDE4MDcgNjU1MzUgZg0KMDAwMDAwMTgwOCA2NTUzNSBmDQowMDAwMDAxODA5 IDY1NTM1IGYNCjAwMDAwMDE4MTAgNjU1MzUgZg0KMDAwMDAwMTgxMSA2NTUzNSBmDQowMDAw MDAxODEyIDY1NTM1IGYNCjAwMDAwMDE4MTMgNjU1MzUgZg0KMDAwMDAwMTgxNCA2NTUzNSBm DQowMDAwMDAxODE1IDY1NTM1IGYNCjAwMDAwMDE4MTYgNjU1MzUgZg0KMDAwMDAwMTgxNyA2 NTUzNSBmDQowMDAwMDAxODE4IDY1NTM1IGYNCjAwMDAwMDE4MTkgNjU1MzUgZg0KMDAwMDAw MTgyMCA2NTUzNSBmDQowMDAwMDAxODIxIDY1NTM1IGYNCjAwMDAwMDE4MjIgNjU1MzUgZg0K MDAwMDAwMTgyMyA2NTUzNSBmDQowMDAwMDAxODI0IDY1NTM1IGYNCjAwMDAwMDE4MjUgNjU1 MzUgZg0KMDAwMDAwMTgyNiA2NTUzNSBmDQowMDAwMDAxODI3IDY1NTM1IGYNCjAwMDAwMDE4 MjggNjU1MzUgZg0KMDAwMDAwMTgyOSA2NTUzNSBmDQowMDAwMDAxODMwIDY1NTM1IGYNCjAw MDAwMDE4MzEgNjU1MzUgZg0KMDAwMDAwMTgzMiA2NTUzNSBmDQowMDAwMDAxODMzIDY1NTM1 IGYNCjAwMDAwMDE4MzQgNjU1MzUgZg0KMDAwMDAwMTgzNSA2NTUzNSBmDQowMDAwMDAxODM2 IDY1NTM1IGYNCjAwMDAwMDE4MzcgNjU1MzUgZg0KMDAwMDAwMTgzOCA2NTUzNSBmDQowMDAw MDAxODM5IDY1NTM1IGYNCjAwMDAwMDE4NDAgNjU1MzUgZg0KMDAwMDAwMTg0MSA2NTUzNSBm DQowMDAwMDAxODQyIDY1NTM1IGYNCjAwMDAwMDE4NDMgNjU1MzUgZg0KMDAwMDAwMTg0NCA2 NTUzNSBmDQowMDAwMDAxODQ1IDY1NTM1IGYNCjAwMDAwMDE4NDYgNjU1MzUgZg0KMDAwMDAw MTg0NyA2NTUzNSBmDQowMDAwMDAxODQ4IDY1NTM1IGYNCjAwMDAwMDE4NDkgNjU1MzUgZg0K MDAwMDAwMTg1MCA2NTUzNSBmDQowMDAwMDAxODUxIDY1NTM1IGYNCjAwMDAwMDE4NTIgNjU1 MzUgZg0KMDAwMDAwMTg1MyA2NTUzNSBmDQowMDAwMDAxODU0IDY1NTM1IGYNCjAwMDAwMDE4 NTUgNjU1MzUgZg0KMDAwMDAwMTg1NiA2NTUzNSBmDQowMDAwMDAxODU3IDY1NTM1IGYNCjAw MDAwMDE4NTggNjU1MzUgZg0KMDAwMDAwMTg1OSA2NTUzNSBmDQowMDAwMDAxODYwIDY1NTM1 IGYNCjAwMDAwMDE4NjEgNjU1MzUgZg0KMDAwMDAwMTg2MiA2NTUzNSBmDQowMDAwMDAxODYz IDY1NTM1IGYNCjAwMDAwMDE4NjQgNjU1MzUgZg0KMDAwMDAwMTg2NSA2NTUzNSBmDQowMDAw MDAxODY2IDY1NTM1IGYNCjAwMDAwMDE4NjcgNjU1MzUgZg0KMDAwMDAwMTg2OCA2NTUzNSBm DQowMDAwMDAxODY5IDY1NTM1IGYNCjAwMDAwMDE4NzAgNjU1MzUgZg0KMDAwMDAwMTg3MSA2 NTUzNSBmDQowMDAwMDAxODcyIDY1NTM1IGYNCjAwMDAwMDE4NzMgNjU1MzUgZg0KMDAwMDAw MTg3NCA2NTUzNSBmDQowMDAwMDAxODc1IDY1NTM1IGYNCjAwMDAwMDE4NzYgNjU1MzUgZg0K MDAwMDAwMTg3NyA2NTUzNSBmDQowMDAwMDAxODc4IDY1NTM1IGYNCjAwMDAwMDE4NzkgNjU1 MzUgZg0KMDAwMDAwMTg4MCA2NTUzNSBmDQowMDAwMDAxODgxIDY1NTM1IGYNCjAwMDAwMDE4 ODIgNjU1MzUgZg0KMDAwMDAwMTg4MyA2NTUzNSBmDQowMDAwMDAxODg0IDY1NTM1IGYNCjAw MDAwMDE4ODUgNjU1MzUgZg0KMDAwMDAwMTg4NiA2NTUzNSBmDQowMDAwMDAxODg3IDY1NTM1 IGYNCjAwMDAwMDE4ODggNjU1MzUgZg0KMDAwMDAwMTg4OSA2NTUzNSBmDQowMDAwMDAxODkw IDY1NTM1IGYNCjAwMDAwMDE4OTEgNjU1MzUgZg0KMDAwMDAwMTg5MiA2NTUzNSBmDQowMDAw MDAxODkzIDY1NTM1IGYNCjAwMDAwMDE4OTQgNjU1MzUgZg0KMDAwMDAwMTg5NSA2NTUzNSBm DQowMDAwMDAxODk2IDY1NTM1IGYNCjAwMDAwMDE4OTcgNjU1MzUgZg0KMDAwMDAwMTg5OCA2 NTUzNSBmDQowMDAwMDAxODk5IDY1NTM1IGYNCjAwMDAwMDE5MDAgNjU1MzUgZg0KMDAwMDAw MTkwMSA2NTUzNSBmDQowMDAwMDAxOTAyIDY1NTM1IGYNCjAwMDAwMDE5MDMgNjU1MzUgZg0K MDAwMDAwMTkwNCA2NTUzNSBmDQowMDAwMDAxOTA1IDY1NTM1IGYNCjAwMDAwMDE5MDYgNjU1 MzUgZg0KMDAwMDAwMTkwNyA2NTUzNSBmDQowMDAwMDAxOTA4IDY1NTM1IGYNCjAwMDAwMDE5 MDkgNjU1MzUgZg0KMDAwMDAwMTkxMCA2NTUzNSBmDQowMDAwMDAxOTExIDY1NTM1IGYNCjAw MDAwMDE5MTIgNjU1MzUgZg0KMDAwMDAwMTkxMyA2NTUzNSBmDQowMDAwMDAxOTE0IDY1NTM1 IGYNCjAwMDAwMDE5MTUgNjU1MzUgZg0KMDAwMDAwMTkxNiA2NTUzNSBmDQowMDAwMDAxOTE3 IDY1NTM1IGYNCjAwMDAwMDE5MTggNjU1MzUgZg0KMDAwMDAwMTkxOSA2NTUzNSBmDQowMDAw MDAxOTIwIDY1NTM1IGYNCjAwMDAwMDE5MjEgNjU1MzUgZg0KMDAwMDAwMTkyMiA2NTUzNSBm DQowMDAwMDAxOTIzIDY1NTM1IGYNCjAwMDAwMDE5MjQgNjU1MzUgZg0KMDAwMDAwMTkyNSA2 NTUzNSBmDQowMDAwMDAxOTI2IDY1NTM1IGYNCjAwMDAwMDE5MjcgNjU1MzUgZg0KMDAwMDAw MTkyOCA2NTUzNSBmDQowMDAwMDAxOTI5IDY1NTM1IGYNCjAwMDAwMDE5MzAgNjU1MzUgZg0K MDAwMDAwMTkzMSA2NTUzNSBmDQowMDAwMDAxOTMyIDY1NTM1IGYNCjAwMDAwMDE5MzMgNjU1 MzUgZg0KMDAwMDAwMTkzNCA2NTUzNSBmDQowMDAwMDAxOTM1IDY1NTM1IGYNCjAwMDAwMDE5 MzYgNjU1MzUgZg0KMDAwMDAwMTkzNyA2NTUzNSBmDQowMDAwMDAxOTM4IDY1NTM1IGYNCjAw MDAwMDE5MzkgNjU1MzUgZg0KMDAwMDAwMTk0MCA2NTUzNSBmDQowMDAwMDAxOTQxIDY1NTM1 IGYNCjAwMDAwMDE5NDIgNjU1MzUgZg0KMDAwMDAwMTk0MyA2NTUzNSBmDQowMDAwMDAxOTQ0 IDY1NTM1IGYNCjAwMDAwMDE5NDUgNjU1MzUgZg0KMDAwMDAwMTk0NiA2NTUzNSBmDQowMDAw MDAxOTQ3IDY1NTM1IGYNCjAwMDAwMDE5NDggNjU1MzUgZg0KMDAwMDAwMTk0OSA2NTUzNSBm DQowMDAwMDAxOTUwIDY1NTM1IGYNCjAwMDAwMDE5NTEgNjU1MzUgZg0KMDAwMDAwMTk1MiA2 NTUzNSBmDQowMDAwMDAxOTUzIDY1NTM1IGYNCjAwMDAwMDE5NTQgNjU1MzUgZg0KMDAwMDAw MTk1NSA2NTUzNSBmDQowMDAwMDAxOTU2IDY1NTM1IGYNCjAwMDAwMDE5NTcgNjU1MzUgZg0K MDAwMDAwMTk1OCA2NTUzNSBmDQowMDAwMDAxOTU5IDY1NTM1IGYNCjAwMDAwMDE5NjAgNjU1 MzUgZg0KMDAwMDAwMTk2MSA2NTUzNSBmDQowMDAwMDAxOTYyIDY1NTM1IGYNCjAwMDAwMDE5 NjMgNjU1MzUgZg0KMDAwMDAwMTk2NCA2NTUzNSBmDQowMDAwMDAxOTY1IDY1NTM1IGYNCjAw MDAwMDE5NjYgNjU1MzUgZg0KMDAwMDAwMTk2NyA2NTUzNSBmDQowMDAwMDAxOTY4IDY1NTM1 IGYNCjAwMDAwMDE5NjkgNjU1MzUgZg0KMDAwMDAwMTk3MCA2NTUzNSBmDQowMDAwMDAxOTcx IDY1NTM1IGYNCjAwMDAwMDE5NzIgNjU1MzUgZg0KMDAwMDAwMTk3MyA2NTUzNSBmDQowMDAw MDAxOTc0IDY1NTM1IGYNCjAwMDAwMDE5NzUgNjU1MzUgZg0KMDAwMDAwMTk3NiA2NTUzNSBm DQowMDAwMDAxOTc3IDY1NTM1IGYNCjAwMDAwMDE5NzggNjU1MzUgZg0KMDAwMDAwMTk3OSA2 NTUzNSBmDQowMDAwMDAxOTgwIDY1NTM1IGYNCjAwMDAwMDE5ODEgNjU1MzUgZg0KMDAwMDAw MTk4MiA2NTUzNSBmDQowMDAwMDAxOTgzIDY1NTM1IGYNCjAwMDAwMDE5ODQgNjU1MzUgZg0K MDAwMDAwMTk4NSA2NTUzNSBmDQowMDAwMDAxOTg2IDY1NTM1IGYNCjAwMDAwMDE5ODcgNjU1 MzUgZg0KMDAwMDAwMTk4OCA2NTUzNSBmDQowMDAwMDAxOTg5IDY1NTM1IGYNCjAwMDAwMDE5 OTAgNjU1MzUgZg0KMDAwMDAwMTk5MSA2NTUzNSBmDQowMDAwMDAxOTkyIDY1NTM1IGYNCjAw MDAwMDE5OTMgNjU1MzUgZg0KMDAwMDAwMTk5NCA2NTUzNSBmDQowMDAwMDAxOTk1IDY1NTM1 IGYNCjAwMDAwMDE5OTYgNjU1MzUgZg0KMDAwMDAwMTk5NyA2NTUzNSBmDQowMDAwMDAxOTk4 IDY1NTM1IGYNCjAwMDAwMDE5OTkgNjU1MzUgZg0KMDAwMDAwMjAwMCA2NTUzNSBmDQowMDAw MDAyMDAxIDY1NTM1IGYNCjAwMDAwMDIwMDIgNjU1MzUgZg0KMDAwMDAwMjAwMyA2NTUzNSBm DQowMDAwMDAyMDA0IDY1NTM1IGYNCjAwMDAwMDIwMDUgNjU1MzUgZg0KMDAwMDAwMjAwNiA2 NTUzNSBmDQowMDAwMDAyMDA3IDY1NTM1IGYNCjAwMDAwMDIwMDggNjU1MzUgZg0KMDAwMDAw MjAwOSA2NTUzNSBmDQowMDAwMDAyMDEwIDY1NTM1IGYNCjAwMDAwMDIwMTEgNjU1MzUgZg0K MDAwMDAwMjAxMiA2NTUzNSBmDQowMDAwMDAyMDEzIDY1NTM1IGYNCjAwMDAwMDIwMTQgNjU1 MzUgZg0KMDAwMDAwMjAxNSA2NTUzNSBmDQowMDAwMDAyMDE2IDY1NTM1IGYNCjAwMDAwMDIw MTcgNjU1MzUgZg0KMDAwMDAwMjAxOCA2NTUzNSBmDQowMDAwMDAyMDE5IDY1NTM1IGYNCjAw MDAwMDIwMjAgNjU1MzUgZg0KMDAwMDAwMjAyMSA2NTUzNSBmDQowMDAwMDAyMDIyIDY1NTM1 IGYNCjAwMDAwMDIwMjMgNjU1MzUgZg0KMDAwMDAwMjAyNCA2NTUzNSBmDQowMDAwMDAyMDI1 IDY1NTM1IGYNCjAwMDAwMDIwMjYgNjU1MzUgZg0KMDAwMDAwMjAyNyA2NTUzNSBmDQowMDAw MDAyMDI4IDY1NTM1IGYNCjAwMDAwMDIwMjkgNjU1MzUgZg0KMDAwMDAwMjAzMCA2NTUzNSBm DQowMDAwMDAyMDMxIDY1NTM1IGYNCjAwMDAwMDIwMzIgNjU1MzUgZg0KMDAwMDAwMjAzMyA2 NTUzNSBmDQowMDAwMDAyMDM0IDY1NTM1IGYNCjAwMDAwMDIwMzUgNjU1MzUgZg0KMDAwMDAw MjAzNiA2NTUzNSBmDQowMDAwMDAyMDM3IDY1NTM1IGYNCjAwMDAwMDIwMzggNjU1MzUgZg0K MDAwMDAwMjAzOSA2NTUzNSBmDQowMDAwMDAyMDQwIDY1NTM1IGYNCjAwMDAwMDIwNDEgNjU1 MzUgZg0KMDAwMDAwMjA0MiA2NTUzNSBmDQowMDAwMDAyMDQzIDY1NTM1IGYNCjAwMDAwMDIw NDQgNjU1MzUgZg0KMDAwMDAwMjA0NiA2NTUzNSBmDQowMDAwNTEyMzU2IDAwMDAwIG4NCjAw MDAwMDIwNDcgNjU1MzUgZg0KMDAwMDAwMjA0OCA2NTUzNSBmDQowMDAwMDAyMDQ5IDY1NTM1 IGYNCjAwMDAwMDIwNTAgNjU1MzUgZg0KMDAwMDAwMjA1MSA2NTUzNSBmDQowMDAwMDAyMDUz IDY1NTM1IGYNCjAwMDA1MTI0MDggMDAwMDAgbg0KMDAwMDAwMjA1NCA2NTUzNSBmDQowMDAw MDAyMDU1IDY1NTM1IGYNCjAwMDAwMDIwNTYgNjU1MzUgZg0KMDAwMDAwMjA1OCA2NTUzNSBm DQowMDAwNTEyNDYyIDAwMDAwIG4NCjAwMDAwMDIwNTkgNjU1MzUgZg0KMDAwMDAwMjA2MCA2 NTUzNSBmDQowMDAwMDAyMDYxIDY1NTM1IGYNCjAwMDAwMDIwNjIgNjU1MzUgZg0KMDAwMDAw MjA2MyA2NTUzNSBmDQowMDAwMDAyMDY0IDY1NTM1IGYNCjAwMDAwMDIwNjUgNjU1MzUgZg0K MDAwMDAwMjA2NyA2NTUzNSBmDQowMDAwNTEyNTE2IDAwMDAwIG4NCjAwMDAwMDIwNjggNjU1 MzUgZg0KMDAwMDAwMjA2OSA2NTUzNSBmDQowMDAwMDAyMDcwIDY1NTM1IGYNCjAwMDAwMDIw NzEgNjU1MzUgZg0KMDAwMDAwMjA3MiA2NTUzNSBmDQowMDAwMDAyMDczIDY1NTM1IGYNCjAw MDAwMDIwNzQgNjU1MzUgZg0KMDAwMDAwMjA3NiA2NTUzNSBmDQowMDAwNTEyNTcwIDAwMDAw IG4NCjAwMDAwMDIwNzcgNjU1MzUgZg0KMDAwMDAwMjA3OCA2NTUzNSBmDQowMDAwMDAyMDc5 IDY1NTM1IGYNCjAwMDAwMDIwODAgNjU1MzUgZg0KMDAwMDAwMjA4MSA2NTUzNSBmDQowMDAw MDAyMDgyIDY1NTM1IGYNCjAwMDAwMDIwODMgNjU1MzUgZg0KMDAwMDAwMjA4NCA2NTUzNSBm DQowMDAwMDAyMDg1IDY1NTM1IGYNCjAwMDAwMDIwODYgNjU1MzUgZg0KMDAwMDAwMjA4NyA2 NTUzNSBmDQowMDAwMDAyMDg4IDY1NTM1IGYNCjAwMDAwMDIwODkgNjU1MzUgZg0KMDAwMDAw MjA5MCA2NTUzNSBmDQowMDAwMDAyMDkxIDY1NTM1IGYNCjAwMDAwMDIwOTIgNjU1MzUgZg0K MDAwMDAwMjA5MyA2NTUzNSBmDQowMDAwMDAyMDk1IDY1NTM1IGYNCjAwMDA1MTI2MjIgMDAw MDAgbg0KMDAwMDAwMjA5NiA2NTUzNSBmDQowMDAwMDAyMDk3IDY1NTM1IGYNCjAwMDAwMDIw OTggNjU1MzUgZg0KMDAwMDAwMjA5OSA2NTUzNSBmDQowMDAwMDAyMTAwIDY1NTM1IGYNCjAw MDAwMDIxMDEgNjU1MzUgZg0KMDAwMDAwMjEwMiA2NTUzNSBmDQowMDAwMDAyMTAzIDY1NTM1 IGYNCjAwMDAwMDIxMDUgNjU1MzUgZg0KMDAwMDUxMjY3NiAwMDAwMCBuDQowMDAwMDAyMTA2 IDY1NTM1IGYNCjAwMDAwMDIxMDcgNjU1MzUgZg0KMDAwMDAwMjEwOCA2NTUzNSBmDQowMDAw MDAyMTA5IDY1NTM1IGYNCjAwMDAwMDIxMTAgNjU1MzUgZg0KMDAwMDAwMjExMSA2NTUzNSBm DQowMDAwMDAyMTEyIDY1NTM1IGYNCjAwMDAwMDIxMTMgNjU1MzUgZg0KMDAwMDAwMjExNCA2 NTUzNSBmDQowMDAwMDAyMTE1IDY1NTM1IGYNCjAwMDAwMDIxMTYgNjU1MzUgZg0KMDAwMDAw MjExNyA2NTUzNSBmDQowMDAwMDAyMTE4IDY1NTM1IGYNCjAwMDAwMDIxMTkgNjU1MzUgZg0K MDAwMDAwMjEyMCA2NTUzNSBmDQowMDAwMDAyMTIxIDY1NTM1IGYNCjAwMDAwMDIxMjIgNjU1 MzUgZg0KMDAwMDAwMjEyMyA2NTUzNSBmDQowMDAwMDAyMTI0IDY1NTM1IGYNCjAwMDAwMDIx MjUgNjU1MzUgZg0KMDAwMDAwMjEyNiA2NTUzNSBmDQowMDAwMDAyMTI3IDY1NTM1IGYNCjAw MDAwMDIxMjggNjU1MzUgZg0KMDAwMDAwMjEyOSA2NTUzNSBmDQowMDAwMDAyMTMwIDY1NTM1 IGYNCjAwMDAwMDIxMzEgNjU1MzUgZg0KMDAwMDAwMjEzMiA2NTUzNSBmDQowMDAwMDAyMTMz IDY1NTM1IGYNCjAwMDAwMDIxMzQgNjU1MzUgZg0KMDAwMDAwMjEzNSA2NTUzNSBmDQowMDAw MDAyMTM2IDY1NTM1IGYNCjAwMDAwMDIxMzcgNjU1MzUgZg0KMDAwMDAwMjEzOCA2NTUzNSBm DQowMDAwMDAyMTM5IDY1NTM1IGYNCjAwMDAwMDIxNDAgNjU1MzUgZg0KMDAwMDAwMjE0MSA2 NTUzNSBmDQowMDAwMDAyMTQyIDY1NTM1IGYNCjAwMDAwMDIxNDMgNjU1MzUgZg0KMDAwMDAw MjE0NCA2NTUzNSBmDQowMDAwMDAyMTQ1IDY1NTM1IGYNCjAwMDAwMDIxNDYgNjU1MzUgZg0K MDAwMDAwMjE0NyA2NTUzNSBmDQowMDAwMDAyMTQ4IDY1NTM1IGYNCjAwMDAwMDIxNDkgNjU1 MzUgZg0KMDAwMDAwMjE1MCA2NTUzNSBmDQowMDAwMDAyMTUxIDY1NTM1IGYNCjAwMDAwMDIx NTIgNjU1MzUgZg0KMDAwMDAwMjE1MyA2NTUzNSBmDQowMDAwMDAyMTU0IDY1NTM1IGYNCjAw MDAwMDIxNTUgNjU1MzUgZg0KMDAwMDAwMjE1NiA2NTUzNSBmDQowMDAwMDAyMTU3IDY1NTM1 IGYNCjAwMDAwMDIxNTggNjU1MzUgZg0KMDAwMDAwMjE1OSA2NTUzNSBmDQowMDAwMDAyMTYw IDY1NTM1IGYNCjAwMDAwMDIxNjEgNjU1MzUgZg0KMDAwMDAwMjE2MiA2NTUzNSBmDQowMDAw MDAyMTYzIDY1NTM1IGYNCjAwMDAwMDIxNjQgNjU1MzUgZg0KMDAwMDAwMjE2NSA2NTUzNSBm DQowMDAwMDAyMTY2IDY1NTM1IGYNCjAwMDAwMDIxNjcgNjU1MzUgZg0KMDAwMDAwMjE2OCA2 NTUzNSBmDQowMDAwMDAyMTY5IDY1NTM1IGYNCjAwMDAwMDIxNzAgNjU1MzUgZg0KMDAwMDAw MjE3MSA2NTUzNSBmDQowMDAwMDAyMTcyIDY1NTM1IGYNCjAwMDAwMDIxNzMgNjU1MzUgZg0K MDAwMDAwMjE3NCA2NTUzNSBmDQowMDAwMDAyMTc1IDY1NTM1IGYNCjAwMDAwMDIxNzYgNjU1 MzUgZg0KMDAwMDAwMjE3NyA2NTUzNSBmDQowMDAwMDAyMTc4IDY1NTM1IGYNCjAwMDAwMDIx NzkgNjU1MzUgZg0KMDAwMDAwMjE4MCA2NTUzNSBmDQowMDAwMDAyMTgxIDY1NTM1IGYNCjAw MDAwMDIxODIgNjU1MzUgZg0KMDAwMDAwMjE4MyA2NTUzNSBmDQowMDAwMDAyMTg0IDY1NTM1 IGYNCjAwMDAwMDIxODUgNjU1MzUgZg0KMDAwMDAwMjE4NiA2NTUzNSBmDQowMDAwMDAyMTg3 IDY1NTM1IGYNCjAwMDAwMDIxODggNjU1MzUgZg0KMDAwMDAwMjE4OSA2NTUzNSBmDQowMDAw MDAyMTkwIDY1NTM1IGYNCjAwMDAwMDIxOTEgNjU1MzUgZg0KMDAwMDAwMjE5MiA2NTUzNSBm DQowMDAwMDAyMTkzIDY1NTM1IGYNCjAwMDAwMDIxOTQgNjU1MzUgZg0KMDAwMDAwMjE5NSA2 NTUzNSBmDQowMDAwMDAyMTk2IDY1NTM1IGYNCjAwMDAwMDIxOTcgNjU1MzUgZg0KMDAwMDAw MjE5OCA2NTUzNSBmDQowMDAwMDAyMTk5IDY1NTM1IGYNCjAwMDAwMDIyMDAgNjU1MzUgZg0K MDAwMDAwMjIwMSA2NTUzNSBmDQowMDAwMDAyMjAyIDY1NTM1IGYNCjAwMDAwMDIyMDMgNjU1 MzUgZg0KMDAwMDAwMjIwNCA2NTUzNSBmDQowMDAwMDAyMjA1IDY1NTM1IGYNCjAwMDAwMDIy MDYgNjU1MzUgZg0KMDAwMDAwMjIwNyA2NTUzNSBmDQowMDAwMDAyMjA4IDY1NTM1IGYNCjAw MDAwMDIyMDkgNjU1MzUgZg0KMDAwMDAwMjIxMCA2NTUzNSBmDQowMDAwMDAyMjExIDY1NTM1 IGYNCjAwMDAwMDIyMTIgNjU1MzUgZg0KMDAwMDAwMjIxMyA2NTUzNSBmDQowMDAwMDAyMjE0 IDY1NTM1IGYNCjAwMDAwMDIyMTUgNjU1MzUgZg0KMDAwMDAwMjIxNiA2NTUzNSBmDQowMDAw MDAyMjE3IDY1NTM1IGYNCjAwMDAwMDIyMTggNjU1MzUgZg0KMDAwMDAwMjIxOSA2NTUzNSBm DQowMDAwMDAyMjIwIDY1NTM1IGYNCjAwMDAwMDIyMjEgNjU1MzUgZg0KMDAwMDAwMjIyMiA2 NTUzNSBmDQowMDAwMDAyMjIzIDY1NTM1IGYNCjAwMDAwMDIyMjQgNjU1MzUgZg0KMDAwMDAw MjIyNSA2NTUzNSBmDQowMDAwMDAyMjI2IDY1NTM1IGYNCjAwMDAwMDIyMjcgNjU1MzUgZg0K MDAwMDAwMjIyOCA2NTUzNSBmDQowMDAwMDAyMjI5IDY1NTM1IGYNCjAwMDAwMDIyMzAgNjU1 MzUgZg0KMDAwMDAwMjIzMSA2NTUzNSBmDQowMDAwMDAyMjMyIDY1NTM1IGYNCjAwMDAwMDIy MzMgNjU1MzUgZg0KMDAwMDAwMjIzNCA2NTUzNSBmDQowMDAwMDAyMjM1IDY1NTM1IGYNCjAw MDAwMDIyMzYgNjU1MzUgZg0KMDAwMDAwMjIzNyA2NTUzNSBmDQowMDAwMDAyMjM4IDY1NTM1 IGYNCjAwMDAwMDIyMzkgNjU1MzUgZg0KMDAwMDAwMjI0MCA2NTUzNSBmDQowMDAwMDAyMjQx IDY1NTM1IGYNCjAwMDAwMDIyNDIgNjU1MzUgZg0KMDAwMDAwMjI0MyA2NTUzNSBmDQowMDAw MDAyMjQ0IDY1NTM1IGYNCjAwMDAwMDIyNDUgNjU1MzUgZg0KMDAwMDAwMjI0NiA2NTUzNSBm DQowMDAwMDAyMjQ3IDY1NTM1IGYNCjAwMDAwMDIyNDggNjU1MzUgZg0KMDAwMDAwMjI0OSA2 NTUzNSBmDQowMDAwMDAyMjUwIDY1NTM1IGYNCjAwMDAwMDIyNTEgNjU1MzUgZg0KMDAwMDAw MjI1MiA2NTUzNSBmDQowMDAwMDAyMjUzIDY1NTM1IGYNCjAwMDAwMDIyNTQgNjU1MzUgZg0K MDAwMDAwMjI1NSA2NTUzNSBmDQowMDAwMDAyMjU2IDY1NTM1IGYNCjAwMDAwMDIyNTcgNjU1 MzUgZg0KMDAwMDAwMjI1OCA2NTUzNSBmDQowMDAwMDAyMjU5IDY1NTM1IGYNCjAwMDAwMDIy NjAgNjU1MzUgZg0KMDAwMDAwMjI2MSA2NTUzNSBmDQowMDAwMDAyMjYyIDY1NTM1IGYNCjAw MDAwMDIyNjMgNjU1MzUgZg0KMDAwMDAwMjI2NCA2NTUzNSBmDQowMDAwMDAyMjY1IDY1NTM1 IGYNCjAwMDAwMDIyNjYgNjU1MzUgZg0KMDAwMDAwMjI2NyA2NTUzNSBmDQowMDAwMDAyMjY4 IDY1NTM1IGYNCjAwMDAwMDIyNjkgNjU1MzUgZg0KMDAwMDAwMjI3MCA2NTUzNSBmDQowMDAw MDAyMjcxIDY1NTM1IGYNCjAwMDAwMDIyNzIgNjU1MzUgZg0KMDAwMDAwMjI3MyA2NTUzNSBm DQowMDAwMDAyMjc0IDY1NTM1IGYNCjAwMDAwMDIyNzUgNjU1MzUgZg0KMDAwMDAwMjI3NiA2 NTUzNSBmDQowMDAwMDAyMjc3IDY1NTM1IGYNCjAwMDAwMDIyNzggNjU1MzUgZg0KMDAwMDAw MjI3OSA2NTUzNSBmDQowMDAwMDAyMjgwIDY1NTM1IGYNCjAwMDAwMDIyODEgNjU1MzUgZg0K MDAwMDAwMjI4MiA2NTUzNSBmDQowMDAwMDAyMjgzIDY1NTM1IGYNCjAwMDAwMDIyODQgNjU1 MzUgZg0KMDAwMDAwMjI4NSA2NTUzNSBmDQowMDAwMDAyMjg2IDY1NTM1IGYNCjAwMDAwMDIy ODcgNjU1MzUgZg0KMDAwMDAwMjI4OCA2NTUzNSBmDQowMDAwMDAyMjg5IDY1NTM1IGYNCjAw MDAwMDIyOTAgNjU1MzUgZg0KMDAwMDAwMjI5MSA2NTUzNSBmDQowMDAwMDAyMjkyIDY1NTM1 IGYNCjAwMDAwMDIyOTMgNjU1MzUgZg0KMDAwMDAwMjI5NCA2NTUzNSBmDQowMDAwMDAyMjk1 IDY1NTM1IGYNCjAwMDAwMDIyOTYgNjU1MzUgZg0KMDAwMDAwMjI5NyA2NTUzNSBmDQowMDAw MDAyMjk4IDY1NTM1IGYNCjAwMDAwMDIyOTkgNjU1MzUgZg0KMDAwMDAwMjMwMCA2NTUzNSBm DQowMDAwMDAyMzAxIDY1NTM1IGYNCjAwMDAwMDIzMDIgNjU1MzUgZg0KMDAwMDAwMjMwMyA2 NTUzNSBmDQowMDAwMDAyMzA0IDY1NTM1IGYNCjAwMDAwMDIzMDUgNjU1MzUgZg0KMDAwMDAw MjMwNiA2NTUzNSBmDQowMDAwMDAyMzA3IDY1NTM1IGYNCjAwMDAwMDIzMDggNjU1MzUgZg0K MDAwMDAwMjMwOSA2NTUzNSBmDQowMDAwMDAyMzEwIDY1NTM1IGYNCjAwMDAwMDIzMTEgNjU1 MzUgZg0KMDAwMDAwMjMxMiA2NTUzNSBmDQowMDAwMDAyMzEzIDY1NTM1IGYNCjAwMDAwMDIz MTQgNjU1MzUgZg0KMDAwMDAwMjMxNSA2NTUzNSBmDQowMDAwMDAyMzE2IDY1NTM1IGYNCjAw MDAwMDIzMTcgNjU1MzUgZg0KMDAwMDAwMjMxOCA2NTUzNSBmDQowMDAwMDAyMzE5IDY1NTM1 IGYNCjAwMDAwMDIzMjAgNjU1MzUgZg0KMDAwMDAwMjMyMSA2NTUzNSBmDQowMDAwMDAyMzIy IDY1NTM1IGYNCjAwMDAwMDIzMjMgNjU1MzUgZg0KMDAwMDAwMjMyNCA2NTUzNSBmDQowMDAw MDAyMzI1IDY1NTM1IGYNCjAwMDAwMDIzMjYgNjU1MzUgZg0KMDAwMDAwMjMyNyA2NTUzNSBm DQowMDAwMDAyMzI4IDY1NTM1IGYNCjAwMDAwMDIzMjkgNjU1MzUgZg0KMDAwMDAwMjMzMCA2 NTUzNSBmDQowMDAwMDAyMzMxIDY1NTM1IGYNCjAwMDAwMDIzMzIgNjU1MzUgZg0KMDAwMDAw MjMzMyA2NTUzNSBmDQowMDAwMDAyMzM0IDY1NTM1IGYNCjAwMDAwMDIzMzUgNjU1MzUgZg0K MDAwMDAwMjMzNiA2NTUzNSBmDQowMDAwMDAyMzM3IDY1NTM1IGYNCjAwMDAwMDIzMzggNjU1 MzUgZg0KMDAwMDAwMjMzOSA2NTUzNSBmDQowMDAwMDAyMzQwIDY1NTM1IGYNCjAwMDAwMDIz NDEgNjU1MzUgZg0KMDAwMDAwMjM0MiA2NTUzNSBmDQowMDAwMDAyMzQzIDY1NTM1IGYNCjAw MDAwMDIzNDQgNjU1MzUgZg0KMDAwMDAwMjM0NSA2NTUzNSBmDQowMDAwMDAyMzQ2IDY1NTM1 IGYNCjAwMDAwMDIzNDcgNjU1MzUgZg0KMDAwMDAwMjM0OCA2NTUzNSBmDQowMDAwMDAyMzQ5 IDY1NTM1IGYNCjAwMDAwMDIzNTAgNjU1MzUgZg0KMDAwMDAwMjM1MSA2NTUzNSBmDQowMDAw MDAyMzUyIDY1NTM1IGYNCjAwMDAwMDIzNTMgNjU1MzUgZg0KMDAwMDAwMjM1NCA2NTUzNSBm DQowMDAwMDAyMzU1IDY1NTM1IGYNCjAwMDAwMDIzNTYgNjU1MzUgZg0KMDAwMDAwMjM1NyA2 NTUzNSBmDQowMDAwMDAyMzU4IDY1NTM1IGYNCjAwMDAwMDIzNTkgNjU1MzUgZg0KMDAwMDAw MjM2MCA2NTUzNSBmDQowMDAwMDAyMzYxIDY1NTM1IGYNCjAwMDAwMDIzNjIgNjU1MzUgZg0K MDAwMDAwMjM2MyA2NTUzNSBmDQowMDAwMDAyMzY0IDY1NTM1IGYNCjAwMDAwMDIzNjUgNjU1 MzUgZg0KMDAwMDAwMjM2NiA2NTUzNSBmDQowMDAwMDAyMzY3IDY1NTM1IGYNCjAwMDAwMDIz NjggNjU1MzUgZg0KMDAwMDAwMjM2OSA2NTUzNSBmDQowMDAwMDAyMzcwIDY1NTM1IGYNCjAw MDAwMDIzNzEgNjU1MzUgZg0KMDAwMDAwMjM3MiA2NTUzNSBmDQowMDAwMDAyMzczIDY1NTM1 IGYNCjAwMDAwMDIzNzQgNjU1MzUgZg0KMDAwMDAwMjM3NSA2NTUzNSBmDQowMDAwMDAyMzc2 IDY1NTM1IGYNCjAwMDAwMDIzNzcgNjU1MzUgZg0KMDAwMDAwMjM3OCA2NTUzNSBmDQowMDAw MDAyMzc5IDY1NTM1IGYNCjAwMDAwMDIzODAgNjU1MzUgZg0KMDAwMDAwMjM4MSA2NTUzNSBm DQowMDAwMDAyMzgyIDY1NTM1IGYNCjAwMDAwMDIzODMgNjU1MzUgZg0KMDAwMDAwMjM4NCA2 NTUzNSBmDQowMDAwMDAyMzg1IDY1NTM1IGYNCjAwMDAwMDIzODYgNjU1MzUgZg0KMDAwMDAw MjM4NyA2NTUzNSBmDQowMDAwMDAyMzg4IDY1NTM1IGYNCjAwMDAwMDIzODkgNjU1MzUgZg0K MDAwMDAwMjM5MCA2NTUzNSBmDQowMDAwMDAyMzkxIDY1NTM1IGYNCjAwMDAwMDIzOTIgNjU1 MzUgZg0KMDAwMDAwMjM5MyA2NTUzNSBmDQowMDAwMDAyMzk0IDY1NTM1IGYNCjAwMDAwMDIz OTUgNjU1MzUgZg0KMDAwMDAwMjM5NiA2NTUzNSBmDQowMDAwMDAyMzk3IDY1NTM1IGYNCjAw MDAwMDIzOTggNjU1MzUgZg0KMDAwMDAwMjM5OSA2NTUzNSBmDQowMDAwMDAyNDAwIDY1NTM1 IGYNCjAwMDAwMDI0MDEgNjU1MzUgZg0KMDAwMDAwMjQwMiA2NTUzNSBmDQowMDAwMDAyNDAz IDY1NTM1IGYNCjAwMDAwMDI0MDQgNjU1MzUgZg0KMDAwMDAwMjQwNSA2NTUzNSBmDQowMDAw MDAyNDA2IDY1NTM1IGYNCjAwMDAwMDI0MDcgNjU1MzUgZg0KMDAwMDAwMjQwOCA2NTUzNSBm DQowMDAwMDAyNDA5IDY1NTM1IGYNCjAwMDAwMDI0MTAgNjU1MzUgZg0KMDAwMDAwMjQxMSA2 NTUzNSBmDQowMDAwMDAyNDEyIDY1NTM1IGYNCjAwMDAwMDI0MTMgNjU1MzUgZg0KMDAwMDAw MjQxNCA2NTUzNSBmDQowMDAwMDAyNDE1IDY1NTM1IGYNCjAwMDAwMDI0MTYgNjU1MzUgZg0K MDAwMDAwMjQxNyA2NTUzNSBmDQowMDAwMDAyNDE4IDY1NTM1IGYNCjAwMDAwMDI0MTkgNjU1 MzUgZg0KMDAwMDAwMjQyMCA2NTUzNSBmDQowMDAwMDAyNDIxIDY1NTM1IGYNCjAwMDAwMDI0 MjIgNjU1MzUgZg0KMDAwMDAwMjQyMyA2NTUzNSBmDQowMDAwMDAyNDI0IDY1NTM1IGYNCjAw MDAwMDI0MjUgNjU1MzUgZg0KMDAwMDAwMjQyNiA2NTUzNSBmDQowMDAwMDAyNDI3IDY1NTM1 IGYNCjAwMDAwMDI0MjggNjU1MzUgZg0KMDAwMDAwMjQyOSA2NTUzNSBmDQowMDAwMDAyNDMw IDY1NTM1IGYNCjAwMDAwMDI0MzEgNjU1MzUgZg0KMDAwMDAwMjQzMiA2NTUzNSBmDQowMDAw MDAyNDMzIDY1NTM1IGYNCjAwMDAwMDI0MzQgNjU1MzUgZg0KMDAwMDAwMjQzNSA2NTUzNSBm DQowMDAwMDAyNDM2IDY1NTM1IGYNCjAwMDAwMDI0MzcgNjU1MzUgZg0KMDAwMDAwMjQzOCA2 NTUzNSBmDQowMDAwMDAyNDM5IDY1NTM1IGYNCjAwMDAwMDI0NDAgNjU1MzUgZg0KMDAwMDAw MjQ0MSA2NTUzNSBmDQowMDAwMDAyNDQyIDY1NTM1IGYNCjAwMDAwMDI0NDMgNjU1MzUgZg0K MDAwMDAwMjQ0NCA2NTUzNSBmDQowMDAwMDAyNDQ1IDY1NTM1IGYNCjAwMDAwMDI0NDYgNjU1 MzUgZg0KMDAwMDAwMjQ0NyA2NTUzNSBmDQowMDAwMDAyNDQ4IDY1NTM1IGYNCjAwMDAwMDI0 NDkgNjU1MzUgZg0KMDAwMDAwMjQ1MCA2NTUzNSBmDQowMDAwMDAyNDUxIDY1NTM1IGYNCjAw MDAwMDI0NTIgNjU1MzUgZg0KMDAwMDAwMjQ1MyA2NTUzNSBmDQowMDAwMDAyNDU0IDY1NTM1 IGYNCjAwMDAwMDI0NTUgNjU1MzUgZg0KMDAwMDAwMjQ1NiA2NTUzNSBmDQowMDAwMDAyNDU3 IDY1NTM1IGYNCjAwMDAwMDI0NTggNjU1MzUgZg0KMDAwMDAwMjQ1OSA2NTUzNSBmDQowMDAw MDAyNDYwIDY1NTM1IGYNCjAwMDAwMDI0NjEgNjU1MzUgZg0KMDAwMDAwMjQ2MiA2NTUzNSBm DQowMDAwMDAyNDYzIDY1NTM1IGYNCjAwMDAwMDI0NjQgNjU1MzUgZg0KMDAwMDAwMjQ2NSA2 NTUzNSBmDQowMDAwMDAyNDY2IDY1NTM1IGYNCjAwMDAwMDI0NjcgNjU1MzUgZg0KMDAwMDAw MjQ2OCA2NTUzNSBmDQowMDAwMDAyNDY5IDY1NTM1IGYNCjAwMDAwMDI0NzAgNjU1MzUgZg0K MDAwMDAwMjQ3MSA2NTUzNSBmDQowMDAwMDAyNDcyIDY1NTM1IGYNCjAwMDAwMDI0NzMgNjU1 MzUgZg0KMDAwMDAwMjQ3NCA2NTUzNSBmDQowMDAwMDAyNDc1IDY1NTM1IGYNCjAwMDAwMDI0 NzYgNjU1MzUgZg0KMDAwMDAwMjQ3NyA2NTUzNSBmDQowMDAwMDAyNDc4IDY1NTM1IGYNCjAw MDAwMDI0NzkgNjU1MzUgZg0KMDAwMDAwMjQ4MCA2NTUzNSBmDQowMDAwMDAyNDgxIDY1NTM1 IGYNCjAwMDAwMDI0ODIgNjU1MzUgZg0KMDAwMDAwMjQ4MyA2NTUzNSBmDQowMDAwMDAyNDg0 IDY1NTM1IGYNCjAwMDAwMDI0ODUgNjU1MzUgZg0KMDAwMDAwMjQ4NiA2NTUzNSBmDQowMDAw MDAyNDg3IDY1NTM1IGYNCjAwMDAwMDI0ODggNjU1MzUgZg0KMDAwMDAwMjQ4OSA2NTUzNSBm DQowMDAwMDAyNDkwIDY1NTM1IGYNCjAwMDAwMDI0OTEgNjU1MzUgZg0KMDAwMDAwMjQ5MiA2 NTUzNSBmDQowMDAwMDAyNDkzIDY1NTM1IGYNCjAwMDAwMDI0OTQgNjU1MzUgZg0KMDAwMDAw MjQ5NSA2NTUzNSBmDQowMDAwMDAyNDk2IDY1NTM1IGYNCjAwMDAwMDI0OTcgNjU1MzUgZg0K MDAwMDAwMjQ5OCA2NTUzNSBmDQowMDAwMDAyNDk5IDY1NTM1IGYNCjAwMDAwMDI1MDAgNjU1 MzUgZg0KMDAwMDAwMjUwMSA2NTUzNSBmDQowMDAwMDAyNTAyIDY1NTM1IGYNCjAwMDAwMDI1 MDMgNjU1MzUgZg0KMDAwMDAwMjUwNCA2NTUzNSBmDQowMDAwMDAyNTA1IDY1NTM1IGYNCjAw MDAwMDI1MDYgNjU1MzUgZg0KMDAwMDAwMjUwNyA2NTUzNSBmDQowMDAwMDAyNTA4IDY1NTM1 IGYNCjAwMDAwMDI1MDkgNjU1MzUgZg0KMDAwMDAwMjUxMCA2NTUzNSBmDQowMDAwMDAyNTEx IDY1NTM1IGYNCjAwMDAwMDI1MTIgNjU1MzUgZg0KMDAwMDAwMjUxMyA2NTUzNSBmDQowMDAw MDAyNTE0IDY1NTM1IGYNCjAwMDAwMDI1MTUgNjU1MzUgZg0KMDAwMDAwMjUxNiA2NTUzNSBm DQowMDAwMDAyNTE3IDY1NTM1IGYNCjAwMDAwMDI1MTggNjU1MzUgZg0KMDAwMDAwMjUxOSA2 NTUzNSBmDQowMDAwMDAyNTIwIDY1NTM1IGYNCjAwMDAwMDI1MjEgNjU1MzUgZg0KMDAwMDAw MjUyMiA2NTUzNSBmDQowMDAwMDAyNTIzIDY1NTM1IGYNCjAwMDAwMDI1MjQgNjU1MzUgZg0K MDAwMDAwMjUyNSA2NTUzNSBmDQowMDAwMDAyNTI2IDY1NTM1IGYNCjAwMDAwMDI1MjcgNjU1 MzUgZg0KMDAwMDAwMjUyOCA2NTUzNSBmDQowMDAwMDAyNTI5IDY1NTM1IGYNCjAwMDAwMDI1 MzAgNjU1MzUgZg0KMDAwMDAwMjUzMSA2NTUzNSBmDQowMDAwMDAyNTMyIDY1NTM1IGYNCjAw MDAwMDI1MzMgNjU1MzUgZg0KMDAwMDAwMjUzNCA2NTUzNSBmDQowMDAwMDAyNTM1IDY1NTM1 IGYNCjAwMDAwMDI1MzYgNjU1MzUgZg0KMDAwMDAwMjUzNyA2NTUzNSBmDQowMDAwMDAyNTM4 IDY1NTM1IGYNCjAwMDAwMDI1MzkgNjU1MzUgZg0KMDAwMDAwMjU0MCA2NTUzNSBmDQowMDAw MDAyNTQxIDY1NTM1IGYNCjAwMDAwMDI1NDIgNjU1MzUgZg0KMDAwMDAwMjU0MyA2NTUzNSBm DQowMDAwMDAyNTQ0IDY1NTM1IGYNCjAwMDAwMDI1NDUgNjU1MzUgZg0KMDAwMDAwMjU0NiA2 NTUzNSBmDQowMDAwMDAyNTQ3IDY1NTM1IGYNCjAwMDAwMDI1NDggNjU1MzUgZg0KMDAwMDAw MjU0OSA2NTUzNSBmDQowMDAwMDAyNTUwIDY1NTM1IGYNCjAwMDAwMDI1NTEgNjU1MzUgZg0K MDAwMDAwMjU1MiA2NTUzNSBmDQowMDAwMDAyNTUzIDY1NTM1IGYNCjAwMDAwMDI1NTQgNjU1 MzUgZg0KMDAwMDAwMjU1NSA2NTUzNSBmDQowMDAwMDAyNTU2IDY1NTM1IGYNCjAwMDAwMDI1 NTcgNjU1MzUgZg0KMDAwMDAwMjU1OCA2NTUzNSBmDQowMDAwMDAyNTU5IDY1NTM1IGYNCjAw MDAwMDI1NjAgNjU1MzUgZg0KMDAwMDAwMjU2MSA2NTUzNSBmDQowMDAwMDAyNTYyIDY1NTM1 IGYNCjAwMDAwMDI1NjMgNjU1MzUgZg0KMDAwMDAwMjU2NCA2NTUzNSBmDQowMDAwMDAyNTY1 IDY1NTM1IGYNCjAwMDAwMDI1NjYgNjU1MzUgZg0KMDAwMDAwMjU2NyA2NTUzNSBmDQowMDAw MDAyNTY4IDY1NTM1IGYNCjAwMDAwMDI1NjkgNjU1MzUgZg0KMDAwMDAwMjU3MCA2NTUzNSBm DQowMDAwMDAyNTcxIDY1NTM1IGYNCjAwMDAwMDI1NzIgNjU1MzUgZg0KMDAwMDAwMjU3MyA2 NTUzNSBmDQowMDAwMDAyNTc0IDY1NTM1IGYNCjAwMDAwMDI1NzUgNjU1MzUgZg0KMDAwMDAw MjU3NiA2NTUzNSBmDQowMDAwMDAyNTc3IDY1NTM1IGYNCjAwMDAwMDI1NzggNjU1MzUgZg0K MDAwMDAwMjU3OSA2NTUzNSBmDQowMDAwMDAyNTgwIDY1NTM1IGYNCjAwMDAwMDI1ODEgNjU1 MzUgZg0KMDAwMDAwMjU4MiA2NTUzNSBmDQowMDAwMDAyNTgzIDY1NTM1IGYNCjAwMDAwMDI1 ODQgNjU1MzUgZg0KMDAwMDAwMjU4NSA2NTUzNSBmDQowMDAwMDAyNTg2IDY1NTM1IGYNCjAw MDAwMDI1ODcgNjU1MzUgZg0KMDAwMDAwMjU4OCA2NTUzNSBmDQowMDAwMDAyNTg5IDY1NTM1 IGYNCjAwMDAwMDI1OTAgNjU1MzUgZg0KMDAwMDAwMjU5MSA2NTUzNSBmDQowMDAwMDAyNTky IDY1NTM1IGYNCjAwMDAwMDI1OTMgNjU1MzUgZg0KMDAwMDAwMjU5NCA2NTUzNSBmDQowMDAw MDAyNTk1IDY1NTM1IGYNCjAwMDAwMDI1OTYgNjU1MzUgZg0KMDAwMDAwMjU5NyA2NTUzNSBm DQowMDAwMDAyNTk4IDY1NTM1IGYNCjAwMDAwMDI1OTkgNjU1MzUgZg0KMDAwMDAwMjYwMCA2 NTUzNSBmDQowMDAwMDAyNjAxIDY1NTM1IGYNCjAwMDAwMDI2MDIgNjU1MzUgZg0KMDAwMDAw MjYwMyA2NTUzNSBmDQowMDAwMDAyNjA0IDY1NTM1IGYNCjAwMDAwMDI2MDUgNjU1MzUgZg0K MDAwMDAwMjYwNiA2NTUzNSBmDQowMDAwMDAyNjA3IDY1NTM1IGYNCjAwMDAwMDI2MDggNjU1 MzUgZg0KMDAwMDAwMjYwOSA2NTUzNSBmDQowMDAwMDAyNjEwIDY1NTM1IGYNCjAwMDAwMDI2 MTEgNjU1MzUgZg0KMDAwMDAwMjYxMiA2NTUzNSBmDQowMDAwMDAyNjEzIDY1NTM1IGYNCjAw MDAwMDI2MTQgNjU1MzUgZg0KMDAwMDAwMjYxNSA2NTUzNSBmDQowMDAwMDAyNjE2IDY1NTM1 IGYNCjAwMDAwMDI2MTcgNjU1MzUgZg0KMDAwMDAwMjYxOCA2NTUzNSBmDQowMDAwMDAyNjE5 IDY1NTM1IGYNCjAwMDAwMDI2MjAgNjU1MzUgZg0KMDAwMDAwMjYyMSA2NTUzNSBmDQowMDAw MDAyNjIyIDY1NTM1IGYNCjAwMDAwMDI2MjMgNjU1MzUgZg0KMDAwMDAwMjYyNCA2NTUzNSBm DQowMDAwMDAyNjI1IDY1NTM1IGYNCjAwMDAwMDI2MjYgNjU1MzUgZg0KMDAwMDAwMjYyNyA2 NTUzNSBmDQowMDAwMDAyNjI4IDY1NTM1IGYNCjAwMDAwMDI2MjkgNjU1MzUgZg0KMDAwMDAw MjYzMCA2NTUzNSBmDQowMDAwMDAyNjMxIDY1NTM1IGYNCjAwMDAwMDI2MzIgNjU1MzUgZg0K MDAwMDAwMjYzMyA2NTUzNSBmDQowMDAwMDAyNjM0IDY1NTM1IGYNCjAwMDAwMDI2MzUgNjU1 MzUgZg0KMDAwMDAwMjYzNiA2NTUzNSBmDQowMDAwMDAyNjM3IDY1NTM1IGYNCjAwMDAwMDI2 MzggNjU1MzUgZg0KMDAwMDAwMjYzOSA2NTUzNSBmDQowMDAwMDAyNjQwIDY1NTM1IGYNCjAw MDAwMDI2NDEgNjU1MzUgZg0KMDAwMDAwMjY0MiA2NTUzNSBmDQowMDAwMDAyNjQzIDY1NTM1 IGYNCjAwMDAwMDI2NDQgNjU1MzUgZg0KMDAwMDAwMjY0NSA2NTUzNSBmDQowMDAwMDAyNjQ2 IDY1NTM1IGYNCjAwMDAwMDI2NDcgNjU1MzUgZg0KMDAwMDAwMjY0OCA2NTUzNSBmDQowMDAw MDAyNjQ5IDY1NTM1IGYNCjAwMDAwMDI2NTAgNjU1MzUgZg0KMDAwMDAwMjY1MSA2NTUzNSBm DQowMDAwMDAyNjUyIDY1NTM1IGYNCjAwMDAwMDI2NTMgNjU1MzUgZg0KMDAwMDAwMjY1NCA2 NTUzNSBmDQowMDAwMDAyNjU1IDY1NTM1IGYNCjAwMDAwMDI2NTYgNjU1MzUgZg0KMDAwMDAw MjY1NyA2NTUzNSBmDQowMDAwMDAyNjU4IDY1NTM1IGYNCjAwMDAwMDI2NTkgNjU1MzUgZg0K MDAwMDAwMjY2MCA2NTUzNSBmDQowMDAwMDAyNjYxIDY1NTM1IGYNCjAwMDAwMDI2NjIgNjU1 MzUgZg0KMDAwMDAwMjY2MyA2NTUzNSBmDQowMDAwMDAyNjY0IDY1NTM1IGYNCjAwMDAwMDI2 NjUgNjU1MzUgZg0KMDAwMDAwMjY2NiA2NTUzNSBmDQowMDAwMDAyNjY3IDY1NTM1IGYNCjAw MDAwMDI2NjggNjU1MzUgZg0KMDAwMDAwMjY2OSA2NTUzNSBmDQowMDAwMDAyNjcwIDY1NTM1 IGYNCjAwMDAwMDI2NzEgNjU1MzUgZg0KMDAwMDAwMjY3MiA2NTUzNSBmDQowMDAwMDAyNjcz IDY1NTM1IGYNCjAwMDAwMDI2NzQgNjU1MzUgZg0KMDAwMDAwMjY3NSA2NTUzNSBmDQowMDAw MDAyNjc2IDY1NTM1IGYNCjAwMDAwMDI2NzcgNjU1MzUgZg0KMDAwMDAwMjY3OCA2NTUzNSBm DQowMDAwMDAyNjc5IDY1NTM1IGYNCjAwMDAwMDI2ODAgNjU1MzUgZg0KMDAwMDAwMjY4MSA2 NTUzNSBmDQowMDAwMDAyNjgyIDY1NTM1IGYNCjAwMDAwMDI2ODMgNjU1MzUgZg0KMDAwMDAw MjY4NCA2NTUzNSBmDQowMDAwMDAyNjg1IDY1NTM1IGYNCjAwMDAwMDI2ODYgNjU1MzUgZg0K MDAwMDAwMjY4NyA2NTUzNSBmDQowMDAwMDAyNjg4IDY1NTM1IGYNCjAwMDAwMDI2ODkgNjU1 MzUgZg0KMDAwMDAwMjY5MCA2NTUzNSBmDQowMDAwMDAyNjkxIDY1NTM1IGYNCjAwMDAwMDI2 OTIgNjU1MzUgZg0KMDAwMDAwMjY5MyA2NTUzNSBmDQowMDAwMDAyNjk0IDY1NTM1IGYNCjAw MDAwMDI2OTUgNjU1MzUgZg0KMDAwMDAwMjY5NiA2NTUzNSBmDQowMDAwMDAyNjk3IDY1NTM1 IGYNCjAwMDAwMDI2OTggNjU1MzUgZg0KMDAwMDAwMjY5OSA2NTUzNSBmDQowMDAwMDAyNzAw IDY1NTM1IGYNCjAwMDAwMDI3MDEgNjU1MzUgZg0KMDAwMDAwMjcwMiA2NTUzNSBmDQowMDAw MDAyNzAzIDY1NTM1IGYNCjAwMDAwMDI3MDQgNjU1MzUgZg0KMDAwMDAwMjcwNSA2NTUzNSBm DQowMDAwMDAyNzA2IDY1NTM1IGYNCjAwMDAwMDI3MDcgNjU1MzUgZg0KMDAwMDAwMjcwOCA2 NTUzNSBmDQowMDAwMDAyNzA5IDY1NTM1IGYNCjAwMDAwMDI3MTAgNjU1MzUgZg0KMDAwMDAw MjcxMSA2NTUzNSBmDQowMDAwMDAyNzEyIDY1NTM1IGYNCjAwMDAwMDI3MTMgNjU1MzUgZg0K MDAwMDAwMjcxNCA2NTUzNSBmDQowMDAwMDAyNzE1IDY1NTM1IGYNCjAwMDAwMDI3MTYgNjU1 MzUgZg0KMDAwMDAwMjcxNyA2NTUzNSBmDQowMDAwMDAyNzE4IDY1NTM1IGYNCjAwMDAwMDI3 MTkgNjU1MzUgZg0KMDAwMDAwMjcyMCA2NTUzNSBmDQowMDAwMDAyNzIxIDY1NTM1IGYNCjAw MDAwMDI3MjIgNjU1MzUgZg0KMDAwMDAwMjcyMyA2NTUzNSBmDQowMDAwMDAyNzI0IDY1NTM1 IGYNCjAwMDAwMDI3MjUgNjU1MzUgZg0KMDAwMDAwMjcyNiA2NTUzNSBmDQowMDAwMDAyNzI3 IDY1NTM1IGYNCjAwMDAwMDI3MjggNjU1MzUgZg0KMDAwMDAwMjcyOSA2NTUzNSBmDQowMDAw MDAyNzMwIDY1NTM1IGYNCjAwMDAwMDI3MzEgNjU1MzUgZg0KMDAwMDAwMjczMiA2NTUzNSBm DQowMDAwMDAyNzMzIDY1NTM1IGYNCjAwMDAwMDI3MzQgNjU1MzUgZg0KMDAwMDAwMjczNSA2 NTUzNSBmDQowMDAwMDAyNzM2IDY1NTM1IGYNCjAwMDAwMDI3MzcgNjU1MzUgZg0KMDAwMDAw MjczOCA2NTUzNSBmDQowMDAwMDAyNzM5IDY1NTM1IGYNCjAwMDAwMDI3NDAgNjU1MzUgZg0K MDAwMDAwMjc0MSA2NTUzNSBmDQowMDAwMDAyNzQyIDY1NTM1IGYNCjAwMDAwMDI3NDMgNjU1 MzUgZg0KMDAwMDAwMjc0NCA2NTUzNSBmDQowMDAwMDAyNzQ1IDY1NTM1IGYNCjAwMDAwMDI3 NDYgNjU1MzUgZg0KMDAwMDAwMjc0NyA2NTUzNSBmDQowMDAwMDAyNzQ4IDY1NTM1IGYNCjAw MDAwMDI3NDkgNjU1MzUgZg0KMDAwMDAwMjc1MCA2NTUzNSBmDQowMDAwMDAyNzUxIDY1NTM1 IGYNCjAwMDAwMDI3NTIgNjU1MzUgZg0KMDAwMDAwMjc1MyA2NTUzNSBmDQowMDAwMDAyNzU0 IDY1NTM1IGYNCjAwMDAwMDI3NTUgNjU1MzUgZg0KMDAwMDAwMjc1NiA2NTUzNSBmDQowMDAw MDAyNzU3IDY1NTM1IGYNCjAwMDAwMDI3NTggNjU1MzUgZg0KMDAwMDAwMjc1OSA2NTUzNSBm DQowMDAwMDAyNzYwIDY1NTM1IGYNCjAwMDAwMDI3NjEgNjU1MzUgZg0KMDAwMDAwMjc2MiA2 NTUzNSBmDQowMDAwMDAyNzYzIDY1NTM1IGYNCjAwMDAwMDI3NjQgNjU1MzUgZg0KMDAwMDAw Mjc2NSA2NTUzNSBmDQowMDAwMDAyNzY2IDY1NTM1IGYNCjAwMDAwMDI3NjcgNjU1MzUgZg0K MDAwMDAwMjc2OCA2NTUzNSBmDQowMDAwMDAyNzY5IDY1NTM1IGYNCjAwMDAwMDI3NzAgNjU1 MzUgZg0KMDAwMDAwMjc3MSA2NTUzNSBmDQowMDAwMDAyNzcyIDY1NTM1IGYNCjAwMDAwMDI3 NzMgNjU1MzUgZg0KMDAwMDAwMjc3NCA2NTUzNSBmDQowMDAwMDAyNzc2IDY1NTM1IGYNCjAw MDA1MTg4MjcgMDAwMDAgbg0KMDAwMDAwMjc3NyA2NTUzNSBmDQowMDAwMDAyNzc4IDY1NTM1 IGYNCjAwMDAwMDI3NzkgNjU1MzUgZg0KMDAwMDAwMjc4MCA2NTUzNSBmDQowMDAwMDAyNzgx IDY1NTM1IGYNCjAwMDAwMDI3ODIgNjU1MzUgZg0KMDAwMDAwMjc4MyA2NTUzNSBmDQowMDAw MDAyNzg0IDY1NTM1IGYNCjAwMDAwMDI3ODUgNjU1MzUgZg0KMDAwMDAwMjc4NiA2NTUzNSBm DQowMDAwMDAyNzg3IDY1NTM1IGYNCjAwMDAwMDI3ODggNjU1MzUgZg0KMDAwMDAwMjc4OSA2 NTUzNSBmDQowMDAwMDAyNzkwIDY1NTM1IGYNCjAwMDAwMDI3OTEgNjU1MzUgZg0KMDAwMDAw Mjc5MyA2NTUzNSBmDQowMDAwNTE4ODc5IDAwMDAwIG4NCjAwMDAwMDI3OTQgNjU1MzUgZg0K MDAwMDAwMjc5NSA2NTUzNSBmDQowMDAwMDAyNzk2IDY1NTM1IGYNCjAwMDAwMDI3OTcgNjU1 MzUgZg0KMDAwMDAwMjc5OCA2NTUzNSBmDQowMDAwMDAyNzk5IDY1NTM1IGYNCjAwMDAwMDI4 MDEgNjU1MzUgZg0KMDAwMDUxODkzMSAwMDAwMCBuDQowMDAwMDAyODAyIDY1NTM1IGYNCjAw MDAwMDI4MDMgNjU1MzUgZg0KMDAwMDAwMjgwNCA2NTUzNSBmDQowMDAwMDAyODA1IDY1NTM1 IGYNCjAwMDAwMDI4MDYgNjU1MzUgZg0KMDAwMDAwMjgwNyA2NTUzNSBmDQowMDAwMDAyODA4 IDY1NTM1IGYNCjAwMDAwMDI4MDkgNjU1MzUgZg0KMDAwMDAwMjgxMCA2NTUzNSBmDQowMDAw MDAyODExIDY1NTM1IGYNCjAwMDAwMDI4MTIgNjU1MzUgZg0KMDAwMDAwMjgxMyA2NTUzNSBm DQowMDAwMDAyODE0IDY1NTM1IGYNCjAwMDAwMDI4MTUgNjU1MzUgZg0KMDAwMDAwMjgxNiA2 NTUzNSBmDQowMDAwMDAyODE3IDY1NTM1IGYNCjAwMDAwMDI4MTggNjU1MzUgZg0KMDAwMDAw MjgxOSA2NTUzNSBmDQowMDAwMDAyODIwIDY1NTM1IGYNCjAwMDAwMDI4MjIgNjU1MzUgZg0K MDAwMDUxODk4MyAwMDAwMCBuDQowMDAwMDAyODIzIDY1NTM1IGYNCjAwMDAwMDI4MjQgNjU1 MzUgZg0KMDAwMDAwMjgyNiA2NTUzNSBmDQowMDAwNTE5MDM1IDAwMDAwIG4NCjAwMDAwMDI4 MjcgNjU1MzUgZg0KMDAwMDAwMjgyOCA2NTUzNSBmDQowMDAwMDAyODI5IDY1NTM1IGYNCjAw MDAwMDI4MzAgNjU1MzUgZg0KMDAwMDAwMjgzMSA2NTUzNSBmDQowMDAwMDAyODMyIDY1NTM1 IGYNCjAwMDAwMDI4MzQgNjU1MzUgZg0KMDAwMDUxOTA4NyAwMDAwMCBuDQowMDAwMDAyODM1 IDY1NTM1IGYNCjAwMDAwMDI4MzYgNjU1MzUgZg0KMDAwMDAwMjgzNyA2NTUzNSBmDQowMDAw MDAyODM5IDY1NTM1IGYNCjAwMDA1MTkxMzkgMDAwMDAgbg0KMDAwMDAwMjg0MCA2NTUzNSBm DQowMDAwMDAyODQxIDY1NTM1IGYNCjAwMDAwMDI4NDIgNjU1MzUgZg0KMDAwMDAwMjg0NCA2 NTUzNSBmDQowMDAwNTE5MTkxIDAwMDAwIG4NCjAwMDAwMDI4NDUgNjU1MzUgZg0KMDAwMDAw Mjg0NiA2NTUzNSBmDQowMDAwMDAyODQ3IDY1NTM1IGYNCjAwMDAwMDI4NDkgNjU1MzUgZg0K MDAwMDUxOTI0MyAwMDAwMCBuDQowMDAwMDAyODUwIDY1NTM1IGYNCjAwMDAwMDI4NTEgNjU1 MzUgZg0KMDAwMDAwMjg1MiA2NTUzNSBmDQowMDAwMDAyODUzIDY1NTM1IGYNCjAwMDAwMDI4 NTUgNjU1MzUgZg0KMDAwMDUyNTM2NCAwMDAwMCBuDQowMDAwMDAyODU2IDY1NTM1IGYNCjAw MDAwMDI4NTcgNjU1MzUgZg0KMDAwMDAwMjg1OCA2NTUzNSBmDQowMDAwMDAyODU5IDY1NTM1 IGYNCjAwMDAwMDI4NjAgNjU1MzUgZg0KMDAwMDAwMjg2MSA2NTUzNSBmDQowMDAwMDAyODYy IDY1NTM1IGYNCjAwMDAwMDI4NjMgNjU1MzUgZg0KMDAwMDAwMjg2NCA2NTUzNSBmDQowMDAw MDAyODY1IDY1NTM1IGYNCjAwMDAwMDI4NjYgNjU1MzUgZg0KMDAwMDAwMjg2NyA2NTUzNSBm DQowMDAwMDAyODY4IDY1NTM1IGYNCjAwMDAwMDI4NjkgNjU1MzUgZg0KMDAwMDAwMjg3MSA2 NTUzNSBmDQowMDAwNTI1NDE2IDAwMDAwIG4NCjAwMDAwMDI4NzIgNjU1MzUgZg0KMDAwMDAw Mjg3MyA2NTUzNSBmDQowMDAwMDAyODc0IDY1NTM1IGYNCjAwMDAwMDI4NzUgNjU1MzUgZg0K MDAwMDAwMjg3NiA2NTUzNSBmDQowMDAwMDAyODc3IDY1NTM1IGYNCjAwMDAwMDI4NzggNjU1 MzUgZg0KMDAwMDAwMjg3OSA2NTUzNSBmDQowMDAwMDAyODgwIDY1NTM1IGYNCjAwMDAwMDI4 ODEgNjU1MzUgZg0KMDAwMDAwMjg4MiA2NTUzNSBmDQowMDAwMDAyODgzIDY1NTM1IGYNCjAw MDAwMDI4ODQgNjU1MzUgZg0KMDAwMDAwMjg4NSA2NTUzNSBmDQowMDAwMDAyODg3IDY1NTM1 IGYNCjAwMDA1MjU0NjggMDAwMDAgbg0KMDAwMDAwMjg4OCA2NTUzNSBmDQowMDAwMDAyODg5 IDY1NTM1IGYNCjAwMDAwMDI4OTAgNjU1MzUgZg0KMDAwMDAwMjg5MSA2NTUzNSBmDQowMDAw MDAyODkyIDY1NTM1IGYNCjAwMDAwMDI4OTQgNjU1MzUgZg0KMDAwMDUyNTUyMyAwMDAwMCBu DQowMDAwMDAyODk1IDY1NTM1IGYNCjAwMDAwMDI4OTYgNjU1MzUgZg0KMDAwMDAwMjg5NyA2 NTUzNSBmDQowMDAwMDAyODk5IDY1NTM1IGYNCjAwMDA1MjU1NzggMDAwMDAgbg0KMDAwMDAw MjkwMCA2NTUzNSBmDQowMDAwMDAyOTAxIDY1NTM1IGYNCjAwMDAwMDI5MDIgNjU1MzUgZg0K MDAwMDAwMjkwNCA2NTUzNSBmDQowMDAwNTI1NjMzIDAwMDAwIG4NCjAwMDAwMDI5MDUgNjU1 MzUgZg0KMDAwMDAwMjkwNiA2NTUzNSBmDQowMDAwMDAyOTA3IDY1NTM1IGYNCjAwMDAwMDI5 MDggNjU1MzUgZg0KMDAwMDAwMjkwOSA2NTUzNSBmDQowMDAwMDAyOTEwIDY1NTM1IGYNCjAw MDAwMDI5MTEgNjU1MzUgZg0KMDAwMDAwMjkxMiA2NTUzNSBmDQowMDAwMDAyOTEzIDY1NTM1 IGYNCjAwMDAwMDI5MTQgNjU1MzUgZg0KMDAwMDAwMjkxNSA2NTUzNSBmDQowMDAwMDAyOTE2 IDY1NTM1IGYNCjAwMDAwMDI5MTcgNjU1MzUgZg0KMDAwMDAwMjkxOCA2NTUzNSBmDQowMDAw MDAyOTE5IDY1NTM1IGYNCjAwMDAwMDI5MjAgNjU1MzUgZg0KMDAwMDAwMjkyMSA2NTUzNSBm DQowMDAwMDAyOTIyIDY1NTM1IGYNCjAwMDAwMDI5MjMgNjU1MzUgZg0KMDAwMDAwMjkyNCA2 NTUzNSBmDQowMDAwMDAyOTI1IDY1NTM1IGYNCjAwMDAwMDI5MjYgNjU1MzUgZg0KMDAwMDAw MjkyNyA2NTUzNSBmDQowMDAwMDAyOTI4IDY1NTM1IGYNCjAwMDAwMDI5MjkgNjU1MzUgZg0K MDAwMDAwMjkzMCA2NTUzNSBmDQowMDAwMDAyOTMxIDY1NTM1IGYNCjAwMDAwMDI5MzIgNjU1 MzUgZg0KMDAwMDAwMjkzMyA2NTUzNSBmDQowMDAwMDAyOTM0IDY1NTM1IGYNCjAwMDAwMDI5 MzUgNjU1MzUgZg0KMDAwMDAwMjkzNiA2NTUzNSBmDQowMDAwMDAyOTM3IDY1NTM1IGYNCjAw MDAwMDI5MzggNjU1MzUgZg0KMDAwMDAwMjkzOSA2NTUzNSBmDQowMDAwMDAyOTQwIDY1NTM1 IGYNCjAwMDAwMDI5NDEgNjU1MzUgZg0KMDAwMDAwMjk0MiA2NTUzNSBmDQowMDAwMDAyOTQz IDY1NTM1IGYNCjAwMDAwMDI5NDQgNjU1MzUgZg0KMDAwMDAwMjk0NSA2NTUzNSBmDQowMDAw MDAyOTQ2IDY1NTM1IGYNCjAwMDAwMDI5NDcgNjU1MzUgZg0KMDAwMDAwMjk0OCA2NTUzNSBm DQowMDAwMDAyOTQ5IDY1NTM1IGYNCjAwMDAwMDI5NTAgNjU1MzUgZg0KMDAwMDAwMjk1MSA2 NTUzNSBmDQowMDAwMDAyOTUyIDY1NTM1IGYNCjAwMDAwMDI5NTMgNjU1MzUgZg0KMDAwMDAw Mjk1NCA2NTUzNSBmDQowMDAwMDAyOTU1IDY1NTM1IGYNCjAwMDAwMDI5NTYgNjU1MzUgZg0K MDAwMDAwMjk1NyA2NTUzNSBmDQowMDAwMDAyOTU4IDY1NTM1IGYNCjAwMDAwMDI5NTkgNjU1 MzUgZg0KMDAwMDAwMjk2MCA2NTUzNSBmDQowMDAwMDAyOTYxIDY1NTM1IGYNCjAwMDAwMDI5 NjIgNjU1MzUgZg0KMDAwMDAwMjk2MyA2NTUzNSBmDQowMDAwMDAyOTY0IDY1NTM1IGYNCjAw MDAwMDI5NjUgNjU1MzUgZg0KMDAwMDAwMjk2NiA2NTUzNSBmDQowMDAwMDAyOTY3IDY1NTM1 IGYNCjAwMDAwMDI5NjggNjU1MzUgZg0KMDAwMDAwMjk2OSA2NTUzNSBmDQowMDAwMDAyOTcw IDY1NTM1IGYNCjAwMDAwMDI5NzEgNjU1MzUgZg0KMDAwMDAwMjk3MiA2NTUzNSBmDQowMDAw MDAyOTczIDY1NTM1IGYNCjAwMDAwMDI5NzQgNjU1MzUgZg0KMDAwMDAwMjk3NSA2NTUzNSBm DQowMDAwMDAyOTc2IDY1NTM1IGYNCjAwMDAwMDI5NzcgNjU1MzUgZg0KMDAwMDAwMjk3OCA2 NTUzNSBmDQowMDAwMDAyOTc5IDY1NTM1IGYNCjAwMDAwMDI5ODAgNjU1MzUgZg0KMDAwMDAw Mjk4MSA2NTUzNSBmDQowMDAwMDAyOTgyIDY1NTM1IGYNCjAwMDAwMDI5ODMgNjU1MzUgZg0K MDAwMDAwMjk4NCA2NTUzNSBmDQowMDAwMDAyOTg1IDY1NTM1IGYNCjAwMDAwMDI5ODYgNjU1 MzUgZg0KMDAwMDAwMjk4NyA2NTUzNSBmDQowMDAwMDAyOTg4IDY1NTM1IGYNCjAwMDAwMDI5 ODkgNjU1MzUgZg0KMDAwMDAwMjk5MCA2NTUzNSBmDQowMDAwMDAyOTkxIDY1NTM1IGYNCjAw MDAwMDI5OTIgNjU1MzUgZg0KMDAwMDAwMjk5MyA2NTUzNSBmDQowMDAwMDAyOTk0IDY1NTM1 IGYNCjAwMDAwMDI5OTUgNjU1MzUgZg0KMDAwMDAwMjk5NiA2NTUzNSBmDQowMDAwMDAyOTk3 IDY1NTM1IGYNCjAwMDAwMDI5OTggNjU1MzUgZg0KMDAwMDAwMjk5OSA2NTUzNSBmDQowMDAw MDAzMDAwIDY1NTM1IGYNCjAwMDAwMDMwMDEgNjU1MzUgZg0KMDAwMDAwMzAwMiA2NTUzNSBm DQowMDAwMDAzMDAzIDY1NTM1IGYNCjAwMDAwMDMwMDQgNjU1MzUgZg0KMDAwMDAwMzAwNSA2 NTUzNSBmDQowMDAwMDAzMDA2IDY1NTM1IGYNCjAwMDAwMDMwMDcgNjU1MzUgZg0KMDAwMDAw MzAwOCA2NTUzNSBmDQowMDAwMDAzMDA5IDY1NTM1IGYNCjAwMDAwMDMwMTAgNjU1MzUgZg0K MDAwMDAwMzAxMSA2NTUzNSBmDQowMDAwMDAzMDEyIDY1NTM1IGYNCjAwMDAwMDMwMTMgNjU1 MzUgZg0KMDAwMDAwMzAxNCA2NTUzNSBmDQowMDAwMDAzMDE1IDY1NTM1IGYNCjAwMDAwMDMw MTYgNjU1MzUgZg0KMDAwMDAwMzAxNyA2NTUzNSBmDQowMDAwMDAzMDE4IDY1NTM1IGYNCjAw MDAwMDMwMTkgNjU1MzUgZg0KMDAwMDAwMzAyMCA2NTUzNSBmDQowMDAwMDAzMDIxIDY1NTM1 IGYNCjAwMDAwMDMwMjIgNjU1MzUgZg0KMDAwMDAwMzAyMyA2NTUzNSBmDQowMDAwMDAzMDI0 IDY1NTM1IGYNCjAwMDAwMDMwMjUgNjU1MzUgZg0KMDAwMDAwMzAyNiA2NTUzNSBmDQowMDAw MDAzMDI3IDY1NTM1IGYNCjAwMDAwMDMwMjggNjU1MzUgZg0KMDAwMDAwMzAyOSA2NTUzNSBm DQowMDAwMDAzMDMwIDY1NTM1IGYNCjAwMDAwMDMwMzEgNjU1MzUgZg0KMDAwMDAwMzAzMiA2 NTUzNSBmDQowMDAwMDAzMDMzIDY1NTM1IGYNCjAwMDAwMDMwMzQgNjU1MzUgZg0KMDAwMDAw MzAzNSA2NTUzNSBmDQowMDAwMDAzMDM2IDY1NTM1IGYNCjAwMDAwMDMwMzcgNjU1MzUgZg0K MDAwMDAwMzAzOCA2NTUzNSBmDQowMDAwMDAzMDM5IDY1NTM1IGYNCjAwMDAwMDMwNDAgNjU1 MzUgZg0KMDAwMDAwMzA0MSA2NTUzNSBmDQowMDAwMDAzMDQyIDY1NTM1IGYNCjAwMDAwMDMw NDMgNjU1MzUgZg0KMDAwMDAwMzA0NCA2NTUzNSBmDQowMDAwMDAzMDQ1IDY1NTM1IGYNCjAw MDAwMDMwNDYgNjU1MzUgZg0KMDAwMDAwMzA0NyA2NTUzNSBmDQowMDAwMDAzMDQ4IDY1NTM1 IGYNCjAwMDAwMDMwNDkgNjU1MzUgZg0KMDAwMDAwMzA1MCA2NTUzNSBmDQowMDAwMDAzMDUx IDY1NTM1IGYNCjAwMDAwMDMwNTIgNjU1MzUgZg0KMDAwMDAwMzA1MyA2NTUzNSBmDQowMDAw MDAzMDU0IDY1NTM1IGYNCjAwMDAwMDMwNTUgNjU1MzUgZg0KMDAwMDAwMzA1NiA2NTUzNSBm DQowMDAwMDAzMDU3IDY1NTM1IGYNCjAwMDAwMDMwNTggNjU1MzUgZg0KMDAwMDAwMzA1OSA2 NTUzNSBmDQowMDAwMDAzMDYwIDY1NTM1IGYNCjAwMDAwMDMwNjEgNjU1MzUgZg0KMDAwMDAw MzA2MiA2NTUzNSBmDQowMDAwMDAzMDYzIDY1NTM1IGYNCjAwMDAwMDMwNjQgNjU1MzUgZg0K MDAwMDAwMzA2NSA2NTUzNSBmDQowMDAwMDAzMDY2IDY1NTM1IGYNCjAwMDAwMDMwNjcgNjU1 MzUgZg0KMDAwMDAwMzA2OCA2NTUzNSBmDQowMDAwMDAzMDY5IDY1NTM1IGYNCjAwMDAwMDMw NzAgNjU1MzUgZg0KMDAwMDAwMzA3MSA2NTUzNSBmDQowMDAwMDAzMDcyIDY1NTM1IGYNCjAw MDAwMDMwNzMgNjU1MzUgZg0KMDAwMDAwMzA3NCA2NTUzNSBmDQowMDAwMDAzMDc1IDY1NTM1 IGYNCjAwMDAwMDMwNzYgNjU1MzUgZg0KMDAwMDAwMzA3NyA2NTUzNSBmDQowMDAwMDAzMDc4 IDY1NTM1IGYNCjAwMDAwMDMwNzkgNjU1MzUgZg0KMDAwMDAwMzA4MCA2NTUzNSBmDQowMDAw MDAzMDgxIDY1NTM1IGYNCjAwMDAwMDMwODIgNjU1MzUgZg0KMDAwMDAwMzA4MyA2NTUzNSBm DQowMDAwMDAzMDg0IDY1NTM1IGYNCjAwMDAwMDMwODUgNjU1MzUgZg0KMDAwMDAwMzA4NiA2 NTUzNSBmDQowMDAwMDAzMDg3IDY1NTM1IGYNCjAwMDAwMDMwODggNjU1MzUgZg0KMDAwMDAw MzA4OSA2NTUzNSBmDQowMDAwMDAzMDkwIDY1NTM1IGYNCjAwMDAwMDMwOTEgNjU1MzUgZg0K MDAwMDAwMzA5MiA2NTUzNSBmDQowMDAwMDAzMDkzIDY1NTM1IGYNCjAwMDAwMDMwOTQgNjU1 MzUgZg0KMDAwMDAwMzA5NSA2NTUzNSBmDQowMDAwMDAzMDk2IDY1NTM1IGYNCjAwMDAwMDMw OTcgNjU1MzUgZg0KMDAwMDAwMzA5OCA2NTUzNSBmDQowMDAwMDAzMDk5IDY1NTM1IGYNCjAw MDAwMDMxMDAgNjU1MzUgZg0KMDAwMDAwMzEwMSA2NTUzNSBmDQowMDAwMDAzMTAyIDY1NTM1 IGYNCjAwMDAwMDMxMDMgNjU1MzUgZg0KMDAwMDAwMzEwNCA2NTUzNSBmDQowMDAwMDAzMTA1 IDY1NTM1IGYNCjAwMDAwMDMxMDYgNjU1MzUgZg0KMDAwMDAwMzEwNyA2NTUzNSBmDQowMDAw MDAzMTA4IDY1NTM1IGYNCjAwMDAwMDMxMDkgNjU1MzUgZg0KMDAwMDAwMzExMCA2NTUzNSBm DQowMDAwMDAzMTExIDY1NTM1IGYNCjAwMDAwMDMxMTIgNjU1MzUgZg0KMDAwMDAwMzExMyA2 NTUzNSBmDQowMDAwMDAzMTE0IDY1NTM1IGYNCjAwMDAwMDMxMTUgNjU1MzUgZg0KMDAwMDAw MzExNiA2NTUzNSBmDQowMDAwMDAzMTE3IDY1NTM1IGYNCjAwMDAwMDMxMTggNjU1MzUgZg0K MDAwMDAwMzExOSA2NTUzNSBmDQowMDAwMDAzMTIwIDY1NTM1IGYNCjAwMDAwMDMxMjEgNjU1 MzUgZg0KMDAwMDAwMzEyMiA2NTUzNSBmDQowMDAwMDAzMTI0IDY1NTM1IGYNCjAwMDA1MjU2 ODggMDAwMDAgbg0KMDAwMDAwMzEyNSA2NTUzNSBmDQowMDAwMDAzMTI2IDY1NTM1IGYNCjAw MDAwMDMxMjcgNjU1MzUgZg0KMDAwMDAwMzEyOCA2NTUzNSBmDQowMDAwMDAzMTI5IDY1NTM1 IGYNCjAwMDAwMDMxMzEgNjU1MzUgZg0KMDAwMDUyNTc0MCAwMDAwMCBuDQowMDAwMDAzMTMy IDY1NTM1IGYNCjAwMDAwMDMxMzMgNjU1MzUgZg0KMDAwMDAwMzEzNCA2NTUzNSBmDQowMDAw MDAzMTM1IDY1NTM1IGYNCjAwMDAwMDMxMzYgNjU1MzUgZg0KMDAwMDAwMzEzNyA2NTUzNSBm DQowMDAwMDAzMTM4IDY1NTM1IGYNCjAwMDAwMDMxMzkgNjU1MzUgZg0KMDAwMDAwMzE0MCA2 NTUzNSBmDQowMDAwMDAzMTQxIDY1NTM1IGYNCjAwMDAwMDMxNDIgNjU1MzUgZg0KMDAwMDAw MzE0NCA2NTUzNSBmDQowMDAwNTI1Nzk0IDAwMDAwIG4NCjAwMDAwMDMxNDUgNjU1MzUgZg0K MDAwMDAwMzE0NiA2NTUzNSBmDQowMDAwMDAzMTQ3IDY1NTM1IGYNCjAwMDAwMDMxNDggNjU1 MzUgZg0KMDAwMDAwMzE0OSA2NTUzNSBmDQowMDAwMDAzMTUxIDY1NTM1IGYNCjAwMDA1MjU4 NDggMDAwMDAgbg0KMDAwMDAwMzE1MiA2NTUzNSBmDQowMDAwMDAzMTUzIDY1NTM1IGYNCjAw MDAwMDMxNTQgNjU1MzUgZg0KMDAwMDAwMzE1NSA2NTUzNSBmDQowMDAwMDAzMTU2IDY1NTM1 IGYNCjAwMDAwMDMxNTcgNjU1MzUgZg0KMDAwMDAwMzE1OCA2NTUzNSBmDQowMDAwMDAzMTU5 IDY1NTM1IGYNCjAwMDAwMDMxNjAgNjU1MzUgZg0KMDAwMDAwMzE2MiA2NTUzNSBmDQowMDAw NTI1OTAyIDAwMDAwIG4NCjAwMDAwMDMxNjMgNjU1MzUgZg0KMDAwMDAwMzE2NCA2NTUzNSBm DQowMDAwMDAzMTY1IDY1NTM1IGYNCjAwMDAwMDMxNjYgNjU1MzUgZg0KMDAwMDAwMzE2NyA2 NTUzNSBmDQowMDAwMDAzMTY4IDY1NTM1IGYNCjAwMDAwMDMxNjkgNjU1MzUgZg0KMDAwMDAw MzE3MCA2NTUzNSBmDQowMDAwMDAzMTcxIDY1NTM1IGYNCjAwMDAwMDMxNzIgNjU1MzUgZg0K MDAwMDAwMzE3NCA2NTUzNSBmDQowMDAwNTI1OTU0IDAwMDAwIG4NCjAwMDAwMDMxNzUgNjU1 MzUgZg0KMDAwMDAwMzE3NiA2NTUzNSBmDQowMDAwMDAzMTc3IDY1NTM1IGYNCjAwMDAwMDMx NzggNjU1MzUgZg0KMDAwMDAwMzE3OSA2NTUzNSBmDQowMDAwMDAzMTgxIDY1NTM1IGYNCjAw MDA1MjYwMDYgMDAwMDAgbg0KMDAwMDAwMzE4MiA2NTUzNSBmDQowMDAwMDAzMTgzIDY1NTM1 IGYNCjAwMDAwMDMxODQgNjU1MzUgZg0KMDAwMDAwMzE4NSA2NTUzNSBmDQowMDAwMDAzMTg2 IDY1NTM1IGYNCjAwMDAwMDMxODcgNjU1MzUgZg0KMDAwMDAwMzE4OCA2NTUzNSBmDQowMDAw MDAzMTg5IDY1NTM1IGYNCjAwMDAwMDMxOTAgNjU1MzUgZg0KMDAwMDAwMzE5MSA2NTUzNSBm DQowMDAwMDAzMTkyIDY1NTM1IGYNCjAwMDAwMDMxOTMgNjU1MzUgZg0KMDAwMDAwMzE5NCA2 NTUzNSBmDQowMDAwMDAzMTk1IDY1NTM1IGYNCjAwMDAwMDMxOTYgNjU1MzUgZg0KMDAwMDAw MzE5NyA2NTUzNSBmDQowMDAwMDAzMTk4IDY1NTM1IGYNCjAwMDAwMDMxOTkgNjU1MzUgZg0K MDAwMDAwMzIwMCA2NTUzNSBmDQowMDAwMDAzMjAxIDY1NTM1IGYNCjAwMDAwMDMyMDIgNjU1 MzUgZg0KMDAwMDAwMzIwMyA2NTUzNSBmDQowMDAwMDAzMjA0IDY1NTM1IGYNCjAwMDAwMDMy MDUgNjU1MzUgZg0KMDAwMDAwMzIwNiA2NTUzNSBmDQowMDAwMDAzMjA3IDY1NTM1IGYNCjAw MDAwMDMyMDggNjU1MzUgZg0KMDAwMDAwMzIwOSA2NTUzNSBmDQowMDAwMDAzMjEwIDY1NTM1 IGYNCjAwMDAwMDMyMTEgNjU1MzUgZg0KMDAwMDAwMzIxMiA2NTUzNSBmDQowMDAwMDAzMjEz IDY1NTM1IGYNCjAwMDAwMDMyMTQgNjU1MzUgZg0KMDAwMDAwMzIxNSA2NTUzNSBmDQowMDAw MDAzMjE2IDY1NTM1IGYNCjAwMDAwMDMyMTcgNjU1MzUgZg0KMDAwMDAwMzIxOCA2NTUzNSBm DQowMDAwMDAzMjE5IDY1NTM1IGYNCjAwMDAwMDMyMjAgNjU1MzUgZg0KMDAwMDAwMzIyMSA2 NTUzNSBmDQowMDAwMDAzMjIyIDY1NTM1IGYNCjAwMDAwMDMyMjMgNjU1MzUgZg0KMDAwMDAw MzIyNCA2NTUzNSBmDQowMDAwMDAzMjI1IDY1NTM1IGYNCjAwMDAwMDMyMjYgNjU1MzUgZg0K MDAwMDAwMzIyNyA2NTUzNSBmDQowMDAwMDAzMjI4IDY1NTM1IGYNCjAwMDAwMDMyMjkgNjU1 MzUgZg0KMDAwMDAwMzIzMCA2NTUzNSBmDQowMDAwMDAzMjMxIDY1NTM1IGYNCjAwMDAwMDMy MzIgNjU1MzUgZg0KMDAwMDAwMzIzMyA2NTUzNSBmDQowMDAwMDAzMjM0IDY1NTM1IGYNCjAw MDAwMDMyMzUgNjU1MzUgZg0KMDAwMDAwMzIzNiA2NTUzNSBmDQowMDAwMDAzMjM3IDY1NTM1 IGYNCjAwMDAwMDMyMzggNjU1MzUgZg0KMDAwMDAwMzIzOSA2NTUzNSBmDQowMDAwMDAzMjQw IDY1NTM1IGYNCjAwMDAwMDMyNDEgNjU1MzUgZg0KMDAwMDAwMzI0MiA2NTUzNSBmDQowMDAw MDAzMjQzIDY1NTM1IGYNCjAwMDAwMDMyNDQgNjU1MzUgZg0KMDAwMDAwMzI0NSA2NTUzNSBm DQowMDAwMDAzMjQ2IDY1NTM1IGYNCjAwMDAwMDMyNDcgNjU1MzUgZg0KMDAwMDAwMzI0OCA2 NTUzNSBmDQowMDAwMDAzMjQ5IDY1NTM1IGYNCjAwMDAwMDMyNTAgNjU1MzUgZg0KMDAwMDAw MzI1MSA2NTUzNSBmDQowMDAwMDAzMjUyIDY1NTM1IGYNCjAwMDAwMDMyNTMgNjU1MzUgZg0K MDAwMDAwMzI1NCA2NTUzNSBmDQowMDAwMDAzMjU1IDY1NTM1IGYNCjAwMDAwMDMyNTYgNjU1 MzUgZg0KMDAwMDAwMzI1NyA2NTUzNSBmDQowMDAwMDAzMjU4IDY1NTM1IGYNCjAwMDAwMDMy NTkgNjU1MzUgZg0KMDAwMDAwMzI2MCA2NTUzNSBmDQowMDAwMDAzMjYxIDY1NTM1IGYNCjAw MDAwMDMyNjIgNjU1MzUgZg0KMDAwMDAwMzI2MyA2NTUzNSBmDQowMDAwMDAzMjY0IDY1NTM1 IGYNCjAwMDAwMDMyNjUgNjU1MzUgZg0KMDAwMDAwMzI2NiA2NTUzNSBmDQowMDAwMDAzMjY3 IDY1NTM1IGYNCjAwMDAwMDMyNjggNjU1MzUgZg0KMDAwMDAwMzI2OSA2NTUzNSBmDQowMDAw MDAzMjcwIDY1NTM1IGYNCjAwMDAwMDMyNzEgNjU1MzUgZg0KMDAwMDAwMzI3MiA2NTUzNSBm DQowMDAwMDAzMjczIDY1NTM1IGYNCjAwMDAwMDMyNzQgNjU1MzUgZg0KMDAwMDAwMzI3NSA2 NTUzNSBmDQowMDAwMDAzMjc2IDY1NTM1IGYNCjAwMDAwMDMyNzcgNjU1MzUgZg0KMDAwMDAw MzI3OCA2NTUzNSBmDQowMDAwMDAzMjc5IDY1NTM1IGYNCjAwMDAwMDMyODAgNjU1MzUgZg0K MDAwMDAwMzI4MSA2NTUzNSBmDQowMDAwMDAzMjgyIDY1NTM1IGYNCjAwMDAwMDMyODMgNjU1 MzUgZg0KMDAwMDAwMzI4NCA2NTUzNSBmDQowMDAwMDAzMjg1IDY1NTM1IGYNCjAwMDAwMDMy ODYgNjU1MzUgZg0KMDAwMDAwMzI4NyA2NTUzNSBmDQowMDAwMDAzMjg4IDY1NTM1IGYNCjAw MDAwMDMyODkgNjU1MzUgZg0KMDAwMDAwMzI5MCA2NTUzNSBmDQowMDAwMDAzMjkxIDY1NTM1 IGYNCjAwMDAwMDMyOTIgNjU1MzUgZg0KMDAwMDAwMzI5MyA2NTUzNSBmDQowMDAwMDAzMjk0 IDY1NTM1IGYNCjAwMDAwMDMyOTUgNjU1MzUgZg0KMDAwMDAwMzI5NiA2NTUzNSBmDQowMDAw MDAzMjk3IDY1NTM1IGYNCjAwMDAwMDMyOTggNjU1MzUgZg0KMDAwMDAwMzI5OSA2NTUzNSBm DQowMDAwMDAzMzAwIDY1NTM1IGYNCjAwMDAwMDMzMDEgNjU1MzUgZg0KMDAwMDAwMzMwMiA2 NTUzNSBmDQowMDAwMDAzMzAzIDY1NTM1IGYNCjAwMDAwMDMzMDQgNjU1MzUgZg0KMDAwMDAw MzMwNSA2NTUzNSBmDQowMDAwMDAzMzA2IDY1NTM1IGYNCjAwMDAwMDMzMDcgNjU1MzUgZg0K MDAwMDAwMzMwOCA2NTUzNSBmDQowMDAwMDAzMzA5IDY1NTM1IGYNCjAwMDAwMDMzMTAgNjU1 MzUgZg0KMDAwMDAwMzMxMSA2NTUzNSBmDQowMDAwMDAzMzEyIDY1NTM1IGYNCjAwMDAwMDMz MTMgNjU1MzUgZg0KMDAwMDAwMzMxNCA2NTUzNSBmDQowMDAwMDAzMzE1IDY1NTM1IGYNCjAw MDAwMDMzMTYgNjU1MzUgZg0KMDAwMDAwMzMxNyA2NTUzNSBmDQowMDAwMDAzMzE4IDY1NTM1 IGYNCjAwMDAwMDMzMTkgNjU1MzUgZg0KMDAwMDAwMzMyMCA2NTUzNSBmDQowMDAwMDAzMzIx IDY1NTM1IGYNCjAwMDAwMDMzMjIgNjU1MzUgZg0KMDAwMDAwMzMyMyA2NTUzNSBmDQowMDAw MDAzMzI0IDY1NTM1IGYNCjAwMDAwMDMzMjUgNjU1MzUgZg0KMDAwMDAwMzMyNiA2NTUzNSBm DQowMDAwMDAzMzI3IDY1NTM1IGYNCjAwMDAwMDMzMjggNjU1MzUgZg0KMDAwMDAwMzMyOSA2 NTUzNSBmDQowMDAwMDAzMzMwIDY1NTM1IGYNCjAwMDAwMDMzMzEgNjU1MzUgZg0KMDAwMDAw MzMzMiA2NTUzNSBmDQowMDAwMDAzMzMzIDY1NTM1IGYNCjAwMDAwMDMzMzQgNjU1MzUgZg0K MDAwMDAwMzMzNSA2NTUzNSBmDQowMDAwMDAzMzM2IDY1NTM1IGYNCjAwMDAwMDMzMzcgNjU1 MzUgZg0KMDAwMDAwMzMzOCA2NTUzNSBmDQowMDAwMDAzMzM5IDY1NTM1IGYNCjAwMDAwMDMz NDAgNjU1MzUgZg0KMDAwMDAwMzM0MSA2NTUzNSBmDQowMDAwMDAzMzQyIDY1NTM1IGYNCjAw MDAwMDMzNDMgNjU1MzUgZg0KMDAwMDAwMzM0NCA2NTUzNSBmDQowMDAwMDAzMzQ1IDY1NTM1 IGYNCjAwMDAwMDMzNDYgNjU1MzUgZg0KMDAwMDAwMzM0NyA2NTUzNSBmDQowMDAwMDAzMzQ4 IDY1NTM1IGYNCjAwMDAwMDMzNDkgNjU1MzUgZg0KMDAwMDAwMzM1MCA2NTUzNSBmDQowMDAw MDAzMzUxIDY1NTM1IGYNCjAwMDAwMDMzNTIgNjU1MzUgZg0KMDAwMDAwMzM1MyA2NTUzNSBm DQowMDAwMDAzMzU0IDY1NTM1IGYNCjAwMDAwMDMzNTUgNjU1MzUgZg0KMDAwMDAwMzM1NiA2 NTUzNSBmDQowMDAwMDAzMzU3IDY1NTM1IGYNCjAwMDAwMDMzNTggNjU1MzUgZg0KMDAwMDAw MzM1OSA2NTUzNSBmDQowMDAwMDAzMzYwIDY1NTM1IGYNCjAwMDAwMDMzNjEgNjU1MzUgZg0K MDAwMDAwMzM2MiA2NTUzNSBmDQowMDAwMDAzMzYzIDY1NTM1IGYNCjAwMDAwMDMzNjQgNjU1 MzUgZg0KMDAwMDAwMzM2NSA2NTUzNSBmDQowMDAwMDAzMzY2IDY1NTM1IGYNCjAwMDAwMDMz NjcgNjU1MzUgZg0KMDAwMDAwMzM2OCA2NTUzNSBmDQowMDAwMDAzMzY5IDY1NTM1IGYNCjAw MDAwMDMzNzAgNjU1MzUgZg0KMDAwMDAwMzM3MSA2NTUzNSBmDQowMDAwMDAzMzcyIDY1NTM1 IGYNCjAwMDAwMDMzNzMgNjU1MzUgZg0KMDAwMDAwMzM3NCA2NTUzNSBmDQowMDAwMDAzMzc1 IDY1NTM1IGYNCjAwMDAwMDMzNzYgNjU1MzUgZg0KMDAwMDAwMzM3NyA2NTUzNSBmDQowMDAw MDAzMzc4IDY1NTM1IGYNCjAwMDAwMDMzNzkgNjU1MzUgZg0KMDAwMDAwMzM4MCA2NTUzNSBm DQowMDAwMDAzMzgxIDY1NTM1IGYNCjAwMDAwMDMzODIgNjU1MzUgZg0KMDAwMDAwMzM4MyA2 NTUzNSBmDQowMDAwMDAzMzg0IDY1NTM1IGYNCjAwMDAwMDMzODUgNjU1MzUgZg0KMDAwMDAw MzM4NiA2NTUzNSBmDQowMDAwMDAzMzg3IDY1NTM1IGYNCjAwMDAwMDMzODggNjU1MzUgZg0K MDAwMDAwMzM4OSA2NTUzNSBmDQowMDAwMDAzMzkwIDY1NTM1IGYNCjAwMDAwMDMzOTEgNjU1 MzUgZg0KMDAwMDAwMzM5MiA2NTUzNSBmDQowMDAwMDAzMzkzIDY1NTM1IGYNCjAwMDAwMDMz OTQgNjU1MzUgZg0KMDAwMDAwMzM5NSA2NTUzNSBmDQowMDAwMDAzMzk2IDY1NTM1IGYNCjAw MDAwMDMzOTcgNjU1MzUgZg0KMDAwMDAwMzM5OCA2NTUzNSBmDQowMDAwMDAzMzk5IDY1NTM1 IGYNCjAwMDAwMDM0MDAgNjU1MzUgZg0KMDAwMDAwMzQwMSA2NTUzNSBmDQowMDAwMDAzNDAy IDY1NTM1IGYNCjAwMDAwMDM0MDMgNjU1MzUgZg0KMDAwMDAwMzQwNCA2NTUzNSBmDQowMDAw MDAzNDA1IDY1NTM1IGYNCjAwMDAwMDM0MDYgNjU1MzUgZg0KMDAwMDAwMzQwNyA2NTUzNSBm DQowMDAwMDAzNDA4IDY1NTM1IGYNCjAwMDAwMDM0MDkgNjU1MzUgZg0KMDAwMDAwMzQxMCA2 NTUzNSBmDQowMDAwMDAzNDExIDY1NTM1IGYNCjAwMDAwMDM0MTIgNjU1MzUgZg0KMDAwMDAw MzQxMyA2NTUzNSBmDQowMDAwMDAzNDE0IDY1NTM1IGYNCjAwMDAwMDM0MTUgNjU1MzUgZg0K MDAwMDAwMzQxNiA2NTUzNSBmDQowMDAwMDAzNDE3IDY1NTM1IGYNCjAwMDAwMDM0MTggNjU1 MzUgZg0KMDAwMDAwMzQxOSA2NTUzNSBmDQowMDAwMDAzNDIwIDY1NTM1IGYNCjAwMDAwMDM0 MjEgNjU1MzUgZg0KMDAwMDAwMzQyMiA2NTUzNSBmDQowMDAwMDAzNDIzIDY1NTM1IGYNCjAw MDAwMDM0MjQgNjU1MzUgZg0KMDAwMDAwMzQyNSA2NTUzNSBmDQowMDAwMDAzNDI2IDY1NTM1 IGYNCjAwMDAwMDM0MjcgNjU1MzUgZg0KMDAwMDAwMzQyOCA2NTUzNSBmDQowMDAwMDAzNDI5 IDY1NTM1IGYNCjAwMDAwMDM0MzAgNjU1MzUgZg0KMDAwMDAwMzQzMSA2NTUzNSBmDQowMDAw MDAzNDMyIDY1NTM1IGYNCjAwMDAwMDM0MzMgNjU1MzUgZg0KMDAwMDAwMzQzNCA2NTUzNSBm DQowMDAwMDAzNDM1IDY1NTM1IGYNCjAwMDAwMDM0MzYgNjU1MzUgZg0KMDAwMDAwMzQzNyA2 NTUzNSBmDQowMDAwMDAzNDM4IDY1NTM1IGYNCjAwMDAwMDM0MzkgNjU1MzUgZg0KMDAwMDAw MzQ0MCA2NTUzNSBmDQowMDAwMDAzNDQxIDY1NTM1IGYNCjAwMDAwMDM0NDIgNjU1MzUgZg0K MDAwMDAwMzQ0MyA2NTUzNSBmDQowMDAwMDAzNDQ0IDY1NTM1IGYNCjAwMDAwMDM0NDUgNjU1 MzUgZg0KMDAwMDAwMzQ0NiA2NTUzNSBmDQowMDAwMDAzNDQ3IDY1NTM1IGYNCjAwMDAwMDM0 NDggNjU1MzUgZg0KMDAwMDAwMzQ0OSA2NTUzNSBmDQowMDAwMDAzNDUwIDY1NTM1IGYNCjAw MDAwMDM0NTEgNjU1MzUgZg0KMDAwMDAwMzQ1MiA2NTUzNSBmDQowMDAwMDAzNDUzIDY1NTM1 IGYNCjAwMDAwMDM0NTQgNjU1MzUgZg0KMDAwMDAwMzQ1NSA2NTUzNSBmDQowMDAwMDAzNDU2 IDY1NTM1IGYNCjAwMDAwMDM0NTcgNjU1MzUgZg0KMDAwMDAwMzQ1OCA2NTUzNSBmDQowMDAw MDAzNDU5IDY1NTM1IGYNCjAwMDAwMDM0NjAgNjU1MzUgZg0KMDAwMDAwMzQ2MSA2NTUzNSBm DQowMDAwMDAzNDYyIDY1NTM1IGYNCjAwMDAwMDM0NjMgNjU1MzUgZg0KMDAwMDAwMzQ2NCA2 NTUzNSBmDQowMDAwMDAzNDY1IDY1NTM1IGYNCjAwMDAwMDM0NjYgNjU1MzUgZg0KMDAwMDAw MzQ2NyA2NTUzNSBmDQowMDAwMDAzNDY4IDY1NTM1IGYNCjAwMDAwMDM0NjkgNjU1MzUgZg0K MDAwMDAwMzQ3MCA2NTUzNSBmDQowMDAwMDAzNDcxIDY1NTM1IGYNCjAwMDAwMDM0NzIgNjU1 MzUgZg0KMDAwMDAwMzQ3MyA2NTUzNSBmDQowMDAwMDAzNDc0IDY1NTM1IGYNCjAwMDAwMDM0 NzUgNjU1MzUgZg0KMDAwMDAwMzQ3NiA2NTUzNSBmDQowMDAwMDAzNDc3IDY1NTM1IGYNCjAw MDAwMDM0NzggNjU1MzUgZg0KMDAwMDAwMzQ3OSA2NTUzNSBmDQowMDAwMDAzNDgwIDY1NTM1 IGYNCjAwMDAwMDM0ODEgNjU1MzUgZg0KMDAwMDAwMzQ4MiA2NTUzNSBmDQowMDAwMDAzNDgz IDY1NTM1IGYNCjAwMDAwMDM0ODQgNjU1MzUgZg0KMDAwMDAwMzQ4NSA2NTUzNSBmDQowMDAw MDAzNDg2IDY1NTM1IGYNCjAwMDAwMDM0ODcgNjU1MzUgZg0KMDAwMDAwMzQ4OCA2NTUzNSBm DQowMDAwMDAzNDg5IDY1NTM1IGYNCjAwMDAwMDM0OTAgNjU1MzUgZg0KMDAwMDAwMzQ5MSA2 NTUzNSBmDQowMDAwMDAzNDkyIDY1NTM1IGYNCjAwMDAwMDM0OTMgNjU1MzUgZg0KMDAwMDAw MzQ5NCA2NTUzNSBmDQowMDAwMDAzNDk1IDY1NTM1IGYNCjAwMDAwMDM0OTYgNjU1MzUgZg0K MDAwMDAwMzQ5NyA2NTUzNSBmDQowMDAwMDAzNDk4IDY1NTM1IGYNCjAwMDAwMDM0OTkgNjU1 MzUgZg0KMDAwMDAwMzUwMCA2NTUzNSBmDQowMDAwMDAzNTAxIDY1NTM1IGYNCjAwMDAwMDM1 MDIgNjU1MzUgZg0KMDAwMDAwMzUwMyA2NTUzNSBmDQowMDAwMDAzNTA0IDY1NTM1IGYNCjAw MDAwMDM1MDUgNjU1MzUgZg0KMDAwMDAwMzUwNiA2NTUzNSBmDQowMDAwMDAzNTA3IDY1NTM1 IGYNCjAwMDAwMDM1MDggNjU1MzUgZg0KMDAwMDAwMzUwOSA2NTUzNSBmDQowMDAwMDAzNTEw IDY1NTM1IGYNCjAwMDAwMDM1MTEgNjU1MzUgZg0KMDAwMDAwMzUxMiA2NTUzNSBmDQowMDAw MDAzNTEzIDY1NTM1IGYNCjAwMDAwMDM1MTQgNjU1MzUgZg0KMDAwMDAwMzUxNSA2NTUzNSBm DQowMDAwMDAzNTE2IDY1NTM1IGYNCjAwMDAwMDM1MTcgNjU1MzUgZg0KMDAwMDAwMzUxOCA2 NTUzNSBmDQowMDAwMDAzNTE5IDY1NTM1IGYNCjAwMDAwMDM1MjAgNjU1MzUgZg0KMDAwMDAw MzUyMSA2NTUzNSBmDQowMDAwMDAzNTIyIDY1NTM1IGYNCjAwMDAwMDM1MjMgNjU1MzUgZg0K MDAwMDAwMzUyNCA2NTUzNSBmDQowMDAwMDAzNTI1IDY1NTM1IGYNCjAwMDAwMDM1MjYgNjU1 MzUgZg0KMDAwMDAwMzUyNyA2NTUzNSBmDQowMDAwMDAzNTI4IDY1NTM1IGYNCjAwMDAwMDM1 MjkgNjU1MzUgZg0KMDAwMDAwMzUzMCA2NTUzNSBmDQowMDAwMDAzNTMxIDY1NTM1IGYNCjAw MDAwMDM1MzIgNjU1MzUgZg0KMDAwMDAwMzUzMyA2NTUzNSBmDQowMDAwMDAzNTM0IDY1NTM1 IGYNCjAwMDAwMDM1MzUgNjU1MzUgZg0KMDAwMDAwMzUzNiA2NTUzNSBmDQowMDAwMDAzNTM3 IDY1NTM1IGYNCjAwMDAwMDM1MzggNjU1MzUgZg0KMDAwMDAwMzUzOSA2NTUzNSBmDQowMDAw MDAzNTQwIDY1NTM1IGYNCjAwMDAwMDM1NDEgNjU1MzUgZg0KMDAwMDAwMzU0MiA2NTUzNSBm DQowMDAwMDAzNTQzIDY1NTM1IGYNCjAwMDAwMDM1NDQgNjU1MzUgZg0KMDAwMDAwMzU0NSA2 NTUzNSBmDQowMDAwMDAzNTQ3IDY1NTM1IGYNCjAwMDA1MzIzNzcgMDAwMDAgbg0KMDAwMDAw MzU0OCA2NTUzNSBmDQowMDAwMDAzNTQ5IDY1NTM1IGYNCjAwMDAwMDM1NTAgNjU1MzUgZg0K MDAwMDAwMzU1MSA2NTUzNSBmDQowMDAwMDAzNTUyIDY1NTM1IGYNCjAwMDAwMDM1NTMgNjU1 MzUgZg0KMDAwMDAwMzU1NCA2NTUzNSBmDQowMDAwMDAzNTU1IDY1NTM1IGYNCjAwMDAwMDM1 NTYgNjU1MzUgZg0KMDAwMDAwMzU1NyA2NTUzNSBmDQowMDAwMDAzNTU4IDY1NTM1IGYNCjAw MDAwMDM1NTkgNjU1MzUgZg0KMDAwMDAwMzU2MSA2NTUzNSBmDQowMDAwNTMyNDI5IDAwMDAw IG4NCjAwMDAwMDM1NjIgNjU1MzUgZg0KMDAwMDAwMzU2MyA2NTUzNSBmDQowMDAwMDAzNTY0 IDY1NTM1IGYNCjAwMDAwMDM1NjUgNjU1MzUgZg0KMDAwMDAwMzU2NiA2NTUzNSBmDQowMDAw MDAzNTY3IDY1NTM1IGYNCjAwMDAwMDM1NjggNjU1MzUgZg0KMDAwMDAwMzU2OSA2NTUzNSBm DQowMDAwMDAzNTcxIDY1NTM1IGYNCjAwMDA1MzI0ODEgMDAwMDAgbg0KMDAwMDAwMzU3MiA2 NTUzNSBmDQowMDAwMDAzNTczIDY1NTM1IGYNCjAwMDAwMDM1NzQgNjU1MzUgZg0KMDAwMDAw MzU3NSA2NTUzNSBmDQowMDAwMDAzNTc2IDY1NTM1IGYNCjAwMDAwMDM1NzcgNjU1MzUgZg0K MDAwMDAwMzU3OCA2NTUzNSBmDQowMDAwMDAzNTc5IDY1NTM1IGYNCjAwMDAwMDM1ODAgNjU1 MzUgZg0KMDAwMDAwMzU4MSA2NTUzNSBmDQowMDAwMDAzNTgyIDY1NTM1IGYNCjAwMDAwMDM1 ODMgNjU1MzUgZg0KMDAwMDAwMzU4NCA2NTUzNSBmDQowMDAwMDAzNTg1IDY1NTM1IGYNCjAw MDAwMDM1ODYgNjU1MzUgZg0KMDAwMDAwMzU4NyA2NTUzNSBmDQowMDAwMDAzNTg5IDY1NTM1 IGYNCjAwMDA1MzI1MzMgMDAwMDAgbg0KMDAwMDAwMzU5MCA2NTUzNSBmDQowMDAwMDAzNTkx IDY1NTM1IGYNCjAwMDAwMDM1OTIgNjU1MzUgZg0KMDAwMDAwMzU5MyA2NTUzNSBmDQowMDAw MDAzNTk0IDY1NTM1IGYNCjAwMDAwMDM1OTUgNjU1MzUgZg0KMDAwMDAwMzU5NyA2NTUzNSBm DQowMDAwNTMyNTg1IDAwMDAwIG4NCjAwMDAwMDM1OTggNjU1MzUgZg0KMDAwMDAwMzU5OSA2 NTUzNSBmDQowMDAwMDAzNjAwIDY1NTM1IGYNCjAwMDAwMDM2MDIgNjU1MzUgZg0KMDAwMDUz MjYzNyAwMDAwMCBuDQowMDAwMDAzNjAzIDY1NTM1IGYNCjAwMDAwMDM2MDQgNjU1MzUgZg0K MDAwMDAwMzYwNSA2NTUzNSBmDQowMDAwMDAzNjA3IDY1NTM1IGYNCjAwMDA1MzI2OTEgMDAw MDAgbg0KMDAwMDAwMzYwOCA2NTUzNSBmDQowMDAwMDAzNjA5IDY1NTM1IGYNCjAwMDAwMDM2 MTAgNjU1MzUgZg0KMDAwMDAwMzYxMSA2NTUzNSBmDQowMDAwMDAzNjEyIDY1NTM1IGYNCjAw MDAwMDM2MTQgNjU1MzUgZg0KMDAwMDUzMjc0NSAwMDAwMCBuDQowMDAwMDAzNjE1IDY1NTM1 IGYNCjAwMDAwMDM2MTYgNjU1MzUgZg0KMDAwMDAwMzYxNyA2NTUzNSBmDQowMDAwMDAzNjE4 IDY1NTM1IGYNCjAwMDAwMDM2MTkgNjU1MzUgZg0KMDAwMDAwMzYyMCA2NTUzNSBmDQowMDAw MDAzNjIxIDY1NTM1IGYNCjAwMDAwMDM2MjIgNjU1MzUgZg0KMDAwMDAwMzYyMyA2NTUzNSBm DQowMDAwMDAzNjI1IDY1NTM1IGYNCjAwMDA1MzI3OTkgMDAwMDAgbg0KMDAwMDAwMzYyNiA2 NTUzNSBmDQowMDAwMDAzNjI3IDY1NTM1IGYNCjAwMDAwMDM2MjggNjU1MzUgZg0KMDAwMDAw MzYzMCA2NTUzNSBmDQowMDAwNTMyODUzIDAwMDAwIG4NCjAwMDAwMDM2MzEgNjU1MzUgZg0K MDAwMDAwMzYzMiA2NTUzNSBmDQowMDAwMDAzNjMzIDY1NTM1IGYNCjAwMDAwMDM2MzQgNjU1 MzUgZg0KMDAwMDAwMzYzNSA2NTUzNSBmDQowMDAwMDAzNjM3IDY1NTM1IGYNCjAwMDA1MzI5 MDcgMDAwMDAgbg0KMDAwMDAwMzYzOCA2NTUzNSBmDQowMDAwMDAzNjM5IDY1NTM1IGYNCjAw MDAwMDM2NDAgNjU1MzUgZg0KMDAwMDAwMzY0MSA2NTUzNSBmDQowMDAwMDAzNjQyIDY1NTM1 IGYNCjAwMDAwMDM2NDMgNjU1MzUgZg0KMDAwMDAwMzY0NCA2NTUzNSBmDQowMDAwMDAzNjQ1 IDY1NTM1IGYNCjAwMDAwMDM2NDYgNjU1MzUgZg0KMDAwMDAwMzY0NyA2NTUzNSBmDQowMDAw MDAzNjQ4IDY1NTM1IGYNCjAwMDAwMDM2NDkgNjU1MzUgZg0KMDAwMDAwMzY1MCA2NTUzNSBm DQowMDAwMDAzNjUxIDY1NTM1IGYNCjAwMDAwMDM2NTIgNjU1MzUgZg0KMDAwMDAwMzY1MyA2 NTUzNSBmDQowMDAwMDAzNjU0IDY1NTM1IGYNCjAwMDAwMDM2NTUgNjU1MzUgZg0KMDAwMDAw MzY1NiA2NTUzNSBmDQowMDAwMDAzNjU3IDY1NTM1IGYNCjAwMDAwMDM2NTggNjU1MzUgZg0K MDAwMDAwMzY1OSA2NTUzNSBmDQowMDAwMDAzNjYwIDY1NTM1IGYNCjAwMDAwMDM2NjEgNjU1 MzUgZg0KMDAwMDAwMzY2MiA2NTUzNSBmDQowMDAwMDAzNjYzIDY1NTM1IGYNCjAwMDAwMDM2 NjQgNjU1MzUgZg0KMDAwMDAwMzY2NSA2NTUzNSBmDQowMDAwMDAzNjY2IDY1NTM1IGYNCjAw MDAwMDM2NjcgNjU1MzUgZg0KMDAwMDAwMzY2OCA2NTUzNSBmDQowMDAwMDAzNjY5IDY1NTM1 IGYNCjAwMDAwMDM2NzAgNjU1MzUgZg0KMDAwMDAwMzY3MSA2NTUzNSBmDQowMDAwMDAzNjcy IDY1NTM1IGYNCjAwMDAwMDM2NzMgNjU1MzUgZg0KMDAwMDAwMzY3NCA2NTUzNSBmDQowMDAw MDAzNjc1IDY1NTM1IGYNCjAwMDAwMDM2NzYgNjU1MzUgZg0KMDAwMDAwMzY3NyA2NTUzNSBm DQowMDAwMDAzNjc4IDY1NTM1IGYNCjAwMDAwMDM2NzkgNjU1MzUgZg0KMDAwMDAwMzY4MCA2 NTUzNSBmDQowMDAwMDAzNjgxIDY1NTM1IGYNCjAwMDAwMDM2ODIgNjU1MzUgZg0KMDAwMDAw MzY4MyA2NTUzNSBmDQowMDAwMDAzNjg0IDY1NTM1IGYNCjAwMDAwMDM2ODUgNjU1MzUgZg0K MDAwMDAwMzY4NiA2NTUzNSBmDQowMDAwMDAzNjg3IDY1NTM1IGYNCjAwMDAwMDM2ODggNjU1 MzUgZg0KMDAwMDAwMzY4OSA2NTUzNSBmDQowMDAwMDAzNjkwIDY1NTM1IGYNCjAwMDAwMDM2 OTEgNjU1MzUgZg0KMDAwMDAwMzY5MiA2NTUzNSBmDQowMDAwMDAzNjkzIDY1NTM1IGYNCjAw MDAwMDM2OTQgNjU1MzUgZg0KMDAwMDAwMzY5NSA2NTUzNSBmDQowMDAwMDAzNjk2IDY1NTM1 IGYNCjAwMDAwMDM2OTcgNjU1MzUgZg0KMDAwMDAwMzY5OCA2NTUzNSBmDQowMDAwMDAzNjk5 IDY1NTM1IGYNCjAwMDAwMDM3MDAgNjU1MzUgZg0KMDAwMDAwMzcwMSA2NTUzNSBmDQowMDAw MDAzNzAyIDY1NTM1IGYNCjAwMDAwMDM3MDMgNjU1MzUgZg0KMDAwMDAwMzcwNCA2NTUzNSBm DQowMDAwMDAzNzA1IDY1NTM1IGYNCjAwMDAwMDM3MDYgNjU1MzUgZg0KMDAwMDAwMzcwNyA2 NTUzNSBmDQowMDAwMDAzNzA4IDY1NTM1IGYNCjAwMDAwMDM3MDkgNjU1MzUgZg0KMDAwMDAw MzcxMCA2NTUzNSBmDQowMDAwMDAzNzExIDY1NTM1IGYNCjAwMDAwMDM3MTIgNjU1MzUgZg0K MDAwMDAwMzcxMyA2NTUzNSBmDQowMDAwMDAzNzE0IDY1NTM1IGYNCjAwMDAwMDM3MTUgNjU1 MzUgZg0KMDAwMDAwMzcxNiA2NTUzNSBmDQowMDAwMDAzNzE3IDY1NTM1IGYNCjAwMDAwMDM3 MTggNjU1MzUgZg0KMDAwMDAwMzcxOSA2NTUzNSBmDQowMDAwMDAzNzIwIDY1NTM1IGYNCjAw MDAwMDM3MjEgNjU1MzUgZg0KMDAwMDAwMzcyMiA2NTUzNSBmDQowMDAwMDAzNzIzIDY1NTM1 IGYNCjAwMDAwMDM3MjQgNjU1MzUgZg0KMDAwMDAwMzcyNSA2NTUzNSBmDQowMDAwMDAzNzI2 IDY1NTM1IGYNCjAwMDAwMDM3MjcgNjU1MzUgZg0KMDAwMDAwMzcyOCA2NTUzNSBmDQowMDAw MDAzNzI5IDY1NTM1IGYNCjAwMDAwMDM3MzAgNjU1MzUgZg0KMDAwMDAwMzczMSA2NTUzNSBm DQowMDAwMDAzNzMyIDY1NTM1IGYNCjAwMDAwMDM3MzMgNjU1MzUgZg0KMDAwMDAwMzczNCA2 NTUzNSBmDQowMDAwMDAzNzM1IDY1NTM1IGYNCjAwMDAwMDM3MzYgNjU1MzUgZg0KMDAwMDAw MzczNyA2NTUzNSBmDQowMDAwMDAzNzM4IDY1NTM1IGYNCjAwMDAwMDM3MzkgNjU1MzUgZg0K MDAwMDAwMzc0MCA2NTUzNSBmDQowMDAwMDAzNzQxIDY1NTM1IGYNCjAwMDAwMDM3NDIgNjU1 MzUgZg0KMDAwMDAwMzc0MyA2NTUzNSBmDQowMDAwMDAzNzQ0IDY1NTM1IGYNCjAwMDAwMDM3 NDUgNjU1MzUgZg0KMDAwMDAwMzc0NiA2NTUzNSBmDQowMDAwMDAzNzQ3IDY1NTM1IGYNCjAw MDAwMDM3NDggNjU1MzUgZg0KMDAwMDAwMzc0OSA2NTUzNSBmDQowMDAwMDAzNzUwIDY1NTM1 IGYNCjAwMDAwMDM3NTEgNjU1MzUgZg0KMDAwMDAwMzc1MiA2NTUzNSBmDQowMDAwMDAzNzUz IDY1NTM1IGYNCjAwMDAwMDM3NTQgNjU1MzUgZg0KMDAwMDAwMzc1NSA2NTUzNSBmDQowMDAw MDAzNzU2IDY1NTM1IGYNCjAwMDAwMDM3NTcgNjU1MzUgZg0KMDAwMDAwMzc1OCA2NTUzNSBm DQowMDAwMDAzNzU5IDY1NTM1IGYNCjAwMDAwMDM3NjAgNjU1MzUgZg0KMDAwMDAwMzc2MSA2 NTUzNSBmDQowMDAwMDAzNzYyIDY1NTM1IGYNCjAwMDAwMDM3NjMgNjU1MzUgZg0KMDAwMDAw Mzc2NCA2NTUzNSBmDQowMDAwMDAzNzY1IDY1NTM1IGYNCjAwMDAwMDM3NjYgNjU1MzUgZg0K MDAwMDAwMzc2NyA2NTUzNSBmDQowMDAwMDAzNzY4IDY1NTM1IGYNCjAwMDAwMDM3NjkgNjU1 MzUgZg0KMDAwMDAwMzc3MCA2NTUzNSBmDQowMDAwMDAzNzcxIDY1NTM1IGYNCjAwMDAwMDM3 NzIgNjU1MzUgZg0KMDAwMDAwMzc3MyA2NTUzNSBmDQowMDAwMDAzNzc0IDY1NTM1IGYNCjAw MDAwMDM3NzUgNjU1MzUgZg0KMDAwMDAwMzc3NiA2NTUzNSBmDQowMDAwMDAzNzc3IDY1NTM1 IGYNCjAwMDAwMDM3NzggNjU1MzUgZg0KMDAwMDAwMzc3OSA2NTUzNSBmDQowMDAwMDAzNzgw IDY1NTM1IGYNCjAwMDAwMDM3ODEgNjU1MzUgZg0KMDAwMDAwMzc4MiA2NTUzNSBmDQowMDAw MDAzNzgzIDY1NTM1IGYNCjAwMDAwMDM3ODQgNjU1MzUgZg0KMDAwMDAwMzc4NSA2NTUzNSBm DQowMDAwMDAzNzg2IDY1NTM1IGYNCjAwMDAwMDM3ODcgNjU1MzUgZg0KMDAwMDAwMzc4OCA2 NTUzNSBmDQowMDAwMDAzNzg5IDY1NTM1IGYNCjAwMDAwMDM3OTAgNjU1MzUgZg0KMDAwMDAw Mzc5MSA2NTUzNSBmDQowMDAwMDAzNzkyIDY1NTM1IGYNCjAwMDAwMDM3OTMgNjU1MzUgZg0K MDAwMDAwMzc5NCA2NTUzNSBmDQowMDAwMDAzNzk1IDY1NTM1IGYNCjAwMDAwMDM3OTYgNjU1 MzUgZg0KMDAwMDAwMzc5NyA2NTUzNSBmDQowMDAwMDAzNzk4IDY1NTM1IGYNCjAwMDAwMDM3 OTkgNjU1MzUgZg0KMDAwMDAwMzgwMCA2NTUzNSBmDQowMDAwMDAzODAxIDY1NTM1IGYNCjAw MDAwMDM4MDIgNjU1MzUgZg0KMDAwMDAwMzgwMyA2NTUzNSBmDQowMDAwMDAzODA0IDY1NTM1 IGYNCjAwMDAwMDM4MDUgNjU1MzUgZg0KMDAwMDAwMzgwNiA2NTUzNSBmDQowMDAwMDAzODA3 IDY1NTM1IGYNCjAwMDAwMDM4MDggNjU1MzUgZg0KMDAwMDAwMzgxMCA2NTUzNSBmDQowMDAw NTMyOTYxIDAwMDAwIG4NCjAwMDAwMDM4MTEgNjU1MzUgZg0KMDAwMDAwMzgxMiA2NTUzNSBm DQowMDAwMDAzODEzIDY1NTM1IGYNCjAwMDAwMDM4MTUgNjU1MzUgZg0KMDAwMDUzMzAxMyAw MDAwMCBuDQowMDAwMDAzODE2IDY1NTM1IGYNCjAwMDAwMDM4MTcgNjU1MzUgZg0KMDAwMDAw MzgxOCA2NTUzNSBmDQowMDAwMDAzODE5IDY1NTM1IGYNCjAwMDAwMDM4MjAgNjU1MzUgZg0K MDAwMDAwMzgyMSA2NTUzNSBmDQowMDAwMDAzODIyIDY1NTM1IGYNCjAwMDAwMDM4MjMgNjU1 MzUgZg0KMDAwMDAwMzgyNCA2NTUzNSBmDQowMDAwMDAzODI1IDY1NTM1IGYNCjAwMDAwMDM4 MjYgNjU1MzUgZg0KMDAwMDAwMzgyNyA2NTUzNSBmDQowMDAwMDAzODI4IDY1NTM1IGYNCjAw MDAwMDM4MjkgNjU1MzUgZg0KMDAwMDAwMzgzMCA2NTUzNSBmDQowMDAwMDAzODMxIDY1NTM1 IGYNCjAwMDAwMDM4MzMgNjU1MzUgZg0KMDAwMDUzMzA2NyAwMDAwMCBuDQowMDAwMDAzODM0 IDY1NTM1IGYNCjAwMDAwMDM4MzUgNjU1MzUgZg0KMDAwMDAwMzgzNiA2NTUzNSBmDQowMDAw MDAzODM3IDY1NTM1IGYNCjAwMDAwMDM4MzkgNjU1MzUgZg0KMDAwMDUzMzExOSAwMDAwMCBu DQowMDAwMDAzODQwIDY1NTM1IGYNCjAwMDAwMDM4NDEgNjU1MzUgZg0KMDAwMDAwMzg0MiA2 NTUzNSBmDQowMDAwMDAzODQzIDY1NTM1IGYNCjAwMDAwMDM4NDQgNjU1MzUgZg0KMDAwMDAw Mzg0NSA2NTUzNSBmDQowMDAwMDAzODQ3IDY1NTM1IGYNCjAwMDA1MzMxNzEgMDAwMDAgbg0K MDAwMDAwMzg0OCA2NTUzNSBmDQowMDAwMDAzODQ5IDY1NTM1IGYNCjAwMDAwMDM4NTAgNjU1 MzUgZg0KMDAwMDAwMzg1MiA2NTUzNSBmDQowMDAwNTMzMjIzIDAwMDAwIG4NCjAwMDAwMDM4 NTMgNjU1MzUgZg0KMDAwMDAwMzg1NCA2NTUzNSBmDQowMDAwMDAzODU1IDY1NTM1IGYNCjAw MDAwMDM4NTYgNjU1MzUgZg0KMDAwMDAwMzg1NyA2NTUzNSBmDQowMDAwMDAzODU4IDY1NTM1 IGYNCjAwMDAwMDM4NTkgNjU1MzUgZg0KMDAwMDAwMzg2MCA2NTUzNSBmDQowMDAwMDAzODYx IDY1NTM1IGYNCjAwMDAwMDM4NjIgNjU1MzUgZg0KMDAwMDAwMzg2MyA2NTUzNSBmDQowMDAw MDAzODY0IDY1NTM1IGYNCjAwMDAwMDM4NjUgNjU1MzUgZg0KMDAwMDAwMzg2NiA2NTUzNSBm DQowMDAwMDAzODY3IDY1NTM1IGYNCjAwMDAwMDM4NjggNjU1MzUgZg0KMDAwMDAwMzg2OSA2 NTUzNSBmDQowMDAwMDAzODcwIDY1NTM1IGYNCjAwMDAwMDM4NzEgNjU1MzUgZg0KMDAwMDAw Mzg3MiA2NTUzNSBmDQowMDAwMDAzODczIDY1NTM1IGYNCjAwMDAwMDM4NzQgNjU1MzUgZg0K MDAwMDAwMzg3NSA2NTUzNSBmDQowMDAwMDAzODc2IDY1NTM1IGYNCjAwMDAwMDM4NzcgNjU1 MzUgZg0KMDAwMDAwMzg3OCA2NTUzNSBmDQowMDAwMDAzODc5IDY1NTM1IGYNCjAwMDAwMDM4 ODAgNjU1MzUgZg0KMDAwMDAwMzg4MSA2NTUzNSBmDQowMDAwMDAzODgyIDY1NTM1IGYNCjAw MDAwMDM4ODMgNjU1MzUgZg0KMDAwMDAwMzg4NCA2NTUzNSBmDQowMDAwMDAzODg1IDY1NTM1 IGYNCjAwMDAwMDM4ODYgNjU1MzUgZg0KMDAwMDAwMzg4NyA2NTUzNSBmDQowMDAwMDAzODg4 IDY1NTM1IGYNCjAwMDAwMDM4ODkgNjU1MzUgZg0KMDAwMDAwMzg5MCA2NTUzNSBmDQowMDAw MDAzODkxIDY1NTM1IGYNCjAwMDAwMDM4OTIgNjU1MzUgZg0KMDAwMDAwMzg5MyA2NTUzNSBm DQowMDAwMDAzODk0IDY1NTM1IGYNCjAwMDAwMDM4OTUgNjU1MzUgZg0KMDAwMDAwMzg5NiA2 NTUzNSBmDQowMDAwMDAzODk3IDY1NTM1IGYNCjAwMDAwMDM4OTggNjU1MzUgZg0KMDAwMDAw Mzg5OSA2NTUzNSBmDQowMDAwMDAzOTAwIDY1NTM1IGYNCjAwMDAwMDM5MDEgNjU1MzUgZg0K MDAwMDAwMzkwMiA2NTUzNSBmDQowMDAwMDAzOTAzIDY1NTM1IGYNCjAwMDAwMDM5MDQgNjU1 MzUgZg0KMDAwMDAwMzkwNSA2NTUzNSBmDQowMDAwMDAzOTA2IDY1NTM1IGYNCjAwMDAwMDM5 MDcgNjU1MzUgZg0KMDAwMDAwMzkwOCA2NTUzNSBmDQowMDAwMDAzOTA5IDY1NTM1IGYNCjAw MDAwMDM5MTAgNjU1MzUgZg0KMDAwMDAwMzkxMSA2NTUzNSBmDQowMDAwMDAzOTEyIDY1NTM1 IGYNCjAwMDAwMDM5MTMgNjU1MzUgZg0KMDAwMDAwMzkxNCA2NTUzNSBmDQowMDAwMDAzOTE1 IDY1NTM1IGYNCjAwMDAwMDM5MTYgNjU1MzUgZg0KMDAwMDAwMzkxNyA2NTUzNSBmDQowMDAw MDAzOTE4IDY1NTM1IGYNCjAwMDAwMDM5MTkgNjU1MzUgZg0KMDAwMDAwMzkyMCA2NTUzNSBm DQowMDAwMDAzOTIxIDY1NTM1IGYNCjAwMDAwMDM5MjIgNjU1MzUgZg0KMDAwMDAwMzkyMyA2 NTUzNSBmDQowMDAwMDAzOTI0IDY1NTM1IGYNCjAwMDAwMDM5MjUgNjU1MzUgZg0KMDAwMDAw MzkyNiA2NTUzNSBmDQowMDAwMDAzOTI3IDY1NTM1IGYNCjAwMDAwMDM5MjggNjU1MzUgZg0K MDAwMDAwMzkyOSA2NTUzNSBmDQowMDAwMDAzOTMwIDY1NTM1IGYNCjAwMDAwMDM5MzEgNjU1 MzUgZg0KMDAwMDAwMzkzMiA2NTUzNSBmDQowMDAwMDAzOTMzIDY1NTM1IGYNCjAwMDAwMDM5 MzQgNjU1MzUgZg0KMDAwMDAwMzkzNSA2NTUzNSBmDQowMDAwMDAzOTM2IDY1NTM1IGYNCjAw MDAwMDM5MzcgNjU1MzUgZg0KMDAwMDAwMzkzOCA2NTUzNSBmDQowMDAwMDAzOTM5IDY1NTM1 IGYNCjAwMDAwMDM5NDAgNjU1MzUgZg0KMDAwMDAwMzk0MSA2NTUzNSBmDQowMDAwMDAzOTQy IDY1NTM1IGYNCjAwMDAwMDM5NDMgNjU1MzUgZg0KMDAwMDAwMzk0NCA2NTUzNSBmDQowMDAw MDAzOTQ1IDY1NTM1IGYNCjAwMDAwMDM5NDYgNjU1MzUgZg0KMDAwMDAwMzk0NyA2NTUzNSBm DQowMDAwMDAzOTQ4IDY1NTM1IGYNCjAwMDAwMDM5NDkgNjU1MzUgZg0KMDAwMDAwMzk1MCA2 NTUzNSBmDQowMDAwMDAzOTUxIDY1NTM1IGYNCjAwMDAwMDM5NTIgNjU1MzUgZg0KMDAwMDAw Mzk1MyA2NTUzNSBmDQowMDAwMDAzOTU1IDY1NTM1IGYNCjAwMDA1Mzk2MjUgMDAwMDAgbg0K MDAwMDAwMzk1NiA2NTUzNSBmDQowMDAwMDAzOTU3IDY1NTM1IGYNCjAwMDAwMDM5NTggNjU1 MzUgZg0KMDAwMDAwMzk2MCA2NTUzNSBmDQowMDAwNTM5Njc3IDAwMDAwIG4NCjAwMDAwMDM5 NjEgNjU1MzUgZg0KMDAwMDAwMzk2MiA2NTUzNSBmDQowMDAwMDAzOTYzIDY1NTM1IGYNCjAw MDAwMDM5NjQgNjU1MzUgZg0KMDAwMDAwMzk2NSA2NTUzNSBmDQowMDAwMDAzOTY2IDY1NTM1 IGYNCjAwMDAwMDM5NjcgNjU1MzUgZg0KMDAwMDAwMzk2OCA2NTUzNSBmDQowMDAwMDAzOTcw IDY1NTM1IGYNCjAwMDA1Mzk3MzEgMDAwMDAgbg0KMDAwMDAwMzk3MSA2NTUzNSBmDQowMDAw MDAzOTcyIDY1NTM1IGYNCjAwMDAwMDM5NzMgNjU1MzUgZg0KMDAwMDAwMzk3NCA2NTUzNSBm DQowMDAwMDAzOTc1IDY1NTM1IGYNCjAwMDAwMDM5NzYgNjU1MzUgZg0KMDAwMDAwMzk3NyA2 NTUzNSBmDQowMDAwMDAzOTc4IDY1NTM1IGYNCjAwMDAwMDM5NzkgNjU1MzUgZg0KMDAwMDAw Mzk4MCA2NTUzNSBmDQowMDAwMDAzOTgxIDY1NTM1IGYNCjAwMDAwMDM5ODMgNjU1MzUgZg0K MDAwMDUzOTc4MyAwMDAwMCBuDQowMDAwMDAzOTg0IDY1NTM1IGYNCjAwMDAwMDM5ODUgNjU1 MzUgZg0KMDAwMDAwMzk4NiA2NTUzNSBmDQowMDAwMDAzOTg3IDY1NTM1IGYNCjAwMDAwMDM5 ODggNjU1MzUgZg0KMDAwMDAwMzk4OSA2NTUzNSBmDQowMDAwMDAzOTkwIDY1NTM1IGYNCjAw MDAwMDM5OTEgNjU1MzUgZg0KMDAwMDAwMzk5MiA2NTUzNSBmDQowMDAwMDAzOTkzIDY1NTM1 IGYNCjAwMDAwMDM5OTQgNjU1MzUgZg0KMDAwMDAwMzk5NSA2NTUzNSBmDQowMDAwMDAzOTk2 IDY1NTM1IGYNCjAwMDAwMDM5OTcgNjU1MzUgZg0KMDAwMDAwMzk5OCA2NTUzNSBmDQowMDAw MDAzOTk5IDY1NTM1IGYNCjAwMDAwMDQwMDAgNjU1MzUgZg0KMDAwMDAwNDAwMSA2NTUzNSBm DQowMDAwMDA0MDAyIDY1NTM1IGYNCjAwMDAwMDQwMDMgNjU1MzUgZg0KMDAwMDAwNDAwNCA2 NTUzNSBmDQowMDAwMDA0MDA1IDY1NTM1IGYNCjAwMDAwMDQwMDYgNjU1MzUgZg0KMDAwMDAw NDAwNyA2NTUzNSBmDQowMDAwMDA0MDA4IDY1NTM1IGYNCjAwMDAwMDQwMDkgNjU1MzUgZg0K MDAwMDAwNDAxMCA2NTUzNSBmDQowMDAwMDA0MDExIDY1NTM1IGYNCjAwMDAwMDQwMTIgNjU1 MzUgZg0KMDAwMDAwNDAxMyA2NTUzNSBmDQowMDAwMDA0MDE0IDY1NTM1IGYNCjAwMDAwMDQw MTUgNjU1MzUgZg0KMDAwMDAwNDAxNiA2NTUzNSBmDQowMDAwMDA0MDE3IDY1NTM1IGYNCjAw MDAwMDQwMTggNjU1MzUgZg0KMDAwMDAwNDAxOSA2NTUzNSBmDQowMDAwMDA0MDIwIDY1NTM1 IGYNCjAwMDAwMDQwMjEgNjU1MzUgZg0KMDAwMDAwNDAyMiA2NTUzNSBmDQowMDAwMDA0MDIz IDY1NTM1IGYNCjAwMDAwMDQwMjQgNjU1MzUgZg0KMDAwMDAwNDAyNSA2NTUzNSBmDQowMDAw MDA0MDI2IDY1NTM1IGYNCjAwMDAwMDQwMjcgNjU1MzUgZg0KMDAwMDAwNDAyOCA2NTUzNSBm DQowMDAwMDA0MDI5IDY1NTM1IGYNCjAwMDAwMDQwMzAgNjU1MzUgZg0KMDAwMDAwNDAzMSA2 NTUzNSBmDQowMDAwMDA0MDMyIDY1NTM1IGYNCjAwMDAwMDQwMzMgNjU1MzUgZg0KMDAwMDAw NDAzNCA2NTUzNSBmDQowMDAwMDA0MDM1IDY1NTM1IGYNCjAwMDAwMDQwMzYgNjU1MzUgZg0K MDAwMDAwNDAzNyA2NTUzNSBmDQowMDAwMDA0MDM4IDY1NTM1IGYNCjAwMDAwMDQwMzkgNjU1 MzUgZg0KMDAwMDAwNDA0MCA2NTUzNSBmDQowMDAwMDA0MDQxIDY1NTM1IGYNCjAwMDAwMDQw NDIgNjU1MzUgZg0KMDAwMDAwNDA0MyA2NTUzNSBmDQowMDAwMDA0MDQ0IDY1NTM1IGYNCjAw MDAwMDQwNDUgNjU1MzUgZg0KMDAwMDAwNDA0NiA2NTUzNSBmDQowMDAwMDA0MDQ3IDY1NTM1 IGYNCjAwMDAwMDQwNDggNjU1MzUgZg0KMDAwMDAwNDA0OSA2NTUzNSBmDQowMDAwMDA0MDUw IDY1NTM1IGYNCjAwMDAwMDQwNTEgNjU1MzUgZg0KMDAwMDAwNDA1MiA2NTUzNSBmDQowMDAw MDA0MDUzIDY1NTM1IGYNCjAwMDAwMDQwNTQgNjU1MzUgZg0KMDAwMDAwNDA1NSA2NTUzNSBm DQowMDAwMDA0MDU2IDY1NTM1IGYNCjAwMDAwMDQwNTcgNjU1MzUgZg0KMDAwMDAwNDA1OCA2 NTUzNSBmDQowMDAwMDA0MDU5IDY1NTM1IGYNCjAwMDAwMDQwNjAgNjU1MzUgZg0KMDAwMDAw NDA2MSA2NTUzNSBmDQowMDAwMDA0MDYyIDY1NTM1IGYNCjAwMDAwMDQwNjMgNjU1MzUgZg0K MDAwMDAwNDA2NCA2NTUzNSBmDQowMDAwMDA0MDY1IDY1NTM1IGYNCjAwMDAwMDQwNjYgNjU1 MzUgZg0KMDAwMDAwNDA2NyA2NTUzNSBmDQowMDAwMDA0MDY4IDY1NTM1IGYNCjAwMDAwMDQw NjkgNjU1MzUgZg0KMDAwMDAwNDA3MCA2NTUzNSBmDQowMDAwMDA0MDcxIDY1NTM1IGYNCjAw MDAwMDQwNzIgNjU1MzUgZg0KMDAwMDAwNDA3MyA2NTUzNSBmDQowMDAwMDA0MDc0IDY1NTM1 IGYNCjAwMDAwMDQwNzUgNjU1MzUgZg0KMDAwMDAwNDA3NiA2NTUzNSBmDQowMDAwMDA0MDc4 IDY1NTM1IGYNCjAwMDA1Mzk4MzggMDAwMDAgbg0KMDAwMDAwNDA3OSA2NTUzNSBmDQowMDAw MDA0MDgwIDY1NTM1IGYNCjAwMDAwMDQwODEgNjU1MzUgZg0KMDAwMDAwNDA4MiA2NTUzNSBm DQowMDAwMDA0MDgzIDY1NTM1IGYNCjAwMDAwMDQwODQgNjU1MzUgZg0KMDAwMDAwNDA4NSA2 NTUzNSBmDQowMDAwMDA0MDg3IDY1NTM1IGYNCjAwMDA1Mzk4OTMgMDAwMDAgbg0KMDAwMDAw NDA4OCA2NTUzNSBmDQowMDAwMDA0MDg5IDY1NTM1IGYNCjAwMDAwMDQwOTAgNjU1MzUgZg0K MDAwMDAwNDA5MSA2NTUzNSBmDQowMDAwMDA0MDkyIDY1NTM1IGYNCjAwMDAwMDQwOTMgNjU1 MzUgZg0KMDAwMDAwNDA5NCA2NTUzNSBmDQowMDAwMDA0MDk1IDY1NTM1IGYNCjAwMDAwMDQw OTYgNjU1MzUgZg0KMDAwMDAwNDA5NyA2NTUzNSBmDQowMDAwMDA0MDk4IDY1NTM1IGYNCjAw MDAwMDQwOTkgNjU1MzUgZg0KMDAwMDAwNDEwMCA2NTUzNSBmDQowMDAwMDA0MTAxIDY1NTM1 IGYNCjAwMDAwMDQxMDIgNjU1MzUgZg0KMDAwMDAwNDEwMyA2NTUzNSBmDQowMDAwMDA0MTA0 IDY1NTM1IGYNCjAwMDAwMDQxMDUgNjU1MzUgZg0KMDAwMDAwNDEwNiA2NTUzNSBmDQowMDAw MDA0MTA3IDY1NTM1IGYNCjAwMDAwMDQxMDggNjU1MzUgZg0KMDAwMDAwNDEwOSA2NTUzNSBm DQowMDAwMDA0MTEwIDY1NTM1IGYNCjAwMDAwMDQxMTEgNjU1MzUgZg0KMDAwMDAwNDExMiA2 NTUzNSBmDQowMDAwMDA0MTEzIDY1NTM1IGYNCjAwMDAwMDQxMTQgNjU1MzUgZg0KMDAwMDAw NDExNSA2NTUzNSBmDQowMDAwMDA0MTE2IDY1NTM1IGYNCjAwMDAwMDQxMTcgNjU1MzUgZg0K MDAwMDAwNDExOCA2NTUzNSBmDQowMDAwMDA0MTE5IDY1NTM1IGYNCjAwMDAwMDQxMjAgNjU1 MzUgZg0KMDAwMDAwNDEyMSA2NTUzNSBmDQowMDAwMDA0MTIyIDY1NTM1IGYNCjAwMDAwMDQx MjMgNjU1MzUgZg0KMDAwMDAwNDEyNCA2NTUzNSBmDQowMDAwMDA0MTI1IDY1NTM1IGYNCjAw MDAwMDQxMjYgNjU1MzUgZg0KMDAwMDAwNDEyNyA2NTUzNSBmDQowMDAwMDA0MTI4IDY1NTM1 IGYNCjAwMDAwMDQxMjkgNjU1MzUgZg0KMDAwMDAwNDEzMCA2NTUzNSBmDQowMDAwMDA0MTMx IDY1NTM1IGYNCjAwMDAwMDQxMzIgNjU1MzUgZg0KMDAwMDAwNDEzMyA2NTUzNSBmDQowMDAw MDA0MTM0IDY1NTM1IGYNCjAwMDAwMDQxMzUgNjU1MzUgZg0KMDAwMDAwNDEzNiA2NTUzNSBm DQowMDAwMDA0MTM3IDY1NTM1IGYNCjAwMDAwMDQxMzggNjU1MzUgZg0KMDAwMDAwNDEzOSA2 NTUzNSBmDQowMDAwMDA0MTQwIDY1NTM1IGYNCjAwMDAwMDQxNDEgNjU1MzUgZg0KMDAwMDAw NDE0MiA2NTUzNSBmDQowMDAwMDA0MTQzIDY1NTM1IGYNCjAwMDAwMDQxNDQgNjU1MzUgZg0K MDAwMDAwNDE0NSA2NTUzNSBmDQowMDAwMDA0MTQ2IDY1NTM1IGYNCjAwMDAwMDQxNDcgNjU1 MzUgZg0KMDAwMDAwNDE0OCA2NTUzNSBmDQowMDAwMDA0MTQ5IDY1NTM1IGYNCjAwMDAwMDQx NTAgNjU1MzUgZg0KMDAwMDAwNDE1MSA2NTUzNSBmDQowMDAwMDA0MTUyIDY1NTM1IGYNCjAw MDAwMDQxNTMgNjU1MzUgZg0KMDAwMDAwNDE1NCA2NTUzNSBmDQowMDAwMDA0MTU1IDY1NTM1 IGYNCjAwMDAwMDQxNTYgNjU1MzUgZg0KMDAwMDAwNDE1NyA2NTUzNSBmDQowMDAwMDA0MTU4 IDY1NTM1IGYNCjAwMDAwMDQxNTkgNjU1MzUgZg0KMDAwMDAwNDE2MCA2NTUzNSBmDQowMDAw MDA0MTYxIDY1NTM1IGYNCjAwMDAwMDQxNjIgNjU1MzUgZg0KMDAwMDAwNDE2MyA2NTUzNSBm DQowMDAwMDA0MTY0IDY1NTM1IGYNCjAwMDAwMDQxNjUgNjU1MzUgZg0KMDAwMDAwNDE2NiA2 NTUzNSBmDQowMDAwMDA0MTY3IDY1NTM1IGYNCjAwMDAwMDQxNjggNjU1MzUgZg0KMDAwMDAw NDE2OSA2NTUzNSBmDQowMDAwMDA0MTcwIDY1NTM1IGYNCjAwMDAwMDQxNzEgNjU1MzUgZg0K MDAwMDAwNDE3MiA2NTUzNSBmDQowMDAwMDA0MTczIDY1NTM1IGYNCjAwMDAwMDQxNzQgNjU1 MzUgZg0KMDAwMDAwNDE3NSA2NTUzNSBmDQowMDAwMDA0MTc2IDY1NTM1IGYNCjAwMDAwMDQx NzcgNjU1MzUgZg0KMDAwMDAwNDE3OCA2NTUzNSBmDQowMDAwMDA0MTc5IDY1NTM1IGYNCjAw MDAwMDQxODAgNjU1MzUgZg0KMDAwMDAwNDE4MSA2NTUzNSBmDQowMDAwMDA0MTgyIDY1NTM1 IGYNCjAwMDAwMDQxODMgNjU1MzUgZg0KMDAwMDAwNDE4NCA2NTUzNSBmDQowMDAwMDA0MTg1 IDY1NTM1IGYNCjAwMDAwMDQxODYgNjU1MzUgZg0KMDAwMDAwNDE4NyA2NTUzNSBmDQowMDAw MDA0MTg4IDY1NTM1IGYNCjAwMDAwMDQxODkgNjU1MzUgZg0KMDAwMDAwNDE5MCA2NTUzNSBm DQowMDAwMDA0MTkxIDY1NTM1IGYNCjAwMDAwMDQxOTIgNjU1MzUgZg0KMDAwMDAwNDE5MyA2 NTUzNSBmDQowMDAwMDA0MTk0IDY1NTM1IGYNCjAwMDAwMDQxOTUgNjU1MzUgZg0KMDAwMDAw NDE5NiA2NTUzNSBmDQowMDAwMDA0MTk3IDY1NTM1IGYNCjAwMDAwMDQxOTggNjU1MzUgZg0K MDAwMDAwNDE5OSA2NTUzNSBmDQowMDAwMDA0MjAwIDY1NTM1IGYNCjAwMDAwMDQyMDEgNjU1 MzUgZg0KMDAwMDAwNDIwMiA2NTUzNSBmDQowMDAwMDA0MjAzIDY1NTM1IGYNCjAwMDAwMDQy MDQgNjU1MzUgZg0KMDAwMDAwNDIwNSA2NTUzNSBmDQowMDAwMDA0MjA2IDY1NTM1IGYNCjAw MDAwMDQyMDcgNjU1MzUgZg0KMDAwMDAwNDIwOCA2NTUzNSBmDQowMDAwMDA0MjA5IDY1NTM1 IGYNCjAwMDAwMDQyMTAgNjU1MzUgZg0KMDAwMDAwNDIxMSA2NTUzNSBmDQowMDAwMDA0MjEy IDY1NTM1IGYNCjAwMDAwMDQyMTMgNjU1MzUgZg0KMDAwMDAwNDIxNCA2NTUzNSBmDQowMDAw MDA0MjE1IDY1NTM1IGYNCjAwMDAwMDQyMTYgNjU1MzUgZg0KMDAwMDAwNDIxNyA2NTUzNSBm DQowMDAwMDA0MjE4IDY1NTM1IGYNCjAwMDAwMDQyMTkgNjU1MzUgZg0KMDAwMDAwNDIyMCA2 NTUzNSBmDQowMDAwMDA0MjIxIDY1NTM1IGYNCjAwMDAwMDQyMjIgNjU1MzUgZg0KMDAwMDAw NDIyMyA2NTUzNSBmDQowMDAwMDA0MjI0IDY1NTM1IGYNCjAwMDAwMDQyMjUgNjU1MzUgZg0K MDAwMDAwNDIyNiA2NTUzNSBmDQowMDAwMDA0MjI3IDY1NTM1IGYNCjAwMDAwMDQyMjggNjU1 MzUgZg0KMDAwMDAwNDIyOSA2NTUzNSBmDQowMDAwMDA0MjMwIDY1NTM1IGYNCjAwMDAwMDQy MzEgNjU1MzUgZg0KMDAwMDAwNDIzMiA2NTUzNSBmDQowMDAwMDA0MjMzIDY1NTM1IGYNCjAw MDAwMDQyMzQgNjU1MzUgZg0KMDAwMDAwNDIzNSA2NTUzNSBmDQowMDAwMDA0MjM2IDY1NTM1 IGYNCjAwMDAwMDQyMzcgNjU1MzUgZg0KMDAwMDAwNDIzOCA2NTUzNSBmDQowMDAwMDA0MjM5 IDY1NTM1IGYNCjAwMDAwMDQyNDAgNjU1MzUgZg0KMDAwMDAwNDI0MSA2NTUzNSBmDQowMDAw MDA0MjQyIDY1NTM1IGYNCjAwMDAwMDQyNDMgNjU1MzUgZg0KMDAwMDAwNDI0NCA2NTUzNSBm DQowMDAwMDA0MjQ1IDY1NTM1IGYNCjAwMDAwMDQyNDYgNjU1MzUgZg0KMDAwMDAwNDI0NyA2 NTUzNSBmDQowMDAwMDA0MjQ4IDY1NTM1IGYNCjAwMDAwMDQyNDkgNjU1MzUgZg0KMDAwMDAw NDI1MCA2NTUzNSBmDQowMDAwMDA0MjUxIDY1NTM1IGYNCjAwMDAwMDQyNTIgNjU1MzUgZg0K MDAwMDAwNDI1MyA2NTUzNSBmDQowMDAwMDA0MjU0IDY1NTM1IGYNCjAwMDAwMDQyNTUgNjU1 MzUgZg0KMDAwMDAwNDI1NiA2NTUzNSBmDQowMDAwMDA0MjU3IDY1NTM1IGYNCjAwMDAwMDQy NTggNjU1MzUgZg0KMDAwMDAwNDI1OSA2NTUzNSBmDQowMDAwMDA0MjYwIDY1NTM1IGYNCjAw MDAwMDQyNjEgNjU1MzUgZg0KMDAwMDAwNDI2MiA2NTUzNSBmDQowMDAwMDA0MjYzIDY1NTM1 IGYNCjAwMDAwMDQyNjQgNjU1MzUgZg0KMDAwMDAwNDI2NSA2NTUzNSBmDQowMDAwMDA0MjY2 IDY1NTM1IGYNCjAwMDAwMDQyNjcgNjU1MzUgZg0KMDAwMDAwNDI2OCA2NTUzNSBmDQowMDAw MDA0MjY5IDY1NTM1IGYNCjAwMDAwMDQyNzAgNjU1MzUgZg0KMDAwMDAwNDI3MSA2NTUzNSBm DQowMDAwMDA0MjcyIDY1NTM1IGYNCjAwMDAwMDQyNzMgNjU1MzUgZg0KMDAwMDAwNDI3NCA2 NTUzNSBmDQowMDAwMDA0Mjc1IDY1NTM1IGYNCjAwMDAwMDQyNzYgNjU1MzUgZg0KMDAwMDAw NDI3NyA2NTUzNSBmDQowMDAwMDA0Mjc4IDY1NTM1IGYNCjAwMDAwMDQyNzkgNjU1MzUgZg0K MDAwMDAwNDI4MCA2NTUzNSBmDQowMDAwMDA0MjgxIDY1NTM1IGYNCjAwMDAwMDQyODIgNjU1 MzUgZg0KMDAwMDAwNDI4MyA2NTUzNSBmDQowMDAwMDA0Mjg0IDY1NTM1IGYNCjAwMDAwMDQy ODUgNjU1MzUgZg0KMDAwMDAwNDI4NiA2NTUzNSBmDQowMDAwMDA0Mjg3IDY1NTM1IGYNCjAw MDAwMDQyODggNjU1MzUgZg0KMDAwMDAwNDI4OSA2NTUzNSBmDQowMDAwMDA0MjkwIDY1NTM1 IGYNCjAwMDAwMDQyOTEgNjU1MzUgZg0KMDAwMDAwNDI5MiA2NTUzNSBmDQowMDAwMDA0Mjkz IDY1NTM1IGYNCjAwMDAwMDQyOTQgNjU1MzUgZg0KMDAwMDAwNDI5NSA2NTUzNSBmDQowMDAw MDA0Mjk2IDY1NTM1IGYNCjAwMDAwMDQyOTcgNjU1MzUgZg0KMDAwMDAwNDI5OCA2NTUzNSBm DQowMDAwMDA0Mjk5IDY1NTM1IGYNCjAwMDAwMDQzMDAgNjU1MzUgZg0KMDAwMDAwNDMwMSA2 NTUzNSBmDQowMDAwMDA0MzAyIDY1NTM1IGYNCjAwMDAwMDQzMDMgNjU1MzUgZg0KMDAwMDAw NDMwNCA2NTUzNSBmDQowMDAwMDA0MzA1IDY1NTM1IGYNCjAwMDAwMDQzMDYgNjU1MzUgZg0K MDAwMDAwNDMwNyA2NTUzNSBmDQowMDAwMDA0MzA4IDY1NTM1IGYNCjAwMDAwMDQzMDkgNjU1 MzUgZg0KMDAwMDAwNDMxMCA2NTUzNSBmDQowMDAwMDA0MzEyIDY1NTM1IGYNCjAwMDA1Mzk5 NDggMDAwMDAgbg0KMDAwMDAwNDMxMyA2NTUzNSBmDQowMDAwMDA0MzE0IDY1NTM1IGYNCjAw MDAwMDQzMTUgNjU1MzUgZg0KMDAwMDAwNDMxNiA2NTUzNSBmDQowMDAwMDA0MzE3IDY1NTM1 IGYNCjAwMDAwMDQzMTkgNjU1MzUgZg0KMDAwMDU0MDAwMCAwMDAwMCBuDQowMDAwMDA0MzIw IDY1NTM1IGYNCjAwMDAwMDQzMjEgNjU1MzUgZg0KMDAwMDAwNDMyMiA2NTUzNSBmDQowMDAw MDA0MzIzIDY1NTM1IGYNCjAwMDAwMDQzMjQgNjU1MzUgZg0KMDAwMDAwNDMyNiA2NTUzNSBm DQowMDAwNTQwMDU0IDAwMDAwIG4NCjAwMDAwMDQzMjcgNjU1MzUgZg0KMDAwMDAwNDMyOCA2 NTUzNSBmDQowMDAwMDA0MzI5IDY1NTM1IGYNCjAwMDAwMDQzMzAgNjU1MzUgZg0KMDAwMDAw NDMzMSA2NTUzNSBmDQowMDAwMDA0MzMzIDY1NTM1IGYNCjAwMDA1NDAxMDggMDAwMDAgbg0K MDAwMDAwNDMzNCA2NTUzNSBmDQowMDAwMDA0MzM1IDY1NTM1IGYNCjAwMDAwMDQzMzYgNjU1 MzUgZg0KMDAwMDAwNDMzNyA2NTUzNSBmDQowMDAwMDA0MzM4IDY1NTM1IGYNCjAwMDAwMDQz NDAgNjU1MzUgZg0KMDAwMDU0MDE2MCAwMDAwMCBuDQowMDAwMDA0MzQxIDY1NTM1IGYNCjAw MDAwMDQzNDIgNjU1MzUgZg0KMDAwMDAwNDM0MyA2NTUzNSBmDQowMDAwMDA0MzQ1IDY1NTM1 IGYNCjAwMDA1NDAyMTIgMDAwMDAgbg0KMDAwMDAwNDM0NiA2NTUzNSBmDQowMDAwMDA0MzQ3 IDY1NTM1IGYNCjAwMDAwMDQzNDggNjU1MzUgZg0KMDAwMDAwNDM0OSA2NTUzNSBmDQowMDAw MDA0MzUwIDY1NTM1IGYNCjAwMDAwMDQzNTEgNjU1MzUgZg0KMDAwMDAwNDM1MyA2NTUzNSBm DQowMDAwNTQwMjY2IDAwMDAwIG4NCjAwMDAwMDQzNTQgNjU1MzUgZg0KMDAwMDAwNDM1NSA2 NTUzNSBmDQowMDAwMDA0MzU3IDY1NTM1IGYNCjAwMDA1NDAzMTggMDAwMDAgbg0KMDAwMDAw NDM1OCA2NTUzNSBmDQowMDAwMDA0MzU5IDY1NTM1IGYNCjAwMDAwMDQzNjAgNjU1MzUgZg0K MDAwMDAwNDM2MSA2NTUzNSBmDQowMDAwMDA0MzYyIDY1NTM1IGYNCjAwMDAwMDQzNjMgNjU1 MzUgZg0KMDAwMDAwNDM2NCA2NTUzNSBmDQowMDAwMDA0MzY1IDY1NTM1IGYNCjAwMDAwMDQz NjYgNjU1MzUgZg0KMDAwMDAwNDM2NyA2NTUzNSBmDQowMDAwMDA0MzY4IDY1NTM1IGYNCjAw MDAwMDQzNjkgNjU1MzUgZg0KMDAwMDAwNDM3MSA2NTUzNSBmDQowMDAwNTQwMzcwIDAwMDAw IG4NCjAwMDAwMDQzNzIgNjU1MzUgZg0KMDAwMDAwNDM3MyA2NTUzNSBmDQowMDAwMDA0Mzc0 IDY1NTM1IGYNCjAwMDAwMDQzNzUgNjU1MzUgZg0KMDAwMDAwNDM3NiA2NTUzNSBmDQowMDAw MDA0Mzc3IDY1NTM1IGYNCjAwMDAwMDQzNzggNjU1MzUgZg0KMDAwMDAwNDM3OSA2NTUzNSBm DQowMDAwMDA0MzgwIDY1NTM1IGYNCjAwMDAwMDQzODEgNjU1MzUgZg0KMDAwMDAwNDM4MiA2 NTUzNSBmDQowMDAwMDA0MzgzIDY1NTM1IGYNCjAwMDAwMDQzODQgNjU1MzUgZg0KMDAwMDAw NDM4NSA2NTUzNSBmDQowMDAwMDA0Mzg2IDY1NTM1IGYNCjAwMDAwMDQzODcgNjU1MzUgZg0K MDAwMDAwNDM4OCA2NTUzNSBmDQowMDAwMDA0Mzg5IDY1NTM1IGYNCjAwMDAwMDQzOTAgNjU1 MzUgZg0KMDAwMDAwNDM5MSA2NTUzNSBmDQowMDAwMDA0MzkyIDY1NTM1IGYNCjAwMDAwMDQz OTMgNjU1MzUgZg0KMDAwMDAwNDM5NCA2NTUzNSBmDQowMDAwMDA0Mzk1IDY1NTM1IGYNCjAw MDAwMDQzOTYgNjU1MzUgZg0KMDAwMDAwNDM5NyA2NTUzNSBmDQowMDAwMDA0Mzk4IDY1NTM1 IGYNCjAwMDAwMDQzOTkgNjU1MzUgZg0KMDAwMDAwNDQwMCA2NTUzNSBmDQowMDAwMDA0NDAx IDY1NTM1IGYNCjAwMDAwMDQ0MDIgNjU1MzUgZg0KMDAwMDAwNDQwMyA2NTUzNSBmDQowMDAw MDA0NDA0IDY1NTM1IGYNCjAwMDAwMDQ0MDUgNjU1MzUgZg0KMDAwMDAwNDQwNiA2NTUzNSBm DQowMDAwMDA0NDA3IDY1NTM1IGYNCjAwMDAwMDQ0MDggNjU1MzUgZg0KMDAwMDAwNDQwOSA2 NTUzNSBmDQowMDAwMDA0NDEwIDY1NTM1IGYNCjAwMDAwMDQ0MTEgNjU1MzUgZg0KMDAwMDAw NDQxMiA2NTUzNSBmDQowMDAwMDA0NDEzIDY1NTM1IGYNCjAwMDAwMDQ0MTQgNjU1MzUgZg0K MDAwMDAwNDQxNSA2NTUzNSBmDQowMDAwMDA0NDE2IDY1NTM1IGYNCjAwMDAwMDQ0MTcgNjU1 MzUgZg0KMDAwMDAwNDQxOCA2NTUzNSBmDQowMDAwMDA0NDE5IDY1NTM1IGYNCjAwMDAwMDQ0 MjAgNjU1MzUgZg0KMDAwMDAwNDQyMSA2NTUzNSBmDQowMDAwMDA0NDIyIDY1NTM1IGYNCjAw MDAwMDQ0MjMgNjU1MzUgZg0KMDAwMDAwNDQyNCA2NTUzNSBmDQowMDAwMDA0NDI1IDY1NTM1 IGYNCjAwMDAwMDQ0MjYgNjU1MzUgZg0KMDAwMDAwNDQyNyA2NTUzNSBmDQowMDAwMDA0NDI4 IDY1NTM1IGYNCjAwMDAwMDQ0MjkgNjU1MzUgZg0KMDAwMDAwNDQzMCA2NTUzNSBmDQowMDAw MDA0NDMxIDY1NTM1IGYNCjAwMDAwMDQ0MzIgNjU1MzUgZg0KMDAwMDAwNDQzMyA2NTUzNSBm DQowMDAwMDA0NDM0IDY1NTM1IGYNCjAwMDAwMDQ0MzUgNjU1MzUgZg0KMDAwMDAwNDQzNiA2 NTUzNSBmDQowMDAwMDA0NDM3IDY1NTM1IGYNCjAwMDAwMDQ0MzggNjU1MzUgZg0KMDAwMDAw NDQzOSA2NTUzNSBmDQowMDAwMDA0NDQwIDY1NTM1IGYNCjAwMDAwMDQ0NDEgNjU1MzUgZg0K MDAwMDAwNDQ0MiA2NTUzNSBmDQowMDAwMDA0NDQzIDY1NTM1IGYNCjAwMDAwMDQ0NDQgNjU1 MzUgZg0KMDAwMDAwNDQ0NSA2NTUzNSBmDQowMDAwMDA0NDQ2IDY1NTM1IGYNCjAwMDAwMDQ0 NDcgNjU1MzUgZg0KMDAwMDAwNDQ0OCA2NTUzNSBmDQowMDAwMDA0NDQ5IDY1NTM1IGYNCjAw MDAwMDQ0NTAgNjU1MzUgZg0KMDAwMDAwNDQ1MSA2NTUzNSBmDQowMDAwMDA0NDUyIDY1NTM1 IGYNCjAwMDAwMDQ0NTMgNjU1MzUgZg0KMDAwMDAwNDQ1NCA2NTUzNSBmDQowMDAwMDA0NDU1 IDY1NTM1IGYNCjAwMDAwMDQ0NTYgNjU1MzUgZg0KMDAwMDAwNDQ1NyA2NTUzNSBmDQowMDAw MDA0NDU4IDY1NTM1IGYNCjAwMDAwMDQ0NTkgNjU1MzUgZg0KMDAwMDAwNDQ2MCA2NTUzNSBm DQowMDAwMDA0NDYxIDY1NTM1IGYNCjAwMDAwMDQ0NjIgNjU1MzUgZg0KMDAwMDAwNDQ2MyA2 NTUzNSBmDQowMDAwMDA0NDY0IDY1NTM1IGYNCjAwMDAwMDQ0NjUgNjU1MzUgZg0KMDAwMDAw NDQ2NiA2NTUzNSBmDQowMDAwMDA0NDY3IDY1NTM1IGYNCjAwMDAwMDQ0NjggNjU1MzUgZg0K MDAwMDAwNDQ2OSA2NTUzNSBmDQowMDAwMDA0NDcwIDY1NTM1IGYNCjAwMDAwMDQ0NzEgNjU1 MzUgZg0KMDAwMDAwNDQ3MiA2NTUzNSBmDQowMDAwMDA0NDczIDY1NTM1IGYNCjAwMDAwMDQ0 NzQgNjU1MzUgZg0KMDAwMDAwNDQ3NSA2NTUzNSBmDQowMDAwMDA0NDc2IDY1NTM1IGYNCjAw MDAwMDQ0NzcgNjU1MzUgZg0KMDAwMDAwNDQ3OCA2NTUzNSBmDQowMDAwMDA0NDc5IDY1NTM1 IGYNCjAwMDAwMDQ0ODAgNjU1MzUgZg0KMDAwMDAwNDQ4MSA2NTUzNSBmDQowMDAwMDA0NDgy IDY1NTM1IGYNCjAwMDAwMDQ0ODMgNjU1MzUgZg0KMDAwMDAwNDQ4NCA2NTUzNSBmDQowMDAw MDA0NDg1IDY1NTM1IGYNCjAwMDAwMDQ0ODYgNjU1MzUgZg0KMDAwMDAwNDQ4NyA2NTUzNSBm DQowMDAwMDA0NDg4IDY1NTM1IGYNCjAwMDAwMDQ0ODkgNjU1MzUgZg0KMDAwMDAwNDQ5MCA2 NTUzNSBmDQowMDAwMDA0NDkxIDY1NTM1IGYNCjAwMDAwMDQ0OTIgNjU1MzUgZg0KMDAwMDAw NDQ5MyA2NTUzNSBmDQowMDAwMDA0NDk0IDY1NTM1IGYNCjAwMDAwMDQ0OTUgNjU1MzUgZg0K MDAwMDAwNDQ5NiA2NTUzNSBmDQowMDAwMDA0NDk3IDY1NTM1IGYNCjAwMDAwMDQ0OTggNjU1 MzUgZg0KMDAwMDAwNDQ5OSA2NTUzNSBmDQowMDAwMDA0NTAwIDY1NTM1IGYNCjAwMDAwMDQ1 MDEgNjU1MzUgZg0KMDAwMDAwNDUwMiA2NTUzNSBmDQowMDAwMDA0NTAzIDY1NTM1IGYNCjAw MDAwMDQ1MDQgNjU1MzUgZg0KMDAwMDAwNDUwNSA2NTUzNSBmDQowMDAwMDA0NTA2IDY1NTM1 IGYNCjAwMDAwMDQ1MDcgNjU1MzUgZg0KMDAwMDAwNDUwOCA2NTUzNSBmDQowMDAwMDA0NTA5 IDY1NTM1IGYNCjAwMDAwMDQ1MTAgNjU1MzUgZg0KMDAwMDAwNDUxMSA2NTUzNSBmDQowMDAw MDA0NTEyIDY1NTM1IGYNCjAwMDAwMDQ1MTMgNjU1MzUgZg0KMDAwMDAwNDUxNCA2NTUzNSBm DQowMDAwMDA0NTE1IDY1NTM1IGYNCjAwMDAwMDQ1MTYgNjU1MzUgZg0KMDAwMDAwNDUxNyA2 NTUzNSBmDQowMDAwMDA0NTE4IDY1NTM1IGYNCjAwMDAwMDQ1MTkgNjU1MzUgZg0KMDAwMDAw NDUyMCA2NTUzNSBmDQowMDAwMDA0NTIxIDY1NTM1IGYNCjAwMDAwMDQ1MjIgNjU1MzUgZg0K MDAwMDAwNDUyMyA2NTUzNSBmDQowMDAwMDA0NTI0IDY1NTM1IGYNCjAwMDAwMDQ1MjUgNjU1 MzUgZg0KMDAwMDAwNDUyNiA2NTUzNSBmDQowMDAwMDA0NTI3IDY1NTM1IGYNCjAwMDAwMDQ1 MjggNjU1MzUgZg0KMDAwMDAwNDUyOSA2NTUzNSBmDQowMDAwMDA0NTMwIDY1NTM1IGYNCjAw MDAwMDQ1MzEgNjU1MzUgZg0KMDAwMDAwNDUzMiA2NTUzNSBmDQowMDAwMDA0NTMzIDY1NTM1 IGYNCjAwMDAwMDQ1MzQgNjU1MzUgZg0KMDAwMDAwNDUzNSA2NTUzNSBmDQowMDAwMDA0NTM2 IDY1NTM1IGYNCjAwMDAwMDQ1MzcgNjU1MzUgZg0KMDAwMDAwNDUzOCA2NTUzNSBmDQowMDAw MDA0NTM5IDY1NTM1IGYNCjAwMDAwMDQ1NDAgNjU1MzUgZg0KMDAwMDAwNDU0MSA2NTUzNSBm DQowMDAwMDA0NTQyIDY1NTM1IGYNCjAwMDAwMDQ1NDMgNjU1MzUgZg0KMDAwMDAwNDU0NCA2 NTUzNSBmDQowMDAwMDA0NTQ1IDY1NTM1IGYNCjAwMDAwMDQ1NDYgNjU1MzUgZg0KMDAwMDAw NDU0NyA2NTUzNSBmDQowMDAwMDA0NTQ4IDY1NTM1IGYNCjAwMDAwMDQ1NDkgNjU1MzUgZg0K MDAwMDAwNDU1MCA2NTUzNSBmDQowMDAwMDA0NTUxIDY1NTM1IGYNCjAwMDAwMDQ1NTIgNjU1 MzUgZg0KMDAwMDAwNDU1MyA2NTUzNSBmDQowMDAwMDA0NTU0IDY1NTM1IGYNCjAwMDAwMDQ1 NTUgNjU1MzUgZg0KMDAwMDAwNDU1NiA2NTUzNSBmDQowMDAwMDA0NTU3IDY1NTM1IGYNCjAw MDAwMDQ1NTggNjU1MzUgZg0KMDAwMDAwNDU1OSA2NTUzNSBmDQowMDAwMDA0NTYwIDY1NTM1 IGYNCjAwMDAwMDQ1NjEgNjU1MzUgZg0KMDAwMDAwNDU2MiA2NTUzNSBmDQowMDAwMDA0NTYz IDY1NTM1IGYNCjAwMDAwMDQ1NjQgNjU1MzUgZg0KMDAwMDAwNDU2NSA2NTUzNSBmDQowMDAw MDA0NTY2IDY1NTM1IGYNCjAwMDAwMDQ1NjcgNjU1MzUgZg0KMDAwMDAwNDU2OCA2NTUzNSBm DQowMDAwMDA0NTY5IDY1NTM1IGYNCjAwMDAwMDQ1NzAgNjU1MzUgZg0KMDAwMDAwNDU3MSA2 NTUzNSBmDQowMDAwMDA0NTcyIDY1NTM1IGYNCjAwMDAwMDQ1NzMgNjU1MzUgZg0KMDAwMDAw NDU3NCA2NTUzNSBmDQowMDAwMDA0NTc1IDY1NTM1IGYNCjAwMDAwMDQ1NzYgNjU1MzUgZg0K MDAwMDAwNDU3NyA2NTUzNSBmDQowMDAwMDA0NTc4IDY1NTM1IGYNCjAwMDAwMDQ1NzkgNjU1 MzUgZg0KMDAwMDAwNDU4MCA2NTUzNSBmDQowMDAwMDA0NTgxIDY1NTM1IGYNCjAwMDAwMDQ1 ODIgNjU1MzUgZg0KMDAwMDAwNDU4MyA2NTUzNSBmDQowMDAwMDA0NTg0IDY1NTM1IGYNCjAw MDAwMDQ1ODUgNjU1MzUgZg0KMDAwMDAwNDU4NiA2NTUzNSBmDQowMDAwMDA0NTg3IDY1NTM1 IGYNCjAwMDAwMDQ1ODggNjU1MzUgZg0KMDAwMDAwNDU4OSA2NTUzNSBmDQowMDAwMDA0NTkw IDY1NTM1IGYNCjAwMDAwMDQ1OTEgNjU1MzUgZg0KMDAwMDAwNDU5MiA2NTUzNSBmDQowMDAw MDA0NTkzIDY1NTM1IGYNCjAwMDAwMDQ1OTQgNjU1MzUgZg0KMDAwMDAwNDU5NSA2NTUzNSBm DQowMDAwMDA0NTk2IDY1NTM1IGYNCjAwMDAwMDQ1OTcgNjU1MzUgZg0KMDAwMDAwNDU5OCA2 NTUzNSBmDQowMDAwMDA0NTk5IDY1NTM1IGYNCjAwMDAwMDQ2MDAgNjU1MzUgZg0KMDAwMDAw NDYwMSA2NTUzNSBmDQowMDAwMDA0NjAyIDY1NTM1IGYNCjAwMDAwMDQ2MDMgNjU1MzUgZg0K MDAwMDAwNDYwNCA2NTUzNSBmDQowMDAwMDA0NjA1IDY1NTM1IGYNCjAwMDAwMDQ2MDYgNjU1 MzUgZg0KMDAwMDAwNDYwNyA2NTUzNSBmDQowMDAwMDA0NjA4IDY1NTM1IGYNCjAwMDAwMDQ2 MDkgNjU1MzUgZg0KMDAwMDAwNDYxMCA2NTUzNSBmDQowMDAwMDA0NjExIDY1NTM1IGYNCjAw MDAwMDQ2MTIgNjU1MzUgZg0KMDAwMDAwNDYxMyA2NTUzNSBmDQowMDAwMDA0NjE0IDY1NTM1 IGYNCjAwMDAwMDQ2MTUgNjU1MzUgZg0KMDAwMDAwNDYxNiA2NTUzNSBmDQowMDAwMDA0NjE3 IDY1NTM1IGYNCjAwMDAwMDQ2MTggNjU1MzUgZg0KMDAwMDAwNDYxOSA2NTUzNSBmDQowMDAw MDA0NjIwIDY1NTM1IGYNCjAwMDAwMDQ2MjEgNjU1MzUgZg0KMDAwMDAwNDYyMiA2NTUzNSBm DQowMDAwMDA0NjIzIDY1NTM1IGYNCjAwMDAwMDQ2MjQgNjU1MzUgZg0KMDAwMDAwNDYyNSA2 NTUzNSBmDQowMDAwMDA0NjI2IDY1NTM1IGYNCjAwMDAwMDQ2MjcgNjU1MzUgZg0KMDAwMDAw NDYyOCA2NTUzNSBmDQowMDAwMDA0NjI5IDY1NTM1IGYNCjAwMDAwMDQ2MzAgNjU1MzUgZg0K MDAwMDAwNDYzMSA2NTUzNSBmDQowMDAwMDA0NjMyIDY1NTM1IGYNCjAwMDAwMDQ2MzMgNjU1 MzUgZg0KMDAwMDAwNDYzNCA2NTUzNSBmDQowMDAwMDA0NjM1IDY1NTM1IGYNCjAwMDAwMDQ2 MzYgNjU1MzUgZg0KMDAwMDAwNDYzNyA2NTUzNSBmDQowMDAwMDA0NjM4IDY1NTM1IGYNCjAw MDAwMDQ2MzkgNjU1MzUgZg0KMDAwMDAwNDY0MCA2NTUzNSBmDQowMDAwMDA0NjQxIDY1NTM1 IGYNCjAwMDAwMDQ2NDIgNjU1MzUgZg0KMDAwMDAwNDY0MyA2NTUzNSBmDQowMDAwMDA0NjQ0 IDY1NTM1IGYNCjAwMDAwMDQ2NDUgNjU1MzUgZg0KMDAwMDAwNDY0NiA2NTUzNSBmDQowMDAw MDA0NjQ3IDY1NTM1IGYNCjAwMDAwMDQ2NDggNjU1MzUgZg0KMDAwMDAwNDY0OSA2NTUzNSBm DQowMDAwMDA0NjUwIDY1NTM1IGYNCjAwMDAwMDQ2NTEgNjU1MzUgZg0KMDAwMDAwNDY1MiA2 NTUzNSBmDQowMDAwMDA0NjUzIDY1NTM1IGYNCjAwMDAwMDQ2NTQgNjU1MzUgZg0KMDAwMDAw NDY1NSA2NTUzNSBmDQowMDAwMDA0NjU2IDY1NTM1IGYNCjAwMDAwMDQ2NTcgNjU1MzUgZg0K MDAwMDAwNDY1OCA2NTUzNSBmDQowMDAwMDA0NjU5IDY1NTM1IGYNCjAwMDAwMDQ2NjAgNjU1 MzUgZg0KMDAwMDAwNDY2MSA2NTUzNSBmDQowMDAwMDA0NjYyIDY1NTM1IGYNCjAwMDAwMDQ2 NjMgNjU1MzUgZg0KMDAwMDAwNDY2NCA2NTUzNSBmDQowMDAwMDA0NjY1IDY1NTM1IGYNCjAw MDAwMDQ2NjYgNjU1MzUgZg0KMDAwMDAwNDY2NyA2NTUzNSBmDQowMDAwMDA0NjY4IDY1NTM1 IGYNCjAwMDAwMDQ2NjkgNjU1MzUgZg0KMDAwMDAwNDY3MCA2NTUzNSBmDQowMDAwMDA0Njcx IDY1NTM1IGYNCjAwMDAwMDQ2NzIgNjU1MzUgZg0KMDAwMDAwNDY3MyA2NTUzNSBmDQowMDAw MDA0Njc0IDY1NTM1IGYNCjAwMDAwMDQ2NzUgNjU1MzUgZg0KMDAwMDAwNDY3NiA2NTUzNSBm DQowMDAwMDA0Njc3IDY1NTM1IGYNCjAwMDAwMDQ2NzggNjU1MzUgZg0KMDAwMDAwNDY3OSA2 NTUzNSBmDQowMDAwMDA0NjgwIDY1NTM1IGYNCjAwMDAwMDQ2ODEgNjU1MzUgZg0KMDAwMDAw NDY4MiA2NTUzNSBmDQowMDAwMDA0NjgzIDY1NTM1IGYNCjAwMDAwMDQ2ODQgNjU1MzUgZg0K MDAwMDAwNDY4NSA2NTUzNSBmDQowMDAwMDA0Njg2IDY1NTM1IGYNCjAwMDAwMDQ2ODcgNjU1 MzUgZg0KMDAwMDAwNDY4OCA2NTUzNSBmDQowMDAwMDA0Njg5IDY1NTM1IGYNCjAwMDAwMDQ2 OTAgNjU1MzUgZg0KMDAwMDAwNDY5MSA2NTUzNSBmDQowMDAwMDA0NjkyIDY1NTM1IGYNCjAw MDAwMDQ2OTMgNjU1MzUgZg0KMDAwMDAwNDY5NCA2NTUzNSBmDQowMDAwMDA0Njk1IDY1NTM1 IGYNCjAwMDAwMDQ2OTYgNjU1MzUgZg0KMDAwMDAwNDY5NyA2NTUzNSBmDQowMDAwMDA0Njk4 IDY1NTM1IGYNCjAwMDAwMDQ2OTkgNjU1MzUgZg0KMDAwMDAwNDcwMCA2NTUzNSBmDQowMDAw MDA0NzAxIDY1NTM1IGYNCjAwMDAwMDQ3MDIgNjU1MzUgZg0KMDAwMDAwNDcwMyA2NTUzNSBm DQowMDAwMDA0NzA0IDY1NTM1IGYNCjAwMDAwMDQ3MDUgNjU1MzUgZg0KMDAwMDAwNDcwNiA2 NTUzNSBmDQowMDAwMDA0NzA3IDY1NTM1IGYNCjAwMDAwMDQ3MDggNjU1MzUgZg0KMDAwMDAw NDcwOSA2NTUzNSBmDQowMDAwMDA0NzEwIDY1NTM1IGYNCjAwMDAwMDQ3MTEgNjU1MzUgZg0K MDAwMDAwNDcxMiA2NTUzNSBmDQowMDAwMDA0NzEzIDY1NTM1IGYNCjAwMDAwMDQ3MTQgNjU1 MzUgZg0KMDAwMDAwNDcxNSA2NTUzNSBmDQowMDAwMDA0NzE2IDY1NTM1IGYNCjAwMDAwMDQ3 MTcgNjU1MzUgZg0KMDAwMDAwNDcxOCA2NTUzNSBmDQowMDAwMDA0NzE5IDY1NTM1IGYNCjAw MDAwMDQ3MjAgNjU1MzUgZg0KMDAwMDAwNDcyMSA2NTUzNSBmDQowMDAwMDA0NzIyIDY1NTM1 IGYNCjAwMDAwMDQ3MjMgNjU1MzUgZg0KMDAwMDAwNDcyNCA2NTUzNSBmDQowMDAwMDA0NzI1 IDY1NTM1IGYNCjAwMDAwMDQ3MjYgNjU1MzUgZg0KMDAwMDAwNDcyNyA2NTUzNSBmDQowMDAw MDA0NzI4IDY1NTM1IGYNCjAwMDAwMDQ3MjkgNjU1MzUgZg0KMDAwMDAwNDczMCA2NTUzNSBm DQowMDAwMDA0NzMxIDY1NTM1IGYNCjAwMDAwMDQ3MzIgNjU1MzUgZg0KMDAwMDAwNDczNCA2 NTUzNSBmDQowMDAwNTQ2NjU1IDAwMDAwIG4NCjAwMDAwMDQ3MzUgNjU1MzUgZg0KMDAwMDAw NDczNiA2NTUzNSBmDQowMDAwMDA0NzM3IDY1NTM1IGYNCjAwMDAwMDQ3MzkgNjU1MzUgZg0K MDAwMDU0NjcwNyAwMDAwMCBuDQowMDAwMDA0NzQwIDY1NTM1IGYNCjAwMDAwMDQ3NDEgNjU1 MzUgZg0KMDAwMDAwNDc0MiA2NTUzNSBmDQowMDAwMDA0NzQzIDY1NTM1IGYNCjAwMDAwMDQ3 NDQgNjU1MzUgZg0KMDAwMDAwNDc0NSA2NTUzNSBmDQowMDAwMDA0NzQ2IDY1NTM1IGYNCjAw MDAwMDQ3NDcgNjU1MzUgZg0KMDAwMDAwNDc0OCA2NTUzNSBmDQowMDAwMDA0NzUwIDY1NTM1 IGYNCjAwMDA1NDY3NjEgMDAwMDAgbg0KMDAwMDAwNDc1MSA2NTUzNSBmDQowMDAwMDA0NzUy IDY1NTM1IGYNCjAwMDAwMDQ3NTMgNjU1MzUgZg0KMDAwMDAwNDc1NCA2NTUzNSBmDQowMDAw MDA0NzU1IDY1NTM1IGYNCjAwMDAwMDQ3NTcgNjU1MzUgZg0KMDAwMDU0NjgxMyAwMDAwMCBu DQowMDAwMDA0NzU4IDY1NTM1IGYNCjAwMDAwMDQ3NTkgNjU1MzUgZg0KMDAwMDAwNDc2MCA2 NTUzNSBmDQowMDAwMDA0NzYyIDY1NTM1IGYNCjAwMDA1NDY4NjUgMDAwMDAgbg0KMDAwMDAw NDc2MyA2NTUzNSBmDQowMDAwMDA0NzY0IDY1NTM1IGYNCjAwMDAwMDQ3NjUgNjU1MzUgZg0K MDAwMDAwNDc2NiA2NTUzNSBmDQowMDAwMDA0NzY3IDY1NTM1IGYNCjAwMDAwMDQ3NjggNjU1 MzUgZg0KMDAwMDAwNDc3MCA2NTUzNSBmDQowMDAwNTQ2OTE5IDAwMDAwIG4NCjAwMDAwMDQ3 NzEgNjU1MzUgZg0KMDAwMDAwNDc3MiA2NTUzNSBmDQowMDAwMDA0NzczIDY1NTM1IGYNCjAw MDAwMDQ3NzQgNjU1MzUgZg0KMDAwMDAwNDc3NSA2NTUzNSBmDQowMDAwMDA0Nzc2IDY1NTM1 IGYNCjAwMDAwMDQ3NzcgNjU1MzUgZg0KMDAwMDAwNDc3OSA2NTUzNSBmDQowMDAwNTQ2OTcx IDAwMDAwIG4NCjAwMDAwMDQ3ODAgNjU1MzUgZg0KMDAwMDAwNDc4MSA2NTUzNSBmDQowMDAw MDA0NzgyIDY1NTM1IGYNCjAwMDAwMDQ3ODQgNjU1MzUgZg0KMDAwMDU0NzAyMyAwMDAwMCBu DQowMDAwMDA0Nzg1IDY1NTM1IGYNCjAwMDAwMDQ3ODYgNjU1MzUgZg0KMDAwMDAwNDc4NyA2 NTUzNSBmDQowMDAwMDA0Nzg4IDY1NTM1IGYNCjAwMDAwMDQ3ODkgNjU1MzUgZg0KMDAwMDAw NDc5MCA2NTUzNSBmDQowMDAwMDA0NzkxIDY1NTM1IGYNCjAwMDAwMDQ3OTIgNjU1MzUgZg0K MDAwMDAwNDc5MyA2NTUzNSBmDQowMDAwMDA0Nzk0IDY1NTM1IGYNCjAwMDAwMDQ3OTUgNjU1 MzUgZg0KMDAwMDAwNDc5NyA2NTUzNSBmDQowMDAwNTQ3MDc3IDAwMDAwIG4NCjAwMDAwMDQ3 OTggNjU1MzUgZg0KMDAwMDAwNDc5OSA2NTUzNSBmDQowMDAwMDA0ODAwIDY1NTM1IGYNCjAw MDAwMDQ4MDEgNjU1MzUgZg0KMDAwMDAwNDgwMiA2NTUzNSBmDQowMDAwMDA0ODAzIDY1NTM1 IGYNCjAwMDAwMDQ4MDQgNjU1MzUgZg0KMDAwMDAwNDgwNSA2NTUzNSBmDQowMDAwMDA0ODA2 IDY1NTM1IGYNCjAwMDAwMDQ4MDcgNjU1MzUgZg0KMDAwMDAwNDgwOCA2NTUzNSBmDQowMDAw MDA0ODA5IDY1NTM1IGYNCjAwMDAwMDQ4MTAgNjU1MzUgZg0KMDAwMDAwNDgxMSA2NTUzNSBm DQowMDAwMDA0ODEyIDY1NTM1IGYNCjAwMDAwMDQ4MTMgNjU1MzUgZg0KMDAwMDAwNDgxNCA2 NTUzNSBmDQowMDAwMDA0ODE1IDY1NTM1IGYNCjAwMDAwMDQ4MTYgNjU1MzUgZg0KMDAwMDAw NDgxNyA2NTUzNSBmDQowMDAwMDA0ODE4IDY1NTM1IGYNCjAwMDAwMDQ4MTkgNjU1MzUgZg0K MDAwMDAwNDgyMCA2NTUzNSBmDQowMDAwMDA0ODIxIDY1NTM1IGYNCjAwMDAwMDQ4MjIgNjU1 MzUgZg0KMDAwMDAwNDgyMyA2NTUzNSBmDQowMDAwMDA0ODI0IDY1NTM1IGYNCjAwMDAwMDQ4 MjUgNjU1MzUgZg0KMDAwMDAwNDgyNiA2NTUzNSBmDQowMDAwMDA0ODI3IDY1NTM1IGYNCjAw MDAwMDQ4MjggNjU1MzUgZg0KMDAwMDAwNDgyOSA2NTUzNSBmDQowMDAwMDA0ODMwIDY1NTM1 IGYNCjAwMDAwMDQ4MzEgNjU1MzUgZg0KMDAwMDAwNDgzMiA2NTUzNSBmDQowMDAwMDA0ODMz IDY1NTM1IGYNCjAwMDAwMDQ4MzQgNjU1MzUgZg0KMDAwMDAwNDgzNSA2NTUzNSBmDQowMDAw MDA0ODM2IDY1NTM1IGYNCjAwMDAwMDQ4MzcgNjU1MzUgZg0KMDAwMDAwNDgzOCA2NTUzNSBm DQowMDAwMDA0ODM5IDY1NTM1IGYNCjAwMDAwMDQ4NDAgNjU1MzUgZg0KMDAwMDAwNDg0MSA2 NTUzNSBmDQowMDAwMDA0ODQyIDY1NTM1IGYNCjAwMDAwMDQ4NDMgNjU1MzUgZg0KMDAwMDAw NDg0NCA2NTUzNSBmDQowMDAwMDA0ODQ1IDY1NTM1IGYNCjAwMDAwMDQ4NDYgNjU1MzUgZg0K MDAwMDAwNDg0NyA2NTUzNSBmDQowMDAwMDA0ODQ4IDY1NTM1IGYNCjAwMDAwMDQ4NDkgNjU1 MzUgZg0KMDAwMDAwNDg1MCA2NTUzNSBmDQowMDAwMDA0ODUxIDY1NTM1IGYNCjAwMDAwMDQ4 NTIgNjU1MzUgZg0KMDAwMDAwNDg1MyA2NTUzNSBmDQowMDAwMDA0ODU0IDY1NTM1IGYNCjAw MDAwMDQ4NTUgNjU1MzUgZg0KMDAwMDAwNDg1NiA2NTUzNSBmDQowMDAwMDA0ODU3IDY1NTM1 IGYNCjAwMDAwMDQ4NTggNjU1MzUgZg0KMDAwMDAwNDg1OSA2NTUzNSBmDQowMDAwMDA0ODYw IDY1NTM1IGYNCjAwMDAwMDQ4NjEgNjU1MzUgZg0KMDAwMDAwNDg2MiA2NTUzNSBmDQowMDAw MDA0ODYzIDY1NTM1IGYNCjAwMDAwMDQ4NjQgNjU1MzUgZg0KMDAwMDAwNDg2NSA2NTUzNSBm DQowMDAwMDA0ODY2IDY1NTM1IGYNCjAwMDAwMDQ4NjcgNjU1MzUgZg0KMDAwMDAwNDg2OCA2 NTUzNSBmDQowMDAwMDA0ODY5IDY1NTM1IGYNCjAwMDAwMDQ4NzAgNjU1MzUgZg0KMDAwMDAw NDg3MSA2NTUzNSBmDQowMDAwMDA0ODcyIDY1NTM1IGYNCjAwMDAwMDQ4NzMgNjU1MzUgZg0K MDAwMDAwNDg3NCA2NTUzNSBmDQowMDAwMDA0ODc1IDY1NTM1IGYNCjAwMDAwMDQ4NzYgNjU1 MzUgZg0KMDAwMDAwNDg3NyA2NTUzNSBmDQowMDAwMDA0ODc4IDY1NTM1IGYNCjAwMDAwMDQ4 NzkgNjU1MzUgZg0KMDAwMDAwNDg4MCA2NTUzNSBmDQowMDAwMDA0ODgxIDY1NTM1IGYNCjAw MDAwMDQ4ODIgNjU1MzUgZg0KMDAwMDAwNDg4MyA2NTUzNSBmDQowMDAwMDA0ODg0IDY1NTM1 IGYNCjAwMDAwMDQ4ODUgNjU1MzUgZg0KMDAwMDAwNDg4NiA2NTUzNSBmDQowMDAwMDA0ODg3 IDY1NTM1IGYNCjAwMDAwMDQ4ODggNjU1MzUgZg0KMDAwMDAwNDg4OSA2NTUzNSBmDQowMDAw MDA0ODkwIDY1NTM1IGYNCjAwMDAwMDQ4OTEgNjU1MzUgZg0KMDAwMDAwNDg5MiA2NTUzNSBm DQowMDAwMDA0ODkzIDY1NTM1IGYNCjAwMDAwMDQ4OTQgNjU1MzUgZg0KMDAwMDAwNDg5NSA2 NTUzNSBmDQowMDAwMDA0ODk2IDY1NTM1IGYNCjAwMDAwMDQ4OTcgNjU1MzUgZg0KMDAwMDAw NDg5OCA2NTUzNSBmDQowMDAwMDA0ODk5IDY1NTM1IGYNCjAwMDAwMDQ5MDAgNjU1MzUgZg0K MDAwMDAwNDkwMSA2NTUzNSBmDQowMDAwMDA0OTAyIDY1NTM1IGYNCjAwMDAwMDQ5MDMgNjU1 MzUgZg0KMDAwMDAwNDkwNCA2NTUzNSBmDQowMDAwMDA0OTA1IDY1NTM1IGYNCjAwMDAwMDQ5 MDYgNjU1MzUgZg0KMDAwMDAwNDkwNyA2NTUzNSBmDQowMDAwMDA0OTA4IDY1NTM1IGYNCjAw MDAwMDQ5MDkgNjU1MzUgZg0KMDAwMDAwNDkxMCA2NTUzNSBmDQowMDAwMDA0OTExIDY1NTM1 IGYNCjAwMDAwMDQ5MTIgNjU1MzUgZg0KMDAwMDAwNDkxMyA2NTUzNSBmDQowMDAwMDA0OTE0 IDY1NTM1IGYNCjAwMDAwMDQ5MTUgNjU1MzUgZg0KMDAwMDAwNDkxNiA2NTUzNSBmDQowMDAw MDA0OTE3IDY1NTM1IGYNCjAwMDAwMDQ5MTggNjU1MzUgZg0KMDAwMDAwNDkxOSA2NTUzNSBm DQowMDAwMDA0OTIwIDY1NTM1IGYNCjAwMDAwMDQ5MjEgNjU1MzUgZg0KMDAwMDAwNDkyMiA2 NTUzNSBmDQowMDAwMDA0OTIzIDY1NTM1IGYNCjAwMDAwMDQ5MjQgNjU1MzUgZg0KMDAwMDAw NDkyNSA2NTUzNSBmDQowMDAwMDA0OTI2IDY1NTM1IGYNCjAwMDAwMDQ5MjcgNjU1MzUgZg0K MDAwMDAwNDkyOCA2NTUzNSBmDQowMDAwMDA0OTI5IDY1NTM1IGYNCjAwMDAwMDQ5MzAgNjU1 MzUgZg0KMDAwMDAwNDkzMSA2NTUzNSBmDQowMDAwMDA0OTMyIDY1NTM1IGYNCjAwMDAwMDQ5 MzMgNjU1MzUgZg0KMDAwMDAwNDkzNCA2NTUzNSBmDQowMDAwMDA0OTM1IDY1NTM1IGYNCjAw MDAwMDQ5MzYgNjU1MzUgZg0KMDAwMDAwNDkzNyA2NTUzNSBmDQowMDAwMDA0OTM4IDY1NTM1 IGYNCjAwMDAwMDQ5MzkgNjU1MzUgZg0KMDAwMDAwNDk0MCA2NTUzNSBmDQowMDAwMDA0OTQx IDY1NTM1IGYNCjAwMDAwMDQ5NDIgNjU1MzUgZg0KMDAwMDAwNDk0MyA2NTUzNSBmDQowMDAw MDA0OTQ0IDY1NTM1IGYNCjAwMDAwMDQ5NDUgNjU1MzUgZg0KMDAwMDAwNDk0NiA2NTUzNSBm DQowMDAwMDA0OTQ3IDY1NTM1IGYNCjAwMDAwMDQ5NDggNjU1MzUgZg0KMDAwMDAwNDk0OSA2 NTUzNSBmDQowMDAwMDA0OTUwIDY1NTM1IGYNCjAwMDAwMDQ5NTEgNjU1MzUgZg0KMDAwMDAw NDk1MiA2NTUzNSBmDQowMDAwMDA0OTUzIDY1NTM1IGYNCjAwMDAwMDQ5NTQgNjU1MzUgZg0K MDAwMDAwNDk1NSA2NTUzNSBmDQowMDAwMDA0OTU2IDY1NTM1IGYNCjAwMDAwMDQ5NTcgNjU1 MzUgZg0KMDAwMDAwNDk1OCA2NTUzNSBmDQowMDAwMDA0OTU5IDY1NTM1IGYNCjAwMDAwMDQ5 NjAgNjU1MzUgZg0KMDAwMDAwNDk2MSA2NTUzNSBmDQowMDAwMDA0OTYyIDY1NTM1IGYNCjAw MDAwMDQ5NjMgNjU1MzUgZg0KMDAwMDAwNDk2NCA2NTUzNSBmDQowMDAwMDA0OTY1IDY1NTM1 IGYNCjAwMDAwMDQ5NjYgNjU1MzUgZg0KMDAwMDAwNDk2NyA2NTUzNSBmDQowMDAwMDA0OTY4 IDY1NTM1IGYNCjAwMDAwMDQ5NjkgNjU1MzUgZg0KMDAwMDAwNDk3MCA2NTUzNSBmDQowMDAw MDA0OTcxIDY1NTM1IGYNCjAwMDAwMDQ5NzIgNjU1MzUgZg0KMDAwMDAwNDk3MyA2NTUzNSBm DQowMDAwMDA0OTc0IDY1NTM1IGYNCjAwMDAwMDQ5NzUgNjU1MzUgZg0KMDAwMDAwNDk3NiA2 NTUzNSBmDQowMDAwMDA0OTc4IDY1NTM1IGYNCjAwMDA1NTkwMTcgMDAwMDAgbg0KMDAwMDAw NDk3OSA2NTUzNSBmDQowMDAwMDA0OTgwIDY1NTM1IGYNCjAwMDAwMDQ5ODEgNjU1MzUgZg0K MDAwMDAwNDk4MyA2NTUzNSBmDQowMDAwNTU5MDY5IDAwMDAwIG4NCjAwMDAwMDQ5ODQgNjU1 MzUgZg0KMDAwMDAwNDk4NSA2NTUzNSBmDQowMDAwMDA0OTg2IDY1NTM1IGYNCjAwMDAwMDQ5 ODcgNjU1MzUgZg0KMDAwMDAwNDk4OCA2NTUzNSBmDQowMDAwMDA0OTg5IDY1NTM1IGYNCjAw MDAwMDQ5OTAgNjU1MzUgZg0KMDAwMDAwNDk5MSA2NTUzNSBmDQowMDAwMDA0OTkyIDY1NTM1 IGYNCjAwMDAwMDQ5OTMgNjU1MzUgZg0KMDAwMDAwNDk5NCA2NTUzNSBmDQowMDAwMDA0OTk1 IDY1NTM1IGYNCjAwMDAwMDQ5OTcgNjU1MzUgZg0KMDAwMDU1OTEyMyAwMDAwMCBuDQowMDAw MDA0OTk4IDY1NTM1IGYNCjAwMDAwMDQ5OTkgNjU1MzUgZg0KMDAwMDAwNTAwMCA2NTUzNSBm DQowMDAwMDA1MDAxIDY1NTM1IGYNCjAwMDAwMDUwMDIgNjU1MzUgZg0KMDAwMDAwNTAwNCA2 NTUzNSBmDQowMDAwNTU5MTc1IDAwMDAwIG4NCjAwMDAwMDUwMDUgNjU1MzUgZg0KMDAwMDAw NTAwNiA2NTUzNSBmDQowMDAwMDA1MDA3IDY1NTM1IGYNCjAwMDAwMDUwMDggNjU1MzUgZg0K MDAwMDAwNTAwOSA2NTUzNSBmDQowMDAwMDA1MDExIDY1NTM1IGYNCjAwMDA1NTkyMjcgMDAw MDAgbg0KMDAwMDAwNTAxMiA2NTUzNSBmDQowMDAwMDA1MDEzIDY1NTM1IGYNCjAwMDAwMDUw MTQgNjU1MzUgZg0KMDAwMDAwNTAxNSA2NTUzNSBmDQowMDAwMDA1MDE2IDY1NTM1IGYNCjAw MDAwMDUwMTcgNjU1MzUgZg0KMDAwMDAwNTAxOCA2NTUzNSBmDQowMDAwMDA1MDIwIDY1NTM1 IGYNCjAwMDA1NTkyODEgMDAwMDAgbg0KMDAwMDAwNTAyMSA2NTUzNSBmDQowMDAwMDA1MDIy IDY1NTM1IGYNCjAwMDAwMDUwMjMgNjU1MzUgZg0KMDAwMDAwNTAyNCA2NTUzNSBmDQowMDAw MDA1MDI1IDY1NTM1IGYNCjAwMDAwMDUwMjcgNjU1MzUgZg0KMDAwMDU1OTMzMyAwMDAwMCBu DQowMDAwMDA1MDI4IDY1NTM1IGYNCjAwMDAwMDUwMjkgNjU1MzUgZg0KMDAwMDAwNTAzMCA2 NTUzNSBmDQowMDAwMDA1MDMxIDY1NTM1IGYNCjAwMDAwMDUwMzIgNjU1MzUgZg0KMDAwMDAw NTAzMyA2NTUzNSBmDQowMDAwMDA1MDM0IDY1NTM1IGYNCjAwMDAwMDUwMzUgNjU1MzUgZg0K MDAwMDAwNTAzNiA2NTUzNSBmDQowMDAwMDA1MDM3IDY1NTM1IGYNCjAwMDAwMDUwMzggNjU1 MzUgZg0KMDAwMDAwNTAzOSA2NTUzNSBmDQowMDAwMDA1MDQwIDY1NTM1IGYNCjAwMDAwMDUw NDEgNjU1MzUgZg0KMDAwMDAwNTA0MiA2NTUzNSBmDQowMDAwMDA1MDQzIDY1NTM1IGYNCjAw MDAwMDUwNDQgNjU1MzUgZg0KMDAwMDAwNTA0NSA2NTUzNSBmDQowMDAwMDA1MDQ2IDY1NTM1 IGYNCjAwMDAwMDUwNDcgNjU1MzUgZg0KMDAwMDAwNTA0OCA2NTUzNSBmDQowMDAwMDA1MDQ5 IDY1NTM1IGYNCjAwMDAwMDUwNTAgNjU1MzUgZg0KMDAwMDAwNTA1MSA2NTUzNSBmDQowMDAw MDA1MDUyIDY1NTM1IGYNCjAwMDAwMDUwNTMgNjU1MzUgZg0KMDAwMDAwNTA1NCA2NTUzNSBm DQowMDAwMDA1MDU1IDY1NTM1IGYNCjAwMDAwMDUwNTYgNjU1MzUgZg0KMDAwMDAwNTA1NyA2 NTUzNSBmDQowMDAwMDA1MDU4IDY1NTM1IGYNCjAwMDAwMDUwNTkgNjU1MzUgZg0KMDAwMDAw NTA2MCA2NTUzNSBmDQowMDAwMDA1MDYxIDY1NTM1IGYNCjAwMDAwMDUwNjIgNjU1MzUgZg0K MDAwMDAwNTA2MyA2NTUzNSBmDQowMDAwMDA1MDY0IDY1NTM1IGYNCjAwMDAwMDUwNjUgNjU1 MzUgZg0KMDAwMDAwNTA2NiA2NTUzNSBmDQowMDAwMDA1MDY3IDY1NTM1IGYNCjAwMDAwMDUw NjggNjU1MzUgZg0KMDAwMDAwNTA2OSA2NTUzNSBmDQowMDAwMDA1MDcwIDY1NTM1IGYNCjAw MDAwMDUwNzEgNjU1MzUgZg0KMDAwMDAwNTA3MiA2NTUzNSBmDQowMDAwMDA1MDczIDY1NTM1 IGYNCjAwMDAwMDUwNzQgNjU1MzUgZg0KMDAwMDAwNTA3NSA2NTUzNSBmDQowMDAwMDA1MDc2 IDY1NTM1IGYNCjAwMDAwMDUwNzcgNjU1MzUgZg0KMDAwMDAwNTA3OCA2NTUzNSBmDQowMDAw MDA1MDc5IDY1NTM1IGYNCjAwMDAwMDUwODAgNjU1MzUgZg0KMDAwMDAwNTA4MSA2NTUzNSBm DQowMDAwMDA1MDgyIDY1NTM1IGYNCjAwMDAwMDUwODMgNjU1MzUgZg0KMDAwMDAwNTA4NCA2 NTUzNSBmDQowMDAwMDA1MDg1IDY1NTM1IGYNCjAwMDAwMDUwODYgNjU1MzUgZg0KMDAwMDAw NTA4NyA2NTUzNSBmDQowMDAwMDA1MDg4IDY1NTM1IGYNCjAwMDAwMDUwODkgNjU1MzUgZg0K MDAwMDAwNTA5MCA2NTUzNSBmDQowMDAwMDA1MDkxIDY1NTM1IGYNCjAwMDAwMDUwOTIgNjU1 MzUgZg0KMDAwMDAwNTA5MyA2NTUzNSBmDQowMDAwMDA1MDk0IDY1NTM1IGYNCjAwMDAwMDUw OTUgNjU1MzUgZg0KMDAwMDAwNTA5NiA2NTUzNSBmDQowMDAwMDA1MDk3IDY1NTM1IGYNCjAw MDAwMDUwOTggNjU1MzUgZg0KMDAwMDAwNTA5OSA2NTUzNSBmDQowMDAwMDA1MTAwIDY1NTM1 IGYNCjAwMDAwMDUxMDEgNjU1MzUgZg0KMDAwMDAwNTEwMiA2NTUzNSBmDQowMDAwMDA1MTAz IDY1NTM1IGYNCjAwMDAwMDUxMDQgNjU1MzUgZg0KMDAwMDAwNTEwNSA2NTUzNSBmDQowMDAw MDA1MTA2IDY1NTM1IGYNCjAwMDAwMDUxMDcgNjU1MzUgZg0KMDAwMDAwNTEwOCA2NTUzNSBm DQowMDAwMDA1MTA5IDY1NTM1IGYNCjAwMDAwMDUxMTAgNjU1MzUgZg0KMDAwMDAwNTExMSA2 NTUzNSBmDQowMDAwMDA1MTEyIDY1NTM1IGYNCjAwMDAwMDUxMTMgNjU1MzUgZg0KMDAwMDAw NTExNCA2NTUzNSBmDQowMDAwMDA1MTE1IDY1NTM1IGYNCjAwMDAwMDUxMTYgNjU1MzUgZg0K MDAwMDAwNTExNyA2NTUzNSBmDQowMDAwMDA1MTE4IDY1NTM1IGYNCjAwMDAwMDUxMTkgNjU1 MzUgZg0KMDAwMDAwNTEyMCA2NTUzNSBmDQowMDAwMDA1MTIxIDY1NTM1IGYNCjAwMDAwMDUx MjIgNjU1MzUgZg0KMDAwMDAwNTEyMyA2NTUzNSBmDQowMDAwMDA1MTI0IDY1NTM1IGYNCjAw MDAwMDUxMjYgNjU1MzUgZg0KMDAwMDU1OTM4NSAwMDAwMCBuDQowMDAwMDA1MTI3IDY1NTM1 IGYNCjAwMDAwMDUxMjggNjU1MzUgZg0KMDAwMDAwNTEyOSA2NTUzNSBmDQowMDAwMDA1MTMw IDY1NTM1IGYNCjAwMDAwMDUxMzEgNjU1MzUgZg0KMDAwMDAwNTEzMiA2NTUzNSBmDQowMDAw MDA1MTM0IDY1NTM1IGYNCjAwMDA1NTk0MzcgMDAwMDAgbg0KMDAwMDAwNTEzNSA2NTUzNSBm DQowMDAwMDA1MTM2IDY1NTM1IGYNCjAwMDAwMDUxMzcgNjU1MzUgZg0KMDAwMDAwNTEzOCA2 NTUzNSBmDQowMDAwMDA1MTM5IDY1NTM1IGYNCjAwMDAwMDUxNDAgNjU1MzUgZg0KMDAwMDAw NTE0MSA2NTUzNSBmDQowMDAwMDA1MTQzIDY1NTM1IGYNCjAwMDA1NTk0OTEgMDAwMDAgbg0K MDAwMDAwNTE0NCA2NTUzNSBmDQowMDAwMDA1MTQ1IDY1NTM1IGYNCjAwMDAwMDUxNDYgNjU1 MzUgZg0KMDAwMDAwNTE0NyA2NTUzNSBmDQowMDAwMDA1MTQ4IDY1NTM1IGYNCjAwMDAwMDUx NDkgNjU1MzUgZg0KMDAwMDAwNTE1MCA2NTUzNSBmDQowMDAwMDA1MTUxIDY1NTM1IGYNCjAw MDAwMDUxNTIgNjU1MzUgZg0KMDAwMDAwNTE1MyA2NTUzNSBmDQowMDAwMDA1MTU0IDY1NTM1 IGYNCjAwMDAwMDUxNTUgNjU1MzUgZg0KMDAwMDAwNTE1NiA2NTUzNSBmDQowMDAwMDA1MTU3 IDY1NTM1IGYNCjAwMDAwMDUxNTggNjU1MzUgZg0KMDAwMDAwNTE1OSA2NTUzNSBmDQowMDAw MDA1MTYwIDY1NTM1IGYNCjAwMDAwMDUxNjEgNjU1MzUgZg0KMDAwMDAwNTE2MyA2NTUzNSBm DQowMDAwNTU5NTQ1IDAwMDAwIG4NCjAwMDAwMDUxNjQgNjU1MzUgZg0KMDAwMDAwNTE2NSA2 NTUzNSBmDQowMDAwMDA1MTY2IDY1NTM1IGYNCjAwMDAwMDUxNjcgNjU1MzUgZg0KMDAwMDAw NTE2OCA2NTUzNSBmDQowMDAwMDA1MTY5IDY1NTM1IGYNCjAwMDAwMDUxNzAgNjU1MzUgZg0K MDAwMDAwNTE3MSA2NTUzNSBmDQowMDAwMDA1MTcyIDY1NTM1IGYNCjAwMDAwMDUxNzMgNjU1 MzUgZg0KMDAwMDAwNTE3NCA2NTUzNSBmDQowMDAwMDA1MTc1IDY1NTM1IGYNCjAwMDAwMDUx NzYgNjU1MzUgZg0KMDAwMDAwNTE3NyA2NTUzNSBmDQowMDAwMDA1MTc4IDY1NTM1IGYNCjAw MDAwMDUxNzkgNjU1MzUgZg0KMDAwMDAwNTE4MCA2NTUzNSBmDQowMDAwMDA1MTgxIDY1NTM1 IGYNCjAwMDAwMDUxODIgNjU1MzUgZg0KMDAwMDAwNTE4MyA2NTUzNSBmDQowMDAwMDA1MTg0 IDY1NTM1IGYNCjAwMDAwMDUxODUgNjU1MzUgZg0KMDAwMDAwNTE4NiA2NTUzNSBmDQowMDAw MDA1MTg3IDY1NTM1IGYNCjAwMDAwMDUxODggNjU1MzUgZg0KMDAwMDAwNTE4OSA2NTUzNSBm DQowMDAwMDA1MTkwIDY1NTM1IGYNCjAwMDAwMDUxOTEgNjU1MzUgZg0KMDAwMDAwNTE5MiA2 NTUzNSBmDQowMDAwMDA1MTkzIDY1NTM1IGYNCjAwMDAwMDUxOTQgNjU1MzUgZg0KMDAwMDAw NTE5NSA2NTUzNSBmDQowMDAwMDA1MTk2IDY1NTM1IGYNCjAwMDAwMDUxOTcgNjU1MzUgZg0K MDAwMDAwNTE5OCA2NTUzNSBmDQowMDAwMDA1MTk5IDY1NTM1IGYNCjAwMDAwMDUyMDAgNjU1 MzUgZg0KMDAwMDAwNTIwMSA2NTUzNSBmDQowMDAwMDA1MjAyIDY1NTM1IGYNCjAwMDAwMDUy MDMgNjU1MzUgZg0KMDAwMDAwNTIwNCA2NTUzNSBmDQowMDAwMDA1MjA1IDY1NTM1IGYNCjAw MDAwMDUyMDYgNjU1MzUgZg0KMDAwMDAwNTIwNyA2NTUzNSBmDQowMDAwMDA1MjA4IDY1NTM1 IGYNCjAwMDAwMDUyMDkgNjU1MzUgZg0KMDAwMDAwNTIxMCA2NTUzNSBmDQowMDAwMDA1MjEx IDY1NTM1IGYNCjAwMDAwMDUyMTIgNjU1MzUgZg0KMDAwMDAwNTIxMyA2NTUzNSBmDQowMDAw MDA1MjE0IDY1NTM1IGYNCjAwMDAwMDUyMTUgNjU1MzUgZg0KMDAwMDAwNTIxNiA2NTUzNSBm DQowMDAwMDA1MjE3IDY1NTM1IGYNCjAwMDAwMDUyMTggNjU1MzUgZg0KMDAwMDAwNTIxOSA2 NTUzNSBmDQowMDAwMDA1MjIwIDY1NTM1IGYNCjAwMDAwMDUyMjEgNjU1MzUgZg0KMDAwMDAw NTIyMiA2NTUzNSBmDQowMDAwMDA1MjIzIDY1NTM1IGYNCjAwMDAwMDUyMjQgNjU1MzUgZg0K MDAwMDAwNTIyNSA2NTUzNSBmDQowMDAwMDA1MjI2IDY1NTM1IGYNCjAwMDAwMDUyMjcgNjU1 MzUgZg0KMDAwMDAwNTIyOCA2NTUzNSBmDQowMDAwMDA1MjI5IDY1NTM1IGYNCjAwMDAwMDUy MzAgNjU1MzUgZg0KMDAwMDAwNTIzMSA2NTUzNSBmDQowMDAwMDA1MjMyIDY1NTM1IGYNCjAw MDAwMDUyMzMgNjU1MzUgZg0KMDAwMDAwNTIzNCA2NTUzNSBmDQowMDAwMDA1MjM1IDY1NTM1 IGYNCjAwMDAwMDUyMzYgNjU1MzUgZg0KMDAwMDAwNTIzNyA2NTUzNSBmDQowMDAwMDA1MjM4 IDY1NTM1IGYNCjAwMDAwMDUyMzkgNjU1MzUgZg0KMDAwMDAwNTI0MCA2NTUzNSBmDQowMDAw MDA1MjQxIDY1NTM1IGYNCjAwMDAwMDUyNDIgNjU1MzUgZg0KMDAwMDAwNTI0MyA2NTUzNSBm DQowMDAwMDA1MjQ0IDY1NTM1IGYNCjAwMDAwMDUyNDUgNjU1MzUgZg0KMDAwMDAwNTI0NiA2 NTUzNSBmDQowMDAwMDA1MjQ3IDY1NTM1IGYNCjAwMDAwMDUyNDggNjU1MzUgZg0KMDAwMDAw NTI0OSA2NTUzNSBmDQowMDAwMDA1MjUwIDY1NTM1IGYNCjAwMDAwMDUyNTEgNjU1MzUgZg0K MDAwMDAwNTI1MiA2NTUzNSBmDQowMDAwMDA1MjUzIDY1NTM1IGYNCjAwMDAwMDUyNTQgNjU1 MzUgZg0KMDAwMDAwNTI1NSA2NTUzNSBmDQowMDAwMDA1MjU2IDY1NTM1IGYNCjAwMDAwMDUy NTcgNjU1MzUgZg0KMDAwMDAwNTI1OCA2NTUzNSBmDQowMDAwMDA1MjU5IDY1NTM1IGYNCjAw MDAwMDUyNjAgNjU1MzUgZg0KMDAwMDAwNTI2MSA2NTUzNSBmDQowMDAwMDA1MjYyIDY1NTM1 IGYNCjAwMDAwMDUyNjMgNjU1MzUgZg0KMDAwMDAwNTI2NCA2NTUzNSBmDQowMDAwMDA1MjY1 IDY1NTM1IGYNCjAwMDAwMDUyNjYgNjU1MzUgZg0KMDAwMDAwNTI2NyA2NTUzNSBmDQowMDAw MDA1MjY4IDY1NTM1IGYNCjAwMDAwMDUyNjkgNjU1MzUgZg0KMDAwMDAwNTI3MCA2NTUzNSBm DQowMDAwMDA1MjcxIDY1NTM1IGYNCjAwMDAwMDUyNzIgNjU1MzUgZg0KMDAwMDAwNTI3MyA2 NTUzNSBmDQowMDAwMDA1Mjc0IDY1NTM1IGYNCjAwMDAwMDUyNzUgNjU1MzUgZg0KMDAwMDAw NTI3NiA2NTUzNSBmDQowMDAwMDA1Mjc3IDY1NTM1IGYNCjAwMDAwMDUyNzggNjU1MzUgZg0K MDAwMDAwNTI3OSA2NTUzNSBmDQowMDAwMDA1MjgwIDY1NTM1IGYNCjAwMDAwMDUyODEgNjU1 MzUgZg0KMDAwMDAwNTI4MiA2NTUzNSBmDQowMDAwMDA1MjgzIDY1NTM1IGYNCjAwMDAwMDUy ODQgNjU1MzUgZg0KMDAwMDAwNTI4NSA2NTUzNSBmDQowMDAwMDA1Mjg2IDY1NTM1IGYNCjAw MDAwMDUyODcgNjU1MzUgZg0KMDAwMDAwNTI4OCA2NTUzNSBmDQowMDAwMDA1Mjg5IDY1NTM1 IGYNCjAwMDAwMDUyOTAgNjU1MzUgZg0KMDAwMDAwNTI5MSA2NTUzNSBmDQowMDAwMDA1Mjky IDY1NTM1IGYNCjAwMDAwMDUyOTMgNjU1MzUgZg0KMDAwMDAwNTI5NCA2NTUzNSBmDQowMDAw MDA1Mjk1IDY1NTM1IGYNCjAwMDAwMDUyOTYgNjU1MzUgZg0KMDAwMDAwNTI5NyA2NTUzNSBm DQowMDAwMDA1Mjk4IDY1NTM1IGYNCjAwMDAwMDUyOTkgNjU1MzUgZg0KMDAwMDAwNTMwMCA2 NTUzNSBmDQowMDAwMDA1MzAxIDY1NTM1IGYNCjAwMDAwMDUzMDIgNjU1MzUgZg0KMDAwMDAw NTMwMyA2NTUzNSBmDQowMDAwMDA1MzA0IDY1NTM1IGYNCjAwMDAwMDUzMDUgNjU1MzUgZg0K MDAwMDAwNTMwNiA2NTUzNSBmDQowMDAwMDA1MzA3IDY1NTM1IGYNCjAwMDAwMDUzMDggNjU1 MzUgZg0KMDAwMDAwNTMwOSA2NTUzNSBmDQowMDAwMDA1MzEwIDY1NTM1IGYNCjAwMDAwMDUz MTEgNjU1MzUgZg0KMDAwMDAwNTMxMiA2NTUzNSBmDQowMDAwMDA1MzEzIDY1NTM1IGYNCjAw MDAwMDUzMTQgNjU1MzUgZg0KMDAwMDAwNTMxNSA2NTUzNSBmDQowMDAwMDA1MzE2IDY1NTM1 IGYNCjAwMDAwMDUzMTcgNjU1MzUgZg0KMDAwMDAwNTMxOCA2NTUzNSBmDQowMDAwMDA1MzE5 IDY1NTM1IGYNCjAwMDAwMDUzMjAgNjU1MzUgZg0KMDAwMDAwNTMyMSA2NTUzNSBmDQowMDAw MDA1MzIyIDY1NTM1IGYNCjAwMDAwMDUzMjMgNjU1MzUgZg0KMDAwMDAwNTMyNCA2NTUzNSBm DQowMDAwMDA1MzI1IDY1NTM1IGYNCjAwMDAwMDUzMjYgNjU1MzUgZg0KMDAwMDAwNTMyNyA2 NTUzNSBmDQowMDAwMDA1MzI4IDY1NTM1IGYNCjAwMDAwMDUzMjkgNjU1MzUgZg0KMDAwMDAw NTMzMCA2NTUzNSBmDQowMDAwMDA1MzMxIDY1NTM1IGYNCjAwMDAwMDUzMzIgNjU1MzUgZg0K MDAwMDAwNTMzMyA2NTUzNSBmDQowMDAwMDA1MzM0IDY1NTM1IGYNCjAwMDAwMDUzMzUgNjU1 MzUgZg0KMDAwMDAwNTMzNiA2NTUzNSBmDQowMDAwMDA1MzM3IDY1NTM1IGYNCjAwMDAwMDUz MzggNjU1MzUgZg0KMDAwMDAwNTMzOSA2NTUzNSBmDQowMDAwMDA1MzQwIDY1NTM1IGYNCjAw MDAwMDUzNDEgNjU1MzUgZg0KMDAwMDAwNTM0MiA2NTUzNSBmDQowMDAwMDA1MzQzIDY1NTM1 IGYNCjAwMDAwMDUzNDQgNjU1MzUgZg0KMDAwMDAwNTM0NSA2NTUzNSBmDQowMDAwMDA1MzQ2 IDY1NTM1IGYNCjAwMDAwMDUzNDcgNjU1MzUgZg0KMDAwMDAwNTM0OCA2NTUzNSBmDQowMDAw MDA1MzQ5IDY1NTM1IGYNCjAwMDAwMDUzNTAgNjU1MzUgZg0KMDAwMDAwNTM1MSA2NTUzNSBm DQowMDAwMDA1MzUyIDY1NTM1IGYNCjAwMDAwMDUzNTMgNjU1MzUgZg0KMDAwMDAwNTM1NCA2 NTUzNSBmDQowMDAwMDA1MzU1IDY1NTM1IGYNCjAwMDAwMDUzNTYgNjU1MzUgZg0KMDAwMDAw NTM1NyA2NTUzNSBmDQowMDAwMDA1MzU4IDY1NTM1IGYNCjAwMDAwMDUzNTkgNjU1MzUgZg0K MDAwMDAwNTM2MCA2NTUzNSBmDQowMDAwMDA1MzYxIDY1NTM1IGYNCjAwMDAwMDUzNjIgNjU1 MzUgZg0KMDAwMDAwNTM2MyA2NTUzNSBmDQowMDAwMDA1MzY0IDY1NTM1IGYNCjAwMDAwMDUz NjUgNjU1MzUgZg0KMDAwMDAwNTM2NiA2NTUzNSBmDQowMDAwMDA1MzY3IDY1NTM1IGYNCjAw MDAwMDUzNjggNjU1MzUgZg0KMDAwMDAwNTM2OSA2NTUzNSBmDQowMDAwMDA1MzcwIDY1NTM1 IGYNCjAwMDAwMDUzNzEgNjU1MzUgZg0KMDAwMDAwNTM3MiA2NTUzNSBmDQowMDAwMDA1Mzcz IDY1NTM1IGYNCjAwMDAwMDUzNzQgNjU1MzUgZg0KMDAwMDAwNTM3NSA2NTUzNSBmDQowMDAw MDA1Mzc2IDY1NTM1IGYNCjAwMDAwMDUzNzcgNjU1MzUgZg0KMDAwMDAwNTM3OCA2NTUzNSBm DQowMDAwMDA1Mzc5IDY1NTM1IGYNCjAwMDAwMDUzODAgNjU1MzUgZg0KMDAwMDAwNTM4MSA2 NTUzNSBmDQowMDAwMDA1MzgyIDY1NTM1IGYNCjAwMDAwMDUzODMgNjU1MzUgZg0KMDAwMDAw NTM4NCA2NTUzNSBmDQowMDAwMDA1Mzg1IDY1NTM1IGYNCjAwMDAwMDUzODYgNjU1MzUgZg0K MDAwMDAwNTM4NyA2NTUzNSBmDQowMDAwMDA1Mzg4IDY1NTM1IGYNCjAwMDAwMDUzODkgNjU1 MzUgZg0KMDAwMDAwNTM5MCA2NTUzNSBmDQowMDAwMDA1MzkxIDY1NTM1IGYNCjAwMDAwMDUz OTIgNjU1MzUgZg0KMDAwMDAwNTM5MyA2NTUzNSBmDQowMDAwMDA1Mzk0IDY1NTM1IGYNCjAw MDAwMDUzOTUgNjU1MzUgZg0KMDAwMDAwNTM5NiA2NTUzNSBmDQowMDAwMDA1Mzk3IDY1NTM1 IGYNCjAwMDAwMDUzOTggNjU1MzUgZg0KMDAwMDAwNTM5OSA2NTUzNSBmDQowMDAwMDA1NDAw IDY1NTM1IGYNCjAwMDAwMDU0MDEgNjU1MzUgZg0KMDAwMDAwMDAwMCA2NTUzNSBmDQowMDAw NTYyMjYwIDAwMDAwIG4NCjAwMDA1NjI0NjYgMDAwMDAgbg0KMDAwMDU2Mjc5OSAwMDAwMCBu DQowMDAwNTYzMDQ2IDAwMDAwIG4NCjAwMDA1NjM0NTMgMDAwMDAgbg0KMDAwMDYyNTQzOSAw MDAwMCBuDQowMDAwNjI1OTA5IDAwMDAwIG4NCjAwMDA2MjY1NDIgMDAwMDAgbg0KMDAwMDYy NjkwMiAwMDAwMCBuDQowMDAwNjc4Mjc0IDAwMDAwIG4NCjAwMDA2Nzg2NzkgMDAwMDAgbg0K MDAwMDY3OTI0OCAwMDAwMCBuDQowMDAwNjc5NTU5IDAwMDAwIG4NCjAwMDA2ODY4MTkgMDAw MDAgbg0KMDAwMDY4Njg3NCAwMDAwMCBuDQowMDAwNjg2OTAzIDAwMDAwIG4NCjAwMDA2ODcw NjAgMDAwMDAgbg0KMDAwMDY5ODU4MCAwMDAwMCBuDQowMDAwNjk4NjA5IDAwMDAwIG4NCjAw MDA3MTgwOTEgMDAwMDAgbg0KMDAwMDcxODQyOSAwMDAwMCBuDQowMDAwNzE4ODM2IDAwMDAw IG4NCjAwMDA3NjI5MjAgMDAwMDAgbg0KMDAwMDc2MzI2NyAwMDAwMCBuDQowMDAwNzYzNTc2 IDAwMDAwIG4NCjAwMDA3NjM4NzkgMDAwMDAgbg0KMDAwMDc3MDAwNCAwMDAwMCBuDQowMDAw NzcwMDQ5IDAwMDAwIG4NCjAwMDA3NzAzNDggMDAwMDAgbg0KMDAwMDc3NzI2NCAwMDAwMCBu DQowMDAwNzc3Mjk4IDAwMDAwIG4NCjAwMDA3Nzc1MjcgMDAwMDAgbg0KMDAwMDc3Nzc5NCAw MDAwMCBuDQowMDAwODAyNTUwIDAwMDAwIG4NCjAwMDA4MDU2MjQgMDAwMDAgbg0KMDAwMDgw NTY3MSAwMDAwMCBuDQp0cmFpbGVyDQo8PC9TaXplIDU0MzgvUm9vdCAxIDAgUi9JbmZvIDU0 MDIgMCBSL0lEWzw2NzBFNjc5NkI2N0U3QjQ4QTY0OEM2RjQwQ0JBMzI5Rj48NjcwRTY3OTZC NjdFN0I0OEE2NDhDNkY0MENCQTMyOUY+XSA+Pg0Kc3RhcnR4cmVmDQo4MTY5MDgNCiUlRU9G DQp4cmVmDQowIDANCnRyYWlsZXINCjw8L1NpemUgNTQzOC9Sb290IDEgMCBSL0luZm8gNTQw MiAwIFIvSURbPDY3MEU2Nzk2QjY3RTdCNDhBNjQ4QzZGNDBDQkEzMjlGPjw2NzBFNjc5NkI2 N0U3QjQ4QTY0OEM2RjQwQ0JBMzI5Rj5dIC9QcmV2IDgxNjkwOC9YUmVmU3RtIDgwNTY3MT4+ DQpzdGFydHhyZWYNCjkyNTgzMg0KJSVFT0Y= --------------28E9D1F09DD3434BEF3A563D-- From nobody Tue Jul 21 11:47:04 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A8C33A0766 for ; Tue, 21 Jul 2020 11:47:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vj3B9uXRkqDs for ; Tue, 21 Jul 2020 11:47:02 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:1:2000::15]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 58D403A0764 for ; Tue, 21 Jul 2020 11:47:02 -0700 (PDT) Received: from fafnir.remote.dragon.net (ip6-localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id D49B67A0F69; Tue, 21 Jul 2020 11:47:01 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id 90CA588E81D; Tue, 21 Jul 2020 12:47:01 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id 8DAC088E81A; Tue, 21 Jul 2020 12:47:01 -0600 (MDT) From: Paul Ebersman To: Neil Cook cc: add@ietf.org In-reply-to: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <20200721073934.GA29757@nic.fr> Comments: In-reply-to Neil Cook message dated "Tue, 21 Jul 2020 19:14:47 +0100." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <76988.1595357221.1@fafnir.local> Date: Tue, 21 Jul 2020 12:47:01 -0600 Message-Id: <20200721184701.90CA588E81D@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 18:47:03 -0000 neil.cook> What does this comment have to do with ADD? People are free neil.cook> to choose their CPE. If you don't want to use the access neil.cook> provider's resolver, use a different one. The problem is that this isn't an option for everyone... Some ISPs mandate what CPE and keep admin control or you don't get internet. And some markets don't have robust multiple choices of provider, such that you can just go to another provider. CPEs are problematic as a mandated part of any solution because: - not everyone owns or can pick their CPE (or even change settings on it) - many CPEs are kept unpatched for years until the magic blue smoke pours out the back and they are replaced with another crappy CPE - many CPEs aren't field upgradeable It is certainly better if we can change/fix/update the CPE but enough of the time this isn't a timely option and we should reflect that in documents we produce. From nobody Tue Jul 21 11:53:21 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EBC4A3A07B6 for ; Tue, 21 Jul 2020 11:53:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.805 X-Spam-Level: X-Spam-Status: No, score=-0.805 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RDNS_NONE=0.793, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (public key: not available)" header.d=noware.co.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cKsv1a_BcK8w for ; Tue, 21 Jul 2020 11:53:17 -0700 (PDT) Received: from mail.noware.co.uk (unknown [IPv6:2604:a880:0:1010::add:2001]) by ietfa.amsl.com (Postfix) with ESMTP id 173FB3A07B3 for ; Tue, 21 Jul 2020 11:53:17 -0700 (PDT) Received: from [192.168.1.170] (unknown [81.156.224.99]) by mail.noware.co.uk (Postfix) with ESMTPSA id 283AE1DE0BC; Tue, 21 Jul 2020 18:52:06 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.noware.co.uk 283AE1DE0BC DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=noware.co.uk; s=default; t=1595357526; bh=sdwgQDts2LJg/HFKhiVEOZUs9OjRrjEsTAeM+P1TL0w=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=FbCX+8aVEwwczUpY4xR/+g9oRw2t+yyf1HGo9WpCZ94b6zI5AXvnbc+dVbJ78jHQS vhvSFiKQ8CrTyFHu7eFOHETjdZiYrVmWPmCPolDvE/QhEDDeNt8p/weIf5dE6os3fA +MhXH/FnGvnpAuU0Wsh/6mWj5fqAi0wU5Wxn/D7w= From: Neil Cook Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_8C9D6ED3-2E00-428D-BEE7-4D660B9FE034" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Date: Tue, 21 Jul 2020 19:53:14 +0100 In-Reply-To: Cc: Andrew Campling , Eric Rescorla , "add@ietf.org" , Martin Thomson To: Tommy Jensen References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> X-Mailer: Apple Mail (2.3608.80.23.2.2) X-VADE-SPAMSTATE: clean X-VADE-SPAMSCORE: -100 X-VADE-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgeduiedrgeejgddthecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfpgffknfevqffqmfenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurhephffktgggufffjgfvfhfosegrtdhmrehhtdejnecuhfhrohhmpefpvghilhcuvehoohhkuceonhgvihhlrdgtohhokhesnhhofigrrhgvrdgtohdruhhkqeenucggtffrrghtthgvrhhnpeehveetvdetudejjedvvddtgeeikeettdfhfeelteeifeeiveduiefgieeiiedvhfenucffohhmrghinheprghkrgdrmhhspdhivghtfhdrohhrghdpohhuthhlohhokhdrtghomhenucfkphepkedurdduheeirddvvdegrdelleenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpeekuddrudehiedrvddvgedrleelpdhhvghloheplgduledvrdduieekrddurddujedtngdpmhgrihhlfhhrohhmpefpvghilhcuvehoohhkuceonhgvihhlrdgtohhokhesnhhofigrrhgvrdgtohdruhhkqedprhgtphhtthhopeflvghnshgvnhdrvfhhohhmrghssehmihgtrhhoshhofhhtrdgtohhmpdhrtghpthhtoheprghnughrvgifrdgtrghmphhlihhnghesgeduledrtghonhhsuhhlthhinhhgpdhrtghpthhtohepvghkrhesrhhtfhhmrdgtohhmpdhrtghpthhtoheprgguugesihgvthhfrdhorhhgpdhrtghpthhtohepmhhtsehlohifvghnthhrohhp hidrnhgvth Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 18:53:19 -0000 --Apple-Mail=_8C9D6ED3-2E00-428D-BEE7-4D660B9FE034 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 21 Jul 2020, at 01:19, Tommy Jensen = wrote: >=20 > I do not see this ISP list the same as the current Windows list of = public DoH servers, and I am not willing to accept the risk posed by = maintaining this new mapping. Where the existing SPAU list we rely on = contains only publicly documented and PKI verifiable names, the proposed = mechanism does not. This means I'm not just confirming what someone else = has already validated; I'm now responsible for the maintenance of the = original ownership verification for an ever-increasing number of ISPs = which will include enterprises running their own internal networks also = eager to avoid infrastructure updates on their end. I will not do that, = especially for a stop-gap feature whose value will fade away as a proper = bootstrapping mechanism is deployed. >=20 I would like to point out that, if you strip away the policy aspects of = the draft, the technical mechanism is very similar to that of RESINFO = (and indeed the proposal that ekr/Comcast co-authored), in that it uses = a DNS lookup to find a DoH resolver.=20 > This is my in-depth way of asking: is rushing to get encrypted DNS to = as many people as possible worth either settling for opportunistic = protection or inventing a whole new trust mechanism (which will be = permanent whether we wish it to be temporary or not, Paul Vixie recently = shared some wisdom along this line)? My answer here in order are "maybe" = and "no" but I'd like to hear what others think.=20 Opportunistic protection is better than the current situation, so my = answer to the first question would be =E2=80=9Cyes=E2=80=9D. > Thanks, > Tommy Jensen > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > How can you secure your DNS queries? https://aka.ms/dohblogpost = =20 > From: Add on behalf of Andrew Campling = > Sent: Monday, July 20, 2020 3:22 PM > To: Eric Rescorla > Cc: add@ietf.org ; Martin Thomson > Subject: [EXTERNAL] Re: [Add] Practical Observations from Encrypted = DNS Deployments by Network Operators > =20 > Ekr > To clarify, there are two issues to overcome here, (i) use of RFC1918 = private addresses by the CPE (to facilitate SPAU) and (ii) support for = DNS forwarders to maintain the full functionality provided by network = operators that is described in the document. The desired end state is = as you describe: > =20 > Client <------- TLS --------> CPE <------- TLS --------> ISP = Resolver > =20 > Whilst it would be ideal to deal with both of the above issues = simultaneously, pragmatically it may be necessary to deal with them = sequentially given the potential for delays in upgrading CPE software. = Since there are already some proposed discovery methods that deal with = the private addresses, it could make sense for to implement a two-step = solution that first solves the private address issue in the short-term = whilst the CPE software upgrade is deployed. This would at least = maintain support for the user=E2=80=99s chosen resolver via encrypted = DNS using SPAU whilst a CPE software upgrade is QA=E2=80=99d by the = network operator and then deployed.=20 > =20 > Of course others may think it better to go with a single-step approach = that upgrades the CPE software to maintain support for DNS forwarders = and deals with the private address issue for SPAU at the same time. = However, since the timeframe for this will be necessarily longer for = many users, my assumption is that the preference for most would be to = enlarge the potential pool of encrypted DNS users as quickly as = possible.=20 > =20 > Does this help? > =20 > =20 > Andrew > =20 > =20 > From: Eric Rescorla =20 > Sent: 20 July 2020 16:03 > To: Andrew Campling > Cc: Martin Thomson ; add@ietf.org > Subject: Re: [Add] Practical Observations from Encrypted DNS = Deployments by Network Operators > =20 > Hi Andrew, >=20 > Ignoring the discovery question for a moment, I guess I'm not entirely > clear on what your desired outcome in terms of network topology is. >=20 > As described in your draft, at present the clients send DNS packets to > the forwarder on the CPE, which then selectively forwards queries to > the main ISP resolver. However, in a world where the DNS is encrypted, > then this would require that the encryption be terminated at the > CPE and then re-originated to the ISP resolver, like so: >=20 >=20 > Client <------- TLS --------> CPE <------- TLS --------> ISP = Resolver >=20 > Is that your desired outcome? If so, it seems to come into conflict > with your points in S 5.2 about the difficulty of upgrading the CPE. > If not, maybe I just don't understand. In either case, perhaps you > can elaborate. >=20 > -Ekr >=20 >=20 >=20 > =20 > On Mon, Jul 20, 2020 at 7:47 AM Andrew Campling = > = wrote: > On Thu, Jul 16, 2020, at 00:12, Martin Thomson > wrote: >=20 > > Your draft seems to be making a case for supporting forwarders, but = I'm not clear on what supporting forwarders looks like. I understand = that you might not have specific ideas about what this support might = look like, but I don't see any real requirements here either. > >=20 > > It would really help if the draft would clearly articulate what your = desired outcome is. >=20 > Sorry for the lack of clarity. The primary intent of the document is = to provide information as we have the impression that at least some = client developers may not have good visibility of common network = operator architectures and practices outside of the US. By providing = such clarity we hope to see implementations that are sympathetic to the = environment into which they are being deployed in order to maximise the = chances of working correctly, ideally via SPAU as manual configuration = of DNS settings by the majority of users seems unlikely. =20 >=20 > In a nut shell, any ADD solution should measure itself to see whether = it meets the use case described in this document, at least one is needed = that does. =20 >=20 >=20 > Andrew=20 >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add = --Apple-Mail=_8C9D6ED3-2E00-428D-BEE7-4D660B9FE034 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On 21 Jul 2020, at 01:19, Tommy Jensen <Jensen.Thomas@microsoft.com> wrote:

I do not see = this ISP list the same as the current Windows list of public DoH = servers, and I am not willing to accept the risk posed by maintaining = this new mapping. Where the existing SPAU list we rely on contains only = publicly documented and PKI verifiable names, the proposed mechanism = does not. This means I'm not just confirming what someone else has = already validated; I'm now responsible for the maintenance of the = original ownership verification for an ever-increasing number of ISPs = which will include enterprises running their own internal networks also = eager to avoid infrastructure updates on their end. I will not do that, = especially for a stop-gap feature whose value will fade away as a proper = bootstrapping mechanism is deployed.


I would like to point out that, if you strip away = the policy aspects of the draft, the technical mechanism is very similar = to that of RESINFO (and indeed the proposal that ekr/Comcast = co-authored), in that it uses a DNS lookup to find a DoH = resolver. 

This is my = in-depth way of asking: is rushing to get encrypted DNS to as many = people as possible worth either settling for opportunistic protection or = inventing a whole new trust mechanism (which will be permanent whether = we wish it to be temporary or not, Paul Vixie recently shared some = wisdom along this line)? My answer here in order are "maybe" and "no" = but I'd like to hear what others think. 

Opportunistic protection is better than the current = situation, so my answer to the first question would be = =E2=80=9Cyes=E2=80=9D.

Thanks,
Tommy Jensen
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D
How can you secure your DNS = queries? https://aka.ms/dohblogpost 
From: Add <add-bounces@ietf.org> on behalf of Andrew Campling = <andrew.campling@419.consulting>
Sent: Monday, July 20, 2020 3:22 = PM
To: Eric Rescorla <ekr@rtfm.com>
Cc: add@ietf.org <add@ietf.org>; Martin = Thomson <mt@lowentropy.net>
Subject: [EXTERNAL] Re: [Add] = Practical Observations from Encrypted DNS Deployments by Network = Operators
 
Ekr
To clarify, there = are two issues to overcome here, (i) use of RFC1918 private addresses by = the CPE (to facilitate SPAU) and (ii) support for DNS forwarders to = maintain the full functionality provided by network operators that is = described in the document.  The desired end state is as you = describe:

 

Client  <------- TLS = -------->  CPE  <------- TLS -------->  ISP = Resolver

 

Whilst it would = be ideal to deal with both of the above issues simultaneously, = pragmatically it may be necessary to deal with them sequentially given = the potential for delays in upgrading CPE software.  Since there = are already some proposed discovery methods that deal with the private = addresses, it could make sense for to implement a two-step solution that = first solves the private address issue in the short-term whilst the CPE = software upgrade is deployed.  This would at least maintain support = for the user=E2=80=99s chosen resolver via encrypted DNS using SPAU = whilst a CPE software upgrade is QA=E2=80=99d by the network operator = and then deployed. 
 
Of course others = may think it better to go with a single-step approach that upgrades the = CPE software to maintain support for DNS forwarders and deals with the = private address issue for SPAU at the same time.  However, since = the timeframe for this will be necessarily longer for many users, my = assumption is that the preference for most would be to enlarge the = potential pool of encrypted DNS users as quickly as = possible. 

 

Does this help?

 

 
Andrew

 

 

From: Eric Rescorla <ekr@rtfm.com> 
Sent: 20 = July 2020 16:03
To: Andrew Campling <andrew.campling@419.consulting>
Cc: Martin Thomson <mt@lowentropy.net>; = add@ietf.org
Subject: Re: [Add] Practical = Observations from Encrypted DNS Deployments by Network = Operators

 

Hi Andrew,

Ignoring the = discovery question for a moment, I guess I'm not entirely
clear on what your desired outcome in terms of network = topology is.

As described in your draft, at = present the clients send DNS packets to
the forwarder on = the CPE, which then selectively forwards queries to
the = main ISP resolver. However, in a world where the DNS is encrypted,
then this would require that the encryption be terminated at = the
CPE and then re-originated to the ISP resolver, like = so:


Client <------- TLS = -------->  CPE  <------- TLS --------> ISP = Resolver

Is that your desired outcome? If = so, it seems to come into conflict
with your points in S = 5.2 about the difficulty of upgrading the CPE.
If not, = maybe I just don't understand. In either case, perhaps you
can elaborate.

-Ekr


 

On Mon, Jul 20, 2020 at = 7:47 AM Andrew Campling <andrew.campling@419.consulting> = wrote:
On Thu, Jul 16, 2020, at = 00:12, Martin Thomson <mt@lowentropy.net> wrote:

> Your draft seems to be making a case for supporting = forwarders, but I'm not clear on what supporting forwarders looks = like.  I understand that you might not have specific ideas about = what this support might look like, but I don't see any real requirements = here either.
> 
> It = would really help if the draft would clearly articulate what your = desired outcome is.

Sorry for the lack of = clarity.  The primary intent of the document is to provide = information as we have the impression that at least some client = developers may not have good visibility of common network operator = architectures and practices outside of the US.  By providing such = clarity we hope to see implementations that are sympathetic to the = environment into which they are being deployed in order to maximise the = chances of working correctly, ideally via SPAU as manual configuration = of DNS settings by the majority of users seems unlikely.  

In a nut shell, any ADD solution should measure itself to see = whether it meets the use case described in this document, at least one = is needed that does.  


Andrew 

-- 
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_8C9D6ED3-2E00-428D-BEE7-4D660B9FE034-- From nobody Tue Jul 21 12:22:22 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C4D193A0820 for ; Tue, 21 Jul 2020 12:22:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.906 X-Spam-Level: X-Spam-Status: No, score=-0.906 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, RDNS_NONE=0.793, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (public key: not available)" header.d=noware.co.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3GOLLrVHEeDb for ; Tue, 21 Jul 2020 12:22:19 -0700 (PDT) Received: from mail.noware.co.uk (unknown [IPv6:2604:a880:0:1010::add:2001]) by ietfa.amsl.com (Postfix) with ESMTP id B7D9A3A081C for ; Tue, 21 Jul 2020 12:22:19 -0700 (PDT) Received: from [192.168.1.170] (unknown [81.156.224.99]) by mail.noware.co.uk (Postfix) with ESMTPSA id 369101DD7E0; Tue, 21 Jul 2020 19:21:09 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.noware.co.uk 369101DD7E0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=noware.co.uk; s=default; t=1595359269; bh=pe/2EWbMvcrxDr/JTJndohwMJiq3GZJ4bDSeLB/BR04=; h=Subject:From:In-Reply-To:Date:Cc:References:To:From; b=SDBHRdKVB4qu5zGnsqykLYG8Uym7NnNLFFgWq/GwmAvc1o7FrLpnM4g+662IA7XjW j3SSyCBuPKkT29s69enP/LlkdU4p+U6BZEpHJNxV/F7lrluZ2kE6C7w2OKyHQu2Zjz pawLxLirxZCtWxoL4SlYESkgkFqpyB15ogsZ+s7Y= Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) From: Neil Cook In-Reply-To: <20200721184701.90CA588E81D@fafnir.remote.dragon.net> Date: Tue, 21 Jul 2020 20:22:17 +0100 Cc: Neil Cook , add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <20200721073934.GA29757@nic.fr> <20200721184701.90CA588E81D@fafnir.remote.dragon.net> To: Paul Ebersman X-Mailer: Apple Mail (2.3608.80.23.2.2) X-VADE-SPAMSTATE: clean X-VADE-SPAMSCORE: 0 X-VADE-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgeduiedrgeejgdduudcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfpgffknfevqffqmfenuceurghilhhouhhtmecufedttdenucenucfjughrpegtggfuhfgjfffgkfhfvffosehtqhhmtdhhtdejnecuhfhrohhmpefpvghilhcuvehoohhkuceonhgvihhlrdgtohhokhesnhhofigrrhgvrdgtohdruhhkqeenucggtffrrghtthgvrhhnpeefkeejhedtheefgfetfedugfekleetkeevhffgheeltedtueeiuefhtedtjefhjeenucfkphepkedurdduheeirddvvdegrdelleenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpeekuddrudehiedrvddvgedrleelpdhhvghloheplgduledvrdduieekrddurddujedtngdpmhgrihhlfhhrohhmpefpvghilhcuvehoohhkuceonhgvihhlrdgtohhokhesnhhofigrrhgvrdgtohdruhhkqedprhgtphhtthhopehlihhsthdqrgguugesughrrghgohhnrdhnvghtpdhrtghpthhtohepnhgvihhlrdgtohhokhepgedtnhhofigrrhgvrdgtohdruhhksegumhgrrhgtrdhivghtfhdrohhrghdprhgtphhtthhopegruggusehivghtfhdrohhrgh Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 19:22:21 -0000 > On 21 Jul 2020, at 19:47, Paul Ebersman wrote: >=20 > neil.cook> What does this comment have to do with ADD? People are free > neil.cook> to choose their CPE. If you don't want to use the access > neil.cook> provider's resolver, use a different one. >=20 > The problem is that this isn't an option for everyone... Some ISPs > mandate what CPE and keep admin control or you don't get internet. And > some markets don't have robust multiple choices of provider, such that > you can just go to another provider. >=20 Fair point. > CPEs are problematic as a mandated part of any solution because: >=20 > - not everyone owns or can pick their CPE (or even change settings on = it) > - many CPEs are kept unpatched for years until the magic blue smoke > pours out the back and they are replaced with another crappy CPE > - many CPEs aren't field upgradeable >=20 I don=E2=80=99t know of any drafts which are mandating CPEs as part of a = solution. However I do think that=E2=80=99s it really important that = this WG understands how widely deployed they are as forwarders, and that = the solutions we come up with take that into account. A lot of folks = seem to assume that there is only one model that is relevant, which is = client direct to eventual resolver. > It is certainly better if we can change/fix/update the CPE but enough = of > the time this isn't a timely option and we should reflect that in > documents we produce. >=20 Agreed. Neil From nobody Tue Jul 21 13:03:37 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C2CD3A08FF for ; Tue, 21 Jul 2020 13:03:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eIAVP3JYnb6t for ; Tue, 21 Jul 2020 13:03:33 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4BCEF3A08FE for ; Tue, 21 Jul 2020 13:03:32 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 03416389F1; Tue, 21 Jul 2020 15:43:06 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 0FofB9EdmNmZ; Tue, 21 Jul 2020 15:43:05 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id D044338A24; Tue, 21 Jul 2020 15:42:57 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 4BF053F; Tue, 21 Jul 2020 16:03:23 -0400 (EDT) From: Michael Richardson To: Stephane Bortzmeyer , add@ietf.org In-Reply-To: <20200721074235.GB29757@nic.fr> References: <2515140.uIgGUBp3BU@linux-9daj> <73db546a-0c47-fe18-0b9e-ec120e56bddd@cs.tcd.ie> <20200721074235.GB29757@nic.fr> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 20:03:35 -0000 --=-=-= Content-Type: text/plain Stephane Bortzmeyer wrote: >> There's an interesting thing there - the current Internet, with >> Cloudy-blah-services, CDNs, VPNs, Tor etc seems no longer to be a >> network of networks that only touch at their edges, but rather a >> network of networks some of which are much more intimately entwined. > RFC 8799 is an interesting reading here. >> I don't have a solution to offer that solves all problems in that >> context, but I do think it means that "my network, my policy" is no >> longer as practical as was once the case. > Also, I strongly object to this "my network, my policy" principle. I > want Internet access providers to be neutral tubes, not to force their > policies onto me. It seems that you are arguing for exactly, "my network, my policy" not against it. You want *my computer, my policy*, and you don't want Internet access providers to force their policy of bypassing your local security mechanisms to be forced upon you. You are exacly in the same camp as Paul Vixie, in my opinion, you just say it a different way. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl8XSgsACgkQgItw+93Q 3WV62AgAqKaLXC2l3McjrprXyGIOQxvmxAZ5oTexKMvEV7LV1jGJw/A1ckNKzpCF qA5yfvKYSm8T/8yqQdqzxWAbdxr8LlFQObfbylWJ8O9B1FJnD+MCx3aQm/Xrr2zJ D7fLJB8qbvfkQ+ZXD1Onr9LVBZBLQXEENQ3Cv4loiaeTWJnMNq5v7ijgZnW+xJW/ fP311wf60D8gWw/UiS49v4DKzWlilKOTa8Xr75rS1myU43raHMMeeyV867I91NxH cWN22NNPCLBAUZJopIjfU7eSRPTANsbBS0o22tj6CXhpwIh5ta0qIdbKDODvafvO u2Jkkk5kkr3Dr/xH95HA22MpZpTnqA== =K4ea -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Jul 21 13:11:20 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 479C03A092E for ; Tue, 21 Jul 2020 13:11:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4IYCZZyMLvvA for ; Tue, 21 Jul 2020 13:11:16 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D17883A0926 for ; Tue, 21 Jul 2020 13:11:15 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 2CC7C38A23; Tue, 21 Jul 2020 15:50:48 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 2RiR5c48rw36; Tue, 21 Jul 2020 15:50:47 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 562AC389FC; Tue, 21 Jul 2020 15:50:47 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id A6E063F; Tue, 21 Jul 2020 16:11:12 -0400 (EDT) From: Michael Richardson To: Stephane Bortzmeyer , "add\@ietf.org" In-Reply-To: <20200721073934.GA29757@nic.fr> References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <20200721073934.GA29757@nic.fr> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 20:11:18 -0000 --=-=-= Content-Type: text/plain Stephane Bortzmeyer wrote: >> With that said, I have some concerns about the objective of having >> the CPE in the user's resolution path. While I certainly can >> understand the reasons you consider it advantageous, it seems to me >> that it significantly weakens the user's security posture. Even >> assuming arguendo that we have a secure mechanism for discovering >> this case, in practice the CPE seems to have quite a high rate of >> security issues, including specifically DNS hijacking (see for >> instance [0]). > Even without hijacking by a third-party (cracker with hoodie), the > local router is often controlled by the access provider which may be > the party you precisely want to work around. If you want to use DoE to > avoid the provider's lying resolver, using their router is not a smart > move. 1) I point at "often", but, it's not exclusively. The provider can also do all sorts of bad things to your packets. The provider is usually fabicating false responses for reasons that they think are good. They usually aren't trying to hide the fact that they are doing this, so, they will usually be willing to state that policy. (which is completely in-scope for this group). [Yes, there are the wildcard advertising attacks, but let's let them be out of scope for now] 2) TR 369 provides for split control of the CPE device. That's not here yet, but there are many who are pushing for it. Plan for accomodating that. 3) there are often more than two parties involved: an access provider, an IT support entity, and the owner. This is extremely common for small businesses, which typically are using "home" equipement. The router is usually managed by the IT support entity, which is often called a "business to business ISP". They usually don't want to try to compete on bandwidth/connectivity, so they often resell the ISP connections. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | IoT architect [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails [ -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEyBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl8XS+AACgkQgItw+93Q 3WVnMwf3cIu+36nN9fywb5mXZMjHXs+Zn3BXuy5FL3K8ptDKHn98K7Fo/uUy7cZ0 5xwuTa7/KezuLFHZRW8cTAH4AbKUVtfLZnG4BHF+697MP7zAcsIJMzq6K8E+CaJj ex/kBk7xC21Xrpxk36WHdNXQdxeCPkMAseTFthFJ8Pm3eayKSn7Io7sw7zfVzTZN grVDCujazyvVow8RprVTMcx2J5gcS//eQG8eHWu9G4ym1RSBbjCdN0SUEDKuG5zi ABG8oi/88O/hDwP7/P1XsaIlOrSU6FeiS8XIRfzgBX+9km4HqrAydHZz1Bo3XmcP 2Ve6gIezfdw0I88mQwCjhRddbChl =8N9E -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Jul 21 13:20:18 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E6CC63A0955 for ; Tue, 21 Jul 2020 13:20:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RFS71Z3AP-KE for ; Tue, 21 Jul 2020 13:20:15 -0700 (PDT) Received: from mail-qk1-x730.google.com (mail-qk1-x730.google.com [IPv6:2607:f8b0:4864:20::730]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 338DC3A0953 for ; Tue, 21 Jul 2020 13:20:15 -0700 (PDT) Received: by mail-qk1-x730.google.com with SMTP id x69so8129035qkb.1 for ; Tue, 21 Jul 2020 13:20:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=Kq0N1RGkqt3uuoX+jyC1xQ7MXb4pXuR0A0r5yjZ4dHY=; b=c5w3HC4P1lJCY6kcI7nh/1MGTjyM0csYAZCs46+cPT0aJvTdutgxW0lxjhhKRzWpL0 eB80ztaCW6uX/RdPEfTj0RZHCQRvGl3fboV5L6eRQ+V4TJ4izt1g3/Z9wjnEq6CEgSg1 aBM5MYnyT4Hls3RAG0ti8MFawgkzMNrh/bbCrhFR6tNS1K+ufbzGTpBj8xoUX54E6jWA A4ygzUUeYulUwR55Hng5t2fgVKe3NntWGECyelOqcj82qDSKcMugnn05jC6VkFBBlxoT idsOZgGheOrJL/BUgAN7D2tSsQ6PaXaY25RIHbZ/DANK95hliIwioxk3KG9q1OlO/ImJ kVbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=Kq0N1RGkqt3uuoX+jyC1xQ7MXb4pXuR0A0r5yjZ4dHY=; b=pGzp70n2orh+9WJNoZLd7BE6r14Kzwl/jqmaYmwmRXb/qbFlCW6VpeAJCWZpTnRGJ/ 2fVmBwunNtm1fhoe4a+tihtryscd1i5YrcLe3Hqc9+SgYRXcXea3oUjNuqvp4FnL2QFt 1dRCJB6m6EL5//qKMGs/BLaZWtjIB6L6fqiledWn63mcHmpISSGb6ks11yreu6XcEQXj yn0XSRKFGHKAw2m11hyWFBQDRzzVl9opvjodL0dEsrjMXuUCa/JRxkublFtvUYsngjJz orDJzbCQ9Qn7/vrJZ1HQasoXtdOsvNLDMxoQ1ygPqusYSo3fZTgzVvbM3GX6M2R1YlFA gtyQ== X-Gm-Message-State: AOAM531B3t/a+2InK9f0tO2ZZ3zJ89ci6FCq6ZYVOQU5qGEbAGpN7Igt Zt3Q53dwF2CnHdBCEGiRWt3zDg== X-Google-Smtp-Source: ABdhPJzNU0xeRK4R1wkqqnrcNSNvtdns6md6ntAXbPUOe0PkUwjfIB0QfrQEhdUDMn4HVDGCMJ3qvw== X-Received: by 2002:a05:620a:10ab:: with SMTP id h11mr9644679qkk.219.1595362814065; Tue, 21 Jul 2020 13:20:14 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:e95c:bb80:2e73:d76f? ([2601:18b:300:36ee:e95c:bb80:2e73:d76f]) by smtp.gmail.com with ESMTPSA id c133sm3671401qkb.111.2020.07.21.13.20.12 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 21 Jul 2020 13:20:13 -0700 (PDT) From: Ted Lemon Message-Id: <69D7A884-4F91-4C0F-984A-B994C6065D29@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_D755531D-CA5B-4FE5-8C52-9CAEEA250ECC" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Tue, 21 Jul 2020 16:20:10 -0400 In-Reply-To: <3151.1595361803@localhost> Cc: Stephane Bortzmeyer , add@ietf.org To: Michael Richardson References: <2515140.uIgGUBp3BU@linux-9daj> <73db546a-0c47-fe18-0b9e-ec120e56bddd@cs.tcd.ie> <20200721074235.GB29757@nic.fr> <3151.1595361803@localhost> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 20:20:17 -0000 --Apple-Mail=_D755531D-CA5B-4FE5-8C52-9CAEEA250ECC Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Jul 21, 2020, at 4:03 PM, Michael Richardson = wrote: > You want *my computer, my policy*, and you don't want Internet access > providers to force their policy of bypassing your local security = mechanisms > to be forced upon you. > You are exacly in the same camp as Paul Vixie, in my opinion, you just = say it > a different way. Not exactly. Both he and Paul want autonomy. But they are operating = different parts of the network hierarchy, and so what they have to do to = get that autonomy is different (and likely antithetical). --Apple-Mail=_D755531D-CA5B-4FE5-8C52-9CAEEA250ECC Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii On = Jul 21, 2020, at 4:03 PM, Michael Richardson <mcr+ietf@sandelman.ca> wrote:
You want *my computer, my policy*, and you don't want = Internet access
providers to force their policy of bypassing your local = security mechanisms
to be forced upon you.
You are exacly in the same camp as Paul Vixie, in my opinion, = you just say it
a different way.

Not exactly. Both he and Paul want autonomy. = But they are operating different parts of the network hierarchy, and so = what they have to do to get that autonomy is different (and likely = antithetical).

= --Apple-Mail=_D755531D-CA5B-4FE5-8C52-9CAEEA250ECC-- From nobody Tue Jul 21 13:22:47 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BA153A0966 for ; Tue, 21 Jul 2020 13:22:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u60Be6U7W6ua for ; Tue, 21 Jul 2020 13:22:43 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6AF513A095F for ; Tue, 21 Jul 2020 13:22:43 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id A7D3638A23 for ; Tue, 21 Jul 2020 16:02:16 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id kXo3S94jrUtW for ; Tue, 21 Jul 2020 16:02:16 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id D8EB838A02 for ; Tue, 21 Jul 2020 16:02:15 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 217903F for ; Tue, 21 Jul 2020 16:22:41 -0400 (EDT) From: Michael Richardson To: add@ietf.org In-Reply-To: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 20:22:45 -0000 --=-=-= Content-Type: text/plain Eric Rescorla wrote: > With that said, I have some concerns about the objective of having the > CPE in the user's resolution path. While I certainly can understand > the reasons you consider it advantageous, it seems to me that it > significantly weakens the user's security posture. It's a question of point of view. While you feel that we can't trust any of the CPEs out there, many of us feel that we can't trust any of the desktop PCs out there. They are infested. And even devices from vendors who say they care about our privacy, seem not willing to use the DNS settings we tell them. Let me rewrite your words from the point of view of many of us, perhaps I will succeed in channeling Paul's point. mcr> Even assuming mcr> arguendo that we have a secure mechanism for discovering this case, mcr> in practice the PC desktop WEB BROWSER and IoT devices seems to have quite a high rate of security mcr> issues, including specifically DNS spoofing, since the browsers do not mcr> do DNSSEC even though they could. mcr> One of the advantages of DoT from client to the locally configured recursive is that mcr> it has the potential to mitigate attacks from attackers on the network mcr> -- including adjacent desktop PCs -- and this seems like it would regress mcr> that. I also have a document draft-richardson-opsawg-mud-iot-dns-considerations-02 that deals with DNS issues as they relate to RFC8520(MUD). Use of non-local DNS resolvers screws with our ability to easily write MUD files for devices. Mostly due to reasons of geolocation of DNS. So, we have to come up with a mechanism where the CPE can be in the device's resolution path, and when that is the case, we need to reliably inform the user of what the resolution path is at the time. [Please note where I said device rather than user] -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl8XTpAACgkQgItw+93Q 3WUYNggAo/PstbTo4EgC64dn9c14FWlGeBkV+68UivpSqXYpZnFCLGOg8pb8igip VpVwb1xyIz2F8d1/5EkHSP7FgI0jnJVa3j45OnUBPJwaNkODHMDtIxNawfRmGonk NUCFmNgeYeZNjkFDS1ISNt6f97rJqjcimnfqTsGH2eZJ27Ac9aTgDiTOjP+OXxFG nC2Qo9F4sXz6aSLyRjokvM6pGePBYvW10CuMoM/T63YXKMSpZKfTeJ0+qRd+Npxp JHFNq0giANJh3LUSpArEmXx8eyES+TDtQgFO9CFEHBS7JccklOIFT1OiKmdCiilC XZQQfSI5C474zF60kvH7hZ44ckxlEA== =+8Ru -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Jul 21 13:29:34 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 057873A096C for ; Tue, 21 Jul 2020 13:29:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H9L1oAjffDnK for ; Tue, 21 Jul 2020 13:29:28 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 730F03A096D for ; Tue, 21 Jul 2020 13:29:28 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 27F1538A23 for ; Tue, 21 Jul 2020 16:09:01 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id Qt_bbQqSNf6Z for ; Tue, 21 Jul 2020 16:08:59 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 36DD038A10 for ; Tue, 21 Jul 2020 16:08:59 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id A8C563F for ; Tue, 21 Jul 2020 16:29:24 -0400 (EDT) From: Michael Richardson To: ADD Mailing list In-Reply-To: References: <5EFC3442-045F-4F89-A4BA-769C1AFE87A4@comcast.com> <20200721074558.GC29757@nic.fr> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] IETF108 ADD Agenda X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 20:29:30 -0000 --=-=-= Content-Type: text/plain Chris Box (BT) wrote: > The agenda looks like a high-speed tour of the drafts, which is probably > necessary, but it's unfortunate there are only 90 minutes to play with. I > imagine the time available for questions on each draft will be only a > minute or two. > When do the chairs expect discussion to take place on selecting a coherent > set of drafts to move forward with? Will this be on the list afterwards, or > is this planned for the interim meeting? I'm hoping we don't need to wait > until September for that. It seems to me that presenting authors could adjust their slide time/content to assume people have read the documents, and to focus on how the proposal fits into the charter, and into other documents. I care, when adopting a document, that it has a good problem statement/focus, and that much less about exactly if the details are fleshed out. I look forward to many iterations of "Hum now if you have read the document and have strong technical objections to document X", rather than "do you like document X" -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl8XUCQACgkQgItw+93Q 3WX4fwgAq8FbI/M70FaPUQ5g7fqO1uffoRy6De05qw7E3uhENXvstaEuXz/G7gu7 WTx6bzhnVzmQTPMO0NauRu8s7JMwo0JaGq72Iuuzm+qYFHbWnvpIiywomJh17C0z cZVPKq5FoJjjaGZbsF8wTSAeBl8w2t6JE0ktupCb/z2vbQx7SDTUWPABDkMWvovu GOyY0RXE28ao3FX6zNhCQjKbKa1q84omFoCrhSpzwIIwJMRrlGQGzuzFCgJ6eZcy VUgQNE5STRiLlhlHkTsTkXoySznOID+w6WTlPYdWhyN8I9NJShWGy7evHsqspI/P f9mr/YKml7Lmgape4EUJiw71xkTlnA== =Ap/Q -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Jul 21 13:31:34 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4D3B3A0975 for ; Tue, 21 Jul 2020 13:31:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X2YNZANJyyOy for ; Tue, 21 Jul 2020 13:31:32 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:1:2000::15]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 01B343A096E for ; Tue, 21 Jul 2020 13:31:31 -0700 (PDT) Received: from fafnir.remote.dragon.net (ip6-localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id C1D827A0F69; Tue, 21 Jul 2020 13:31:31 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id 95EF288F212; Tue, 21 Jul 2020 14:31:31 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id 938DC88F211; Tue, 21 Jul 2020 14:31:31 -0600 (MDT) From: Paul Ebersman To: Neil Cook cc: add@ietf.org In-reply-to: References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <20200721073934.GA29757@nic.fr> <20200721184701.90CA588E81D@fafnir.remote.dragon.net> Comments: In-reply-to Neil Cook message dated "Tue, 21 Jul 2020 20:22:17 +0100." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <78583.1595363491.1@fafnir.local> Date: Tue, 21 Jul 2020 14:31:31 -0600 Message-Id: <20200721203131.95EF288F212@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 20:31:33 -0000 neil.cook> I don't know of any drafts which are mandating CPEs as part neil.cook> of a solution. However I do think that's it really important neil.cook> that this WG understands how widely deployed they are as neil.cook> forwarders, and that the solutions we come up with take that neil.cook> into account. A lot of folks seem to assume that there is neil.cook> only one model that is relevant, which is client direct to neil.cook> eventual resolver. Agree. "common" implementation models runs the gamut and we should acknowledge that. From nobody Tue Jul 21 13:46:01 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D940D3A0A7B for ; Tue, 21 Jul 2020 13:45:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id abhgeSN40OTg for ; Tue, 21 Jul 2020 13:45:52 -0700 (PDT) Received: from mail-lf1-x133.google.com (mail-lf1-x133.google.com [IPv6:2a00:1450:4864:20::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7E7AB3A0A8F for ; Tue, 21 Jul 2020 13:45:50 -0700 (PDT) Received: by mail-lf1-x133.google.com with SMTP id k17so78698lfg.3 for ; Tue, 21 Jul 2020 13:45:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=3gLkw4CEFtuMkBNmzWSGCBmeNRM7LlmawnpVxxWvvYg=; b=Hwwu0xXhGjoREj7aKvMouXXyE9vd9Us/MiBQG970HU9bdF1/GtB4cn3nRofaJDVAZE tApPTWsZQd7Z1kilR1qih+skiZXs2lxD57C7STgIFC1iRHDoJhQmYhkT7gwiXu4JoDNG yuEQ28ggtj+NeVEIOsJSEFEAXbgaKAW2f6fbAUSvlz3fZMEMmfprrrBgCEj9FarGxA0Z yQbWKGFKuZxPs8CFiAVM8MCbMnpMXWIOCOnkYB0LbecJ6xtM6U/MHvnalKAVE/7+hRJY Ada3Zst5TkJ7eA3CGtJ1xKkbTM+gnXYKJC8GP9YJ2I7uslr5oyELpj7s+3hLJ1jSQjVC UmaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=3gLkw4CEFtuMkBNmzWSGCBmeNRM7LlmawnpVxxWvvYg=; b=sEJnMbuBvSasM2rgK6d5cecuk23VYbyjYvh/DOlgIVfcGUuIxDOnfXDG3Xe5gWzlzz 6AsLxEmTDPgJvuKhCZjy0f+mJg1CKTo6UhmDmC7Hni8EbjfnqBg8UFPHI3OpUspv5zSq zfC/KvpLDgPRurYybW9NU8Vsfvk6ee8L65RQ8+Utdo1pO7LmI8yS1EZVq/TDOCctaFPX Z0/7BwUlD+ddczbzpTmS6RXPiq70iN9J82I8SW8xGup+p8Z8ISJz1ZWdfZVdT0eHll4p FkbkyXWUsgowzuyIZRKO+LLFgc5a7Sg/carFTDTsP7tEIeVgyrpyaWA5D7VN8RQ430TA HdUQ== X-Gm-Message-State: AOAM532NRNgYEduay053lnlTVYSQCjw/y9HBNMV8E6HzS9XSwT2YP6Xc slgVQw1q0Mb5bQb4p6AEDIsM824lXK7sM53TiParsbCjt55Jsg== X-Google-Smtp-Source: ABdhPJzn0LIGd8MNHlyiqbwKKEA0qiknWKET/BJjpW09NRq9DIJAgv7soDss/XLgW5h8vx08h4puZvhRns52ocPN4qY= X-Received: by 2002:ac2:5f04:: with SMTP id 4mr14345842lfq.140.1595364348423; Tue, 21 Jul 2020 13:45:48 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <7671.1595362961@localhost> In-Reply-To: <7671.1595362961@localhost> From: Eric Rescorla Date: Tue, 21 Jul 2020 13:45:11 -0700 Message-ID: To: Michael Richardson Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000468b8c05aaf9b5fa" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 20:46:00 -0000 --000000000000468b8c05aaf9b5fa Content-Type: text/plain; charset="UTF-8" On Tue, Jul 21, 2020 at 1:22 PM Michael Richardson wrote: > > Eric Rescorla wrote: > > With that said, I have some concerns about the objective of having > the > > CPE in the user's resolution path. While I certainly can understand > > the reasons you consider it advantageous, it seems to me that it > > significantly weakens the user's security posture. > > It's a question of point of view. > While you feel that we can't trust any of the CPEs out there, many of us > feel > that we can't trust any of the desktop PCs out there. They are infested. > And even devices from vendors who say they care about our privacy, seem not > willing to use the DNS settings we tell them. > > Let me rewrite your words from the point of view of many of us, > perhaps I will succeed in channeling Paul's point. > > Michael, I think we are now verging into the kind of policy territory which is out of scope for this WG. In any case, the point I was making was specific to CPE: it's one thing to have the client detect and use the ISP's resolver; it's quite another to have it use the CPE. For the same reason that it's hard to upgrade the CPU (as noted in the draft that started this thread) it's also hard to secure it. This is not true for either the ISP's resolver or, incidentally, for Web browsers, though it is true for many IoT devices. Thus, it seems like having the client detect and use the CPE significantly worsens the user's posture vis-a-vis them using the ISP resolver. mcr> Even assuming > mcr> arguendo that we have a secure mechanism for discovering this > case, > mcr> in practice the PC desktop WEB BROWSER and IoT devices seems to > have quite a high rate of security > mcr> issues, including specifically DNS spoofing, since the browsers > do not > mcr> do DNSSEC even though they could. > This claim seems to have two parts: 1. Doing DNSSEC validation would significantly decrease the high rate of DNS spoofing. 2. That the browsers in fact could do DNSSEC validation. As far as I know, it's an open question whether either of these is true. Do you have measurements that support either (1) that DNS spoofing happens frequently and would be prevented by DNS [note that due to the high fraction of connections which are secured by TLS, the impact of such spoofing would be modest in many cases] or (2) that browsers could safely do DNSSEC validation without experiencing unacceptable false positive rates? -Ekr --000000000000468b8c05aaf9b5fa Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Tue, Jul 21, 2020 at 1:22 PM Michael Richardson <mcr+ietf@sandelman.ca> wrote:

Eric Rescorla <ekr@rtf= m.com> wrote:
=C2=A0 =C2=A0 > With that said, I have some concerns about the objective= of having the
=C2=A0 =C2=A0 > CPE in the user's resolution path. While I certainly= can understand
=C2=A0 =C2=A0 > the reasons you consider it advantageous, it seems to me= that it
=C2=A0 =C2=A0 > significantly weakens the user's security posture.
It's a question of point of view.
While you feel that we can't trust any of the CPEs out there, many of u= s feel
that we can't trust any of the desktop PCs out there.=C2=A0 They are in= fested.
And even devices from vendors who say they care about our privacy, seem not=
willing to use the DNS settings we tell them.

Let me rewrite your words from the point of view of many of us,
perhaps I will succeed in channeling Paul's point.

Michael,

I think we are= now verging into the kind of policy territory which is out of scope for th= is WG.

In any case, the point I was making was spe= cific to CPE: it's one thing to have the client detect and use the ISP&= #39;s resolver; it's quite another to have it use the CPE. For the same= reason that it's hard to upgrade the CPU (as noted in the draft that s= tarted this thread) it's also hard to secure it. This is not true for e= ither the ISP's resolver or, incidentally, for Web browsers, though it = is true for many IoT devices. Thus, it seems like having the client detect = and use the CPE significantly worsens the user's posture vis-a-vis them= using the ISP resolver.
=C2=A0

=C2=A0 =C2=A0 mcr> Even assuming
=C2=A0 =C2=A0 mcr> arguendo that we have a secure mechanism for discover= ing this case,
=C2=A0 =C2=A0 mcr> in practice the PC desktop WEB BROWSER and IoT device= s seems to have quite a high rate of security
=C2=A0 =C2=A0 mcr> issues, including specifically DNS spoofing, since th= e browsers do not
=C2=A0 =C2=A0 mcr> do DNSSEC even though they could.

This claim seems to have two parts:

1. Doing DNSSEC validation would significantly decrease the high rat= e of DNS spoofing.
2. That the browsers in fact could do DNSSEC v= alidation.

As far as I know, it's an open ques= tion whether either of these is true. Do you have measurements that support= either (1) that DNS spoofing happens frequently and would be prevented by = DNS [note that due to the high fraction of connections which are secured by= TLS, the impact of such spoofing would be modest in many cases] or (2) tha= t browsers could safely do DNSSEC validation without experiencing unaccepta= ble false positive rates?

-Ekr

<= /div>

--000000000000468b8c05aaf9b5fa-- From nobody Tue Jul 21 13:58:40 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDF6B3A0A78 for ; Tue, 21 Jul 2020 13:58:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vHLsahAaaKSH for ; Tue, 21 Jul 2020 13:58:37 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC0543A0A6E for ; Tue, 21 Jul 2020 13:58:37 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 12C4CC3F16 for ; Tue, 21 Jul 2020 20:58:35 +0000 (UTC) From: Paul Vixie To: add@ietf.org Date: Tue, 21 Jul 2020 20:58:34 +0000 Message-ID: <14140771.zFNO5eadja@linux-9daj> Organization: none In-Reply-To: <69D7A884-4F91-4C0F-984A-B994C6065D29@fugue.com> References: <3151.1595361803@localhost> <69D7A884-4F91-4C0F-984A-B994C6065D29@fugue.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="nextPart2019198.pvGm3x96PY" Content-Transfer-Encoding: 7Bit Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 20:58:39 -0000 This is a multi-part message in MIME format. --nextPart2019198.pvGm3x96PY Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" On Tuesday, 21 July 2020 20:20:10 UTC Ted Lemon wrote: > On Jul 21, 2020, at 4:03 PM, Michael Richardson wrote: > > ... > > You are exacly in the same camp as Paul Vixie, in my opinion, you just say > > it a different way. > > Not exactly. Both he and Paul want autonomy. But they are operating > different parts of the network hierarchy, and so what they have to do to > get that autonomy is different (and likely antithetical). i feel sure that stephane and i both operate edge networks (so, same part of the hierarchy) and that neither of us wants our policies for such networks dictated to us, either by iot devices, browser makers, isp's, governments, or end users. there may be a distinction here but there is not a difference. -- Paul --nextPart2019198.pvGm3x96PY Content-Transfer-Encoding: 7Bit Content-Type: text/html; charset="us-ascii"

On Tuesday, 21 July 2020 20:20:10 UTC Ted Lemon wrote:

> On Jul 21, 2020, at 4:03 PM, Michael Richardson <mcr+ietf@sandelman.ca> wrote:

> > ...

> > You are exacly in the same camp as Paul Vixie, in my opinion, you just say

> > it a different way.

>

> Not exactly. Both he and Paul want autonomy. But they are operating

> different parts of the network hierarchy, and so what they have to do to

> get that autonomy is different (and likely antithetical).


i feel sure that stephane and i both operate edge networks (so, same part of the hierarchy) and that neither of us wants our policies for such networks dictated to us, either by iot devices, browser makers, isp's, governments, or end users. there may be a distinction here but there is not a difference.


--

Paul

--nextPart2019198.pvGm3x96PY-- From nobody Tue Jul 21 14:58:55 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B44B3A0AE0 for ; Tue, 21 Jul 2020 14:58:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GgDJZYGRUOmq for ; Tue, 21 Jul 2020 14:58:52 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CAEA73A0ADE for ; Tue, 21 Jul 2020 14:58:52 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 07162C3F16 for ; Tue, 21 Jul 2020 21:58:50 +0000 (UTC) From: Paul Vixie To: add@ietf.org Date: Tue, 21 Jul 2020 21:58:49 +0000 Message-ID: <10658287.m1sr0i5iKv@linux-9daj> Organization: none In-Reply-To: <73db546a-0c47-fe18-0b9e-ec120e56bddd@cs.tcd.ie> References: <2515140.uIgGUBp3BU@linux-9daj> <73db546a-0c47-fe18-0b9e-ec120e56bddd@cs.tcd.ie> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="nextPart1657095.5lpoyoxTne" Content-Transfer-Encoding: 7Bit Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 21:58:54 -0000 This is a multi-part message in MIME format. --nextPart1657095.5lpoyoxTne Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" On Tuesday, 21 July 2020 01:15:24 UTC Stephen Farrell wrote: > ... > > I don't have a solution to offer that solves all problems > in that context, but I do think it means that "my network, > my policy" is no longer as practical as was once the case. if i pay for its upkeep, am responsible for its emissions, own every device connected to it, and either employ or am otherwise legally responsible for the actions of its users, then i will make the final decision over how it's used. and i don't think anyone here is going to say "paul you're wrong, the internet exists apart from you, your responsibility is just to extend it and then let any browser vendor or iot device do whatever they want, it's viral now, all public property, including the parts you're paying for." so if we could dispense with blurred distinctions between private-access edge networks and public-access ISP and core networks, i'd like to get back to the topic ADD is for: how will we securely inform connected devices of the local network's resources and policies (e.g., DNS settings), and how will we ensure that private-access edge networks can monitor and control policy compliance? -- Paul --nextPart1657095.5lpoyoxTne Content-Transfer-Encoding: 7Bit Content-Type: text/html; charset="us-ascii"

On Tuesday, 21 July 2020 01:15:24 UTC Stephen Farrell wrote:

> ...

>

> I don't have a solution to offer that solves all problems

> in that context, but I do think it means that "my network,

> my policy" is no longer as practical as was once the case.


if i pay for its upkeep, am responsible for its emissions, own every device connected to it, and either employ or am otherwise legally responsible for the actions of its users, then i will make the final decision over how it's used.


and i don't think anyone here is going to say "paul you're wrong, the internet exists apart from you, your responsibility is just to extend it and then let any browser vendor or iot device do whatever they want, it's viral now, all public property, including the parts you're paying for."


so if we could dispense with blurred distinctions between private-access edge networks and public-access ISP and core networks, i'd like to get back to the topic ADD is for: how will we securely inform connected devices of the local network's resources and policies (e.g., DNS settings), and how will we ensure that private-access edge networks can monitor and control policy compliance?


--

Paul

--nextPart1657095.5lpoyoxTne-- From nobody Tue Jul 21 15:03:01 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EE6C3A0AE9 for ; Tue, 21 Jul 2020 15:02:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DhwJGwm8hQqv for ; Tue, 21 Jul 2020 15:02:57 -0700 (PDT) Received: from mail-lj1-x236.google.com (mail-lj1-x236.google.com [IPv6:2a00:1450:4864:20::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 62A723A0AE7 for ; Tue, 21 Jul 2020 15:02:57 -0700 (PDT) Received: by mail-lj1-x236.google.com with SMTP id h22so308543lji.9 for ; Tue, 21 Jul 2020 15:02:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9xXtm1G/jRZanKhTV93e39GRjkTcX/VUl0csWTN+jts=; b=Yuf3iHJAtwJyfZA5PIVceZEb+V+z2a4e1AbJ7QN9a9vW4Hx95EbM6uLHcXFx9lSeh5 6jJt5D0pGMNMDxgBQTACmklBzZp2CSZHE7djLUw58u76ILe3+LfE8GF5Z/etr8z4eWP+ a820cgAY8MtYbYO6XbAURz2R7wbIvV+3m7hgvEWUgOs5XMXBCVYHszvvIymn48XyrXbg bT1Q3S+x9Gba3CrsqvXhqmrPQUWgo6fG6r/2Y+qMYfNFrWkoKVnvVjJucSRQx55447/7 MfDRcTe9g0Uc9OgEuKJsczqZn8R7eDIHSWi6fql8hwUG4Ogb1gw36V0P4qDb6I03aC5B BUIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9xXtm1G/jRZanKhTV93e39GRjkTcX/VUl0csWTN+jts=; b=qfUonHRO0LSTBYSOu51dr6Ui88C2JZIfL+vg6rLQ7Vf/HkM1yDXCeiLcS8u+t4Z8RD JTTHTqF/8zT4OdYrGYJSurSmBgwp6JAxdO1S+UnubJnpKFyqMr6kg7hkck2z5s4Uybga J1U4QUA900boy+g9P6fusSCbKDaTKwXzCRdJZspOi17ehitH/OCSy+Qap0sWtU9JYWXs TtEK07XsO2YkVw7agEyoYHwci9hhBifoAbEeCxildzAApZHrhYTtt7iErvatpYWc9V/j PO/lqPnI9pmDxUFUnxLa0KnR9i81ArVTVZFc3S2eYoQXNyOc+fz6IYkdPtZvOALsZVlX Ca+g== X-Gm-Message-State: AOAM532sJQxTxq1pUjWK/GN2Ed9Itlzie1wnLWYlNvOJH61V4UV50trN Q9/6Zx/OTwsXP8wdee/I0ASPlAMlt8Lfl4daHo3+MaflKbU= X-Google-Smtp-Source: ABdhPJzVqJArSu1dagM/1L3bYOVG8q3e0r4R8Qg5nCPWHzjr3okLmEWXvGP+L4ZaU0xiMSsgjLrOJBwGZIqu7+MbuUg= X-Received: by 2002:a05:651c:14d:: with SMTP id c13mr12891274ljd.409.1595368975535; Tue, 21 Jul 2020 15:02:55 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <7671.1595362961@localhost> In-Reply-To: From: Eric Rescorla Date: Tue, 21 Jul 2020 15:02:18 -0700 Message-ID: To: Michael Richardson Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000012a5b705aafac9e5" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 22:02:59 -0000 --00000000000012a5b705aafac9e5 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 21, 2020 at 1:45 PM Eric Rescorla wrote: > > On Tue, Jul 21, 2020 at 1:22 PM Michael Richardson > wrote: > >> >> Eric Rescorla wrote: >> > With that said, I have some concerns about the objective of having >> the >> > CPE in the user's resolution path. While I certainly can understand >> > the reasons you consider it advantageous, it seems to me that it >> > significantly weakens the user's security posture. >> >> It's a question of point of view. >> While you feel that we can't trust any of the CPEs out there, many of us >> feel >> that we can't trust any of the desktop PCs out there. They are infested. >> And even devices from vendors who say they care about our privacy, seem >> not >> willing to use the DNS settings we tell them. >> > >> Let me rewrite your words from the point of view of many of us, >> perhaps I will succeed in channeling Paul's point. >> >> Michael, > > I think we are now verging into the kind of policy territory which is out > of scope for this WG. > > In any case, the point I was making was specific to CPE: it's one thing to > have the client detect and use the ISP's resolver; it's quite another to > have it use the CPE. For the same reason that it's hard to upgrade the CPU > (as noted in the draft that started this thread) it's also hard to secure > it. This is not true for either the ISP's resolver or, incidentally, for > Web browsers, though it is true for many IoT devices. Thus, it seems like > having the client detect and use the CPE significantly worsens the user's > posture vis-a-vis them using the ISP resolver. > And just to clarify, I don't think these comments necessarily apply to enterprise edge routers. I'm really talking specifically about the advisability of keeping a set of devices we know to have severe security problems in the loop. -Ekr > > mcr> Even assuming >> mcr> arguendo that we have a secure mechanism for discovering this >> case, >> mcr> in practice the PC desktop WEB BROWSER and IoT devices seems to >> have quite a high rate of security >> mcr> issues, including specifically DNS spoofing, since the browsers >> do not >> mcr> do DNSSEC even though they could. >> > > This claim seems to have two parts: > > 1. Doing DNSSEC validation would significantly decrease the high rate of > DNS spoofing. > 2. That the browsers in fact could do DNSSEC validation. > > As far as I know, it's an open question whether either of these is true. > Do you have measurements that support either (1) that DNS spoofing happens > frequently and would be prevented by DNS [note that due to the high > fraction of connections which are secured by TLS, the impact of such > spoofing would be modest in many cases] or (2) that browsers could safely > do DNSSEC validation without experiencing unacceptable false positive rates? > > -Ekr > > > > --00000000000012a5b705aafac9e5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 21, 2020 at 1:45 PM Eric = Rescorla <ekr@rtfm.com> wrote:
<= br>
On Tue,= Jul 21, 2020 at 1:22 PM Michael Richardson <mcr+ietf@sandelman.ca> wrote:
<= /div>

Eric Rescorla <ekr@rtf= m.com> wrote:
=C2=A0 =C2=A0 > With that said, I have some concerns about the objective= of having the
=C2=A0 =C2=A0 > CPE in the user's resolution path. While I certainly= can understand
=C2=A0 =C2=A0 > the reasons you consider it advantageous, it seems to me= that it
=C2=A0 =C2=A0 > significantly weakens the user's security posture.
It's a question of point of view.
While you feel that we can't trust any of the CPEs out there, many of u= s feel
that we can't trust any of the desktop PCs out there.=C2=A0 They are in= fested.
And even devices from vendors who say they care about our privacy, seem not=
willing to use the DNS settings we tell them.

Let me rewrite your words from the point of view of many of us,
perhaps I will succeed in channeling Paul's point.

Michael,

I think we are= now verging into the kind of policy territory which is out of scope for th= is WG.

In any case, the point I was making was spe= cific to CPE: it's one thing to have the client detect and use the ISP&= #39;s resolver; it's quite another to have it use the CPE. For the same= reason that it's hard to upgrade the CPU (as noted in the draft that s= tarted this thread) it's also hard to secure it. This is not true for e= ither the ISP's resolver or, incidentally, for Web browsers, though it = is true for many IoT devices. Thus, it seems like having the client detect = and use the CPE significantly worsens the user's posture vis-a-vis them= using the ISP resolver.

<= /div>
And just to clarify, I don't think these comments necessarily= apply to enterprise edge routers. I'm really talking specifically abou= t the advisability of keeping a set of devices we know to have severe secur= ity problems in the loop.

-Ekr

=C2=A0

=C2=A0 =C2=A0 mcr> Even assuming
=C2=A0 =C2=A0 mcr> arguendo that we have a secure mechanism for discover= ing this case,
=C2=A0 =C2=A0 mcr> in practice the PC desktop WEB BROWSER and IoT device= s seems to have quite a high rate of security
=C2=A0 =C2=A0 mcr> issues, including specifically DNS spoofing, since th= e browsers do not
=C2=A0 =C2=A0 mcr> do DNSSEC even though they could.

This claim seems to have two parts:

1. Doing DNSSEC validation would significantly decrease the high rat= e of DNS spoofing.
2. That the browsers in fact could do DNSSEC v= alidation.

As far as I know, it's an open ques= tion whether either of these is true. Do you have measurements that support= either (1) that DNS spoofing happens frequently and would be prevented by = DNS [note that due to the high fraction of connections which are secured by= TLS, the impact of such spoofing would be modest in many cases] or (2) tha= t browsers could safely do DNSSEC validation without experiencing unaccepta= ble false positive rates?

-Ekr

<= /div>

--00000000000012a5b705aafac9e5-- From nobody Tue Jul 21 15:09:15 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F6E63A0AF3 for ; Tue, 21 Jul 2020 15:09:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com header.b=wWPUkss8; dkim=pass (2048-bit key) header.d=comcast.com header.b=iYujfW6t; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=comcastcorp.onmicrosoft.com header.b=G7rwDcvR Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kmN65g9wwoZ6 for ; Tue, 21 Jul 2020 15:09:11 -0700 (PDT) Received: from mx0b-00143702.pphosted.com (mx0b-00143702.pphosted.com [148.163.141.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC0CE3A0B16 for ; Tue, 21 Jul 2020 15:09:11 -0700 (PDT) Received: from pps.filterd (m0184890.ppops.net [127.0.0.1]) by mx0b-00143702.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06LM5OYN006000 for ; Tue, 21 Jul 2020 18:09:10 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=20190412; bh=BHXKKLMbEnxAFx7QJT3lOMV4ykz3I0l+GU6ytkrf8Ig=; b=wWPUkss87BBY80ApApPA456OoT+SaQvoXqpVZqnz9VNTf0G8EU/CfjdrGjsF39bZm3BQ PbzloWLKySRje8IdjJblPTPVe5jx+Lo8Bzo/fUBLSo9+RJmS3bqXN7BX14c3woNaaPBS v/4WUFiqGUTjMNqqtuTXpfI/UnL2A5qIk+MWa0VwHl7NZ77mBH331wLeqfXU0Orp/82S QNqhu2JDmQ0Y81WFfvaB/7OeUugxZrzSYvQkrPbSG7VQhif+HVHltwZh+IDo+Smp2Hpy oSWfbPHQbwAtxEwqGQoV7+c2mPa4dhXNOJjU0tfDyDfmihovGWCVmVWoE4nxMpkJpEVH Zw== Received: from pacdcmhout02.cable.comcast.com (pacdcmhout02.cable.comcast.com [68.87.96.15]) by mx0b-00143702.pphosted.com with ESMTP id 32bw6etrq3-15 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 21 Jul 2020 18:09:10 -0400 DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1595369350; x=2459282950; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=BHXKKLMbEnxAFx7QJT3lOMV4ykz3I0l+GU6ytkrf8Ig=; b=iYujfW6tptUmp/sTReH2bOcqIIKKz3WyPaimxopxFcPNdSsdTQfqNR9c3ys4R/hC /ezoWPYbIvYF55QkdjonfrtPiFD6Ugz2G1EbkySTlX2UttfxPkD5JvuaOIM3sHqO hbdSsdyCCTE0PkNCRaj8LmIE2SV7ufz4GGCKklnZoVP2OftAtSy9mUcbld+Ir0YC Lc1/ljRPvQLCG0nAAAoFP31ZNkpxSXtgVec44LwjnQ3drwx3BjQ6/sGTBSQlzZ0N EXLGYz0dvgj0C4N3wXRfmfY3FNSRA4x6YmUJghelMJI76jNGVYagDDY2ACf6EaPN h8xGGVRmGpsddxf2dEPm9g==; X-AuditID: 4457600f-f27ff70000005543-b2-5f176785cad3 Received: from PACDCEX54.cable.comcast.com (cas-umc02.ndceast.pa.bo.comcast.net [68.87.34.28]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by pacdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id 20.2F.21827.587671F5; Tue, 21 Jul 2020 18:09:10 -0400 (EDT) Received: from PACDCEX11.cable.comcast.com (24.40.1.134) by PACDCEX54.cable.comcast.com (24.40.2.153) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 21 Jul 2020 18:09:09 -0400 Received: from PACDCEXEDGE01.cable.comcast.com (76.96.78.71) by PACDCEX11.cable.comcast.com (24.40.1.134) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 21 Jul 2020 18:09:09 -0400 Received: from NAM12-MW2-obe.outbound.protection.outlook.com (104.47.66.44) by webmail.comcast.com (76.96.78.71) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 21 Jul 2020 18:09:08 -0400 Received: from BYAPR11MB3111.namprd11.prod.outlook.com (2603:10b6:a03:90::25) by BY5PR11MB4151.namprd11.prod.outlook.com (2603:10b6:a03:18f::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.25; Tue, 21 Jul 2020 22:09:06 +0000 Received: from BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0]) by BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0%4]) with mapi id 15.20.3195.025; Tue, 21 Jul 2020 22:09:06 +0000 From: "Deen, Glenn" To: Martin Thomson , "add@ietf.org" Thread-Topic: [EXTERNAL] Re: [Add] New Threats ID for ADD Thread-Index: AQHWXveH7JO1nsTxqkKNHNNtJCTm0A== Date: Tue, 21 Jul 2020 22:09:06 +0000 Message-ID: References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: lowentropy.net; dkim=none (message not signed) header.d=none; lowentropy.net; dmarc=none action=none header.from=comcast.com; x-originating-ip: [2605:e000:141b:121:9442:a71d:7b0a:7e04] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 101a21d6-82cb-49bc-dd89-08d82dc2af88 x-ms-traffictypediagnostic: BY5PR11MB4151: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: Rq/rQ3a8nTpNtlLIzpAp9M2nzF4qmQ2ZRb1zvCwN9iqyMir3a4Gxy82GfyzC0DmYeSWOyHiYKO/0KtRFF2w+XfbRFfWdiR5tO5eJ8jBpsr6ZbU96VSStZdmcjqSwXYZsdZWFS8a+brOFt2iTkoWFQVD3t1Bf5v2TxImdAstJF1bdJuVYp2FHBQ+sVmZBVr2ndVLgRydR0z3P54mLJ1za/Bg/3oOcLvg2cc3L5Zv7tWCUVVfWh1o5Sn9xofAsoJ6YrYuh5mPPhHT+RYjE7F3GosJJByMBEOPTA8icNbWuAp7V2F85+VCxXTCd08wFVAaN2un/aHddeyz1xGiJZYwSDlP8+yG6hPsP73j5TGzVd5HvadJx2f/qFwJJAje72/A2Tf+XsOVLIOHRPDDIqsocTA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3111.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(396003)(346002)(39860400002)(136003)(366004)(376002)(6486002)(186003)(6506007)(2906002)(9686003)(33656002)(478600001)(966005)(71200400001)(6512007)(86362001)(316002)(36756003)(5660300002)(83380400001)(8676002)(110136005)(8936002)(76116006)(66446008)(66556008)(66946007)(66476007)(64756008); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: cRMo6/CZMstSdqD4HWXFq/paWTSFOiL9Vt6QVg4PuPL1ONG34Z3Tk3hzws97IZx7SGboSyl0DH3+BX5ALBwxxbwoXeQn7akuQlBtenDIDNZmZ9FtXa4CgyIdUFZBd/y2A826WpYP/Sa7feQgrHXSWhMFEsUqG58Hu9T86XB0HBRrwvcdR/Z4D7Rec0r/MeKeVfj1ea/gUqFiH02fuf0mouW01kU2pcgQFVG2wP95OOQugECKkb96x3Q1jmKGvuBIKZH9P6KJ+XDtC+lIcj+NjRu63Je/C4Gck0zV9zW57XqvsYTiMx6XcscURC4yJGDqBqz0KDPcjUOX4sNbvu2iDj6FDpZ2yOJWozW50dXoT2uYw8wAMYsKPRg5g1pK2Mq9XIO54jGvlh4Ac+GBqPu1/4KG1EZdcwtAuk76i0BAouArWFPI5reMiS5T4KptjT/aUu4Er5aWuyZ+OdzOr2vdFp5UPPA6W+NCCCSZkx+nh+G6+4oAlRR2OcUOvKJgCkeGtW7zl/uxUayiTEpsvlKvqPqmprHU0qDQsGe0baZOauH1xW1zMzy/BbSdod41WKm+ x-ms-exchange-transport-forked: True arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=aeQDJ01UZOvzQmF76w5PUzOm/LFiteVmhkmnWZoR1yCb+C3piXLC2tSDy8BvkVvNn7joD/duG1nm1MHJLuqHwbZTY/yLO2cv+5C4afCj1QDB5eePOHCPRSuXKLvz+mYIoos6JVLljOLDo6QlDeqzP0pzSOxQ8ZdassKS2HTCKZA85euMpCBzZjxpbhropSCvJTMHmGy8byoQEhlLz2kN9IaierG0m19oaBGIwqpdCynp1HTNB0R24NPmkuWx8qFmG+fzaI5uPSzMSF4sq4RwLK6yZmcpI4eb3hmUYOabZFUuz14A2k/TED5IHetWlQcKpY2mxwEuyjTWq6bmmDdGUA== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=yk/uhBGmLQ3ezxDA1gldM8veC9v0HCMaranUVmDQMjc=; b=PWdjEt0jyKuBk0NjquPqGePMbcBxiZC7Tu0Z4Sdj3R4JkCAXzAH2cMFfwpymEx4IbqLyMYLwc/2sT+1fpbf2/eB2GOIrwToc2AUWXbjMX1EwWYwlNXk7b4TTaVUkDaWtGHTa15J1W3nImLEeD2QSCiux9MFOBktYWcew3MudJIBq4dvT76y0TjM6mm5dwzmZnn/pb0pTFvI3RQGGEtieNjHlk4g2BNYg4lBH+D4TjJjkQqTXFfzmiyaJir3UVhVan4jQmLcVN5d4mwYnOmx3fqx2xrnnE2afG7v7TmytQtEo6CNt6k+hZ9wv5FKxPtTuHr0TrTvYmY33jcAec7vWhA== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=comcast.com; dmarc=pass action=none header.from=comcast.com; dkim=pass header.d=comcast.com; arc=none dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastcorp.onmicrosoft.com; s=selector1-comcastcorp-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=yk/uhBGmLQ3ezxDA1gldM8veC9v0HCMaranUVmDQMjc=; b=G7rwDcvR1tVwk0qXPP3Iign2PFPzRtzgUTQYbOFRl+XJqPBGgy+SNhWcXkZZlcHmu99gswHYjdlfnXtUJ2dDBlRJGVNz+xJ3uvRAzCvm5rz98hYpAwJYsis/oN9Aayz5Iok4CIfwpy1kn/la9Ma2zobuFONY8OwHIRPKmcYwCGY= x-ms-exchange-crosstenant-authas: Internal x-ms-exchange-crosstenant-authsource: BYAPR11MB3111.namprd11.prod.outlook.com x-ms-exchange-crosstenant-network-message-id: 101a21d6-82cb-49bc-dd89-08d82dc2af88 x-ms-exchange-crosstenant-originalarrivaltime: 21 Jul 2020 22:09:06.3041 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 906aefe9-76a7-4f65-b82d-5ec20775d5aa x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: MFwy9loXtCT+5FjFE3p9GsL3F2PcKrbY6bFqfFwhy6qsfgTasxvJLRd8TCDDDLs3HA/oai4UtZvbexVsaWgoW8m7F+9FnThRInOToIh9u6c= x-ms-exchange-transport-crosstenantheadersstamped: BY5PR11MB4151 x-originatororg: comcast.com Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpjleLIzCtJLcpLzFFi42JxCVeS0W1LF483+PhYyOL/6XVsFjvPzmZy YPJYsuQnk8e6l+vYA5iiuGxSUnMyy1KL9O0SuDLOLLnOUjBNoeLKvPfsDYxr5LsYOTkkBEwk Np69x9bFyMUhJHCESeJqzxNWCGcXo8S09tVQzlVGiZZtX5ggnKOMEt+fboRyljBJbDvaxQoy TEjgEaPE0Q82XYwcHGwCOhLbNtuDhEUEXCX2nHnOCGILC1hIbNo5jRUibikx7W8LC4StJ3F5 x1ywGhYBVYmJS76AxXkFbCXa1q1ggRhfITFh8wuwGk4BF4n1ex6B2YwCYhLfT61hArGZBcQl bj2ZzwTxm4DEkj3nmSFsUYmXj/+B7RUV0Je4t/4zC8j9jALTgE7+28wEcrOEgJXE5EMaEPWy EpfmdzNC2L4SW68dZ4ewtSS2XJrBBmFnS1ye/RxqvprEjTcdULacxKrehywQtozEgxvbweEr IbCbWeL45yOMEM4tIGfXBrYJjKazkBw+C+gOZgFNifW79CHCHhLfj61lhbAVJaZ0P2SfBQ4X QYmTM5+wLGBkXcXIbWahZ2GuZ2mmZ2i6iRGcOhL4dzAene5xiFGAg1GJh3dhqni8EGtiWXFl 7iFGCQ5mJRFeHUagEG9KYmVValF+fFFpTmrxIUZpDhYlcd7+qy/ihATSE0tSs1NTC1KLYLJM HJxSDYxMMYW5Mz/fnVPEUGptvbTQ5P0f55JTk1pXH3kekXMhtCRwL8eXRadLLebM//Vgy8yd 679ofIw10pry9YP4sUdsyzg95d5M8AyQy0k03vbpfVjxMbELBSdCDm5u4jyler2nWJDHO+Bz aldq/AVllRKVxTcVpF4duazndt9l8R6DW9UL9rw+ZSWixFKckWioxVxUnAgAD/86zxkDAAA= X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-21_15:2020-07-21, 2020-07-21 signatures=0 X-Proofpoint-Spam-Reason: safe Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 22:09:13 -0000 DQoNCu+7v09uIDcvMjEvMjAsIDI6MjcgQU0sICJBZGQgb24gYmVoYWxmIG9mIE1hcnRpbiBUaG9t c29uIiA8YWRkLWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIG10QGxvd2VudHJvcHkubmV0 PiB3cm90ZToNCg0KICAgIE9uIFR1ZSwgSnVsIDIxLCAyMDIwLCBhdCAxMDo0MCwgRGVlbiwgR2xl bm4gd3JvdGU6DQogICAgPiBodHRwczovL3VybGRlZmVuc2UuY29tL3YzL19faHR0cHM6Ly9kYXRh dHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1kZWVuLWFkZC10aHJlYXRzLTAwX187ISFQ SVplZVc1d3NjeW5SUSE5b3REc3U4NXlsdm81eTdMOS1KVm5XV2VDZjhNMjhUV2lnV1psaHN5WW1P TUtlbTFKZWhqLXlIZXhWR2p5Skg3JA0KDQogICAgSGkgR2xlbm4sDQoNCiAgICBUaGlzIGlzIGFu IGludGVyZXN0aW5nIHRha2Ugb24gdGhlIHByb2JsZW0uICBIb3cgZG8geW91IGFudGljaXBhdGUg aWRlbnRpZnlpbmcgbmV0d29ya3MsIG9yIGlzIHRoYXQgbGVmdCBhcyBhbiBleGVyY2lzZSBmb3Ig dGhlIHJlYWRlcj8gIE9uZSBvZiB0aGUgdGhpbmdzIHdlIGhhdmUgc3RydWdnbGVkIHdpdGggaW4g Z2VuZXJhbCBpcyBuZXR3b3JrIGlkZW50aWZpY2F0aW9uLiAgQW5kIGV2ZW4gdGhhdCBmYWxscyBz aG9ydCBvZiB3aGF0IEdyZWVuIHdvdWxkIHNlZW0gdG8gZGVtYW5kLCB3aGljaCBpcyBuZXR3b3Jr IGF1dGhlbnRpY2F0aW9uLg0KDQogICAgSSBrbm93IHRoYXQgdGhlcmUgYXJlIHNvbWUgRUFQIG1l dGhvZHMgdGhhdCBpbnRlZ3JhdGUgbmV0d29yayBhdXRoZW50aWNhdGlvbiBhbmQgdGhlcmVmb3Jl IG1pZ2h0IGFsbG93IGZvciBtYWtpbmcgdGhpcyBjYWxsLCBidXQgSSBkb24ndCBrbm93IGhvdyBw b3J0YWJsZSB0aG9zZSBhcHByb2FjaGVzIGFyZS4NCg0KVGhlIGJhc2ljIGhlYXJ0IG9mIHRoZSBw cm9wb3NhbCBpcyB0aGF0IGl0J3MgdXNlciBjZW50cmljOyBUaGUgdXNlciBtYWtlcyBzdWJqZWN0 aXZlIGNsYXNzaWZpY2F0aW9ucyBvZiB0aGVpciBlZGdlIG5ldHdvcmsgYmFzZWQgb24gdGhlaXIg b3duIHVuZGVyc3RhbmRpbmcgYW5kIHBlcnNwZWN0aXZlLiAgU28gaWRlbnRpZmljYXRpb24gaXMg YSBjaGFsbGVuZ2UgdGhhdCBpcyBnb2luZyB0byBuZWVkIHRvIGludm9sdmUgdGhlIHVzZXIncyBj aG9pY2UuDQoNCk15IHRoaW5raW5nIHdhcyB0aGF0IHdlJ2QgdXNlIHRoZSB0aHJlZSBjbGFzc2lm aWNhdGlvbnMgYXMgYSBmcmFtaW5nIHRvIGRpc2N1c3Mgd2hhdCBtaXRpZ2F0aW9ucyBjb3VsZCBi ZSBkZWZpbmVkIHRvIGRlYWwgd2l0aCB0aGUgMyB0aHJlYXQvdHJ1c3QgbGV2ZWxzLiAgIFVzZXJz IHdvdWxkIHRoZW4gYmUgYWJsZSB0byBhdmFpbCB0aGVtc2VsdmVzIG9mIHRoZSBhcHByb3ByaWF0 ZSBtaXRpZ2F0aW9ucyBmb3IgdHJ1c3QvdGhyZWF0IGxldmVsIHRoZXkgYmVsaWV2ZSB0aGV5IGFy ZSBpbi4gIFRoZSBjbGFzc2lmaWNhdGlvbnMgZXhhbXBsZXMgd2VyZSBub3QgbWVhbnQgdG8gYmUg c3RyaWN0bHkgcHJvc2NyaXB0aXZlLCBtZWFuaW5nIHRoYXQgd2hpbGUgbWFueSB1c2VycyBldmVu IHRvZGF5IGRvIGhhcHB5IHRydXN0IHRoZWlyIElTUCBDUEUgZGV2aWNlIGFuZCBldmVyeXRoaW5n IGJlaGluZCBpdCBvbiB0aGVpciBob21lIG5ldHdvcmssIHRoZXJlIGFyZSBvdGhlcnMgd2hvIGRv buKAmXQgYW5kIHRha2Ugb3RoZXIgbWVhc3VyZXMgdG8gcHJvdGVjdCB0aGVpciBob21lIG5ldHdv cmsgYW5kIGRldmljZXMuICBCb3RoIGFyZSBmaW5lIGFuZCB0aGUgSUVURiBpc24ndCBpbiB0aGUg YnVzaW5lc3Mgb2YgdGVsbGluZyBlaXRoZXIgc2l0dWF0aW9uIHRoYXQgdGhleSBhcmUgd3Jvbmcs IGJ1dCB3ZSBhcmUgaW4gdGhlIGJ1c2luZXNzIG9mIGRlc2lnbmluZyB0aGluZ3MgdGhhdCBmaXQg aW50byBhIHZhcmlldHkgb2Ygc2NlbmFyaW9zIC0gYWxiZWl0IHdpdGggZGlmZmVyZW50IGNvbmZp Z3VyYXRpb25zIGFuZCB0aHJlYXQgbWl0aWdhdGlvbnMuDQoNClRoZSBob3BlIGZvciB0aGUgcHJv cG9zZWQgY2xhc3NpZmljYXRpb25zIGlzIHRoYXQgdGhleSB3aWxsIGxldCB1cyBwcm9kdWN0aXZl bHkgZm9jdXMgb3VyIGRpc2N1c3Npb25zLiAgICAgV2UgY2FuIGV2ZW4gZXhwYW5kIHRoZSBsaXN0 IGlmIG5lZWRlZCwgYnV0IHRoZSAzIGdyb3VwaW5ncyBtYXRjaGVzIHByZXR0eSB3ZWxsIHdpdGgg aG93IHBlb3BsZSBpbnRlcmFjdCB3aXRoIHRoZSByZWFsIHdvcmxkIHRocmVhdCBsZXZlbHM6ICAg KDEpIHdoYXQgeW91IGJlbGlldmUgeW91IGNhbiB0cnVzdDsgKDIpIHdoYXQgeW91IHRoaW5rIHlv dSBsaWtlbHkgc2hvdWxkIGJlIGFibGUgdG8gdHJ1c3Q7ICgzKSB3aGF0IHlvdSBrbm93IHlvdSBj YW4ndCB0cnVzdC4gIFdoZXJlIGFueSBwYXJ0aWN1bGFyIHRoaW5nIGZhbGxzIGludG8gaXMgYm90 aCBzdWJqZWN0aXZlIGFuZCBvcGVuIGZvciByZXZhbHVhdGlvbiBpZiBjb25kaXRpb25zIG9yIHBl cmNlcHRpb25zIGNoYW5nZSwgYnV0IHRoZSAzIGJ1Y2tldHMgaXMgYSBwcmV0dHkgZ29vZCBjbGFz c2lmaWNhdGlvbiBpbiBjbGFzc2ljIHRocmVhdCBhbmFseXNpcy4NCg0KDQoNCiBJJ20gbm90IHBy b3Bvc2luZyBhIGZvcm1hbCBtZXRob2QgZm9yIGEgbmV0d29yayBzZWdtZW50IHRvIGJlIGxhYmVs ZWQgZ3JlZWQveWVsbG93L3JlZCAtIGJ1dCBJIGRvIHRoaW5rIGFzIHdlIHdvcmsgdGhyb3VnaCBv dXIgY29sbGVjdGl2ZSB0aGlua2luZyBvbiB3aGF0J3MgbmVlZGVkIGFuZCB3aGF0J3MgZ29vZCBl bm91Z2ggaW4gZWFjaCB6b25lIGl0IHdpbGwgaGVscCB1cyBjb21lIHRvIGEgZ29vZCBwbGFjZSB3 aGVyZSB0aGUgZGlzY292ZXJ5IGFuZCByZXNvbHZlciBpbmZvIG1ldGhvZHMgd2lsbCBtZWV0IHdp dGggYm90aCB0aGUgbmVlZCBvZiB0aGUgdXNlciB0byBjb25uZWN0IHN1Y2Nlc3NmdWxseSB0byBh IGVuY3J5cHRlZCBETlMgcmVzb2x2ZXIsIGJ1dCBhbHNvIGVuYWJsZSB0aGVtIHRvIGRvIHNvIHdp dGggYXBwcm9wcmlhdGUgcHJvdGVjdGlvbnMuDQoNCi1nbGVubg0KDQoNCg== From nobody Tue Jul 21 15:41:14 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 852933A0039 for ; Tue, 21 Jul 2020 15:41:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.918 X-Spam-Level: X-Spam-Status: No, score=-1.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aXhobgEzmzgG for ; Tue, 21 Jul 2020 15:41:11 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 530333A0044 for ; Tue, 21 Jul 2020 15:41:11 -0700 (PDT) Received: from pps.filterd (m0049458.ppops.net [127.0.0.1]) by m0049458.ppops.net-00191d01. (8.16.0.42/8.16.0.42) with SMTP id 06LMW4rB005291; Tue, 21 Jul 2020 18:41:10 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049458.ppops.net-00191d01. with ESMTP id 32e3vppkqb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 21 Jul 2020 18:41:10 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id 06LMf95a012771; Tue, 21 Jul 2020 18:41:09 -0400 Received: from zlp30488.vci.att.com (zlp30488.vci.att.com [135.47.91.93]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id 06LMf3YO012631 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 21 Jul 2020 18:41:03 -0400 Received: from zlp30488.vci.att.com (zlp30488.vci.att.com [127.0.0.1]) by zlp30488.vci.att.com (Service) with ESMTP id 35322400AF90; Tue, 21 Jul 2020 22:41:03 +0000 (GMT) Received: from GAALPA1MSGEX1CA.ITServices.sbc.com (unknown [135.50.89.108]) by zlp30488.vci.att.com (Service) with ESMTPS id 1B296400AF73; Tue, 21 Jul 2020 22:41:03 +0000 (GMT) Received: from GAALPA1MSGEX1CB.ITServices.sbc.com (135.50.89.109) by GAALPA1MSGEX1CA.ITServices.sbc.com (135.50.89.108) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2044.4; Tue, 21 Jul 2020 18:41:02 -0400 Received: from GAALPA1MSGEX1CB.ITServices.sbc.com ([135.50.89.109]) by GAALPA1MSGEX1CB.ITServices.sbc.com ([135.50.89.109]) with mapi id 15.01.2044.004; Tue, 21 Jul 2020 18:41:02 -0400 From: "STARK, BARBARA H" To: "'Eric Rescorla'" , "'Michael Richardson'" CC: "'ADD Mailing list'" Thread-Topic: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AQHWXqS/7aOk/WOOM0GAfZqI925UXKkQ02OAgAB6x4CAACdhAIABSZeAgAAGSoD//8NFwA== Date: Tue, 21 Jul 2020 22:41:02 +0000 Message-ID: <4361a792716b4f9f8f2054e4fddcab34@att.com> References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <7671.1595362961@localhost> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.104.133] x-tm-snts-smtp: 568730DF08F760BDE29121D7C807598D78206F55DF742E3D49EB58AA0E6441CC2 Content-Type: multipart/alternative; boundary="_000_4361a792716b4f9f8f2054e4fddcab34attcom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-21_15:2020-07-21, 2020-07-21 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 bulkscore=0 phishscore=0 mlxlogscore=999 spamscore=0 clxscore=1011 malwarescore=0 priorityscore=1501 suspectscore=0 adultscore=0 mlxscore=0 lowpriorityscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007210141 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 22:41:14 -0000 --_000_4361a792716b4f9f8f2054e4fddcab34attcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SW4tbGluZSBhcyBbQkhTXS4NCkJhcmJhcmENCg0KRnJvbTogRXJpYyBSZXNjb3JsYQ0KDQpPbiBU dWUsIEp1bCAyMSwgMjAyMCBhdCAxOjIyIFBNIE1pY2hhZWwgUmljaGFyZHNvbiA8bWNyK2lldGZA c2FuZGVsbWFuLmNhPG1haWx0bzptY3IlMkJpZXRmQHNhbmRlbG1hbi5jYT4+IHdyb3RlOg0KDQpF cmljIFJlc2NvcmxhIDxla3JAcnRmbS5jb208bWFpbHRvOmVrckBydGZtLmNvbT4+IHdyb3RlOg0K ICAgID4gV2l0aCB0aGF0IHNhaWQsIEkgaGF2ZSBzb21lIGNvbmNlcm5zIGFib3V0IHRoZSBvYmpl Y3RpdmUgb2YgaGF2aW5nIHRoZQ0KICAgID4gQ1BFIGluIHRoZSB1c2VyJ3MgcmVzb2x1dGlvbiBw YXRoLiBXaGlsZSBJIGNlcnRhaW5seSBjYW4gdW5kZXJzdGFuZA0KICAgID4gdGhlIHJlYXNvbnMg eW91IGNvbnNpZGVyIGl0IGFkdmFudGFnZW91cywgaXQgc2VlbXMgdG8gbWUgdGhhdCBpdA0KICAg ID4gc2lnbmlmaWNhbnRseSB3ZWFrZW5zIHRoZSB1c2VyJ3Mgc2VjdXJpdHkgcG9zdHVyZS4NCg0K SXQncyBhIHF1ZXN0aW9uIG9mIHBvaW50IG9mIHZpZXcuDQpXaGlsZSB5b3UgZmVlbCB0aGF0IHdl IGNhbid0IHRydXN0IGFueSBvZiB0aGUgQ1BFcyBvdXQgdGhlcmUsIG1hbnkgb2YgdXMgZmVlbA0K dGhhdCB3ZSBjYW4ndCB0cnVzdCBhbnkgb2YgdGhlIGRlc2t0b3AgUENzIG91dCB0aGVyZS4gIFRo ZXkgYXJlIGluZmVzdGVkLg0KQW5kIGV2ZW4gZGV2aWNlcyBmcm9tIHZlbmRvcnMgd2hvIHNheSB0 aGV5IGNhcmUgYWJvdXQgb3VyIHByaXZhY3ksIHNlZW0gbm90DQp3aWxsaW5nIHRvIHVzZSB0aGUg RE5TIHNldHRpbmdzIHdlIHRlbGwgdGhlbS4NCg0KTGV0IG1lIHJld3JpdGUgeW91ciB3b3JkcyBm cm9tIHRoZSBwb2ludCBvZiB2aWV3IG9mIG1hbnkgb2YgdXMsDQpwZXJoYXBzIEkgd2lsbCBzdWNj ZWVkIGluIGNoYW5uZWxpbmcgUGF1bCdzIHBvaW50Lg0KTWljaGFlbCwNCg0KSSB0aGluayB3ZSBh cmUgbm93IHZlcmdpbmcgaW50byB0aGUga2luZCBvZiBwb2xpY3kgdGVycml0b3J5IHdoaWNoIGlz IG91dCBvZiBzY29wZSBmb3IgdGhpcyBXRy4NCg0KSW4gYW55IGNhc2UsIHRoZSBwb2ludCBJIHdh cyBtYWtpbmcgd2FzIHNwZWNpZmljIHRvIENQRTogaXQncyBvbmUgdGhpbmcgdG8gaGF2ZSB0aGUg Y2xpZW50IGRldGVjdCBhbmQgdXNlIHRoZSBJU1AncyByZXNvbHZlcjsgaXQncyBxdWl0ZSBhbm90 aGVyIHRvIGhhdmUgaXQgdXNlIHRoZSBDUEUuIEZvciB0aGUgc2FtZSByZWFzb24gdGhhdCBpdCdz IGhhcmQgdG8gdXBncmFkZSB0aGUgQ1BVIChhcyBub3RlZCBpbiB0aGUgZHJhZnQgdGhhdCBzdGFy dGVkIHRoaXMgdGhyZWFkKSBpdCdzIGFsc28gaGFyZCB0byBzZWN1cmUgaXQuIFRoaXMgaXMgbm90 IHRydWUgZm9yIGVpdGhlciB0aGUgSVNQJ3MgcmVzb2x2ZXIgb3IsIGluY2lkZW50YWxseSwgZm9y IFdlYiBicm93c2VycywgdGhvdWdoIGl0IGlzIHRydWUgZm9yIG1hbnkgSW9UIGRldmljZXMuIFRo dXMsIGl0IHNlZW1zIGxpa2UgaGF2aW5nIHRoZSBjbGllbnQgZGV0ZWN0IGFuZCB1c2UgdGhlIENQ RSBzaWduaWZpY2FudGx5IHdvcnNlbnMgdGhlIHVzZXIncyBwb3N0dXJlIHZpcy1hLXZpcyB0aGVt IHVzaW5nIHRoZSBJU1AgcmVzb2x2ZXIuDQoNCltCSFNdIFdoaWxlIG15IElTUCByZXF1aXJlcyBt ZSB0byB1c2UgdGhlIENFIHJvdXRlciB0aGV5IHN1cHBseSwgSeKAmXZlIG5ldmVyIGhhZCBhbiBp c3N1ZSBjb25uZWN0aW5nIHRoYXQgdG8gbXkgb3duIHJvdXRlciBhbmQgdGhlbiBydW5uaW5nIG15 IGhvbWUgbmV0d29yayBmcm9tIG15IHJvdXRlci4gVGhlIENFIHJvdXRlciBmcm9tIG15IHBhcnRp Y3VsYXIgSVNQIChZTU1WKSBldmVuIGF1dG9tYXRpY2FsbHkgcGFzc2VzIG9uIHRoZSBwdWJsaWMg SVB2NCBhZGRyZXNzIGl0IGFjcXVpcmVzIGFuZCBhIC82NCBJUHY2IHByZWZpeCB0byBteSByb3V0 ZXIgKHNvIElQdjQganVzdCBoYXMgdGhlIHNpbmdsZSBOQVQgYW5kIElQdjYgd29ya3MgZ3JlYXQp LiBJIGhhdmUgdG90YWwgYWJpbGl0eSB0byBjaG9vc2UgYW55IHJvdXRlciBJIHdhbnQgYW5kIGNv bmZpZ3VyZSB0aGF0IHJvdXRlciBhcyBtdWNoIGFzIHRoYXQgcm91dGVyIHZlbmRvcuKAmXMgR1VJ IGFsbG93cyAoZS5nLiwgTmV0Z2VhciBHVUlzIGRvbuKAmXQgbGV0IHlvdSBjb25maWd1cmUgdGhl IEROUyBzZXJ2ZXIgaW5mbyBpdCBzdXBwbGllcyB0byB0aGUgTEFOIHZpYSBESENQLCBldGMuIOKA kyBpdCBhbHdheXMgc3VwcGxpZXMgaXRzIG93biBJUCBhZGRyZXNzOyBpdCBkb2VzIGxldCB0aGUg dXNlciBzYXkgd2hldGhlciBpdHMgcHJveHkgd2lsbCB1c2UgRE5TIGluZm8gaXQgZ2V0cyB2aWEg REhDUCBvciBjb25maWd1cmUgc3RhdGljIEROUyBpbmZvKS4gSXQgc2VlbXMgdG8gbWUgdGhhdCBh bnlvbmUgd2hvIGlzIGNvbmNlcm5lZCB3aXRoIHdoYXQgdGhlIElTUCBjYW4gZG8gdmlzLcOgLXZp cyB0aGVpciBob21lIG5ldHdvcmsgc2hvdWxkIGJlIGZpcmV3YWxsaW5nIHRoZSBJU1AgQ0Ugcm91 dGVyLCBhbnl3YXkuIEnigJltIGF0IGEgbG9zcyB0byB1bmRlcnN0YW5kIHdoeSBwZW9wbGUgYXJl IGNvbnNpZGVyZWQg4oCcZm9yY2Vk4oCdIHRvIHVzZSB0aGUgSVNQIENFIHJvdXRlciBhcyB0aGVp ciBob21lIG5ldHdvcmsgcm91dGVyLCBqdXN0IGJlY2F1c2UgdGhleeKAmXJlIGZvcmNlZCB0byB1 c2UgaXQgdG8gdGVybWluYXRlIHRoZSBJU1AgV0FOIGNvbm5lY3Rpb24uIEkgZG8gdW5kZXJzdGFu ZCB0aGF0IHBlb3BsZSBkbyB0aGlzIGZvciBlYXNlIGFuZCBjb252ZW5pZW5jZS4gQnV0IHRob3Nl IHNhbWUgcGVvcGxlIGFyZSBhbHNvIHVubGlrZWx5IHRvIGNhcmUgYWJvdXQgY2hhbmdpbmcgYXdh eSBmcm9tIHRoZSBJU1AgcmVzb2x2ZXJzLiBJZiB5b3UgY2FyZSBlbm91Z2ggdG8gd2FudCB0byBj b25maWd1cmUgdGhlIEROUyB1c2VkIGluIHlvdXIgaG9tZSBuZXR3b3JrLCB5b3Ugc2hvdWxkIGNh cmUgZW5vdWdoIHRvIHJ1biB5b3VyIG93biByb3V0ZXIgYmV0d2VlbiB5b3VyIG5ldHdvcmsgYW5k IHRoZSBJU1Ag4oCcV0FOIHRlcm1pbmF0aW9uIGRldmljZeKAnS4gLS1CYXJiYXJhDQoNCg0KICAg IG1jcj4gRXZlbiBhc3N1bWluZw0KICAgIG1jcj4gYXJndWVuZG8gdGhhdCB3ZSBoYXZlIGEgc2Vj dXJlIG1lY2hhbmlzbSBmb3IgZGlzY292ZXJpbmcgdGhpcyBjYXNlLA0KICAgIG1jcj4gaW4gcHJh Y3RpY2UgdGhlIFBDIGRlc2t0b3AgV0VCIEJST1dTRVIgYW5kIElvVCBkZXZpY2VzIHNlZW1zIHRv IGhhdmUgcXVpdGUgYSBoaWdoIHJhdGUgb2Ygc2VjdXJpdHkNCiAgICBtY3I+IGlzc3VlcywgaW5j bHVkaW5nIHNwZWNpZmljYWxseSBETlMgc3Bvb2ZpbmcsIHNpbmNlIHRoZSBicm93c2VycyBkbyBu b3QNCiAgICBtY3I+IGRvIEROU1NFQyBldmVuIHRob3VnaCB0aGV5IGNvdWxkLg0KDQpUaGlzIGNs YWltIHNlZW1zIHRvIGhhdmUgdHdvIHBhcnRzOg0KDQoxLiBEb2luZyBETlNTRUMgdmFsaWRhdGlv biB3b3VsZCBzaWduaWZpY2FudGx5IGRlY3JlYXNlIHRoZSBoaWdoIHJhdGUgb2YgRE5TIHNwb29m aW5nLg0KMi4gVGhhdCB0aGUgYnJvd3NlcnMgaW4gZmFjdCBjb3VsZCBkbyBETlNTRUMgdmFsaWRh dGlvbi4NCg0KQXMgZmFyIGFzIEkga25vdywgaXQncyBhbiBvcGVuIHF1ZXN0aW9uIHdoZXRoZXIg ZWl0aGVyIG9mIHRoZXNlIGlzIHRydWUuIERvIHlvdSBoYXZlIG1lYXN1cmVtZW50cyB0aGF0IHN1 cHBvcnQgZWl0aGVyICgxKSB0aGF0IEROUyBzcG9vZmluZyBoYXBwZW5zIGZyZXF1ZW50bHkgYW5k IHdvdWxkIGJlIHByZXZlbnRlZCBieSBETlMgW25vdGUgdGhhdCBkdWUgdG8gdGhlIGhpZ2ggZnJh Y3Rpb24gb2YgY29ubmVjdGlvbnMgd2hpY2ggYXJlIHNlY3VyZWQgYnkgVExTLCB0aGUgaW1wYWN0 IG9mIHN1Y2ggc3Bvb2Zpbmcgd291bGQgYmUgbW9kZXN0IGluIG1hbnkgY2FzZXNdIG9yICgyKSB0 aGF0IGJyb3dzZXJzIGNvdWxkIHNhZmVseSBkbyBETlNTRUMgdmFsaWRhdGlvbiB3aXRob3V0IGV4 cGVyaWVuY2luZyB1bmFjY2VwdGFibGUgZmFsc2UgcG9zaXRpdmUgcmF0ZXM/DQoNCi1Fa3INCg0K DQo= --_000_4361a792716b4f9f8f2054e4fddcab34attcom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IlByb2dJZCIg Y29udGVudD0iV29yZC5Eb2N1bWVudCI+DQo8bWV0YSBuYW1lPSJHZW5lcmF0b3IiIGNvbnRlbnQ9 Ik1pY3Jvc29mdCBXb3JkIDE1Ij4NCjxtZXRhIG5hbWU9Ik9yaWdpbmF0b3IiIGNvbnRlbnQ9Ik1p Y3Jvc29mdCBXb3JkIDE1Ij4NCjxsaW5rIHJlbD0iRmlsZS1MaXN0IiBocmVmPSJjaWQ6ZmlsZWxp c3QueG1sQDAxRDY1Rjg2LjBGOTQ2QzUwIj48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOk9m ZmljZURvY3VtZW50U2V0dGluZ3M+DQo8bzpBbGxvd1BORy8+DQo8bzpEb05vdFJlbHlPbkNTUy8+ DQo8L286T2ZmaWNlRG9jdW1lbnRTZXR0aW5ncz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPHc6V29yZERvY3VtZW50Pg0KPHc6U3BlbGxpbmdTdGF0ZT5DbGVh bjwvdzpTcGVsbGluZ1N0YXRlPg0KPHc6RG9jdW1lbnRLaW5kPkRvY3VtZW50RW1haWw8L3c6RG9j dW1lbnRLaW5kPg0KPHc6VHJhY2tNb3Zlcy8+DQo8dzpUcmFja0Zvcm1hdHRpbmcvPg0KPHc6RW52 ZWxvcGVWaXMvPg0KPHc6VmFsaWRhdGVBZ2FpbnN0U2NoZW1hcy8+DQo8dzpTYXZlSWZYTUxJbnZh bGlkPmZhbHNlPC93OlNhdmVJZlhNTEludmFsaWQ+DQo8dzpJZ25vcmVNaXhlZENvbnRlbnQ+ZmFs c2U8L3c6SWdub3JlTWl4ZWRDb250ZW50Pg0KPHc6QWx3YXlzU2hvd1BsYWNlaG9sZGVyVGV4dD5m YWxzZTwvdzpBbHdheXNTaG93UGxhY2Vob2xkZXJUZXh0Pg0KPHc6RG9Ob3RQcm9tb3RlUUYvPg0K PHc6TGlkVGhlbWVPdGhlcj5FTi1VUzwvdzpMaWRUaGVtZU90aGVyPg0KPHc6TGlkVGhlbWVBc2lh bj5YLU5PTkU8L3c6TGlkVGhlbWVBc2lhbj4NCjx3OkxpZFRoZW1lQ29tcGxleFNjcmlwdD5YLU5P TkU8L3c6TGlkVGhlbWVDb21wbGV4U2NyaXB0Pg0KPHc6Q29tcGF0aWJpbGl0eT4NCjx3OkRvTm90 RXhwYW5kU2hpZnRSZXR1cm4vPg0KPHc6QnJlYWtXcmFwcGVkVGFibGVzLz4NCjx3OlNuYXBUb0dy aWRJbkNlbGwvPg0KPHc6V3JhcFRleHRXaXRoUHVuY3QvPg0KPHc6VXNlQXNpYW5CcmVha1J1bGVz Lz4NCjx3OkRvbnRHcm93QXV0b2ZpdC8+DQo8dzpTcGxpdFBnQnJlYWtBbmRQYXJhTWFyay8+DQo8 dzpFbmFibGVPcGVuVHlwZUtlcm5pbmcvPg0KPHc6RG9udEZsaXBNaXJyb3JJbmRlbnRzLz4NCjx3 Ok92ZXJyaWRlVGFibGVTdHlsZUhwcy8+DQo8L3c6Q29tcGF0aWJpbGl0eT4NCjxtOm1hdGhQcj4N CjxtOm1hdGhGb250IG06dmFsPSJDYW1icmlhIE1hdGgiLz4NCjxtOmJya0JpbiBtOnZhbD0iYmVm b3JlIi8+DQo8bTpicmtCaW5TdWIgbTp2YWw9IiYjNDU7LSIvPg0KPG06c21hbGxGcmFjIG06dmFs PSJvZmYiLz4NCjxtOmRpc3BEZWYvPg0KPG06bE1hcmdpbiBtOnZhbD0iMCIvPg0KPG06ck1hcmdp biBtOnZhbD0iMCIvPg0KPG06ZGVmSmMgbTp2YWw9ImNlbnRlckdyb3VwIi8+DQo8bTp3cmFwSW5k ZW50IG06dmFsPSIxNDQwIi8+DQo8bTppbnRMaW0gbTp2YWw9InN1YlN1cCIvPg0KPG06bmFyeUxp bSBtOnZhbD0idW5kT3ZyIi8+DQo8L206bWF0aFByPjwvdzpXb3JkRG9jdW1lbnQ+DQo8L3htbD48 IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjx3OkxhdGVudFN0eWxlcyBEZWZM b2NrZWRTdGF0ZT0iZmFsc2UiIERlZlVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgRGVmU2VtaUhpZGRl bj0iZmFsc2UiIERlZlFGb3JtYXQ9ImZhbHNlIiBEZWZQcmlvcml0eT0iOTkiIExhdGVudFN0eWxl Q291bnQ9IjM3NyI+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjAi IFFGb3JtYXQ9InRydWUiIE5hbWU9Ik5vcm1hbCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI5IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDEiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIgU2VtaUhpZGRlbj0idHJ1 ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFGb3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgMiIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI5IiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iaGVhZGlu ZyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjkiIFNlbWlI aWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJo ZWFkaW5nIDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFGb3JtYXQ9InRydWUiIE5h bWU9ImhlYWRpbmcgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZvcm1hdD0idHJ1 ZSIgTmFtZT0iaGVhZGluZyA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBRRm9ybWF0 PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iOSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFG b3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iaGVhZGluZyA5Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 ImluZGV4IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0 cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iaW5kZXggMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJpbmRleCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhp ZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImluZGV4IDQiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iaW5kZXggNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJpbmRleCA2Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRl V2hlblVzZWQ9InRydWUiIE5hbWU9ImluZGV4IDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iaW5k ZXggOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJpbmRleCA5Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0idG9jIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBO YW1lPSJ0b2MgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIz OSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9InRvYyAzIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9jIDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0b2MgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSIzOSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRy dWUiIE5hbWU9InRvYyA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjM5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9j IDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlI aWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0b2MgOCIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzOSIgU2VtaUhpZGRlbj0idHJ1ZSIg VW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9InRvYyA5Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 Ik5vcm1hbCBJbmRlbnQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlk ZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iZm9vdG5vdGUgdGV4dCIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdo ZW5Vc2VkPSJ0cnVlIiBOYW1lPSJhbm5vdGF0aW9uIHRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFt ZT0iaGVhZGVyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImZvb3RlciIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJpbmRleCBoZWFkaW5nIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjM1IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZv cm1hdD0idHJ1ZSIgTmFtZT0iY2FwdGlvbiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0YWJsZSBv ZiBmaWd1cmVzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImVudmVsb3BlIGFkZHJlc3MiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iZW52ZWxvcGUgcmV0dXJuIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 ImZvb3Rub3RlIHJlZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJhbm5vdGF0aW9uIHJl ZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJsaW5lIG51bWJlciIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJwYWdlIG51bWJlciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJlbmRub3RlIHJl ZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJlbmRub3RlIHRleHQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0idGFibGUgb2YgYXV0aG9yaXRpZXMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i bWFjcm8iLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9hIGhlYWRpbmciLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IEJ1bGxldCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0 IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iTGlzdCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 Ikxpc3QgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IDUiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBCdWxsZXQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IEJ1bGxldCAz Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxpc3QgQnVsbGV0IDQiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBCdWxsZXQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxpc3QgTnVtYmVyIDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBOdW1iZXIgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciA1 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjEwIiBRRm9ybWF0 PSJ0cnVlIiBOYW1lPSJUaXRsZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJDbG9zaW5nIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hl blVzZWQ9InRydWUiIE5hbWU9IlNpZ25hdHVyZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSIxIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iRGVmYXVsdCBQYXJhZ3JhcGggRm9udCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJC b2R5IFRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0 cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEluZGVudCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJMaXN0IENvbnRpbnVlIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxp c3QgQ29udGludWUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IENvbnRpbnVlIDMiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iTGlzdCBDb250aW51ZSA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9Ikxpc3QgQ29udGludWUgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJNZXNzYWdlIEhlYWRl ciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIxMSIgUUZvcm1h dD0idHJ1ZSIgTmFtZT0iU3VidGl0bGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iU2FsdXRhdGlv biIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJEYXRlIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkJv ZHkgVGV4dCBGaXJzdCBJbmRlbnQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBT ZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEZp cnN0IEluZGVudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRl bj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ik5vdGUgSGVhZGluZyIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJCb2R5IFRleHQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCb2R5 IFRleHQgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCb2R5IFRleHQgSW5kZW50IDIiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEluZGVudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9IkJsb2NrIFRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlk ZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSHlwZXJsaW5rIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVz ZWQ9InRydWUiIE5hbWU9IkZvbGxvd2VkSHlwZXJsaW5rIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjIyIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJTdHJvbmciLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMjAiIFFGb3JtYXQ9InRy dWUiIE5hbWU9IkVtcGhhc2lzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2Vt aUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkRvY3VtZW50IE1hcCIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJQbGFpbiBUZXh0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IkUtbWFpbCBTaWduYXR1cmUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1p SGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBUb3Agb2YgRm9y bSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIEJvdHRvbSBvZiBGb3JtIi8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9 InRydWUiIE5hbWU9Ik5vcm1hbCAoV2ViKSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIEFj cm9ueW0iLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBBZGRyZXNzIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRy dWUiIE5hbWU9IkhUTUwgQ2l0ZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIENvZGUiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBEZWZpbml0aW9uIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9IkhUTUwgS2V5Ym9hcmQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1p SGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBQcmVmb3JtYXR0 ZWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBTYW1wbGUiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iSFRNTCBUeXBld3JpdGVyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkhUTUwgVmFyaWFi bGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iYW5ub3RhdGlvbiBzdWJqZWN0Ii8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9 InRydWUiIE5hbWU9Ik5vIExpc3QiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBT ZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iT3V0bGluZSBMaXN0 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iT3V0bGluZSBMaXN0IDIiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iT3V0bGluZSBMaXN0IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgU2lt cGxlIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgU2ltcGxlIDIiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0iVGFibGUgU2ltcGxlIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUg Q2xhc3NpYyAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENsYXNzaWMgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDbGFzc2ljIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i VGFibGUgQ2xhc3NpYyA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhp ZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENvbG9yZnVsIDEi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhp ZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgQ29sb3JmdWwgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJUYWJsZSBDb2xvcmZ1bCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENv bHVtbnMgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDb2x1bW5zIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgQ29sdW1ucyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRh YmxlIENvbHVtbnMgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDb2x1bW5zIDUiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IlRhYmxlIEdyaWQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBHcmlkIDMiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRh YmxlIEdyaWQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49 InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBHcmlkIDYiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCA3Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxl IEdyaWQgOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDEiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0iVGFibGUgTGlzdCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIExp c3QgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iVGFibGUgTGlzdCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIExpc3Qg NiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDciLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iVGFibGUgTGlzdCA4Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2Vt aUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIDNEIGVmZmVj dHMgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSAzRCBlZmZlY3RzIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgM0QgZWZmZWN0cyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IlRhYmxlIENvbnRlbXBvcmFyeSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBFbGVnYW50 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIFByb2Zlc3Npb25hbCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJUYWJsZSBTdWJ0bGUgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBT dWJ0bGUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBXZWIgMSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJUYWJsZSBXZWIgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCYWxsb29uIFRl eHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIE5hbWU9 IlRhYmxlIEdyaWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVu PSJ0cnVlIiBOYW1lPSJQbGFjZWhvbGRlciBUZXh0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjEiIFFGb3JtYXQ9InRydWUiIE5hbWU9Ik5vIFNwYWNpbmciLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIE5hbWU9IkxpZ2h0 IFNoYWRpbmciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEi IE5hbWU9IkxpZ2h0IExpc3QiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjIiIE5hbWU9IkxpZ2h0IEdyaWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjMiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDEiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjQiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIE5hbWU9Ik1l ZGl1bSBMaXN0IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NjYiIE5hbWU9Ik1lZGl1bSBMaXN0IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1bSBHcmlkIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5hbWU9Ik1lZGl1bSBHcmlk IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9 IkRhcmsgTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGluZyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI3MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9u IExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgTmFtZT0iQ29sb3JmdWwgR3JpZCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQgU2hh ZGluZyBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2MSIgTmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgMSIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVtIFNo YWRpbmcgMSBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI2NCIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMiBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2Nl bnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IE5hbWU9IlJldmlzaW9uIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjM0IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJMaXN0IFBhcmFncmFwaCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIyOSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0i UXVvdGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzAiIFFG b3JtYXQ9InRydWUiIE5hbWU9IkludGVuc2UgUXVvdGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIE5hbWU9Ik1lZGl1bSBMaXN0IDIgQWNjZW50IDEiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1 bSBHcmlkIDEgQWNjZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNjZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5hbWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9 IkRhcmsgTGlzdCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI3MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGluZyBBY2NlbnQgMSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCBB Y2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIg TmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQgU2hhZGluZyBBY2NlbnQgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MSIgTmFtZT0iTGlnaHQgTGlz dCBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2 MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMSBBY2NlbnQgMiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NCIgTmFtZT0iTWVkaXVt IFNoYWRpbmcgMiBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIgTmFtZT0iTWVkaXVtIExpc3QgMiBBY2Nl bnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NyIgTmFt ZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI2OCIgTmFtZT0iTWVkaXVtIEdyaWQgMiBBY2NlbnQgMiIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OSIgTmFtZT0iTWVkaXVtIEdyaWQg MyBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MCIgTmFtZT0iRGFyayBMaXN0IEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjcxIiBOYW1lPSJDb2xvcmZ1bCBTaGFkaW5nIEFjY2VudCAyIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcyIiBOYW1lPSJDb2xvcmZ1 bCBMaXN0IEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjczIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYwIiBOYW1lPSJMaWdodCBTaGFkaW5nIEFjY2VudCAz Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYxIiBOYW1lPSJM aWdodCBMaXN0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjYyIiBOYW1lPSJMaWdodCBHcmlkIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAxIEFjY2Vu dCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY0IiBOYW1l PSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjY1IiBOYW1lPSJNZWRpdW0gTGlzdCAxIEFjY2VudCAzIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY2IiBOYW1lPSJNZWRpdW0gTGlz dCAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjY3IiBOYW1lPSJNZWRpdW0gR3JpZCAxIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBOYW1lPSJNZWRpdW0gR3JpZCAyIEFjY2VudCAzIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY5IiBOYW1lPSJNZWRp dW0gR3JpZCAzIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjcwIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzEiIE5hbWU9IkNvbG9yZnVsIFNoYWRpbmcgQWNjZW50 IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzIiIE5hbWU9 IkNvbG9yZnVsIExpc3QgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNzMiIE5hbWU9IkNvbG9yZnVsIEdyaWQgQWNjZW50IDMiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIE5hbWU9IkxpZ2h0IFNoYWRpbmcg QWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEi IE5hbWU9IkxpZ2h0IExpc3QgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjIiIE5hbWU9IkxpZ2h0IEdyaWQgQWNjZW50IDQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjMiIE5hbWU9Ik1lZGl1bSBTaGFkaW5n IDEgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NjQiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIE5hbWU9Ik1lZGl1bSBMaXN0IDEgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIE5hbWU9Ik1l ZGl1bSBMaXN0IDIgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1bSBHcmlkIDEgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNj ZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5h bWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9IkRhcmsgTGlzdCBBY2NlbnQgNCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGlu ZyBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgTmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgNCIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQg U2hhZGluZyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI2MSIgTmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgNSIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVt IFNoYWRpbmcgMSBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2NCIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBB Y2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIg TmFtZT0iTWVkaXVtIExpc3QgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2NyIgTmFtZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgNSIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OCIgTmFtZT0iTWVkaXVtIEdy aWQgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2OSIgTmFtZT0iTWVkaXVtIEdyaWQgMyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MCIgTmFtZT0iRGFyayBMaXN0IEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcxIiBOYW1lPSJDb2xvcmZ1 bCBTaGFkaW5nIEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjcyIiBOYW1lPSJDb2xvcmZ1bCBMaXN0IEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNlcHRp b24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjczIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2Vu dCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYwIiBOYW1l PSJMaWdodCBTaGFkaW5nIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjYxIiBOYW1lPSJMaWdodCBMaXN0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYyIiBOYW1lPSJMaWdodCBHcmlkIEFjY2Vu dCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBOYW1l PSJNZWRpdW0gU2hhZGluZyAxIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjY0IiBOYW1lPSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCA2Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY1IiBOYW1lPSJNZWRpdW0g TGlzdCAxIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjY2IiBOYW1lPSJNZWRpdW0gTGlzdCAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY3IiBOYW1lPSJNZWRpdW0gR3JpZCAxIEFjY2VudCA2 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBOYW1lPSJN ZWRpdW0gR3JpZCAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjY5IiBOYW1lPSJNZWRpdW0gR3JpZCAzIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcwIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50 IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzEiIE5hbWU9 IkNvbG9yZnVsIFNoYWRpbmcgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNzIiIE5hbWU9IkNvbG9yZnVsIExpc3QgQWNjZW50IDYiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzMiIE5hbWU9IkNvbG9yZnVsIEdy aWQgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i MTkiIFFGb3JtYXQ9InRydWUiIE5hbWU9IlN1YnRsZSBFbXBoYXNpcyIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIyMSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iSW50 ZW5zZSBFbXBoYXNpcyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSIzMSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iU3VidGxlIFJlZmVyZW5jZSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzMiIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0i SW50ZW5zZSBSZWZlcmVuY2UiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iMzMiIFFGb3JtYXQ9InRydWUiIE5hbWU9IkJvb2sgVGl0bGUiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzciIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCaWJsaW9ncmFwaHkiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJUT0MgSGVhZGluZyIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MSIgTmFtZT0iUGxhaW4gVGFibGUgMSIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MiIgTmFtZT0iUGxh aW4gVGFibGUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0 MyIgTmFtZT0iUGxhaW4gVGFibGUgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0NCIgTmFtZT0iUGxhaW4gVGFibGUgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NSIgTmFtZT0iUGxhaW4gVGFibGUgNSIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MCIgTmFtZT0iR3JpZCBUYWJsZSBM aWdodCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFt ZT0iR3JpZCBUYWJsZSAxIExpZ2h0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iR3JpZCBUYWJsZSA0Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1lPSJHcmlk IFRhYmxlIDUgRGFyayIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2IENvbG9yZnVsIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9IkdyaWQg VGFibGUgMSBMaWdodCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0NyIgTmFtZT0iR3JpZCBUYWJsZSAyIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ4IiBOYW1lPSJHcmlkIFRhYmxlIDMgQWNj ZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5h bWU9IkdyaWQgVGFibGUgNCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iR3JpZCBUYWJsZSA1IERhcmsgQWNjZW50IDEiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9IkdyaWQgVGFi bGUgNiBDb2xvcmZ1bCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI1MiIgTmFtZT0iR3JpZCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCAxIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJHcmlkIFRh YmxlIDEgTGlnaHQgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNDciIE5hbWU9IkdyaWQgVGFibGUgMiBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OCIgTmFtZT0iR3JpZCBUYWJsZSAzIEFjY2Vu dCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1l PSJHcmlkIFRhYmxlIDQgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNTAiIE5hbWU9IkdyaWQgVGFibGUgNSBEYXJrIEFjY2VudCAyIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJHcmlkIFRhYmxl IDYgQ29sb3JmdWwgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNTIiIE5hbWU9IkdyaWQgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iR3JpZCBUYWJs ZSAxIExpZ2h0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyBBY2NlbnQg MyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0i R3JpZCBUYWJsZSA0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjUwIiBOYW1lPSJHcmlkIFRhYmxlIDUgRGFyayBBY2NlbnQgMyIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2 IENvbG9yZnVsIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDMiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9IkdyaWQgVGFibGUg MSBMaWdodCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI0NyIgTmFtZT0iR3JpZCBUYWJsZSAyIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ4IiBOYW1lPSJHcmlkIFRhYmxlIDMgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikdy aWQgVGFibGUgNCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI1MCIgTmFtZT0iR3JpZCBUYWJsZSA1IERhcmsgQWNjZW50IDQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9IkdyaWQgVGFibGUgNiBD b2xvcmZ1bCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI1MiIgTmFtZT0iR3JpZCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCA0Ii8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJHcmlkIFRhYmxlIDEg TGlnaHQgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNDciIE5hbWU9IkdyaWQgVGFibGUgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OCIgTmFtZT0iR3JpZCBUYWJsZSAzIEFjY2VudCA1Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJHcmlk IFRhYmxlIDQgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNTAiIE5hbWU9IkdyaWQgVGFibGUgNSBEYXJrIEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJHcmlkIFRhYmxlIDYgQ29s b3JmdWwgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNTIiIE5hbWU9IkdyaWQgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgNSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iR3JpZCBUYWJsZSAxIExp Z2h0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyBBY2NlbnQgNiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iR3JpZCBU YWJsZSA0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjUwIiBOYW1lPSJHcmlkIFRhYmxlIDUgRGFyayBBY2NlbnQgNiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2IENvbG9y ZnVsIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdo dCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0i TGlzdCBUYWJsZSAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iTGlzdCBUYWJsZSA1IERhcmsiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFi bGUgNiBDb2xvcmZ1bCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI1MiIgTmFtZT0iTGlzdCBUYWJsZSA3IENvbG9yZnVsIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJMaXN0IFRhYmxlIDEgTGlnaHQgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDciIE5hbWU9 Ikxpc3QgVGFibGUgMiBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0OCIgTmFtZT0iTGlzdCBUYWJsZSAzIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJMaXN0IFRhYmxlIDQgQWNj ZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTAiIE5h bWU9Ikxpc3QgVGFibGUgNSBEYXJrIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJMaXN0IFRhYmxlIDYgQ29sb3JmdWwgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTIiIE5hbWU9 Ikxpc3QgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iTGlzdCBUYWJsZSAxIExpZ2h0IEFjY2VudCAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ3IiBOYW1lPSJM aXN0IFRhYmxlIDIgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNDgiIE5hbWU9Ikxpc3QgVGFibGUgMyBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iTGlzdCBUYWJsZSA0IEFjY2Vu dCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1l PSJMaXN0IFRhYmxlIDUgRGFyayBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iTGlzdCBUYWJsZSA2IENvbG9yZnVsIEFjY2VudCAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJM aXN0IFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdodCBBY2NlbnQgMyIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0iTGlz dCBUYWJsZSAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCBBY2NlbnQg MyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0i TGlzdCBUYWJsZSA1IERhcmsgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFibGUgNiBDb2xvcmZ1bCBBY2NlbnQgMyIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MiIgTmFtZT0iTGlz dCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJMaXN0IFRhYmxlIDEgTGlnaHQgQWNjZW50IDQiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDciIE5hbWU9Ikxpc3Qg VGFibGUgMiBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI0OCIgTmFtZT0iTGlzdCBUYWJsZSAzIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJMaXN0IFRhYmxlIDQgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTAiIE5hbWU9Ikxp c3QgVGFibGUgNSBEYXJrIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJMaXN0IFRhYmxlIDYgQ29sb3JmdWwgQWNjZW50IDQiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTIiIE5hbWU9Ikxpc3Qg VGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iTGlzdCBUYWJsZSAxIExpZ2h0IEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ3IiBOYW1lPSJMaXN0IFRh YmxlIDIgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNDgiIE5hbWU9Ikxpc3QgVGFibGUgMyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iTGlzdCBUYWJsZSA0IEFjY2VudCA1Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1lPSJMaXN0 IFRhYmxlIDUgRGFyayBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI1MSIgTmFtZT0iTGlzdCBUYWJsZSA2IENvbG9yZnVsIEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJMaXN0IFRh YmxlIDcgQ29sb3JmdWwgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdodCBBY2NlbnQgNiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0iTGlzdCBUYWJs ZSAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCBBY2NlbnQgNiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iTGlzdCBU YWJsZSA1IERhcmsgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFibGUgNiBDb2xvcmZ1bCBBY2NlbnQgNiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MiIgTmFtZT0iTGlzdCBUYWJs ZSA3IENvbG9yZnVsIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ik1lbnRpb24iLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iU21hcnQgSHlwZXJsaW5rIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9Ikhhc2h0YWciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVW5yZXNvbHZlZCBNZW50aW9uIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRl V2hlblVzZWQ9InRydWUiIE5hbWU9IlNtYXJ0IExpbmsiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i U21hcnQgTGluayBFcnJvciIvPg0KPC93OkxhdGVudFN0eWxlcz4NCjwveG1sPjwhW2VuZGlmXS0t PjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYgMyAyIDQ7DQoJ bXNvLWZvbnQtY2hhcnNldDowOw0KCW1zby1nZW5lcmljLWZvbnQtZmFtaWx5OnJvbWFuOw0KCW1z by1mb250LXBpdGNoOnZhcmlhYmxlOw0KCW1zby1mb250LXNpZ25hdHVyZTotNTM2ODY5MTIxIDEx MDczMDU3MjcgMzM1NTQ0MzIgMCA0MTUgMDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNh bGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7DQoJbXNvLWZvbnQtY2hhcnNl dDowOw0KCW1zby1nZW5lcmljLWZvbnQtZmFtaWx5OnN3aXNzOw0KCW1zby1mb250LXBpdGNoOnZh cmlhYmxlOw0KCW1zby1mb250LXNpZ25hdHVyZTotNTM2ODU4ODgxIC0xMDczNzMyNDg1IDkgMCA1 MTEgMDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1h bCwgZGl2Lk1zb05vcm1hbA0KCXttc28tc3R5bGUtdW5oaWRlOm5vOw0KCW1zby1zdHlsZS1xZm9y bWF0OnllczsNCgltc28tc3R5bGUtcGFyZW50OiIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJv dHRvbTouMDAwMXB0Ow0KCW1zby1wYWdpbmF0aW9uOndpZG93LW9ycGhhbjsNCglmb250LXNpemU6 MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0 LWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28t c3R5bGUtbm9zaG93OnllczsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsN Cgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lOw0KCXRleHQtdW5kZXJsaW5lOnNpbmdsZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLW5vc2hvdzp5 ZXM7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29y YXRpb246dW5kZXJsaW5lOw0KCXRleHQtdW5kZXJsaW5lOnNpbmdsZTt9DQpwLm1zb25vcm1hbDAs IGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1h bDsNCgltc28tc3R5bGUtdW5oaWRlOm5vOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1h cmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxl ZnQ6MGluOw0KCW1zby1wYWdpbmF0aW9uOndpZG93LW9ycGhhbjsNCglmb250LXNpemU6MTEuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0LWZvbnQt ZmFtaWx5OkNhbGlicmk7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVy c29uYWwtcmVwbHk7DQoJbXNvLXN0eWxlLW5vc2hvdzp5ZXM7DQoJbXNvLXN0eWxlLXVuaGlkZTpu bzsNCgltc28tYW5zaS1mb250LXNpemU6MTEuMHB0Ow0KCW1zby1iaWRpLWZvbnQtc2l6ZToxMS4w cHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWFzY2lpLWZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28t aGFuc2ktZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uU3BlbGxFDQoJe21zby1zdHls ZS1uYW1lOiIiOw0KCW1zby1zcGwtZTp5ZXM7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxl LXR5cGU6ZXhwb3J0LW9ubHk7DQoJbXNvLWRlZmF1bHQtcHJvcHM6eWVzOw0KCWZvbnQtZmFtaWx5 OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1hc2NpaS1mb250LWZhbWlseTpDYWxpYnJpOw0K CW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJbXNvLWhhbnNpLWZvbnQtZmFtaWx5 OkNhbGlicmk7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQHBh Z2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBp biAxLjBpbiAxLjBpbjsNCgltc28taGVhZGVyLW1hcmdpbjouNWluOw0KCW1zby1mb290ZXItbWFy Z2luOi41aW47DQoJbXNvLXBhcGVyLXNvdXJjZTowO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFn ZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gMTBdPjxzdHlsZT4v KiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KdGFibGUuTXNvTm9ybWFsVGFibGUNCgl7bXNvLXN0eWxl LW5hbWU6IlRhYmxlIE5vcm1hbCI7DQoJbXNvLXRzdHlsZS1yb3diYW5kLXNpemU6MDsNCgltc28t dHN0eWxlLWNvbGJhbmQtc2l6ZTowOw0KCW1zby1zdHlsZS1ub3Nob3c6eWVzOw0KCW1zby1zdHls ZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtcGFyZW50OiIiOw0KCW1zby1wYWRkaW5nLWFsdDow aW4gNS40cHQgMGluIDUuNHB0Ow0KCW1zby1wYXJhLW1hcmdpbjowaW47DQoJbXNvLXBhcmEtbWFy Z2luLWJvdHRvbTouMDAwMXB0Ow0KCW1zby1wYWdpbmF0aW9uOndpZG93LW9ycGhhbjsNCglmb250 LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1h c2NpaS1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1oYW5zaS1mb250LWZhbWlseTpDYWxpYnJp Ow0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCjwvc3R5bGU+PCFb ZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0 PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUg bXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4 dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4N CjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIiBz dHlsZT0idGFiLWludGVydmFsOi41aW4iPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1hc2NpaS1mb250LWZhbWlseTpDYWxpYnJpO21zby1o YW5zaS1mb250LWZhbWlseTpDYWxpYnJpO21zby1iaWRpLWZvbnQtZmFtaWx5OiZxdW90O1RpbWVz IE5ldyBSb21hbiZxdW90OyI+SW4tbGluZSBhcyBbQkhTXS48bzpwPjwvbzpwPjwvc3Bhbj48L2Zv bnQ+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJy aSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWFzY2lpLWZvbnQtZmFtaWx5OkNh bGlicmk7bXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWJpZGktZm9udC1mYW1pbHk6 JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij5CYXJiYXJhPG86cD48L286cD48L3NwYW4+PC9m b250PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGli cmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1hc2NpaS1mb250LWZhbWlseTpD YWxpYnJpO21zby1oYW5zaS1mb250LWZhbWlseTpDYWxpYnJpO21zby1iaWRpLWZvbnQtZmFtaWx5 OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9m b250PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxmb250IHNpemU9IjIiIGZhY2U9IkNh bGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1mYXJlYXN0LWZvbnQtZmFt aWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90Oztmb250LXdlaWdodDpib2xkIj5Gcm9tOjwv c3Bhbj48L2ZvbnQ+PC9iPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1mb250LWZhbWlseTomcXVv dDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiBFcmljIFJlc2NvcmxhPGJyIHN0eWxlPSJtc28tc3Bl Y2lhbC1jaGFyYWN0ZXI6bGluZS1icmVhayI+DQo8IVtpZiAhc3VwcG9ydExpbmVCcmVha05ld0xp bmVdPjxiciBzdHlsZT0ibXNvLXNwZWNpYWwtY2hhcmFjdGVyOmxpbmUtYnJlYWsiPg0KPCFbZW5k aWZdPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQiPk9uIFR1ZSwgSnVsIDIxLCAyMDIwIGF0IDE6MjIgUE0gTWljaGFlbCBSaWNoYXJk c29uICZsdDs8YSBocmVmPSJtYWlsdG86bWNyJTJCaWV0ZkBzYW5kZWxtYW4uY2EiPm1jciYjNDM7 aWV0ZkBzYW5kZWxtYW4uY2E8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvc3Bhbj48L2ZvbnQ+ PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6 c29saWQgI0NDQ0NDQyAxLjBwdDttc28tYm9yZGVyLWxlZnQtYWx0OnNvbGlkICNDQ0NDQ0MgLjc1 cHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmln aHQ6MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGli cmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48YnI+DQpFcmljIFJlc2NvcmxhICZs dDs8YSBocmVmPSJtYWlsdG86ZWtyQHJ0Zm0uY29tIiB0YXJnZXQ9Il9ibGFuayI+ZWtyQHJ0Zm0u Y29tPC9hPiZndDsgd3JvdGU6PGJyPg0KJm5ic3A7ICZuYnNwOyAmZ3Q7IFdpdGggdGhhdCBzYWlk LCBJIGhhdmUgc29tZSBjb25jZXJucyBhYm91dCB0aGUgb2JqZWN0aXZlIG9mIGhhdmluZyB0aGU8 YnI+DQombmJzcDsgJm5ic3A7ICZndDsgQ1BFIGluIHRoZSB1c2VyJ3MgcmVzb2x1dGlvbiBwYXRo LiBXaGlsZSBJIGNlcnRhaW5seSBjYW4gdW5kZXJzdGFuZDxicj4NCiZuYnNwOyAmbmJzcDsgJmd0 OyB0aGUgcmVhc29ucyB5b3UgY29uc2lkZXIgaXQgYWR2YW50YWdlb3VzLCBpdCBzZWVtcyB0byBt ZSB0aGF0IGl0PGJyPg0KJm5ic3A7ICZuYnNwOyAmZ3Q7IHNpZ25pZmljYW50bHkgd2Vha2VucyB0 aGUgdXNlcidzIHNlY3VyaXR5IHBvc3R1cmUuPGJyPg0KPGJyPg0KSXQncyBhIHF1ZXN0aW9uIG9m IHBvaW50IG9mIHZpZXcuPGJyPg0KV2hpbGUgeW91IGZlZWwgdGhhdCB3ZSBjYW4ndCB0cnVzdCBh bnkgb2YgdGhlIENQRXMgb3V0IHRoZXJlLCBtYW55IG9mIHVzIGZlZWw8YnI+DQp0aGF0IHdlIGNh bid0IHRydXN0IGFueSBvZiB0aGUgZGVza3RvcCBQQ3Mgb3V0IHRoZXJlLiZuYnNwOyBUaGV5IGFy ZSBpbmZlc3RlZC48YnI+DQpBbmQgZXZlbiBkZXZpY2VzIGZyb20gdmVuZG9ycyB3aG8gc2F5IHRo ZXkgY2FyZSBhYm91dCBvdXIgcHJpdmFjeSwgc2VlbSBub3Q8YnI+DQp3aWxsaW5nIHRvIHVzZSB0 aGUgRE5TIHNldHRpbmdzIHdlIHRlbGwgdGhlbS48bzpwPjwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9w Pg0KPC9ibG9ja3F1b3RlPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1s ZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7bXNvLWJvcmRlci1sZWZ0LWFsdDpzb2xpZCAjQ0NDQ0ND IC43NXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2lu LXJpZ2h0OjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbTox Mi4wcHQiPjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij48YnI+DQpMZXQgbWUgcmV3cml0ZSB5b3VyIHdvcmRzIGZyb20gdGhlIHBvaW50 IG9mIHZpZXcgb2YgbWFueSBvZiB1cyw8YnI+DQpwZXJoYXBzIEkgd2lsbCBzdWNjZWVkIGluIGNo YW5uZWxpbmcgUGF1bCdzIHBvaW50LjxvOnA+PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+DQo8L2Js b2NrcXVvdGU+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9 IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5NaWNoYWVs LDxvOnA+PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9mb250PjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGli cmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5JIHRoaW5rIHdlIGFyZSBub3cgdmVy Z2luZyBpbnRvIHRoZSBraW5kIG9mIHBvbGljeSB0ZXJyaXRvcnkgd2hpY2ggaXMgb3V0IG9mIHNj b3BlIGZvciB0aGlzIFdHLjxvOnA+PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9m b250PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9 IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5JbiBhbnkg Y2FzZSwgdGhlIHBvaW50IEkgd2FzIG1ha2luZyB3YXMgc3BlY2lmaWMgdG8gQ1BFOiBpdCdzIG9u ZSB0aGluZyB0byBoYXZlIHRoZSBjbGllbnQgZGV0ZWN0IGFuZCB1c2UgdGhlIElTUCdzIHJlc29s dmVyOyBpdCdzIHF1aXRlIGFub3RoZXIgdG8gaGF2ZSBpdCB1c2UgdGhlIENQRS4gRm9yIHRoZQ0K IHNhbWUgcmVhc29uIHRoYXQgaXQncyBoYXJkIHRvIHVwZ3JhZGUgdGhlIENQVSAoYXMgbm90ZWQg aW4gdGhlIGRyYWZ0IHRoYXQgc3RhcnRlZCB0aGlzIHRocmVhZCkgaXQncyBhbHNvIGhhcmQgdG8g c2VjdXJlIGl0LiBUaGlzIGlzIG5vdCB0cnVlIGZvciBlaXRoZXIgdGhlIElTUCdzIHJlc29sdmVy IG9yLCBpbmNpZGVudGFsbHksIGZvciBXZWIgYnJvd3NlcnMsIHRob3VnaCBpdCBpcyB0cnVlIGZv ciBtYW55IElvVCBkZXZpY2VzLiBUaHVzLCBpdA0KIHNlZW1zIGxpa2UgaGF2aW5nIHRoZSBjbGll bnQgZGV0ZWN0IGFuZCB1c2UgdGhlIENQRSBzaWduaWZpY2FudGx5IHdvcnNlbnMgdGhlIHVzZXIn cyBwb3N0dXJlIHZpcy1hLXZpcyB0aGVtIHVzaW5nIHRoZSBJU1AgcmVzb2x2ZXIuPG86cD48L286 cD48L3NwYW4+PC9mb250PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9IjIi IGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGIgc3R5bGU9 Im1zby1iaWRpLWZvbnQtd2VpZ2h0Om5vcm1hbCI+PGkgc3R5bGU9Im1zby1iaWRpLWZvbnQtc3R5 bGU6bm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDttc28tYXNjaWktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28taGFuc2ktZm9u dC1mYW1pbHk6Q2FsaWJyaTttc28tYmlkaS1mb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9t YW4mcXVvdDs7Zm9udC13ZWlnaHQ6Ym9sZDttc28tYmlkaS1mb250LXdlaWdodDpub3JtYWw7Zm9u dC1zdHlsZTppdGFsaWM7bXNvLWJpZGktZm9udC1zdHlsZTpub3JtYWwiPltCSFNdDQogV2hpbGUg bXkgSVNQIHJlcXVpcmVzIG1lIHRvIHVzZSB0aGUgQ0Ugcm91dGVyIHRoZXkgc3VwcGx5LCBJ4oCZ dmUgbmV2ZXIgaGFkIGFuIGlzc3VlIGNvbm5lY3RpbmcgdGhhdCB0byBteSBvd24gcm91dGVyIGFu ZCB0aGVuIHJ1bm5pbmcgbXkgaG9tZSBuZXR3b3JrIGZyb20gbXkgcm91dGVyLiBUaGUgQ0Ugcm91 dGVyIGZyb20gbXkgcGFydGljdWxhciBJU1AgKFlNTVYpIGV2ZW4gYXV0b21hdGljYWxseSBwYXNz ZXMgb24gdGhlIHB1YmxpYyBJUHY0IGFkZHJlc3MNCiBpdCBhY3F1aXJlcyBhbmQgYSAvNjQgSVB2 NiBwcmVmaXggdG8gbXkgcm91dGVyIChzbyBJUHY0IGp1c3QgaGFzIHRoZSBzaW5nbGUgTkFUIGFu ZCBJUHY2IHdvcmtzIGdyZWF0KS4gSSBoYXZlIHRvdGFsIGFiaWxpdHkgdG8gY2hvb3NlIGFueSBy b3V0ZXIgSSB3YW50IGFuZCBjb25maWd1cmUgdGhhdCByb3V0ZXIgYXMgbXVjaCBhcyB0aGF0IHJv dXRlciB2ZW5kb3LigJlzIEdVSSBhbGxvd3MgKGUuZy4sDQo8c3BhbiBjbGFzcz0iU3BlbGxFIj5O ZXRnZWFyPC9zcGFuPiBHVUlzIGRvbuKAmXQgbGV0IHlvdSBjb25maWd1cmUgdGhlIEROUyBzZXJ2 ZXIgaW5mbyBpdCBzdXBwbGllcyB0byB0aGUgTEFOIHZpYSBESENQLCBldGMuIOKAkyBpdCBhbHdh eXMgc3VwcGxpZXMgaXRzIG93biBJUCBhZGRyZXNzOyBpdCBkb2VzIGxldCB0aGUgdXNlciBzYXkg d2hldGhlciBpdHMgcHJveHkgd2lsbCB1c2UgRE5TIGluZm8gaXQgZ2V0cyB2aWEgREhDUCBvciBj b25maWd1cmUgc3RhdGljDQogRE5TIGluZm8pLiBJdCBzZWVtcyB0byBtZSB0aGF0IGFueW9uZSB3 aG8gaXMgY29uY2VybmVkIHdpdGggd2hhdCB0aGUgSVNQIGNhbiBkbyB2aXMtw6AtdmlzIHRoZWly IGhvbWUgbmV0d29yayBzaG91bGQgYmUgZmlyZXdhbGxpbmcgdGhlIElTUCBDRSByb3V0ZXIsIGFu eXdheS4gSeKAmW0gYXQgYSBsb3NzIHRvIHVuZGVyc3RhbmQgd2h5IHBlb3BsZSBhcmUgY29uc2lk ZXJlZCDigJxmb3JjZWTigJ0gdG8gdXNlIHRoZSBJU1AgQ0Ugcm91dGVyIGFzIHRoZWlyIGhvbWUN CiBuZXR3b3JrIHJvdXRlciwganVzdCBiZWNhdXNlIHRoZXnigJlyZSBmb3JjZWQgdG8gdXNlIGl0 IHRvIHRlcm1pbmF0ZSB0aGUgSVNQIFdBTiBjb25uZWN0aW9uLiBJIGRvIHVuZGVyc3RhbmQgdGhh dCBwZW9wbGUgZG8gdGhpcyBmb3IgZWFzZSBhbmQgY29udmVuaWVuY2UuIEJ1dCB0aG9zZSBzYW1l IHBlb3BsZSBhcmUgYWxzbyB1bmxpa2VseSB0byBjYXJlIGFib3V0IGNoYW5naW5nIGF3YXkgZnJv bSB0aGUgSVNQIHJlc29sdmVycy4gSWYgeW91IGNhcmUNCiBlbm91Z2ggdG8gd2FudCB0byBjb25m aWd1cmUgdGhlIEROUyB1c2VkIGluIHlvdXIgaG9tZSBuZXR3b3JrLCB5b3Ugc2hvdWxkIGNhcmUg ZW5vdWdoIHRvIHJ1biB5b3VyIG93biByb3V0ZXIgYmV0d2VlbiB5b3VyIG5ldHdvcmsgYW5kIHRo ZSBJU1Ag4oCcV0FOIHRlcm1pbmF0aW9uIGRldmljZeKAnS4gLS1CYXJiYXJhPC9zcGFuPjwvZm9u dD48L2k+PC9iPjxzcGFuIHN0eWxlPSJtc28tYXNjaWktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28t aGFuc2ktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28tYmlkaS1mb250LWZhbWlseTomcXVvdDtUaW1l cyBOZXcgUm9tYW4mcXVvdDsiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJD YWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9mb250PjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7bXNvLWJvcmRlci1sZWZ0LWFsdDpzb2xp ZCAjQ0NDQ0NDIC43NXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44 cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIy IiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Jm5ic3A7ICZu YnNwOyBtY3ImZ3Q7IEV2ZW4gYXNzdW1pbmc8YnI+DQombmJzcDsgJm5ic3A7IG1jciZndDsgYXJn dWVuZG8gdGhhdCB3ZSBoYXZlIGEgc2VjdXJlIG1lY2hhbmlzbSBmb3IgZGlzY292ZXJpbmcgdGhp cyBjYXNlLDxicj4NCiZuYnNwOyAmbmJzcDsgbWNyJmd0OyBpbiBwcmFjdGljZSB0aGUgUEMgZGVz a3RvcCBXRUIgQlJPV1NFUiBhbmQgSW9UIGRldmljZXMgc2VlbXMgdG8gaGF2ZSBxdWl0ZSBhIGhp Z2ggcmF0ZSBvZiBzZWN1cml0eTxicj4NCiZuYnNwOyAmbmJzcDsgbWNyJmd0OyBpc3N1ZXMsIGlu Y2x1ZGluZyBzcGVjaWZpY2FsbHkgRE5TIHNwb29maW5nLCBzaW5jZSB0aGUgYnJvd3NlcnMgZG8g bm90PGJyPg0KJm5ic3A7ICZuYnNwOyBtY3ImZ3Q7IGRvIEROU1NFQyBldmVuIHRob3VnaCB0aGV5 IGNvdWxkLjxvOnA+PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZm9u dD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIy IiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+VGhpcyBjbGFp bSBzZWVtcyB0byBoYXZlIHR3byBwYXJ0czo8bzpwPjwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0i Q2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvZm9udD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dCI+MS4gRG9pbmcgRE5TU0VDIHZhbGlkYXRpb24gd291bGQgc2lnbmlmaWNhbnRseSBkZWNyZWFz ZSB0aGUgaGlnaCByYXRlIG9mIEROUyBzcG9vZmluZy48bzpwPjwvbzpwPjwvc3Bhbj48L2ZvbnQ+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIg ZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjIuIFRoYXQgdGhl IGJyb3dzZXJzIGluIGZhY3QgY291bGQgZG8gRE5TU0VDIHZhbGlkYXRpb24uPG86cD48L286cD48 L3NwYW4+PC9mb250PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxm b250IHNpemU9IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkFzIGZhciBhcyBJIGtub3csIGl0J3MgYW4gb3BlbiBxdWVz dGlvbiB3aGV0aGVyIGVpdGhlciBvZiB0aGVzZSBpcyB0cnVlLiBEbyB5b3UgaGF2ZSBtZWFzdXJl bWVudHMgdGhhdCBzdXBwb3J0IGVpdGhlciAoMSkgdGhhdCBETlMgc3Bvb2ZpbmcgaGFwcGVucyBm cmVxdWVudGx5IGFuZCB3b3VsZCBiZSBwcmV2ZW50ZWQNCiBieSBETlMgW25vdGUgdGhhdCBkdWUg dG8gdGhlIGhpZ2ggZnJhY3Rpb24gb2YgY29ubmVjdGlvbnMgd2hpY2ggYXJlIHNlY3VyZWQgYnkg VExTLCB0aGUgaW1wYWN0IG9mIHN1Y2ggc3Bvb2Zpbmcgd291bGQgYmUgbW9kZXN0IGluIG1hbnkg Y2FzZXNdIG9yICgyKSB0aGF0IGJyb3dzZXJzIGNvdWxkIHNhZmVseSBkbyBETlNTRUMgdmFsaWRh dGlvbiB3aXRob3V0IGV4cGVyaWVuY2luZyB1bmFjY2VwdGFibGUgZmFsc2UgcG9zaXRpdmUgcmF0 ZXM/PG86cD48L286cD48L3NwYW4+PC9mb250PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2Fs aWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPi1Fa3I8bzpwPjwvbzpwPjwvc3Bh bj48L2ZvbnQ+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQg c2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0i Q2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvZm9udD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_4361a792716b4f9f8f2054e4fddcab34attcom_-- From nobody Tue Jul 21 15:54:43 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D4B43A0746 for ; Tue, 21 Jul 2020 15:54:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1SI7R7dFFCWK for ; Tue, 21 Jul 2020 15:54:39 -0700 (PDT) Received: from mail-lf1-x136.google.com (mail-lf1-x136.google.com [IPv6:2a00:1450:4864:20::136]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 803CB3A0744 for ; Tue, 21 Jul 2020 15:54:39 -0700 (PDT) Received: by mail-lf1-x136.google.com with SMTP id u25so245377lfm.1 for ; Tue, 21 Jul 2020 15:54:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=TlSKzAEyikaKjhccAALthfwqZyRvoAcTLENYSwyvWDw=; b=rxl4WdRum9yt+Ja6CKgpsHKoFsQZy7utxnBsjdE6kK1USIudwcQFhRSPRHTeZ7RgpT am8PgVW74tdGBIUgHwyumZ4vm7Ch4Xvi5isDQ+0YkusK4u5fYI0b5nfbj/+KI3EATxhW J41bM7u99iSIj7ATScV+ih/lYg9wbAFNO9qvPPxg7icUqK8NQe3zvkIXV+zfMQJ3e8wf 8bycHh9T4/Vt4JSNLf6AtsCOO8od0gNMUoWG/nnDuj8sVPgrTRJKLkET0XCHEr4VX9KC 3yZf8ckIUTWYmKnZckiat+atyrtqvRyr9+AMrDAA4P+z/aqQPBK2dqB2FtZvfGyGqOJu CXmg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=TlSKzAEyikaKjhccAALthfwqZyRvoAcTLENYSwyvWDw=; b=VF3F83MCObKnGTmzq9A4uWKjQCHkMT892FDgUQDyojqMuIvIbChk8fGZsptRynWN5y WJC8IEMB5YYKbvmfhUNC01n8/Kum4D66sok/BX/u/K1YkNTlXw3xH36L9ZSg1TKxjL0u ThRwzPauh3ED18dLQKuziYMSlKApYWLpXdUjsczknJz0ZNV7JKZLgmtiZ1KhWSP31ixp wxBWHcDLegAC74xxRJsZmyVyGYfstfHhAU3u2whB9mfiM9hDovBkWcnaX599vz0MeWrX TzMNwPBEsh1On65jQWYFMHCxvEGn3TUD4c849KzhOVzSbxgPU9GD50VRG4ViXs1c5FHx IBQg== X-Gm-Message-State: AOAM533NAx4WHLf+20AENpIhXp3Z0ZNUVI7GzYtj/QJtrPMMbWcDD9e5 t5shG6e4pzlE9kcT5OgkZItck42MeC9EyG3jVkyUlg== X-Google-Smtp-Source: ABdhPJzCoX/XLVejjcCXZLFAXh11kkMhW23C1dA5dHRAPkawmdteQ7IIPL+AEAIqNpJeGTmGR1gEJhe/l3C2Sy5lIec= X-Received: by 2002:a19:4910:: with SMTP id w16mr2314725lfa.161.1595372077780; Tue, 21 Jul 2020 15:54:37 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <7671.1595362961@localhost> <4361a792716b4f9f8f2054e4fddcab34@att.com> In-Reply-To: <4361a792716b4f9f8f2054e4fddcab34@att.com> From: Eric Rescorla Date: Tue, 21 Jul 2020 15:54:01 -0700 Message-ID: To: "STARK, BARBARA H" Cc: Michael Richardson , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000fb24e405aafb81c8" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 22:54:41 -0000 --000000000000fb24e405aafb81c8 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Jul 21, 2020 at 3:41 PM STARK, BARBARA H wrote: > *[BHS] While my ISP requires me to use the CE router they supply, I=E2=80= =99ve > never had an issue connecting that to my own router and then running my > home network from my router. The CE router from my particular ISP (YMMV) > even automatically passes on the public IPv4 address it acquires and a /6= 4 > IPv6 prefix to my router (so IPv4 just has the single NAT and IPv6 works > great). I have total ability to choose any router I want and configure th= at > router as much as that router vendor=E2=80=99s GUI allows (e.g., Netgear = GUIs don=E2=80=99t > let you configure the DNS server info it supplies to the LAN via DHCP, et= c. > =E2=80=93 it always supplies its own IP address; it does let the user say= whether > its proxy will use DNS info it gets via DHCP or configure static DNS info= ). > It seems to me that anyone who is concerned with what the ISP can do > vis-=C3=A0-vis their home network should be firewalling the ISP CE router= , > anyway. I=E2=80=99m at a loss to understand why people are considered =E2= =80=9Cforced=E2=80=9D to > use the ISP CE router as their home network router, just because they=E2= =80=99re > forced to use it to terminate the ISP WAN connection. I do understand tha= t > people do this for ease and convenience. But those same people are also > unlikely to care about changing away from the ISP resolvers. If you care > enough to want to configure the DNS used in your home network, you should > care enough to run your own router between your network and the ISP =E2= =80=9CWAN > termination device=E2=80=9D. --Barbara* > I'm not quite sure what you're responding to here, because I didn't say anything about forced, and the concern I'm raising here is not about the ISP doing things vis-a-vis the user's home network but *attackers* doing things by compromising the ISP-provided CE router. The context of this discussion as I understand it is this: A number of endpoints are using SPAU mechanisms for converting from Do53 to Do[TH]. This draft points out that this has the potential to cause the endpoint to connect directly to the ISP's resolver, bypassing the CPE and any functions that the CPE performs (presumably the ISP resolver could perform some but not all of these) and proposes that we develop some mechanism to avoid bypassing the CPE. At least from my perspective this particular discussion is not about the ISP versus the consumer but about whether it is advisable to design a mechanism to keep the CPE in the loop. -Ekr --000000000000fb24e405aafb81c8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 21, 2020 at 3:41 PM STARK, BARBARA H <bs7652@att.com> wrote:

[BHS] While my ISP requires me to use the CE router they supply, I=E2=80=99ve ne= ver had an issue connecting that to my own router and then running my home = network from my router. The CE router from my particular ISP (YMMV) even au= tomatically passes on the public IPv4 address it acquires and a /64 IPv6 prefix to my router (so IPv4 just has the singl= e NAT and IPv6 works great). I have total ability to choose any router I wa= nt and configure that router as much as that router vendor=E2=80=99s GUI al= lows (e.g., Netgear GUIs don= =E2=80=99t let you configure the DNS server info it supplies to the LAN via= DHCP, etc. =E2=80=93 it always supplies its own IP address; it does let th= e user say whether its proxy will use DNS info it gets via DHCP or configur= e static DNS info). It seems to me that anyone who is concerned with what the ISP c= an do vis-=C3=A0-vis their home network should be firewalling the ISP CE ro= uter, anyway. I=E2=80=99m at a loss to understand why people are considered= =E2=80=9Cforced=E2=80=9D to use the ISP CE router as their home network router, just because they=E2=80=99re forced to use it to terminate= the ISP WAN connection. I do understand that people do this for ease and c= onvenience. But those same people are also unlikely to care about changing = away from the ISP resolvers. If you care enough to want to configure the DNS used in your home network, you should = care enough to run your own router between your network and the ISP =E2=80= =9CWAN termination device=E2=80=9D. --Barbara

=C2=A0
I'm not quite sure what you're responding to here, because I didn= 't say anything about forced, and the concern I'm raising here is n= ot about the ISP doing things vis-a-vis the user's home network but *at= tackers* doing things by compromising the ISP-provided CE router.

The context of this discussion as I understand it is this:<= /div>
A number of endpoints are using SPAU mechanisms for converting fr= om Do53 to Do[TH]. This draft points out that this has the potential to cau= se the endpoint to connect directly to the ISP's resolver, bypassing th= e CPE and any functions that the CPE performs (presumably the ISP resolver = could perform some but not all of these) and proposes that we develop some = mechanism to avoid bypassing the CPE. At least from my perspective this par= ticular discussion is not about the ISP versus the consumer but about wheth= er it is advisable to design a mechanism to keep the CPE in the loop.

-Ekr

--000000000000fb24e405aafb81c8-- From nobody Tue Jul 21 16:11:22 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BAA933A07AF for ; Tue, 21 Jul 2020 16:11:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fhLHcvNfDtAH for ; Tue, 21 Jul 2020 16:11:19 -0700 (PDT) Received: from mail-oi1-x22e.google.com (mail-oi1-x22e.google.com [IPv6:2607:f8b0:4864:20::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 673A43A07AC for ; Tue, 21 Jul 2020 16:11:19 -0700 (PDT) Received: by mail-oi1-x22e.google.com with SMTP id e4so224924oib.1 for ; Tue, 21 Jul 2020 16:11:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=7CaEwPiGboc2jO7gMCuyT+pcj2+ux/95e6R2X/TXfMQ=; b=tsZ00bpQX+CwfF5O1hIeGIOWsaLJjlzWDQSLTwh+52YBd3oi9UgYjiHQ7F8g4K/sy2 9E9ycrmcUPxtuU9qdAD8U/wyLaYuuaBv9PrJR+5YryDW5zKBTYBiDeYi3qKv7HX0tWJ2 qazSXK+yH6bCfv+IEzEyjXyk5mVyywov2ZAd3Sy5mDg691qYEc4+FKElZpVm+DKqNoFY Z5DqpGC4ime+fADjdUv8K9MZ7b1TWpzt/lQqVKAJO3RRL4/wuGSVhEQLwEnH9S6750NB MqDgYcPLS9pAjKFK4vxKwPSdtfOm25ZlPWJ06cnDS5lBnY/edmGCGYs7VJL9lpcbOg5L V1hQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=7CaEwPiGboc2jO7gMCuyT+pcj2+ux/95e6R2X/TXfMQ=; b=ZCfOFVC84wuaMkQWfjswPG7G6aCh+rTvI3W/InVp/s974hVAbZaWQSpZrksos0nzUH Bg32GmvHb0VnMKAGLp7CZEqc4ksKlVu+xV01nX99UmzkY6MJ0zWSiJMj45zvT+jLSdj7 SWF990vJGLFg6lL39PH8vusGwn59o7D9ZFBroTpX/tIxNvM8SuBiDZ4NPZwCTqSpjwOE rU5qfb7AT5q31xRasjAHk7lpDuEelwz7Vqeb7LVtaawGsBmPoUMlnheLiVmYc87oCftE VB1l2m9FMnuyoozFrvIqkSItDujv+q8AtKPhtX8JLQ2ATeUAMU/FJiQrgBzXE/dWrspA POOQ== X-Gm-Message-State: AOAM533X5Qv0NkbjTPeU6zrJIw/CP452vhpzEbCNb9Kj6AjwWGB0KU4q PAwlmU2qA3xcv6/uy5a69uoFdA6x5m9k43mzYhvbN8V+ X-Google-Smtp-Source: ABdhPJxk4fAG2dyuVjLPJXuc6HyfBf1TdvRKlhim2wFxJvkXmQnWfzs2REeXXSu9SYfhIXx/zpAj8FbZHLVlXlniN5M= X-Received: by 2002:a05:6808:9aa:: with SMTP id e10mr4825035oig.74.1595373078527; Tue, 21 Jul 2020 16:11:18 -0700 (PDT) MIME-Version: 1.0 References: <2515140.uIgGUBp3BU@linux-9daj> <73db546a-0c47-fe18-0b9e-ec120e56bddd@cs.tcd.ie> <10658287.m1sr0i5iKv@linux-9daj> In-Reply-To: <10658287.m1sr0i5iKv@linux-9daj> From: Ted Hardie Date: Tue, 21 Jul 2020 16:10:51 -0700 Message-ID: To: Paul Vixie Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000a141ef05aafbbd10" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 23:11:21 -0000 --000000000000a141ef05aafbbd10 Content-Type: text/plain; charset="UTF-8" Howdy, On Tue, Jul 21, 2020 at 2:59 PM Paul Vixie wrote: > i'd like to get back to the topic ADD is for: how will we securely inform > connected devices of the local network's resources and policies (e.g., DNS > settings), and how will we ensure that private-access edge networks can > monitor and control policy compliance? > > -- > > That's a more expansive reading of our charter than I think is warranted. Here's a reminder of our deliverables: The Adaptive DNS Discovery (ADD) working group will work on the following deliverables: - Define a mechanism that allows clients to discover DNS resolvers that support encryption and that are available to the client either on the public Internet or on private or local networks. - Define a mechanism that allows communication of DNS resolver information to clients for use in selection decisions. This could be part of the mechanism used for discovery, above. - Develop an informational document that describes mechanisms for clients to detect specific network environments (such as captive portal and split horizon) and to use that information to inform their DNS configuration. I don't see any deliverables that cover "and how will we ensure that private-access edge networks can monitor and control policy compliance?" ADD will specify a mechanism to allow clients to discover DNS resolvers and a mechanism to communicate resolver information *for the clients to use in selection decisions*. I don't see an action item in this group for describing what the network does if it doesn't like the client's choices. Note that I am not arguing that the network operator cannot take action in this case. I am, however, pretty convinced that it needs to remain out of the discussions here for those discussions to actually deliver the bits the group was chartered for. Just my two cents, of course, Ted --000000000000a141ef05aafbbd10 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Howdy,

On Tue, Jul 21, 2020 at 2:59 PM Paul Vixie = <paul@redbarn.org> wrote:
=
=C2=A0i'd like to get back to the topic ADD is for: how will we se= curely inform connected devices of the local network's resources and po= licies (e.g., DNS settings), and how will we ensure that private-access edg= e networks can monitor and control policy compliance?

--


That's a= more expansive reading of our charter than I think is warranted.=C2=A0 Her= e's a reminder of our deliverables:

The Adaptive DNS Discovery (ADD) working group will work on the follow= ing
deliverables:

- Define a mechanism that allows clients to discover DNS resolvers
= that support encryption and that are available to the client
either on= the public Internet or on private or local networks.

- Define a mechanism that allows communication of DNS resolver
info= rmation to clients for use in selection decisions. This could be
part = of the mechanism used for discovery, above.

- Develop an informational document that describes mechanisms for
c= lients to detect specific network environments (such as captive portal
= and split horizon) and to use that information to inform their DNS
co= nfiguration.

I don't see any deliverables that cover &quo= t;and how will we ensure that private-access edge networks can monitor and = control policy compliance?"=C2=A0 =C2=A0 ADD will specify a mechanism = to allow clients to discover DNS resolvers and a mechanism to communicate r= esolver information *for the clients to use in selection decisions*.=C2=A0 = I don't see an action item in this group for describing what the networ= k does if it doesn't like the client's choices.=C2=A0=C2=A0

Note that I am not arguing that the network operator cann= ot take action in this case. I am, however, pretty convinced that it needs = to remain out of the discussions here for those discussions to actually del= iver the bits the group was chartered for.

Just my= two cents, of course,

Ted

=C2=A0
--000000000000a141ef05aafbbd10-- From nobody Tue Jul 21 16:27:35 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76EEF3A07FF for ; Tue, 21 Jul 2020 16:27:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I69efkXys0UJ for ; Tue, 21 Jul 2020 16:27:32 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 842483A0801 for ; Tue, 21 Jul 2020 16:27:32 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id E6C0DC3F16 for ; Tue, 21 Jul 2020 23:27:29 +0000 (UTC) From: Paul Vixie To: add@ietf.org Date: Tue, 21 Jul 2020 23:27:29 +0000 Message-ID: <21876935.53dnTbfrlv@linux-9daj> Organization: none In-Reply-To: References: <10658287.m1sr0i5iKv@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 23:27:33 -0000 On Tuesday, 21 July 2020 23:10:51 UTC Ted Hardie wrote: > ... > > Just my two cents, of course, appreciated. if we provide a secure method of DNS server resource discovery to replace the known-unauthenticatable DHCP protocol previously used for this, we will create two new problems. perhaps that's ok, but it's avoidable. new problem #1 is apps, devices, or users who don't speak this protocol or which don't agree to use the resources authentically offered on the local network. for privately-owned edge networks this may look like an attack, and they may take steps to defend against it. new problem #2 is apps, devices, or users who face the defense noted in #1 and treat it ambiguously, as an "outage" of some kind, because there won't be a way for the local network to unambiguously signal "that's not allowed here." so regardless of what the recently updated charter does not say, the job of authentically offering local DNS resources such as recursives or authorities will be incomplete if there's not a well defined (unambiguous) error path. but i apologize for jumping ahead of the charter that's actually written down. -- Paul From nobody Tue Jul 21 16:59:36 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0150A3A0842 for ; Tue, 21 Jul 2020 16:59:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qa9jkkqESC8l for ; Tue, 21 Jul 2020 16:59:32 -0700 (PDT) Received: from mail-oi1-x235.google.com (mail-oi1-x235.google.com [IPv6:2607:f8b0:4864:20::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B7C423A0840 for ; Tue, 21 Jul 2020 16:59:32 -0700 (PDT) Received: by mail-oi1-x235.google.com with SMTP id r8so295170oij.5 for ; Tue, 21 Jul 2020 16:59:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Sb9CTXQcTMMQ3BVQEvbbS3tmEt1Yii7y00tni6qtejY=; b=XwedUS7UjOqEaMX9NgzB3dQhPVh1TiU9FQgZdQmNOeHipv1uUvgjoWfOJPwlW7DPJP sWIjLIlhY4/Q75Rgv2IMUDEIbUkWk5B1KjS0iEOuyZ/a6rx+vsWhPMTKiVpiNQl8u4lS iZEyvNPMAqHej4ax208aLAkIjNncZHiKuEpzacLhEc9g2gOo4b8TDA3BKiZu9bHDYa9/ ZY6UosnhBENCtLjetl863B90oRodlrCRt6Spin550E6KjoT0oyz6PT3hs6MJNZXfXAPv AGm51E7qsW5pc+kmJxsxdfIXXc7HupHmrhyFN4U7xPZYf318W1zza62Mrz03pIXE3Nh4 cTNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Sb9CTXQcTMMQ3BVQEvbbS3tmEt1Yii7y00tni6qtejY=; b=C3NoqfmgO+hIzSW+K17Bh2hYUNrt5YQdXOtDK/7FheMiT2yluXcuvoDz7otMCRcjft vyiJ45Sq0hQQ4ZnBrFarbYYinW7BeTujWVJpjZ/xOhb3wOV951iOGSkBYyOu/mgXefZ8 KXzQx+/ep1szS4a629u4+4mbQ/mxh/2BetflsLP9SFoZzGqGXxdbmcIkaNFRuPTFBlZ9 jifOiPWWiFr8HA5FLMU5nVGKhgHad7ubI1BLW48Ki7sy7OVBDnlr//RStN2NA38fc9Qe s3nnVYAUvhvy9f8aoYv3INJVJFVeEIuwCOAwTfPL/rKtXf5Cr+zKGLRzdb1yHM/FDa8b CmMg== X-Gm-Message-State: AOAM533iz8mtIvcKz7eaguU5DDhauvt1qRpH2RS8yAOb6fjQHCtvSG34 JiK/IMw4VK7CnZ9EjR8BBudm0+SpTNUnUMq/tOS1+SFY X-Google-Smtp-Source: ABdhPJyCeAidfqKFS/WVcsHPlmvpZ3p/2kpIhFWPnzazWdqTH0+N3ZtXsIrHqb7q1tjAjDTcmdJ8UzildISMSYiDStA= X-Received: by 2002:aca:ea08:: with SMTP id i8mr5328874oih.167.1595375972030; Tue, 21 Jul 2020 16:59:32 -0700 (PDT) MIME-Version: 1.0 References: <10658287.m1sr0i5iKv@linux-9daj> <21876935.53dnTbfrlv@linux-9daj> In-Reply-To: <21876935.53dnTbfrlv@linux-9daj> From: Ted Hardie Date: Tue, 21 Jul 2020 16:59:05 -0700 Message-ID: To: Paul Vixie Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000189c6605aafc6a3f" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2020 23:59:34 -0000 --000000000000189c6605aafc6a3f Content-Type: text/plain; charset="UTF-8" On Tue, Jul 21, 2020 at 4:27 PM Paul Vixie wrote: > On Tuesday, 21 July 2020 23:10:51 UTC Ted Hardie wrote: > The job of authentically offering local DNS resources such as recursives or > authorities will be incomplete if there's not a well defined (unambiguous) > error path. > I think some elements of that can fit within this: Develop an informational document that describes mechanisms for clients to detect specific network environments (such as captive portal and split horizon) and to use that information to inform their DNS configuration. If the detected network environment has a set of resources that has no intersection with the client's set of acceptable choices, then advice in this document on how to surface that error would be useful. That won't eliminate all calls to the helpdesk, but it can improve the situation without changing what this has been set as deliverables. regards, Ted --000000000000189c6605aafc6a3f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 21, 2020 at 4:27 PM Paul Vixi= e <paul@redbarn.org> wrote:
On Tuesday, 21 July 2020 23:10:51 UTC Ted Hardie wrote:

The job of authentically offering local DNS resources such as recursives= or authorities=C2=A0 will be incomplete if there's not a well defined = (unambiguous) error path.

I think som= e elements of that can fit within this:

Develop an informational document that describes mechanism= s for
clients to detect specific network environments (such as captive= portal
and split horizon) and to use that information to inform their= DNS
configuration.

If the detected network environment has a set of r= esources that has no intersection with the client's set of acceptable c= hoices, then advice in this document on how to surface that error would be = useful.=C2=A0=C2=A0

That won't eliminate all calls to the helpdesk, but it ca= n improve the situation without changing what this has been set as delivera= bles.

= regards,

Ted
--000000000000189c6605aafc6a3f-- From nobody Tue Jul 21 18:00:41 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F1D6F3A0544 for ; Tue, 21 Jul 2020 18:00:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com header.b=WDSC8wI4; dkim=pass (2048-bit key) header.d=comcast.com header.b=HK7IPMKq; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=comcastcorp.onmicrosoft.com header.b=A55ONZ5m Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iO_xD5mN8h6D for ; Tue, 21 Jul 2020 18:00:38 -0700 (PDT) Received: from mx0b-00143702.pphosted.com (mx0b-00143702.pphosted.com [148.163.141.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 38A053A053E for ; Tue, 21 Jul 2020 18:00:38 -0700 (PDT) Received: from pps.filterd (m0184891.ppops.net [127.0.0.1]) by mx0b-00143702.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06M0sHaF001939 for ; Tue, 21 Jul 2020 21:00:37 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.com; h=from : to : cc : subject : date : message-id : content-type : content-id : content-transfer-encoding : mime-version; s=20190412; bh=Biu5cEVL0Fly6rrhCMk77w8n+UZLFKU44YXyGyHkWFA=; b=WDSC8wI4QzguLHse7z+FxfPywOLGEvgaRoBGtst4prpgZqsA5HDJv++zRwPxU7GeSVN8 Gfd2YEwhdufrt1o9NhDjCsHp2hkg4Cs+caemhgLEKZphtDcMJxNo7BmrF7h0Bd2HhFK+ 0IPCa5HcFs7wopvBvrvpX4LdocJgXzHeUxBj8LCCA511IlFiazjQzaSpnoHCxll0Fazw j6TZ0g377zqC/H1qwhuQcxRcqzXyv54D/36rlBaPrF3t/vXq+ohqftw1C7s2eVi5roa1 hw83wGMsAiiornu15sS+f1W0QyaEt6SVSJreA1XvW28s96OR8aD0MRBQTH37gC9+msWx Sw== Received: from pacdcmhout02.cable.comcast.com (pacdcmhout02.cable.comcast.com [68.87.96.15]) by mx0b-00143702.pphosted.com with ESMTP id 32bwug3a2p-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 21 Jul 2020 21:00:37 -0400 DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1595379635; x=2459293235; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Biu5cEVL0Fly6rrhCMk77w8n+UZLFKU44YXyGyHkWFA=; b=HK7IPMKqkMkfheJmozdKqkIxPxqaRP0qZvMCiMPmPjyrztx9wQoUnJ78VYiCEfT9 tebu+hXNYsvF6mb0zQ5gL9xsDDhDAlu874CxZ+l8fAUebc8/IoKvnr1KA47Y5IjQ lvU/eagX4+v0mhqBuBDf7LRhObgyjIeMV6OrPbyEEo/yRE6sIARNo8DfcMv1Tf8f gvz+OPodLX1yCmk0sBeL+Lu48LbwqKVu4YymcNNwIjJc8ACcv23wiW/SyB8iYrOh dLdQcQTpzm3InWQ3qqaTm+nHrYBKbDQqlo8X/bEsnFC2I1VAa0K31NWva0l6PNDF ZhtIbvuGuoApbYowFQ2aOQ==; X-AuditID: 4457600f-f27ff70000005543-0e-5f178fb399f1 Received: from PACDCEX33.cable.comcast.com (cas-umc02.ndceast.pa.bo.comcast.net [68.87.34.28]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by pacdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id C5.16.21827.3BF871F5; Tue, 21 Jul 2020 21:00:35 -0400 (EDT) Received: from PACDCEX09.cable.comcast.com (24.40.1.132) by PACDCEX33.cable.comcast.com (24.40.2.132) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 21 Jul 2020 21:00:34 -0400 Received: from PACDCEXEDGE01.cable.comcast.com (76.96.78.71) by PACDCEX09.cable.comcast.com (24.40.1.132) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 21 Jul 2020 21:00:34 -0400 Received: from NAM11-DM6-obe.outbound.protection.outlook.com (104.47.57.171) by webmail.comcast.com (76.96.78.71) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 21 Jul 2020 21:00:33 -0400 Received: from BYAPR11MB3111.namprd11.prod.outlook.com (2603:10b6:a03:90::25) by BY5PR11MB4435.namprd11.prod.outlook.com (2603:10b6:a03:1ce::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.17; Wed, 22 Jul 2020 01:00:32 +0000 Received: from BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0]) by BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0%4]) with mapi id 15.20.3195.025; Wed, 22 Jul 2020 01:00:32 +0000 From: "Deen, Glenn" To: Stephane Bortzmeyer CC: ADD Mailing list Thread-Topic: [Add] New Threats ID for ADD Thread-Index: AQHWX8N/NLb4MeGW3kSyuO/DtAqdLA== Date: Wed, 22 Jul 2020 01:00:32 +0000 Message-ID: <8BEC224C-8F8C-4226-BEE5-A3383608E15D@comcast.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: nic.fr; dkim=none (message not signed) header.d=none;nic.fr; dmarc=none action=none header.from=comcast.com; x-originating-ip: [2605:e000:141b:121:9442:a71d:7b0a:7e04] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: c7020611-1bcf-4680-76fd-08d82ddaa28b x-ms-traffictypediagnostic: BY5PR11MB4435: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: lP6cDJUWAB+c5ZW8yH6X1akymEC5NqYC/E8tSTlsefaxKSpIOluoeLMnj549o9PqM2jqzzSrRsXI/+xy57iyu/di14CpcUpjZp7rADNOCKS8kWPVCnqjVN9qLQcn+VtNzZrKPg3fEhe7rEcRybgGzL3jjHASDFIzAJsbg1Lh0p3bEIEzdp5m3b2mYFfMlZ5zWBPVExVu+t55HkFMXJAH9wQBwX8qb1edlfvB7EvLcwlaYWAQSovsb5gAmscinldk/sRtDKwQGGSpAN2zo9HGJzoYkBeKO3rg3k7YraXFtlVREhbwY49+m8zp+h2ZEAsyjBdk/Z2zsCe0/KmoGzUPhkJ+99tTag8P2aIS2Gb1Vnv9nCAbFJenSizLaChU508vQukoT1mdtlJ6t+673DMIbg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3111.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(136003)(346002)(39860400002)(396003)(376002)(6506007)(8676002)(71200400001)(186003)(6486002)(66946007)(66476007)(64756008)(76116006)(6916009)(478600001)(966005)(66556008)(66446008)(66574015)(83380400001)(2616005)(4326008)(5660300002)(2906002)(36756003)(316002)(8936002)(86362001)(6512007)(33656002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: pilw2rcVhogunZNJn6r5CQ4p/8mW0NeHxT1TTocrT+af0TnPyd3MiNT4rYTIgVrcamHKYZs16ExREWuiDwTcGxPP9R0yI43Nk6vaszngmSD9HeQEDZMXj4ze0Cx5TkuiVqPRdpG3BTu/vaJkyuXRV1oCUxIAtiwKvQczvm947E9dLeLeEQBBr9gelInswBEonUFtI7ItikydnF2QeTHrmumSxHPdMJf4YvmKsC9xpx3vahcK7xY7Qmk0vbjJr8KPWi4r6aQPbEGzySFnB5MtWkmSOhm8e16/hIo98zudBsV3aAhJwYmux+bM3RUjZlpzmxmr+dH7RfEzbCIFKX/vvPcAXi9dD4q93v+pFWSDQKky/AmYi4TCFGUhwFXRebKPgx33Y98sfcIGucJ5Wmg2uXkhhKX3AUxVGbXszHjVUb0sdRNnVUN1d8pLQsaQqokYzybjhX4bIVkTPkbxiQKVUgaU6T2VdqCKLn6rE01Hp1envoYqRHA6CKrt3UQFi2NSyXYsfKf+dYH2RaCO2VvNDtlk3wXn+JXlmgd7uyhPuI98Qt7+7o3WPHqVli1l+BHE x-ms-exchange-transport-forked: True arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ddQMZ+em3qxEd7LwSOVuKeHfXR45CvOtJ4v+NE4zrbcuNufchHo203CVy9ApqSI+Tz3uok2wOzZXnfOJ+FnnCUMr5msboh22jtrlVaUiy2HQD8867C3+yUXiql3VGIxg33X8o8JNfKZ9OM6bo2/SEWicQTdgg/2MNsUDxpPvTvKQgQxBurT/wcJVA1AzAFYZaOPJkvTanKafaYsoLaAGtR8yAtlrCWApXyL47CHfE2tbZx4frkdHk5j4x/9cvMX7oARSLh+4SQQ9a256DYytJmKUU/lg3cW+lSR067UkTrtff4ZKeakvS4FWYZ5REOyY3WJGqybuc4Wcxd4AC/FRpw== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=obtK8G0A/4kyA6rKrvs9F1XS4OhQPNft5eJGNI4/YL0=; b=ceBs+HkrTWszR+E6ZcEDdB/M8D/rnRIpmK9Cxz2pyenZRffKFFWOhzAuvHdxi6fUeuppibSvxBWErbd23yoMCe+QAVihUK4FU6esmPLro7d3Lu3hjBU32JxJ00vT8DHJXpFmQRT/XCd7D8yDV4q+ObXSryBJXsCnlbAr+6LYfwZ1Jx2uUlytbHwS+rKaHlONJa3BGOsJqfB0qJivCRytB6J6DKLG/stD8udGVcRwcW/1yOF0JPUXdwZIJmte29PXYeXSRVueEZFkww3TIyGE0LAPXqBrtaHe3NnmDTY8evS1JaYdH1rNEnT2QwFcKSx3Ww33RJcZ24PgJPH8kdBf+Q== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=comcast.com; dmarc=pass action=none header.from=comcast.com; dkim=pass header.d=comcast.com; arc=none dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastcorp.onmicrosoft.com; s=selector1-comcastcorp-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=obtK8G0A/4kyA6rKrvs9F1XS4OhQPNft5eJGNI4/YL0=; b=A55ONZ5mibbpA4cdAbQIutcx+BXctTgWjIhjCzd3CsjJ+H19h93M9sczSZ8mtlv9VFxVXIMrTM6cH+WGm05h9ybr9mLBj806I5Bt/fVreTokYHfT3kCfn7rnYqfT3ca5umg2lfdHkHCP4YW771weKFo/8/QWm4VUfUp74+SLO44= x-ms-exchange-crosstenant-authas: Internal x-ms-exchange-crosstenant-authsource: BYAPR11MB3111.namprd11.prod.outlook.com x-ms-exchange-crosstenant-network-message-id: c7020611-1bcf-4680-76fd-08d82ddaa28b x-ms-exchange-crosstenant-originalarrivaltime: 22 Jul 2020 01:00:32.4163 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 906aefe9-76a7-4f65-b82d-5ec20775d5aa x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: iWNw6X6W/dytRCC0CqL+s/W7pDAZszOuvwh9a4tbrMM5Szs7dLUKhTaX93AYZnMYrvlzAhNn3KKigBiCa00dNjc+QCSX53V5UwcdORfqToI= x-ms-exchange-transport-crosstenantheadersstamped: BY5PR11MB4435 x-originatororg: comcast.com Content-Type: text/plain; charset="utf-8" Content-ID: <52F4AD3116A8314EB76CA855108C403C@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA02SfyzUYRzH93y/3ztfl+NxftxnUsu1Wp1z0nQuK9myufTzn1ZrE2f3HUbY nSxWS0V0GKYiEbbrByViHZOZLuRHzdiorBROwizLbs40cvfU1n+v9/t5P8/nxx6WFmXzvNj4 pFROm6ROlPAFTNgZibdfc6E4ak9PJ1auDzznK4tqZlEopTIYVihV8VojdYo6Jzig4RLj0zit f0i0IC7XkEunGH0u6Qf76UzUu02PHFnAgdC60k/pkYAV4S4KWnKNDBFtCKzmGw5EjCAoraxA RPQg6Kzv4Nvui7CBglW9H+FJBOOVe/WIZflYBsbmQzbbHftCyad8ZGMab4cs8xfaxm54N1Q3 zVMkI4XlGiufsBzWzD8dbMzgHbCc+cGeF+IQeDldb/cR9oTl/mcUeVMMY+YqioyDwdA+SBP2 gNmpNZ6NPbA/jDcs2SdD+CaC2bY7PFufgIOhxLSL5LfAcFUeInwcLAOrfBKRwvf1GGInQPXv UR7hndAyOvi37FaoK5hgCHvDt48tfFspwK9o0M/NMUTM09D6yIKIMDPQnT3KL0KB5f8NUb5R kN5YTEObP7FVYB1+SxH2gdt5Ew7l9l24Qt89M1ONeHVok0IpVwbJ9yvkAfuakP1zRLu0ou5S lQlhFkmchL0Z4igRT52mS79gQsDSEnehDG1YQo06PYPTJkdpLyZyOhPazDISsbBw5Md5EY5V p3IJHJfCaf+dUqyjVya65bz0el5Sy4X3sKdn+l78csk52YWvXFs8cr+Ep7nrGdy0EC5bmFlk L8dmnSiI1YcreNbQp/nKqYe+Ql1ce6TT0bECneZd4VAHazwYEfHVcTLaInWDnMfv31xXNAY1 psbkHHadtnw+e0wzVE+VdVZEPrAkhz1BZc464/rV4lqZhNHFqQOktFan/gMWb9tuGAMAAA== X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-21_15:2020-07-21, 2020-07-21 signatures=0 X-Proofpoint-Spam-Reason: safe Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 01:00:40 -0000 DQoNCu+7v09uIDcvMjEvMjAsIDI6NTMgQU0sICJTdGVwaGFuZSBCb3J0em1leWVyIiA8Ym9ydHpt ZXllckBuaWMuZnI+IHdyb3RlOg0KDQogICAgT24gVHVlLCBKdWwgMjEsIDIwMjAgYXQgMTI6NDA6 MjdBTSArMDAwMCwNCiAgICAgRGVlbiwgR2xlbm4gPEdsZW5uX0RlZW5AY29tY2FzdC5jb20+IHdy b3RlDQogICAgIGEgbWVzc2FnZSBvZiAxMDIgbGluZXMgd2hpY2ggc2FpZDoNCg0KICAgID4gSSB3 YW50ZWQgdG8gYnJpbmcgdG8geW91ciBhdHRlbnRpb24gYSBzaG9ydCwgdmVyeSBzaG9ydCwgZHJh ZnQgdGhhdA0KICAgID4gSSB3cm90ZSB1cCBiYXNlZCBvbiBhbiBlbWFpbCB0aHJlYWQgb24gdGhl IFdHIGxpc3QuICBJdCBjYXB0dXJlcyBhDQogICAgPiBiYXNpYyBmcmFtZXdvcmsgb2YgR3JlZW4t WWVsbG93LVJlZCB0aHJlYXQgYW5kIHRydXN0IHJlbGF0aW9uc2hpcHMNCiAgICA+IHRoZSB1c2Vy IG1heSBoYXZlIHdpdGggdGhlaXIgbmV0d29yay4gIFRoZSBob3BlIGlzIHRoYXQgdGhpcyBjYW4g YmUNCiAgICA+IGEgYmFzaXMgZm9yIGZvY3VzaW5nIGRpc2N1c3Npb24gb2YgdGhyZWF0cyBhbmQg d2hhdCBtaXRpZ2F0aW9ucw0KICAgID4gbWF5YmUgbmVlZGVkIGluIGRpZmZlcmVudCBzaXR1YXRp b25zLg0KICAgID4NCiAgICA+IGh0dHBzOi8vdXJsZGVmZW5zZS5jb20vdjMvX19odHRwczovL2Rh dGF0cmFja2VyLmlldGYub3JnL2RvYy9odG1sL2RyYWZ0LWRlZW4tYWRkLXRocmVhdHMtMDBfXzsh IUNRbDNtY0hYMkEhU21QMHozcnhYYXVCaUpDWWFoZmxHVXdENzZ4RDdwZjI4dXg5MlZVeEx6WjRq bGg3VnNmSDdIelJZUjY1NWdKblR3JA0KDQogICAgSSBzZWUgbm8gdXNlIGZvciB0aGlzIGRvY3Vt ZW50LiBJdCBzZWVtcyB0byBjb25zaWRlciBvbmx5IHRoZQ0KICAgIHBvdGVudGlhbCByaXNrcyBi eSBvdXRzaWRlcnMsIGFuZCBub3QgdGhlIHJpc2tzIGJ5IHRoZSBvcGVyYXRvcnMsDQogICAgd2hp Y2ggYXJlIGFzIGltcG9ydGFudC4gRm9yIGluc3RhbmNlLCBhc3Nlc3NpbmcgdGhhdCB0aGUgIlVz ZXIncyBJU1ANCiAgICBuZXR3b3JrIiBpcyBzYWZlIG9yIG5vdCBpcyBub3QganVzdCBhIG1hdHRl ciBvZiB3ZXRoZXIgaXQgaXMgcHJvcGVybHkNCiAgICBzZWN1cmVkOiBpdCBpcyBhbHNvIGEgbWF0 dGVyIG9mIHdoYXQgdGhleSBkZWNpZGUgdG8gZG8gKGFuIElTUA0KICAgIHJlc29sdmVyIHdoaWNo IGNlbnNvcnMgU2NpLUh1YiBpcyBub3Qgc2FmZSBmb3IgbWUsIGV2ZW4gaWYgaXQgaXMNCiAgICBz ZWN1cmVkIGFuZCBwcm90ZWN0ZWQgZnJvbSBvdXRzaWRlIGF0dGFja2VycykuDQoNCiAgICBUaGlz IGRyYWZ0IGlzIG5vdCBhIHByb3BlciB0aHJlYXQgbW9kZWwgZm9yIHRoZSBJbnRlcm5ldC4NCg0K VGhpcyBkcmFmdCBpcyBlbnRpcmVseSBmcm9tIHRoZSBwZXJzcGVjdGl2ZSBvZiB0aGUgdXNlci4g ICAgV2hpbGUgaXQgb2ZmZXJzIGV4YW1wbGVzIG9mIHdoYXQgYSB1c2VyIG1heSB2aWV3IGFzIGlu IHRoZSBHcmVlbiBvciBZZWxsb3cgb3IgUmVkLCB0aGUgcGxhY2VtZW50IGlzIG5vdCBwcm9zY3Jp cHRpdmUgYW5kIGNhbiBjaGFuZ2UgZm9yIGRpZmZlcmVudCB1c2VyJ3MgcGVyc3BlY3RpdmVzLg0K DQoNCiAgICBBbHNvLCBob3cgd2FzIGRlY2lkZWQgdGhlIGxpc3Qgb2YgZXhhbXBsZXM/ICJVc2Vy J3Mgb3duIGhvbWUgbmV0d29yayINCiAgICBpcyBtYXJrZWQgYXMgZ3JlZW4gYnV0IGl0IGlzIHR5 cGljYWxseSBxdWl0ZSB1bnNhZmUsIGJvdGggYmVjYXVzZQ0KICAgIHR5cGljYWwgdXNlcnMgZG8g bm90IGhhdmUgdGhlIGtub3dsZWRnZSwgaW5jbGluYXRpb24gYW5kL29yIHRpbWUgdG8NCiAgICBz ZWN1cmUgaXQsIGFuZCBhbHNvIGJlY2F1c2UgdGhlIGRhbmdlciBjYW4gYmUgaW5zaWRlIChzZWUg dGhpcw0KICAgIGV4Y2VsbGVudCBwYXBlciBmb3IgbWFueSBleGFtcGxlcw0KICAgIDxodHRwczov L3VybGRlZmVuc2UuY29tL3YzL19faHR0cHM6Ly93d3cuc2NobmVpZXIuY29tL2FjYWRlbWljL3Bh cGVyZmlsZXMvUHJpdmFjeV9UaHJlYXRzX2luX0ludGltYXRlX1JlbGF0aW9uc2hpcHMucGRmX187 ISFDUWwzbWNIWDJBIVNtUDB6M3J4WGF1QmlKQ1lhaGZsR1V3RDc2eEQ3cGYyOHV4OTJWVXhMelo0 amxoN1ZzZkg3SHpSWVI0dXJnbjY5QSQgPikNCg0KQWdhaW4sIGl0J3MgYSBub24tcHJvc2NyaXB0 aXZlIGxpc3Qgb2YgZXhhbXBsZXMgYW5kIHdpbGwgY2hhbmdlIGRlcGVuZGluZyBvbiB0aGUgdXNl cidzIHZpZXdzLiAgU29tZSBtYXkgbm90IHRydXN0IHRoZSBJU1AgQ1BFLCBjdXJyZW50IG9wZXJh dGlvbmFsIHByYWN0aWNlcyBzaG93IHRoYXQgbW9zdCB3aWxsLiAgU29tZSBtYXkgcmVhZCBCcnVj ZSdzIHBhcGVyIGFuZCBub3QgdHJ1c3QgdGhlaXIgc2lnbmlmaWNhbnQgb3RoZXIgdG8gb24gdGhl IHNhbWUgbmV0d29yayBzZWdtZW50LCBjZXJ0YWlubHkgbWFueSBvZiB1c2Ugc2VnbWVudCBvdXIg a2lkcyBhbmQgY2hvb3NlIGRpZmZlcmVudCBETlMgc2V0dGluZ3MgZm9yIHRoZWlyIGRldmljZXMu ICAgVGhlIGJvdHRvbSBsaW5lIGlzIHRoYXQgaXQncyB0aGUgdXNlcidzIGNob2ljZSBhbmQgdGhl IHVzZXIncyB2aWV3cyB0aGF0IGRldGVybWluZSB0aGUgY2hvaWNlLiAgIFRoZXkgY2FuIGNob29z ZSB0byBkbyBzcGVjaWFsIG1pdGlnYXRpb25zIHRvIG1hbmFnZSBwZXJjZWl2ZWQgdGhyZWF0cywg YW5kIHRoZXkgZXF1YWxseSBjYW4gY2hvb3NlIHRvIGRlbGVnYXRlIGl0IHRvIGEgdGhpcmQgcGFy dHkuICBNYW55IHRha2Ugd2hhdGV2ZXIgc2V0dGluZ3MgdGhlaXIgSVNQIG9mZmVycywgYW5kIG5v dyB3aXRoIGJyb3dzZXJzIHByb3ZpZGluZyBhdXRvLXVwZ3JhZGUgdG8gRG9IIHByb3ZpZGVycyBt YW55IGFyZSBjaG9vc2luZyB0byBkZWxlZ2F0ZSB0byBhbmQgdHJ1c3QgdGhlaXIgYnJvd3NlciBt YWtlci4NCg0KQWxzbywgeWVzIHRoZXJlIGlzIGEgdHlwbyBpbiB0aGUgdGl0bGUgb2YgZHJhZnQu ICBJIHdyb3RlIGl0IHVzaW5nIGFub3RoZXIgYXMgYSB0ZW1wbGF0ZSBhbmQgSSBtaXNzZWQgZGVs ZXRpbmcgdGhlIHdvcmsgImhlcmUiIGZyb20gdGhlIHRpdGxlLiAgIEkgd2lsbCBmaXggaXQgd2hl biBkYXRhdHJhY2tlciBvcGVucyBhZ2Fpbi4NCg0KUmVnYXJkcw0KR2xlbm4NCg0K From nobody Tue Jul 21 18:17:55 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1657F3A07B7 for ; Tue, 21 Jul 2020 18:17:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com header.b=yfBmFj+k; dkim=pass (2048-bit key) header.d=comcast.com header.b=VIfEuq5G; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=comcastcorp.onmicrosoft.com header.b=NCoZiMwU Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T47zyeWRpsHT for ; Tue, 21 Jul 2020 18:17:52 -0700 (PDT) Received: from mx0b-00143702.pphosted.com (mx0b-00143702.pphosted.com [148.163.141.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3290F3A07B3 for ; Tue, 21 Jul 2020 18:17:51 -0700 (PDT) Received: from pps.filterd (m0156896.ppops.net [127.0.0.1]) by mx0b-00143702.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06M1EVqS024442 for ; Tue, 21 Jul 2020 21:17:51 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=20190412; bh=LZN+j5KZIQXZIB0GYiDheiU1EPaO6MY+wkzLfDtOvnY=; b=yfBmFj+kXoitVRFFC2VeDC2Qm6qN33fGM2zfR74VRH/Ezvvb7KSJyvS3vck0M2YnOh0X aJN6IEogIhHZA5XD5I60pX2qNF2xz5gZyRaB1sk/SVim4mqQ2QaesoADLEvGcQtjNPQA PyZw1S7pQfVr3Klj66CKYxLKC2XTiU2kUh1qxrZWY3Li7mDMMqx/buUJF+YFh2Xo+VTV qcV3ITy7cu/avJbmeh+6aVzu51NDdr/Ef4E5+f2Gm2DjKJ1i9U/MD/Y88N5Y7jxq1CuY OLehm54V0/dsuyR5klkHWeNf9GEzSb9LU7hbKAHX5PN66HgIBFjZgSDMz5a4+YYOb0LM CA== Received: from pacdcmhout02.cable.comcast.com (pacdcmhout02.cable.comcast.com [68.87.96.15]) by mx0b-00143702.pphosted.com with ESMTP id 32bv393mgm-34 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 21 Jul 2020 21:17:51 -0400 DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1595380670; x=2459294270; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=LZN+j5KZIQXZIB0GYiDheiU1EPaO6MY+wkzLfDtOvnY=; b=VIfEuq5G2+Ft5migPlInePVoVG6jN+rme7bA5B5BwC/tFlZaO2nEoyWwUGTfs0df QoRbvmqJCJBuxajOz9OBL0yy1YK/R31PwRiQM29E6bS39u4MlxUugSicKBTevA1N A8guizYM/1FqvyYXmI0/MmxPmiU0EQf/GDGEXGoLxrTxUl7x9T6J1BwfwpbIRhgG ebjP/f22hHjvaKBXYab0ziMcGHp7uRiE6qnlfop+hYkcl6udjEzruCVwMYzfqAKK 4SsWWMuQMZLqQ8/23icd/4Brciis/N3W4SNemXHQesr1EFR7Qm+YFibmqT/ptW2E ZkR9P0qs+1HXURwYhk1mzQ==; X-AuditID: 4457600f-f27ff70000005543-3b-5f1793be9564 Received: from PACDCEX35.cable.comcast.com (cas-umc02.ndceast.pa.bo.comcast.net [68.87.34.28]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by pacdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id D3.D6.21827.EB3971F5; Tue, 21 Jul 2020 21:17:50 -0400 (EDT) Received: from PACDCEX44.cable.comcast.com (24.40.2.143) by PACDCEX35.cable.comcast.com (24.40.2.134) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 21 Jul 2020 21:17:49 -0400 Received: from PACDCEXEDGE01.cable.comcast.com (76.96.78.71) by PACDCEX44.cable.comcast.com (24.40.2.143) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 21 Jul 2020 21:17:49 -0400 Received: from NAM12-MW2-obe.outbound.protection.outlook.com (104.47.66.45) by webmail.comcast.com (76.96.78.71) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 21 Jul 2020 21:17:49 -0400 Received: from BYAPR11MB3111.namprd11.prod.outlook.com (2603:10b6:a03:90::25) by BY5PR11MB4324.namprd11.prod.outlook.com (2603:10b6:a03:1bd::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.20; Wed, 22 Jul 2020 01:17:46 +0000 Received: from BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0]) by BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0%4]) with mapi id 15.20.3195.025; Wed, 22 Jul 2020 01:17:46 +0000 From: "Deen, Glenn" To: Michael Richardson , ADD Mailing list CC: "Deen, Glenn" Thread-Topic: [EXTERNAL] Re: [Add] New Threats ID for ADD Thread-Index: AQHWXveH7JO1nsTxqkKNHNNtJCTm0KkSLS+AgAArWIA= Date: Wed, 22 Jul 2020 01:17:46 +0000 Message-ID: <60A4F318-2536-4BC7-BF6B-F43148F4FAAF@comcast.com> References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> <32491.1595346157@localhost> In-Reply-To: <32491.1595346157@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: sandelman.ca; dkim=none (message not signed) header.d=none;sandelman.ca; dmarc=none action=none header.from=comcast.com; x-originating-ip: [2605:e000:141b:121:9442:a71d:7b0a:7e04] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 297c113f-3bc6-4061-7f5f-08d82ddd0abf x-ms-traffictypediagnostic: BY5PR11MB4324: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 8o6LVzcfVL45EI8CWCY59Po5sFrcaGxiB29u8LJvRFM567QDIA3wCniikSp9Cso9PAvQwOS/uDODElUpiDE8ElTVo+JNI14ReLukTWG76678KeBnE+cUb081gfkUShBDgb3AAubNflMxAOF6mlBmxt4b4I1QjR4Ota/fqbYVcx1/OJUhoG9/BjnFl+AY3ljCw+YyfruacTn6w5snkDpZqAaaLL6hav9320hQHuLs2y4QBH2HHV6fZdnWsg2Lu4+iAYKKeK9reD3sMcz1hdanavU4vpZb3QbvXrqmWGvrJ66CmEpsCwSLaxf6GbKOih8NgtAXjvQKdv7QVjH6fLuc8A== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3111.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(396003)(376002)(136003)(366004)(346002)(39860400002)(36756003)(71200400001)(83380400001)(2616005)(107886003)(186003)(4326008)(5660300002)(478600001)(6506007)(8936002)(66574015)(86362001)(316002)(33656002)(6512007)(64756008)(8676002)(76116006)(110136005)(66556008)(66476007)(66446008)(66946007)(6486002)(2906002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: gHHc9BAGtdSeRZqcYdxbXqhvB4uPm45AvMS4b1mbQf536Kn8tKewco7FEbcPHcX5hJNhKqFV3A3Qfba0HQyYIn2pDsUd2ELek4XbCjtY+bmMbITduLJfswpHltsH40vxG2V+LUaoJ3XYC2TpbqE0TLvNZfGb7KVB9ld86Yu/nrc4XYS+Wv+TQ0AxSnwszrhXNnpUHAbjadB1YmDRKnd4wzO8Ub0yw4GP12u2gDMxmuuB8/PlCvQX6EPnUHb5Fc+a6bGELjnbsSOfdnVVMyRXbQbBc/rJATUmtsXc9z2EFxtuFFJOrQh2Rb3Xpn8704Vz/h07l4sonvkU4D4DQQjPp/+HWDEkcQfbQBPgM60LdDOa69i4KuXFfGiRUXYKXsM93sk2ppN3K+M9vng4bCBl5WHrpiLTXraFVLGv5rb4i1cY5uWjW548BT8msqTTvuUeggFGaJZogPDhA5aFO1243mzlAw6aldqa881TCpf/41Bpin8P50PzEMCcfpztFrD6QQ9chviLrd/2H0602Qc/U4GNEY22BAH7pWUEhvzgvrBWXbvtGykQcM0+cGLezbn7 arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=OXBdkmZiKwBnPGfv9QVgUeadzx1DqOBhl+zUFyknmql0SoG99i6YRhxAqfpzNzPj9k9xQv5Oj9z33iTsjDqpuNReT4un9Y2t78sEjqoVltrnaQQj/Xf7zW8WTwve1W8UK/1GxMBxBpH1CyLVQNFQXoChhSvKyPEEIZb66hTjiQnDrGBsTe0VHhs7Boq0UjAC0rvUOnh4GXzvH9IVxtSyN2L2gjUpNPTnnmKJMiig+xjJlwRtLdiSEv1UWIMTwZ9cVgOWs2RRHehIit6UQj23tISk1pFIx/2GFs1d0OSwA1ovSxEmUFKOky87JBH4ROPJxrZIZqyTgk0I2HSppH9zZw== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=k0paDVQh+k43PYi8r/pJr7h//3NT0u95YhO1MgRxeG8=; b=ocl+yYC2wFdirgZt5d8/SRZnj/Gy0wQk7zHT2HvpPSa8EO9hSIFetFwhdt7QDqLw4LbBjdDl209mSTn4A9cdRMKdvqCh25PXbLPWa9F/a8PdPLlUQ9LIEpXOh6twbPiZ93vCSN+XIZrcSMk8YLtXr1+ojfmxhRIKfQFKudDdVJAWYDHRu8tfjOyqFnAcsI5Gj404TgdlxP9/PHuoC44x/5X5FOas+xZm3jie/03dL7MQVYFN9f/UELyRD7ZbsUH1/Srm3IISzda6XuSoZct6FK6Wgur7R8ULu2Z5k1X6reNddleLb+qsLa75dfD/Hn3SlTcYdU7YbBTBNVq2q76VHA== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=comcast.com; dmarc=pass action=none header.from=comcast.com; dkim=pass header.d=comcast.com; arc=none dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastcorp.onmicrosoft.com; s=selector1-comcastcorp-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=k0paDVQh+k43PYi8r/pJr7h//3NT0u95YhO1MgRxeG8=; b=NCoZiMwUAwG4CsQEwSJFR05fCkMiZqiorbeNO9E0QpmoTFnWSaANmQaouwMdTnwaKih6+/SCqF1Ayu7Sfjs8iHnUiKqGgHwR/m/US5vB8fSQgUV7SviXrVJUVsLvPAuhsvolbOIFBo7mK4APQrJbl4g/dDlJBO2LJ3uHTNeE0f0= x-ms-exchange-crosstenant-authas: Internal x-ms-exchange-crosstenant-authsource: BYAPR11MB3111.namprd11.prod.outlook.com x-ms-exchange-crosstenant-network-message-id: 297c113f-3bc6-4061-7f5f-08d82ddd0abf x-ms-exchange-crosstenant-originalarrivaltime: 22 Jul 2020 01:17:46.1709 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 906aefe9-76a7-4f65-b82d-5ec20775d5aa x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: vai+ZJJsvK5x59AiISRk8hi8s2NtUrKOUKnlMkPgQWyOuLCkUWwfnSfPFbLH0h7ry8eW2mKeLeckxz0XN68wHeFPRueRaGhWBfJRWvX9dB0= x-ms-exchange-transport-crosstenantheadersstamped: BY5PR11MB4324 x-originatororg: comcast.com Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpileLIzCtJLcpLzFFi42JxCVeS0d03WTze4MVhSYv/p9exWfQc6md3 YPJYsuQnk0fLnD3MAUxRXDYpqTmZZalF+nYJXBl/95xmL+gzrPg2eSd7A+Mb/S5GTg4JAROJ JwtXMncxcnEICRxhkrh57DMThLOLUeLHgUOMEM5VRon5cyeyQThHGSUO3IfpWcIksadjJQuE 84hR4vrrHaxdjBwcbAI6Ets224MsEREIlFg//wsTiM0soCXRsbeDBcQWFrCQ2LRzGitEjaXE tL8tLBC2lcS8dweZQWwWAVWJ7Wv+gvXyCthJtC15xAZiCwnESsw/dRGsnlNAU2Jf7y2wOYwC YhLfT62B2iUucevJfCaIRwUkluw5zwxhi0q8fPwPrF5UQF/i3vrPYPczCkxilFgx8z8TyP0S QEdMPqQBUS8rcWl+NyNE2Fei45UrRFhL4njPDFaIsIrEv0OVEOFsif9XdjNC2GoSN950QG2V k1jV+5AFwpaReHBjO9sERrNZSA6dBTSJGeiZ9bv0IUwPiU33tCEqFCWmdD9knwUOBkGJkzOf sCxgZF3FyG1moWdhrmdppmdouokRnDIS+HcwHp3ucYhRgINRiYf3RJV4vBBrYllxZe4hRgkO ZiURXh1GoBBvSmJlVWpRfnxRaU5q8SFGaQ4WJXHe/qsv4oQE0hNLUrNTUwtSi2CyTBycUg2M LflxE2TOhGqdUDFMMe3R4/0iUP73Qw2PpV37MosDtx8+Lb7WXnHg0wKXKH3OL6s/CV2+vn6C /6SJFqEJSybPEBXfPr281jHol0mY7SPGFLcn3snFxb3Jp2XieHn39k+72V4S5hrnW3fM9ku+ vLa2sLH8jz9+FQ+WXeMN/NUq19cVf+jvGmslluKMREMt5qLiRACwFaRHFQMAAA== X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-22_01:2020-07-21, 2020-07-21 signatures=0 X-Proofpoint-Spam-Reason: safe Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 01:17:54 -0000 DQoNCu+7v09uIDcvMjEvMjAsIDg6NDMgQU0sICJNaWNoYWVsIFJpY2hhcmRzb24iIDxtY3IraWV0 ZkBzYW5kZWxtYW4uY2E+IHdyb3RlOg0KDQoNCiAgICBEZWVuLCBHbGVubiA8R2xlbm5fRGVlbkBj b21jYXN0LmNvbT4gd3JvdGU6DQogICAgICAgID4gSSB3YW50ZWQgdG8gYnJpbmcgdG8geW91ciBh dHRlbnRpb24gYSBzaG9ydCwgdmVyeSBzaG9ydCwgZHJhZnQgdGhhdCBJDQogICAgICAgID4gd3Jv dGUgdXAgYmFzZWQgb24gYW4gZW1haWwgdGhyZWFkIG9uIHRoZSBXRyBsaXN0LiAgSXQgY2FwdHVy ZXMgYSBiYXNpYw0KICAgICAgICA+IGZyYW1ld29yayBvZiBHcmVlbi1ZZWxsb3ctUmVkIHRocmVh dCBhbmQgdHJ1c3QgcmVsYXRpb25zaGlwcyB0aGUgdXNlcg0KICAgICAgICA+IG1heSBoYXZlIHdp dGggdGhlaXIgbmV0d29yay4gICBUaGUgaG9wZSBpcyB0aGF0IHRoaXMgY2FuIGJlIGEgYmFzaXMg Zm9yDQogICAgICAgID4gZm9jdXNpbmcgZGlzY3Vzc2lvbiBvZiB0aHJlYXRzIGFuZCB3aGF0IG1p dGlnYXRpb25zIG1heWJlIG5lZWRlZCBpbg0KICAgICAgICA+IGRpZmZlcmVudCBzaXR1YXRpb25z Lg0KDQogICAgSSBmZWVsIHRoYXQgdGhlIHRpdGxlOg0KICAgICAgICBfQWRhcHRpdmUgRE5TIERp c2NvdmVyeSBUaHJlYXRzIEhlcmVfDQoNCiAgICBpcyB0cnlpbmcgdG8gZG8gc29tZXRoaW5nIGN1 dGUgYnkgaGF2aW5nICJIZXJlIiBhdCB0aGUgZW5kLCBidXQgSSBkb24ndCBrbm93DQogICAgd2hh dCBpdCBpcy4gIE1heWJlIGl0J3MganVzdCBhIHR5cG8/DQoNCg0KSnVzdCBhIHR5cG8gLSB3aWxs IGJlIGZpeGVkIGluIHRoZSBuZXh0IHJldmlzaW9uLg0KDQoNCiAgICBGaXJzdCwgSSBkaXNhZ3Jl ZSB3aXRoIHlvdXIgWWVsbG93IGxpc3QsIGEgbnVtYmVyIG9mIHRoaW5ncyBJJ2QgcHV0IGludG8g dGhlDQogICAgUmVkIHpvbmUuDQogICAgSSB0aGluayB0aGF0IEFpcnBvcnQgYW5kIENhZmUgbmV0 d29ya3MgbWF5IGJlIGV2ZW4gbW9yZSBob3N0aWxlIHRoYW4gSG9zdGlsZSBSZWdpbWVzLg0KICAg IEJ1dCwgSSB0aGluayB0aGF0IHVsdGltYXRlbHksIGl0J3MgdXAgdG8gdGhlIGVuZCB1c2VyIGFu ZCB0aGVpciBPUyB0byBmaWd1cmUNCiAgICB0aGlzIG91dC4NCg0KSSAxMDAlIGFncmVlIHRoYXQg aXQncyB0aGUgdXNlcidzIGNob2ljZS4gVGhlIGxpc3QgaXMgYSBub24tcHJvc2NyaXB0aXZlIGV4 YW1wbGUgYW5kIHdoZXJlIHRoaW5ncyBmYWxsIHdpbGwgY2hhbmdlIGRlcGVuZGluZyBvbiB0aGUg dXNlcidzIHZpZXdzLiAgICBJJ2xsIHRyeSB0byBtYWtlIHRoYXQgcG9pbnQgaW4gYSBmdXR1cmUg ZHJhZnQuDQoNCg0KICAgIChXaW5kb3dzIGFscmVhZHkgYXNrcyB0aGlzIHF1ZXN0aW9uIGZvciBu ZXcgbmV0d29ya3MsIHNvIHRoYXQncyBiYXNpY2FsbHkNCiAgICBkb25lLiBXZSBqdXN0IG5lZWQg dG8gaGF2ZSBleHRlbmRlZC1QT1NJWCBBUElzIHRoYXQgd291bGQgYWxsb3cgYnJvd3NlcnMgdG8N CiAgICBkZXRlcm1pbmUgdGhpcykNCg0KICAgIEkgd291bGQgcmV3b3JrIHRoZXNlIGNhdGVnb3Jp ZXMgYSBiaXQuDQogICAgVGhlIGtleSB0aGluZyBpcyB3aGV0aGVyIG9yIG5vdCB0aGUgZW5kIHVz ZXIgaXMgYXdhcmUgb2YgdGhlIHJpc2suDQogICAgVGhhdCBpcywga25vd2xlZGdlIHRoYXQgb25l IGlzIG9uIGEgSG9zdGlsZSBSZWdpbWUgbmV0d29yayBtYXkgY2F1c2UgdGhlIHVzZXINCiAgICB0 byBiZSBtb3JlIGNhdXRpb3VzIGluIHRoZWlyIHVzZSB0aGFuIGJlaW5nIG9uIGEgIlllbGxvdyIg SG90ZWwgbmV0d29yayB3aGljaA0KICAgIGlzIGluIGZhY3QgY29tcHJvbWlzZWQuDQogICAgT3Ig d29yc2UsIG9uIGEgaG9tZSBuZXR3b3JrIHdoaWNoIGlzIGNvbXBsZXRlbHkgY29tcHJvbWlzZWQs IGFuZCB0aGUgdXNlciBoYXMNCiAgICBiZWVuIHRyYWluZWQgdG8gY2xpY2sgdGhyb3VnaCBhbGwg dGhlIGh0dHBzIHdhcm5pbmdzIG9uIDE5Mi4xNjguMS54IGFkZHJlc3Nlcy4NCg0KSSBhZ3JlZSB0 aGF0IGl0J3MgZW50aXJlbHkgZGVwZW5kZW50IG9uIHRoZSB1c2VyIGtub3dpbmcgdGhlIHJpc2sg b3Igbm90LiAgIFRoaXMgaXNuJ3QgdG9vIGZhciBvZmYgbm9uLW5ldHdvcmsgcmlzayBldmFsdWF0 aW9uIGFuZCByaXNrIHRha2luZy4gICAgU29tZSA1MCB5ciBvbGRzIGRlY2lkZSB0byByaWRlIHRo ZSBza2F0ZSBib2FyZCBkb3duIHRoZSBzbG9wZWQgc3RyZWV0IGFuZCBzdWNjZWVkIGluIG1ha2lu ZyBpdCBzdWNjZXNzZnVsbHkuICAgT3RoZXIgZGVjaWNlIHRvIHJpZGUgYW5kIGZhaWwsIHNvbWV0 aW1lcyBvbiBhIHlvdXR1YmUgdmlkZW8gc28gd2UgYWxsIGNhbiBzaGFyZSB0aGUgcGFpbiBhbmQg am95LiAgV2hpbGUgb3RoZXJzIG1heSBldmFsdWF0ZSB0aGUgcmlzayBhbmQgZGVjaWRlIG5vdCB0 byBldmVuIGdpdmUgaXQgYSB0cnkuDQoNCiAgICBTdGVwaGFuZSBCb3J0bWFuJ3MgY3JpdGljaXNt IGlzIHZhbGlkLCBpZiB0aGlzIHdlcmUgYSBjYXRlZ29yaXphdGlvbiBvZiB0aGUNCiAgICBzZWN1 cml0eSBvZiB0aGUgKm5ldHdvcmtzKiwgYnV0IGl0J3Mgbm90IGludGVuZGVkLiBJdCdzIGludGVu ZGVkLCB0aGluaywgYXMNCiAgICBmZWVkYmFjayB0byB0aGUgdXNlciBhcyB0byAqdGhlaXIqIHJp c2sgb2YgcHJpdmFjeSBkaXNjbG9zdXJlIHRocm91Z2ggRE5TDQogICAgc25vb3BpbmcuDQoNClll cy4gIEJvdGggdGhlIHJpc2sgb2YgcHJpdmFjeSBidXQgYWxzbyB0aGUgcmlzayBvZiBiZWluZyBz ZW50IHRvIGEgRE5TIHJlc29sdmVyIHRoYXQgZG9lc24ndCBiZWhhdmUgbGlrZSB0aGV5IGV4cGVj dC4gIFRoYXQgZXhwZWN0YXRpb24gY291bGQgaW5jbHVkZSB0aGUgYmVoYXZpb3IgdGhhdCB0aGUg cmVzb2x2ZXIgd29uJ3Qgc2VuZCB0aGVtIHRvIG1hbHdhcmUgc2l0ZXMsIG9yIG90aGVyIHR5cGVz IG9mICJwcm90ZWN0IG1lIGZyb20gYmFkIHN0dWZmIHBsZWFzZSIgZmlsdGVyaW5nLiAgIENvbnZl cnNlbHksIHRoZSBleHBlY3RhdGlvbiBtYXkgYmUgdGhhdCB0aGUgYmVoYXZpb3IgaXMgdGhhdCB0 aGUgcG9pbnRlZCB0byBETlMgc2VydmVyIGFwcGxpZXMgbm8gZmlsdGVycyBhbmQganVzdCByZXR1 cm5zIGV2ZXJ5dGhpbmcuICAgICBVbHRpbWF0ZWx5IGl0IGNvbWVzIGRvd24gdG8gZ2l2aW5nIHRo ZSB1c2VyIHdoYXQgdGhleSB3YW50IGFuZCB3aGF0IHRoZXkgZXhwZWN0Lg0KDQogICAgUmljaGFy ZCBCYXJuZXMnIGFudGljaXBhdGVkIG15IHN1Z2dlc3Rpb24gd2l0aCB0aGUgcXVlc3Rpb246IGhv dyBkbyB3ZSB0ZWxsPw0KICAgIFdlbGwsIHdlIGhhdmUgUkZDMzExOC4NCiAgICBTZXJ2ZXJzIGNh biBzaWduIHRoZWlyIG9mZmVycy4gIFRoZXkgY2FuIGRvIHRoaXMgd2l0aCByYXcgcHVibGljIGtl eXMuICAgT3IgU0VORCBmb3IgUkFzLg0KICAgIEZvciBXSUZJLCBpdCBjYW4gYWxzbyBhbGwgYmUg dGllZCBpbnRvIHRoZSBMMiBrZXlzLg0KDQogICAgSXQgd291bGQgYmUgd29ydGggZXhwYW5kaW5n IHRoaXMgSUQgYmV0dGVyIHRvIGV4cGxhaW4gdGhlc2UgdGhpbmdzLg0KDQpUaGlzIElEIGlzIGlu dGVuZGVkIHRvIGJlIHVzZWQgaW4gb3RoZXIgZHJhZnRzIHRoYXQgY291bGQgdGFsayBhYm91dCBz dWNoIHRoaW5ncyBpbiB0aGUgYWN0dWFsIGNvbnRleHQgb2YgdGhlIHBhcnRpY3VsYXIgZHJhZnQu ICAgSSB3cm90ZSBpdCBiZWNhdXNlIHRoZXJlIHdhcyBhIGxvdCBvZiBkaWZmZXJlbnQgd2hhdC1p ZiBzY2VuYXJpb3MgYmVpbmcgdGhyb3duIGFyb3VuZCBhbmQgcGVvcGxlIG9uIG9jY2FzaW9uIHdo ZXJlIHRhbGtpbmcgYWNyb3NzIG9uZSBhbm90aGVyIGFuZCBmb2N1c2luZyBvbiBkaWZmZXJlbnQg c29ydHMgb2Ygc2NlbmFyaW9zLiAgIEEgY2xhc3NpYyB2ZXJzaW9uIG9mIHRoaXMgaXMgc29tZW9u ZSB0YWxraW5nIGFib3V0IHRoZSBtaXRpZ2F0aW9ucyBhcHByb3ByaWF0ZSBpbiBhIHJlZCBlbnZp cm9ubWVudCB3aGVyZSB0aGUgb3RoZXIgcGVyc29uIGlzIHRhbGtpbmcgYWJvdXQgd2hhdCBpcyBh cHByb3ByaWF0ZSBpbiBhIGdyZWVuIGVudmlyb25tZW50LiAgICAgIEl0J3Mgbm90IHVubGlrZSB3 aGF0IG9uZSBjb21tb25seSBzZWVzIG9uICB0b3VyaXNtIGZvcnVtcyB3aGVyZSBhbiBhbGFybWlz dCBwZXJzb24gcG9zdHMgdGhhdCBldmVyeW9uZSBtdXN0IGhhdmUgdGhlIGxhdGVzdCByaXAtc3Rv cCBhbmQgcGljayBwb2NrZXQgcHJvb2YgYmFja3BhY2tzIHdoZW4gcmlkaW5nIHRoZSBNZXRybyBp biBQYXJpcy4gVGhlIHJlYWwgYW5zd2VyIGRlcGVuZHMgb24gaWYgdGhlIHBlcnNvbiByaWRpbmcg dGhlIE1ldHJvIHBlcmNlaXZlcyB0aGUgTWV0cm8gYXMgYSBHcmVlbiwgWWVsbG93LCBvciBSZWQg dGhyZWF0IGxldmVsIGJlY2F1c2UgaXQncyBhIHN1YmplY3RpdmUgZXZhbHVhdGlvbiBieSB0aGUg cmlkZXIgb2YgaG93IHRoZXkgcGVyY2VpdmUgdGhlIE1ldHJvLiAgIE1hbnkgbWFueSBwZW9wbGUg cmlkZSBpdCBldmVyeSBkYXkgdmlld2luZyBpdCBhcyBhIEdyZWVuIGxldmVsIGFuZCBoYXZlIG5v IHByb2JsZW1zLCB3aGlsZSBvdGhlcnMgbWF5IHZpZXcgaXQgYXMgWWVsbG93IGFuZCBvdGhlcnMg dmlldyBpdCBhcyBSZWQuDQoNCg0KDQotZ2xlbm4NCg0K From nobody Tue Jul 21 19:24:40 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 138993A08A9 for ; Tue, 21 Jul 2020 19:24:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com header.b=PTZPlyNp; dkim=pass (2048-bit key) header.d=comcast.com header.b=IJA57avE; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=comcastcorp.onmicrosoft.com header.b=g3vWzOgq Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2maVioVWTplp for ; Tue, 21 Jul 2020 19:24:36 -0700 (PDT) Received: from mx0b-00143702.pphosted.com (mx0b-00143702.pphosted.com [148.163.141.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF29C3A08A7 for ; Tue, 21 Jul 2020 19:24:36 -0700 (PDT) Received: from pps.filterd (m0156894.ppops.net [127.0.0.1]) by mx0b-00143702.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06M2DSD6027690 for ; Tue, 21 Jul 2020 22:24:36 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.com; h=from : to : subject : date : message-id : content-type : content-id : content-transfer-encoding : mime-version; s=20190412; bh=0yEx/JESX85XJyp3bUXnfcklJYVj8tcwKucM3Vm7rto=; b=PTZPlyNpmW2XGIVswmR6jiEMa+i/em/bxT52UQ9/ELa6dDLJzKEMuF3+EjzaVFhFnvky tW0o608INIgHFYkifOhfLv5Vsx4LzDkPt9OsSGN+pU7N+Y+KlCOU5eGfbk2hZDTGHdrv UIN8cazH/c9eIOS0xuFW9T/uNfaXKjtgeainmJrnE31bbG264eouEHzryitJrbkAZXh2 P3oOy8fnbSzavIntr4xh+zaJEe9O2lgg+ov/qZfNIljrkSUNcSfYU5PVU2GLRMlmAjQe 9SZv7/VKLL+2vsQ5XTHDcXi42fvj0Hp1vp9W8bf4Fs+xXciwMYrvHWEevi+Be6O+t8Hn tQ== Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) by mx0b-00143702.pphosted.com with ESMTP id 32e5hbtcfc-14 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 21 Jul 2020 22:24:35 -0400 DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1595384675; x=2459298275; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=0yEx/JESX85XJyp3bUXnfcklJYVj8tcwKucM3Vm7rto=; b=IJA57avEDsBXRH6oBcH84XBGM4NaH4upWm65pBMOrYKGWlO7u4XM3nL5vYCTIYF4 k1lc2uP+2CifPS3vzAEedyBtZaeURiaOtYy7y3RhVDfDrWuqXkHqkRrKKg9Kny9B A8BAdULbcJtIt4qdAV6dRaIoGpdvyTklhLY9CNNtFJ12Fv9f15OcH7mBgq1jbCiK gGaUgkxBiCFYMrS3F1hMDZn4zvcHWeN3JjVymOXf7+jr+t4VzD1SbApzgvw1FkrO yJiUuQbud448qPmwpEd6HTovg1FXKVxaKfwkDzQWuUm4qBl9wJ1Ycm2iijS9Z7Sp Wxb698thSkOp/MDIkRm00A==; X-AuditID: 60729ed4-a49ff70000003048-6f-5f17a363a83b Received: from COPDCEX09.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id 38.2D.12360.363A71F5; Tue, 21 Jul 2020 20:24:35 -0600 (MDT) Received: from copdcex56.cable.comcast.com (147.191.125.155) by COPDCEX09.cable.comcast.com (147.191.124.140) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 21 Jul 2020 20:24:34 -0600 Received: from COPDCEXEDGE01.cable.comcast.com (96.114.158.213) by copdcex56.cable.comcast.com (147.191.125.155) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 21 Jul 2020 22:24:34 -0400 Received: from NAM04-CO1-obe.outbound.protection.outlook.com (104.47.45.55) by webmail.comcast.com (96.114.158.213) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 21 Jul 2020 22:24:34 -0400 Received: from BYAPR11MB3111.namprd11.prod.outlook.com (2603:10b6:a03:90::25) by BY5PR11MB3974.namprd11.prod.outlook.com (2603:10b6:a03:183::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.21; Wed, 22 Jul 2020 02:24:32 +0000 Received: from BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0]) by BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0%4]) with mapi id 15.20.3195.025; Wed, 22 Jul 2020 02:24:32 +0000 From: "Deen, Glenn" To: ADD Mailing list Thread-Topic: [Add] IETF108 ADD Agenda Thread-Index: AQHWX887L9GbbSuZo0+l2fOWo3M1jQ== Date: Wed, 22 Jul 2020 02:24:32 +0000 Message-ID: <07DECCE9-24F8-47A0-A220-4721B7BEFB9A@nbcuni.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=comcast.com; x-originating-ip: [2605:e000:141b:121:9442:a71d:7b0a:7e04] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 5ff9560c-aad6-4b8c-57d3-08d82de65e65 x-ms-traffictypediagnostic: BY5PR11MB3974: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:5797; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 0bJBPJ2eTJJUULtv6loQGK6iXzQ/QSotu/lpHawa+SgFNhNvSTcNAwlQAySADewAUkv05oPIsExGeJOsA9KAsvrPPLDdZzL4G4sgW7xWsvqbeJipUDX8jFavZ/7WNjPlzLVa773+RRMoeilDm5KojLX4lslfXL44RLlEzzB/mlEHshVPi67p2/DGQPZid026rfQU8TKw2hCKNZf5hi9nVmxohBunarJepbFraQLKknq7c8MTPVK7LaMcD+exfCO04eyEdOKrxImhOpnDTvrWjP8Z0vCFiINe4t3szSP1kqEWkfQ+JKw5VzySBvcS7Act01yYToLm4X47jGEqH/F5Tg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3111.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(136003)(39850400004)(396003)(366004)(346002)(376002)(186003)(478600001)(8936002)(71200400001)(558084003)(316002)(6506007)(33656002)(8676002)(36756003)(6512007)(83380400001)(9686003)(5660300002)(6486002)(66476007)(66556008)(64756008)(66446008)(2906002)(86362001)(76116006)(66946007)(6916009); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: WYixW+l0RN2gAZH5S7MyNzgAOx5HxDmEk/+TTJq0J5eBGlRv8Dy3Fvl9ORKqGtRFmfB0mB0EG2gWaiJHI5d4YhDNp6khiUxNY9OvqjP4WWGM00f7w+SxYQB7CR5mCh0ISArq0bYj1Kq+2cktISJRXshb4ukDDhxtDDndze8xA5qFmNQRmvYejwj4mJk/Gtz5vLO0tJm+NJuUuuq50L2HLT4vMomGy2U1gH5F1Ul8sXBX4Bemr9iiqD5iHCXvNA/Pvw8uT1l/VHaPAsVK64AG5BKZf8C2qGQIcmP26gpWvOfDkxo1g4A52AsCwJDjcqO0oWREPyPHgRcQmo3kyyuqXcg0gzqeRQoUfBpOWL/AeG+X2OywsrjpmNXGJW0bOGGNtVxhwWGH0+VXOh5jtkukqQNMmdi+ZUcLCSG1hOrQjLNagf3fDwYTQ3/DACWviurpzprYTcMKJ9cSWUdHvgwrYAMfTbHTNh7fYvulYsnZRuDRdQC/42xySsVHnCZhzzwwLJVrQnaK9Doq7WapAAimzB4sf/DRlu6JlH1ARciHrlY38B5IL6jNfjwNPcNg7ubc x-ms-exchange-transport-forked: True arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=F2QdOdcJiA2GFVYBvTt5KFAla90epvPxG7+HJSYj6sC2xRxR2187349G0ZGdRkIjzFf1LqxO883zTy6nmthFSXQUEllW45bs66zSyDJBYIroQoSMuDoXyAJHaZUyEvB+5RS4Dq+SI2osQHvV7s6Syj176Ltz1AwK3N8wk16mkgIshogEuPgALmFdl7BfHWS2+pDEW8QrcER2OPwvKv4OtVIuNVcDhfFHkG/v/HAo8rLwZQxqzmngcCUIr24P0o9Dchj8OfRW+ra/dK0i7l0z59fVJTM8Wilw/s6DIr3XDmCBc60qubfZQqC2zhZQLijRLv6CllrejM6TZpSZfMvSXA== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8BFxvsvvWYMPeh6mOyoG6eQqW6MetIQ8toFwwgAbf0U=; b=Xw6iHayyc/NeVTOgYs0m9/OcAxKlMHyTCMjnCRpmYJm9h0n/PmNVj0RjTXxyICMuloz82czcZhCoA4BIwOW9JaY8hpZ58020c14zWFiYM49NmGQWq+bQCeF/xMd30VEHbedVWg2PGr9+yf7oxqmxVLs09L6O+HA1Ofhp6jQCLkQHe90xhXQYnbAl0jnh6KKG/xswr1NzzbJCv79+Omu3h6DKQQleCfKl8nwP2skxHLn0S41eFhFx6kcjKf6nmlwDj1eiM3wjqPDvpbGZp08ozmCNBbc0L/odOXuvXo5NV4mjKQ6TdoILUrPTBxijJuBu51YfuEQw656ivxnxJDrqxw== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=comcast.com; dmarc=pass action=none header.from=comcast.com; dkim=pass header.d=comcast.com; arc=none dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastcorp.onmicrosoft.com; s=selector1-comcastcorp-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8BFxvsvvWYMPeh6mOyoG6eQqW6MetIQ8toFwwgAbf0U=; b=g3vWzOgqmGIViQwTlVAdL6bkgiGaYYC74CqEhZPQbgehIlp+DvlLWUrOz9CzzeDMN6MmxPcR7N/n9URfVCkiEwm1kPT+WsgGHv3PEMW3R4Did66a1FG+E3Zb4u+528qMzpQWH+tdihx8514U36j9UeUvMoLZ2nEjDJmA4xi3jFY= x-ms-exchange-crosstenant-authas: Internal x-ms-exchange-crosstenant-authsource: BYAPR11MB3111.namprd11.prod.outlook.com x-ms-exchange-crosstenant-network-message-id: 5ff9560c-aad6-4b8c-57d3-08d82de65e65 x-ms-exchange-crosstenant-originalarrivaltime: 22 Jul 2020 02:24:32.0162 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 906aefe9-76a7-4f65-b82d-5ec20775d5aa x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: fFkQLRRLgTnM85NoCf4a/leNUASeBFxPKl/vr5wgROBy+BHwLEIh5Nt6eAT5xyTKOuxkxdv3SWxmrA4EjmKGUcgrFIY9s379oem1yrMV6Ew= x-ms-exchange-transport-crosstenantheadersstamped: BY5PR11MB3974 x-originatororg: comcast.com Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrLIsWRmVeSWpSXmKPExsWSUDRnsm7yYvF4g7lzlSz+n17H5sDosWTJ T6YAxigum5TUnMyy1CJ9uwSujHk3prMV3GOsWP+9nbGB8QZjFyMnh4SAicSEWbtZuhi5OIQE DjNJtK/+yg7hHGKU+DFnFyuEc4dR4nj/S2YI5wSjxILXX1lB+oUEljBJfNjkC5F4xCixYs4j oMEcHGwCOhLbNtuD1IgIKEssvbudCcQWFlCVmLbvDRNEXE3i3YKrjBC2nsT8g+dYQFpZgGom /HUHCfMK2Eo8ef6QBcRmFBCT+H5qDVgrs4C4xK0n85kgXhCQWLLnPDOELSrx8vE/sNNEBfQl 7q3/DPYao0AXo8SrrgNgp0kIWElMPqQBUS8rcWl+NzQofCUeXr4PNVNLYt+mJqiZ2RJT1v5k gbDVJN4vuwBVIyexqvchVFxG4sGN7WwguyQEfjNJbJjbwQ7h3GaW6J+zGarjCYvEjKsREEeo SPw7VDmB0XgWkn9mAWWYBTQl1u/Shwh7SFyYtoENwlaUmNL9kH0WOFgEJU7OfMKygJF1FSOf pZmeoaGJnqGphZ6RodEmRnCimHdlB+Pl6R6HGAU4GJV4eNdPFo8XYk0sK67MBcYrB7OSCK8O I1CINyWxsiq1KD++qDQntfgQozQHi5I4b2zs2TghgfTEktTs1NSC1CKYLBMHp1QDo6LZNneV fr9sh6UNK6e3qJ2YpWPl53blE0vIfd6lAkKrb9mI1lretW4zO1/UferAllPfVwju5im0OHHR xP4H/039xtilJ0vdJP1e3b7Cz6XLHaG5OMoy/dO+A50HH0U9q1vsdWZW3G6WlU/4Z37UZ/mk 3zytkENVcP/+o2qMTr3vGxgn7zZUVWIpzkg01GIuKk4EANqL2ZkQAwAA X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-22_01:2020-07-21, 2020-07-21 signatures=0 X-Proofpoint-Spam-Reason: safe Archived-At: Subject: Re: [Add] IETF108 ADD Agenda X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 02:24:38 -0000 RllJIC0gQW4gdXBkYXRlZCBhZ2VuZGEgd2l0aCB0aGUgcmVxdWVzdGVkIGNoYW5nZXMgaGFzIGJl ZW4gdXBsb2FkZWQuICAgU2FtZSBwcmVzZW50YXRpb25zLCBidXQgdXBkYXRlZCBuYW1lcyBhbmQg cGxhY2VtZW50IGluIHRoZSBhZ2VuZGEuDQoNClJlZ2FyZHMNCkdsZW5uDQoNCg== From nobody Tue Jul 21 23:40:36 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B0EA33A0E60 for ; Tue, 21 Jul 2020 23:40:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.103 X-Spam-Level: X-Spam-Status: No, score=-2.103 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y5MSIyUbN4sL for ; Tue, 21 Jul 2020 23:40:32 -0700 (PDT) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (mail-eopbgr30077.outbound.protection.outlook.com [40.107.3.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EF1843A085B for ; Tue, 21 Jul 2020 23:40:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=La+Q4XKPI4bE0+nhz6VXgwISVmGPHnDA0wIRuGEVoRtBgXkKWmHE/ic8y/KCZzMuspRGdcTdHoQHg5PkHM2YeALCxhucTfKHbj3JTDUV42b6RkC8RZuhbbOKZBUqMgnU/CyOSm4ROoCDn979pv8+pJ6sbvx8JGf9xza64SfgynNiizdx4Rr1ebMamKCvKfoIiRIkLGeYmQRA9PjUyQaKUsktotJxGGn1l8JDMBODrCgNP6QWi32+1QyFIaMZuK0gFTfVQACHBflUK1+wwE08fdrp+htYE57f4n/j60Gk0cGLwVMkMlkTPbU8RmedDtW5wOBWK85mlkRRksNGPohHMw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=q8DdBJBRPbN41QyHAJva8ESmKTTpv2hNbiPx2eoTwWU=; b=bYM0jEbQwkXs4OYRqEKBroJKxld/TDejEDTEZfr67xUfrnKW3AFObE24Ak51ULWiY36P4mZePybtdu2LqDB7WN1HPQmLSKGNJxj3VMLHZAwILFdCjtttL3dhO8H7oVp5CTljQWqrSPNrxvG8U486F6kYNCBQvQpgpy20M/nBTdy8bYFnadApRippcw9NIe4T15nI1lGAgaXwBli3Khz0bq379C8nJs9Wlo21GzjD+3hVsPuj3X2KR21ae+w96LNhEc6p68liTPBY4Qxb+aC7dzbVobs0DxCwPcclzTvPMX38BQSTBsSe77xskHXznqSmWJ69edlKsRqmMJxC0OTkHw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=q8DdBJBRPbN41QyHAJva8ESmKTTpv2hNbiPx2eoTwWU=; b=ZNHokysZhsy76FFciwr8awtV1mIiQ6owhF/Rlzqw31UsZxbDvkyXm7UmoBs21P45jkzXO8YiffFCaTIDnn+YmQDOgijoBSLOgGTSJoXFlZhKGtW+H2Qu7BrUPvWr4moe71Vuuclql3CV5i2IjeNSHmMTI88/7OSkSgIzvblVf9I= Received: from HE1PR07MB3386.eurprd07.prod.outlook.com (2603:10a6:7:2d::25) by HE1PR0702MB3737.eurprd07.prod.outlook.com (2603:10a6:7:8a::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.14; Wed, 22 Jul 2020 06:40:29 +0000 Received: from HE1PR07MB3386.eurprd07.prod.outlook.com ([fe80::e01c:9809:43db:67d3]) by HE1PR07MB3386.eurprd07.prod.outlook.com ([fe80::e01c:9809:43db:67d3%6]) with mapi id 15.20.3216.020; Wed, 22 Jul 2020 06:40:29 +0000 From: Mohit Sethi M To: Stephane Bortzmeyer , "Deen, Glenn" CC: ADD Mailing list Thread-Topic: [Add] New Threats ID for ADD Thread-Index: AQHWX/L8QlK+rIkhLk21FrF5no2lQg== Date: Wed, 22 Jul 2020 06:40:29 +0000 Message-ID: References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> <20200721095240.GA10868@nic.fr> In-Reply-To: <20200721095240.GA10868@nic.fr> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 authentication-results: nic.fr; dkim=none (message not signed) header.d=none;nic.fr; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [2001:14bb:140:27c7:2739:5cce:2572:bccb] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: fcaad4c9-323c-4419-67e0-08d82e0a1ffd x-ms-traffictypediagnostic: HE1PR0702MB3737: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: z+eO0ljCQ7QQwUNVGcJtM7TYxR0ne0QMbqSr3DQUQfugt9CJC9SWY0Da/pOY/1YualwVvYoZjVzrtKorlnL9VCYHrDRTLKdRBPfTEOgiZgUdJ4lEQsITlS6A/qvbfKIkg15RNbBwE6uja4drDWko4gU5lovglKKDqST1yypKRRulFMF03JMAf4a2w+oNKUhm70ZvXPmDZ4dVOo5Pgqazq/9TxeNLxr6F7ZOGdYcALyd00wkB99wq6bhCqWEtaYo1809fJVM1bq1mM08BxJUWG3ElyFP6loDAz6b2Ks2jmP3+dSUa0L4AqpX/JsbHzYlIZmiOCxDWQONZ9YQGSApmfjEp290HH2ugCcDF2eKPrr6nN4X0bHiV6aNHxD93HQAWvtjfY7bEjlLUEVmxQDesUfn3P6vm4coSFWr8qwyPx42R0Cl4jhE2Rhi4p/1bi7opk4YSkLhEqFIs79wsJ4dHpQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:HE1PR07MB3386.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(39860400002)(376002)(396003)(366004)(136003)(346002)(31686004)(36756003)(6506007)(8676002)(66556008)(66946007)(64756008)(66446008)(83380400001)(66476007)(2906002)(6486002)(53546011)(76116006)(66574015)(316002)(5660300002)(2616005)(966005)(86362001)(478600001)(71200400001)(6512007)(186003)(4326008)(31696002)(8936002)(110136005)(43740500002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: +xLn6MvpDMO8HC8oE+VTCUay3Vh8r53hDuN/n8UH+RwcxO6fY6dh7ljbE+nHbdcktanrfJXLtEpIGNtgyn26xIN5pn3wck0C0FcnCq8JuV//g8l2pP/lwVFDpHYEbnWTQl5jcQkl27fkN5mcPOGnI3UwTzelU6oiZf7ULgSZWdnEZ7L4f6f6EH+nAK6KAdXayMQz1zvCbMsY2PDLH3DuIpn7pNqaLXwh8DnzgvlRV/W7RQVE9kk8Gt/M+ILktYC+chTYmSRJKKGkWeJ+eySzkOzFpUaHv9Hv2pB/Vlsxdf/G99pgKO4Z/Fd6CtYUlFwiXB1Lr5uwn6b1PAeIcy3IayFGX0PvJ8/d7zVYbRtalNDgpUfpOVfMt8JWxxlTcDWAqzyCuqqOKQmJv+xOyN1sri3Ldue9TsImUPnWLmKj/TlHK/+3qky3TAzpAeUH4D54g785t1NTwMik6e7HZP5QrqDlmDkaudIAw8JXTduYenx3OrcY5W/TYEF2ULav1ndukdyYQCu9TI2HvJuWwYaBuPqWb3dvDTdZemVxpiW3ZgF7yFuYfycNrtqjJoEO/Abi x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: <87D1407FE3A0C84FA43B67FF6070FBE6@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: HE1PR07MB3386.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: fcaad4c9-323c-4419-67e0-08d82e0a1ffd X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2020 06:40:29.2707 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: cCFqcDq6TxVPyNbuIW3N4JRXZx61oH+38/EB6fyi97XM6In2064I7/SU0GlAyiwREJACQrcugbg5N4S4EZgkgHGuIuRcb72o+uoWfp1x2tw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0702MB3737 Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 06:40:34 -0000 SW4tbGluZS4NCg0KT24gNy8yMS8yMCAxMjo1MiBQTSwgU3RlcGhhbmUgQm9ydHptZXllciB3cm90 ZToNCj4gT24gVHVlLCBKdWwgMjEsIDIwMjAgYXQgMTI6NDA6MjdBTSArMDAwMCwNCj4gICBEZWVu LCBHbGVubiA8R2xlbm5fRGVlbkBjb21jYXN0LmNvbT4gd3JvdGUNCj4gICBhIG1lc3NhZ2Ugb2Yg MTAyIGxpbmVzIHdoaWNoIHNhaWQ6DQo+DQo+PiBJIHdhbnRlZCB0byBicmluZyB0byB5b3VyIGF0 dGVudGlvbiBhIHNob3J0LCB2ZXJ5IHNob3J0LCBkcmFmdCB0aGF0DQo+PiBJIHdyb3RlIHVwIGJh c2VkIG9uIGFuIGVtYWlsIHRocmVhZCBvbiB0aGUgV0cgbGlzdC4gIEl0IGNhcHR1cmVzIGENCj4+ IGJhc2ljIGZyYW1ld29yayBvZiBHcmVlbi1ZZWxsb3ctUmVkIHRocmVhdCBhbmQgdHJ1c3QgcmVs YXRpb25zaGlwcw0KPj4gdGhlIHVzZXIgbWF5IGhhdmUgd2l0aCB0aGVpciBuZXR3b3JrLiAgVGhl IGhvcGUgaXMgdGhhdCB0aGlzIGNhbiBiZQ0KPj4gYSBiYXNpcyBmb3IgZm9jdXNpbmcgZGlzY3Vz c2lvbiBvZiB0aHJlYXRzIGFuZCB3aGF0IG1pdGlnYXRpb25zDQo+PiBtYXliZSBuZWVkZWQgaW4g ZGlmZmVyZW50IHNpdHVhdGlvbnMuDQo+Pg0KPj4gaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9y Zy9kb2MvaHRtbC9kcmFmdC1kZWVuLWFkZC10aHJlYXRzLTAwDQo+IEkgc2VlIG5vIHVzZSBmb3Ig dGhpcyBkb2N1bWVudC4gSXQgc2VlbXMgdG8gY29uc2lkZXIgb25seSB0aGUNCj4gcG90ZW50aWFs IHJpc2tzIGJ5IG91dHNpZGVycywgYW5kIG5vdCB0aGUgcmlza3MgYnkgdGhlIG9wZXJhdG9ycywN Cj4gd2hpY2ggYXJlIGFzIGltcG9ydGFudC4gRm9yIGluc3RhbmNlLCBhc3Nlc3NpbmcgdGhhdCB0 aGUgIlVzZXIncyBJU1ANCj4gbmV0d29yayIgaXMgc2FmZSBvciBub3QgaXMgbm90IGp1c3QgYSBt YXR0ZXIgb2Ygd2V0aGVyIGl0IGlzIHByb3Blcmx5DQo+IHNlY3VyZWQ6IGl0IGlzIGFsc28gYSBt YXR0ZXIgb2Ygd2hhdCB0aGV5IGRlY2lkZSB0byBkbyAoYW4gSVNQDQo+IHJlc29sdmVyIHdoaWNo IGNlbnNvcnMgU2NpLUh1YiBpcyBub3Qgc2FmZSBmb3IgbWUsIGV2ZW4gaWYgaXQgaXMNCj4gc2Vj dXJlZCBhbmQgcHJvdGVjdGVkIGZyb20gb3V0c2lkZSBhdHRhY2tlcnMpLg0KPg0KPiBUaGlzIGRy YWZ0IGlzIG5vdCBhIHByb3BlciB0aHJlYXQgbW9kZWwgZm9yIHRoZSBJbnRlcm5ldC4NCg0KSSBk b24ndCB3YW50IHRvIHNob290IGRvd24gdGhpcyB3b3JrIGJ1dCBjYXRlZ29yaXphdGlvbiBvZiBu ZXR3b3JrcyBpbnRvIA0KcmVkL2dyZWVuL3llbGxvdyBiYXNrZXRzIGlzIGhhcmQgKGlmIG5vdCBp bXBvc3NpYmxlKSBhbmQgaXQgd2lsbCBsZWFkIHRvIA0KYSB2ZXJ5IGxvbmcgdGhyZWFkIHdpdGgg Y291bnRlciBleGFtcGxlcy4gRm9yIGV4YW1wbGU6DQoNCi0gTWFueSBzY2hvb2wgYW5kIHVuaXZl cnNpdHkgbmV0d29ya3MgdXNlIGVkdXJvYW0gd2l0aCBFQVAuIFRoZXkgc2hvdWxkIA0KYmUgaW4g dGhlIGdyZWVuIGJhc2tldC4NCg0KLSBNYW55IGhvbWUgbmV0d29ya3MgYnJvYWRjYXN0IGEgR3Vl c3QgU1NJRCB3aGljaCBjYW4gYmUgYW4gZW50cnkgcG9pbnQgDQpmb3Igcm9ndWUgYWN0b3JzLiBU aGV5IHNob3VsZCBiZSBpbiB0aGUgeWVsbG93IGJhc2tldC4NCg0KLSBDb25mZXJlbmNlIG5ldHdv cmtzIGF0IHNlY3VyaXR5IGNvbmZlcmVuY2VzIChzdWNoIGFzIEJsYWNrSGF0LCBDQ1MgDQpldGMu KSBzaG91bGQgYmUgaW4gdGhlIHJlZCBiYXNrZXQuDQoNCkkgdGhpbmsgZGlzY3Vzc2lvbiBvbiB0 aGlzIHNvcnQgb2YgY2F0ZWdvcml6YXRpb24gbWF5IG5vdCBiZSB2ZXJ5IA0KcHJvZHVjdGl2ZSBm b3IgdGhlIHdvcmtpbmcgZ3JvdXAuDQoNCi0tTW9oaXQNCg0KPg0KPiBBbHNvLCBob3cgd2FzIGRl Y2lkZWQgdGhlIGxpc3Qgb2YgZXhhbXBsZXM/ICJVc2VyJ3Mgb3duIGhvbWUgbmV0d29yayINCj4g aXMgbWFya2VkIGFzIGdyZWVuIGJ1dCBpdCBpcyB0eXBpY2FsbHkgcXVpdGUgdW5zYWZlLCBib3Ro IGJlY2F1c2UNCj4gdHlwaWNhbCB1c2VycyBkbyBub3QgaGF2ZSB0aGUga25vd2xlZGdlLCBpbmNs aW5hdGlvbiBhbmQvb3IgdGltZSB0bw0KPiBzZWN1cmUgaXQsIGFuZCBhbHNvIGJlY2F1c2UgdGhl IGRhbmdlciBjYW4gYmUgaW5zaWRlIChzZWUgdGhpcw0KPiBleGNlbGxlbnQgcGFwZXIgZm9yIG1h bnkgZXhhbXBsZXMNCj4gPGh0dHBzOi8vd3d3LnNjaG5laWVyLmNvbS9hY2FkZW1pYy9wYXBlcmZp bGVzL1ByaXZhY3lfVGhyZWF0c19pbl9JbnRpbWF0ZV9SZWxhdGlvbnNoaXBzLnBkZj4pDQo+DQo= From nobody Tue Jul 21 23:40:49 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 862483A0E6F for ; Tue, 21 Jul 2020 23:40:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.103 X-Spam-Level: X-Spam-Status: No, score=-2.103 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id McYENJmH7nKl for ; Tue, 21 Jul 2020 23:40:40 -0700 (PDT) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (mail-eopbgr30072.outbound.protection.outlook.com [40.107.3.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D9DF93A0E65 for ; Tue, 21 Jul 2020 23:40:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=fw7qkVbqq0nwujcvyjt1uAxuejtCaoW8UPOTVtgQh0o/BsjuBdese4tRs1XL35Xju3chUAlp2kH8JI16RDUDefwjEvuzVKktkt3RWPvfNl6UQrZXAuorUsR2+jytdVN9YMA6zLP1+oGT8BrEWFPEHuKQx7EqQWlmVp6djJ1VJpKDn6Wd97oM3k/QnGBZzVeAFi7DBFaOFiubJRzHDtON01/79SpA/6msXu0yvnlqxXmUzRcnKpZk8JCcg5JYR79Lg4CaH2UiqKQk9n3m7LbOm5kMSEJ3y1Rwp3U0KT5cJ/nRiEfsVTOTJdhpfO2gmSBy0o0mGSsG6fJuIbSB2Jwvsg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=TApu+Zc8lzcJaSNuaYK/pRtZ6YfIADKQVE7qeHojH10=; b=Atw65XnuN8DBGeRpYCtKDQXGmBkDWhcASraO57Y3HJUiEtGtfCZpNRkAtG8TzRvv4kVJtXhYJM1Lr7umyiOWeYsLUmapbf3pcHDQBgnGlBTkK6L3OLYhY1UXyqGILIvAxp+gUNXv/d/8M8lFEJ4eFBLrr2F1TKkP4SS+dHRbzLJEoEHK9b7U6MEKIvekzUcEi5di8QOQ+pEQ7A/hqwIwBtrForLUH1JLPxx6TLVbHmcfOUYFlYkwB+P/LfufseDSbrkQCJviAlqugC+9gRjOFh6PUU7ffb+cCY9au7Y1di65I7AHhuRYRxNp9Cko9nTZgD6NP27x93JKuX8oe8YXaw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=TApu+Zc8lzcJaSNuaYK/pRtZ6YfIADKQVE7qeHojH10=; b=bIUPX/sXrMuC+I0JNCqzUpmeJxse/BWqXtF0L+xJtmKTbz60lblWTfxrePXraFv3k3dVW1OP6j0IYZNxOm6eG2yHrJ6ZzGaShMGfOizQu1YniyUfA0MAoyvEA5h10jwASGRk/8myi96rvdjhp/7hBmmrLA5kzWsJgHkD/5GYSpg= Received: from HE1PR07MB3386.eurprd07.prod.outlook.com (2603:10a6:7:2d::25) by HE1PR0702MB3737.eurprd07.prod.outlook.com (2603:10a6:7:8a::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.14; Wed, 22 Jul 2020 06:40:37 +0000 Received: from HE1PR07MB3386.eurprd07.prod.outlook.com ([fe80::e01c:9809:43db:67d3]) by HE1PR07MB3386.eurprd07.prod.outlook.com ([fe80::e01c:9809:43db:67d3%6]) with mapi id 15.20.3216.020; Wed, 22 Jul 2020 06:40:37 +0000 From: Mohit Sethi M To: Martin Thomson , "add@ietf.org" Thread-Topic: [Add] New Threats ID for ADD Thread-Index: AQHWX/MBQlK+rIkhLk21FrF5no2lQg== Date: Wed, 22 Jul 2020 06:40:37 +0000 Message-ID: <3f73ed6b-f5fa-b757-42f5-7e0cc7e77113@ericsson.com> References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 authentication-results: lowentropy.net; dkim=none (message not signed) header.d=none;lowentropy.net; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [2001:14bb:140:27c7:2739:5cce:2572:bccb] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 5932e3d0-aa84-42f0-6a9d-08d82e0a24e1 x-ms-traffictypediagnostic: HE1PR0702MB3737: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: u9IkCAAD3Tsa5iw456BxkBp37nicQ7obHVX/9LeF2w5joYwdgS4LCnxk/p2XaSqOXhYp8CrXFsTD/kJOJTbU3Ia9F0/sl7jg3ER+DtYN2zycg+wRj0GZl2+f3q4YKnGdfkSgTjKwMa3Bl7yzT0SwnzTpWqQ6jTYimLF0YGXB8Ee4ONGy+94gcWm5GumEwwnb2xIuat6iqkoP/uttZ/s8RzgWY0o/beqFYFJ7jGz0r3JnWVFsZOZrg4o8nU1oRbLFG6VqCJtMl/0dMVKNMkVCmES1GafN+y/aOVEviqal86i4G9uDY6LSIXIHae4zy5JECiqD28C+j2f9aPtXv9qFh5XGSknDCcG4Mcwpjr38aJE96pRxcm7+XM14VgIj6XqoFfxqZHSuv3SGzdC5LCa1v6ALpvx8ctr35uJfzPBG59o+TCMGxELUlCphJE17KDBWmAZYyWVVTDfMAORHezd1eg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:HE1PR07MB3386.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(39860400002)(376002)(396003)(366004)(136003)(346002)(31686004)(36756003)(6506007)(8676002)(66556008)(66946007)(64756008)(66446008)(83380400001)(66476007)(2906002)(6486002)(53546011)(76116006)(316002)(5660300002)(2616005)(966005)(86362001)(478600001)(71200400001)(6512007)(186003)(31696002)(8936002)(110136005)(43740500002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: bnEc/7NycJCy3Bw1LKiR1K0qh6ghMjaoU0tRpZuXIIOu0i/loE/sIGWMM7EEZ2CYxh4KSHLWvPb4u+hKBLcfMVpEX1RFh6FbWXsEHBUFbynw1BNxGNC8k+7n4QX6Pq6XM7yupc25z8lJYMrlY8diRx+gEIZS2zzPWPwitpyjqpvsnF274YN8kJVrv46YKp1pzSsDZbrN+xPyrDAAkiK1shgHIFQSbdGrVVbHYnAdmgvUS2E8gnlMebkCPlvksZEK99oTS/EbFLHrEDf4xhWbj3nrNMGKHQOvsexQhkQ34d5ONOjnPnNOa5nE0DHE7BUAg2A+td1UOJgBQi/QTuaME+amh6oxhQtZr/kA0FsAJDrfkFMu7uDx1W4m/TecrNllpfNYZ+4olh5w3kqE7kJRCJLgs6yi1B42AgoyBXT4y1NRuAA/THapx32Rfstkr/C9Fj/YIZSCqEcI331qDQwDMZVdKkXq9Om3AvazmZ7eR2HeGUqNDZLu9kEykVEiwU15AFDSqc+tNJNt5ny73PmlZg0OKFrpSi33l/5LjokqI5y69J7l9q0W9hRFgn11CXVD x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: <199712F731665F4A814D7BD451B64C63@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: HE1PR07MB3386.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5932e3d0-aa84-42f0-6a9d-08d82e0a24e1 X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2020 06:40:37.4719 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: XbgFBrtNmFjV+srE/qBNXTYk0pgPb5fdD4Zyt10CkqiwGs2x9Q1bjSUhmV8QyRN7TotqSFXKDkfzWSCBJmvAc5CgqCPFLMNt4rHPp/bpH2A= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0702MB3737 Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 06:40:47 -0000 SW4tbGluZS4NCg0KT24gNy8yMS8yMCAxMjoyNiBQTSwgTWFydGluIFRob21zb24gd3JvdGU6DQo+ IE9uIFR1ZSwgSnVsIDIxLCAyMDIwLCBhdCAxMDo0MCwgRGVlbiwgR2xlbm4gd3JvdGU6DQo+PiBo dHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9odG1sL2RyYWZ0LWRlZW4tYWRkLXRocmVh dHMtMDANCj4gSGkgR2xlbm4sDQo+DQo+IFRoaXMgaXMgYW4gaW50ZXJlc3RpbmcgdGFrZSBvbiB0 aGUgcHJvYmxlbS4gIEhvdyBkbyB5b3UgYW50aWNpcGF0ZSBpZGVudGlmeWluZyBuZXR3b3Jrcywg b3IgaXMgdGhhdCBsZWZ0IGFzIGFuIGV4ZXJjaXNlIGZvciB0aGUgcmVhZGVyPyAgT25lIG9mIHRo ZSB0aGluZ3Mgd2UgaGF2ZSBzdHJ1Z2dsZWQgd2l0aCBpbiBnZW5lcmFsIGlzIG5ldHdvcmsgaWRl bnRpZmljYXRpb24uICBBbmQgZXZlbiB0aGF0IGZhbGxzIHNob3J0IG9mIHdoYXQgR3JlZW4gd291 bGQgc2VlbSB0byBkZW1hbmQsIHdoaWNoIGlzIG5ldHdvcmsgYXV0aGVudGljYXRpb24uDQo+DQo+ IEkga25vdyB0aGF0IHRoZXJlIGFyZSBzb21lIEVBUCBtZXRob2RzIHRoYXQgaW50ZWdyYXRlIG5l dHdvcmsgYXV0aGVudGljYXRpb24gYW5kIHRoZXJlZm9yZSBtaWdodCBhbGxvdyBmb3IgbWFraW5n IHRoaXMgY2FsbCwgYnV0IEkgZG9uJ3Qga25vdyBob3cgcG9ydGFibGUgdGhvc2UgYXBwcm9hY2hl cyBhcmUuDQoNClNvbWU/IEEgYml0IG1vcmUgdGhhbiA1MCByaWdodCBub3cgDQooaHR0cHM6Ly93 d3cuaWFuYS5vcmcvYXNzaWdubWVudHMvZWFwLW51bWJlcnMvZWFwLW51bWJlcnMueGh0bWwjZWFw LW51bWJlcnMtNCkuIA0KU28geW91IGNhbiBjaG9vc2UgYW55IHR5cGUgb2YgY3JlZGVudGlhbHM6 IGNlcnRpZmljYXRlcywgcGFzc3dvcmRzLCANClBTS3MsIFBBS0VzLCBTSU0gY2FyZHMsIG9uZSB0 aW1lIHBhc3N3b3JkcywgYW5kIHZhcmlvdXMgY29tYmluYXRpb25zOiANClRMUyBhdXRoZW50aWNh dGlvbiBvZiBzZXJ2ZXIgYW5kIHBhc3N3b3JkL1BTSyBhdXRoZW50aWNhdGlvbiBpbnNpZGUuIA0K QWRtaXR0ZWRseSwgc2V0dGluZyB1cCBhbiBFQVAgbmV0d29yayB3aXRoIGEgQUFBIHNlcnZlciBj YW4gYmUgDQpjaGFsbGVuZ2luZyBmb3IgbWFueSBob21lIHVzZXJzIGJ1dCBJIHdvdWxkIHJhdGhl ciBzb2x2ZSB0aGF0IHByb2JsZW0gDQp0aGFuIGludmVudCBhIG5ldyBwcm90b2NvbCBmb3IgZG9p bmcgd2hhdCBFQVAgZG9lcy4NCg0KLS1Nb2hpdA0KDQo= From nobody Tue Jul 21 23:41:02 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 06BE03A0E94 for ; Tue, 21 Jul 2020 23:40:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.102 X-Spam-Level: X-Spam-Status: No, score=-2.102 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qKoIFKlt8mLJ for ; Tue, 21 Jul 2020 23:40:51 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150048.outbound.protection.outlook.com [40.107.15.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F6E13A0E8D for ; Tue, 21 Jul 2020 23:40:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=WB8Xfe3rg++40c5Ol08J1NSGuxCNWubibWuo+VoXwHMDAUu2aekkucExO2sHVLyfstgE0/8Qv8pXDK/23jPfQpE6l/biWgJzQj6uswC3VONGxTfWppZBNG43pXwUA/y56RuZO+NkHDBzRWM3AsaCqecQEVDrADzlUqqZ7tN+IKeCDtz0vEks1U3aSvUxSqJbqehg/V3KLMtOVXJFUmVd+kOWq1triKI9zKEvh1Q4TThFKkZo5VzGzOu8VaCMSou7D1I+ZM9qG/1ZMDPSgkX8DBfRtu5lxMqhirKxZRr5tMEeopM/GfeEPRJnfvP7mPF5sv7cWFxUW2962nSvhATL6A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DRX9AyIBsvTlACcAfWq68odQeUmB9/TCJAcCwiPdm8A=; b=VN3liWAYrisAPQdZ7xqMsugfticxBcZLQrjl37ZOoNp28GVHmvUQLx5dbIHiCAHOJ53df3PHbUxafTDE8yBQnEkj2RCVH/T0CNWb+oNm/vf4cIOtDIyozqcd7b/LoIU226Ob0qDI5MhJXYqRskh/ZiyRH0+yh6o3aD2BhHbbMtpb+dNlY7fz+HZYmL1uSEkpaGROPPRqlgolOjVXQT4uWMa7PoIt0Ojym5QuOWE/ypkFEKrLEwgE6veN5AXVOe+9f2HEaR6M59ZA97Xlpc/dqfC025If8bwh3Zk2FGqZVP4CoxcrgkKCIwW6Yu+96I/jnSA6gshiM4lQB+NRNY22RQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DRX9AyIBsvTlACcAfWq68odQeUmB9/TCJAcCwiPdm8A=; b=GjuWBYGSrKllMNYYi8z+H6kaFp1I1lo/O1irdVuRuO/whggXCxLjqeJTJ2kcxNlI2l0LmAgR2fNOlDXBWBUlsOLpFccHJHCsTkvqYTZoNBP0V2P48yMKUDzVHt36Un/RJXwp/xTI0aYAW5Svbgg+opaRRW+liDJrFpvIUy4GhU8= Received: from HE1PR07MB3386.eurprd07.prod.outlook.com (2603:10a6:7:2d::25) by HE1PR0702MB3738.eurprd07.prod.outlook.com (2603:10a6:7:8d::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.14; Wed, 22 Jul 2020 06:40:47 +0000 Received: from HE1PR07MB3386.eurprd07.prod.outlook.com ([fe80::e01c:9809:43db:67d3]) by HE1PR07MB3386.eurprd07.prod.outlook.com ([fe80::e01c:9809:43db:67d3%6]) with mapi id 15.20.3216.020; Wed, 22 Jul 2020 06:40:47 +0000 From: Mohit Sethi M To: tirumal reddy , Eric Rescorla CC: Andrew Campling , "add@ietf.org" , Martin Thomson Thread-Topic: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AQHWX/MHGQ7dt8tCwUWw1D25DI/0bQ== Date: Wed, 22 Jul 2020 06:40:47 +0000 Message-ID: <0576b179-fb78-87a2-b31a-40416884dd1f@ericsson.com> References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [2001:14bb:140:27c7:2739:5cce:2572:bccb] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: fc2d4319-d7dc-431e-52a2-08d82e0a2abc x-ms-traffictypediagnostic: HE1PR0702MB3738: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: goRhU7EVPlNP59F6kvQjoo6/zncxxH340X9klZ3HJb57zHC28DTFdmp32MgqVZTyVe7dpT9VYt27beG5ALx65mmo+IvcZq5C+tIe5eDGom+tPGxAd7jk2mNwzGaeOpeMBhVbJCa7/v0l5UJYXDdyORcdWgILL2EakW28JrhkAICNBFNgz1FVUC7KXK/T37b3keJtU8+JGff9asTuUy1VDq2wv3rX9b3wn7vAjyRMjR0wSCjKaK80/iVsXvu8QfBqCV2tRcWQ0wME2uIQJZwlHLqXg03v7oS3A/+aYtzZBeMAJWAE9ZXc0Ry0v2uPATKeXufJP89E4IJjfjYp/4fVlyphS3eC6tB4123705hO0YukHa+1yyWks9ga1KLvuoYFOnPQBLv77Vj9zB6a3Oi+NBJdaH8ruXx/Tjt79WsWrsH0xJC8IiEkVBuvEcZprYdhxwvoENwTwgNJJaTF4d3j1Q== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:HE1PR07MB3386.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(396003)(366004)(376002)(346002)(136003)(39860400002)(6486002)(53546011)(2906002)(5660300002)(186003)(6512007)(6506007)(83380400001)(4326008)(4001150100001)(66476007)(8936002)(64756008)(66446008)(36756003)(21615005)(54906003)(966005)(8676002)(2616005)(110136005)(166002)(71200400001)(66574015)(76116006)(31686004)(66946007)(66556008)(86362001)(316002)(31696002)(478600001)(43740500002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: 5UXu4UK3CTIlTLvnbhP2skNVbzWSoauk6WxWUUJ3Zt6fSenIW8N0HDxcetzXWzVgjMtxL59uJM+AcfQj2Jh44ZTaccbalk6FYABNI5BMuH7NqVywoffZmM9IWkd+IDE8lMytk2yhFO9pryyR4MLbZTwtyaLp/TRraRd6W1j0ZNHwGmuzm34YYHqW1jpp2CSLWIbTC8e7Ru/crqD87dzycvaw8X/gK/lsCdORfOxaPcDx+HZfdSfMu+LWrLIPP449njLIXEFxO5/OT5fQgTX8D+ZB6CHCM7PkCGUJDON9+dyOezVVR7DaXQdqIRDwOxBwKIdVG7IcLFm6N+boXg47FN4sYSC0Kb8Dd5GdBy4sZIW8s//D54Y2zmlCZ+6kUYO2QllqVKOVgShaGD9sbpIKY4qmd+sfeLrqxRPfj1tlB0fPaQKTaHJlpnBrZzKvD13hPKNNfcOCVPi2Ti9Dm3/N8+ZA+fIjB8tUfMxP9ELXmHkzDiYaSv2GKmgzJaugjKbcC7ZclfnkVFZ63VC9lLIonm+SiNOlBFXWbocRacwKDl9YgE6hNLG2HJlnUZn+k3Zv x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_0576b179fb7887a2b31a40416884dd1fericssoncom_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: HE1PR07MB3386.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: fc2d4319-d7dc-431e-52a2-08d82e0a2abc X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2020 06:40:47.3171 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: /Gx41gTkTu6SKY5UA4FF13UXGauotkoMyJTV7VVUa+gCQ+zLol6gjRz6l9/T1rEZyJ7wHEFKUPqhXKTZpPT1BMfPO7xGad+3rQk8esGE8lM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0702MB3738 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 06:41:00 -0000 --_000_0576b179fb7887a2b31a40416884dd1fericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SW4tbGluZS4NCg0KT24gNy8yMS8yMCAxMjo0MiBQTSwgdGlydW1hbCByZWRkeSB3cm90ZToNCk9u IFR1ZSwgMjEgSnVsIDIwMjAgYXQgMDY6MTMsIEVyaWMgUmVzY29ybGEgPGVrckBydGZtLmNvbTxt YWlsdG86ZWtyQHJ0Zm0uY29tPj4gd3JvdGU6DQoNClRoYW5rcyBmb3IgdGhlIGNsYXJpZmljYXRp b24uDQoNCk9uIE1vbiwgSnVsIDIwLCAyMDIwIGF0IDM6MjIgUE0gQW5kcmV3IENhbXBsaW5nIDxh bmRyZXcuY2FtcGxpbmdANDE5LmNvbnN1bHRpbmc+PG1haWx0bzphbmRyZXcuY2FtcGxpbmdANDE5 LmNvbnN1bHRpbmc+IHdyb3RlOg0KPiBUbyBjbGFyaWZ5LCB0aGVyZSBhcmUgdHdvIGlzc3VlcyB0 byBvdmVyY29tZSBoZXJlLCAoaSkgdXNlIG9mIFJGQzE5MTgNCj4gcHJpdmF0ZSBhZGRyZXNzZXMg YnkgdGhlIENQRSAodG8gZmFjaWxpdGF0ZSBTUEFVKSBhbmQgKGlpKSBzdXBwb3J0IGZvcg0KPiBE TlMgZm9yd2FyZGVycyB0byBtYWludGFpbiB0aGUgZnVsbCBmdW5jdGlvbmFsaXR5IHByb3ZpZGVk IGJ5IG5ldHdvcmsNCj4gb3BlcmF0b3JzIHRoYXQgaXMgZGVzY3JpYmVkIGluIHRoZSBkb2N1bWVu dC4gIFRoZSBkZXNpcmVkIGVuZCBzdGF0ZSBpcw0KPiBhcyB5b3UgZGVzY3JpYmU6DQo+DQo+DQo+ DQo+IENsaWVudCA8LS0tLS0tLSBUTFMgLS0tLS0tLS0+IENQRSA8LS0tLS0tLSBUTFMgLS0tLS0t LS0+IElTUCBSZXNvbHZlcg0KPg0KPg0KPg0KPiBXaGlsc3QgaXQgd291bGQgYmUgaWRlYWwgdG8g ZGVhbCB3aXRoIGJvdGggb2YgdGhlIGFib3ZlIGlzc3Vlcw0KPiBzaW11bHRhbmVvdXNseSwgcHJh Z21hdGljYWxseSBpdCBtYXkgYmUgbmVjZXNzYXJ5IHRvIGRlYWwgd2l0aCB0aGVtDQo+IHNlcXVl bnRpYWxseSBnaXZlbiB0aGUgcG90ZW50aWFsIGZvciBkZWxheXMgaW4gdXBncmFkaW5nIENQRSBz b2Z0d2FyZS4NCj4gU2luY2UgdGhlcmUgYXJlIGFscmVhZHkgc29tZSBwcm9wb3NlZCBkaXNjb3Zl cnkgbWV0aG9kcyB0aGF0IGRlYWwgd2l0aA0KPiB0aGUgcHJpdmF0ZSBhZGRyZXNzZXMsIGl0IGNv dWxkIG1ha2Ugc2Vuc2UgZm9yIHRvIGltcGxlbWVudCBhIHR3by1zdGVwDQo+IHNvbHV0aW9uIHRo YXQgZmlyc3Qgc29sdmVzIHRoZSBwcml2YXRlIGFkZHJlc3MgaXNzdWUgaW4gdGhlIHNob3J0LXRl cm0NCj4gd2hpbHN0IHRoZSBDUEUgc29mdHdhcmUgdXBncmFkZSBpcyBkZXBsb3llZC4NCg0KU28g dGhlIGlkZWEgaGVyZSB3b3VsZCBiZSB0byBoYXZlIGEgbWVjaGFuaXNtIHdoaWNoIGVuYWJsZWQg RG9bVEhdIGJ1dA0KYnlwYXNzZWQgdGhlIENQRSwgY29ycmVjdD8gU28sIGl0IHdvdWxkIGJlIHNv bWV0aGluZyB0aGF0IG9uZSBkZXBsb3llZA0KYXQgdGhlIElTUCdzIHJlY3Vyc2l2ZSBhbmQgdGhh dCB3ZSBqdXN0IGV4cGVjdGVkIHRoZSBDUEUgdG8gcGFzcyBvbj8NCkl0IHNlZW1zIGxpa2UgdGhl IHByaW1hcnkgcmVxdWlyZW1lbnQgdGhlcmUgd291bGQgYmUgZm9yIHNvbWV0aGluZyB3aGljaA0K aGFkIGEgdmVyeSBoaWdoIGNoYW5jZSBvZiBwYXNzaW5nIHRocm91Z2ggZXhpc3RpbmcgQ1BFLg0K DQoNCldpdGggdGhhdCBzYWlkLCBJIGhhdmUgc29tZSBjb25jZXJucyBhYm91dCB0aGUgb2JqZWN0 aXZlIG9mIGhhdmluZyB0aGUNCkNQRSBpbiB0aGUgdXNlcidzIHJlc29sdXRpb24gcGF0aC4gV2hp bGUgSSBjZXJ0YWlubHkgY2FuIHVuZGVyc3RhbmQNCnRoZSByZWFzb25zIHlvdSBjb25zaWRlciBp dCBhZHZhbnRhZ2VvdXMsIGl0IHNlZW1zIHRvIG1lIHRoYXQgaXQNCnNpZ25pZmljYW50bHkgd2Vh a2VucyB0aGUgdXNlcidzIHNlY3VyaXR5IHBvc3R1cmUuIEV2ZW4gYXNzdW1pbmcNCmFyZ3VlbmRv IHRoYXQgd2UgaGF2ZSBhIHNlY3VyZSBtZWNoYW5pc20gZm9yIGRpc2NvdmVyaW5nIHRoaXMgY2Fz ZSwNCmluIHByYWN0aWNlIHRoZSBDUEUgc2VlbXMgdG8gaGF2ZSBxdWl0ZSBhIGhpZ2ggcmF0ZSBv ZiBzZWN1cml0eQ0KaXNzdWVzLCBpbmNsdWRpbmcgc3BlY2lmaWNhbGx5IEROUyBoaWphY2tpbmcg KHNlZSBmb3IgaW5zdGFuY2UgWzBdKS4NCg0KSG9tZSByb3V0ZXJzIGFyZSBoYXJkZW5lZCAoZm9y IGV4YW1wbGUsIHNlZSBodHRwczovL3d3dy5taW5kLmJlL29wZW53cnRzdW1taXQxOC8yMDE4LTEw LTMwLU9wZW5XUlQxOC1wcnBsV1JULmh0bWwpIHRvIGhvc3QgbmV0d29yayBzZWN1cml0eSBzZXJ2 aWNlcyB0byBwcm90ZWN0IHRoZSBuZXR3b3JrIGZyb20gaW50ZXJuYWwgYW5kIGV4dGVybmFsIGF0 dGFja3MuDQoNCk9idmlvdXNseSBzb21lIGFyZSBiZXR0ZXIgdGhhbiBvdGhlcnMgYW5kIHdlIGFy ZSBjb25zdGFudGx5IGltcHJvdmluZyBidXQgaXQgd291bGQgYmUgd3JvbmcgdG8gcGFpbnQgYWxs IG9mIHRoZW0gd2l0aCB0aGUgc2FtZSBicnVzaC4gVGhlIHdlYiBzZXJ2ZXJzIHRoYXQgc29tZSBv ZiB0aGUgQ1BFJ3MgaG9zdCBmb3IgbWFuYWdlbWVudCBhbmQgY29uZmlndXJhdGlvbiBhcmUgYXdm dWwgdG8gdXNlIGFuZCBvZnRlbiBpbnNlY3VyZSBieSBkZXNpZ24uDQoNCkkgY3VycmVudGx5IGhh dmUgYSBmZXcgeWVhcnMgb2xkICJlbnRlcnByaXNlLWdyYWRlIiBDUEUgd2hpY2ggYWxsb3dzIG1l IHRvIGJyb2FkY2FzdCAzMiBTU0lEcyBidXQgZG9lc24ndCBhbGxvdyBtZSB0byBjb25maWd1cmUg c2VjcmV0cyB0aGF0IGFyZSBsb25nZXIgdGhhbiA4IGFscGhhbnVtZXJpYyBjaGFyYWN0ZXJzLg0K DQotLU1vaGl0DQoNCg0KT25lIG9mIHRoZSBhZHZhbnRhZ2VzIG9mIERvW1RIXSBmcm9tIGNsaWVu dCB0byByZWN1cnNpdmUgaXMgdGhhdA0KaXQgaGFzIHRoZSBwb3RlbnRpYWwgdG8gbWl0aWdhdGUg YXR0YWNrcyBmcm9tIGF0dGFja2VycyBvbiB0aGUgbmV0d29yaw0KLS0gaW5jbHVkaW5nIHRoZSBs b2NhbCByb3V0ZXIgLS0gYW5kIHRoaXMgc2VlbXMgbGlrZSBpdCB3b3VsZCByZWdyZXNzDQp0aGF0 Lg0KDQotRWtyDQoNClswXSBodHRwczovL2xhYnMuYml0ZGVmZW5kZXIuY29tLzIwMjAvMDMvbmV3 LXJvdXRlci1kbnMtaGlqYWNraW5nLWF0dGFja3MtYWJ1c2UtYml0YnVja2V0LXRvLWhvc3QtaW5m b3N0ZWFsZXIvDQoNCg0KDQoNCi0tDQpBZGQgbWFpbGluZyBsaXN0DQpBZGRAaWV0Zi5vcmc8bWFp bHRvOkFkZEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v YWRkDQoNCg0K --_000_0576b179fb7887a2b31a40416884dd1fericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <90959F3AB1336645918C136DFF0F2264@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5Pg0KPHA+SW4tbGluZS48 YnI+DQo8L3A+DQo8ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVmaXgiPk9uIDcvMjEvMjAgMTI6NDIg UE0sIHRpcnVtYWwgcmVkZHkgd3JvdGU6PGJyPg0KPC9kaXY+DQo8YmxvY2txdW90ZSB0eXBlPSJj aXRlIiBjaXRlPSJtaWQ6Q0FGcEczZ2RBM0xLam1pWWU4UGtqWT1CSmsxaVVPTV9ucm9oQm40NkFi WkFmNTl5bkFBQG1haWwuZ21haWwuY29tIj4NCjxkaXYgZGlyPSJsdHIiPg0KPGRpdiBkaXI9Imx0 ciI+T24gVHVlLCAyMSBKdWwgMjAyMCBhdCAwNjoxMywgRXJpYyBSZXNjb3JsYSAmbHQ7PGEgaHJl Zj0ibWFpbHRvOmVrckBydGZtLmNvbSIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5la3JAcnRmbS5j b208L2E+Jmd0OyB3cm90ZTo8YnI+DQo8L2Rpdj4NCjxkaXYgY2xhc3M9ImdtYWlsX3F1b3RlIj4N CjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowcHggMHB4IDBw eA0KICAgICAgICAgICAgMC44ZXg7Ym9yZGVyLWxlZnQ6MXB4IHNvbGlkDQogICAgICAgICAgICBy Z2IoMjA0LDIwNCwyMDQpO3BhZGRpbmctbGVmdDoxZXgiPg0KPGRpdiBkaXI9Imx0ciI+DQo8ZGl2 IGRpcj0ibHRyIj48YnI+DQo8L2Rpdj4NCjxkaXYgZGlyPSJsdHIiPg0KPGRpdj5UaGFua3MgZm9y IHRoZSBjbGFyaWZpY2F0aW9uLjwvZGl2Pg0KPGRpdj48YnI+DQpPbiBNb24sIEp1bCAyMCwgMjAy MCBhdCAzOjIyIFBNIEFuZHJldyBDYW1wbGluZyA8YSBjbGFzcz0ibW96LXR4dC1saW5rLXJmYzIz OTZFIiBocmVmPSJtYWlsdG86YW5kcmV3LmNhbXBsaW5nQDQxOS5jb25zdWx0aW5nIj4NCiZsdDth bmRyZXcuY2FtcGxpbmdANDE5LmNvbnN1bHRpbmcmZ3Q7PC9hPiB3cm90ZTo8YnI+DQomZ3Q7IFRv IGNsYXJpZnksIHRoZXJlIGFyZSB0d28gaXNzdWVzIHRvIG92ZXJjb21lIGhlcmUsIChpKSB1c2Ug b2YgUkZDMTkxODxicj4NCiZndDsgcHJpdmF0ZSBhZGRyZXNzZXMgYnkgdGhlIENQRSAodG8gZmFj aWxpdGF0ZSBTUEFVKSBhbmQgKGlpKSBzdXBwb3J0IGZvcjxicj4NCiZndDsgRE5TIGZvcndhcmRl cnMgdG8gbWFpbnRhaW4gdGhlIGZ1bGwgZnVuY3Rpb25hbGl0eSBwcm92aWRlZCBieSBuZXR3b3Jr PGJyPg0KJmd0OyBvcGVyYXRvcnMgdGhhdCBpcyBkZXNjcmliZWQgaW4gdGhlIGRvY3VtZW50LiZu YnNwOyBUaGUgZGVzaXJlZCBlbmQgc3RhdGUgaXM8YnI+DQomZ3Q7IGFzIHlvdSBkZXNjcmliZTo8 YnI+DQomZ3Q7IDxicj4NCiZndDsgJm5ic3A7PGJyPg0KJmd0OyA8YnI+DQomZ3Q7IENsaWVudCAm bHQ7LS0tLS0tLSBUTFMgLS0tLS0tLS0mZ3Q7IENQRSAmbHQ7LS0tLS0tLSBUTFMgLS0tLS0tLS0m Z3Q7IElTUCBSZXNvbHZlcjxicj4NCiZndDsgPGJyPg0KJmd0OyAmbmJzcDs8YnI+DQomZ3Q7IDxi cj4NCiZndDsgV2hpbHN0IGl0IHdvdWxkIGJlIGlkZWFsIHRvIGRlYWwgd2l0aCBib3RoIG9mIHRo ZSBhYm92ZSBpc3N1ZXM8YnI+DQomZ3Q7IHNpbXVsdGFuZW91c2x5LCBwcmFnbWF0aWNhbGx5IGl0 IG1heSBiZSBuZWNlc3NhcnkgdG8gZGVhbCB3aXRoIHRoZW08YnI+DQomZ3Q7IHNlcXVlbnRpYWxs eSBnaXZlbiB0aGUgcG90ZW50aWFsIGZvciBkZWxheXMgaW4gdXBncmFkaW5nIENQRSBzb2Z0d2Fy ZS48YnI+DQomZ3Q7IFNpbmNlIHRoZXJlIGFyZSBhbHJlYWR5IHNvbWUgcHJvcG9zZWQgZGlzY292 ZXJ5IG1ldGhvZHMgdGhhdCBkZWFsIHdpdGg8YnI+DQomZ3Q7IHRoZSBwcml2YXRlIGFkZHJlc3Nl cywgaXQgY291bGQgbWFrZSBzZW5zZSBmb3IgdG8gaW1wbGVtZW50IGEgdHdvLXN0ZXA8YnI+DQom Z3Q7IHNvbHV0aW9uIHRoYXQgZmlyc3Qgc29sdmVzIHRoZSBwcml2YXRlIGFkZHJlc3MgaXNzdWUg aW4gdGhlIHNob3J0LXRlcm08YnI+DQomZ3Q7IHdoaWxzdCB0aGUgQ1BFIHNvZnR3YXJlIHVwZ3Jh ZGUgaXMgZGVwbG95ZWQuPGJyPg0KPGJyPg0KU28gdGhlIGlkZWEgaGVyZSB3b3VsZCBiZSB0byBo YXZlIGEgbWVjaGFuaXNtIHdoaWNoIGVuYWJsZWQgRG9bVEhdIGJ1dDxicj4NCmJ5cGFzc2VkIHRo ZSBDUEUsIGNvcnJlY3Q/IFNvLCBpdCB3b3VsZCBiZSBzb21ldGhpbmcgdGhhdCBvbmUgZGVwbG95 ZWQ8YnI+DQphdCB0aGUgSVNQJ3MgcmVjdXJzaXZlIGFuZCB0aGF0IHdlIGp1c3QgZXhwZWN0ZWQg dGhlIENQRSB0byBwYXNzIG9uPzxicj4NCkl0IHNlZW1zIGxpa2UgdGhlIHByaW1hcnkgcmVxdWly ZW1lbnQgdGhlcmUgd291bGQgYmUgZm9yIHNvbWV0aGluZyB3aGljaDxicj4NCmhhZCBhIHZlcnkg aGlnaCBjaGFuY2Ugb2YgcGFzc2luZyB0aHJvdWdoIGV4aXN0aW5nIENQRS48YnI+DQo8YnI+DQo8 YnI+DQpXaXRoIHRoYXQgc2FpZCwgSSBoYXZlIHNvbWUgY29uY2VybnMgYWJvdXQgdGhlIG9iamVj dGl2ZSBvZiBoYXZpbmcgdGhlPGJyPg0KQ1BFIGluIHRoZSB1c2VyJ3MgcmVzb2x1dGlvbiBwYXRo LiBXaGlsZSBJIGNlcnRhaW5seSBjYW4gdW5kZXJzdGFuZDxicj4NCnRoZSByZWFzb25zIHlvdSBj b25zaWRlciBpdCBhZHZhbnRhZ2VvdXMsIGl0IHNlZW1zIHRvIG1lIHRoYXQgaXQ8YnI+DQpzaWdu aWZpY2FudGx5IHdlYWtlbnMgdGhlIHVzZXIncyBzZWN1cml0eSBwb3N0dXJlLiBFdmVuIGFzc3Vt aW5nPGJyPg0KYXJndWVuZG8gdGhhdCB3ZSBoYXZlIGEgc2VjdXJlIG1lY2hhbmlzbSBmb3IgZGlz Y292ZXJpbmcgdGhpcyBjYXNlLDxicj4NCmluIHByYWN0aWNlIHRoZSBDUEUgc2VlbXMgdG8gaGF2 ZSBxdWl0ZSBhIGhpZ2ggcmF0ZSBvZiBzZWN1cml0eTxicj4NCmlzc3VlcywgaW5jbHVkaW5nIHNw ZWNpZmljYWxseSBETlMgaGlqYWNraW5nIChzZWUgZm9yIGluc3RhbmNlIFswXSkuPGJyPg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj48YnI+DQo8L2Rpdj4NCjxk aXY+SG9tZSByb3V0ZXJzIGFyZSBoYXJkZW5lZCAoZm9yIGV4YW1wbGUsIHNlZSA8YSBocmVmPSJo dHRwczovL3d3dy5taW5kLmJlL29wZW53cnRzdW1taXQxOC8yMDE4LTEwLTMwLU9wZW5XUlQxOC1w cnBsV1JULmh0bWwiIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+DQpodHRwczovL3d3dy5taW5kLmJl L29wZW53cnRzdW1taXQxOC8yMDE4LTEwLTMwLU9wZW5XUlQxOC1wcnBsV1JULmh0bWw8L2E+KSB0 byBob3N0IG5ldHdvcmsgc2VjdXJpdHkgc2VydmljZXMgdG8gcHJvdGVjdCB0aGUgbmV0d29yayBm cm9tIGludGVybmFsIGFuZCBleHRlcm5hbCBhdHRhY2tzLg0KPGJyPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPHA+T2J2aW91c2x5IHNvbWUgYXJlIGJldHRlciB0aGFu IG90aGVycyBhbmQgd2UgYXJlIGNvbnN0YW50bHkgaW1wcm92aW5nIGJ1dCBpdCB3b3VsZCBiZSB3 cm9uZyB0byBwYWludCBhbGwgb2YgdGhlbSB3aXRoIHRoZSBzYW1lIGJydXNoLiBUaGUgd2ViIHNl cnZlcnMgdGhhdCBzb21lIG9mIHRoZSBDUEUncyBob3N0IGZvciBtYW5hZ2VtZW50IGFuZCBjb25m aWd1cmF0aW9uIGFyZSBhd2Z1bCB0byB1c2UgYW5kIG9mdGVuIGluc2VjdXJlIGJ5IGRlc2lnbi4N Cjxicj4NCjwvcD4NCjxwPkkgY3VycmVudGx5IGhhdmUgYSBmZXcgeWVhcnMgb2xkICZxdW90O2Vu dGVycHJpc2UtZ3JhZGUmcXVvdDsgQ1BFIHdoaWNoIGFsbG93cyBtZSB0byBicm9hZGNhc3QgMzIg U1NJRHMgYnV0IGRvZXNuJ3QgYWxsb3cgbWUgdG8gY29uZmlndXJlIHNlY3JldHMgdGhhdCBhcmUg bG9uZ2VyIHRoYW4gOCBhbHBoYW51bWVyaWMgY2hhcmFjdGVycy4NCjxicj4NCjwvcD4NCjxwPi0t TW9oaXQ8YnI+DQo8L3A+DQo8YmxvY2txdW90ZSB0eXBlPSJjaXRlIiBjaXRlPSJtaWQ6Q0FGcEcz Z2RBM0xLam1pWWU4UGtqWT1CSmsxaVVPTV9ucm9oQm40NkFiWkFmNTl5bkFBQG1haWwuZ21haWwu Y29tIj4NCjxkaXYgZGlyPSJsdHIiPg0KPGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPg0KPGRpdj4m bmJzcDs8L2Rpdj4NCjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdp bjowcHggMHB4IDBweA0KICAgICAgICAgICAgMC44ZXg7Ym9yZGVyLWxlZnQ6MXB4IHNvbGlkDQog ICAgICAgICAgICByZ2IoMjA0LDIwNCwyMDQpO3BhZGRpbmctbGVmdDoxZXgiPg0KPGRpdiBkaXI9 Imx0ciI+DQo8ZGl2IGRpcj0ibHRyIj4NCjxkaXY+T25lIG9mIHRoZSBhZHZhbnRhZ2VzIG9mIERv W1RIXSBmcm9tIGNsaWVudCB0byByZWN1cnNpdmUgaXMgdGhhdDxicj4NCml0IGhhcyB0aGUgcG90 ZW50aWFsIHRvIG1pdGlnYXRlIGF0dGFja3MgZnJvbSBhdHRhY2tlcnMgb24gdGhlIG5ldHdvcms8 YnI+DQotLSBpbmNsdWRpbmcgdGhlIGxvY2FsIHJvdXRlciAtLSBhbmQgdGhpcyBzZWVtcyBsaWtl IGl0IHdvdWxkIHJlZ3Jlc3M8YnI+DQp0aGF0Ljxicj4NCjxicj4NCi1Fa3I8YnI+DQo8YnI+DQpb MF0gPGEgaHJlZj0iaHR0cHM6Ly9sYWJzLmJpdGRlZmVuZGVyLmNvbS8yMDIwLzAzL25ldy1yb3V0 ZXItZG5zLWhpamFja2luZy1hdHRhY2tzLWFidXNlLWJpdGJ1Y2tldC10by1ob3N0LWluZm9zdGVh bGVyLyIgdGFyZ2V0PSJfYmxhbmsiIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+DQpodHRwczovL2xh YnMuYml0ZGVmZW5kZXIuY29tLzIwMjAvMDMvbmV3LXJvdXRlci1kbnMtaGlqYWNraW5nLWF0dGFj a3MtYWJ1c2UtYml0YnVja2V0LXRvLWhvc3QtaW5mb3N0ZWFsZXIvPC9hPjxicj4NCjwvZGl2Pg0K PGRpdj48YnI+DQo8L2Rpdj4NCjxkaXY+PGJyPg0KPC9kaXY+DQo8L2Rpdj4NCjxicj4NCjxkaXYg Y2xhc3M9ImdtYWlsX3F1b3RlIj4NCjxkaXYgZGlyPSJsdHIiIGNsYXNzPSJnbWFpbF9hdHRyIj48 YnI+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQotLSA8YnI+DQpBZGQgbWFpbGluZyBsaXN0PGJy Pg0KPGEgaHJlZj0ibWFpbHRvOkFkZEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiIG1vei1kby1u b3Qtc2VuZD0idHJ1ZSI+QWRkQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3 LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWRkIiByZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0i X2JsYW5rIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vYWRkPC9hPjxicj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8 YnI+DQo8ZmllbGRzZXQgY2xhc3M9Im1pbWVBdHRhY2htZW50SGVhZGVyIj48L2ZpZWxkc2V0PiA8 L2Jsb2NrcXVvdGU+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_0576b179fb7887a2b31a40416884dd1fericssoncom_-- From nobody Wed Jul 22 00:29:13 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0F023A0EA3; Wed, 22 Jul 2020 00:29:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.118 X-Spam-Level: X-Spam-Status: No, score=-2.118 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=orange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YO5cPrijniK5; Wed, 22 Jul 2020 00:29:10 -0700 (PDT) Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.66.40]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1208D3A0EA1; Wed, 22 Jul 2020 00:29:09 -0700 (PDT) Received: from opfedar02.francetelecom.fr (unknown [xx.xx.xx.4]) by opfedar20.francetelecom.fr (ESMTP service) with ESMTP id 4BBRsv3lt4z8xV5; Wed, 22 Jul 2020 09:29:07 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.com; s=ORANGE001; t=1595402947; bh=cvyMRI4YM/ruSPZ0puI5zN3sxTaYv+srzERKnxCw1D0=; h=From:To:Subject:Date:Message-ID:Content-Type: Content-Transfer-Encoding:MIME-Version; b=JgBM9qxphMNywKLx2RcQdEzj1aDBYSuFhhcvlu7WUFYl5rHJLs5qlWvWhd5z9gQyR N7uO5DqUQCsgFX8bENFBM1qKUG5hPvXsN5shWWoCtcJlgls8RRQPcoqCAhw4phDLAD lFcmHFZUxLWZYHiQqQM/znr4nN8/315GgAoz8Ytfzb1hJ3kvmiebAkbyyEz7fSUjuG Sw7YuiWR2z88KqOK+xENF0mUlkfgJH9JjlcbK3wfR8KTRVXEWCgZkfabGK7sR76pif bfE1TPe+RQHTuA66CUw0aKotSUmZ3UKnjlBD1X1JG0+1iv5syeOuzk/98N3j+zHgmg /j39U37iMEnqQ== Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.45]) by opfedar02.francetelecom.fr (ESMTP service) with ESMTP id 4BBRsv2rTZzCqkN; Wed, 22 Jul 2020 09:29:07 +0200 (CEST) From: To: Stephane Bortzmeyer CC: "draft-btw-add-home@ietf.org" , "ADD Mailing list (add@ietf.org)" Thread-Topic: [Add] TR: I-D Action: draft-btw-add-home-07.txt Thread-Index: AQHWXqeUzZYtVRXXYkCU6G2sVaXhWakRsK8wgAGD3XA= Date: Wed, 22 Jul 2020 07:29:06 +0000 Message-ID: <25088_1595402947_5F17EAC3_25088_293_1_787AE7BB302AE849A7480A190F8B9330314FFAFB@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> References: <159438950508.10283.6338787113671554159@ietfa.amsl.com> <23877_1594815149_5F0EF2AD_23877_384_1_787AE7BB302AE849A7480A190F8B9330314F9783@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <20200720150751.GA14985@nic.fr> <17264_1595321101_5F16AB0D_17264_254_1_787AE7BB302AE849A7480A190F8B9330314FEE52@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> In-Reply-To: <17264_1595321101_5F16AB0D_17264_254_1_787AE7BB302AE849A7480A190F8B9330314FEE52@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.114.13.247] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Add] TR: I-D Action: draft-btw-add-home-07.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 07:29:12 -0000 SGkgU3TDqXBoYW5lLCANCg0KSSB3YXMgYWJvdXQgdG8gdXBkYXRlIG15IGxvY2FsIGNvcHkgb2Yg dGhlIGRyYWZ0IHRvIGFkZHJlc3Mgb25lIG9mIHlvdXIgY29tbWVudHMsIGJ1dCBJIHNlZSB0aGF0 IHdlIGRvIGFscmVhZHkgaGF2ZSB0aGlzIHRleHQgKHNlZSB0aGUgbGFzdCBzZW50ZW5jZSwgcGFy dGljdWxhcik6DQoNCiAgIFNvbWUgSVNQcyByZWx5IHVwb24gZXh0ZXJuYWwgcmVzb2x2ZXJzIChl LmcuLCBvdXRzb3VyY2VkIHNlcnZpY2Ugb3INCiAgIHB1YmxpYyByZXNvbHZlcnMpOyB0aGVzZSBJ U1BzIHByb3ZpZGUgdGhlaXIgY3VzdG9tZXJzIHdpdGggdGhlIElQDQogICBhZGRyZXNzZXMgb2Yg dGhlc2UgcmVzb2x2ZXJzLiAgVGhlc2UgYWRkcmVzc2VzIGFyZSB0eXBpY2FsbHkNCiAgIGNvbmZp Z3VyZWQgb24gQ1BFcyB1c2luZyB0aGUgc2FtZSBtZWNoYW5pc21zIGxpc3RlZCBhYm92ZS4gIExp a2V3aXNlLA0KICAgdXNlcnMgY2FuIG1vZGlmeSB0aGUgZGVmYXVsdCBETlMgY29uZmlndXJhdGlv biBvZiB0aGVpciBDUEVzIChlLmcuLA0KICAgc3VwcGxpZWQgYnkgdGhlaXIgSVNQKSB0byBjb25m aWd1cmUgdGhlaXIgZmF2b3JpdGUgRE5TIHNlcnZlcnMuICBUaGlzDQogICBkb2N1bWVudCBwZXJt aXRzIHN1Y2ggZGVwbG95bWVudHMuDQoNCkNoZWVycywNCk1lZA0KDQo+ID4gLS0tLS1NZXNzYWdl IGQnb3JpZ2luZS0tLS0tDQo+ID4gRGXCoDogQWRkIFttYWlsdG86YWRkLWJvdW5jZXNAaWV0Zi5v cmddIERlIGxhIHBhcnQgZGUgU3RlcGhhbmUNCj4gPiBCb3J0em1leWVyIEVudm95w6nCoDogbHVu ZGkgMjAganVpbGxldCAyMDIwIDE3OjA4IMOAwqA6IEJPVUNBREFJUg0KPiBNb2hhbWVkDQo+ID4g VEdJL09MTiA8bW9oYW1lZC5ib3VjYWRhaXJAb3JhbmdlLmNvbT4gQ2PCoDoNCj4gPiBkcmFmdC1i dHctYWRkLWhvbWVAaWV0Zi5vcmc7IEFERCBNYWlsaW5nIGxpc3QgKGFkZEBpZXRmLm9yZykNCj4g PiA8YWRkQGlldGYub3JnPiBPYmpldMKgOiBSZTogW0FkZF0gVFI6IEktRCBBY3Rpb246DQo+ID4g ZHJhZnQtYnR3LWFkZC1ob21lLTA3LnR4dA0KPiA+DQo+ID4NCj4gPiBMYXN0IHRoaW5nLCB0aGlz IHByb3Bvc2FsLCBsaWtlIG1vc3QgKGFsbD8pIEFERCBwcm9wb3NhbHMgaXMgc2lsZW50DQo+ID4g YWJvdXQgdGhlIHJpc2tzIG9mIHVzaW5nIHRoZSAiZGVmYXVsdCIgKGluZGljYXRlZCBieSB0aGUg YWNjZXNzDQo+ID4gbmV0d29yaykgcmVzb2x2ZXIuIElmIHBlb3BsZSBuZWVkIERvRSwgdGhpcyBp cyBiZWNhdXNlIHRoZXkgZG8gbm90DQo+ID4gdHJ1c3QgdGhpcyByZXNvbHZlciwgYmVjYXVzZSBp dCBsaWVzIG9yIGJlY2F1c2UgaXQgbG9ncyAob3IgYm90aCkuDQo+ID4gVGhpcyBkZXNlcnZlcyBh IHdhcm5pbmcuIFNlY3Rpb24gOSBtZW50aW9ucyBvbmx5IHRoZSByaXNrcyBvZiBhDQo+ID4gdGhp cmQtcGFydHkgaGlqYWNraW5nIERIQ1Agb3IgYSBzaW1pbGFyIHByb3RvY29sLCBub3QgdGhlIHJp c2tzIG9mDQo+IHRoZQ0KPiA+IGRlZmF1bHQgcmVzb2x2ZXIsIGV4Y2VwdCBpbiBhIGxpbWl0ZWQg d2F5IGluIHRoZSBwYXJhZ3JhcMSlICJUaGUgdXNlDQo+IG9mDQo+ID4gRG9IL0RvVCBhbHNvIGRl cGVuZHMgb24gdGhlIHVzZXIncyBwb2xpY2llcy4iDQo+IA0KPiBbTWVkXSBBY3R1YWxseSwgd2Ug aGF2ZSBhIGZ1bGwgcGFyYWdyYXBoIHRvIGNvdmVyIHRoaXM6DQo+IA0KPiAgICBUaGUgdXNlIG9m IERvSC9Eb1QgYWxzbyBkZXBlbmRzIG9uIHRoZSB1c2VyJ3MgcG9saWNpZXMuICBGb3INCj4gZXhh bXBsZSwNCj4gICAgdGhlIHVzZXIgbWF5IGluZGljYXRlIGhpcy9oZXIgY29uc2VudCB0byB1c2Ug KG9yIG5vdCkgdGhlIGxvY2FsbHktDQo+ICAgIGRpc2NvdmVyZWQgRG9IL0RvVCBzZXJ2ZXIgb3Ig cmVxdWVzdCB0byByZXZpZXcgaHVtYW4tcmVhZGFibGUNCj4gcHJpdmFjeQ0KPiAgICBwb2xpY3kg aW5mb3JtYXRpb24gb2YgYSBzZWxlY3RlZCBETlMgc2VydmVyIGFuZCB0byBhc3Nlc3Mgd2hldGhl cg0KPiAgICB0aGF0IEROUyBzZXJ2ZXIgcGVyZm9ybXMgRE5TLWJhc2VkIGNvbnRlbnQgZmlsdGVy aW5nIChlLmcuLA0KPiAgICBbSS1ELnJlZGR5LWFkZC1zZXJ2ZXItcG9saWN5LXNlbGVjdGlvbl0p LiAgVGhlIEROUyBjbGllbnQgaXMNCj4gYXNzdW1lZA0KPiAgICB0byBhZGhlcmUgdG8gdGhlc2Ug cG9saWNpZXMuICBUaGlzIGRvY3VtZW50IGRvZXMgbm90IG1ha2UgYW55DQo+ICAgIGFzc3VtcHRp b24gYWJvdXQgdGhlIHN0cnVjdHVyZSBvZiBzdWNoIHBvbGljaWVzIG5vciBtYW5kYXRlcw0KPiBz cGVjaWZpYw0KPiAgICByZXF1aXJlbWVudHMuICBTdWNoIHBvbGljaWVzIGFuZCB0aGVpciBoYW5k bGluZyBpcyBvdXQgb2Ygc2NvcGUuDQo+IA0KPiBXZSB3YW50ZWQgdG8gYXZvaWQgZ29pbmcgdG9v IGZhciBpbiB0aGUgInBvbGljeSBsYW5kIiwgaGVuY2UgdGhpcw0KPiB3b3JkaW5nLg0KPiANCj4g QXMgb2YgdG9kYXkncyBkZXBsb3ltZW50cywgYSB1c2VyIGNhbiBvdmVycmlkZSB0aGUgY29uZmln dXJhdGlvbg0KPiByZWNlaXZlZCBmcm9tIHRoZSBuZXR3b3JrLiBXZSBoYXZlIGEgc2VudGVuY2Ug Zm9yIHVubWFuYWdlZCBDUEVzOg0KPiANCj4gIm92ZXJyaWRlIHRoZSBETlMgY29uZmlndXJhdGlv biBpdCByZWNlaXZlcyBmcm9tIHRoZSBJU1Atc3VwcGxpZWQiDQo+IA0KPiBXZSBjYW4gYWRkIGEg c2ltaWxhciBvbmUgZm9yIG1hbmFnZWQgQ1BFcy4NCg0KCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNlIG1lc3NhZ2UgZXQg c2VzIHBpZWNlcyBqb2ludGVzIHBldXZlbnQgY29udGVuaXIgZGVzIGluZm9ybWF0aW9ucyBjb25m aWRlbnRpZWxsZXMgb3UgcHJpdmlsZWdpZWVzIGV0IG5lIGRvaXZlbnQgZG9uYwpwYXMgZXRyZSBk aWZmdXNlcywgZXhwbG9pdGVzIG91IGNvcGllcyBzYW5zIGF1dG9yaXNhdGlvbi4gU2kgdm91cyBh dmV6IHJlY3UgY2UgbWVzc2FnZSBwYXIgZXJyZXVyLCB2ZXVpbGxleiBsZSBzaWduYWxlcgphIGwn ZXhwZWRpdGV1ciBldCBsZSBkZXRydWlyZSBhaW5zaSBxdWUgbGVzIHBpZWNlcyBqb2ludGVzLiBM ZXMgbWVzc2FnZXMgZWxlY3Ryb25pcXVlcyBldGFudCBzdXNjZXB0aWJsZXMgZCdhbHRlcmF0aW9u LApPcmFuZ2UgZGVjbGluZSB0b3V0ZSByZXNwb25zYWJpbGl0ZSBzaSBjZSBtZXNzYWdlIGEgZXRl IGFsdGVyZSwgZGVmb3JtZSBvdSBmYWxzaWZpZS4gTWVyY2kuCgpUaGlzIG1lc3NhZ2UgYW5kIGl0 cyBhdHRhY2htZW50cyBtYXkgY29udGFpbiBjb25maWRlbnRpYWwgb3IgcHJpdmlsZWdlZCBpbmZv cm1hdGlvbiB0aGF0IG1heSBiZSBwcm90ZWN0ZWQgYnkgbGF3Owp0aGV5IHNob3VsZCBub3QgYmUg ZGlzdHJpYnV0ZWQsIHVzZWQgb3IgY29waWVkIHdpdGhvdXQgYXV0aG9yaXNhdGlvbi4KSWYgeW91 IGhhdmUgcmVjZWl2ZWQgdGhpcyBlbWFpbCBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2Vu ZGVyIGFuZCBkZWxldGUgdGhpcyBtZXNzYWdlIGFuZCBpdHMgYXR0YWNobWVudHMuCkFzIGVtYWls cyBtYXkgYmUgYWx0ZXJlZCwgT3JhbmdlIGlzIG5vdCBsaWFibGUgZm9yIG1lc3NhZ2VzIHRoYXQg aGF2ZSBiZWVuIG1vZGlmaWVkLCBjaGFuZ2VkIG9yIGZhbHNpZmllZC4KVGhhbmsgeW91LgoK From nobody Wed Jul 22 00:55:07 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7BBE33A0F78 for ; Wed, 22 Jul 2020 00:55:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M9LNIj54cinn for ; Wed, 22 Jul 2020 00:55:03 -0700 (PDT) Received: from mail-il1-x129.google.com (mail-il1-x129.google.com [IPv6:2607:f8b0:4864:20::129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9E7993A0F6F for ; Wed, 22 Jul 2020 00:55:03 -0700 (PDT) Received: by mail-il1-x129.google.com with SMTP id e18so506483ilr.7 for ; Wed, 22 Jul 2020 00:55:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hOnQHcgdiQIWTtJ8hEKP4K3gPy4Xm6CNWPRtHxX42rQ=; b=b6ez3rFSn76bdi6H2qS2NHp+ht0VMA5fKOAhqk3jaWsiX+YaggeGhjFmHT+iJWNTj8 +SzTuIknag+dZlzt3iW4Vppdrd+sepPuo/tTFh1ahgILxJhgf8BxNjrzOVqkYI74oOmt DM3wHX+5Omvhz6Rx3kFCD3ZC3NYm3NhiKJ9HGYLiB6467d3fSBWNlQvRvLxJBP+gtnbc wDs8hEwpToZimR42zu41xUQw4BOqyN7zbTtC/FfrIUFj2SwhASGGCtVzy/5aUkPWZ7eD 7lZ+mLi2kiK6/wRtZg6MYKxmbefXSKiZt3brDWUuyC8Pl5dSwffED6Z9D4Zwi4gEn06l XCsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hOnQHcgdiQIWTtJ8hEKP4K3gPy4Xm6CNWPRtHxX42rQ=; b=ij/GX3+aghgAKHmOutBVR3DsZ4p1LUpdqfuoJCMO5GW2CHvVQPaUni7sV/dINZOSj9 Wgkuf84P8n9BwAxboqptixs5nDIib+mXTzzYF5zdANFRAiYtQnvmom1EsP8LfMotDsZt ADeMEgQ9hJD71roQ/ymW9kGSBd9ZJaGlgt/ntzpcMgCqq5pSR3kOzuuyWDhjVeDjwmdq 0D/G4ifOVyh1NL5zhT0rQbW+mH+th93UyHAy42bKfej8AG2jpVuQRN0vD4Se6rMa/cJF gPRg+LChd6e/M2EPTtY+LWX6QcNUIu3OHblh0NF22UZA1iHdpKxRmFiJe5QqQR+FbWO5 1KzA== X-Gm-Message-State: AOAM533H2bxJ4jS/LnWP3DaG65N2fRCfbmdxZbfZNTjRWGP49P07qJ2T fRZcB8SFN/fDV+wiNzkso3ANvIkjnS8kmQ/zehyUkt5YE4A= X-Google-Smtp-Source: ABdhPJyy3/FS+8DtzaEYM7mFeYyVIjsu6gRRmbV3W4Xh2Elg9bbKrCaltV8C7xQY/kUJ8I3C7bkN/r/07MbIhtzn6ZY= X-Received: by 2002:a92:c530:: with SMTP id m16mr32925899ili.300.1595404502864; Wed, 22 Jul 2020 00:55:02 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: From: tirumal reddy Date: Wed, 22 Jul 2020 13:24:50 +0530 Message-ID: To: Tommy Jensen Cc: Tommy Jensen , Andrew Campling , "add@ietf.org" , Eric Rescorla , Martin Thomson Content-Type: multipart/alternative; boundary="000000000000aa9bc905ab030e0a" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 07:55:07 -0000 --000000000000aa9bc905ab030e0a Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Tommy, Please see inline On Tue, 21 Jul 2020 at 21:05, Tommy Jensen wrote: > Hey Tiru, > > Thanks for sharing. In section 7 of your draft which defines the mechanis= m > you=E2=80=99re proposing for PKI secures communication with an RFC1918 ad= dress, I > see one problem: > > > Let's suppose that "example.net" is pre-configured as a verified resolv= ed > in the browser or OS. > > This depends on the DNS client already having =E2=80=9Cexample.com=E2=80= =9D configured as > a resolver. This doesn=E2=80=99t scale well. In order for a client to wor= k out of > the box with my ISP, it would need to come preconfigured with all known > ISPs or provide a UX to add example.com as a resolver. The first doesn=E2= =80=99t > scale any better than pre-shared HOSTS files, and the second requires the > user to get involved rather than providing security by default. While we > are using a pre shared list today, it=E2=80=99s incredibly short and not = a viable > solution in the long term nor something I would want have as a requiremen= t > for mainstream consumer scenarios. > Yes, a pre-configured list of trusted resolvers is a short-term solution and will not scale. > > One approach (which may be in your draft and I simply missed it) would be > to make a connection to the parent of the DHCP/RA domain by dropping the > leftmost labels and verify the certificate the same way. I would expect t= he > CPE to provide the IP hint for that resolver as well. This at least would > allow bootstrapping without any preconfiguration or user involvement need= ed > unless I=E2=80=99m missing something? > Agreed, it works provided the domains and CPE are managed by the ISP and an (out-of-band) agreement with the client to enable wild-card white-listing for the ISP managed sub-domains. Please see https://tools.ietf.org/html/draft-btw-add-home-07#section-7.1.2, it discusses that a DoH/DoT client can learn the local DoH/DoT forwarder using DHCP/RA and auto-upgrade because the left-most label of the pre-configured ADN would match the subjectAltName value in the DNS server certificate. > This should negate the need for the work described here requiring other > token types for going from a DHCP message with novel server identifiers t= o > a secure DNS connection to a local address. > I don't get the above line. > > > If the insecurely discovered DoH/DoT server is not pre-configured in > the OS or browser, the client must validate the signatory (e.g., > cryptographically attested by the ISP [ > I-D.reddy-add-server-policy-selection > > ]). > https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-03 discusses how a DNS client can authenticate it is connecting to a DoH/DoT server host= ed by a specific organization (e.g., ISP). This information is cryptographically signed to attest its authenticity. It is particularly useful when the DoH/DoT server is insecurely discovered (e.g., using DHP/RA) and prevents the client from connecting to an attacker's server. In addition, the insecurely discovered ADN need not be pre-configured in the client. Cheers, -Tiru > > Thanks, > Tommy Jensen > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > How can you secure your DNS queries? https://aka.ms/dohblogpost > > ------------------------------ > *From:* Add on behalf of tirumal reddy < > kondtir@gmail.com> > *Sent:* Tuesday, July 21, 2020 3:32 AM > *To:* Tommy Jensen > *Cc:* Andrew Campling ; add@ietf.org < > add@ietf.org>; Eric Rescorla ; Martin Thomson < > mt@lowentropy.net> > *Subject:* [EXTERNAL] Re: [Add] Practical Observations from Encrypted DNS > Deployments by Network Operators > > Hi Tommy, > > Please see inline > > On Tue, 21 Jul 2020 at 05:50, Tommy Jensen 40microsoft.com@dmarc.ietf.org> wrote: > > Hey Andrew, > > Thank you for bringing this to the WG. I think it's important to talk > through the ISP perspective. Given the two documents are intertwined, I'l= l > address your proposal directly despite the subject being your information= al > document. > > andrew> However, since the timeframe for this will be necessarily longer > for many users, my assumption is that the preference for most would be to > enlarge the potential pool of encrypted DNS users as quickly as possible. > > Part of my feedback on this document was that this assumption does not > hold true for me. I would rather avoid building protocols or systems we'l= l > regret later than maximize the number of encrypted DNS users ASAP. I'm > about to write out the verbose version of why I don't feel that way. Plea= se > feel free to correct anything I've misunderstood or overlooked. > > In the spirit of ekr's calls for a threat model, let's walk through an > attacker scenario. Let's say I discover 192.168.1.100 as a DNS server fro= m > my CPE from my home Wi-Fi network. I did this via DHCP, which is an > insecure protocol. This proposal has a third party vouch for the > authenticity, in this case, the separately maintained mapping by DNS clie= nt > vendors. > > > It is possible to host a DoT/DoH forwarder on the home router, the > forwarder can use a certificate that can be validated by PKI and the CPE > can continue to use private IP addresses. Please see > https://tools.ietf..org/html/draft-btw-add-home-07#section-7.1 > for > more details. > > > > I do not see this ISP list the same as the current Windows list of public > DoH servers, and I am not willing to accept the risk posed by maintaining > this new mapping. Where the existing SPAU list we rely on contains only > publicly documented and PKI verifiable names, the proposed mechanism does > not. This means I'm not just confirming what someone else has already > validated; I'm now responsible for the maintenance of the original > ownership verification for an ever-increasing number of ISPs which will > include enterprises running their own internal networks also eager to avo= id > infrastructure updates on their end. I will not do that, especially for a > stop-gap feature whose value will fade away as a proper bootstrapping > mechanism is deployed. > > The proposal I'm coauthoring ( > https://tools..ietf.org/html/draft-pauly-add-resolver-discovery-01#sectio= n-5 > ) > won't work for RFC1918 addresses because they can't be verified using PKI= . > I'm ok with this, as DNS use of HTTPS should not be less secure than any > other use of HTTPS. > > Since DHCP discovery of 192.168.1.100 is insecure to start with and PKI > can't be used to secure RFC1918 addresses, our choices are to invent a ne= w > trust mechanism (such as your proposal) or settle for opportunistic > security. For example, a DNS client receiving an RFC1918 address can simp= ly > try it with DoT without concern for hostname... Literally just add TLS SP= AU > style. In a threat model, what this provides is protection against multip= le > eavesdroppers, reducing the eavesdropper count between the client and the > CPE to a maximum of one (whoever convinces the client to use their spoofe= d > DHCP message). It does not guarantee the identity of who you are sending > queries to. However, this is no worse than before, as you have the same > lack of authentication with classic DNS to a DHCP-discovered address but > have now prevented eavesdropping by a third party. > > If this is viewed as a regression because an attacker can then prevent th= e > CPE from inspecting classic DNS traffic coming through it for ISP provide= d > filtering purposes, then we're back to inventing a new trust mechanism. > From my perspective, this is a non-starter. That leaves us with two > alternatives I can think of: make DHCP (or its replacement) secure, or > allow use of classic DNS on the client to CPE link. The former has > previously been determined to be a hard problem. The latter is our curren= t > situation. > > This is my in-depth way of asking: is rushing to get encrypted DNS to as > many people as possible worth either settling for opportunistic protectio= n > or inventing a whole new trust mechanism (which will be permanent whether > we wish it to be temporary or not, Paul Vixie recently shared some wisdom > along this line)? My answer here in order are "maybe" and "no" but I'd li= ke > to hear what others think. > > I hear you that deploying public DNS servers is costly and not within you= r > interests. I also hear you that updating CPEs is time consuming. I simply > don't see a way to avoid those things and continue to enable DNS to a CPE > while providing the same level of security as DoH to a public resolver > without either securing DHCP (which is hard and brings us back to updatin= g > CPEs) or inventing a new trust mechanism for private addresses (which add= s > a heavy burden to DNS clients for stop-gap work). > > > The home network itself is susceptible to both internal and external > attacks. https://tools.ietf.org/html/draft-btw-add-home-07#section-9 > discusses > various attacks possible and the mechanisms endpoint can use to avoid usi= ng > the attacker's DoH/DoT server. > > Cheers, > -Tiru > > > > I welcome any comments or corrections. I'd be happy to be wrong. > > Thanks, > Tommy Jensen > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > How can you secure your DNS queries? https://aka.ms/dohblogpost > ------------------------------ > *From:* Add on behalf of Andrew Campling > > *Sent:* Monday, July 20, 2020 3:22 PM > *To:* Eric Rescorla > *Cc:* add@ietf.org ; Martin Thomson > *Subject:* [EXTERNAL] Re: [Add] Practical Observations from Encrypted DNS > Deployments by Network Operators > > > *Ekr* > > To clarify, there are two issues to overcome here, (i) use of RFC1918 > private addresses by the CPE (to facilitate SPAU) and (ii) support for DN= S > forwarders to maintain the full functionality provided by network operato= rs > that is described in the document. The desired end state is as you > describe: > > > > Client <------- TLS --------> CPE <------- TLS --------> ISP Resolver > > > > Whilst it would be ideal to deal with both of the above issues > simultaneously, pragmatically it may be necessary to deal with them > sequentially given the potential for delays in upgrading CPE software. > Since there are already some proposed discovery methods that deal with th= e > private addresses, it could make sense for to implement a two-step soluti= on > that first solves the private address issue in the short-term whilst the > CPE software upgrade is deployed. This would at least maintain support f= or > the user=E2=80=99s chosen resolver via encrypted DNS using SPAU whilst a = CPE > software upgrade is QA=E2=80=99d by the network operator and then deploye= d. > > > > Of course others may think it better to go with a single-step approach > that upgrades the CPE software to maintain support for DNS forwarders and > deals with the private address issue for SPAU at the same time. However, > since the timeframe for this will be necessarily longer for many users, m= y > assumption is that the preference for most would be to enlarge the > potential pool of encrypted DNS users as quickly as possible. > > > > Does this help? > > > > > > *Andrew* > > > > > > *From:* Eric Rescorla > *Sent:* 20 July 2020 16:03 > *To:* Andrew Campling > *Cc:* Martin Thomson ; add@ietf.org > *Subject:* Re: [Add] Practical Observations from Encrypted DNS > Deployments by Network Operators > > > > Hi Andrew, > > Ignoring the discovery question for a moment, I guess I'm not entirely > clear on what your desired outcome in terms of network topology is. > > As described in your draft, at present the clients send DNS packets to > the forwarder on the CPE, which then selectively forwards queries to > the main ISP resolver. However, in a world where the DNS is encrypted, > then this would require that the encryption be terminated at the > CPE and then re-originated to the ISP resolver, like so: > > > Client <------- TLS --------> CPE <------- TLS --------> ISP Resolver > > Is that your desired outcome? If so, it seems to come into conflict > with your points in S 5.2 about the difficulty of upgrading the CPE. > If not, maybe I just don't understand. In either case, perhaps you > can elaborate. > > -Ekr > > > > > On Mon, Jul 20, 2020 at 7:47 AM Andrew Campling < > andrew.campling@419.consulting> wrote: > > On Thu, Jul 16, 2020, at 00:12, Martin Thomson wrote: > > > Your draft seems to be making a case for supporting forwarders, but I'm > not clear on what supporting forwarders looks like. I understand that yo= u > might not have specific ideas about what this support might look like, bu= t > I don't see any real requirements here either. > > > > It would really help if the draft would clearly articulate what your > desired outcome is. > > Sorry for the lack of clarity. The primary intent of the document is to > provide information as we have the impression that at least some client > developers may not have good visibility of common network operator > architectures and practices outside of the US. By providing such clarity > we hope to see implementations that are sympathetic to the environment in= to > which they are being deployed in order to maximise the chances of working > correctly, ideally via SPAU as manual configuration of DNS settings by th= e > majority of users seems unlikely. > > In a nut shell, any ADD solution should measure itself to see whether it > meets the use case described in this document, at least one is needed tha= t > does. > > > Andrew > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > --000000000000aa9bc905ab030e0a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Tommy,

Please see i= nline

On Tue, 21 Jul 2020 at 21:05, Tommy Jensen <Jensen.Thomas@microsoft.com> wrote:
Hey Tiru,

Thanks for sharing. In section 7 of your draft which defines the mecha= nism you=E2=80=99re proposing for PKI secures communication with an RFC1918= address, I see one problem:

>=C2=A0Let's= suppose that "exampl= e.net" is pre-configured as a verified resolved in the b= rowser or OS.

This depends on the= DNS client already having =E2=80=9Cexample.com=E2=80=9D configured as a resolver. This doesn= =E2=80=99t scale well. In order for a client to work out of the box with my ISP, it would need to come pre= configured with all known ISPs or provide a UX to add example.com as a resolver. The first doesn= =E2=80=99t scale any better than pre-shared HOSTS files, and the second req= uires the user to get involved rather than providing security by default. While we are using a p= re shared list today, it=E2=80=99s incredibly short and not a viable soluti= on in the long term nor something I would want have as a requirement for ma= instream consumer scenarios.

=
Yes, a pre-configured list of trusted resolvers is a short-term soluti= on and will not scale.
=C2=A0

One approach (which may be in your draft and I simply missed it) would= be to make a connection to the parent of the DHCP/RA domain by dropping th= e leftmost labels and verify the certificate the same way. I would expect t= he CPE to provide the IP hint for that resolver as well. This at least would allow bootstrapping without any= preconfiguration or user involvement needed unless I=E2=80=99m missing som= ething?

Agreed, it works provi= ded the domains and CPE are managed by the ISP and an (out-of-band) agreeme= nt with the client to=C2=A0enable wild-card white-listing for the ISP manag= ed sub-domains. Please see=C2=A0https://tools.ietf.org/html/draft-btw-add-= home-07#section-7.1.2, it discusses that a DoH/DoT client can learn the= local DoH/DoT forwarder using DHCP/RA and auto-upgrade because the left-mo= st label of the pre-configured ADN would match the subjectAltName value in = the DNS server certificate.=C2=A0
=C2=A0
This should negate the need for = the work described here requiring other token types for going from a DHCP m= essage with novel server identifiers to a secure DNS connection to a local addres= s.

I don't get the above li= ne.
=C2=A0

>=C2=A0If the in= securely discovered DoH/DoT server is not pre-configured in the OS or browser, the client must validate the signatory (e.g., cryptographically attes= ted by the ISP [I-D.reddy-add-server-policy-selection]).
=

https://tools.ietf.org/html/draft-reddy-add-ser= ver-policy-selection-03=C2=A0discusses how a DNS client can authenticat= e it is connecting to a DoH/DoT=C2=A0server= =C2=A0hosted by a specific organization (e.g., ISP). This information is cr= yptographically signed to attest its authenticity. It is particularly usefu= l when the DoH/DoT=C2=A0server=C2=A0is inse= curely discovered (e.g., using DHP/RA) and prevents the client from connect= ing to an attacker's=C2=A0server. In ad= dition, the insecurely discovered ADN need not be pre-configured in the cli= ent.

Cheers,
-Tiru
=C2=A0

Thanks,
Tommy Jensen
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
How can you secure your DNS queries? https://aka.ms/dohblogpost=C2=A0

From= : Add <add= -bounces@ietf.org> on behalf of tirumal reddy <kondtir@gmail.com>
Sent: Tuesday, July 21, 2020 3:32 AM
To: Tommy Jensen <Jensen.Thomas=3D40microsoft.com@dmarc.ietf.org>=
Cc: Andrew Campling <andrew.campling@419.consulting>; add@ietf.org <add@ietf.org>; Eric Rescorla = <ekr@rtfm.com>;= Martin Thomson <= mt@lowentropy.net>
Subject: [EXTERNAL] Re: [Add] Practical Observations from Encrypted = DNS Deployments by Network Operators
=C2=A0
Hi Tommy,

Please see inline

On Tue, 21 Jul 2020 at 05:50, Tommy Jensen <Jensen.Thom= as=3D40= microsoft.com@dmarc.ietf.org> wrote:
Hey Andrew,

Thank you for bringing this to the WG. I think it's important to tal= k through the ISP perspective. Given the two documents are intertwined, I&#= 39;ll address your proposal directly despite the subject being your informational document.

andrew>=C2=A0However, since the timeframe for this will be necessarily longer for many users, my assumption is that the prefe= rence for most would be to enlarge the potential pool of encrypted DNS user= s as quickly as possible.=C2=A0

Part of my feedback on this document was that this assumption does not hold= true for me. I would rather avoid building protocols or systems we'll = regret later than maximize the number of encrypted DNS users ASAP. I'm = about to write out the verbose version of why I don't feel that way. Please feel free to correct anything I'= ve misunderstood or overlooked.

In the spirit of ekr's calls for a threat model,=C2=A0let's walk= through an attacker scenario. Let's say I discover 192.168.1.100 as a = DNS server from my CPE from my home Wi-Fi network. I did this via DHCP, which is an insecure protocol. This proposal has a th= ird party vouch for the authenticity, in this case, the separately maintain= ed mapping by DNS client vendors.

It is possible to host a DoT/DoH forwarder on the home router, the for= warder can use a certificate that can be validated by PKI and the CPE can c= ontinue to use private IP addresses. Please see=C2=A0https://t= ools.ietf..org/html/draft-btw-add-home-07#section-7.1=C2=A0for more details.
=C2=A0

I do not see this ISP list the same as the current Windows list of public D= oH servers, and I am not willing to accept the risk posed by maintaining th= is new mapping. Where the existing SPAU list we rely on contains only publi= cly documented and PKI verifiable names, the proposed mechanism does not. This means I'm not just confir= ming what someone else has already validated; I'm now responsible for t= he maintenance of the original ownership verification for an ever-increasin= g number of ISPs which will include enterprises running their own internal networks also eager to avoid infrastructure upd= ates on their end. I will not do that, especially for a stop-gap feature wh= ose value will fade away as a proper bootstrapping mechanism is deployed.

The proposal I'm coauthoring (https://tools..= ietf.org/html/draft-pauly-add-resolver-discovery-01#section-5) won't work for RFC1918 addresses because they can't be verified us= ing PKI. I'm ok with this, as DNS use of HTTPS should not be less secur= e than any other use of HTTPS.=C2=A0

Since DHCP discovery of 192.168.1.100 is insecure to start with and PKI can= 't be used to secure RFC1918 addresses, our choices are to invent a new= trust mechanism (such as your proposal) or settle for opportunistic securi= ty. For example, a DNS client receiving an RFC1918 address can simply try it with DoT without concern for hostname= ... Literally just add TLS SPAU style. In a threat model, what this provide= s is protection against multiple eavesdroppers, reducing the eavesdropper c= ount between the client and the CPE to a maximum of one (whoever convinces the client to use their spoofed= DHCP message). It does not guarantee the identity of who you are sending q= ueries to. However, this is no worse than before, as you have the same lack= of authentication with classic DNS to a DHCP-discovered address but have now prevented eavesdropping by a= third party.

If this is viewed as a regression because an attacker can then prevent the = CPE from inspecting classic DNS traffic coming through it for ISP provided = filtering purposes, then we're back to inventing a new trust mechanism.= From my perspective, this is a non-starter. That leaves us with two alternatives I can think of: make DHCP (or its rep= lacement) secure, or allow use of classic DNS on the client to CPE link. Th= e former has previously been determined to be a hard problem. The latter is= our current situation.

This is my in-depth way of asking: is rushing to get encrypted DNS to as ma= ny people as possible worth either settling for opportunistic protection or= inventing a whole new trust mechanism (which will be permanent whether we = wish it to be temporary or not, Paul Vixie recently shared some wisdom along this line)? My answer here in= order are "maybe" and "no" but I'd like to hear wh= at others think.=C2=A0

I hear you that deploying public DNS servers is costly and not within your = interests. I also hear you that updating CPEs is time consuming. I simply d= on't see a way to avoid those things and continue to enable DNS to a CP= E while providing the same level of security as DoH to a public resolver without either securing DHCP (which i= s hard and brings us back to updating CPEs) or inventing a new trust mechan= ism for private addresses (which adds a heavy burden to DNS clients for sto= p-gap work).=C2=A0

The home network itself is susceptible to both internal and external a= ttacks.=C2=A0https://tools.ietf.org/html/draft-btw-add-home-07#s= ection-9=C2=A0discusses various attacks possible and the mechanisms endpoint can use to avoid usin= g the attacker's DoH/DoT server.

Cheers,
-Tiru
=C2=A0

I welcome any comments or corrections. I'd be happy to be wrong.

Thanks,
Tommy Jensen
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
How can you secure your DNS queries? https://aka.ms/dohblogpost=C2=A0
From: Add <add-bounces@ietf.org> on behalf of Andrew= Campling <andrew.campling@419.consulting>
Sent: Monday, July 20, 2020 3:22 PM
To: Eric Rescorla <ekr@rtfm.com>
Cc: add@ietf.org <add@ietf.org&g= t;; Martin Thomson <mt@lowentropy.net>
Subject: [EXTERNAL] Re: [Add] Practical Observations from Encrypted = DNS Deployments by Network Operators
=C2=A0

Ekr

To clarify, there are two issues to overc= ome here, (i) use of RFC1918 private addresses by the CPE (to facilitate SP= AU) and (ii) support for DNS forwarders to maintain the full functionality = provided by network operators that is described in the document.=C2=A0 The desired end state is as you descri= be:

=C2=A0

Client =C2=A0<------- TLS --------> =C2=A0CPE =C2=A0<------- TL= S --------> =C2=A0ISP Resolver

=C2=A0

Whilst it would be ideal to deal with bot= h of the above issues simultaneously, pragmatically it may be necessary to = deal with them sequentially given the potential for delays in upgrading CPE= software.=C2=A0 Since there are already some proposed discovery methods that deal with the private addresses, it c= ould make sense for to implement a two-step solution that first solves the = private address issue in the short-term whilst the CPE software upgrade is = deployed.=C2=A0 This would at least maintain support for the user=E2=80=99s chosen resolver via encrypted DNS using SPA= U whilst a CPE software upgrade is QA=E2=80=99d by the network operator and= then deployed.=C2=A0

=C2=A0

Of course others may think it better to g= o with a single-step approach that upgrades the CPE software to maintain su= pport for DNS forwarders and deals with the private address issue for SPAU = at the same time.=C2=A0 However, since the timeframe for this will be necessarily longer for many users, my assum= ption is that the preference for most would be to enlarge the potential poo= l of encrypted DNS users as quickly as possible.=C2=A0

=C2=A0

Does this help?

=C2=A0

=C2=A0

Andrew

=C2=A0

=C2=A0

From: Eric Resco= rla <ekr@rtfm.com&= gt;
Sent: 20 July 2020 16:03
To: Andrew Campling <andrew.campling@419.consulting>
Cc: Martin Thomson <mt@lowentropy.net>; add@ietf.org
Subject: Re: [Add] Practical Observations from Encrypted DNS Deploym= ents by Network Operators

=C2=A0

Hi Andrew,

Ignoring the discovery question for a moment, I guess I'm not entirely<= br> clear on what your desired outcome in terms of network topology is.

As described in your draft, at present the clients send DNS packets to
the forwarder on the CPE, which then selectively forwards queries to
the main ISP resolver. However, in a world where the DNS is encrypted,
then this would require that the encryption be terminated at the
CPE and then re-originated to the ISP resolver, like so:


Client <------- TLS --------> =C2=A0CPE =C2=A0<------- TLS -------= -> ISP Resolver

Is that your desired outcome? If so, it seems to come into conflict
with your points in S 5.2 about the difficulty of upgrading the CPE.
If not, maybe I just don't understand. In either case, perhaps you
can elaborate.

-Ekr


=C2=A0

On Mon, Jul 20, 2020 at 7:47 AM Andrew Campling <andrew.campling@419.consult= ing> wrote:

On Thu, Jul 16, 2020, at 00:12, Martin Thomson <mt@lowentropy.net> wrote:

> Your draft seems to be making a case for supporting forwarders, but I&= #39;m not clear on what supporting forwarders looks like.=C2=A0 I understan= d that you might not have specific ideas about what this support might look= like, but I don't see any real requirements here either.
>
> It would really help if the draft would clearly articulate what your d= esired outcome is.

Sorry for the lack of clarity.=C2=A0 The primary intent of the document is = to provide information as we have the impression that at least some client = developers may not have good visibility of common network operator architec= tures and practices outside of the US.=C2=A0 By providing such clarity we hope to see implementations that are sympathe= tic to the environment into which they are being deployed in order to maxim= ise the chances of working correctly, ideally via SPAU as manual configurat= ion of DNS settings by the majority of users seems unlikely.=C2=A0

In a nut shell, any ADD solution should measure itself to see whether it me= ets the use case described in this document, at least one is needed that do= es.=C2=A0


Andrew

--
Add mailing list
Add@ietf.org
https:/= /www.ietf.org/mailman/listinfo/add

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000aa9bc905ab030e0a-- From nobody Wed Jul 22 01:06:37 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 850343A0F88 for ; Wed, 22 Jul 2020 01:06:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qXGe4v0bOTtm for ; Wed, 22 Jul 2020 01:06:33 -0700 (PDT) Received: from mail-il1-x134.google.com (mail-il1-x134.google.com [IPv6:2607:f8b0:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B56253A0F85 for ; Wed, 22 Jul 2020 01:06:33 -0700 (PDT) Received: by mail-il1-x134.google.com with SMTP id i18so514188ilk.10 for ; Wed, 22 Jul 2020 01:06:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=U/gZxGWb027pe3YLSTOTt1xu0yi5D8iMfYzToB1FKjA=; b=p85eikXicmimiB48P1eO1F8X1EVQ1KPdYR2qXdhJVI9NJ4WB02H+IeaR4kd4xHCRm0 8f+dXgQOBiM7MXUlde/vhQwNmyrWC6XUtY8QSUOkEv5H50VufqMy3ykkeFozHZ8ZAZTd ISeFrURxrV19CKF2je6gh98QdtfOZsoBrFJifosWbrWd8pZCG5Fh9r7ZHZnojByDlk1X jh1oUf78AVcAyV0kGtTxyrYKfw2tzp7mBDbZGpW/LRMoRnGvxu3xm7gfiTV3KhXMy4WD 2cOmaJRuBvF84Wt+RfDHTK5KBdmY82f+VSCtBIRfQ7B8mF6lsTTI1EGqa3TBrrkqYFJl g0dw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=U/gZxGWb027pe3YLSTOTt1xu0yi5D8iMfYzToB1FKjA=; b=UeKUB5tgPDzSbAdbsxwPGWSyt1kV+q3AgAHaZmK3SDsRRDjZoBnjVKn7+4Oy2mXMpM 4lbW6TTaBbxCewQdEi9rGbDtDWKLKoD2nxcFmcSu6Zwe1yH5QDQzfXzlNvKxvMVSbn09 DGyiIoZ4Hx/0Bs/7sgN7N2Ae9j8NdNJsH1F4VtMNzzIzTu60vcmsxmdPmNWFphvIuEvb lttCbaBnLwEytefJaBcizYKBmyiayX+q5tccudIQXLhRZicu3xHvOyDg3bly99Yss7H/ wr8g+ok4iX5l8K2Xsa+lISLkz1T2AELKaX10+6x3XZ3SOfmUIpVT0SRKBBTsNqhJq2NY 8twg== X-Gm-Message-State: AOAM533WCa4ot2bXsr9vWUalF/6LIoGx9tf1jrzMtzvuYRvIJWJNHEl4 zBb8cxd58zOddzihe3xV71lIX8u5Jqpwbt8gfKY= X-Google-Smtp-Source: ABdhPJxg5HlMz1FoXUxEC+p3A6tQHOTdRoZIYocJGdLT73iWl0BU6k0oIZpbqkKT1KscAQ0RdQRvfJpYaSWauHWIZRU= X-Received: by 2002:a92:cf09:: with SMTP id c9mr30999738ilo.214.1595405193013; Wed, 22 Jul 2020 01:06:33 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> In-Reply-To: From: tirumal reddy Date: Wed, 22 Jul 2020 13:36:20 +0530 Message-ID: To: Eric Rescorla Cc: Andrew Campling , "add@ietf.org" , Martin Thomson Content-Type: multipart/alternative; boundary="000000000000cd6ea505ab0337bb" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 08:06:36 -0000 --000000000000cd6ea505ab0337bb Content-Type: text/plain; charset="UTF-8" On Tue, 21 Jul 2020 at 17:59, Eric Rescorla wrote: > > > On Tue, Jul 21, 2020 at 2:42 AM tirumal reddy wrote: > >> On Tue, 21 Jul 2020 at 06:13, Eric Rescorla wrote: >> >>> >>> With that said, I have some concerns about the objective of having the >>> CPE in the user's resolution path. While I certainly can understand >>> the reasons you consider it advantageous, it seems to me that it >>> significantly weakens the user's security posture. Even assuming >>> arguendo that we have a secure mechanism for discovering this case, >>> in practice the CPE seems to have quite a high rate of security >>> issues, including specifically DNS hijacking (see for instance [0]). >>> >> >> Home routers are hardened (for example, see >> https://www.mind.be/openwrtsummit18/2018-10-30-OpenWRT18-prplWRT.html) >> to host network security services to protect the network from internal and >> external attacks. >> > > Some home routers are hardened, but as the link I posted indicated, many > are not. > The attack in the link you posted is because the router management console is using weak/default credentials. The attacker could bruteforce to guess the credentials and change the DNS settings to deliver malware. Typical network security services on home routers do check for weak/default credentials on both routers and IoT devices, and prompt the user to change the credentials. I see ISP deployments with both next-generation and legacy routers. Cheers, -Tiru > > -Ekr > --000000000000cd6ea505ab0337bb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, 21 Jul 2020 at 17:59, Eric Rescor= la <ekr@rtfm.com> wrote:


On Tue, Jul 21, 2020 at 2:42 AM ti= rumal reddy <kond= tir@gmail.com> wrote:
On Tue, 21 Jul 2020 at 06:13= , Eric Rescorla <ekr@r= tfm.com> wrote:

With that said, I have some concerns about the objective of having theCPE in the user's resolution path. While I certainly can understandthe reasons you consider it advantageous, it seems to me that it
signif= icantly weakens the user's security posture. Even assuming
arguendo = that we have a secure mechanism for discovering this case,
in practice t= he CPE seems to have quite a high rate of security
issues, including spe= cifically DNS hijacking (see for instance [0]).

Home routers are hardened (for example, see https://www.mind.be/openwrtsummit18/2018-10-30-OpenWRT= 18-prplWRT.html) to host network security services to protect the netwo= rk from internal and external attacks.=C2=A0
=

Some home routers are hardened, but as the link I poste= d indicated, many are not.

The attack in the link you posted is because the router management consol= e is=C2=A0using weak/default credentials. The attacker could bruteforce to = guess the credentials and change the DNS settings to deliver malware. Typic= al network security services on home routers do check for weak/default cred= entials on both routers and IoT devices, and prompt the user to change the = credentials. I see ISP deployments with both next-generation and legacy rou= ters.

Cheers,
-Tiru
=C2=A0=

-Ekr
--000000000000cd6ea505ab0337bb-- From nobody Wed Jul 22 02:15:36 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5F353A07B9 for ; Wed, 22 Jul 2020 02:15:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F7Xh6QE5tJ4L for ; Wed, 22 Jul 2020 02:15:33 -0700 (PDT) Received: from mail-il1-x12e.google.com (mail-il1-x12e.google.com [IPv6:2607:f8b0:4864:20::12e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D1033A07C7 for ; Wed, 22 Jul 2020 02:15:33 -0700 (PDT) Received: by mail-il1-x12e.google.com with SMTP id p15so642010ilh.13 for ; Wed, 22 Jul 2020 02:15:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=b7GQUzo7OPuadi2aPgO7uZeJPN7QM/xpcCe3P01sWbc=; b=JrOlBUFuaxhvsax8ZrQdje/X6S8cZu2U2O4LdnLyH22lkGxq6T7NfgzflpuaTc1KkA JiLSwQsjq/dLBvMKXVGTtgWXWciUIicnaPqJN0YGwsEDiMFac3VBcciRsCwCszMOgD/z vCfxKbN57DKZBUZNg6Ny+T8/M3Nt6maBA8lmc3E9dGnjDPIwSN5iPPom/1a8Ehena0PI r4trLnWCvT8kP0qDQpK39hkkgI142gHie6zCHT5ciFDf7L/bbipPAh2K7UaYnwaxYTf3 rIwOWNf3co52FfNqPIcmV88wrDS4T3vzkY6ahsMR8zJPaX5BRYAxGQaygQ56DZip1JNi CQFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=b7GQUzo7OPuadi2aPgO7uZeJPN7QM/xpcCe3P01sWbc=; b=P/ASWm5Esox9U4LE+5u5g2AjdY1NTDIT3Xrp8vLrxbFSHC7x0LOULA46mekV/S8fEB bXBw5AB18ejvvoIgeETOpLoEe2nU+hoZ0Ogz2rKAhwnF+Vhix40ZgrGFA9qx30CRFjA9 uWicg32sg++Pcn3goxDHxtpm32fOkUK8kCmwOolAyniwP0KKl9ifTpGvCgBI6msLadxv bfBDzU/R5Rt9WZ47MtvJ0KnZzSyOYi+WamBWkGsprLmnumLFTxDJqeUYhQrvAYPVv/Xs XEZK47mpPqqyAk4J4G+y85hgbbZiG41DA0Ggtn2pZV6yQG5x3kug9S2TPkdNuXla16+2 6pOg== X-Gm-Message-State: AOAM530IRuUlwUQNpSwBahdcFYi6sFhSez269Uyq9n/gsEABpzL4o9vt 2yu113XOcWAojFKQOWRj5klYd94cwyiBcwTFpTvPlxgz X-Google-Smtp-Source: ABdhPJzCJNRuV9VOiTX1uLHMGzvflgIP/mGfmlnpIzpAdLFgye4CwfmB9T3JymwvfCsAtR+RHEMcPOwEwTywk/YVMSg= X-Received: by 2002:a92:9fcb:: with SMTP id z72mr32320459ilk.195.1595409332211; Wed, 22 Jul 2020 02:15:32 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <1672194657.2185.1595334210541@appsuite-gw1.open-xchange.com> In-Reply-To: <1672194657.2185.1595334210541@appsuite-gw1.open-xchange.com> From: tirumal reddy Date: Wed, 22 Jul 2020 14:45:20 +0530 Message-ID: To: Vittorio Bertola Cc: Jim Reid , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000084971205ab042e15" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 09:15:35 -0000 --00000000000084971205ab042e15 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 21 Jul 2020 at 17:53, Vittorio Bertola wrote: > > > > Il 21/07/2020 13:41 Jim Reid ha scritto: > > > > The dprive WG would appear to be the right place for discussing > encryption of DNS traffic. If you=E2=80=99re looking at end-to-end commun= ications > in general, that=E2=80=99s probably far too big and diffuse a topic to si= t inside a > single, all-encompassing tent. > > Well, RFC 7258 is the IETF's policy statement from which Tommy's question > descends, so where was it discussed and approved at the time? That would > look like an appropriate venue. > > By the way, the policy dimensions hit by that question are multiple and g= o > way beyond the simple strive for encryption or for technical security. So= me > parties will prefer continuing to use the local resolver with encrypted > DNS, even if discovered through a process which is only 99.99% secure, > rather than switching to an open global resolver that can be authenticate= d > with 100% certainty. Secure discovery is possible in some scenarios like those discussed in https://tools.ietf.org/html/draft-reddy-add-enterprise-00. In deployments where secure discovery is not possible, client validation techniques like pre-configured TRR or cryptographic assertion of the server identity would ensure the client does not connect to a DoT/DoH server hosted by a specific organization. -Tiru > I think that the IETF should provide the tools so that both things can > happen easily, and then the decision on what to implement is likely to be > non-technical and not driven by threat models (e.g. in Europe there > currently are a lot of concerns and political debates about consolidation= , > competition and "self-preferencing" by the big platforms against local > operators, so I wouldn't be surprised if this popped up there). > > -- > Vittorio Bertola | Head of Policy & Innovation, Open-Xchange > vittorio.bertola@open-xchange.com > Office @ Via Treviso 12, 10144 Torino, Italy > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --00000000000084971205ab042e15 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, 21 Jul 2020 at 17:53, Vittorio Be= rtola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:


> Il 21/07/2020 13:41 Jim Reid <jim@rfc1035.com> ha scritto:
>
> The dprive WG would appear to be the right place for discussing encryp= tion of DNS traffic. If you=E2=80=99re looking at end-to-end communications= in general, that=E2=80=99s probably far too big and diffuse a topic to sit= inside a single, all-encompassing tent.

Well, RFC 7258 is the IETF's policy statement from which Tommy's qu= estion descends, so where was it discussed and approved at the time? That w= ould look like an appropriate venue.

By the way, the policy dimensions hit by that question are multiple and go = way beyond the simple strive for encryption or for technical security. Some= parties will prefer continuing to use the local resolver with encrypted DN= S, even if discovered through a process which is only 99.99% secure, rather= than switching to an open global resolver that can be authenticated with 1= 00% certainty.

Secure discovery is possibl= e in some scenarios like those discussed in=C2=A0https://tools.ietf.org/html/dra= ft-reddy-add-enterprise-00. In deployments where secure discovery is no= t possible, client validation techniques like pre-configured TRR or
cryptographic assertion of the server identity would ensure the=C2=A0cli= ent does not connect to a DoT/DoH=C2=A0server=C2=A0hosted by a specific organization.

-Ti= ru
=C2=A0
I think that the IETF should provide the tools so that both things can = happen easily, and then the decision on what to implement is likely to be n= on-technical and not driven by threat models (e.g. in Europe there currentl= y are a lot of concerns and political debates about consolidation, competit= ion and "self-preferencing" by the big platforms against local op= erators, so I wouldn't be surprised if this popped up there).

--
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vitt= orio.bertola@open-xchange.com
Office @ Via Treviso 12, 10144 Torino, Italy

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--00000000000084971205ab042e15-- From nobody Wed Jul 22 03:46:26 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD8183A0743 for ; Wed, 22 Jul 2020 03:46:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c1jlBtfZc30g for ; Wed, 22 Jul 2020 03:46:23 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 01CBD3A05E2 for ; Wed, 22 Jul 2020 03:46:22 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id e64so2002928iof.12 for ; Wed, 22 Jul 2020 03:46:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=QTALv4ceUmPPC2HRhpIr22hYDVF6nV+PUT/u90LAiOU=; b=GzHWRLaLC8uYmWPbvQ3hAxaX0lw41J8DSK6oeJyghUaPErmhhM9IroyZODHcA3EHMM Oj224yvi/9nc6OJlTc4vem4F0R0bFktdBF+CpQH9vR0ChB5PUZWImv7YblKdgBzBRflR 9xZ1i6cxScUACzyOYZK2yZVWBlCBjfhkyQ4oYUyzaJLDL5gr3kUuOAKSzfyiOvVWA735 U7pgJ+pz5qeZ8iDApkRjUeQSa6osivn2ZHJcXo3vwa0mMyzK35HvH5sfwLWaZgwCeJ9y mlaB4dk4Rok76Cbym5nrS6QmTjcpBjKY40NX7hLeVknBJGK+s9ADXUH2CniBiILL9D89 fd6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=QTALv4ceUmPPC2HRhpIr22hYDVF6nV+PUT/u90LAiOU=; b=bJB2/7RXyjGJsjGFpW5aRJCEYATTYS+uPcohHKUyLVvtv5ATc6ejRv3pid5SxBs+QM NW898nXEccg+xH8INvhExO1e1r0s6i634ENih+j+UPdtTyj2NFV5mYbTLEO3gTs4Y8pP TgFk5tQYWGTy2as6h46funOoDNxeq77v7Dncyx0LLAaxtp0wEhad8PLALNfeKk6Qak+8 thLr2k9Ihqjfb8W5fFEmPFF2SYRx8cAvWLAvwcSLCxB6BAxlmZbwyenK0FjauHNURjOx euk5m3GPDNmOsb8AtmOXyTtJq3Gt0rvARAHS+D9cNMIWutRI10FKpyPAr6NLAXzMKnjT HElQ== X-Gm-Message-State: AOAM531GwzATHCVEM0A3Q7CXnqEcxRORdDSj77+o7x3LzjhOYgkMRhFL 7QLeHyD4vZr+CVeC6xg8m9LbfFs5/6zVxThjEos= X-Google-Smtp-Source: ABdhPJzxqognV8AMXaVMzz2cf1BC1/l0dU8QXwVsRiE9Lc4sEaet+wmj7P5+oF2/8nQTrW2Viu8VXoARupY3FuPzpds= X-Received: by 2002:a5e:9916:: with SMTP id t22mr4315009ioj.21.1595414782067; Wed, 22 Jul 2020 03:46:22 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <7671.1595362961@localhost> <4361a792716b4f9f8f2054e4fddcab34@att.com> In-Reply-To: From: tirumal reddy Date: Wed, 22 Jul 2020 16:16:09 +0530 Message-ID: To: Eric Rescorla Cc: "STARK, BARBARA H" , Michael Richardson , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000005ad49505ab057386" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 10:46:25 -0000 --0000000000005ad49505ab057386 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 22 Jul 2020 at 04:24, Eric Rescorla wrote: > On Tue, Jul 21, 2020 at 3:41 PM STARK, BARBARA H wrote: > >> *[BHS] While my ISP requires me to use the CE router they supply, I=E2= =80=99ve >> never had an issue connecting that to my own router and then running my >> home network from my router. The CE router from my particular ISP (YMMV) >> even automatically passes on the public IPv4 address it acquires and a /= 64 >> IPv6 prefix to my router (so IPv4 just has the single NAT and IPv6 works >> great). I have total ability to choose any router I want and configure t= hat >> router as much as that router vendor=E2=80=99s GUI allows (e.g., Netgear= GUIs don=E2=80=99t >> let you configure the DNS server info it supplies to the LAN via DHCP, e= tc. >> =E2=80=93 it always supplies its own IP address; it does let the user sa= y whether >> its proxy will use DNS info it gets via DHCP or configure static DNS inf= o). >> It seems to me that anyone who is concerned with what the ISP can do >> vis-=C3=A0-vis their home network should be firewalling the ISP CE route= r, >> anyway. I=E2=80=99m at a loss to understand why people are considered = =E2=80=9Cforced=E2=80=9D to >> use the ISP CE router as their home network router, just because they=E2= =80=99re >> forced to use it to terminate the ISP WAN connection. I do understand th= at >> people do this for ease and convenience. But those same people are also >> unlikely to care about changing away from the ISP resolvers. If you care >> enough to want to configure the DNS used in your home network, you shoul= d >> care enough to run your own router between your network and the ISP =E2= =80=9CWAN >> termination device=E2=80=9D. --Barbara* >> > > I'm not quite sure what you're responding to here, because I didn't say > anything about forced, and the concern I'm raising here is not about the > ISP doing things vis-a-vis the user's home network but *attackers* doing > things by compromising the ISP-provided CE router. > > The context of this discussion as I understand it is this: > A number of endpoints are using SPAU mechanisms for converting from Do53 > to Do[TH]. This draft points out that this has the potential to cause the > endpoint to connect directly to the ISP's resolver, bypassing the CPE and > any functions that the CPE performs (presumably the ISP resolver could > perform some but not all of these) and proposes that we develop some > mechanism to avoid bypassing the CPE. At least from my perspective this > particular discussion is not about the ISP versus the consumer but about > whether it is advisable to design a mechanism to keep the CPE in the loop= . > Several security vendors are offering network security services on CPE to protect the home network from internal and external attacks (see https://securehomeplatform.mcafee.com/, https://securingsam.com/), these CPE are hardered and can host a DoH/DoT server. These CPE are already deployed in several ISP deployments. I don't think it is a good idea to exclude CPE from the design because of some legacy routers which anyway cannot upgrade the firmware or have the capability to host a DoH/DoT server= . Cheers, -Tiru > -Ekr > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000005ad49505ab057386 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, 22 Jul 2020 at 04:24, Eric Rescor= la <ekr@rtfm.com> wrote:
On Tue, Jul 21, 2020 at 3:41 PM STARK, BARBARA H <bs7652@att.com> wr= ote:

[BHS] While my ISP requires me to use the CE router they supply, I=E2=80=99ve ne= ver had an issue connecting that to my own router and then running my home = network from my router. The CE router from my particular ISP (YMMV) even au= tomatically passes on the public IPv4 address it acquires and a /64 IPv6 prefix to my router (so IPv4 just has the singl= e NAT and IPv6 works great). I have total ability to choose any router I wa= nt and configure that router as much as that router vendor=E2=80=99s GUI al= lows (e.g., Netgear GUIs don=E2=80=99t let you configure the DNS server in= fo it supplies to the LAN via DHCP, etc. =E2=80=93 it always supplies its o= wn IP address; it does let the user say whether its proxy will use DNS info= it gets via DHCP or configure static DNS info). It seems to me that anyone who is concerned with what the ISP c= an do vis-=C3=A0-vis their home network should be firewalling the ISP CE ro= uter, anyway. I=E2=80=99m at a loss to understand why people are considered= =E2=80=9Cforced=E2=80=9D to use the ISP CE router as their home network router, just because they=E2=80=99re forced to use it to terminate= the ISP WAN connection. I do understand that people do this for ease and c= onvenience. But those same people are also unlikely to care about changing = away from the ISP resolvers. If you care enough to want to configure the DNS used in your home network, you should = care enough to run your own router between your network and the ISP =E2=80= =9CWAN termination device=E2=80=9D. --Barbara

=C2=A0
I'm not quite sure what you're responding to here, because I didn= 't say anything about forced, and the concern I'm raising here is n= ot about the ISP doing things vis-a-vis the user's home network but *at= tackers* doing things by compromising the ISP-provided CE router.

The context of this discussion as I understand it is this:<= /div>
A number of endpoints are using SPAU mechanisms for converting fr= om Do53 to Do[TH]. This draft points out that this has the potential to cau= se the endpoint to connect directly to the ISP's resolver, bypassing th= e CPE and any functions that the CPE performs (presumably the ISP resolver = could perform some but not all of these) and proposes that we develop some = mechanism to avoid bypassing the CPE. At least from my perspective this par= ticular discussion is not about the ISP versus the consumer but about wheth= er it is advisable to design a mechanism to keep the CPE in the loop.

Several security vendors a= re offering network security services on CPE to protect the home network fr= om internal and external attacks (see=C2=A0https://securehomeplatform.mcafee.com/, https://securingsam.com/), these CPE are harde= red and can host a DoH/DoT server. These CPE are already deployed in severa= l ISP=C2=A0deployments. I don't think it is a good idea to exclude CPE = from the design because of some legacy routers which anyway cannot upgrade = the firmware or have the capability to host a DoH/DoT server.
Cheers,
-Tiru


-Ekr

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000005ad49505ab057386-- From nobody Wed Jul 22 04:56:41 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5AAA3A0A83 for ; Wed, 22 Jul 2020 04:56:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Sq2SbGf4-HSH for ; Wed, 22 Jul 2020 04:56:37 -0700 (PDT) Received: from mail-il1-x135.google.com (mail-il1-x135.google.com [IPv6:2607:f8b0:4864:20::135]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2CFFA3A0A82 for ; Wed, 22 Jul 2020 04:56:37 -0700 (PDT) Received: by mail-il1-x135.google.com with SMTP id p15so987440ilh.13 for ; Wed, 22 Jul 2020 04:56:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=SF6zTh9ZwVjfnRy9TTP3JtjHvDycfJXZZe6pxnFY+gI=; b=YaNHS5r5HIQfuc7vAuvJmoE0TuaS1Z7uKxpj8U9ceIsjxcIuJViXvTTsYLcciC89Dn XkQ2C1+DMv9fof4J2fvtntiYCIzDyVhmDIqRlqWf4cbf0WoNtTwpViKHzlRWIvA2hIGK FuHty6CouIEUanVHGs++7NxMOLrBQpVxwkTieXZXHkWnWo3HWQf2qz4jveWTD/UX7oBH tP85m24n6o/CvexQzlsrOG/HJDqdc+fbVwBOD8EXGHPp4si8Ib7EkG/0pWU9VL39eZT2 o3zw7klIYCgQH6oGeeV8YzUolgMcAuE8li0GYczLtn1CUzdn/zvBFXR3qGLvx/1W2JwM eNAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=SF6zTh9ZwVjfnRy9TTP3JtjHvDycfJXZZe6pxnFY+gI=; b=JiQsq3gLn61GSM9lb5NUDlM9DE1bAwLSjsCSElORRQoxMEE+vBTM7iCPbc9I264wIJ ebbiozPn28RxPrjPkKC6V1irZ7vBK6DhsO1jOGiXJp+BlvWXYWMHwuPKMM9H2dSZcihT RCLw7L/m7DsOyptqeYWOUNdybe4mqmlK6X1lxrpP+i51ZBPzDfHXOnJt4T5vC2hU1st4 JRq+f+7e/eWrJPkYZYe0bGZtOmI7fmJuFyS2Plemmmhg0QKY1ji3iKi4iiE6qEcLA8cn fSWwzIQXyyZO5uLOrOHKzjZpXgb2JTMY9YLMM763kS3mYA4d3z6Ypsr0lN1iHRRVpoBf jcQw== X-Gm-Message-State: AOAM530UcJ5HKyC8xkoAkivCvTEO2MiYvluLj0luNuZNWapXAIBQh124 ShTdvZKg9H5YrPN1pjMdpN0uDjvScwrcvYYKCho= X-Google-Smtp-Source: ABdhPJxrJ38EVgIBI/ppxr8ZTaHmFNehAyhgPziv+uVG6YeO3WpPhPqPQvZACwreRQaeBOumpfwWw4gGX7jXu3Uzcj8= X-Received: by 2002:a92:9fcb:: with SMTP id z72mr32888118ilk.195.1595418996338; Wed, 22 Jul 2020 04:56:36 -0700 (PDT) MIME-Version: 1.0 References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> <3f73ed6b-f5fa-b757-42f5-7e0cc7e77113@ericsson.com> In-Reply-To: <3f73ed6b-f5fa-b757-42f5-7e0cc7e77113@ericsson.com> From: tirumal reddy Date: Wed, 22 Jul 2020 17:26:24 +0530 Message-ID: To: Mohit Sethi M Cc: Martin Thomson , "add@ietf.org" Content-Type: multipart/alternative; boundary="0000000000008b750c05ab066e1c" Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 11:56:39 -0000 --0000000000008b750c05ab066e1c Content-Type: text/plain; charset="UTF-8" On Wed, 22 Jul 2020 at 12:10, Mohit Sethi M wrote: > In-line. > > On 7/21/20 12:26 PM, Martin Thomson wrote: > > On Tue, Jul 21, 2020, at 10:40, Deen, Glenn wrote: > >> https://datatracker.ietf.org/doc/html/draft-deen-add-threats-00 > > Hi Glenn, > > > > This is an interesting take on the problem. How do you anticipate > identifying networks, or is that left as an exercise for the reader? One > of the things we have struggled with in general is network identification. > And even that falls short of what Green would seem to demand, which is > network authentication. > > > > I know that there are some EAP methods that integrate network > authentication and therefore might allow for making this call, but I don't > know how portable those approaches are. > > Some? A bit more than 50 right now > ( > https://www.iana.org/assignments/eap-numbers/eap-numbers.xhtml#eap-numbers-4). > > So you can choose any type of credentials: certificates, passwords, > PSKs, PAKEs, SIM cards, one time passwords, and various combinations: > TLS authentication of server and password/PSK authentication inside. > Admittedly, setting up an EAP network with a AAA server can be > challenging for many home users but I would rather solve that problem > than invent a new protocol for doing what EAP does. > It is possible to run AAA server on a home router (see https://openwrt.org/docs/guide-user/network/wifi/freeradius). I could run EAP-pwd on home routers to avoid the problems with shared password, identifying devices using MAC address and the problems with WPA2/WPA3. The main problem is several consumer IoT devices do not yet support any of the EAP methods. -Tiru > > --Mohit > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000008b750c05ab066e1c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, 22 Jul 2020 at 12:10, Mohit Sethi= M <mohit.m.sethi=3D40e= ricsson.com@dmarc.ietf.org> wrote:
In-line.

On 7/21/20 12:26 PM, Martin Thomson wrote:
> On Tue, Jul 21, 2020, at 10:40, Deen, Glenn wrote:
>> https://datatracker.ietf.org= /doc/html/draft-deen-add-threats-00
> Hi Glenn,
>
> This is an interesting take on the problem.=C2=A0 How do you anticipat= e identifying networks, or is that left as an exercise for the reader?=C2= =A0 One of the things we have struggled with in general is network identifi= cation.=C2=A0 And even that falls short of what Green would seem to demand,= which is network authentication.
>
> I know that there are some EAP methods that integrate network authenti= cation and therefore might allow for making this call, but I don't know= how portable those approaches are.

Some? A bit more than 50 right now
(https://www.iana.org/as= signments/eap-numbers/eap-numbers.xhtml#eap-numbers-4).
So you can choose any type of credentials: certificates, passwords,
PSKs, PAKEs, SIM cards, one time passwords, and various combinations:
TLS authentication of server and password/PSK authentication inside.
Admittedly, setting up an EAP network with a AAA server can be
challenging for many home users but I would rather solve that problem
than invent a new protocol for doing what EAP does.
It is possible to run AAA server on a home router (see=C2=A0https= ://openwrt.org/docs/guide-user/network/wifi/freeradius). I could run EA= P-pwd on home routers to avoid the problems with shared password, identifyi= ng devices using MAC address and the problems with=C2=A0WPA2/WPA3. The main= problem is several consumer IoT devices do not yet support any of the EAP = methods.

-Tiru
=C2=A0

--Mohit

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000008b750c05ab066e1c-- From nobody Wed Jul 22 05:00:00 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BDA0C3A0A83 for ; Wed, 22 Jul 2020 04:59:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jck1mDGH-Ina for ; Wed, 22 Jul 2020 04:59:57 -0700 (PDT) Received: from mx3.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A0583A0A82 for ; Wed, 22 Jul 2020 04:59:56 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx3.open-xchange.com (Postfix) with ESMTPS id A877C6A302; Wed, 22 Jul 2020 13:59:53 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1595419193; bh=G9ADMgDfb+fX/saY545uPFJQqLlu72sOdhMVyWKlkP0=; h=Date:From:To:In-Reply-To:References:Subject:From; b=5DzX6ca8LKMzITZE7H6zUpe4jmixRE//l/wykuVYgFbT4pL/3baaOA3sg6ABLPM0j D9jNMd2v+l7GlV0MelZxHdk4pabEBJYT3+USu+FCAdDEOrZWGefuVFi6WMc+cLKEjr 1RffzCmADrUqTdxFU/ncmlhols0UeG7KD0de/5x2GIFCQPa/yqRA7XoFB38JHp8WIP w2ZkpIhlZU8bvZmiN1K5BaVubwJixbPCkLAt0qHhbNcTraoDu4J6D0Z1i14oCIThn3 bPWLQpt8zXBiFpTDlZ/s6qnybpbftBcssS/6JxjlTZCkLl34wGmbpKe7HqComk32X9 ZGEzZaCnSOjPw== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 9840F3C0210; Wed, 22 Jul 2020 13:59:53 +0200 (CEST) Date: Wed, 22 Jul 2020 13:59:53 +0200 (CEST) From: Vittorio Bertola To: Tony Rutkowski , "add@ietf.org" Message-ID: <1656374832.4600.1595419193524@appsuite-gw1.open-xchange.com> In-Reply-To: <452c8cf6-d32e-6971-7839-2275a3565d15@gmail.com> References: <20200721074235.GB29757@nic.fr> <8646010.mL01ujt3hu@linux-9daj> <452c8cf6-d32e-6971-7839-2275a3565d15@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev17 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 11:59:59 -0000 > Il 21/07/2020 20:42 Tony Rutkowski ha scritto: > > I also haven't forgot our previous dialogue on competition complexities, > but chose to spend the time researching and writing on CircleID. > http://www.circleid.com/posts/20200711-addressing-anticompetitive-behaviur-in-internet-standards-bodies/ Very interesting story - also considering Stephen's reply on how RFC 7258 was done without any specific process, I find more and more signs that the IETF for quite some years now has treaded recklessly into policy-intensive territories without giving any real thought at how to do it right :-) It would be interesting to have that discussion, but of course not here. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Wed Jul 22 05:09:46 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7BFE3A0ABA for ; Wed, 22 Jul 2020 05:09:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CViMk58Lr4i7 for ; Wed, 22 Jul 2020 05:09:43 -0700 (PDT) Received: from mx3.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 064423A0AB8 for ; Wed, 22 Jul 2020 05:09:42 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx3.open-xchange.com (Postfix) with ESMTPS id 7E7AF6A302; Wed, 22 Jul 2020 14:09:41 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1595419781; bh=w33GRD8+qeUzj394+7Qkw7AFZ+k+xBLmqxd0cGhGMAs=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=kMttgEzHb4g6Ln/OW6qphUXleD0FSoITBsGrT5CWUFWW5BCuzYuvRwyQxp0WjCo6z dqR2QVmfhrOTnOlx45/G77d27WseMocsdDevMRg4LnLmJITmgrLuMwqSYbncz1+tu+ JvKmo36kDhhKn9gK9rzmN9SHHTwljK/XG//j/mixQA64OC6hcE8ZL94RQ4wkQUVvOS NOEW/CG2Sx3xR2pg6hKc/d7cc9zybYOKQP2hr2YlZv4gEtEkf66xwqHaXj+hZKPvR9 WhSh1OG92ja0L5o2w9wJAEs/5Ww9nNbL5fF5XmINHHTLBiEEPLbl5a817xsQOHIjkA N76hPBJgseFRg== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 703423C0210; Wed, 22 Jul 2020 14:09:41 +0200 (CEST) Date: Wed, 22 Jul 2020 14:09:41 +0200 (CEST) From: Vittorio Bertola To: "Deen, Glenn" Cc: ADD Mailing list Message-ID: <1783302463.4615.1595419781357@appsuite-gw1.open-xchange.com> In-Reply-To: <8BEC224C-8F8C-4226-BEE5-A3383608E15D@comcast.com> References: <8BEC224C-8F8C-4226-BEE5-A3383608E15D@comcast.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev17 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 12:09:45 -0000 > Il 22/07/2020 03:00 Deen, Glenn ha scritto: > > This draft is entirely from the perspective of the user. While it offers examples of what a user may view as in the Green or Yellow or Red, the placement is not proscriptive and can change for different user's perspectives. The idea in the draft is interesting and I think that a user-defined threat model is one of the few workable scenarios, especially for smarter users. However, to lead to proper assessments, the draft should consider all the threats that may hit the user. For example, if I turn on a VPN to escape the risk of a yellow network, the final result can be even worse if the VPN is a scam (e.g. like the seven VPN operators here https://www.theregister.com/2020/07/17/ufo_vpn_database/ ). Same if I use a random open DoH resolver found somewhere on the net (e.g. in a list of "open resolvers you can use" written by who knows who) without knowing who they are: that would be just like using a random open wi-fi network found on the street. I suspect that we would then end up with a socio-economic model, in which I trust people that I know and/or that I have some kind of contract with, or that have been recommended by someone I know / I trust. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Wed Jul 22 05:48:58 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF1953A0B32 for ; Wed, 22 Jul 2020 05:48:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cshNgtim5wSh for ; Wed, 22 Jul 2020 05:48:55 -0700 (PDT) Received: from mail-qv1-xf33.google.com (mail-qv1-xf33.google.com [IPv6:2607:f8b0:4864:20::f33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52EAF3A0B2E for ; Wed, 22 Jul 2020 05:48:55 -0700 (PDT) Received: by mail-qv1-xf33.google.com with SMTP id dm12so925035qvb.9 for ; Wed, 22 Jul 2020 05:48:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding:content-language; bh=INhFVsOJ9dfLfKpHP61Z/qf6KPndK+wkmFApMi5AoFs=; b=dRsaIzOYOxQopxfnb8eluE1SqpkpeotF9jqUwdZxJ2Zq0jJ97IZ0l8+PdfIagwPkni LMxkmLbyupwKCISwi8Cgf6rdoj2NumokTSlpvgZMA2IgaKldcvZyItMeR3DviUd2ROIA PURodsLduxNaO+VNLcABRBsfEQyxQguaIpOqz/sxo+aV+Qy+GLjksHcuh4E6Rbcqz6Rj o8TgO+s4KPcTkYyv9PW5ibrnnbwfSbrJ+TFUY8AhwJOVWDaKYIYNgh/loQ9nai5V6Dht q4jzFHFGFxyAOs60pYsSQl+iUqaFY71PifN7UhpO+eZ1OqXMf+wEmR8HKSn9xnbovP7r 13Qw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding :content-language; bh=INhFVsOJ9dfLfKpHP61Z/qf6KPndK+wkmFApMi5AoFs=; b=Os0MHd/T/yD4QMlYs4Id3XIMA4FIfeUNpcluURGRFlYFNRu5RBw/tvlb5LcR83VShH Iprq+ML3zF3TwXWErn797JJthTTLkLBCbygktUKsjaD+m0Z8SBW7i+5Buwm2pNlVW/Zu j8b9yg+BkS5jn/pFPY+8Xjd20nwrMdBNN/Yfa7kdGIRyAccmhjdFWKbmCUQy9qjnOPYk Vqk3ADZHWbse4NDCk0PI/PXxy+3rYSMxGldc0ow8wYjeunpQs8LsZnzhQzmXDvMr5YCa p0PYlkmj0wdO4YiolKgbHZknrupjuZbJx6v3y+U2Th303wab8eZTvzA/q9qvOPtjv+1I ++5g== X-Gm-Message-State: AOAM5334trXe3OxxmDu8dgfRft3brpOYFOteoTVUFQUHSqi8YltYj46l /BB1dOrxX1yq5rcCNT230w2/I3nb+vY= X-Google-Smtp-Source: ABdhPJxytd8W+yanPpB8U0QRMSCWDErJF7NeVWDlkHSCD9sNl7khAwN8RH3ZuLDxASahCswoxHtOWQ== X-Received: by 2002:a05:6214:14f4:: with SMTP id k20mr31587026qvw.231.1595422134012; Wed, 22 Jul 2020 05:48:54 -0700 (PDT) Received: from [192.168.1.249] (pool-70-106-222-98.clppva.fios.verizon.net. [70.106.222.98]) by smtp.gmail.com with ESMTPSA id x189sm5204372qkc.54.2020.07.22.05.48.52 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 22 Jul 2020 05:48:53 -0700 (PDT) To: Vittorio Bertola , "add@ietf.org" References: <20200721074235.GB29757@nic.fr> <8646010.mL01ujt3hu@linux-9daj> <452c8cf6-d32e-6971-7839-2275a3565d15@gmail.com> <1656374832.4600.1595419193524@appsuite-gw1.open-xchange.com> From: Tony Rutkowski Message-ID: <33ee877a-818d-7bed-726f-8d9604064dde@gmail.com> Date: Wed, 22 Jul 2020 08:48:53 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: <1656374832.4600.1595419193524@appsuite-gw1.open-xchange.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 12:48:57 -0000 Hi Vittorio, An update. The new head of the USDOJ antitrust investigations recently underscored the requirements for "importance of openness, balance, and transparency in standards development."  In addressing the enforcement activities, he notes that "without balancing interests of different members there is little value in a group having openness, due process, or an appeals process, as there would be no diversity of opinion that would leverage such principles into reaching consensus.”  The need for a "balance of interests," and not "restricting consumer choices" were underscored. See at https://www.justice.gov/opa/speech/deputy-assistant-attorney-general-alexander-okuliar-delivers-remarks-intellectual The record of RFC 7258 and its application to IETF work would seem to run afoul of these requirements and potentially expose the Trust and participants in the work to enforcement actions.  Almost all standards groups today have rather explicit antitrust conspiracy mitigation policies that are made incumbent on all participants in their ongoing collaborative activities.  Until those policies are established, these requirements are not actionable in add, even if they should be considered. --tony On 22-Jul-20 7:59 AM, Vittorio Bertola wrote: > >> Il 21/07/2020 20:42 Tony Rutkowski ha scritto: >> >> I also haven't forgot our previous dialogue on competition complexities, >> but chose to spend the time researching and writing on CircleID. >> http://www.circleid.com/posts/20200711-addressing-anticompetitive-behaviur-in-internet-standards-bodies/ > Very interesting story - also considering Stephen's reply on how RFC 7258 was done without any specific process, I find more and more signs that the IETF for quite some years now has treaded recklessly into policy-intensive territories without giving any real thought at how to do it right :-) It would be interesting to have that discussion, but of course not here. > From nobody Wed Jul 22 05:54:34 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D59373A0B33 for ; Wed, 22 Jul 2020 05:54:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8iEsp3QRqpH9 for ; Wed, 22 Jul 2020 05:54:30 -0700 (PDT) Received: from mail-qk1-x72a.google.com (mail-qk1-x72a.google.com [IPv6:2607:f8b0:4864:20::72a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F18C3A0A3E for ; Wed, 22 Jul 2020 05:54:30 -0700 (PDT) Received: by mail-qk1-x72a.google.com with SMTP id l6so1788989qkc.6 for ; Wed, 22 Jul 2020 05:54:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9y/tTDg0VDKAIi5cN7e/uceHy72q0GXhd5/+13X/lMA=; b=ZTr9Yx7dL01sishPGXNeIGiD0vMtIQz5sMLiowkxEF3AyCNR/JmpPyr8y3eeQwgFeO zLnhAQcbmiSFg+jWjtEj7dI3omFgn7PLy/e0sI8gMAw6iF+pmyQnemuizznUORt5IG9/ 6tWRanzE4/sr3CelixyxVeGMi8ayUJWSIaexM7lgIVUkzCPMwNCkIWh+iyGtJb6IF+Mk VnF+hm3Q01ab7D1WvF7jza/Vu36uDF5BX/hC9YKmI9VMHSsZUJ0GorSnMfJXfrk36hH7 sTmDTbsXoRjZYZpo4Db0Bwo+Z2gz2FjXhTfyWvYdCKYL/Wr/vufeeUn4rueESdEC9E2y 8Z2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9y/tTDg0VDKAIi5cN7e/uceHy72q0GXhd5/+13X/lMA=; b=m6coMn3Fobx33IbjBmgMutLqmoqkiW23Ag7jeVSHEZjpkbClnVTe9BVCu7bzwALSpO /N5Z1b8n44HXjgYwuXpbJz1c5qk9SFosfHlBnzrcoMknEm/XJ5lEXnGuf8Q4jwzKC2Ib qV2z7GEAQhXXpxjqsc7ukqa7Y30yJht07ICfEeLHglgew85JN3JLbITcx6EbzIYBuoGD SFhH9zcg2eCBiSg/yOA6A6UHLUSQnFwWMlN724c8tZBau104LeAXWNzsHcR32LGgqjng WEs4ecmVIO/KkezFkIo88Ww8208P0y6oU9coftSUK6fIHK6FI0V5cVBpP1WY+Yun6GB+ SzRw== X-Gm-Message-State: AOAM531IbslIXOAKDhbuJM/3i4JBBVzjBjFMtFtJbMNcrJQk28wWhvEm gIEQcaHUIdEBQ+jH+LtKmvrBe+o5ezVF2IkjnIRERw== X-Google-Smtp-Source: ABdhPJy2MPsOLTK1gcOlcPc7Xa+XPuN9DaedLN1x5Yi9cJuIw7f3kSoBlNgU64C6njwoIDuYhukMXC7WHK44D+2r6uE= X-Received: by 2002:a05:620a:15bc:: with SMTP id f28mr30705315qkk.322.1595422469408; Wed, 22 Jul 2020 05:54:29 -0700 (PDT) MIME-Version: 1.0 References: <5EFC3442-045F-4F89-A4BA-769C1AFE87A4@comcast.com> <20200721074558.GC29757@nic.fr> <9390.1595363364@localhost> In-Reply-To: <9390.1595363364@localhost> From: "Chris Box (BT)" Date: Wed, 22 Jul 2020 13:54:17 +0100 Message-ID: To: Michael Richardson Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000008e4a4105ab073d04" Archived-At: Subject: Re: [Add] IETF108 ADD Agenda X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 12:54:32 -0000 --0000000000008e4a4105ab073d04 Content-Type: text/plain; charset="UTF-8" Michael, I agree it would speed things up to take that approach, but going by Glenn's previous reply I think he's expecting the serious review to take place both on the list, and in the September interim. Chris On Tue, 21 Jul 2020 at 21:29, Michael Richardson wrote: > > Chris Box (BT) wrote: > > The agenda looks like a high-speed tour of the drafts, which is > probably > > necessary, but it's unfortunate there are only 90 minutes to play > with. I > > imagine the time available for questions on each draft will be only a > > minute or two. > > > When do the chairs expect discussion to take place on selecting a > coherent > > set of drafts to move forward with? Will this be on the list > afterwards, or > > is this planned for the interim meeting? I'm hoping we don't need to > wait > > until September for that. > > It seems to me that presenting authors could adjust their slide > time/content > to assume people have read the documents, and to focus on how the proposal > fits into the charter, and into other documents. > > I care, when adopting a document, that it has a good problem > statement/focus, > and that much less about exactly if the details are fleshed out. > > I look forward to many iterations of "Hum now if you have read the document > and have strong technical objections to document X", rather than "do you > like > document X" > > -- > Michael Richardson , Sandelman Software Works > -= IPv6 IoT consulting =- > > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000008e4a4105ab073d04 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Michael,

I agree it would sp= eed things up to take that approach, but going by Glenn's previous repl= y I think he's expecting the serious review to take place both on the l= ist, and in the September interim.

Chris
=


On Tue, 21 Jul 2020 at 21:29, Michael Richardson <mcr+ietf@sandelman.ca> wrote:

Chris Box (BT) <chris.box.ietf@gmail.com> wrote:
=C2=A0 =C2=A0 > The agenda looks like a high-speed tour of the drafts, w= hich is probably
=C2=A0 =C2=A0 > necessary, but it's unfortunate there are only 90 mi= nutes to play with. I
=C2=A0 =C2=A0 > imagine the time available for questions on each draft w= ill be only a
=C2=A0 =C2=A0 > minute or two.

=C2=A0 =C2=A0 > When do the chairs expect discussion to take place on se= lecting a coherent
=C2=A0 =C2=A0 > set of drafts to move forward with? Will this be on the = list afterwards, or
=C2=A0 =C2=A0 > is this planned for the interim meeting? I'm hoping = we don't need to wait
=C2=A0 =C2=A0 > until September for that.

It seems to me that presenting authors could adjust their slide time/conten= t
to assume people have read the documents, and to focus on how the proposal<= br> fits into the charter, and into other documents.

I care, when adopting a document, that it has a good problem statement/focu= s,
and that much less about exactly if the details are fleshed out.

I look forward to many iterations of "Hum now if you have read the doc= ument
and have strong technical objections to document X", rather than "= ;do you like
document X"

--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
=C2=A0-=3D IPv6 IoT consulting =3D-



--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000008e4a4105ab073d04-- From nobody Wed Jul 22 06:17:02 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 360FC3A0928 for ; Wed, 22 Jul 2020 06:17:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lYrnnKlNZ9AJ for ; Wed, 22 Jul 2020 06:17:00 -0700 (PDT) Received: from mail-qt1-x82c.google.com (mail-qt1-x82c.google.com [IPv6:2607:f8b0:4864:20::82c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 08E3A3A0922 for ; Wed, 22 Jul 2020 06:17:00 -0700 (PDT) Received: by mail-qt1-x82c.google.com with SMTP id k18so1722989qtm.10 for ; Wed, 22 Jul 2020 06:16:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=FaRTWnParRjYyLRC4WIuuidxEgOW/D56z4SGyCBZ2ss=; b=KsCnAdzqFMPbzeL8BFaQ0ZCYN0dCdCObtf2bqD/gmYNn5XW80UCckFkPRf9iWtMAm4 rIF2mENR8yKolgbq8w7RBfYXTcP0yTy0TeyugSacFhVEl15ocAqHykyjS5eLrExAwcie jkDZGOApIa9cuS0mLb6HpONA3tCFyTdOLrkIL7/QX+pFTeimBKePRuTnrTITl+WNrTWq ATKSi+sQ5toFdHqzPjMeAHQnk6vIA2kxGh/58cOYZsLN7U9oi2m9D/VNfay7cLaYd9wS zP0av2RjsTvNf3Nd0WdfOiV1jR9ebxTRuhwgzBvzoTVOVApd1yY4EnODBzRCd16VBPjn mFLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=FaRTWnParRjYyLRC4WIuuidxEgOW/D56z4SGyCBZ2ss=; b=NgHdl8q8bjjVwsaiVb0ouIcLxI/kK6oWM2pljpxtALw9GEltPgLTgneSmTT9S+AtWf updwynordJ+fm5B0ROenhlxA9TD5VlkMCCfKDoQu2/mXF1LZ8ZctNMGsxA4zf1eh/rIE x07MVhK9ennirAflW5MTuVjG/dURUYaKIHLGWsyz3QBwZnG/x+jkAORd1ZsW9aQAdCNW 1I06rBHbYr94+UYO/hZBQbgGpD0SUcZ6eJ4ewgREtjSHlHZLDG4xGC6deiayqV0f3kfG 4bWGjXJt71Z4MBSu9JRmn9j1sFtJ15csWUW6Iqp1nnEHnqttAoNu4+YX6wjdqK0dZukM SWUg== X-Gm-Message-State: AOAM533My8WrHs+sDA183MH17BuExI1b8RMQnNnaOCz6/4VcriYxrmf4 MrKM+HetvHHbMl3vQbwS8/3KuXlgU8MPvb7jrw4= X-Google-Smtp-Source: ABdhPJxN93NTIYl/or2RcUsxqG7uD9O6dGDHfvOI7pA37trNUqkosSN4+9WlvHhe2LmVSm+0SG1NoKvQ1YM3bzXpduU= X-Received: by 2002:ac8:47c8:: with SMTP id d8mr32262620qtr.32.1595423819180; Wed, 22 Jul 2020 06:16:59 -0700 (PDT) MIME-Version: 1.0 References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> <20200721095240.GA10868@nic.fr> In-Reply-To: From: "Chris Box (BT)" Date: Wed, 22 Jul 2020 14:16:47 +0100 Message-ID: To: Mohit Sethi M Cc: "Deen, Glenn" , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000002308f05ab078e08" Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 13:17:01 -0000 --00000000000002308f05ab078e08 Content-Type: text/plain; charset="UTF-8" Mohit, > I don't want to shoot down this work but categorization of networks into > red/green/yellow baskets is hard (if not impossible) and it will lead to > a very long thread with counter examples. > Rather than a hard classification of network X should always be color Y, in this list I think Glenn clarified it should be like the Windows model, i.e. when the user first connects to a network, the user is prompted to decide which trust level (color) it should be. They do this based on their own understanding of the context. With that in mind, do you still have an objection? I think the classifications would be useful for other drafts. Chris --00000000000002308f05ab078e08 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Mohit,
I don't want to shoot down this work but categorization of networks int= o
red/green/yellow baskets is hard (if not impossible) and it will lead to a very long thread with counter examples.

<= div>Rather than a hard classification of network X should always be color Y= , in this list I think Glenn clarified it should be like the Windows model,= i.e. when the user first connects to a network, the user is prompted to de= cide which trust level (color) it should be. They do this based on their ow= n understanding of the context.

With that in m= ind, do you still have an objection? I think the classifications would be u= seful for other drafts.

Chris
=
--00000000000002308f05ab078e08-- From nobody Wed Jul 22 06:17:16 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A68F53A0922 for ; Wed, 22 Jul 2020 06:17:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WoMu7SOMXupN for ; Wed, 22 Jul 2020 06:17:13 -0700 (PDT) Received: from mail-qk1-x735.google.com (mail-qk1-x735.google.com [IPv6:2607:f8b0:4864:20::735]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7EBF3A0B60 for ; Wed, 22 Jul 2020 06:17:12 -0700 (PDT) Received: by mail-qk1-x735.google.com with SMTP id j187so1839898qke.11 for ; Wed, 22 Jul 2020 06:17:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=9v0NmOzgOIfhLMikh5qv4K04NG1/cP4DV1fUAaINPiI=; b=UhkMKNqM/sDc0f/f6ruqQETYQmjeuVRHtzPIZUPv4iG4xOSHdMwZEINeEkxSJk8Ioc o+oSPaMj6sLlsfM6CEexc1cdnPA3cwV9rCnjT7+7j9q4Kyh4hPiQn/62+Ta31+fPt1gr 7gn/Fo7nupF4IrQQ/OA/FjjqWy0uGOW2UiwfLzM3F8ig6r3UUY/zVtl2aVnhCC3vOJGw FOsfzVsomVoZaiC7WWfQg0tReMLY+1/4QtG4szzGHJRQsu8q6kdJEjfMuKFJgpN0jeME hJhIBWxc8v3CEUGjOAC54RU3CIjy+rdJIFQy13cQKnmx0XuCMWC0RDMsMHUsnsD8uCes wDdg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=9v0NmOzgOIfhLMikh5qv4K04NG1/cP4DV1fUAaINPiI=; b=ijpl3LSu5Ijk5JRs+2nZ5D0bORtrWWMcgFnQSD4Xv1+IaCJ6C/f49ckNFEG3A1GVem Mp6rL36JLJIYrDz7QtN2/m3YuZvEq8vn6dRGrsoXxFNO9vok1P6r18ga8j+bpUUulEaK +uH0FVUYF1df6E+WEaAJKJTzG8gjFQvg14irtcWWcJeMhPnYufCjfR7NMeAhwrpaayFF W0tsC1vHa7W4D+TW+lTpglcBxWCbmvo/FmwPe60AApiqXaUSpIwlVYel8HcVaRIWCH8N 6SdrhxuZkUAgq7nqHlA8rpzjIKmEdU0owDu3wwLNriCWiL/RAbSQxtzK4EsRjMl5iOPp TUiw== X-Gm-Message-State: AOAM530UiMLD35U56pfX6uyaLiQwABlyarESt7jrMEhCZsV7sk4eatGV n8x2FlJj0O02YymRIBrp5rM+hg== X-Google-Smtp-Source: ABdhPJxWyXnPfOS2wcBwlH1iMs/7tDVAF5ooLeAPAU30YeDKjgMahV8Mh9MAz2BbVzZbLTNOiO4f0Q== X-Received: by 2002:a37:b041:: with SMTP id z62mr29798474qke.448.1595423831971; Wed, 22 Jul 2020 06:17:11 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:6cd5:9b28:6c36:63b8? ([2601:18b:300:36ee:6cd5:9b28:6c36:63b8]) by smtp.gmail.com with ESMTPSA id 128sm5071039qkk.101.2020.07.22.06.17.10 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 22 Jul 2020 06:17:10 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_2C48A99E-DE41-4390-BC7F-F1A8BF8F0BEB" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Wed, 22 Jul 2020 09:17:09 -0400 In-Reply-To: <33ee877a-818d-7bed-726f-8d9604064dde@gmail.com> Cc: Vittorio Bertola , "add@ietf.org" To: Tony Rutkowski References: <20200721074235.GB29757@nic.fr> <8646010.mL01ujt3hu@linux-9daj> <452c8cf6-d32e-6971-7839-2275a3565d15@gmail.com> <1656374832.4600.1595419193524@appsuite-gw1.open-xchange.com> <33ee877a-818d-7bed-726f-8d9604064dde@gmail.com> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 13:17:15 -0000 --Apple-Mail=_2C48A99E-DE41-4390-BC7F-F1A8BF8F0BEB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 22, 2020, at 8:48 AM, Tony Rutkowski = wrote: > In addressing the enforcement activities, he notes that "without = balancing interests of different members there is little value in a = group having openness, due process, or an appeals process, as there = would be no diversity of opinion that would leverage such principles = into reaching consensus.=E2=80=9D The need for a "balance of = interests," and not "restricting consumer choices" were underscored. The IETF process is explicitly not =E2=80=9Ca balance of interests.=E2=80=9D= That=E2=80=99s what =E2=80=9Cwe don=E2=80=99t believe in voting=E2=80=9D = means. Rough consensus and running code means valuing technical arguments over = majority preference. That=E2=80=99s why we have the process we do, and = why we do not take votes. You may not agree with this approach, but ADD is definitely not the = place to be arguing about it. --Apple-Mail=_2C48A99E-DE41-4390-BC7F-F1A8BF8F0BEB Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 22, 2020, at 8:48 AM, Tony Rutkowski <rutkowski.tony@gmail.com> wrote:
In addressing the enforcement activities, he notes that = "without balancing interests of different members there is little value = in a group having openness, due process, or an appeals process, as there = would be no diversity of opinion that would leverage such principles = into reaching consensus.=E2=80=9D  The need for a "balance of = interests," and not "restricting consumer choices" were = underscored.

The IETF process is explicitly not =E2=80=9Ca balance of = interests.=E2=80=9D That=E2=80=99s what =E2=80=9Cwe don=E2=80=99t = believe in voting=E2=80=9D means.

Rough consensus and running code means = valuing technical arguments over majority preference. That=E2=80=99s why = we have the process we do, and why we do not take votes.

You may not agree with = this approach, but ADD is definitely not the place to be arguing about = it.

= --Apple-Mail=_2C48A99E-DE41-4390-BC7F-F1A8BF8F0BEB-- From nobody Wed Jul 22 06:43:41 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D8423A091B for ; Wed, 22 Jul 2020 06:43:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.919 X-Spam-Level: X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nbcuni.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Oxix1D2s35wt for ; Wed, 22 Jul 2020 06:43:38 -0700 (PDT) Received: from mx0b-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 05CFF3A0835 for ; Wed, 22 Jul 2020 06:43:37 -0700 (PDT) Received: from pps.filterd (m0193502.ppops.net [127.0.0.1]) by m0193502.ppops.net-00176a04. (8.16.0.42/8.16.0.42) with SMTP id 06MDar8l032238 for ; Wed, 22 Jul 2020 09:43:37 -0400 Received: from usushmgip003.mail.tfayd.com ([216.178.109.222]) by m0193502.ppops.net-00176a04. with ESMTP id 32bvffjkjw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 22 Jul 2020 09:43:36 -0400 IronPort-SDR: 19kaanYvtDgThi8LLacCpCs/XuM3f2SgQ11hSr+ihl/2XcvbkimM3CFwHaK/QCPwpZSEpXoDDa 4ytA1X27mSNg== Received: from unknown (HELO ashemwp00006.mail.tfayd.com) ([100.126.24.30]) by USUSHMGIP003.mail.tfayd.com with ESMTP/TLS/ECDHE-RSA-AES128-SHA256; 22 Jul 2020 09:43:37 -0400 Received: from ashemwp00008.mail.tfayd.com (100.126.24.32) by ashemwp00003.mail.tfayd.com (100.126.24.27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1913.5; Wed, 22 Jul 2020 09:43:34 -0400 Received: from NAM10-MW2-obe.outbound.protection.outlook.com (10.56.130.76) by ashemwp00008.mail.tfayd.com (100.126.24.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1913.5 via Frontend Transport; Wed, 22 Jul 2020 09:43:34 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=SwEMCxSnUPyWSAkn7cGgbR8v7PURosg0c+dSPp3+BF7Gr/xXXAX2nGdoo61BS93D1vKaOZOQSNCN4zqx+Ajlf0KA2S1akXJcdSenpUIuREcpBYMwcnCG5oXn7WwYS14tsDu2InSBHkhsKdLUB+yD1IQ7lFg8WFAPU7Z2Km2JoDCzXHW13pU4EsCIZYzLNr5/tuLTWQl+WJ5mxjSIB0oYHqr2N0zYiNHfTvls9b7zs3JRzALg69lfbCNm577UYUpw+kSjBRoiliErD3ZAwyNRYKEdAFjfq+D7e8AJWuUS0gzSj4RBQstvyFoqwpaWRCeVwBXGu2tS99F/6a8ynJpUOQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=XkUCwNGu8KXG4BoYQyIRbywLMhlZJve6eI6DsWcPHSE=; b=PnrE1VCc7nrYl+TcdivjYVBGiLWJlzTZszQk4tcr8+mswzkZyiuRruqUMMRi5csCHYahLGEAce89IaXK7CQjGS0B4oyguNxdOsM0CCBmzG0lOpNyDw1gpWnP/7T5u+zVm9Xbjtuw2Vsyq43NTk7Z44WycoIT8EaTXLcx16PXoOuMLa7a3gztlYELGg7JyeTd7xHTCMW8vMbUaI+pfzF1CnQ/vCVEpb0QCHMZl7g4sGD7pDC4j+GG38nc0611iZ5qQC+E0ou43PAnbW3PQn729vEj4L5op+Lr3oYH1fzCMWbda3howuUfnwGQ94J1Waz1PlIQ/qtUqbzXaQRp/NUgeg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nbcuni.com; dmarc=pass action=none header.from=nbcuni.com; dkim=pass header.d=nbcuni.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NBCUNI.onmicrosoft.com; s=selector1-NBCUNI-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=XkUCwNGu8KXG4BoYQyIRbywLMhlZJve6eI6DsWcPHSE=; b=FdaJSfw25ClDXrynULR89bZ9MyCr3QwKNKA7NfA1JKIpqqCQW4JKZtPxYdAwC5Jt/EMZY6fFQuVtV+Ad0/aobQzUXqf8BxjJ+udH8WxKnx0l4QRGqR9oJPnsOSHmJeR080WrSOPH+UXQGbnKcQarifK/Ul4wTC/088puNtD0NTY= Received: from BYAPR14MB3094.namprd14.prod.outlook.com (2603:10b6:a03:14d::30) by BYAPR14MB2518.namprd14.prod.outlook.com (2603:10b6:a03:ac::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.23; Wed, 22 Jul 2020 13:43:31 +0000 Received: from BYAPR14MB3094.namprd14.prod.outlook.com ([fe80::e074:901e:d085:be5c]) by BYAPR14MB3094.namprd14.prod.outlook.com ([fe80::e074:901e:d085:be5c%7]) with mapi id 15.20.3195.025; Wed, 22 Jul 2020 13:43:31 +0000 From: "Deen, Glenn (NBCUniversal)" To: "add@ietf.org" Thread-Topic: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AQHWYC4WY5LhQ0vTp022pm7rhCqerw== Date: Wed, 22 Jul 2020 13:43:30 +0000 Message-ID: <4AC28D6A-4AA2-4BCA-8CEA-A526B8F7C74A@nbcuni.com> References: <20200721074235.GB29757@nic.fr> <8646010.mL01ujt3hu@linux-9daj> <452c8cf6-d32e-6971-7839-2275a3565d15@gmail.com> <1656374832.4600.1595419193524@appsuite-gw1.open-xchange.com>, <33ee877a-818d-7bed-726f-8d9604064dde@gmail.com> In-Reply-To: <33ee877a-818d-7bed-726f-8d9604064dde@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=nbcuni.com; x-originating-ip: [2605:e000:141b:121:dd76:8d58:12df:cd7d] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 7c5de8c6-bbcc-429e-6ca5-08d82e4538ad x-ms-traffictypediagnostic: BYAPR14MB2518: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: URPciXzv3BUemQA9F9eXbTRsOcFkL+Sioh4PAfwgRVRzSHvqjzptbcT0/pRMZLhqDaYm64dF/aq4/YjY8YEq/23inAuBLqF0gFFd61IjPR9m/PNhJHQ7DI47EPveLZQ7Rtlnae45obU38RFwdR0GIAk5T5FsN+eb6wUmz7mriP61MUpkGbmN4IkEJPDWxymQ99Q2ErbKohHKz8HYIsjz67Ajoe83d1abeHuNUdhWeWTm8kwJdWnruCsN/6y0rQBF57jFzIGx6h4hb98sICiU7MlR5vWVg2gEPUj4FGYZQ2E/B7+XAa0/3pIuiyFnu0rSnCKbTJbjgEmuS2M4VR/QFlAinJI3K0Ei1cGEJ3UMyiMI78X+44QXDEG+GqCJCfeKsCtwem7RF4afqt3TeWu1sw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR14MB3094.namprd14.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(39860400002)(376002)(396003)(346002)(136003)(366004)(6916009)(71200400001)(86362001)(53546011)(6506007)(66946007)(186003)(8936002)(83380400001)(66574015)(36756003)(76116006)(6486002)(8676002)(6512007)(2906002)(33656002)(316002)(2616005)(478600001)(966005)(5660300002)(66476007)(66556008)(64756008)(83080400001)(66446008); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: 0aAaxZ8OY/GoMYvb3Qiwrb9Ry7pIO8y5UZmMOmxVAcOpEfNiRkE4yOfq74LruRlwlyqAbev9odEf+LhkAL6FTTHitdKOkoAyteuFxHyuK/UmK2GfTEejDpSguyb1mlRcurs+pjKgN+E7iiGYLnzvvz1yVzTtdHv5jCLybBC0ybFdLMHVSHRK//Zi/JwEZAlS/lBZtDQWTYys8akbnt375cYvq7+NfNCHinXsuoXYzT5k2kHzR16U5gfOBirIWfy5rIC2S7csqfsTHd3a9IwTC+llQEotqlui9NhroazLfu3D5UX0GCvVbPm53XxKzsqrIHKAqwD10jukxN5a794ne6Gt09qwdX8Zfk3KnXZfVzyJvvEfQVT8in1bzEPKsR3QXq5KG7U7JBW7Xim2DeHr/epU6Am0Vjkc2CODNoUfj3gnsfoziyT5vL+0Lf+m0sBVNA2XUo0ig6whVAteeF/VfjROfr1SaF2MmYQU1Ximix0MYfegOYCVncwWh33V7kx03rMmdtNkctvr2zKBfgNWM84EXb//Iilrs20CerDRwyEaheVbR79P+Ma4592/xysh x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BYAPR14MB3094.namprd14.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7c5de8c6-bbcc-429e-6ca5-08d82e4538ad X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2020 13:43:31.0006 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4f3526f9-97d6-412d-933a-4e30a73110f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: pOeehZX+gH7kH1sJEQbU5y9F84U4LipGo4+xlAJKS8SdiLiesk0Q+eg57GRf2DkSDaWstN4Xb4S9FFN68Kfk7w== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR14MB2518 X-OriginatorOrg: nbcuni.com X-EXCLAIMER-MD-CONFIG: 47edc00f-f2d6-45ef-be83-8a353bd47e45 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-22_08:2020-07-22, 2020-07-22 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 clxscore=1015 suspectscore=0 priorityscore=1501 adultscore=0 impostorscore=0 spamscore=0 bulkscore=0 lowpriorityscore=0 mlxlogscore=999 mlxscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007220099 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 13:43:40 -0000 RnJvbSB0aGUgQUREIENoYWlycy0gIA0KDQpFdmVyeW9uZSAtIEFudGl0cnVzdCBhbmQgU0RPIG9y Z2FuaXphdGlvbiBzdHJ1Y3R1cmUgYXJlIG91dCBvZiBzY29wZSBmb3IgdGhlIEFERCBXRywgcGxl YXNlIHN0b3AgcG9zdGluZyBhYm91dCBpdCBvbiB0aGlzIGxpc3QuDQoNCkdsZW5uIERlZW4NCg0K PiBPbiBKdWwgMjIsIDIwMjAsIGF0IDU6NDkgQU0sIFRvbnkgUnV0a293c2tpIDxydXRrb3dza2ku dG9ueUBnbWFpbC5jb20+IHdyb3RlOg0KPiANCj4g77u/SGkgVml0dG9yaW8sDQo+IA0KPiBBbiB1 cGRhdGUuDQo+IA0KPiBUaGUgbmV3IGhlYWQgb2YgdGhlIFVTRE9KIGFudGl0cnVzdCBpbnZlc3Rp Z2F0aW9ucyByZWNlbnRseSB1bmRlcnNjb3JlZCB0aGUgcmVxdWlyZW1lbnRzIGZvciAiaW1wb3J0 YW5jZSBvZiBvcGVubmVzcywgYmFsYW5jZSwgYW5kIHRyYW5zcGFyZW5jeSBpbiBzdGFuZGFyZHMg ZGV2ZWxvcG1lbnQuIiAgSW4gYWRkcmVzc2luZyB0aGUgZW5mb3JjZW1lbnQgYWN0aXZpdGllcywg aGUgbm90ZXMgdGhhdCAid2l0aG91dCBiYWxhbmNpbmcgaW50ZXJlc3RzIG9mIGRpZmZlcmVudCBt ZW1iZXJzIHRoZXJlIGlzIGxpdHRsZSB2YWx1ZSBpbiBhIGdyb3VwIGhhdmluZyBvcGVubmVzcywg ZHVlIHByb2Nlc3MsIG9yIGFuIGFwcGVhbHMgcHJvY2VzcywgYXMgdGhlcmUgd291bGQgYmUgbm8g ZGl2ZXJzaXR5IG9mIG9waW5pb24gdGhhdCB3b3VsZCBsZXZlcmFnZSBzdWNoIHByaW5jaXBsZXMg aW50byByZWFjaGluZyBjb25zZW5zdXMu4oCdICBUaGUgbmVlZCBmb3IgYSAiYmFsYW5jZSBvZiBp bnRlcmVzdHMsIiBhbmQgbm90ICJyZXN0cmljdGluZyBjb25zdW1lciBjaG9pY2VzIiB3ZXJlIHVu ZGVyc2NvcmVkLg0KPiANCj4gU2VlIGF0IGh0dHBzOi8vdXJsZGVmZW5zZS5jb20vdjMvX19odHRw czovL3d3dy5qdXN0aWNlLmdvdi9vcGEvc3BlZWNoL2RlcHV0eS1hc3Npc3RhbnQtYXR0b3JuZXkt Z2VuZXJhbC1hbGV4YW5kZXItb2t1bGlhci1kZWxpdmVycy1yZW1hcmtzLWludGVsbGVjdHVhbF9f OyEhUElaZWVXNXdzY3luUlEhNi1aWnlSbkJIek9haExuaFZVQW1nQWQwQ2ZHcWQtYmFhdk0xeXhz STdzMTFBRFBhdWEwTk9VVnpmZkJwNFYxdCQgDQo+IFRoZSByZWNvcmQgb2YgUkZDIDcyNTggYW5k IGl0cyBhcHBsaWNhdGlvbiB0byBJRVRGIHdvcmsgd291bGQgc2VlbSB0byBydW4gYWZvdWwgb2Yg dGhlc2UgcmVxdWlyZW1lbnRzIGFuZCBwb3RlbnRpYWxseSBleHBvc2UgdGhlIFRydXN0IGFuZCBw YXJ0aWNpcGFudHMgaW4gdGhlIHdvcmsgdG8gZW5mb3JjZW1lbnQgYWN0aW9ucy4gIEFsbW9zdCBh bGwgc3RhbmRhcmRzIGdyb3VwcyB0b2RheSBoYXZlIHJhdGhlciBleHBsaWNpdCBhbnRpdHJ1c3Qg Y29uc3BpcmFjeSBtaXRpZ2F0aW9uIHBvbGljaWVzIHRoYXQgYXJlIG1hZGUgaW5jdW1iZW50IG9u IGFsbCBwYXJ0aWNpcGFudHMgaW4gdGhlaXIgb25nb2luZyBjb2xsYWJvcmF0aXZlIGFjdGl2aXRp ZXMuICBVbnRpbCB0aG9zZSBwb2xpY2llcyBhcmUgZXN0YWJsaXNoZWQsIHRoZXNlIHJlcXVpcmVt ZW50cyBhcmUgbm90IGFjdGlvbmFibGUgaW4gYWRkLCBldmVuIGlmIHRoZXkgc2hvdWxkIGJlIGNv bnNpZGVyZWQuDQo+IA0KPiAtLXRvbnkNCj4gDQo+PiBPbiAyMi1KdWwtMjAgNzo1OSBBTSwgVml0 dG9yaW8gQmVydG9sYSB3cm90ZToNCj4+IA0KPj4+IElsIDIxLzA3LzIwMjAgMjA6NDIgVG9ueSBS dXRrb3dza2kgPHJ1dGtvd3NraS50b255QGdtYWlsLmNvbT4gaGEgc2NyaXR0bzoNCj4+PiANCj4+ PiBJIGFsc28gaGF2ZW4ndCBmb3Jnb3Qgb3VyIHByZXZpb3VzIGRpYWxvZ3VlIG9uIGNvbXBldGl0 aW9uIGNvbXBsZXhpdGllcywNCj4+PiBidXQgY2hvc2UgdG8gc3BlbmQgdGhlIHRpbWUgcmVzZWFy Y2hpbmcgYW5kIHdyaXRpbmcgb24gQ2lyY2xlSUQuDQo+Pj4gaHR0cHM6Ly91cmxkZWZlbnNlLmNv bS92My9fX2h0dHA6Ly93d3cuY2lyY2xlaWQuY29tL3Bvc3RzLzIwMjAwNzExLWFkZHJlc3Npbmct YW50aWNvbXBldGl0aXZlLWJlaGF2aXVyLWluLWludGVybmV0LXN0YW5kYXJkcy1ib2RpZXMvX187 ISFQSVplZVc1d3NjeW5SUSE2LVpaeVJuQkh6T2FoTG5oVlVBbWdBZDBDZkdxZC1iYWF2TTF5eHNJ N3MxMUFEUGF1YTBOT1VWemZVZ0VzRjlMJCANCj4+IFZlcnkgaW50ZXJlc3Rpbmcgc3RvcnkgLSBh bHNvIGNvbnNpZGVyaW5nIFN0ZXBoZW4ncyByZXBseSBvbiBob3cgUkZDIDcyNTggd2FzIGRvbmUg d2l0aG91dCBhbnkgc3BlY2lmaWMgcHJvY2VzcywgSSBmaW5kIG1vcmUgYW5kIG1vcmUgc2lnbnMg dGhhdCB0aGUgSUVURiBmb3IgcXVpdGUgc29tZSB5ZWFycyBub3cgaGFzIHRyZWFkZWQgcmVja2xl c3NseSBpbnRvIHBvbGljeS1pbnRlbnNpdmUgdGVycml0b3JpZXMgd2l0aG91dCBnaXZpbmcgYW55 IHJlYWwgdGhvdWdodCBhdCBob3cgdG8gZG8gaXQgcmlnaHQgOi0pIEl0IHdvdWxkIGJlIGludGVy ZXN0aW5nIHRvIGhhdmUgdGhhdCBkaXNjdXNzaW9uLCBidXQgb2YgY291cnNlIG5vdCBoZXJlLg0K Pj4gDQo+IA0KPiAtLSANCj4gQWRkIG1haWxpbmcgbGlzdA0KPiBBZGRAaWV0Zi5vcmcNCj4gaHR0 cHM6Ly91cmxkZWZlbnNlLmNvbS92My9fX2h0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlz dGluZm8vYWRkX187ISFQSVplZVc1d3NjeW5SUSE2LVpaeVJuQkh6T2FoTG5oVlVBbWdBZDBDZkdx ZC1iYWF2TTF5eHNJN3MxMUFEUGF1YTBOT1VWemZjZ2JKQjBkJCANCg== From nobody Wed Jul 22 07:28:09 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D47D03A0B3D for ; Wed, 22 Jul 2020 07:28:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com header.b=KkD2+O+p; dkim=pass (2048-bit key) header.d=comcast.com header.b=IwgqkUwz; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=comcastcorp.onmicrosoft.com header.b=fcCwxcFQ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D84OXlXRcZ41 for ; Wed, 22 Jul 2020 07:28:05 -0700 (PDT) Received: from mx0b-00143702.pphosted.com (mx0b-00143702.pphosted.com [148.163.141.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D98773A0B38 for ; Wed, 22 Jul 2020 07:28:04 -0700 (PDT) Received: from pps.filterd (m0184890.ppops.net [127.0.0.1]) by mx0b-00143702.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06MENXN8009739 for ; Wed, 22 Jul 2020 10:28:04 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.com; h=from : to : subject : date : message-id : content-type : content-id : content-transfer-encoding : mime-version; s=20190412; bh=cyMQjnP5u2zkpa1AM9I5wiCOwCwI948pEQsJPNtlgZA=; b=KkD2+O+phIlt6jNgzhkagNx/bVDDgYo33eqxmhabQxKoNsQUAbQ9hnCbw9Q2nBe9Vwsq RtTfOceTlR5BIbK2TW5PbIkfm7xi5s4YLi9hehDl4xXye4JB9FRBp5hBpXTprMLzI0zd Dg/oUp3UjlZsjJyfMHheGCbHJdQZaM5pvItuKdwXbBoKyMZzHUnr/sux5j/YPiczsfR2 zz65nfFUapHW0ApQQMg8M46rNiJ1S2OfPAy2YnzjemNBt/kgixogaEwqxHEIp3i4FLeU zmJmcWbTRBkLFiStIm4b9HnUp3cnhp2DD7nTQ7wTC3FadXANepmu3MSv0b0ObtANJp17 ug== Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) by mx0b-00143702.pphosted.com with ESMTP id 32bw6exc1u-10 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 22 Jul 2020 10:28:03 -0400 DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1595428083; x=2459341683; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=cyMQjnP5u2zkpa1AM9I5wiCOwCwI948pEQsJPNtlgZA=; b=IwgqkUwzFm7R8PDXWM11T5te3Rtx92ayzz5Zdwba0uoGnsxr1SrU4SnOliIo3TBk 4mAOCCNfUdJ+9XPok9Y7N+BMbkYrp1H3DcmZd5p0u4/zDnostWVu6fM3tkn2DW9N 7dg953NnmF0IeaOatGvCIM5Xnc396EZncw655EPv05Ehs3hIz07ElCNGeuDAXXrR HkC9OyLKj0lYUv/Ykz/nntK3ZjMxaJU+AH+56Vd+lTP8MhpJemRHbU9K7aWn7EEC i1JFgUxVv2a/8oe5V4k9CHFCjeq8Wquy07he7DK48+2w9JME0zNlylit/s5OJEI7 VkBey3xzyPAOJxQmopqDwg==; X-AuditID: 60729ed4-a31ff70000003048-f2-5f184cf39838 Received: from copdcex56.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id 96.C3.12360.3FC481F5; Wed, 22 Jul 2020 08:28:03 -0600 (MDT) Received: from COPDCEX10.cable.comcast.com (147.191.124.141) by copdcex56.cable.comcast.com (147.191.125.155) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 22 Jul 2020 10:28:02 -0400 Received: from COPDCEXEDGE01.cable.comcast.com (96.114.158.213) by COPDCEX10.cable.comcast.com (147.191.124.141) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Wed, 22 Jul 2020 08:28:02 -0600 Received: from NAM11-BN8-obe.outbound.protection.outlook.com (104.47.58.173) by webmail.comcast.com (96.114.158.213) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 22 Jul 2020 10:27:45 -0400 Received: from BL0PR11MB3107.namprd11.prod.outlook.com (2603:10b6:208:7c::12) by MN2PR11MB4694.namprd11.prod.outlook.com (2603:10b6:208:266::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.18; Wed, 22 Jul 2020 14:27:44 +0000 Received: from BL0PR11MB3107.namprd11.prod.outlook.com ([fe80::140b:d467:2295:fc47]) by BL0PR11MB3107.namprd11.prod.outlook.com ([fe80::140b:d467:2295:fc47%6]) with mapi id 15.20.3216.020; Wed, 22 Jul 2020 14:27:43 +0000 From: "Deen, Glenn" To: ADD Mailing list Thread-Topic: [Add] New Threats ID for ADD Thread-Index: AQHWYDRDe15tPQlI10eFgtk0rMTAVg== Date: Wed, 22 Jul 2020 14:27:43 +0000 Message-ID: <5990D901-60E1-474C-BC18-94F069C0201A@nbcuni.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=comcast.com; x-originating-ip: [2605:e000:141b:121:9442:a71d:7b0a:7e04] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 70988f7b-5fef-4a8e-8896-08d82e4b65e1 x-ms-traffictypediagnostic: MN2PR11MB4694: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: GHtHKvB1vIJRbvbrJF6hkUDz5x2R6+sUVT4C531AMsgd08CvpGjSiEuV/hlVameU0/htBql/idVQoEeunLoT3YG+ck71pHouuILfBwf7gxapzMRfX5p5UNTT9+cjeTzWD9T61f3qj3bfDOHcGbs5rDg10OjaxlKtSyFPL8JkS1oWA2KcWMgYGIbDntlBZD+lsHQMX/weCs2529cIQ6cv1Qoh8LJpDoN7l/kuFDEfOf7Iqv87UKZgpRUyvnm5UFHTWC7c55NK2cvQGvSIBlAm68Rmg2ZkYx4VxXuIP1uCQGX8KU/TKdboxOq+U3THxO2IsZOiauXZnjBL144wKmybN4+9unGwAnyAien7ThxbWhgPdfPAcZXi8OEofMSkMhw8NgNqlBrnyJx8wpcU6g/+uA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BL0PR11MB3107.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(136003)(376002)(39860400002)(396003)(366004)(8936002)(5660300002)(66946007)(316002)(91956017)(64756008)(53546011)(83380400001)(6486002)(76116006)(8676002)(66446008)(9686003)(6506007)(66574015)(33656002)(2906002)(6512007)(36756003)(86362001)(66476007)(66556008)(966005)(6916009)(71200400001)(186003)(478600001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: QrCvLfjkKnpTqdKj0lobzlYoipCAqIfG2uVeixbdPP5SpPb4B+k89zqKEkW3HyBPrDCyqW6V+6Xe/2MwKT9XmfR2DolNGTlgnF9p3KB1dCdW5L+8FHRmdL2FP1HsBJw0BfssDeX/3Q27zS0QNoTbaXNVYGpyPMbqCmLv4Uj61fUvF2gr1Z6MwTbat/Pd3OvGiQwn0zdKnHKnMpvpS4755ifTgzen4Jz7mQKAuiDx093dnfIvc3PfGxYUE/lkw0JaH74djsWMaEwTZLdBkzDuim/kEo7edRdqOzDW+e/6UopkURvT5JHjgRMOg5w5JLpyowo6q4LSbc7BcHFqX1PRcSeKRdVQEQf8X7UqG2uoPXlPbIGHFOtWRtY3GhZYKBd8YsbX2kwLznpuFPssLJqOrz59pu9HqD9dG8UHD+T+5a1PJXHYGjA6AfM9eMw5V/8dDnWGOjeR/QThpndXilYvZ58tQcekrecDB93k7la6RJXP9ITBWyH4fcDGqa2PsDeQup97/aThM1bxEvIdNFs+a4hro6her0n2ZBPu8pqm+hkOIgBrF8AVfxDCAhYQf2jM x-ms-exchange-transport-forked: True arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=QzJMCYw1HKuNzh3DblMxBMcJLM0Rukfbcga8PMOBlHRaNBTw0C6HVajkHY6gY48zTOOIQkJHBVfJhknVOV5t0FQge5Ja5HjS07vPuGaEo+hjeM3X2L3I5rAaaxBnGsrgj73kWeCW8/h92qPPJAra5NeAwc93ZOgkCWSGFZ7xy5BGgiXZFYfvnQpMWNCXR3CdkmgwUWMRvmr0N99sMcxNJnK7d4ETuENt/mZsfUNFvkROis5Qz/y6O7fsDwsAnWsvksXHEWo07zFG39FjW/Skxnd9yf7NJ/0fMyzkzo6KbdWovoeUVg6LZSSLGokaa4NmWn4Cl/Q6Xm8dWRYwtEc+Rg== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1LFwl8S+vJJTkT3xxlId3gmZD1oWAH6XCLWH2ayds5g=; b=Qe3KIvvS6JpqsQVJ12PXZ6OIr0WcvmP44E7pdCxyg5dLxcdOPomnfygr0FD/H13dmr8djmiXadir970VFzq35sWo3TLVEM/fh+U3ymua87h+gPksKxJVx4sAB/spHlD59/FVmrqcrqEWJx7JTCeCycXc2Kky/MYce56nAVvZdJzm9pd687DLKaNnh+V9wV5aiRnr8PQ+9oIO0OZsrZoeOponhIyK/udfH7bgOBFGIzHiRiTuCxvRlqqQVhTf2OBUuxoHUoWCHrRgRxoq9eLaKcx6FP5bpWK6hZ6cx5eyTU2kWRfOt3PE8pYB/0cUk23hgOF8GI348YoNofUWMS1Jrw== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=comcast.com; dmarc=pass action=none header.from=comcast.com; dkim=pass header.d=comcast.com; arc=none dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastcorp.onmicrosoft.com; s=selector1-comcastcorp-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1LFwl8S+vJJTkT3xxlId3gmZD1oWAH6XCLWH2ayds5g=; b=fcCwxcFQKrY5253eeQyrMbTFZXs+0wW/PInVRqAT1oRJ3TXd3uq/Ta2StDIATRvTDSuJhef4Y6eZaBopogVHu2SxizOTWCnuK5a0NEp3JKiKFedTRcWItV1mGtTc6mZrlDIZXkRm+SFY0XYUtSQNAxPE7F2hjBtSzVzjl1xLWe8= x-ms-exchange-crosstenant-authas: Internal x-ms-exchange-crosstenant-authsource: BL0PR11MB3107.namprd11.prod.outlook.com x-ms-exchange-crosstenant-network-message-id: 70988f7b-5fef-4a8e-8896-08d82e4b65e1 x-ms-exchange-crosstenant-originalarrivaltime: 22 Jul 2020 14:27:43.9149 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 906aefe9-76a7-4f65-b82d-5ec20775d5aa x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: yu00YQRyDJQxwWw6Tt52d2y/Boc35myX03ObMnyat+ncOGsK409o6SIi/KQ1rYdAuEg9Zkqu9PpJau5WuHxNm0QprJeU2Rg+KKpZ1dZRU1A= x-ms-exchange-transport-crosstenantheadersstamped: MN2PR11MB4694 x-originatororg: comcast.com Content-Type: text/plain; charset="utf-8" Content-ID: <0BE9F2B2911DD24FB4762FAE69CAE616@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrLIsWRmVeSWpSXmKPExsWSUDRnsu5nH4l4g9PXeC3+n17H5sDosWTJ T6YAxigum5TUnMyy1CJ9uwSujC89W9gK9qhVTFvq28C4R7WLkZNDQsBE4ntHE3MXIxeHkMBh JokPG09COYcYJRq6mpkgnDtAzpYZUJmTjBJLF09nhHAWM0msvTsPynnEKLHwYhNLFyMHB5uA jsS2zfYgS0QElCWW3t3OBGILC2hKLNj0mgkiriXxfeEPNpByEQE9ibbuGpAwi4CqxKL3x9lA bF4BW4kbqy4xgtiMAmIS30+tAWtlFhCXuPVkPhPEDwISS/acZ4awRSVePv7HCmKLCuhL3Fv/ mQXkNEaBLkaJV10HGEF2SQhYSUw+pAFRLytxaX43I4TtK3FuxWR2CFtL4uqSmVDzsyW+fzsO ZatJbL92HsqWk1jV+5AFwpaReHBjOxuEvZtZ4kBnDMheCYFvzBI3H51ihXCesEisXryRGeII FYl/hyonMBrPQvLPLKAMMzCI1u/Shwh7SHx7e4IJwlaUmNL9kH0WOFgEJU7OfMKygJF1FSOf pZmeoaGJnqGphZ6RodEmRnCimHdlB+Pl6R6HGAU4GJV4eOMcJeKFWBPLiitzgRHLwawkwqvD KB4vxJuSWFmVWpQfX1Sak1p8iFGag0VJnDc29myckEB6YklqdmpqQWoRTJaJg1OqgZG3xHK2 oqvXHTXBeifR5w4/rDZb3pu4/tqjTeZ1T3tMtrVlfZw589XjCpUuG70qxbMtOUczKhw8vr2T +z+vK+VD9JTMYCFVOa2e7N1LVlpO+d8YcuXZC5MYPt0Ff/6L7uWWiH/L2qYpx/nu0alazveu xm5HVrI8zjtX1q1wY+m1suiDUnd5TyixFGckGmoxFxUnAgAZKwbcEAMAAA== X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-22_08:2020-07-22, 2020-07-22 signatures=0 X-Proofpoint-Spam-Reason: safe Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 14:28:07 -0000 SGkgTW9oaXQsDQoNClRoYW5rcyBmb3IgdGhlIGZlZWRiYWNrLCBsZXQgbWUgYXR0ZW1wdCB0byBj bGFyaWZ5IHRoZSBwcm9wb3NhbCBiZWxvdyBpbmxpbmUuLi4uDQoNCu+7v09uIDcvMjEvMjAsIDEx OjQxIFBNLCAiQWRkIG9uIGJlaGFsZiBvZiBNb2hpdCBTZXRoaSBNIiA8YWRkLWJvdW5jZXNAaWV0 Zi5vcmcgb24gYmVoYWxmIG9mIG1vaGl0Lm0uc2V0aGk9NDBlcmljc3Nvbi5jb21AZG1hcmMuaWV0 Zi5vcmc+IHdyb3RlOg0KDQogICAgSW4tbGluZS4NCg0KICAgIE9uIDcvMjEvMjAgMTI6NTIgUE0s IFN0ZXBoYW5lIEJvcnR6bWV5ZXIgd3JvdGU6DQogICAgPiBPbiBUdWUsIEp1bCAyMSwgMjAyMCBh dCAxMjo0MDoyN0FNICswMDAwLA0KICAgID4gICBEZWVuLCBHbGVubiA8R2xlbm5fRGVlbkBjb21j YXN0LmNvbT4gd3JvdGUNCiAgICA+ICAgYSBtZXNzYWdlIG9mIDEwMiBsaW5lcyB3aGljaCBzYWlk Og0KICAgID4NCiAgICA+PiBJIHdhbnRlZCB0byBicmluZyB0byB5b3VyIGF0dGVudGlvbiBhIHNo b3J0LCB2ZXJ5IHNob3J0LCBkcmFmdCB0aGF0DQogICAgPj4gSSB3cm90ZSB1cCBiYXNlZCBvbiBh biBlbWFpbCB0aHJlYWQgb24gdGhlIFdHIGxpc3QuICBJdCBjYXB0dXJlcyBhDQogICAgPj4gYmFz aWMgZnJhbWV3b3JrIG9mIEdyZWVuLVllbGxvdy1SZWQgdGhyZWF0IGFuZCB0cnVzdCByZWxhdGlv bnNoaXBzDQogICAgPj4gdGhlIHVzZXIgbWF5IGhhdmUgd2l0aCB0aGVpciBuZXR3b3JrLiAgVGhl IGhvcGUgaXMgdGhhdCB0aGlzIGNhbiBiZQ0KICAgID4+IGEgYmFzaXMgZm9yIGZvY3VzaW5nIGRp c2N1c3Npb24gb2YgdGhyZWF0cyBhbmQgd2hhdCBtaXRpZ2F0aW9ucw0KICAgID4+IG1heWJlIG5l ZWRlZCBpbiBkaWZmZXJlbnQgc2l0dWF0aW9ucy4NCiAgICA+Pg0KICAgID4+IGh0dHBzOi8vdXJs ZGVmZW5zZS5jb20vdjMvX19odHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9odG1sL2Ry YWZ0LWRlZW4tYWRkLXRocmVhdHMtMDBfXzshIVBJWmVlVzV3c2N5blJRITdxT0tGdDhZbWhwYTFE WnlYd3RUbXJGaHIwMnp1eHNsMEpZNXBZNlZJMURkX0NaZzV2d3JXOEF1akFXR3EtNGwkDQogICAg PiBJIHNlZSBubyB1c2UgZm9yIHRoaXMgZG9jdW1lbnQuIEl0IHNlZW1zIHRvIGNvbnNpZGVyIG9u bHkgdGhlDQogICAgPiBwb3RlbnRpYWwgcmlza3MgYnkgb3V0c2lkZXJzLCBhbmQgbm90IHRoZSBy aXNrcyBieSB0aGUgb3BlcmF0b3JzLA0KICAgID4gd2hpY2ggYXJlIGFzIGltcG9ydGFudC4gRm9y IGluc3RhbmNlLCBhc3Nlc3NpbmcgdGhhdCB0aGUgIlVzZXIncyBJU1ANCiAgICA+IG5ldHdvcmsi IGlzIHNhZmUgb3Igbm90IGlzIG5vdCBqdXN0IGEgbWF0dGVyIG9mIHdldGhlciBpdCBpcyBwcm9w ZXJseQ0KICAgID4gc2VjdXJlZDogaXQgaXMgYWxzbyBhIG1hdHRlciBvZiB3aGF0IHRoZXkgZGVj aWRlIHRvIGRvIChhbiBJU1ANCiAgICA+IHJlc29sdmVyIHdoaWNoIGNlbnNvcnMgU2NpLUh1YiBp cyBub3Qgc2FmZSBmb3IgbWUsIGV2ZW4gaWYgaXQgaXMNCiAgICA+IHNlY3VyZWQgYW5kIHByb3Rl Y3RlZCBmcm9tIG91dHNpZGUgYXR0YWNrZXJzKS4NCiAgICA+DQogICAgPiBUaGlzIGRyYWZ0IGlz IG5vdCBhIHByb3BlciB0aHJlYXQgbW9kZWwgZm9yIHRoZSBJbnRlcm5ldC4NCg0KICAgIEkgZG9u J3Qgd2FudCB0byBzaG9vdCBkb3duIHRoaXMgd29yayBidXQgY2F0ZWdvcml6YXRpb24gb2YgbmV0 d29ya3MgaW50bw0KICAgIHJlZC9ncmVlbi95ZWxsb3cgYmFza2V0cyBpcyBoYXJkIChpZiBub3Qg aW1wb3NzaWJsZSkgYW5kIGl0IHdpbGwgbGVhZCB0bw0KICAgIGEgdmVyeSBsb25nIHRocmVhZCB3 aXRoIGNvdW50ZXIgZXhhbXBsZXMuIEZvciBleGFtcGxlOg0KDQogICAgLSBNYW55IHNjaG9vbCBh bmQgdW5pdmVyc2l0eSBuZXR3b3JrcyB1c2UgZWR1cm9hbSB3aXRoIEVBUC4gVGhleSBzaG91bGQN CiAgICBiZSBpbiB0aGUgZ3JlZW4gYmFza2V0Lg0KDQogICAgLSBNYW55IGhvbWUgbmV0d29ya3Mg YnJvYWRjYXN0IGEgR3Vlc3QgU1NJRCB3aGljaCBjYW4gYmUgYW4gZW50cnkgcG9pbnQNCiAgICBm b3Igcm9ndWUgYWN0b3JzLiBUaGV5IHNob3VsZCBiZSBpbiB0aGUgeWVsbG93IGJhc2tldC4NCg0K ICAgIC0gQ29uZmVyZW5jZSBuZXR3b3JrcyBhdCBzZWN1cml0eSBjb25mZXJlbmNlcyAoc3VjaCBh cyBCbGFja0hhdCwgQ0NTDQogICAgZXRjLikgc2hvdWxkIGJlIGluIHRoZSByZWQgYmFza2V0Lg0K DQogICAgSSB0aGluayBkaXNjdXNzaW9uIG9uIHRoaXMgc29ydCBvZiBjYXRlZ29yaXphdGlvbiBt YXkgbm90IGJlIHZlcnkNCiAgICBwcm9kdWN0aXZlIGZvciB0aGUgd29ya2luZyBncm91cC4NCg0K ICAgIC0tTW9oaXQNCg0KDQoNClRoZSBjbGFzc2lmaWNhdGlvbiBpcyBub3QgbWVhbnQgdG8gYmUg YSBjbGFzc2lmaWNhdGlvbiB0aGF0IGlzIGhhcmQgYW5kIGZpeGVkLCBub3IgaXMgaXQgc29tZW9u ZSBJJ20gcHJvcG9zaW5nIGJlIHR1cm5lZCBpbnRvIGEgbGFiZWxsaW5nIHdoaWNoIGlzIHNvbWVo b3cgc3RvcmVkIG9yIGNvbW11bmljYXRlZCBhcyBkZXNjcmlwdGl2ZSBpbmZvcm1hdGlvbiBvZiB0 aGUgbmV0d29yay4gIEFzIEkndmUgc2FpZCBpbiBvdGhlciBub3RlcywgIHRoaXMgaXMgYWxsIGZy b20gdGhlIHVzZXIncyBwZXJzcGVjdGl2ZSBhbmQgd2hlcmUgYSBwYXJ0aWN1bGFyIG5ldHdvcmsg ZmFsbHMgZm9yIG9uZSB1c2VyIG1heSB3ZWxsIGJlIGRpZmZlcmVudCBmb3IgYW5vdGhlciwgYW5k IHRoYXQgY2xhc3NpZmljYXRpb24gbWF5IGNoYW5nZSBvdmVyIHRpbWUgYmFzZWQgb24gZXZlbnRz IG9yIGV4cGVyaWVuY2Ugb3Igb3BlcmF0aW9uYWwgYmVoYXZpb3IgdGhlIHVzZXIgd2FudHMgZnJv bSB0aGUgbmV0d29yay4NCg0KSXQgaXMgbWVhbnQgdG8gaGVscCBmb2N1cyBBREQncyBkaXNjdXNz aW9uIG9mIHZhcmlvdXMgcHJvcG9zYWxzIGFuZCB0aGUgdGhyZWF0cyB0aGV5IGZhY2UuICBIb3dl dmVyLCByZWNvZ25pemluZyBhbmQgYWNrbm93bGVkZ2luZyB0aGF0IG5vdCBhbGwgbmV0d29yayBl bnZpcm9ubWVudHMgYXJlIGFzIHRydXN0ZWQgYXMgb3RoZXJzLCBhbmQgb24gdGhlIHR3byBleHRy ZW1lcyByYW5nZSBmcm9tIHdlbGwgdHJ1c3RlZCBuZXR3b3JrcyBvbiB0byBjbGVhcmx5IGhvc3Rp bGUgbmV0d29ya3MgLSBhcyB5b3UgcG9pbnQgb3V0IGFib3ZlLg0KDQpDbGVhcmx5IGVhY2ggdGhy ZWF0L3RydXN0IGxldmVsIC0gR3JlZW4vWWVsbG93L1JlZCBjYWxscyBmb3IgZGlmZmVyZW50IG1p dGlnYXRpb25zIHRvIG1haW50YWluIGludGVncml0eSBmcm9tIHRoZSB1c2VyJ3MgcGVyc3BlY3Rp dmUuICBTbyB3aGVuIHdlJ3JlIGRpc2N1c3NpbmcgZGlzY292ZXJ5IGFuZCByZXNvbHZlciBpbmZv cm1hdGlvbiBkZWxpdmVyeSBwcm9wb3NhbHMgaW4gQUREIGl0IGlzIGltcG9ydGFudCB0byBiZSBh YmxlIHRvIGFsc28gZGlzY3VzcyB3aGF0IHRocmVhdHMgYW5kIG1pdGlnYXRpb25zIGFyZSBhcHBy b3ByaWF0ZSBpbiBlYWNoLiAgU28gbm90IGEgbmV0d29yayBsYWJlbGxpbmcgcHJvcG9zYWwgYnV0 IGEgZGlzY3Vzc2lvbiBhbmQgdGhvdWdodCBmb2N1c2luZyBwcm9wb3NhbC4NCg0KDQoNCi1nbGVu bg0KDQo= From nobody Wed Jul 22 07:46:33 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4271A3A053E for ; Wed, 22 Jul 2020 07:46:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.919 X-Spam-Level: X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nbcuni.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tbqL_2bsVnjP for ; Wed, 22 Jul 2020 07:46:30 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0a-00176a04.pphosted.com [67.231.149.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 257453A0528 for ; Wed, 22 Jul 2020 07:46:29 -0700 (PDT) Received: from pps.filterd (m0193509.ppops.net [127.0.0.1]) by m0193509.ppops.net-00176a04. (8.16.0.42/8.16.0.42) with SMTP id 06MESxpk015940 for ; Wed, 22 Jul 2020 10:46:29 -0400 Received: from usushmgip003.mail.tfayd.com ([216.178.109.222]) by m0193509.ppops.net-00176a04. with ESMTP id 32buhyu2tn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 22 Jul 2020 10:46:29 -0400 IronPort-SDR: /DR1BVNpQLB3mIAcNU9SDXCLjLlngVdrcVR68rcmXq2uqrKNhOV96tIUfyu0oXogj4HLh+S4/i C+wjwOaNzRrg== Received: from unknown (HELO ashemwp00003.mail.tfayd.com) ([100.126.24.27]) by USUSHMGIP003.mail.tfayd.com with ESMTP/TLS/ECDHE-RSA-AES128-SHA256; 22 Jul 2020 10:46:30 -0400 Received: from ashemwp00006.mail.tfayd.com (100.126.24.30) by ashemwp00001.mail.tfayd.com (100.126.24.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1913.5; Wed, 22 Jul 2020 10:46:27 -0400 Received: from NAM04-SN1-obe.outbound.protection.outlook.com (10.56.130.76) by ashemwp00006.mail.tfayd.com (100.126.24.30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1913.5 via Frontend Transport; Wed, 22 Jul 2020 10:46:26 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=IZFlqZE8eo/a+lZzFGwMoOC8Bl+tl7PcVfskHKHZU042l6ULk5V8v+tVfRZZSMbgMlCtc736HE1aKGy/1uwa+RSX9yG7K9g1Z1Vu7bgy7MMr3e2CvE9kdtV4LNl7OPYpfyJzoC0dfyM5P9k+zSTnURhFuv5I+U0rdhc9nfHwS75QvcJVixGp4XP3LAgd2lGCcbDIZ9xqU3WAB/Ib2Isaqg8HrfA/AZSgMKTcKpv6yhFgA6cfXj9FDnQfWACtrqR40J3O3PBJgSeV6MwAJkLJMIfqIubaSe1QJWDPqsOGxKSD74kvd++Cg3pZ8yc0y/0YWWBJtHyNsICjKVEvx73Mgg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=O4xdUvgI+A6SIEYTboJphoKVcIIk1+765E34jX+2b1Q=; b=Kcuy78QefShTjN7wL8XS0I1g6j8ql5i9INUXZ8162AQkhxaSj6RFDpXpd/MeXDg3l7LeHzw6xXhTxEooGFBNebPQDl72IhcPLJy0HielXeMQzZRJt5gyELwMUET6hS1RstdOm1B4+FNtnHoeW63kJhs+CJiAkeez1Ury4XU0GBuEwz3pflFm0lI26AJRUFVRVQ8esWk0onF05n/QP3cvbrRRZh/FecsnmTKcIv7b4SY+0XgKRMMHHJMG8siW9YwIEud1AvtmtLwv4WkgUVkkBIQxTmWEP3Sy90TsOKZo12IjTA3BKpX5PaEeNH6DyDZBfEz1gi9/LCtmHd6rB6RrBA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nbcuni.com; dmarc=pass action=none header.from=nbcuni.com; dkim=pass header.d=nbcuni.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NBCUNI.onmicrosoft.com; s=selector1-NBCUNI-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=O4xdUvgI+A6SIEYTboJphoKVcIIk1+765E34jX+2b1Q=; b=Cfauxls3qN8U7cpDnKEoU/9C7Dhkey4yV1c/iAYUa+Fq9LBQzXHgucmL6aUWu5uTaso5KzVSlhXaD4aXDilx6zX0aeOIFGkbbieP6XsolgHYjVOvK4GwDcW2gZvQK0pFEAKlKNTHo7Vatg6ne6/s8FDOXCoYASmS8NNK7CEN7bs= Received: from BYAPR14MB3094.namprd14.prod.outlook.com (2603:10b6:a03:14d::30) by BY5PR14MB3986.namprd14.prod.outlook.com (2603:10b6:a03:206::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.23; Wed, 22 Jul 2020 14:46:26 +0000 Received: from BYAPR14MB3094.namprd14.prod.outlook.com ([fe80::e074:901e:d085:be5c]) by BYAPR14MB3094.namprd14.prod.outlook.com ([fe80::e074:901e:d085:be5c%7]) with mapi id 15.20.3195.025; Wed, 22 Jul 2020 14:46:26 +0000 From: "Deen, Glenn (NBCUniversal)" To: Michael Richardson , ADD Mailing list CC: "Deen, Glenn (NBCUniversal)" Thread-Topic: [EXTERNAL] Re: [Add] IETF108 ADD Agenda Thread-Index: AQHWXuqdTSzFseWptUy4yJH39rObGqkRqBwAgACnw4CAAC2KAIAAvSiA Date: Wed, 22 Jul 2020 14:46:26 +0000 Message-ID: <36D29439-9F38-41C7-B2F4-0767BC56B6D9@nbcuni.com> References: <5EFC3442-045F-4F89-A4BA-769C1AFE87A4@comcast.com> <20200721074558.GC29757@nic.fr> <9390.1595363364@localhost> In-Reply-To: <9390.1595363364@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: sandelman.ca; dkim=none (message not signed) header.d=none;sandelman.ca; dmarc=none action=none header.from=nbcuni.com; x-originating-ip: [2605:e000:141b:121:9442:a71d:7b0a:7e04] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: db3f60e6-d507-4af1-be95-08d82e4e02de x-ms-traffictypediagnostic: BY5PR14MB3986: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: uey/hG4dHbKRh4M1j55YmKyKuLWH9sGK6IBbsNUp8V3B0g8aYVP0ZKyzrsnNbSyCy1J0/gbBMB9McXDUJ89+Kuk7gp+WcOFJf2qcG80CZHcBV/y6w88Z3H30mZIkKO9a519FO3ZqEVNG6HLgkJy5ZNuUCUUkYfxXJcReyDoW+xmrv7ElVjefAoCzmtj/GwdZM6aZxi4NPwxmnjD72MoigCCnCZnbwTESqg02AomJP9SP0GNKGjTp6dbtWRnaW0Ci+AXqV98t6ACA1Xe/uBZfvIob1ic307h5DfJ6jFK4/QwctaiJJDLDCw3+e9z9crC3 x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR14MB3094.namprd14.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(136003)(376002)(39860400002)(366004)(346002)(396003)(4326008)(2616005)(110136005)(2906002)(8936002)(6506007)(316002)(107886003)(8676002)(6512007)(36756003)(5660300002)(71200400001)(86362001)(83380400001)(33656002)(6486002)(478600001)(186003)(66946007)(76116006)(66446008)(64756008)(66556008)(66476007)(4744005); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: mRMd0ZUMUgfXf78Y1nvtWIW0hfpwCRViBf/kYICSv0yQOODTy/iay80CQm252mtKCguJ53p/h9uLUnktR+6+NCeLMxROFJcjs84KNKN3UNIFWqKEawLxeN11TmeNrm8yA46d7eUFSsWEVo8VxsBZWz8/KB74oAJAP/u/00qkhcYKdhnbnz9SXZdxk5KxL2s60V5tkebYDq3oWgOg3qSr7HhrT+CH/0neZATXGRZA0j2Lb/OCGzYE4t/uEemd3klnuoLDMn9OVoAcnb0JtidTRUvHUDEceptDIO4ZZzvt5pG458aW9aRTQtm/1a1yLpQKJzkkDMsMtkgbm++rKATLKg8EhRgh0jfQ1+nJ/9g5Rhz73ifODdDQtstil9UYZDCbNr+MS+DRNmp6/PK3h0E7iQL8yAwkqAakFTnSzevDxWIjMWqdJcDFuKDi3Meybs0e3BAuxTN3tiI8Rteghsj0ZG9m41P8NHTfykRVTUBQ0tAeAmB/HOoZPHD4K97hvscYpbWx13b7BI6k6FrVJuAGtUIvrWiKOHp2C84Jp/muE0Rrufe2egrPhIIlByT/zpRM Content-Type: text/plain; charset="utf-8" Content-ID: <7E658777386287429A357F2D6606762A@namprd14.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BYAPR14MB3094.namprd14.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: db3f60e6-d507-4af1-be95-08d82e4e02de X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2020 14:46:26.1745 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4f3526f9-97d6-412d-933a-4e30a73110f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: s7tv3ymy312kpz55Yi+WUx5aF0hwVrU4Pk7t1YmjpM6otZg3bVneEP3Wb9lQ7CWL42fXiym8ziMTcM0VdEWi4A== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR14MB3986 X-OriginatorOrg: nbcuni.com X-EXCLAIMER-MD-CONFIG: 47edc00f-f2d6-45ef-be83-8a353bd47e45 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-22_08:2020-07-22, 2020-07-22 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 priorityscore=1501 suspectscore=0 mlxlogscore=999 impostorscore=0 phishscore=0 lowpriorityscore=0 bulkscore=0 clxscore=1015 spamscore=0 mlxscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007220104 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: IETF108 ADD Agenda X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 14:46:31 -0000 SGkgTWljaGFlbA0KDQrvu79PbiA3LzIxLzIwLCAxOjMwIFBNLCAiQWRkIG9uIGJlaGFsZiBvZiBN aWNoYWVsIFJpY2hhcmRzb24iIDxhZGQtYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2YgbWNy K2lldGZAc2FuZGVsbWFuLmNhPiB3cm90ZToNCg0KICAgIEl0IHNlZW1zIHRvIG1lIHRoYXQgcHJl c2VudGluZyBhdXRob3JzIGNvdWxkIGFkanVzdCB0aGVpciBzbGlkZSB0aW1lL2NvbnRlbnQNCiAg ICB0byBhc3N1bWUgcGVvcGxlIGhhdmUgcmVhZCB0aGUgZG9jdW1lbnRzLCBhbmQgdG8gZm9jdXMg b24gaG93IHRoZSBwcm9wb3NhbA0KICAgIGZpdHMgaW50byB0aGUgY2hhcnRlciwgYW5kIGludG8g b3RoZXIgZG9jdW1lbnRzLg0KDQpUaGlzIGlzIHZlcnkgY2xvc2UgdG8gd2hhdCBoYXMgYmVlbiB0 b2xkIHRvIHRoZSBwcmVzZW50ZXJzIGF0IElFVEYxMDguICBBc3N1bWUgcGVvcGxlIGhhdmUgcmVh ZCwgcHJlc2VudCB5b3VyIGNoYW5nZXMgbm90IHlvdXIgZW50aXJlIGRvY3VtZW50IGFuZCBpZiB5 b3UgYXJlIGEgbmV3IC0wMCBkb2N1bWVudCAtIHByZXNlbnQgdGhlIGltcG9ydGFudCBoaWdobGln aHRzLiAgDQoNClRoZSBhZ2VuZGEgZm9yIDEwOCBpcyB2ZXJ5IHRpZ2h0IGJ1dCBob3BlZnVsbHkg Zm9jdXNpbmcgb24gaGlnaGxpZ2h0cyBhbmQgdXBkYXRlcyB3aWxsIHBlcm1pdCBzb21lLCBhbGJl aXQgbGltaXRlZCwgIGNvbW1lbnRzIGR1cmluZyB0aGUgc2Vzc2lvbi4gICBUaGUgU2VwdGVtYmVy IHNlc3Npb24gd2lsbCBiZSBsb25nZXIgd2hpY2ggc2hvdWxkIHBlcm1pdCBtb3JlIGV4dGVuc2l2 ZSBkaXNjdXNzaW9uLg0KDQotZ2xlbm4NCg0KDQoNCg== From nobody Wed Jul 22 07:49:58 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 322DE3A0780 for ; Wed, 22 Jul 2020 07:49:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com header.b=fpDAJpUY; dkim=pass (2048-bit key) header.d=comcast.com header.b=kVjLpZlD; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=comcastcorp.onmicrosoft.com header.b=LWvR8UyY Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id flpxZ82rYYey for ; Wed, 22 Jul 2020 07:49:55 -0700 (PDT) Received: from mx0a-00143702.pphosted.com (mx0a-00143702.pphosted.com [148.163.145.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A18D3A0744 for ; Wed, 22 Jul 2020 07:49:55 -0700 (PDT) Received: from pps.filterd (m0156892.ppops.net [127.0.0.1]) by mx0a-00143702.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06MEmiHj000812 for ; Wed, 22 Jul 2020 10:49:55 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.com; h=from : to : subject : date : message-id : content-type : mime-version; s=20190412; bh=yD1W4dF3AzdHIx1cAHiazAK/RF0NPAhHoyrSymZyeeo=; b=fpDAJpUYhhEnBPEad1WoQR4dghTFynDc/fdotk/qn2x/4OTGVATHr4k5JsuzjaLD+1l5 uPwnj9lk+kTruPaAhP7u50ClGQF+k/xfSR+obylcPhEM01gAKbF0Cq/7+Hzrksxc0pT8 /3va83GQhpc/cU1jiwWhMwAZ7hk45OR+DuPmwKc9WTQKY00xPWPtOndJWonN2SUAbXvA Xfroh3TDt1WMFyPyTStil88G5kA+bea/1hBYe3F2jHxn1QjFN0aasDCfi2xvO/mCYHsa buASiiouGBFAzlytGRniha7vrKpcwxr72IjVOdVjct5EmMxyrurjJRkTp9M55JjXJMKP pg== Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) by mx0a-00143702.pphosted.com with ESMTP id 32bvdkxx7y-34 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 22 Jul 2020 10:49:54 -0400 DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1595429394; x=2459342994; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=yD1W4dF3AzdHIx1cAHiazAK/RF0NPAhHoyrSymZyeeo=; b=kVjLpZlD7rycVPv3Lec/hUBeUTbQJg0qKnUTruPzL69fEHYgyUFe5wBxchd5Qq4D uwwQkwSyNghX53OocTDnD+odWdgfO1Uw5Fa6kEMlOl0byKaUVtOOt08fx4BZTUNA tnucvBvfgWpzc3QhfpfM8krem8wy7MqnUURMOzDlzf3ND8xXwIv/Z7FSzxw+bl1U oGm2lqYTXWRaN3RZcA+uY6ZZkc8exoK3hdURV38cLL4PK56ezwhWzRrbuQXBMj+A i7MKfBHfL2L2BWf3FVh6v1iCVH9ZDL3TTX269XdGhJNbr/BwOdDJrCCIA4YAot5L mZoOM9O6EPRPFpZKwHa24w==; X-AuditID: a2962c47-549ff7000001f819-ec-5f18521217d6 Received: from COPDCEX49.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id A7.EF.63513.212581F5; Wed, 22 Jul 2020 08:49:54 -0600 (MDT) Received: from COPDCEX50.cable.comcast.com (147.191.125.149) by COPDCEX49.cable.comcast.com (147.191.125.148) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 22 Jul 2020 08:49:53 -0600 Received: from COPDCEXEDGE01.cable.comcast.com (96.114.158.213) by COPDCEX50.cable.comcast.com (147.191.125.149) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Wed, 22 Jul 2020 08:49:53 -0600 Received: from NAM12-MW2-obe.outbound.protection.outlook.com (104.47.66.44) by webmail.comcast.com (96.114.158.213) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 22 Jul 2020 10:49:39 -0400 Received: from BL0PR11MB3107.namprd11.prod.outlook.com (2603:10b6:208:7c::12) by BL0PR11MB3249.namprd11.prod.outlook.com (2603:10b6:208:6b::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.23; Wed, 22 Jul 2020 14:49:38 +0000 Received: from BL0PR11MB3107.namprd11.prod.outlook.com ([fe80::140b:d467:2295:fc47]) by BL0PR11MB3107.namprd11.prod.outlook.com ([fe80::140b:d467:2295:fc47%6]) with mapi id 15.20.3216.020; Wed, 22 Jul 2020 14:49:38 +0000 From: "Deen, Glenn" To: ADD Mailing list Thread-Topic: [Add] IETF108 ADD Agenda Thread-Index: AQHWYDdS610faN2KsUKXHo+hbZH6EQ== Date: Wed, 22 Jul 2020 14:49:38 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=comcast.com; x-originating-ip: [2605:e000:141b:121:9442:a71d:7b0a:7e04] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 9898049a-2c2f-4478-8008-08d82e4e7554 x-ms-traffictypediagnostic: BL0PR11MB3249: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 2Qd678aYWdzLE2gHte8u3eHKFVZ6nKVMkm5qFC5QoidCq0KpHRyucpEPFknJ3GW5GQq1QQ/PHH+Rlbyh0PPaguW+MWuLEkYOO5ljjWpdDihUtLvbgqR5EAs90vs+unEaVxqdljte5Fj7ahzN+otE3zdoZACiEF9VM/NjF0pwSNiRZEZi7HLBFn1ovAmy1YEtD08wJ5frLB3TIVQ3ll0HJKbIN1De9JfqmRDeHujxr2GEzKj4/jgzi2GQIUndOmCQJzUasOLlmjj5VobrltDRgfDAgHPtn/0Zf8fDH0fBJKu4OmAmfCNOTHvEj6jB82ZzDTm6TY3ATe7Zerxmpc6C7kxSvqPHpjh6ROzMz9bXY/2GwYii1w4weTANpiKGIR59O2dn9qfU/xE2YNrgwVlAyg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BL0PR11MB3107.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(396003)(346002)(39860400002)(136003)(376002)(166002)(53546011)(6506007)(36756003)(83380400001)(8676002)(316002)(66574015)(966005)(478600001)(33656002)(6486002)(76116006)(5660300002)(66556008)(8936002)(2906002)(91956017)(86362001)(71200400001)(66476007)(6512007)(9686003)(6916009)(64756008)(66946007)(186003)(66446008); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: D73XBQ7UZY+xLqo6mXCAHLLOO5RDGLH6LgsSvgWJEcMM03QJBWZBL8vXN/RO0mga+oK9g0dIiO+uVCMTxDdLVGABk4K7EvUoE92EE4KLd3lnVzkBzn+xyzlxUOpxtaUi6wTqwmDmqUnv4cM89L07M+mP7qriHqv1eDE4+c1OPAEeTVjhQsj/CgQxI7CZs5p6PiJXFEWTujp5XDvx2h9aN87rGAXwL9Z7JWEerZaCwYBgjBMqayDdXkUlmpO4p4u4ZpmkYvYBUzeTpQ68WCKC2GCI0i2AeqqOeH1+70/59JBryhZvowRknmQEWsO7JRsce52LDPaWyhMDD60J9ivMnGu5T4+XP+bJBdMn5jR7G820jz469W2X+A4aGDaX33uC/o3E+1AqHDXx9L+7oHzfLaegJUj1Qa7VmFtMaDptw0JgRuyEJ7vHjITQt5qWmtuySMsuzH1iRe1SyiMkq+5Qe6ehrBw6jJ4YWN4Y2KCZ0W9e7E4jm31FCr+TYNAsdwAFwgc2nxxVIjBhrjThQFjo58yNuJjqNJA9A86CDgLLlW9/m01a4Zf9qw7r399eXmSh x-ms-exchange-transport-forked: True arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=hc9AWIkulyL+eYM3XFFZWMxrlEMW5hHhFYGBeOvwt8yI2ZzpHCMLjkBwhBUFH+Vc/5oY5QIoFNkIcL7CA5rgufXG3lgQ140VHpihKTEG2H0UhzXAio21gmkC+wRoFsr6IUWZvoBL3eebiKGKpshWhZ1YDvb0VUMiO+LvM/gWfVwcuTNEAZE4h9wKtHA6bOdzAJ2NDUsVN1fZL/j0mQQ7theCopgbVEkTdUNWh1bAW8+VVxH4FO4dIz8aXe3x/cVvczYW4jJdLFqvQgs5RRB2maKqMvmeqL5DkctUcC99J+XVRZjRBeuOlKmG0IV7mlVUpne5zD90e+l9WmOnXaWHIg== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dk6SEDmK+o75vyHGpSg6TwggGKlGSlbtFOOk0ggVs70=; b=JDmc5hRC87fm0XIVJAOaNz0eL5Ct0NjN9e0FdpQCNsGfuTP1YFBrmqieUUKMGjJpOZKIrM9pEyHaml//DPkmbq5Bxiqrw3DF3cbKCGWFl8ThvxJl/4Mgv7od5vw98uq2WbguMJBPEtubdo7l18lDXdGdXaDHkOVQys34cEgHU4lcdnorWf5v4ia0DKdgELM/C8JxKT3BfLechNN2sbYZ6g2+dPCxxlG+cxyB5n2eWe7a/BZQ4FpWLp+4NI0kthLps8n4eKAj59oCB6HsevWLIXuqpEEWGKF0PY6cPTJ6fLlu77uRAL+Q/Pps0JrqhCRf/IYqLmrywE64nvkCJW+swg== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=comcast.com; dmarc=pass action=none header.from=comcast.com; dkim=pass header.d=comcast.com; arc=none dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastcorp.onmicrosoft.com; s=selector1-comcastcorp-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dk6SEDmK+o75vyHGpSg6TwggGKlGSlbtFOOk0ggVs70=; b=LWvR8UyYFZsSOAz3wfjyq7mXO4VvOBy8IgfV3gesAfOlJQ1wOQlZwV1kGsCH/LssSWOA+bFQQxqkgCHhFHRk/UWTgl4seB3ygpmQanE34D8G40tFfXLchNNxFz0i4ywZ2ljoVAHRLHsKEs80omYzLjQS1t6gbR7gFzSUu6TY8EA= x-ms-exchange-crosstenant-authas: Internal x-ms-exchange-crosstenant-authsource: BL0PR11MB3107.namprd11.prod.outlook.com x-ms-exchange-crosstenant-network-message-id: 9898049a-2c2f-4478-8008-08d82e4e7554 x-ms-exchange-crosstenant-originalarrivaltime: 22 Jul 2020 14:49:38.2664 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 906aefe9-76a7-4f65-b82d-5ec20775d5aa x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: 7VFvOgbdEN13i2UL5dqnWIEdVOaRrvkLwmrsExFD9nfA0fbPjEpcTw3ArJCPIKIA3Jx8ptakaeRL9DzJFuw7VyXfBzR2uQIW20ARzHc36uE= x-ms-exchange-transport-crosstenantheadersstamped: BL0PR11MB3249 x-originatororg: comcast.com Content-Type: multipart/alternative; boundary="_000_DFDF00E555834BA090A3B06FB6C2E252nbcunicom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA02Sb0hTURjGO/febdfV4Lo0X5wJbWYmNp1YrTCtD5EVUvqhIMo58Jbi/Lep tAjRpKSpESqWoilpuTQUjFqoiC2KzYFWMovpzKWZ2jQhKyLa2nYW+O33PO/De973nEOTwg5O KJ2TX8yq85UqMZdPZapb6vcI00ERVzMkkbstvdzDKKWz8zdxGp3jJ2axqpxSVh2blMnPHq1s 4xUupl02D69S5ejVKR0KoIFJgF79NY4O8Wkh85IAs2mFwsKIYOhbg78yjeDhggVhYUJgn9H7 RQcBdbX3/OITgrcf1zwNaJrLxMCzJ8neQ4IYCTywGwgvb2V2QuOwk8B+JKy2WxFmKdy1Yp/y ZKzTFT5fwByC3haLz0fMNvg1+tjHJBMCtvk2Ai/BQOfQOIk5GJbmXBwvBzOxMNP33bcPYnQI lnUjyDsbMAeh3hiF89vhXVs1wpwKPQYTB3M02J/e8ffPBdtoFw9zJBgmx/1+OHTXOijMYTD7 wcD1ngXMIAk6/SyFhYsEa+sSD4t5CvQLyxSeIgJcRu1tJGvesBBmJdxYtVPNvgsIBHPTvIdp j78b+gZicWQHNFQ7eJij4HpLq59TYLDJQW3MtCO6Gwlk++Klsr1x0oQE6X5ZP/J8nfuNMcee o7XxC0bE0Ei8RdCTDAohR1mq0eZ5Xp8mxUGCGBSiEAqylNorrLpAoS5RsRojEtGUOERQY13M EDKXlMVsLssWsur/VYIOCC1HBa9FExcrbVfDPh84Iisjx44Ppq6fWOx3ljhuVoW6EqfklKTM TbwhTeuiquKBHLKo/FH034oF9CPQth71hdiUWTUbnP7+xfnWs5vzmsLnJumvu1Tx5gj3nwKe kW5ISitaqXSePKOemrC1a+GoRfTTPFInujVW2tiVIZe7nRIxpclWyqJJtUb5D47fKBc2AwAA X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-22_08:2020-07-22, 2020-07-22 signatures=0 X-Proofpoint-Spam-Reason: safe Archived-At: Subject: Re: [Add] IETF108 ADD Agenda X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 14:49:57 -0000 --_000_DFDF00E555834BA090A3B06FB6C2E252nbcunicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SeKAmXZlIHVwZGF0ZSB0aGUgYWdlbmRhIHRvIHJlZmxlY3QgdGhpcy4NCg0KDQoNCkJUVyAtIHRv IGF2b2lkIHRoZSDigJwwNuKAnSBvciDigJwwN+KAnSBxdWVzdGlvbiBpbiB0aGUgYWN0dWFsIEFn ZW5kYSBsaW5rcyBJIHVzZSB0aGUgbGluayB0byBkYXRhdHJhY2tlciBmb3IgdGhlIGRvY3VtZW50 IHNvIHlvdeKAmWxsIGJ5IGRlZmF1bHQgZ2V0IHRoZSBsYXRlc3QuDQoNCi1nbGVubg0KDQpPbiA3 LzIxLzIwLCAxMDo0NyBBTSwgIkFkZCBvbiBiZWhhbGYgb2YgQ2hyaXMgQm94IChCVCkiIDxhZGQt Ym91bmNlc0BpZXRmLm9yZzxtYWlsdG86YWRkLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJlaGFsZiBv ZiBjaHJpcy5ib3guaWV0ZkBnbWFpbC5jb208bWFpbHRvOmNocmlzLmJveC5pZXRmQGdtYWlsLmNv bT4+IHdyb3RlOg0KDQpJbiBhIHNpbWlsYXIgdmVpbiwgZHJhZnQtYnR3LWFkZC1ob21lLTA2IHNo b3VsZCBub3cgYmUgLTA3Lg0KDQpUaGUgYWdlbmRhIGxvb2tzIGxpa2UgYSBoaWdoLXNwZWVkIHRv dXIgb2YgdGhlIGRyYWZ0cywgd2hpY2ggaXMgcHJvYmFibHkgbmVjZXNzYXJ5LCBidXQgaXQncyB1 bmZvcnR1bmF0ZSB0aGVyZSBhcmUgb25seSA5MCBtaW51dGVzIHRvIHBsYXkgd2l0aC4gSSBpbWFn aW5lIHRoZSB0aW1lIGF2YWlsYWJsZSBmb3IgcXVlc3Rpb25zIG9uIGVhY2ggZHJhZnQgd2lsbCBi ZSBvbmx5IGEgbWludXRlIG9yIHR3by4uDQoNCldoZW4gZG8gdGhlIGNoYWlycyBleHBlY3QgZGlz Y3Vzc2lvbiB0byB0YWtlIHBsYWNlIG9uIHNlbGVjdGluZyBhIGNvaGVyZW50IHNldCBvZiBkcmFm dHMgdG8gbW92ZSBmb3J3YXJkIHdpdGg/IFdpbGwgdGhpcyBiZSBvbiB0aGUgbGlzdCBhZnRlcndh cmRzLCBvciBpcyB0aGlzIHBsYW5uZWQgZm9yIHRoZSBpbnRlcmltIG1lZXRpbmc/IEknbSBob3Bp bmcgd2UgZG9uJ3QgbmVlZCB0byB3YWl0IHVudGlsIFNlcHRlbWJlciBmb3IgdGhhdC4NCg0KVGhh bmtzLA0KQ2hyaXMNCg0KDQoNCk9uIFR1ZSwgMjEgSnVsIDIwMjAgYXQgMDg6NDYsIFN0ZXBoYW5l IEJvcnR6bWV5ZXIgPGJvcnR6bWV5ZXJAbmljLmZyPG1haWx0bzpib3J0em1leWVyQG5pYy5mcj4+ IHdyb3RlOg0KT24gTW9uLCBKdWwgMjAsIDIwMjAgYXQgMTE6MDg6MDFQTSArMDAwMCwNCiBEZWVu LCBHbGVubiA8R2xlbm5fRGVlbkBjb21jYXN0LmNvbTxtYWlsdG86R2xlbm5fRGVlbkBjb21jYXN0 LmNvbT4+IHdyb3RlDQogYSBtZXNzYWdlIG9mIDcxIGxpbmVzIHdoaWNoIHNhaWQ6DQoNCj4gVGhl IGFnZW5kYSBmb3IgQUREIEAgSUVURjEwOCBoYXMgbm93IGJlZW4gcG9zdGVkLg0KPiAoaHR0cHM6 Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9tZWV0aW5nLzEwOC9zZXNzaW9uL2FkZDxodHRwczovL3Vy bGRlZmVuc2UuY29tL3YzL19faHR0cHM6L2RhdGF0cmFja2VyLmlldGYub3JnL21lZXRpbmcvMTA4 L3Nlc3Npb24vYWRkX187ISFQSVplZVc1d3NjeW5SUSE0V3o5TzB3dUpoUW01d3ZEWHBfWjFWR3Rk S1U0R01OeDE1MmJZMmlELVhpX0Z1VEpFTXlhMTRFX0s2Ry1xS0llJD4pDQoNClR5cG86IHRoZSBk cmFmdCBmb3IgRFJEUCBpcyBkcmFmdC1tZ2x0LWFkZC1yZHAsIG5vdA0KZHJhZnQtbWdsdC1hZGQt ZHJkcC4NCg0KLS0NCkFkZCBtYWlsaW5nIGxpc3QNCkFkZEBpZXRmLm9yZzxtYWlsdG86QWRkQGll dGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hZGQ8aHR0cHM6 Ly91cmxkZWZlbnNlLmNvbS92My9fX2h0dHBzOi93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9hZGRfXzshIVBJWmVlVzV3c2N5blJRITRXejlPMHd1SmhRbTV3dkRYcF9aMVZHdGRLVTRHTU54 MTUyYlkyaUQtWGlfRnVUSkVNeWExNEVfSzZfWGVaM2EkPg0K --_000_DFDF00E555834BA090A3B06FB6C2E252nbcunicom_ Content-Type: text/html; charset="utf-8" Content-ID: <35B18F07E70D1846A13861C18B7611C2@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6IlRpbWVzIE5ldyBSb21hbiBcKEJvZHkgQ1NcKSI7DQoJcGFub3NlLTE6MiAyIDYgMyA1 IDQgNSAyIDMgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1z b05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAw MDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLkVtYWls U3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseTpI ZWx2ZXRpY2E7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5 bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0 aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4w aW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxl Pg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPknigJl2ZSB1cGRhdGUgdGhlIGFnZW5kYSB0 byByZWZsZWN0IHRoaXMuICZuYnNwOyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPkJUVyAtIHRvIGF2b2lkIHRoZSDigJwwNuKAnSBv ciDigJwwN+KAnSBxdWVzdGlvbiBpbiB0aGUgYWN0dWFsIEFnZW5kYSBsaW5rcyBJIHVzZSB0aGUg bGluayB0byBkYXRhdHJhY2tlciBmb3IgdGhlIGRvY3VtZW50IHNvIHlvdeKAmWxsIGJ5IGRlZmF1 bHQgZ2V0IHRoZSBsYXRlc3QuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYSI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OkhlbHZldGljYSI+LWdsZW5uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYSI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+T24gNy8yMS8yMCwgMTA6NDcgQU0sICZxdW90O0FkZCBvbiBi ZWhhbGYgb2YgQ2hyaXMgQm94IChCVCkmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzphZGQtYm91 bmNlc0BpZXRmLm9yZyI+YWRkLWJvdW5jZXNAaWV0Zi5vcmc8L2E+IG9uIGJlaGFsZiBvZg0KPGEg aHJlZj0ibWFpbHRvOmNocmlzLmJveC5pZXRmQGdtYWlsLmNvbSI+Y2hyaXMuYm94LmlldGZAZ21h aWwuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+SW4gYSBzaW1pbGFyIHZlaW4sIGRyYWZ0LWJ0dy1h ZGQtaG9tZS0wNiBzaG91bGQgbm93IGJlIC0wNy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj5UaGUgYWdlbmRhIGxvb2tzIGxpa2UgYSBoaWdoLXNwZWVkIHRv dXIgb2YgdGhlIGRyYWZ0cywgd2hpY2ggaXMgcHJvYmFibHkgbmVjZXNzYXJ5LCBidXQgaXQncyB1 bmZvcnR1bmF0ZSB0aGVyZSBhcmUgb25seSA5MCBtaW51dGVzIHRvIHBsYXkgd2l0aC4gSSBpbWFn aW5lIHRoZSB0aW1lIGF2YWlsYWJsZSBmb3IgcXVlc3Rpb25zIG9uIGVhY2ggZHJhZnQgd2lsbCBi ZSBvbmx5DQogYSBtaW51dGUgb3IgdHdvLi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj5XaGVuIGRvIHRoZSBjaGFpcnMgZXhwZWN0IGRpc2N1c3Npb24gdG8g dGFrZSBwbGFjZSBvbiBzZWxlY3RpbmcgYSBjb2hlcmVudCBzZXQgb2YgZHJhZnRzIHRvIG1vdmUg Zm9yd2FyZCB3aXRoPyBXaWxsIHRoaXMgYmUgb24gdGhlIGxpc3QgYWZ0ZXJ3YXJkcywgb3IgaXMg dGhpcyBwbGFubmVkIGZvciB0aGUgaW50ZXJpbSBtZWV0aW5nPyBJJ20gaG9waW5nIHdlIGRvbid0 DQogbmVlZCB0byB3YWl0IHVudGlsIFNlcHRlbWJlciBmb3IgdGhhdC48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5UaGFua3MsPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+Q2hyaXM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5PbiBU dWUsIDIxIEp1bCAyMDIwIGF0IDA4OjQ2LCBTdGVwaGFuZSBCb3J0em1leWVyICZsdDs8YSBocmVm PSJtYWlsdG86Ym9ydHptZXllckBuaWMuZnIiPmJvcnR6bWV5ZXJAbmljLmZyPC9hPiZndDsgd3Jv dGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4w cHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+T24gTW9uLCBKdWwgMjAsIDIwMjAgYXQgMTE6 MDg6MDFQTSAmIzQzOzAwMDAsPGJyPg0KJm5ic3A7RGVlbiwgR2xlbm4gJmx0OzxhIGhyZWY9Im1h aWx0bzpHbGVubl9EZWVuQGNvbWNhc3QuY29tIiB0YXJnZXQ9Il9ibGFuayI+R2xlbm5fRGVlbkBj b21jYXN0LmNvbTwvYT4mZ3Q7IHdyb3RlDQo8YnI+DQombmJzcDthIG1lc3NhZ2Ugb2YgNzEgbGlu ZXMgd2hpY2ggc2FpZDo8YnI+DQo8YnI+DQomZ3Q7IFRoZSBhZ2VuZGEgZm9yIEFERCBAIElFVEYx MDggaGFzIG5vdyBiZWVuIHBvc3RlZC48YnI+DQomZ3Q7ICg8YSBocmVmPSJodHRwczovL3VybGRl ZmVuc2UuY29tL3YzL19faHR0cHM6L2RhdGF0cmFja2VyLmlldGYub3JnL21lZXRpbmcvMTA4L3Nl c3Npb24vYWRkX187ISFQSVplZVc1d3NjeW5SUSE0V3o5TzB3dUpoUW01d3ZEWHBfWjFWR3RkS1U0 R01OeDE1MmJZMmlELVhpX0Z1VEpFTXlhMTRFX0s2Ry1xS0llJCIgdGFyZ2V0PSJfYmxhbmsiPmh0 dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvbWVldGluZy8xMDgvc2Vzc2lvbi9hZGQ8L2E+KTxi cj4NCjxicj4NClR5cG86IHRoZSBkcmFmdCBmb3IgRFJEUCBpcyBkcmFmdC1tZ2x0LWFkZC1yZHAs IG5vdDxicj4NCmRyYWZ0LW1nbHQtYWRkLWRyZHAuPGJyPg0KPGJyPg0KLS0gPGJyPg0KQWRkIG1h aWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpBZGRAaWV0Zi5vcmciIHRhcmdldD0iX2Js YW5rIj5BZGRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLmNv bS92My9fX2h0dHBzOi93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hZGRfXzshIVBJWmVl VzV3c2N5blJRITRXejlPMHd1SmhRbTV3dkRYcF9aMVZHdGRLVTRHTU54MTUyYlkyaUQtWGlfRnVU SkVNeWExNEVfSzZfWGVaM2EkIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby9hZGQ8L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_DFDF00E555834BA090A3B06FB6C2E252nbcunicom_-- From nobody Wed Jul 22 08:12:00 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9734E3A088A for ; Wed, 22 Jul 2020 08:11:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.918 X-Spam-Level: X-Spam-Status: No, score=-1.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id alKsGSMgksHA for ; Wed, 22 Jul 2020 08:11:56 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 31CD53A0888 for ; Wed, 22 Jul 2020 08:11:56 -0700 (PDT) Received: from pps.filterd (m0049463.ppops.net [127.0.0.1]) by m0049463.ppops.net-00191d01. (8.16.0.42/8.16.0.42) with SMTP id 06MF4AhW022495; Wed, 22 Jul 2020 11:11:55 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049463.ppops.net-00191d01. with ESMTP id 32dpc053eg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2020 11:11:54 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id 06MFBrBE014626; Wed, 22 Jul 2020 11:11:53 -0400 Received: from zlp30484.vci.att.com (zlp30484.vci.att.com [135.47.91.179]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id 06MFBlVB014479 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 22 Jul 2020 11:11:47 -0400 Received: from zlp30484.vci.att.com (zlp30484.vci.att.com [127.0.0.1]) by zlp30484.vci.att.com (Service) with ESMTP id 926914009E78; Wed, 22 Jul 2020 15:11:47 +0000 (GMT) Received: from GAALPA1MSGEX1CD.ITServices.sbc.com (unknown [135.50.89.111]) by zlp30484.vci.att.com (Service) with ESMTPS id 6CA4B4009E72; Wed, 22 Jul 2020 15:11:47 +0000 (GMT) Received: from GAALPA1MSGEX1CB.ITServices.sbc.com (135.50.89.109) by GAALPA1MSGEX1CD.ITServices.sbc.com (135.50.89.111) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2044.4; Wed, 22 Jul 2020 11:11:44 -0400 Received: from GAALPA1MSGEX1CB.ITServices.sbc.com ([135.50.89.109]) by GAALPA1MSGEX1CB.ITServices.sbc.com ([135.50.89.109]) with mapi id 15.01.2044.004; Wed, 22 Jul 2020 11:11:44 -0400 From: "STARK, BARBARA H" To: "'Eric Rescorla'" CC: "'Michael Richardson'" , "'ADD Mailing list'" Thread-Topic: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators Thread-Index: AQHWXqS/7aOk/WOOM0GAfZqI925UXKkQ02OAgAB6x4CAACdhAIABSZeAgAAGSoD//8NFwIAAYLmAgAC4UrA= Date: Wed, 22 Jul 2020 15:11:44 +0000 Message-ID: <774f665882ec4dfbbd4682f83c2a3009@att.com> References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <7671.1595362961@localhost> <4361a792716b4f9f8f2054e4fddcab34@att.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.10.66.16] x-tm-snts-smtp: 736CA246ECA40142D50154F1BFB9C62FA9252754A1024D31E8B79ADA888102642 Content-Type: multipart/alternative; boundary="_000_774f665882ec4dfbbd4682f83c2a3009attcom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-22_09:2020-07-22, 2020-07-22 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 lowpriorityscore=0 clxscore=1015 impostorscore=0 mlxscore=0 mlxlogscore=999 bulkscore=0 malwarescore=0 priorityscore=1501 spamscore=0 phishscore=0 adultscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007220105 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 15:11:59 -0000 --_000_774f665882ec4dfbbd4682f83c2a3009attcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQoNCkZyb206IEVyaWMgUmVzY29ybGEgPGVrckBydGZtLmNvbT4NClNlbnQ6IFR1ZXNkYXksIEp1 bHkgMjEsIDIwMjAgNTo1NCBQTQ0KVG86IFNUQVJLLCBCQVJCQVJBIEggPGJzNzY1MkBhdHQuY29t Pg0KQ2M6IE1pY2hhZWwgUmljaGFyZHNvbiA8bWNyK2lldGZAc2FuZGVsbWFuLmNhPjsgQUREIE1h aWxpbmcgbGlzdCA8YWRkQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtBZGRdIFByYWN0aWNhbCBP YnNlcnZhdGlvbnMgZnJvbSBFbmNyeXB0ZWQgRE5TIERlcGxveW1lbnRzIGJ5IE5ldHdvcmsgT3Bl cmF0b3JzDQoNCk9uIFR1ZSwgSnVsIDIxLCAyMDIwIGF0IDM6NDEgUE0gU1RBUkssIEJBUkJBUkEg SCA8YnM3NjUyQGF0dC5jb208bWFpbHRvOmJzNzY1MkBhdHQuY29tPj4gd3JvdGU6DQpbQkhTXSBX aGlsZSBteSBJU1AgcmVxdWlyZXMgbWUgdG8gdXNlIHRoZSBDRSByb3V0ZXIgdGhleSBzdXBwbHks IEnigJl2ZSBuZXZlciBoYWQgYW4gaXNzdWUgY29ubmVjdGluZyB0aGF0IHRvIG15IG93biByb3V0 ZXIgYW5kIHRoZW4gcnVubmluZyBteSBob21lIG5ldHdvcmsgZnJvbSBteSByb3V0ZXIuIFRoZSBD RSByb3V0ZXIgZnJvbSBteSBwYXJ0aWN1bGFyIElTUCAoWU1NVikgZXZlbiBhdXRvbWF0aWNhbGx5 IHBhc3NlcyBvbiB0aGUgcHVibGljIElQdjQgYWRkcmVzcyBpdCBhY3F1aXJlcyBhbmQgYSAvNjQg SVB2NiBwcmVmaXggdG8gbXkgcm91dGVyIChzbyBJUHY0IGp1c3QgaGFzIHRoZSBzaW5nbGUgTkFU IGFuZCBJUHY2IHdvcmtzIGdyZWF0KS4gSSBoYXZlIHRvdGFsIGFiaWxpdHkgdG8gY2hvb3NlIGFu eSByb3V0ZXIgSSB3YW50IGFuZCBjb25maWd1cmUgdGhhdCByb3V0ZXIgYXMgbXVjaCBhcyB0aGF0 IHJvdXRlciB2ZW5kb3LigJlzIEdVSSBhbGxvd3MgKGUuZy4sIE5ldGdlYXIgR1VJcyBkb27igJl0 IGxldCB5b3UgY29uZmlndXJlIHRoZSBETlMgc2VydmVyIGluZm8gaXQgc3VwcGxpZXMgdG8gdGhl IExBTiB2aWEgREhDUCwgZXRjLiDigJMgaXQgYWx3YXlzIHN1cHBsaWVzIGl0cyBvd24gSVAgYWRk cmVzczsgaXQgZG9lcyBsZXQgdGhlIHVzZXIgc2F5IHdoZXRoZXIgaXRzIHByb3h5IHdpbGwgdXNl IEROUyBpbmZvIGl0IGdldHMgdmlhIERIQ1Agb3IgY29uZmlndXJlIHN0YXRpYyBETlMgaW5mbyku IEl0IHNlZW1zIHRvIG1lIHRoYXQgYW55b25lIHdobyBpcyBjb25jZXJuZWQgd2l0aCB3aGF0IHRo ZSBJU1AgY2FuIGRvIHZpcy3DoC12aXMgdGhlaXIgaG9tZSBuZXR3b3JrIHNob3VsZCBiZSBmaXJl d2FsbGluZyB0aGUgSVNQIENFIHJvdXRlciwgYW55d2F5LiBJ4oCZbSBhdCBhIGxvc3MgdG8gdW5k ZXJzdGFuZCB3aHkgcGVvcGxlIGFyZSBjb25zaWRlcmVkIOKAnGZvcmNlZOKAnSB0byB1c2UgdGhl IElTUCBDRSByb3V0ZXIgYXMgdGhlaXIgaG9tZSBuZXR3b3JrIHJvdXRlciwganVzdCBiZWNhdXNl IHRoZXnigJlyZSBmb3JjZWQgdG8gdXNlIGl0IHRvIHRlcm1pbmF0ZSB0aGUgSVNQIFdBTiBjb25u ZWN0aW9uLiBJIGRvIHVuZGVyc3RhbmQgdGhhdCBwZW9wbGUgZG8gdGhpcyBmb3IgZWFzZSBhbmQg Y29udmVuaWVuY2UuIEJ1dCB0aG9zZSBzYW1lIHBlb3BsZSBhcmUgYWxzbyB1bmxpa2VseSB0byBj YXJlIGFib3V0IGNoYW5naW5nIGF3YXkgZnJvbSB0aGUgSVNQIHJlc29sdmVycy4gSWYgeW91IGNh cmUgZW5vdWdoIHRvIHdhbnQgdG8gY29uZmlndXJlIHRoZSBETlMgdXNlZCBpbiB5b3VyIGhvbWUg bmV0d29yaywgeW91IHNob3VsZCBjYXJlIGVub3VnaCB0byBydW4geW91ciBvd24gcm91dGVyIGJl dHdlZW4geW91ciBuZXR3b3JrIGFuZCB0aGUgSVNQIOKAnFdBTiB0ZXJtaW5hdGlvbiBkZXZpY2Xi gJ0uIC0tQmFyYmFyYQ0KDQpJJ20gbm90IHF1aXRlIHN1cmUgd2hhdCB5b3UncmUgcmVzcG9uZGlu ZyB0byBoZXJlLCBiZWNhdXNlIEkgZGlkbid0IHNheSBhbnl0aGluZyBhYm91dCBmb3JjZWQsIGFu ZCB0aGUgY29uY2VybiBJJ20gcmFpc2luZyBoZXJlIGlzIG5vdCBhYm91dCB0aGUgSVNQIGRvaW5n IHRoaW5ncyB2aXMtYS12aXMgdGhlIHVzZXIncyBob21lIG5ldHdvcmsgYnV0ICphdHRhY2tlcnMq IGRvaW5nIHRoaW5ncyBieSBjb21wcm9taXNpbmcgdGhlIElTUC1wcm92aWRlZCBDRSByb3V0ZXIu DQoNClRoZSBjb250ZXh0IG9mIHRoaXMgZGlzY3Vzc2lvbiBhcyBJIHVuZGVyc3RhbmQgaXQgaXMg dGhpczoNCkEgbnVtYmVyIG9mIGVuZHBvaW50cyBhcmUgdXNpbmcgU1BBVSBtZWNoYW5pc21zIGZv ciBjb252ZXJ0aW5nIGZyb20gRG81MyB0byBEb1tUSF0uIFRoaXMgZHJhZnQgcG9pbnRzIG91dCB0 aGF0IHRoaXMgaGFzIHRoZSBwb3RlbnRpYWwgdG8gY2F1c2UgdGhlIGVuZHBvaW50IHRvIGNvbm5l Y3QgZGlyZWN0bHkgdG8gdGhlIElTUCdzIHJlc29sdmVyLCBieXBhc3NpbmcgdGhlIENQRSBhbmQg YW55IGZ1bmN0aW9ucyB0aGF0IHRoZSBDUEUgcGVyZm9ybXMgKHByZXN1bWFibHkgdGhlIElTUCBy ZXNvbHZlciBjb3VsZCBwZXJmb3JtIHNvbWUgYnV0IG5vdCBhbGwgb2YgdGhlc2UpIGFuZCBwcm9w b3NlcyB0aGF0IHdlIGRldmVsb3Agc29tZSBtZWNoYW5pc20gdG8gYXZvaWQgYnlwYXNzaW5nIHRo ZSBDUEUuIEF0IGxlYXN0IGZyb20gbXkgcGVyc3BlY3RpdmUgdGhpcyBwYXJ0aWN1bGFyIGRpc2N1 c3Npb24gaXMgbm90IGFib3V0IHRoZSBJU1AgdmVyc3VzIHRoZSBjb25zdW1lciBidXQgYWJvdXQg d2hldGhlciBpdCBpcyBhZHZpc2FibGUgdG8gZGVzaWduIGEgbWVjaGFuaXNtIHRvIGtlZXAgdGhl IENQRSBpbiB0aGUgbG9vcC4NCg0KLUVrcg0KDQpbQkhTXSBJ4oCZbSBnb2luZyB0byBhc3N1bWUg dGhhdCBieSDigJxDUEXigJ0geW914oCZcmUgcmVmZXJyaW5nIHRvIGFuIElTUC1zdXBwbGllZCBD RSByb3V0ZXIgaW4gdGhlIGNvbnRleHQgb2YgdGhpcyBkaXNjdXNzaW9uLiBbTm90ZTog4oCcQ1BF 4oCdIGlzIGEgZ2VuZXJhbCB0ZXJtIHRoYXQgY2FuIG1lYW4gYW55IHByb3ZpZGVyLXN1cHBsaWVk IEN1c3RvbWVyIFByZW1pc2VzIEVxdWlwbWVudCAoZS5nLiwgcm91dGVycywgV2ktRmkgZXh0ZW5k ZXJzLCBzZXQtdG9wIGJveGVzLCBob21lIHNlY3VyaXR5IHNlbnNvcnMgYW5kIGNhbWVyYXMpIOKA kyBhbHRob3VnaCBwZW9wbGUgb2NjYXNpb25hbGx5IHVzZSBpdCB0byByZWZlciB0byBhbnkgZXF1 aXBtZW50IG9uIHRoZSBjdXN0b21lcuKAmXMgcHJlbWlzZXM7IHVzaW5nIOKAnENQReKAnSBhcyBz eW5vbnltb3VzIHdpdGggdGhlIChJU1Atc3VwcGxpZWQpIENFIHJvdXRlciBpcyBhIHBldCBwZWV2 ZSBvZiBtaW5lLl0gIFRoZXJlIGhhZCBiZWVuIGEgbGluayBwcm92aWRlZCBlYXJsaWVyIGluIHRo aXMgdGhyZWFkIHRvIGEgTGlua3N5cyByb3V0ZXIgdnVsbmVyYWJpbGl0eS4gTGlua3N5cyBoYXMg ZnJvbSB0aW1lLXRvLXRpbWUgaGFkIGRlYWxzIHdpdGggSVNQcyB0byBzdXBwbHkgcm91dGVycywg YnV0IG1vc3QgTGlua3N5cyByb3V0ZXJzIGFyZSBub3QgSVNQLXN1cHBsaWVkIChhbmQgdGhlcmVm b3JlIG5vdCBDUEUgaW4gdGhlIGNvbW1vbiBkZWZpbml0aW9uIG9mIHRoZSB0ZXJtKS4gTW9zdCBM aW5rc3lzIHJvdXRlcnMgYXJlIHB1cmNoYXNlZCBieSBjb25zdW1lcnMuIFNvIEnigJltIHN0cnVn Z2xpbmcgdG8gdW5kZXJzdGFuZCB3aGV0aGVyIHlvdSBiZWxpZXZlIHRoYXQgdXNlci1vd25lZC9p bnN0YWxsZWQgYXBwbGljYXRpb25zIGFuZCBjb25zdW1lciBob3N0IGRldmljZXMgd2l0aCBhIGxv bmcgdHJhY2sgcmVjb3JkIG9mIHZ1bG5lcmFiaWxpdGllcyBzaG91bGQgYmUgYXZvaWRpbmcgc2Vy dmljZXMgc3VwcGxpZWQgYnkgdGhlIGhvbWUtbmV0d29yay1vd25lciBvd25lZC9pbnN0YWxsZWQg KGFuZCBwb3NzaWJseSBjb21wcm9taXNlZCkgQ0Ugcm91dGVycyAobGlrZSBMaW5rc3lzKSAoaW5k ZXBlbmRlbnQgb2Ygd2hhdCB0aGUgaG9tZS1uZXR3b3JrLW93bmVyIHdhbnRzLCBiZWNhdXNlIHRo ZSB2ZW5kb3JzIG9mIGhpZ2hseS12dWxuZXJhYmxlIGFuZCBwb3NzaWJseSBjb21wcm9taXNlZCBh cHBsaWNhdGlvbnMgYW5kIGhvc3QgZGV2aWNlcyBrbm93IHdoYXTigJlzIGJlc3QpOyBvciB0aGF0 IGFwcHMgYW5kIGRldmljZXMgc2hvdWxkIGJlIGF2b2lkaW5nIHNlcnZpY2VzIHN1cHBsaWVkIGJ5 IElTUC1zdXBwbGllZC9tYW5hZ2VkIENFIHJvdXRlcnMgKHdoaWNoIGluIHRoZSBVUyB0ZW5kIHRv IGJlIGZyZXF1ZW50bHkgdXBkYXRlZCB0byBhZGRyZXNzIHZ1bG5lcmFiaWxpdGllcykuDQoNCkZy ZXF1ZW50bHksIHRoZSBmaXJzdCBpbmRpY2F0aW9uIHVzZXJzIGhhdmUgdGhhdCB0aGVpciBhcHBs aWNhdGlvbnMgb3IgaG9zdCBkZXZpY2VzIGhhdmUgYmVlbiBjb21wcm9taXNlZCBpcyB3aGVuIHRo ZSBJU1AgdGVsbHMgdGhlbSB0aGF0IHZpcmFsIHRyYWZmaWMgaXMgY29taW5nIGZyb20gdGhhdCBo b21lIG5ldHdvcmsgKGFuZCB0aGUgdXNlcuKAmXMgSW50ZXJuZXQgc2VydmljZSBtYXkgYmUgc3Vz cGVuZGVkIHVudGlsIGl0IHN0b3BzKS4gVGhlIENFIHJvdXRlciBpcyBpbiB0aGUgYmVzdCBwb3Np dGlvbiB0byBkZXRlY3QgbWFsd2FyZSBlbWFuYXRpbmcgZnJvbSB0aGUgaG9tZSBuZXR3b3JrLiBX ZSBzaG91bGQgYmUgdHJ5aW5nIHRvIG1ha2UgaXQgZWFzaWVyIGZvciB0aGUgQ0Ugcm91dGVyIHRv IGRvIHRoaXMsIHJhdGhlciB0aGFuIG1vcmUgZGlmZmljdWx0Lg0KDQpBbmQsIEJUVywgYnkgZmFy IHRoZSBiaWdnZXN0IHZ1bG5lcmFiaWxpdGllcyBpbnNpZGUgdGhlIGhvbWUgbmV0d29yayBhcmUg dGhlIHVzZXJzLiBXaGF0IHJlYWxseSBzZWVtcyB0byBiZSBpbXBsaWVkIGlzIHRoYXQgdGhlIHVz ZXIgY2Fu4oCZdCBiZSB0cnVzdGVkIHRvIGRvIHdoYXQgaXMgcmlnaHQgZm9yIHRoZW1zZWx2ZXMs IHNvIGFwcGxpY2F0aW9ucyBhbmQgZGV2aWNlIHZlbmRvcnMgbmVlZCB0byBiZSBpbiBjb250cm9s IGFuZCBtaW5pbWl6ZSB1c2Vyc+KAmSBhYmlsaXR5IHRvIGF1dG9tYXRpY2FsbHkgaW5mbHVlbmNl IGFuZCBjb250cm9sIHRob3NlIGFwcHMgYW5kIGhvc3RzIChpbmRlcGVuZGVudCBvZiB3aGV0aGVy IHVzZXJzIGNhbiBvciBzaG91bGQgdHJ1c3QgdGhlIHZlbmRvcnM7IGFuZCB3aG8gcmFyZWx5IGhh dmUgYSBjb250cmFjdHVhbCByZWxhdGlvbnNoaXAgd2l0aCB1c2VycykuIEkgZGlzYWdyZWUuIFdo aWxlIHVzZXJzIGFyZSB0aGUgYmlnZ2VzdCB0aHJlYXQgdG8gdGhlaXIgb3duIGhvbWUgbmV0d29y a3MgYW5kIGRldmljZXMsIGdpdmluZyBhcHAgYW5kIGhvc3QgdmVuZG9ycyBtb3JlIGNvbnRyb2wg dG8gYnlwYXNzIHVzZXIgYW5kIGhvbWUtbmV0d29yay1vd25lciBjaG9pY2VzIGlzIG5vdCB0aGUg YW5zd2VyLiBXaGF0IHdlIG5lZWQgaXMgbW9yZSBhbmQgYmV0dGVyIHRvb2xzIGZvciB1c2VycyBh bmQgaG9tZS1uZXR3b3JrLW93bmVycyB0byBrbm93IHdoZW4gc29tZXRoaW5nIGluc2lkZSB0aGVp ciBuZXR3b3JrIGhhcyBiZWVuIGNvbXByb21pc2VkIGFuZCB0byBtYWtlIGluZm9ybWVkIGNob2lj ZXMuIC0tIEJhcmJhcmENCg== --_000_774f665882ec4dfbbd4682f83c2a3009attcom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IlByb2dJZCIg Y29udGVudD0iV29yZC5Eb2N1bWVudCI+DQo8bWV0YSBuYW1lPSJHZW5lcmF0b3IiIGNvbnRlbnQ9 Ik1pY3Jvc29mdCBXb3JkIDE1Ij4NCjxtZXRhIG5hbWU9Ik9yaWdpbmF0b3IiIGNvbnRlbnQ9Ik1p Y3Jvc29mdCBXb3JkIDE1Ij4NCjxsaW5rIHJlbD0iRmlsZS1MaXN0IiBocmVmPSJjaWQ6ZmlsZWxp c3QueG1sQDAxRDY2MDEwLjc3NDA2MzYwIj48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOk9m ZmljZURvY3VtZW50U2V0dGluZ3M+DQo8bzpBbGxvd1BORy8+DQo8bzpEb05vdFJlbHlPbkNTUy8+ DQo8L286T2ZmaWNlRG9jdW1lbnRTZXR0aW5ncz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPHc6V29yZERvY3VtZW50Pg0KPHc6U3BlbGxpbmdTdGF0ZT5DbGVh bjwvdzpTcGVsbGluZ1N0YXRlPg0KPHc6RG9jdW1lbnRLaW5kPkRvY3VtZW50RW1haWw8L3c6RG9j dW1lbnRLaW5kPg0KPHc6VHJhY2tNb3Zlcy8+DQo8dzpUcmFja0Zvcm1hdHRpbmcvPg0KPHc6RW52 ZWxvcGVWaXMvPg0KPHc6VmFsaWRhdGVBZ2FpbnN0U2NoZW1hcy8+DQo8dzpTYXZlSWZYTUxJbnZh bGlkPmZhbHNlPC93OlNhdmVJZlhNTEludmFsaWQ+DQo8dzpJZ25vcmVNaXhlZENvbnRlbnQ+ZmFs c2U8L3c6SWdub3JlTWl4ZWRDb250ZW50Pg0KPHc6QWx3YXlzU2hvd1BsYWNlaG9sZGVyVGV4dD5m YWxzZTwvdzpBbHdheXNTaG93UGxhY2Vob2xkZXJUZXh0Pg0KPHc6RG9Ob3RQcm9tb3RlUUYvPg0K PHc6TGlkVGhlbWVPdGhlcj5FTi1VUzwvdzpMaWRUaGVtZU90aGVyPg0KPHc6TGlkVGhlbWVBc2lh bj5YLU5PTkU8L3c6TGlkVGhlbWVBc2lhbj4NCjx3OkxpZFRoZW1lQ29tcGxleFNjcmlwdD5YLU5P TkU8L3c6TGlkVGhlbWVDb21wbGV4U2NyaXB0Pg0KPHc6Q29tcGF0aWJpbGl0eT4NCjx3OkRvTm90 RXhwYW5kU2hpZnRSZXR1cm4vPg0KPHc6QnJlYWtXcmFwcGVkVGFibGVzLz4NCjx3OlNuYXBUb0dy aWRJbkNlbGwvPg0KPHc6V3JhcFRleHRXaXRoUHVuY3QvPg0KPHc6VXNlQXNpYW5CcmVha1J1bGVz Lz4NCjx3OkRvbnRHcm93QXV0b2ZpdC8+DQo8dzpTcGxpdFBnQnJlYWtBbmRQYXJhTWFyay8+DQo8 dzpFbmFibGVPcGVuVHlwZUtlcm5pbmcvPg0KPHc6RG9udEZsaXBNaXJyb3JJbmRlbnRzLz4NCjx3 Ok92ZXJyaWRlVGFibGVTdHlsZUhwcy8+DQo8L3c6Q29tcGF0aWJpbGl0eT4NCjxtOm1hdGhQcj4N CjxtOm1hdGhGb250IG06dmFsPSJDYW1icmlhIE1hdGgiLz4NCjxtOmJya0JpbiBtOnZhbD0iYmVm b3JlIi8+DQo8bTpicmtCaW5TdWIgbTp2YWw9IiYjNDU7LSIvPg0KPG06c21hbGxGcmFjIG06dmFs PSJvZmYiLz4NCjxtOmRpc3BEZWYvPg0KPG06bE1hcmdpbiBtOnZhbD0iMCIvPg0KPG06ck1hcmdp biBtOnZhbD0iMCIvPg0KPG06ZGVmSmMgbTp2YWw9ImNlbnRlckdyb3VwIi8+DQo8bTp3cmFwSW5k ZW50IG06dmFsPSIxNDQwIi8+DQo8bTppbnRMaW0gbTp2YWw9InN1YlN1cCIvPg0KPG06bmFyeUxp bSBtOnZhbD0idW5kT3ZyIi8+DQo8L206bWF0aFByPjwvdzpXb3JkRG9jdW1lbnQ+DQo8L3htbD48 IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjx3OkxhdGVudFN0eWxlcyBEZWZM b2NrZWRTdGF0ZT0iZmFsc2UiIERlZlVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgRGVmU2VtaUhpZGRl bj0iZmFsc2UiIERlZlFGb3JtYXQ9ImZhbHNlIiBEZWZQcmlvcml0eT0iOTkiIExhdGVudFN0eWxl Q291bnQ9IjM3NyI+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjAi IFFGb3JtYXQ9InRydWUiIE5hbWU9Ik5vcm1hbCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI5IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDEiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIgU2VtaUhpZGRlbj0idHJ1 ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFGb3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgMiIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI5IiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iaGVhZGlu ZyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjkiIFNlbWlI aWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJo ZWFkaW5nIDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFGb3JtYXQ9InRydWUiIE5h bWU9ImhlYWRpbmcgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZvcm1hdD0idHJ1 ZSIgTmFtZT0iaGVhZGluZyA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBRRm9ybWF0 PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iOSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFG b3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iaGVhZGluZyA5Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 ImluZGV4IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0 cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iaW5kZXggMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJpbmRleCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhp ZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImluZGV4IDQiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iaW5kZXggNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJpbmRleCA2Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRl V2hlblVzZWQ9InRydWUiIE5hbWU9ImluZGV4IDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iaW5k ZXggOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJpbmRleCA5Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0idG9jIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBO YW1lPSJ0b2MgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIz OSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9InRvYyAzIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9jIDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0b2MgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSIzOSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRy dWUiIE5hbWU9InRvYyA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjM5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9j IDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlI aWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0b2MgOCIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzOSIgU2VtaUhpZGRlbj0idHJ1ZSIg VW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9InRvYyA5Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 Ik5vcm1hbCBJbmRlbnQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlk ZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iZm9vdG5vdGUgdGV4dCIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdo ZW5Vc2VkPSJ0cnVlIiBOYW1lPSJhbm5vdGF0aW9uIHRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFt ZT0iaGVhZGVyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImZvb3RlciIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJpbmRleCBoZWFkaW5nIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjM1IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZv cm1hdD0idHJ1ZSIgTmFtZT0iY2FwdGlvbiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0YWJsZSBv ZiBmaWd1cmVzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImVudmVsb3BlIGFkZHJlc3MiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iZW52ZWxvcGUgcmV0dXJuIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 ImZvb3Rub3RlIHJlZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJhbm5vdGF0aW9uIHJl ZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJsaW5lIG51bWJlciIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJwYWdlIG51bWJlciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJlbmRub3RlIHJl ZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJlbmRub3RlIHRleHQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0idGFibGUgb2YgYXV0aG9yaXRpZXMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i bWFjcm8iLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9hIGhlYWRpbmciLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IEJ1bGxldCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0 IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iTGlzdCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 Ikxpc3QgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IDUiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBCdWxsZXQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IEJ1bGxldCAz Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxpc3QgQnVsbGV0IDQiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBCdWxsZXQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxpc3QgTnVtYmVyIDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBOdW1iZXIgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciA1 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjEwIiBRRm9ybWF0 PSJ0cnVlIiBOYW1lPSJUaXRsZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJDbG9zaW5nIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hl blVzZWQ9InRydWUiIE5hbWU9IlNpZ25hdHVyZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSIxIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iRGVmYXVsdCBQYXJhZ3JhcGggRm9udCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJC b2R5IFRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0 cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEluZGVudCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJMaXN0IENvbnRpbnVlIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxp c3QgQ29udGludWUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IENvbnRpbnVlIDMiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iTGlzdCBDb250aW51ZSA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9Ikxpc3QgQ29udGludWUgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJNZXNzYWdlIEhlYWRl ciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIxMSIgUUZvcm1h dD0idHJ1ZSIgTmFtZT0iU3VidGl0bGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iU2FsdXRhdGlv biIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJEYXRlIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkJv ZHkgVGV4dCBGaXJzdCBJbmRlbnQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBT ZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEZp cnN0IEluZGVudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRl bj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ik5vdGUgSGVhZGluZyIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJCb2R5IFRleHQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCb2R5 IFRleHQgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCb2R5IFRleHQgSW5kZW50IDIiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEluZGVudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9IkJsb2NrIFRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlk ZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSHlwZXJsaW5rIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVz ZWQ9InRydWUiIE5hbWU9IkZvbGxvd2VkSHlwZXJsaW5rIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjIyIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJTdHJvbmciLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMjAiIFFGb3JtYXQ9InRy dWUiIE5hbWU9IkVtcGhhc2lzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2Vt aUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkRvY3VtZW50IE1hcCIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJQbGFpbiBUZXh0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IkUtbWFpbCBTaWduYXR1cmUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1p SGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBUb3Agb2YgRm9y bSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIEJvdHRvbSBvZiBGb3JtIi8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9 InRydWUiIE5hbWU9Ik5vcm1hbCAoV2ViKSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIEFj cm9ueW0iLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBBZGRyZXNzIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRy dWUiIE5hbWU9IkhUTUwgQ2l0ZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIENvZGUiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBEZWZpbml0aW9uIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9IkhUTUwgS2V5Ym9hcmQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1p SGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBQcmVmb3JtYXR0 ZWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBTYW1wbGUiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iSFRNTCBUeXBld3JpdGVyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkhUTUwgVmFyaWFi bGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iYW5ub3RhdGlvbiBzdWJqZWN0Ii8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9 InRydWUiIE5hbWU9Ik5vIExpc3QiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBT ZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iT3V0bGluZSBMaXN0 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iT3V0bGluZSBMaXN0IDIiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iT3V0bGluZSBMaXN0IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgU2lt cGxlIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgU2ltcGxlIDIiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0iVGFibGUgU2ltcGxlIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUg Q2xhc3NpYyAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENsYXNzaWMgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDbGFzc2ljIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i VGFibGUgQ2xhc3NpYyA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhp ZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENvbG9yZnVsIDEi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhp ZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgQ29sb3JmdWwgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJUYWJsZSBDb2xvcmZ1bCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENv bHVtbnMgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDb2x1bW5zIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgQ29sdW1ucyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRh YmxlIENvbHVtbnMgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDb2x1bW5zIDUiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IlRhYmxlIEdyaWQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBHcmlkIDMiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRh YmxlIEdyaWQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49 InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBHcmlkIDYiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCA3Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxl IEdyaWQgOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDEiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0iVGFibGUgTGlzdCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIExp c3QgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iVGFibGUgTGlzdCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIExpc3Qg NiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDciLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iVGFibGUgTGlzdCA4Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2Vt aUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIDNEIGVmZmVj dHMgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSAzRCBlZmZlY3RzIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgM0QgZWZmZWN0cyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IlRhYmxlIENvbnRlbXBvcmFyeSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBFbGVnYW50 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIFByb2Zlc3Npb25hbCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJUYWJsZSBTdWJ0bGUgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBT dWJ0bGUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBXZWIgMSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJUYWJsZSBXZWIgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCYWxsb29uIFRl eHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIE5hbWU9 IlRhYmxlIEdyaWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVu PSJ0cnVlIiBOYW1lPSJQbGFjZWhvbGRlciBUZXh0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjEiIFFGb3JtYXQ9InRydWUiIE5hbWU9Ik5vIFNwYWNpbmciLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIE5hbWU9IkxpZ2h0 IFNoYWRpbmciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEi IE5hbWU9IkxpZ2h0IExpc3QiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjIiIE5hbWU9IkxpZ2h0IEdyaWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjMiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDEiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjQiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIE5hbWU9Ik1l ZGl1bSBMaXN0IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NjYiIE5hbWU9Ik1lZGl1bSBMaXN0IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1bSBHcmlkIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5hbWU9Ik1lZGl1bSBHcmlk IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9 IkRhcmsgTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGluZyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI3MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9u IExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgTmFtZT0iQ29sb3JmdWwgR3JpZCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQgU2hh ZGluZyBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2MSIgTmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgMSIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVtIFNo YWRpbmcgMSBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI2NCIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMiBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2Nl bnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IE5hbWU9IlJldmlzaW9uIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjM0IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJMaXN0IFBhcmFncmFwaCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIyOSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0i UXVvdGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzAiIFFG b3JtYXQ9InRydWUiIE5hbWU9IkludGVuc2UgUXVvdGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIE5hbWU9Ik1lZGl1bSBMaXN0IDIgQWNjZW50IDEiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1 bSBHcmlkIDEgQWNjZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNjZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5hbWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9 IkRhcmsgTGlzdCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI3MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGluZyBBY2NlbnQgMSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCBB Y2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIg TmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQgU2hhZGluZyBBY2NlbnQgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MSIgTmFtZT0iTGlnaHQgTGlz dCBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2 MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMSBBY2NlbnQgMiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NCIgTmFtZT0iTWVkaXVt IFNoYWRpbmcgMiBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIgTmFtZT0iTWVkaXVtIExpc3QgMiBBY2Nl bnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NyIgTmFt ZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI2OCIgTmFtZT0iTWVkaXVtIEdyaWQgMiBBY2NlbnQgMiIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OSIgTmFtZT0iTWVkaXVtIEdyaWQg MyBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MCIgTmFtZT0iRGFyayBMaXN0IEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjcxIiBOYW1lPSJDb2xvcmZ1bCBTaGFkaW5nIEFjY2VudCAyIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcyIiBOYW1lPSJDb2xvcmZ1 bCBMaXN0IEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjczIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYwIiBOYW1lPSJMaWdodCBTaGFkaW5nIEFjY2VudCAz Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYxIiBOYW1lPSJM aWdodCBMaXN0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjYyIiBOYW1lPSJMaWdodCBHcmlkIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAxIEFjY2Vu dCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY0IiBOYW1l PSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjY1IiBOYW1lPSJNZWRpdW0gTGlzdCAxIEFjY2VudCAzIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY2IiBOYW1lPSJNZWRpdW0gTGlz dCAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjY3IiBOYW1lPSJNZWRpdW0gR3JpZCAxIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBOYW1lPSJNZWRpdW0gR3JpZCAyIEFjY2VudCAzIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY5IiBOYW1lPSJNZWRp dW0gR3JpZCAzIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjcwIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzEiIE5hbWU9IkNvbG9yZnVsIFNoYWRpbmcgQWNjZW50 IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzIiIE5hbWU9 IkNvbG9yZnVsIExpc3QgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNzMiIE5hbWU9IkNvbG9yZnVsIEdyaWQgQWNjZW50IDMiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIE5hbWU9IkxpZ2h0IFNoYWRpbmcg QWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEi IE5hbWU9IkxpZ2h0IExpc3QgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjIiIE5hbWU9IkxpZ2h0IEdyaWQgQWNjZW50IDQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjMiIE5hbWU9Ik1lZGl1bSBTaGFkaW5n IDEgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NjQiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIE5hbWU9Ik1lZGl1bSBMaXN0IDEgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIE5hbWU9Ik1l ZGl1bSBMaXN0IDIgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1bSBHcmlkIDEgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNj ZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5h bWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9IkRhcmsgTGlzdCBBY2NlbnQgNCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGlu ZyBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgTmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgNCIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQg U2hhZGluZyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI2MSIgTmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgNSIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVt IFNoYWRpbmcgMSBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2NCIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBB Y2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIg TmFtZT0iTWVkaXVtIExpc3QgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2NyIgTmFtZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgNSIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OCIgTmFtZT0iTWVkaXVtIEdy aWQgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2OSIgTmFtZT0iTWVkaXVtIEdyaWQgMyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MCIgTmFtZT0iRGFyayBMaXN0IEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcxIiBOYW1lPSJDb2xvcmZ1 bCBTaGFkaW5nIEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjcyIiBOYW1lPSJDb2xvcmZ1bCBMaXN0IEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNlcHRp b24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjczIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2Vu dCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYwIiBOYW1l PSJMaWdodCBTaGFkaW5nIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjYxIiBOYW1lPSJMaWdodCBMaXN0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYyIiBOYW1lPSJMaWdodCBHcmlkIEFjY2Vu dCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBOYW1l PSJNZWRpdW0gU2hhZGluZyAxIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjY0IiBOYW1lPSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCA2Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY1IiBOYW1lPSJNZWRpdW0g TGlzdCAxIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjY2IiBOYW1lPSJNZWRpdW0gTGlzdCAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY3IiBOYW1lPSJNZWRpdW0gR3JpZCAxIEFjY2VudCA2 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBOYW1lPSJN ZWRpdW0gR3JpZCAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjY5IiBOYW1lPSJNZWRpdW0gR3JpZCAzIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcwIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50 IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzEiIE5hbWU9 IkNvbG9yZnVsIFNoYWRpbmcgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNzIiIE5hbWU9IkNvbG9yZnVsIExpc3QgQWNjZW50IDYiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzMiIE5hbWU9IkNvbG9yZnVsIEdy aWQgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i MTkiIFFGb3JtYXQ9InRydWUiIE5hbWU9IlN1YnRsZSBFbXBoYXNpcyIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIyMSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iSW50 ZW5zZSBFbXBoYXNpcyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSIzMSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iU3VidGxlIFJlZmVyZW5jZSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzMiIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0i SW50ZW5zZSBSZWZlcmVuY2UiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iMzMiIFFGb3JtYXQ9InRydWUiIE5hbWU9IkJvb2sgVGl0bGUiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzciIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCaWJsaW9ncmFwaHkiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJUT0MgSGVhZGluZyIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MSIgTmFtZT0iUGxhaW4gVGFibGUgMSIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MiIgTmFtZT0iUGxh aW4gVGFibGUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0 MyIgTmFtZT0iUGxhaW4gVGFibGUgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0NCIgTmFtZT0iUGxhaW4gVGFibGUgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NSIgTmFtZT0iUGxhaW4gVGFibGUgNSIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MCIgTmFtZT0iR3JpZCBUYWJsZSBM aWdodCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFt ZT0iR3JpZCBUYWJsZSAxIExpZ2h0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iR3JpZCBUYWJsZSA0Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1lPSJHcmlk IFRhYmxlIDUgRGFyayIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2IENvbG9yZnVsIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9IkdyaWQg VGFibGUgMSBMaWdodCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0NyIgTmFtZT0iR3JpZCBUYWJsZSAyIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ4IiBOYW1lPSJHcmlkIFRhYmxlIDMgQWNj ZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5h bWU9IkdyaWQgVGFibGUgNCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iR3JpZCBUYWJsZSA1IERhcmsgQWNjZW50IDEiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9IkdyaWQgVGFi bGUgNiBDb2xvcmZ1bCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI1MiIgTmFtZT0iR3JpZCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCAxIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJHcmlkIFRh YmxlIDEgTGlnaHQgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNDciIE5hbWU9IkdyaWQgVGFibGUgMiBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OCIgTmFtZT0iR3JpZCBUYWJsZSAzIEFjY2Vu dCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1l PSJHcmlkIFRhYmxlIDQgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNTAiIE5hbWU9IkdyaWQgVGFibGUgNSBEYXJrIEFjY2VudCAyIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJHcmlkIFRhYmxl IDYgQ29sb3JmdWwgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNTIiIE5hbWU9IkdyaWQgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iR3JpZCBUYWJs ZSAxIExpZ2h0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyBBY2NlbnQg MyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0i R3JpZCBUYWJsZSA0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjUwIiBOYW1lPSJHcmlkIFRhYmxlIDUgRGFyayBBY2NlbnQgMyIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2 IENvbG9yZnVsIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDMiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9IkdyaWQgVGFibGUg MSBMaWdodCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI0NyIgTmFtZT0iR3JpZCBUYWJsZSAyIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ4IiBOYW1lPSJHcmlkIFRhYmxlIDMgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikdy aWQgVGFibGUgNCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI1MCIgTmFtZT0iR3JpZCBUYWJsZSA1IERhcmsgQWNjZW50IDQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9IkdyaWQgVGFibGUgNiBD b2xvcmZ1bCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI1MiIgTmFtZT0iR3JpZCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCA0Ii8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJHcmlkIFRhYmxlIDEg TGlnaHQgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNDciIE5hbWU9IkdyaWQgVGFibGUgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OCIgTmFtZT0iR3JpZCBUYWJsZSAzIEFjY2VudCA1Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJHcmlk IFRhYmxlIDQgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNTAiIE5hbWU9IkdyaWQgVGFibGUgNSBEYXJrIEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJHcmlkIFRhYmxlIDYgQ29s b3JmdWwgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNTIiIE5hbWU9IkdyaWQgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgNSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iR3JpZCBUYWJsZSAxIExp Z2h0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyBBY2NlbnQgNiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iR3JpZCBU YWJsZSA0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjUwIiBOYW1lPSJHcmlkIFRhYmxlIDUgRGFyayBBY2NlbnQgNiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2IENvbG9y ZnVsIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdo dCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0i TGlzdCBUYWJsZSAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iTGlzdCBUYWJsZSA1IERhcmsiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFi bGUgNiBDb2xvcmZ1bCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI1MiIgTmFtZT0iTGlzdCBUYWJsZSA3IENvbG9yZnVsIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJMaXN0IFRhYmxlIDEgTGlnaHQgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDciIE5hbWU9 Ikxpc3QgVGFibGUgMiBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0OCIgTmFtZT0iTGlzdCBUYWJsZSAzIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJMaXN0IFRhYmxlIDQgQWNj ZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTAiIE5h bWU9Ikxpc3QgVGFibGUgNSBEYXJrIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJMaXN0IFRhYmxlIDYgQ29sb3JmdWwgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTIiIE5hbWU9 Ikxpc3QgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iTGlzdCBUYWJsZSAxIExpZ2h0IEFjY2VudCAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ3IiBOYW1lPSJM aXN0IFRhYmxlIDIgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNDgiIE5hbWU9Ikxpc3QgVGFibGUgMyBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iTGlzdCBUYWJsZSA0IEFjY2Vu dCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1l PSJMaXN0IFRhYmxlIDUgRGFyayBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iTGlzdCBUYWJsZSA2IENvbG9yZnVsIEFjY2VudCAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJM aXN0IFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdodCBBY2NlbnQgMyIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0iTGlz dCBUYWJsZSAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCBBY2NlbnQg MyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0i TGlzdCBUYWJsZSA1IERhcmsgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFibGUgNiBDb2xvcmZ1bCBBY2NlbnQgMyIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MiIgTmFtZT0iTGlz dCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJMaXN0IFRhYmxlIDEgTGlnaHQgQWNjZW50IDQiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDciIE5hbWU9Ikxpc3Qg VGFibGUgMiBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI0OCIgTmFtZT0iTGlzdCBUYWJsZSAzIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJMaXN0IFRhYmxlIDQgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTAiIE5hbWU9Ikxp c3QgVGFibGUgNSBEYXJrIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJMaXN0IFRhYmxlIDYgQ29sb3JmdWwgQWNjZW50IDQiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTIiIE5hbWU9Ikxpc3Qg VGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iTGlzdCBUYWJsZSAxIExpZ2h0IEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ3IiBOYW1lPSJMaXN0IFRh YmxlIDIgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNDgiIE5hbWU9Ikxpc3QgVGFibGUgMyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iTGlzdCBUYWJsZSA0IEFjY2VudCA1Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1lPSJMaXN0 IFRhYmxlIDUgRGFyayBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI1MSIgTmFtZT0iTGlzdCBUYWJsZSA2IENvbG9yZnVsIEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJMaXN0IFRh YmxlIDcgQ29sb3JmdWwgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdodCBBY2NlbnQgNiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0iTGlzdCBUYWJs ZSAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCBBY2NlbnQgNiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iTGlzdCBU YWJsZSA1IERhcmsgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFibGUgNiBDb2xvcmZ1bCBBY2NlbnQgNiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MiIgTmFtZT0iTGlzdCBUYWJs ZSA3IENvbG9yZnVsIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ik1lbnRpb24iLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iU21hcnQgSHlwZXJsaW5rIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9Ikhhc2h0YWciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVW5yZXNvbHZlZCBNZW50aW9uIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRl V2hlblVzZWQ9InRydWUiIE5hbWU9IlNtYXJ0IExpbmsiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i U21hcnQgTGluayBFcnJvciIvPg0KPC93OkxhdGVudFN0eWxlcz4NCjwveG1sPjwhW2VuZGlmXS0t PjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYgMyAyIDQ7DQoJ bXNvLWZvbnQtY2hhcnNldDowOw0KCW1zby1nZW5lcmljLWZvbnQtZmFtaWx5OnJvbWFuOw0KCW1z by1mb250LXBpdGNoOnZhcmlhYmxlOw0KCW1zby1mb250LXNpZ25hdHVyZTozIDAgMCAwIDEgMDt9 DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIg MiAyIDQgMyAyIDQ7DQoJbXNvLWZvbnQtY2hhcnNldDowOw0KCW1zby1nZW5lcmljLWZvbnQtZmFt aWx5OnN3aXNzOw0KCW1zby1mb250LXBpdGNoOnZhcmlhYmxlOw0KCW1zby1mb250LXNpZ25hdHVy ZTotNTM2ODU4ODgxIC0xMDczNzMyNDg1IDkgMCA1MTEgMDt9DQovKiBTdHlsZSBEZWZpbml0aW9u cyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttc28tc3R5 bGUtdW5oaWRlOm5vOw0KCW1zby1zdHlsZS1xZm9ybWF0OnllczsNCgltc28tc3R5bGUtcGFyZW50 OiIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCW1zby1wYWdpbmF0 aW9uOndpZG93LW9ycGhhbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KYTps aW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtbm9zaG93OnllczsNCgltc28tc3R5 bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5l Ow0KCXRleHQtdW5kZXJsaW5lOnNpbmdsZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5r Rm9sbG93ZWQNCgl7bXNvLXN0eWxlLW5vc2hvdzp5ZXM7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lOw0KCXRleHQtdW5k ZXJsaW5lOnNpbmdsZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3Jt YWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tc3R5bGUtdW5oaWRlOm5vOw0K CW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCW1zby1wYWdpbmF0aW9uOndp ZG93LW9ycGhhbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0Kc3Bhbi5nbWFp bC1tLTkxNTE2NDk5ODUwMTc3NDMyOHNwZWxsZQ0KCXttc28tc3R5bGUtbmFtZTpnbWFpbC1tXy05 MTUxNjQ5OTg1MDE3NzQzMjhzcGVsbGU7DQoJbXNvLXN0eWxlLXVuaGlkZTpubzt9DQpzcGFuLkVt YWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCgltc28tc3R5bGUt bm9zaG93OnllczsNCgltc28tc3R5bGUtdW5oaWRlOm5vOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MS4wcHQ7DQoJbXNvLWJpZGktZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjsNCgltc28tYXNjaWktZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tZmFy ZWFzdC1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1oYW5zaS1mb250LWZhbWlseTpDYWxpYnJp Ow0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iOw0KCWNvbG9yOndpbmRv d3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJ bXNvLWRlZmF1bHQtcHJvcHM6eWVzOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCW1zby1hc2NpaS1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFt aWx5OkNhbGlicmk7DQoJbXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJbXNvLWJpZGkt Zm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3Np emU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjsNCgltc28t aGVhZGVyLW1hcmdpbjouNWluOw0KCW1zby1mb290ZXItbWFyZ2luOi41aW47DQoJbXNvLXBhcGVy LXNvdXJjZTowO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+ PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gMTBdPjxzdHlsZT4vKiBTdHlsZSBEZWZpbml0aW9ucyAq Lw0KdGFibGUuTXNvTm9ybWFsVGFibGUNCgl7bXNvLXN0eWxlLW5hbWU6IlRhYmxlIE5vcm1hbCI7 DQoJbXNvLXRzdHlsZS1yb3diYW5kLXNpemU6MDsNCgltc28tdHN0eWxlLWNvbGJhbmQtc2l6ZTow Ow0KCW1zby1zdHlsZS1ub3Nob3c6eWVzOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28t c3R5bGUtcGFyZW50OiIiOw0KCW1zby1wYWRkaW5nLWFsdDowaW4gNS40cHQgMGluIDUuNHB0Ow0K CW1zby1wYXJhLW1hcmdpbjowaW47DQoJbXNvLXBhcmEtbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0K CW1zby1wYWdpbmF0aW9uOndpZG93LW9ycGhhbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1hc2NpaS1mb250LWZhbWlseTpDYWxp YnJpOw0KCW1zby1oYW5zaS1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1iaWRpLWZvbnQtZmFt aWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCjwvc3R5bGU+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUg bXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2 IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4N CjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9 IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIiBzdHlsZT0idGFiLWludGVydmFsOi41 aW4iPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxm b250IHNpemU9IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O21zby1hc2NpaS1mb250LWZhbWlseTpDYWxpYnJpO21zby1oYW5zaS1mb250LWZhbWlseTpDYWxp YnJpO21zby1iaWRpLWZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9mb250PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxm b250IHNpemU9IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O21zby1hc2NpaS1mb250LWZhbWlseTpDYWxpYnJpO21zby1oYW5zaS1mb250LWZhbWlseTpDYWxp YnJpO21zby1iaWRpLWZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9mb250PjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdCI+ DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUx IDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7bXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7 O2ZvbnQtd2VpZ2h0OmJvbGQiPkZyb206PC9zcGFuPjwvZm9udD48L2I+PHNwYW4gc3R5bGU9Im1z by1mYXJlYXN0LWZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+IEVyaWMg UmVzY29ybGEgJmx0O2VrckBydGZtLmNvbSZndDsNCjxicj4NCjxiPjxzcGFuIHN0eWxlPSJmb250 LXdlaWdodDpib2xkIj5TZW50Ojwvc3Bhbj48L2I+IFR1ZXNkYXksIEp1bHkgMjEsIDIwMjAgNTo1 NCBQTTxicj4NCjxiPjxzcGFuIHN0eWxlPSJmb250LXdlaWdodDpib2xkIj5Ubzo8L3NwYW4+PC9i PiBTVEFSSywgQkFSQkFSQSBIICZsdDticzc2NTJAYXR0LmNvbSZndDs8YnI+DQo8Yj48c3BhbiBz dHlsZT0iZm9udC13ZWlnaHQ6Ym9sZCI+Q2M6PC9zcGFuPjwvYj4gTWljaGFlbCBSaWNoYXJkc29u ICZsdDttY3ImIzQzO2lldGZAc2FuZGVsbWFuLmNhJmd0OzsgQUREIE1haWxpbmcgbGlzdCAmbHQ7 YWRkQGlldGYub3JnJmd0Ozxicj4NCjxiPjxzcGFuIHN0eWxlPSJmb250LXdlaWdodDpib2xkIj5T dWJqZWN0Ojwvc3Bhbj48L2I+IFJlOiBbQWRkXSBQcmFjdGljYWwgT2JzZXJ2YXRpb25zIGZyb20g RW5jcnlwdGVkIEROUyBEZXBsb3ltZW50cyBieSBOZXR3b3JrIE9wZXJhdG9yczxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBz aXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9mb250PjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdCI+T24gVHVlLCBKdWwgMjEsIDIwMjAgYXQgMzo0MSBQTSBTVEFSSywgQkFSQkFSQSBI ICZsdDs8YSBocmVmPSJtYWlsdG86YnM3NjUyQGF0dC5jb20iPmJzNzY1MkBhdHQuY29tPC9hPiZn dDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9mb250PjwvcD4NCjxkaXY+DQo8YmxvY2txdW90 ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDttc28t Ym9yZGVyLWxlZnQtYWx0OnNvbGlkICNDQ0NDQ0MgLjc1cHQ7cGFkZGluZzowaW4gMGluIDBpbiA2 LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48Yj48aT48Zm9udCBz aXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LXdlaWdodDpib2xkO2ZvbnQtc3R5bGU6aXRhbGljIj5bQkhTXSBXaGlsZSBteSBJU1AgcmVxdWly ZXMgbWUgdG8gdXNlIHRoZSBDRSByb3V0ZXIgdGhleSBzdXBwbHksIEnigJl2ZSBuZXZlcg0KIGhh ZCBhbiBpc3N1ZSBjb25uZWN0aW5nIHRoYXQgdG8gbXkgb3duIHJvdXRlciBhbmQgdGhlbiBydW5u aW5nIG15IGhvbWUgbmV0d29yayBmcm9tIG15IHJvdXRlci4gVGhlIENFIHJvdXRlciBmcm9tIG15 IHBhcnRpY3VsYXIgSVNQIChZTU1WKSBldmVuIGF1dG9tYXRpY2FsbHkgcGFzc2VzIG9uIHRoZSBw dWJsaWMgSVB2NCBhZGRyZXNzIGl0IGFjcXVpcmVzIGFuZCBhIC82NCBJUHY2IHByZWZpeCB0byBt eSByb3V0ZXIgKHNvIElQdjQganVzdCBoYXMNCiB0aGUgc2luZ2xlIE5BVCBhbmQgSVB2NiB3b3Jr cyBncmVhdCkuIEkgaGF2ZSB0b3RhbCBhYmlsaXR5IHRvIGNob29zZSBhbnkgcm91dGVyIEkgd2Fu dCBhbmQgY29uZmlndXJlIHRoYXQgcm91dGVyIGFzIG11Y2ggYXMgdGhhdCByb3V0ZXIgdmVuZG9y 4oCZcyBHVUkgYWxsb3dzIChlLmcuLA0KPHNwYW4gY2xhc3M9ImdtYWlsLW0tOTE1MTY0OTk4NTAx Nzc0MzI4c3BlbGxlIj5OZXRnZWFyPC9zcGFuPiBHVUlzIGRvbuKAmXQgbGV0IHlvdSBjb25maWd1 cmUgdGhlIEROUyBzZXJ2ZXIgaW5mbyBpdCBzdXBwbGllcyB0byB0aGUgTEFOIHZpYSBESENQLCBl dGMuIOKAkyBpdCBhbHdheXMgc3VwcGxpZXMgaXRzIG93biBJUCBhZGRyZXNzOyBpdCBkb2VzIGxl dCB0aGUgdXNlciBzYXkgd2hldGhlciBpdHMgcHJveHkgd2lsbCB1c2UgRE5TIGluZm8gaXQgZ2V0 cw0KIHZpYSBESENQIG9yIGNvbmZpZ3VyZSBzdGF0aWMgRE5TIGluZm8pLiBJdCBzZWVtcyB0byBt ZSB0aGF0IGFueW9uZSB3aG8gaXMgY29uY2VybmVkIHdpdGggd2hhdCB0aGUgSVNQIGNhbiBkbyB2 aXMtw6AtdmlzIHRoZWlyIGhvbWUgbmV0d29yayBzaG91bGQgYmUgZmlyZXdhbGxpbmcgdGhlIElT UCBDRSByb3V0ZXIsIGFueXdheS4gSeKAmW0gYXQgYSBsb3NzIHRvIHVuZGVyc3RhbmQgd2h5IHBl b3BsZSBhcmUgY29uc2lkZXJlZCDigJxmb3JjZWTigJ0gdG8gdXNlDQogdGhlIElTUCBDRSByb3V0 ZXIgYXMgdGhlaXIgaG9tZSBuZXR3b3JrIHJvdXRlciwganVzdCBiZWNhdXNlIHRoZXnigJlyZSBm b3JjZWQgdG8gdXNlIGl0IHRvIHRlcm1pbmF0ZSB0aGUgSVNQIFdBTiBjb25uZWN0aW9uLiBJIGRv IHVuZGVyc3RhbmQgdGhhdCBwZW9wbGUgZG8gdGhpcyBmb3IgZWFzZSBhbmQgY29udmVuaWVuY2Uu IEJ1dCB0aG9zZSBzYW1lIHBlb3BsZSBhcmUgYWxzbyB1bmxpa2VseSB0byBjYXJlIGFib3V0IGNo YW5naW5nIGF3YXkgZnJvbQ0KIHRoZSBJU1AgcmVzb2x2ZXJzLiBJZiB5b3UgY2FyZSBlbm91Z2gg dG8gd2FudCB0byBjb25maWd1cmUgdGhlIEROUyB1c2VkIGluIHlvdXIgaG9tZSBuZXR3b3JrLCB5 b3Ugc2hvdWxkIGNhcmUgZW5vdWdoIHRvIHJ1biB5b3VyIG93biByb3V0ZXIgYmV0d2VlbiB5b3Vy IG5ldHdvcmsgYW5kIHRoZSBJU1Ag4oCcV0FOIHRlcm1pbmF0aW9uIGRldmljZeKAnS4gLS1CYXJi YXJhPC9zcGFuPjwvZm9udD48L2k+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdCI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9mb250PjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGli cmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5JJ20gbm90IHF1aXRlIHN1cmUgd2hh dCB5b3UncmUgcmVzcG9uZGluZyB0byBoZXJlLCBiZWNhdXNlIEkgZGlkbid0IHNheSBhbnl0aGlu ZyBhYm91dCBmb3JjZWQsIGFuZCB0aGUgY29uY2VybiBJJ20gcmFpc2luZyBoZXJlIGlzIG5vdCBh Ym91dCB0aGUgSVNQIGRvaW5nIHRoaW5ncyB2aXMtYS12aXMgdGhlDQogdXNlcidzIGhvbWUgbmV0 d29yayBidXQgKmF0dGFja2VycyogZG9pbmcgdGhpbmdzIGJ5IGNvbXByb21pc2luZyB0aGUgSVNQ LXByb3ZpZGVkIENFIHJvdXRlci48bzpwPjwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJy aSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvZm9udD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBz aXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+VGhl IGNvbnRleHQgb2YgdGhpcyBkaXNjdXNzaW9uIGFzIEkgdW5kZXJzdGFuZCBpdCBpcyB0aGlzOjxv OnA+PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdCI+QSBudW1iZXIgb2YgZW5kcG9pbnRzIGFyZSB1c2luZyBTUEFVIG1lY2hhbmlz bXMgZm9yIGNvbnZlcnRpbmcgZnJvbSBEbzUzIHRvIERvW1RIXS4gVGhpcyBkcmFmdCBwb2ludHMg b3V0IHRoYXQgdGhpcyBoYXMgdGhlIHBvdGVudGlhbCB0byBjYXVzZSB0aGUgZW5kcG9pbnQgdG8g Y29ubmVjdCBkaXJlY3RseQ0KIHRvIHRoZSBJU1AncyByZXNvbHZlciwgYnlwYXNzaW5nIHRoZSBD UEUgYW5kIGFueSBmdW5jdGlvbnMgdGhhdCB0aGUgQ1BFIHBlcmZvcm1zIChwcmVzdW1hYmx5IHRo ZSBJU1AgcmVzb2x2ZXIgY291bGQgcGVyZm9ybSBzb21lIGJ1dCBub3QgYWxsIG9mIHRoZXNlKSBh bmQgcHJvcG9zZXMgdGhhdCB3ZSBkZXZlbG9wIHNvbWUgbWVjaGFuaXNtIHRvIGF2b2lkIGJ5cGFz c2luZyB0aGUgQ1BFLiBBdCBsZWFzdCBmcm9tIG15IHBlcnNwZWN0aXZlIHRoaXMNCiBwYXJ0aWN1 bGFyIGRpc2N1c3Npb24gaXMgbm90IGFib3V0IHRoZSBJU1AgdmVyc3VzIHRoZSBjb25zdW1lciBi dXQgYWJvdXQgd2hldGhlciBpdCBpcyBhZHZpc2FibGUgdG8gZGVzaWduIGEgbWVjaGFuaXNtIHRv IGtlZXAgdGhlIENQRSBpbiB0aGUgbG9vcC48bzpwPjwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0i Q2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvZm9udD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dCI+LUVrcjxvOnA+PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9mb250PjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiIHN0eWxlPSJtc28tYmlkaS1mb250LXdlaWdodDpub3Jt YWwiPjxpIHN0eWxlPSJtc28tYmlkaS1mb250LXN0eWxlOm5vcm1hbCI+PGZvbnQgc2l6ZT0iMiIg ZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWFzY2lpLWZv bnQtZmFtaWx5OkNhbGlicmk7bXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWJpZGkt Zm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7O2ZvbnQtd2VpZ2h0OmJvbGQ7 bXNvLWJpZGktZm9udC13ZWlnaHQ6bm9ybWFsO2ZvbnQtc3R5bGU6aXRhbGljO21zby1iaWRpLWZv bnQtc3R5bGU6bm9ybWFsIj5bQkhTXQ0KIEnigJltIGdvaW5nIHRvIGFzc3VtZSB0aGF0IGJ5IOKA nENQReKAnSB5b3XigJlyZSByZWZlcnJpbmcgdG8gYW4gSVNQLXN1cHBsaWVkIENFIHJvdXRlciBp biB0aGUgY29udGV4dCBvZiB0aGlzIGRpc2N1c3Npb24uIFtOb3RlOiDigJxDUEXigJ0gaXMgYSBn ZW5lcmFsIHRlcm0gdGhhdCBjYW4gbWVhbiBhbnkgcHJvdmlkZXItc3VwcGxpZWQgQ3VzdG9tZXIg UHJlbWlzZXMgRXF1aXBtZW50IChlLmcuLCByb3V0ZXJzLCBXaS1GaSBleHRlbmRlcnMsIHNldC10 b3AgYm94ZXMsDQogaG9tZSBzZWN1cml0eSBzZW5zb3JzIGFuZCBjYW1lcmFzKSDigJMgYWx0aG91 Z2ggcGVvcGxlIG9jY2FzaW9uYWxseSB1c2UgaXQgdG8gcmVmZXIgdG8gYW55IGVxdWlwbWVudCBv biB0aGUgY3VzdG9tZXLigJlzIHByZW1pc2VzOyB1c2luZyDigJxDUEXigJ0gYXMgc3lub255bW91 cyB3aXRoIHRoZSAoSVNQLXN1cHBsaWVkKSBDRSByb3V0ZXIgaXMgYSBwZXQgcGVldmUgb2YgbWlu ZS5dDQo8c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOnllcyI+Jm5ic3A7PC9zcGFuPlRoZXJlIGhh ZCBiZWVuIGEgbGluayBwcm92aWRlZCBlYXJsaWVyIGluIHRoaXMgdGhyZWFkIHRvIGEgTGlua3N5 cyByb3V0ZXIgdnVsbmVyYWJpbGl0eS4gTGlua3N5cyBoYXMgZnJvbSB0aW1lLXRvLXRpbWUgaGFk IGRlYWxzIHdpdGggSVNQcyB0byBzdXBwbHkgcm91dGVycywgYnV0IG1vc3QgTGlua3N5cyByb3V0 ZXJzIGFyZSBub3QgSVNQLXN1cHBsaWVkIChhbmQgdGhlcmVmb3JlDQogbm90IENQRSBpbiB0aGUg Y29tbW9uIGRlZmluaXRpb24gb2YgdGhlIHRlcm0pLiBNb3N0IExpbmtzeXMgcm91dGVycyBhcmUg cHVyY2hhc2VkIGJ5IGNvbnN1bWVycy4gU28gSeKAmW0gc3RydWdnbGluZyB0byB1bmRlcnN0YW5k IHdoZXRoZXIgeW91IGJlbGlldmUgdGhhdCB1c2VyLW93bmVkL2luc3RhbGxlZCBhcHBsaWNhdGlv bnMgYW5kIGNvbnN1bWVyIGhvc3QgZGV2aWNlcyB3aXRoIGEgbG9uZyB0cmFjayByZWNvcmQgb2Yg dnVsbmVyYWJpbGl0aWVzDQogc2hvdWxkIGJlIGF2b2lkaW5nIHNlcnZpY2VzIHN1cHBsaWVkIGJ5 IHRoZSBob21lLW5ldHdvcmstb3duZXIgb3duZWQvaW5zdGFsbGVkIChhbmQgcG9zc2libHkgY29t cHJvbWlzZWQpIENFIHJvdXRlcnMgKGxpa2UgTGlua3N5cykgKGluZGVwZW5kZW50IG9mIHdoYXQg dGhlIGhvbWUtbmV0d29yay1vd25lciB3YW50cywgYmVjYXVzZSB0aGUgdmVuZG9ycyBvZiBoaWdo bHktdnVsbmVyYWJsZSBhbmQgcG9zc2libHkgY29tcHJvbWlzZWQgYXBwbGljYXRpb25zDQogYW5k IGhvc3QgZGV2aWNlcyBrbm93IHdoYXTigJlzIGJlc3QpOyBvciB0aGF0IGFwcHMgYW5kIGRldmlj ZXMgc2hvdWxkIGJlIGF2b2lkaW5nIHNlcnZpY2VzIHN1cHBsaWVkIGJ5IElTUC1zdXBwbGllZC9t YW5hZ2VkIENFIHJvdXRlcnMgKHdoaWNoIGluIHRoZSBVUyB0ZW5kIHRvIGJlIGZyZXF1ZW50bHkg dXBkYXRlZCB0byBhZGRyZXNzIHZ1bG5lcmFiaWxpdGllcykuDQo8bzpwPjwvbzpwPjwvc3Bhbj48 L2ZvbnQ+PC9pPjwvYj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YiBzdHlsZT0ibXNvLWJp ZGktZm9udC13ZWlnaHQ6bm9ybWFsIj48aSBzdHlsZT0ibXNvLWJpZGktZm9udC1zdHlsZTpub3Jt YWwiPjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O21zby1hc2NpaS1mb250LWZhbWlseTpDYWxpYnJpO21zby1oYW5zaS1mb250LWZhbWls eTpDYWxpYnJpO21zby1iaWRpLWZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90 Oztmb250LXdlaWdodDpib2xkO21zby1iaWRpLWZvbnQtd2VpZ2h0Om5vcm1hbDtmb250LXN0eWxl Oml0YWxpYzttc28tYmlkaS1mb250LXN0eWxlOm5vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9mb250PjwvaT48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGIgc3R5bGU9Im1z by1iaWRpLWZvbnQtd2VpZ2h0Om5vcm1hbCI+PGkgc3R5bGU9Im1zby1iaWRpLWZvbnQtc3R5bGU6 bm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDttc28tYXNjaWktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28taGFuc2ktZm9udC1m YW1pbHk6Q2FsaWJyaTttc28tYmlkaS1mb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4m cXVvdDs7Zm9udC13ZWlnaHQ6Ym9sZDttc28tYmlkaS1mb250LXdlaWdodDpub3JtYWw7Zm9udC1z dHlsZTppdGFsaWM7bXNvLWJpZGktZm9udC1zdHlsZTpub3JtYWwiPkZyZXF1ZW50bHksDQogdGhl IGZpcnN0IGluZGljYXRpb24gdXNlcnMgaGF2ZSB0aGF0IHRoZWlyIGFwcGxpY2F0aW9ucyBvciBo b3N0IGRldmljZXMgaGF2ZSBiZWVuIGNvbXByb21pc2VkIGlzIHdoZW4gdGhlIElTUCB0ZWxscyB0 aGVtIHRoYXQgdmlyYWwgdHJhZmZpYyBpcyBjb21pbmcgZnJvbSB0aGF0IGhvbWUgbmV0d29yayAo YW5kIHRoZSB1c2Vy4oCZcyBJbnRlcm5ldCBzZXJ2aWNlIG1heSBiZSBzdXNwZW5kZWQgdW50aWwg aXQgc3RvcHMpLiBUaGUgQ0Ugcm91dGVyIGlzDQogaW4gdGhlIGJlc3QgcG9zaXRpb24gdG8gZGV0 ZWN0IG1hbHdhcmUgZW1hbmF0aW5nIGZyb20gdGhlIGhvbWUgbmV0d29yay4gV2Ugc2hvdWxkIGJl IHRyeWluZyB0byBtYWtlIGl0IGVhc2llciBmb3IgdGhlIENFIHJvdXRlciB0byBkbyB0aGlzLCBy YXRoZXIgdGhhbiBtb3JlIGRpZmZpY3VsdC4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvZm9udD48L2k+ PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiIHN0eWxlPSJtc28tYmlkaS1mb250LXdl aWdodDpub3JtYWwiPjxpIHN0eWxlPSJtc28tYmlkaS1mb250LXN0eWxlOm5vcm1hbCI+PGZvbnQg c2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNv LWFzY2lpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbGlicmk7 bXNvLWJpZGktZm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7O2ZvbnQtd2Vp Z2h0OmJvbGQ7bXNvLWJpZGktZm9udC13ZWlnaHQ6bm9ybWFsO2ZvbnQtc3R5bGU6aXRhbGljO21z by1iaWRpLWZvbnQtc3R5bGU6bm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2ZvbnQ+ PC9pPjwvYj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YiBzdHlsZT0ibXNvLWJpZGktZm9u dC13ZWlnaHQ6bm9ybWFsIj48aSBzdHlsZT0ibXNvLWJpZGktZm9udC1zdHlsZTpub3JtYWwiPjxm b250IHNpemU9IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O21zby1hc2NpaS1mb250LWZhbWlseTpDYWxpYnJpO21zby1oYW5zaS1mb250LWZhbWlseTpDYWxp YnJpO21zby1iaWRpLWZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90Oztmb250 LXdlaWdodDpib2xkO21zby1iaWRpLWZvbnQtd2VpZ2h0Om5vcm1hbDtmb250LXN0eWxlOml0YWxp Yzttc28tYmlkaS1mb250LXN0eWxlOm5vcm1hbCI+QW5kLA0KIEJUVywgYnkgZmFyIHRoZSBiaWdn ZXN0IHZ1bG5lcmFiaWxpdGllcyBpbnNpZGUgdGhlIGhvbWUgbmV0d29yayBhcmUgdGhlIHVzZXJz LiBXaGF0IHJlYWxseSBzZWVtcyB0byBiZSBpbXBsaWVkIGlzIHRoYXQgdGhlIHVzZXIgY2Fu4oCZ dCBiZSB0cnVzdGVkIHRvIGRvIHdoYXQgaXMgcmlnaHQgZm9yIHRoZW1zZWx2ZXMsIHNvIGFwcGxp Y2F0aW9ucyBhbmQgZGV2aWNlIHZlbmRvcnMgbmVlZCB0byBiZSBpbiBjb250cm9sIGFuZCBtaW5p bWl6ZSB1c2Vyc+KAmQ0KIGFiaWxpdHkgdG8gYXV0b21hdGljYWxseSBpbmZsdWVuY2UgYW5kIGNv bnRyb2wgdGhvc2UgYXBwcyBhbmQgaG9zdHMgKGluZGVwZW5kZW50IG9mIHdoZXRoZXIgdXNlcnMg Y2FuIG9yIHNob3VsZCB0cnVzdCB0aGUgdmVuZG9yczsgYW5kIHdobyByYXJlbHkgaGF2ZSBhIGNv bnRyYWN0dWFsIHJlbGF0aW9uc2hpcCB3aXRoIHVzZXJzKS4gSSBkaXNhZ3JlZS4gV2hpbGUgdXNl cnMgYXJlIHRoZSBiaWdnZXN0IHRocmVhdCB0byB0aGVpciBvd24gaG9tZQ0KIG5ldHdvcmtzIGFu ZCBkZXZpY2VzLCBnaXZpbmcgYXBwIGFuZCBob3N0IHZlbmRvcnMgbW9yZSBjb250cm9sIHRvIGJ5 cGFzcyB1c2VyIGFuZCBob21lLW5ldHdvcmstb3duZXIgY2hvaWNlcyBpcyBub3QgdGhlIGFuc3dl ci4gV2hhdCB3ZSBuZWVkIGlzIG1vcmUgYW5kIGJldHRlciB0b29scyBmb3IgdXNlcnMgYW5kIGhv bWUtbmV0d29yay1vd25lcnMgdG8ga25vdyB3aGVuIHNvbWV0aGluZyBpbnNpZGUgdGhlaXIgbmV0 d29yayBoYXMgYmVlbiBjb21wcm9taXNlZA0KIGFuZCB0byBtYWtlIGluZm9ybWVkIGNob2ljZXMu IC0tIEJhcmJhcmEgPG86cD48L286cD48L3NwYW4+PC9mb250PjwvaT48L2I+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_774f665882ec4dfbbd4682f83c2a3009attcom_-- From nobody Wed Jul 22 08:50:35 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 740573A091C for ; Wed, 22 Jul 2020 08:50:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dxPJqsTuMNj4 for ; Wed, 22 Jul 2020 08:50:31 -0700 (PDT) Received: from mail-wr1-x42f.google.com (mail-wr1-x42f.google.com [IPv6:2a00:1450:4864:20::42f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AA1943A091A for ; Wed, 22 Jul 2020 08:50:31 -0700 (PDT) Received: by mail-wr1-x42f.google.com with SMTP id f2so2378055wrp.7 for ; Wed, 22 Jul 2020 08:50:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=GnUvVIXj65eD5yAGeJt9pv8Mtjw1kUZLYqjMTZbrPI4=; b=SiX6Y4Qw1839GKGaCASn/0T5R0t1RDf/cg+IPBRoH/BxFHso/k534twpxHlvMjbmoD yNbQTiaBXYs9+wk4WjO/bQkXr6AFyE548dUConXdmdUxnXeP4LqxKKx2E8Z6mVQtp1yq iAZf5WW56IdwHPOVa3ui0t0Nj2Ic8HDQwZCrTTdkirEI2tpD9Mwgz/HjZwIZT7qt7jno 6eCOblYqeVKbEge0bcnvRERytJH+8a/MsQcTJ6VpI7T5Tu+YHkmvQBHJa+bSJIysE+TQ zGTQDroxwlty2TCebyD3rkVNWgUMi466ikxuXWf8BaQ25Pjj8hMnLFA7kumSEqT8BrA6 UsFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=GnUvVIXj65eD5yAGeJt9pv8Mtjw1kUZLYqjMTZbrPI4=; b=Wtxk3PPP2Ok2HRpbnMMn4HPAwu+iH47hVuHV6f8YGw8SgI9AEj5rvtr2uyTXDN1cob 3mOZWmhhLyGgtUEb9buwDzOsoRIn8X/bSLXeUpvtiF8rB4/0fobG/AbFpuxGNH7pUcFs vOLacLDpyoukB7f3zusW6Jlf3K/1VVMplPTII2ARzRVy1tfvx7kYTeyLmPafKfRO/YEk B9N2/RBjxwm/76YGXihdNiTIpH06k/aYO6Vl45AFo/ScBa7nNNHeXp+a/sIwH0F3xDy1 nDCOCf4iJMbLQ4ho0iiD3dVdWG/M3mjJxtbqCEYXHxk2lhGTNsvtH9/qGgrRJNdrEhEd I6vg== X-Gm-Message-State: AOAM530LoLUA4zQ0TMabX3q+j4ZL2pRthJHxgiitAc31zq6DLbN2CzW3 PMyLu3uUYImHL2v49Cy5FT06ysHuh3CEVMLhgqfrBw== X-Google-Smtp-Source: ABdhPJzz0G/pr8ctd8gzuAkQ8q/qnEGdD6RBK9F7KUAnmrZx6lHqs4/KDNiVWHGNkPHIjDmb/w6CHmHMjvLoLsv6zkI= X-Received: by 2002:a5d:4a03:: with SMTP id m3mr201446wrq.186.1595433029852; Wed, 22 Jul 2020 08:50:29 -0700 (PDT) MIME-Version: 1.0 References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> <20200721095240.GA10868@nic.fr> In-Reply-To: From: Eric Orth Date: Wed, 22 Jul 2020 11:50:18 -0400 Message-ID: To: "Chris Box (BT)" Cc: Mohit Sethi M , ADD Mailing list , "Deen, Glenn" Content-Type: multipart/alternative; boundary="00000000000002465605ab09b33f" Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 15:50:33 -0000 --00000000000002465605ab09b33f Content-Type: text/plain; charset="UTF-8" Any hard classification of different networks would likely go way too far into policy controversy. Since it sounds like the goal is only to loosely define the categories for discussion purposes, I think the draft needs a bit more clarification around that. Maybe a bit of explanatory text to make clear that different people could trust different networks differently. And the "Examples of [X] Networks" labels as-is certainly imply that those examples are classified as such, so maybe it should be changed to something like "Examples that a typical user may consider to be [X] networks". Maybe some text specifically pointing out when some of those examples may be in higher risk categories for some users, maybe something like "ISP networks may be Yellow networks for users that, despite the contractual relationship, do not generally trust their ISP". And I'm curious about the intent for how this will be used. How is this expected to be helpful in discussions or drafts? Seems we lose a lot of the potential for discussion helpfulness if we don't have a common understanding of classifications or implications (which we shouldn't have because that's policy). And I would be especially concerned if draft Security Considerations sections started making statements like "this attack only affects home networks, which are a Green network and therefore not a concern". On Wed, Jul 22, 2020 at 9:17 AM Chris Box (BT) wrote: > > Mohit, > >> I don't want to shoot down this work but categorization of networks into >> red/green/yellow baskets is hard (if not impossible) and it will lead to >> a very long thread with counter examples. >> > > Rather than a hard classification of network X should always be color Y, > in this list I think Glenn clarified it should be like the Windows model, > i.e. when the user first connects to a network, the user is prompted to > decide which trust level (color) it should be. They do this based on their > own understanding of the context. > > With that in mind, do you still have an objection? I think the > classifications would be useful for other drafts. > > Chris > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --00000000000002465605ab09b33f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Any hard classification of different=C2=A0networks wo= uld likely go way too far into policy controversy.=C2=A0 Since it sounds li= ke the goal is only to loosely define the categories for discussion purpose= s, I think the draft needs a bit more clarification around that.=C2=A0 Mayb= e a bit of explanatory text to make clear that different people could trust= different networks differently.=C2=A0 And the "Examples of [X] Networ= ks" labels as-is certainly imply that those examples are classified as= such, so maybe it should be changed to something like "Examples that = a typical user may consider to be [X] networks".=C2=A0 Maybe some text= specifically pointing out when some of those examples may be in higher ris= k categories for some users, maybe something like "ISP networks may be= Yellow networks for users that, despite the contractual relationship, do n= ot generally trust their ISP".

And I'm cu= rious about the intent for how this will be used.=C2=A0 How is this expecte= d to be helpful in discussions or drafts? Seems we lose a lot of the potent= ial for discussion helpfulness if we don't have a common understanding = of classifications or implications (which we shouldn't have because tha= t's policy).=C2=A0 And I would be especially concerned if draft Securit= y Considerations sections started making statements like "this attack = only affects home networks, which are a Green network and therefore not a c= oncern".

On Wed, Jul 22, 2020 at 9:17 AM Chris Box (BT) <chris.box.ietf@gmail.com> wro= te:

Mohit,
<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex"> I don't want to shoot down this work but categorization of networks int= o
red/green/yellow baskets is hard (if not impossible) and it will lead to a very long thread with counter examples.

<= div>Rather than a hard classification of network X should always be color Y= , in this list I think Glenn clarified it should be like the Windows model,= i.e. when the user first connects to a network, the user is prompted to de= cide which trust level (color) it should be. They do this based on their ow= n understanding of the context.

With that in m= ind, do you still have an objection? I think the classifications would be u= seful for other drafts.

Chris
=
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--00000000000002465605ab09b33f-- From nobody Wed Jul 22 10:30:35 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FF713A07E3 for ; Wed, 22 Jul 2020 10:30:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DljEhUKExd0j for ; Wed, 22 Jul 2020 10:30:33 -0700 (PDT) Received: from mail-qt1-x82a.google.com (mail-qt1-x82a.google.com [IPv6:2607:f8b0:4864:20::82a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7ADDE3A07CA for ; Wed, 22 Jul 2020 10:30:33 -0700 (PDT) Received: by mail-qt1-x82a.google.com with SMTP id d27so2416581qtg.4 for ; Wed, 22 Jul 2020 10:30:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ptfakVonT9d50T4zbNwR/gV29TkYtYj9ByUqMOdYFIo=; b=SR88QJ6/eOrDFrBlu4owKAwUKUfC/KyGv2MzJh33XKmkLU+83SL1OISp2pBxVeicWT N+LBPSl4R+zQ0bCBFrKQIkL9bjQCPcpyACNmFeAOOu1/xonGtbK0wTknEhnkRDY4gwlo Z9mNfKDV8YdI4yJKUc6Ly16kBizUmJzsrRUOqQ7VlWuj1N9EdGkZfun2XKwH2jMxrgHZ mi0dX/bADDE+6z2UeK4AaF2XX5b2JrnLLUBYzXmFoo6Cadbl4RC1LJCq2H2QN18raQrr l+P6Mfe3PWcS6sJDOzRFGjCZ+rXsDofYRU/pUvzegPZy9c+vQSS/O0S+mEmTJlrtOmZa B7Mg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ptfakVonT9d50T4zbNwR/gV29TkYtYj9ByUqMOdYFIo=; b=KeQR6Sqn+ML6baJRTUGq48mC8EHRKkjtqdnPj0+GYBrBtiXtBa3eX0N0iKZ7I/h50E qf0Ut4kwNqM44DKhhQsfBqzFWFhVtEl/Gmj6b6q9vtluNlr+qmT/S9YhzIQQSBJZ1GHZ TZM6ftipql2yNRhcDc1D8YOyfHE5tippKVgWl0teX+Yztkt2GWlxCJz1CBAk/TNU/A/M Q4pkLHXvqIHWzBZ0DKUMQt/uKOsxs/w8p2cJHcl4Y6GrE/pVs4DR1FZA24vac9UQBsPi mBNtV0nQoaX4IaFY3ryYjEOEfMa/yu/pDU/yjaRJunCH/0DMSJOuZ2cgDfEH+yaHFAoZ jZOA== X-Gm-Message-State: AOAM531VTb5rNyBtca8imd2jOpLz+NZoJJiZV0yXq8qhY3wrTpCBn/OY l/0r30rjln/C5JoZJbRrcuBkE9eOrv5Qk9wBYak= X-Google-Smtp-Source: ABdhPJyg67ZaTnGhBS9VsidFir0MccyUVsqif3xXfSp3xzMiatoleRVXEZEHED7EAa0CjkPgK0hBrG7/KRl5xI+B6Vk= X-Received: by 2002:ac8:38c9:: with SMTP id g9mr393557qtc.367.1595439032470; Wed, 22 Jul 2020 10:30:32 -0700 (PDT) MIME-Version: 1.0 References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> <20200721095240.GA10868@nic.fr> In-Reply-To: From: "Chris Box (BT)" Date: Wed, 22 Jul 2020 18:30:20 +0100 Message-ID: To: Eric Orth Cc: ADD Mailing list , "Deen, Glenn" Content-Type: multipart/alternative; boundary="000000000000ca90b405ab0b182f" Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 17:30:35 -0000 --000000000000ca90b405ab0b182f Content-Type: text/plain; charset="UTF-8" Eric, And I'm curious about the intent for how this will be used. How is this > expected to be helpful in discussions or drafts? Seems we lose a lot of the > potential for discussion helpfulness if we don't have a common > understanding of classifications or implications (which we shouldn't have > because that's policy). And I would be especially concerned if draft > Security Considerations sections started making statements like "this > attack only affects home networks, which are a Green network and therefore > not a concern". > > Thinking aloud, would it be useful for a draft to say "this automatic mechanism SHOULD NOT be used in a network the user has classified as Red"? Chris --000000000000ca90b405ab0b182f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Eric,

=
And I'm curious about the intent for how t= his will be used.=C2=A0 How is this expected to be helpful in discussions o= r drafts? Seems we lose a lot of the potential for discussion helpfulness i= f we don't have a common understanding of classifications or implicatio= ns (which we shouldn't have because that's policy).=C2=A0 And I wou= ld be especially concerned if draft Security Considerations sections starte= d making statements like "this attack only affects home networks, whic= h are a Green network and therefore not a concern".


Thinking aloud, would it be useful for a draf= t to say "this automatic mechanism SHOULD NOT be used in a network the= user has classified as Red"?

Chris
=
--000000000000ca90b405ab0b182f-- From nobody Wed Jul 22 10:56:45 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B2A93A0A0D for ; Wed, 22 Jul 2020 10:56:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.6 X-Spam-Level: X-Spam-Status: No, score=-17.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ncEclP9U9suw for ; Wed, 22 Jul 2020 10:56:42 -0700 (PDT) Received: from mail-wm1-x32f.google.com (mail-wm1-x32f.google.com [IPv6:2a00:1450:4864:20::32f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DAB43A0A0B for ; Wed, 22 Jul 2020 10:56:42 -0700 (PDT) Received: by mail-wm1-x32f.google.com with SMTP id 17so2839030wmo.1 for ; Wed, 22 Jul 2020 10:56:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Wk297nDvonuJJEWdo93n28IpCUpFl257Q5A6/An8Ruk=; b=vio8lEAPh96GZ5/qC9qLzV7FukPsaStEu6iEtVkeo2YRXAERN6vYVVYuWNcdA+GGsO HN8j9rez6BI7fZLRp1AMfMQlDP8z0EsefBJgtc+6BRWjHsz50QewHHc77hGzuy6QjZuh 5A2U9ofNpnZaxH4oD4XZhOJpyAJTdPbJYG0EG15nXSo/7v204n0yw2nSfYCuzUAkoE9A 4dDnQjimXdiDNYom28iAbqWdN8FwutVSsQEOtvZe+A5Jo/oXKVr/Z1lkPQMLwLNm+hBB 49pEQr6POKcV5q0sMT0IRbXYDLLeiKK17e/BFoFkrMB6I5RevVZJ4AmfAn830u/c9KAe nm2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Wk297nDvonuJJEWdo93n28IpCUpFl257Q5A6/An8Ruk=; b=DFrVUj4xerJabetPPP9xTnGvMYzucRcTaZzWre0YBS/BjRB139ogq+0oxfasuLaJfk MN2jSgAo8qVHG67VbFDYhuHCUi3E5+WRlIlXcz0DBo+KD6wNhvyLvaW1k39a/F7998mo VMHlNJmfLfgMOKHJK5ZAaquACAA54BOvulucjyp2eUibGdUzx3lK9ljso3c9XmWe2Fpu FSqsMEtmttmanz2u9PAf3P7Ha0O1pM+j5jITSH/WsYxBs/BOiH2OHwwStpV8PCi3NXvk p79cUEy9Ja/z64vKhhttvge3QT+ySZDAJrS38dq68L0aKFOnWhsjK1kYnkMJXQIFQLFN FkYQ== X-Gm-Message-State: AOAM5311ePhBFb4nvA8Jut2BjrDr+B/SeR9BeYHC+DmsvgvVxRWCXZVv 3gx5SMI/M2HwHK9W4xkLN0ZfcmhJ5F7wNFD+6+O5DA== X-Google-Smtp-Source: ABdhPJz2a7nLsUKfFzztB0yJ55HSjcnUuqQL9mbx4Vx+mcm0n8c2vwKGOkTSpLjbhG56OpEnJ4nI4xiKbEIlqaqYd/M= X-Received: by 2002:a1c:56c3:: with SMTP id k186mr696012wmb.21.1595440600775; Wed, 22 Jul 2020 10:56:40 -0700 (PDT) MIME-Version: 1.0 References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> <20200721095240.GA10868@nic.fr> In-Reply-To: From: Eric Orth Date: Wed, 22 Jul 2020 13:56:29 -0400 Message-ID: To: "Chris Box (BT)" Cc: ADD Mailing list , "Deen, Glenn" Content-Type: multipart/alternative; boundary="00000000000045947205ab0b766d" Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 17:56:44 -0000 --00000000000045947205ab0b766d Content-Type: text/plain; charset="UTF-8" On Wed, Jul 22, 2020 at 1:30 PM Chris Box (BT) wrote: > > Eric, > > And I'm curious about the intent for how this will be used. How is this >> expected to be helpful in discussions or drafts? Seems we lose a lot of the >> potential for discussion helpfulness if we don't have a common >> understanding of classifications or implications (which we shouldn't have >> because that's policy). And I would be especially concerned if draft >> Security Considerations sections started making statements like "this >> attack only affects home networks, which are a Green network and therefore >> not a concern". >> >> > Thinking aloud, would it be useful for a draft to say "this automatic > mechanism SHOULD NOT be used in a network the user has classified as Red"? > I think that would be a problematic statement because, for many mechanisms where a draft might consider making such a statement, the software choosing to use such a mechanism may not have any reasonable signal of whether or not the user would classify the network as such. Maybe statements around "when the implementation expects its users would classify the network as Red", but that might be too loose to be helpful in such security discussions. Maybe could be helpful for more refined statements like "this mechanism could be particularly vulnerable to attacks on networks the user has classified as Red, so implementations SHOULD make appropriate mitigations unless the user has signaled a higher level of trust", but when going into that much detail, is the simplification of saying "Red" really helpful or is the draft going to need to clearly define the situational dangers anyway? > > Chris > --00000000000045947205ab0b766d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 22, 2020 at 1:30 PM Chris= Box (BT) <chris.box.ietf@gm= ail.com> wrote:

Eric,
And I'm curious about the intent fo= r how this will be used.=C2=A0 How is this expected to be helpful in discus= sions or drafts? Seems we lose a lot of the potential for discussion helpfu= lness if we don't have a common understanding of classifications or imp= lications (which we shouldn't have because that's policy).=C2=A0 An= d I would be especially concerned if draft Security Considerations sections= started making statements like "this attack only affects home network= s, which are a Green network and therefore not a concern".
=

Thinking aloud, would it be useful for= a draft to say "this automatic mechanism SHOULD NOT be used in a netw= ork the user has classified as Red"?

I think that would be a problematic statement becaus= e, for many mechanisms where a draft might consider making such a statement= , the software choosing to use such a mechanism=C2=A0may not have any reaso= nable signal of whether or not the user would classify the network as such.= =C2=A0 Maybe statements around "when the implementation expects its us= ers would classify the network as Red", but that might be too loose to= be helpful in such security discussions. Maybe could be helpful for more r= efined statements like "this mechanism could be particularly vulnerabl= e to attacks on networks the user has classified as Red, so implementations= SHOULD make appropriate mitigations unless the user has signaled a higher = level of trust", but when going into that much detail, is the simplifi= cation of saying "Red" really helpful or is the draft going to ne= ed to clearly define the situational dangers anyway?
=C2=A0
=

Chris
--00000000000045947205ab0b766d-- From nobody Wed Jul 22 12:05:24 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 132D23A00B0 for ; Wed, 22 Jul 2020 12:05:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.103 X-Spam-Level: X-Spam-Status: No, score=-2.103 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o94ClIifSzHp for ; Wed, 22 Jul 2020 12:05:20 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150089.outbound.protection.outlook.com [40.107.15.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 186863A003C for ; Wed, 22 Jul 2020 12:05:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=m81oqqjDbttOthXGJxbC5Csuzj3/rTBRKesGKJ6WKrVes6PF3qEYy9KCyqiQq/CLNFUQDRd7rh8ORddmyvODLaL4UcuSSiNpYYqklyjKbtqVDKxx7BIMkawDaNntGKLWmXBYOg0c4Jkjmg7fO+GwleGjA4062x6ogdbiyDJmn6c4ZXHv3wBXsNLM5YsuN6FtNBEY23WhtgFecgZdyc1J24sD2TWPafyl/Nz74/gL42rs45NGaz05Rjvxh/m9AQNWpjLkXwVyHUmDREKOiTHp/xXkqQPcb3BOjYOVAUoqM0IbRyxbr6mGGCOoT2/GsMCuvjqrtJ4mkzA9FZ1OCbcPmQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1iicqzqoryjmbfVozkQqNFUwM1OGBNTbV2rNffUNixg=; b=JYiCCE5CRSc97B5de5ELOThSCC/LOjNagfFd+C7B44bs35XUL4TBp4dCIPvUUCnDuBiCUEgkcJlg3nDgsfwJ5scegrlPPSPKZrdv/bT3UW8OmeoLIXWIIZUedAE//JUhPx5L928f5c+iGUsZThLYwPAaQMsnMo2NegozzyVbvOOe9KP/UIIHzccpfnTtsiQQMzc8uIrCTJMfriaH9Kr/D9Kuu9nceEWYkI1ZrktGpExDJ1byiDycTd6NRd/4MeNRLU6VZaR00ql9o4Feyp5x8KMKkxIl45IM7i8C3Y2EzhEyQeFsIJHaMLvILA9SgW6XdVjYB1Pz9VHM+iiI1oqHcg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1iicqzqoryjmbfVozkQqNFUwM1OGBNTbV2rNffUNixg=; b=NdvUZUi4O2T2vcUb2VC3SEKE81D2gJ4rF2S+Hv+1bc246NYsHCDxjxg2PeLoj+VIjOLMt4Goi/Gy5xyQg5ofuSZ4Nwsv2V0ZQVi9WFoBdLw6hcliWW3jZATD2yG7JAQ3FwZ7xR9z8Zv6V7B3Dv+4myQ/VqCpYoDnkDe6wUCiudA= Received: from HE1PR07MB3386.eurprd07.prod.outlook.com (2603:10a6:7:2d::25) by HE1PR0702MB3738.eurprd07.prod.outlook.com (2603:10a6:7:8d::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.14; Wed, 22 Jul 2020 19:05:17 +0000 Received: from HE1PR07MB3386.eurprd07.prod.outlook.com ([fe80::e01c:9809:43db:67d3]) by HE1PR07MB3386.eurprd07.prod.outlook.com ([fe80::e01c:9809:43db:67d3%6]) with mapi id 15.20.3216.020; Wed, 22 Jul 2020 19:05:17 +0000 From: Mohit Sethi M To: "Deen, Glenn" , ADD Mailing list Thread-Topic: [Add] New Threats ID for ADD Thread-Index: AQHWYFsJQ8R37ALys0GiQW9FwxXEPA== Date: Wed, 22 Jul 2020 19:05:17 +0000 Message-ID: <150cdf53-e9d8-9f76-4456-5c73c4dbdc79@ericsson.com> References: <5990D901-60E1-474C-BC18-94F069C0201A@nbcuni.com> In-Reply-To: <5990D901-60E1-474C-BC18-94F069C0201A@nbcuni.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 authentication-results: comcast.com; dkim=none (message not signed) header.d=none;comcast.com; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [2001:14bb:140:27c7:2739:5cce:2572:bccb] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: c18d38af-a667-467a-46c8-08d82e722c55 x-ms-traffictypediagnostic: HE1PR0702MB3738: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: YWOhrSHZVlf4IVMKfqABW4eoo/4joNaUuPPfPGnZ4r1DPxrxjkzP9I21b5lCAeNbbPG0M+S8aBidTLIDmEADcDKDUNtG9RqLVl6tWXNcsV3nMp8IgzB7ZPLuvw5t+HDIwp49IN+XhBUib405ojlS+nOsy5Uw5xzKXv62JB+6rLbk5DS4lpL9aZbxcMQu9yRMQAAHqbZ+CzK5TFqHfN+prslh6EbYdCoDEl+3OTb6FI/wXMDemrJYSArX57R08ypX2w1MaZogTLO+slOzeVg2CIZLPkt3F6/F25p6rEy1OKWGntHk4mNP+3fQXemXGaDAwNcUYGXD4jO3jKAbV0Y0PLBS6AbkhBR1iS5MzroxeArkOLEzDMCAuDChMG9GXC3blayWc7hRJr/nW5FysT8e181UPpatF5kwS8lYBmcr/+ZEfCf+VjXqnLbB3leu2rqDPj1iY8qyARY7e7PoubV2YA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:HE1PR07MB3386.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(39860400002)(136003)(346002)(376002)(366004)(396003)(966005)(8676002)(2616005)(66946007)(64756008)(66476007)(8936002)(36756003)(110136005)(316002)(66446008)(478600001)(66574015)(31696002)(66556008)(71200400001)(31686004)(76116006)(86362001)(53546011)(2906002)(6486002)(6506007)(5660300002)(186003)(6512007)(83380400001)(43740500002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: vCK+xDVFhV07wUMKfnLrp+tt78rdqXq3p26Jqw69jwXWLoJH4StRtHamSmyf1719+rijf8rnOqA4HQ1DkKN3QhdfKDDbUE/Rj4gUncN5pLBfDtFNkNdNuN4fAFjss01OQ/8adneohbjKUhIi+pgyBokusIo+dw//rjmDuhej3DrbeWOBt3dVd4Xnu/asnO93qXsflrf1uKjFxdSDg1dHlyYJ6OEGZPySZRjOstXHZ5jiPGqwl3A46XZw3cBCMHi12r4y3Y0Kc60+IBLbW3X6aUN1tkIXMOG9HUy07jgtCiYvLr+rfh7mOnaFbTnd9WJKtiLlubKkjn8YyQYUermD5cpjbjA1cS2vzSpxV5Ov+Npxulc4LkjPQ1ayBj+I+2FC5D3q2s8SmzFQSCO7TF2LxXcMfhbhlLEjkJpTAP+orncP3tPK6cvFP+rU2NXD/CB1GelhgsRJPaCC2ShmErcDd9V4TpVR59rRSCGmzRxrEOVvljgtuSypWRoh6138RAHuRTDNgyNqQM9+LjqVTQN9v1QCZCrH1o4Vl/3doEm96hL+fICsvCkywD/4lZYIHpqL x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: <42B9856AF9E81B4EA309471C9C952260@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: HE1PR07MB3386.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: c18d38af-a667-467a-46c8-08d82e722c55 X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2020 19:05:17.6201 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: nGloJttlPAkAlmdzfP5ZqDDjYJ/Dy+m5o8D/OxtBAwQcUtYSGpkcY2kgKQIo9Ip+GeYTZokDTFcf6bKS5wq0fOgLrQrYguOHEpump93m4Sg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0702MB3738 Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 19:05:22 -0000 Q2hyaXMvR2xlbm46DQoNCkkgY2VydGFpbmx5IGRvbid0IHdhbnQgdG8gYmUgYSBzaG93IHN0b3Bw ZXIgZm9yIHdoYXRldmVyIHRoZSB3b3JraW5nIA0KZ3JvdXAgd2FudHMgdG8gd29yayBvbi4gUGxl YXNlIHRyZWF0IG15IGNvbW1lbnRzIGFzIHRob3NlIG9mIGFuIA0KaW50ZXJlc3RlZCBvYnNlcnZl ciBvbiB0aGUgc2lkZWxpbmVzLg0KDQpJIHVuZGVyc3RhbmQgdGhhdCB1c2VycyBjYW4gcGljayB0 aGUgY2xhc3NpZmljYXRpb24gYmFzZWQgb24gdGhlaXIgDQpwZXJjZXB0aW9uIG9mIHRocmVhdCB2 cy4gc2VjdXJpdHkuIEhvd2V2ZXIsIG5vdCBhbGwgdXNlcnMgYXJlIGVxdWFsLiANCldoaWxlIEkg ZXhwZWN0IG1vc3QgcGVvcGxlIG9uIHRoaXMgbGlzdCB0byBtYWtlIGV4Y2VsbGVudCBkZWNpc2lv bnMsIA0KdGhlcmUgaXMgYSBsYXJnZSBhbmQgZGl2ZXJzZSBwb3B1bGF0aW9uIG91dCB0aGVyZSB3 aGljaCBtYXkgbGFiZWwgdGhlIA0Kc2FtZSBuZXR3b3JrcyB2ZXJ5IGRpZmZlcmVudGx5IChpbnNl cnQgcXVpbnRlc3NlbnRpYWwgZ3JhbmRtb3RoZXIgDQpleGFtcGxlIGhlcmUpLiBJIGFsc28gd29u ZGVyIGFib3V0IHNpdHVhdGlvbnMgd2hlcmUgdGhlIHVzZXIgaXMgbm90IA0KYWN0aXZlbHkgc2Vs ZWN0aW5nIG5ldHdvcmtzLiBBdCBsZWFzdCBpbiB0aGUgcGFzdCwgbWFueSBzbWFydHBob25lcyB3 ZXJlIA0KaGFwcHkgdG8gb3Bwb3J0dW5pc3RpY2FsbHkgam9pbiBhbnkgb3BlbiB3aXJlbGVzcyBu ZXR3b3JrIHRoYXQgcHJvdmlkZWQgDQpzb21lIHNvcnQgb2YgSW50ZXJuZXQgY29ubmVjdGl2aXR5 Lg0KDQpBbnlob3csIGRvbid0IHRyZWF0IHRoZXNlIGFzIG9iamVjdGlvbnMgYW5kIHJhdGhlciBh cyBpc3N1ZXMgdGhhdCBtaWdodCANCmJlIHdvcnRoIGNvbnNpZGVyaW5nIGdvaW5nIGZvcndhcmQu DQoNCi0tTW9oaXQNCg0KT24gNy8yMi8yMCA1OjI3IFBNLCBEZWVuLCBHbGVubiB3cm90ZToNCj4g SGkgTW9oaXQsDQo+DQo+IFRoYW5rcyBmb3IgdGhlIGZlZWRiYWNrLCBsZXQgbWUgYXR0ZW1wdCB0 byBjbGFyaWZ5IHRoZSBwcm9wb3NhbCBiZWxvdyBpbmxpbmUuLi4uDQo+DQo+IO+7v09uIDcvMjEv MjAsIDExOjQxIFBNLCAiQWRkIG9uIGJlaGFsZiBvZiBNb2hpdCBTZXRoaSBNIiA8YWRkLWJvdW5j ZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIG1vaGl0Lm0uc2V0aGk9NDBlcmljc3Nvbi5jb21AZG1h cmMuaWV0Zi5vcmc+IHdyb3RlOg0KPg0KPiAgICAgIEluLWxpbmUuDQo+DQo+ICAgICAgT24gNy8y MS8yMCAxMjo1MiBQTSwgU3RlcGhhbmUgQm9ydHptZXllciB3cm90ZToNCj4gICAgICA+IE9uIFR1 ZSwgSnVsIDIxLCAyMDIwIGF0IDEyOjQwOjI3QU0gKzAwMDAsDQo+ICAgICAgPiAgIERlZW4sIEds ZW5uIDxHbGVubl9EZWVuQGNvbWNhc3QuY29tPiB3cm90ZQ0KPiAgICAgID4gICBhIG1lc3NhZ2Ug b2YgMTAyIGxpbmVzIHdoaWNoIHNhaWQ6DQo+ICAgICAgPg0KPiAgICAgID4+IEkgd2FudGVkIHRv IGJyaW5nIHRvIHlvdXIgYXR0ZW50aW9uIGEgc2hvcnQsIHZlcnkgc2hvcnQsIGRyYWZ0IHRoYXQN Cj4gICAgICA+PiBJIHdyb3RlIHVwIGJhc2VkIG9uIGFuIGVtYWlsIHRocmVhZCBvbiB0aGUgV0cg bGlzdC4gIEl0IGNhcHR1cmVzIGENCj4gICAgICA+PiBiYXNpYyBmcmFtZXdvcmsgb2YgR3JlZW4t WWVsbG93LVJlZCB0aHJlYXQgYW5kIHRydXN0IHJlbGF0aW9uc2hpcHMNCj4gICAgICA+PiB0aGUg dXNlciBtYXkgaGF2ZSB3aXRoIHRoZWlyIG5ldHdvcmsuICBUaGUgaG9wZSBpcyB0aGF0IHRoaXMg Y2FuIGJlDQo+ICAgICAgPj4gYSBiYXNpcyBmb3IgZm9jdXNpbmcgZGlzY3Vzc2lvbiBvZiB0aHJl YXRzIGFuZCB3aGF0IG1pdGlnYXRpb25zDQo+ICAgICAgPj4gbWF5YmUgbmVlZGVkIGluIGRpZmZl cmVudCBzaXR1YXRpb25zLg0KPiAgICAgID4+DQo+ICAgICAgPj4gaHR0cHM6Ly91cmxkZWZlbnNl LmNvbS92My9fX2h0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2h0bWwvZHJhZnQtZGVl bi1hZGQtdGhyZWF0cy0wMF9fOyEhUElaZWVXNXdzY3luUlEhN3FPS0Z0OFltaHBhMURaeVh3dFRt ckZocjAyenV4c2wwSlk1cFk2VkkxRGRfQ1pnNXZ3clc4QXVqQVdHcS00bCQNCj4gICAgICA+IEkg c2VlIG5vIHVzZSBmb3IgdGhpcyBkb2N1bWVudC4gSXQgc2VlbXMgdG8gY29uc2lkZXIgb25seSB0 aGUNCj4gICAgICA+IHBvdGVudGlhbCByaXNrcyBieSBvdXRzaWRlcnMsIGFuZCBub3QgdGhlIHJp c2tzIGJ5IHRoZSBvcGVyYXRvcnMsDQo+ICAgICAgPiB3aGljaCBhcmUgYXMgaW1wb3J0YW50LiBG b3IgaW5zdGFuY2UsIGFzc2Vzc2luZyB0aGF0IHRoZSAiVXNlcidzIElTUA0KPiAgICAgID4gbmV0 d29yayIgaXMgc2FmZSBvciBub3QgaXMgbm90IGp1c3QgYSBtYXR0ZXIgb2Ygd2V0aGVyIGl0IGlz IHByb3Blcmx5DQo+ICAgICAgPiBzZWN1cmVkOiBpdCBpcyBhbHNvIGEgbWF0dGVyIG9mIHdoYXQg dGhleSBkZWNpZGUgdG8gZG8gKGFuIElTUA0KPiAgICAgID4gcmVzb2x2ZXIgd2hpY2ggY2Vuc29y cyBTY2ktSHViIGlzIG5vdCBzYWZlIGZvciBtZSwgZXZlbiBpZiBpdCBpcw0KPiAgICAgID4gc2Vj dXJlZCBhbmQgcHJvdGVjdGVkIGZyb20gb3V0c2lkZSBhdHRhY2tlcnMpLg0KPiAgICAgID4NCj4g ICAgICA+IFRoaXMgZHJhZnQgaXMgbm90IGEgcHJvcGVyIHRocmVhdCBtb2RlbCBmb3IgdGhlIElu dGVybmV0Lg0KPg0KPiAgICAgIEkgZG9uJ3Qgd2FudCB0byBzaG9vdCBkb3duIHRoaXMgd29yayBi dXQgY2F0ZWdvcml6YXRpb24gb2YgbmV0d29ya3MgaW50bw0KPiAgICAgIHJlZC9ncmVlbi95ZWxs b3cgYmFza2V0cyBpcyBoYXJkIChpZiBub3QgaW1wb3NzaWJsZSkgYW5kIGl0IHdpbGwgbGVhZCB0 bw0KPiAgICAgIGEgdmVyeSBsb25nIHRocmVhZCB3aXRoIGNvdW50ZXIgZXhhbXBsZXMuIEZvciBl eGFtcGxlOg0KPg0KPiAgICAgIC0gTWFueSBzY2hvb2wgYW5kIHVuaXZlcnNpdHkgbmV0d29ya3Mg dXNlIGVkdXJvYW0gd2l0aCBFQVAuIFRoZXkgc2hvdWxkDQo+ICAgICAgYmUgaW4gdGhlIGdyZWVu IGJhc2tldC4NCj4NCj4gICAgICAtIE1hbnkgaG9tZSBuZXR3b3JrcyBicm9hZGNhc3QgYSBHdWVz dCBTU0lEIHdoaWNoIGNhbiBiZSBhbiBlbnRyeSBwb2ludA0KPiAgICAgIGZvciByb2d1ZSBhY3Rv cnMuIFRoZXkgc2hvdWxkIGJlIGluIHRoZSB5ZWxsb3cgYmFza2V0Lg0KPg0KPiAgICAgIC0gQ29u ZmVyZW5jZSBuZXR3b3JrcyBhdCBzZWN1cml0eSBjb25mZXJlbmNlcyAoc3VjaCBhcyBCbGFja0hh dCwgQ0NTDQo+ICAgICAgZXRjLikgc2hvdWxkIGJlIGluIHRoZSByZWQgYmFza2V0Lg0KPg0KPiAg ICAgIEkgdGhpbmsgZGlzY3Vzc2lvbiBvbiB0aGlzIHNvcnQgb2YgY2F0ZWdvcml6YXRpb24gbWF5 IG5vdCBiZSB2ZXJ5DQo+ICAgICAgcHJvZHVjdGl2ZSBmb3IgdGhlIHdvcmtpbmcgZ3JvdXAuDQo+ DQo+ICAgICAgLS1Nb2hpdA0KPg0KPg0KPg0KPiBUaGUgY2xhc3NpZmljYXRpb24gaXMgbm90IG1l YW50IHRvIGJlIGEgY2xhc3NpZmljYXRpb24gdGhhdCBpcyBoYXJkIGFuZCBmaXhlZCwgbm9yIGlz IGl0IHNvbWVvbmUgSSdtIHByb3Bvc2luZyBiZSB0dXJuZWQgaW50byBhIGxhYmVsbGluZyB3aGlj aCBpcyBzb21laG93IHN0b3JlZCBvciBjb21tdW5pY2F0ZWQgYXMgZGVzY3JpcHRpdmUgaW5mb3Jt YXRpb24gb2YgdGhlIG5ldHdvcmsuICBBcyBJJ3ZlIHNhaWQgaW4gb3RoZXIgbm90ZXMsICB0aGlz IGlzIGFsbCBmcm9tIHRoZSB1c2VyJ3MgcGVyc3BlY3RpdmUgYW5kIHdoZXJlIGEgcGFydGljdWxh ciBuZXR3b3JrIGZhbGxzIGZvciBvbmUgdXNlciBtYXkgd2VsbCBiZSBkaWZmZXJlbnQgZm9yIGFu b3RoZXIsIGFuZCB0aGF0IGNsYXNzaWZpY2F0aW9uIG1heSBjaGFuZ2Ugb3ZlciB0aW1lIGJhc2Vk IG9uIGV2ZW50cyBvciBleHBlcmllbmNlIG9yIG9wZXJhdGlvbmFsIGJlaGF2aW9yIHRoZSB1c2Vy IHdhbnRzIGZyb20gdGhlIG5ldHdvcmsuDQo+DQo+IEl0IGlzIG1lYW50IHRvIGhlbHAgZm9jdXMg QUREJ3MgZGlzY3Vzc2lvbiBvZiB2YXJpb3VzIHByb3Bvc2FscyBhbmQgdGhlIHRocmVhdHMgdGhl eSBmYWNlLiAgSG93ZXZlciwgcmVjb2duaXppbmcgYW5kIGFja25vd2xlZGdpbmcgdGhhdCBub3Qg YWxsIG5ldHdvcmsgZW52aXJvbm1lbnRzIGFyZSBhcyB0cnVzdGVkIGFzIG90aGVycywgYW5kIG9u IHRoZSB0d28gZXh0cmVtZXMgcmFuZ2UgZnJvbSB3ZWxsIHRydXN0ZWQgbmV0d29ya3Mgb24gdG8g Y2xlYXJseSBob3N0aWxlIG5ldHdvcmtzIC0gYXMgeW91IHBvaW50IG91dCBhYm92ZS4NCj4NCj4g Q2xlYXJseSBlYWNoIHRocmVhdC90cnVzdCBsZXZlbCAtIEdyZWVuL1llbGxvdy9SZWQgY2FsbHMg Zm9yIGRpZmZlcmVudCBtaXRpZ2F0aW9ucyB0byBtYWludGFpbiBpbnRlZ3JpdHkgZnJvbSB0aGUg dXNlcidzIHBlcnNwZWN0aXZlLiAgU28gd2hlbiB3ZSdyZSBkaXNjdXNzaW5nIGRpc2NvdmVyeSBh bmQgcmVzb2x2ZXIgaW5mb3JtYXRpb24gZGVsaXZlcnkgcHJvcG9zYWxzIGluIEFERCBpdCBpcyBp bXBvcnRhbnQgdG8gYmUgYWJsZSB0byBhbHNvIGRpc2N1c3Mgd2hhdCB0aHJlYXRzIGFuZCBtaXRp Z2F0aW9ucyBhcmUgYXBwcm9wcmlhdGUgaW4gZWFjaC4gIFNvIG5vdCBhIG5ldHdvcmsgbGFiZWxs aW5nIHByb3Bvc2FsIGJ1dCBhIGRpc2N1c3Npb24gYW5kIHRob3VnaHQgZm9jdXNpbmcgcHJvcG9z YWwuDQo+DQo+DQo+DQo+IC1nbGVubg0KPg0K From nobody Wed Jul 22 12:51:07 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BDA103A093C for ; Wed, 22 Jul 2020 12:51:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com header.b=MWky6TWV; dkim=pass (2048-bit key) header.d=comcast.com header.b=3UukRfd8; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=comcastcorp.onmicrosoft.com header.b=Ijt1EB/p Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sH_d5erHHGok for ; Wed, 22 Jul 2020 12:50:59 -0700 (PDT) Received: from mx0b-00143702.pphosted.com (mx0b-00143702.pphosted.com [148.163.141.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 235543A087F for ; Wed, 22 Jul 2020 12:50:58 -0700 (PDT) Received: from pps.filterd (m0184891.ppops.net [127.0.0.1]) by mx0b-00143702.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06MJot6f022043 for ; Wed, 22 Jul 2020 15:50:58 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=20190412; bh=N7AIQnITMvDarE5p2Hoh13gHVIPhjCi8PkAOcIhT/P4=; b=MWky6TWVzpdzJlbafo+cqPuXAR5CExxYitWL3AKia6biJUo2GQ342A/HJZomVB8Dfgv9 IHtrbO8zwlWLC9/ShWZ4hnw0rsd2NgAQSW3ZHVNtbAFK0p+p0qKuvLuRCa7eC/JKcLsz sLrQdUABcibpRLBcVsUBXKmWd2+WVhsgTLm3mZHfa1oEbdeBWuC/lPrrweryH/x4FaSV l0vcoOmZpBYsklGchsOy/IhbdSwJJxp8HtnQ3cx2GuA1yuOFXQX5aCT0UjjlOuRxf0Uf Ls/e9X0GQ8q2iQv975OyLh+HCIXznwR95+evAZmJldYvqCiDR/PTcCLMJqtw0uaybQaS vg== Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) by mx0b-00143702.pphosted.com with ESMTP id 32bwug89ya-3 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 22 Jul 2020 15:50:58 -0400 DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1595447448; x=2459361048; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=N7AIQnITMvDarE5p2Hoh13gHVIPhjCi8PkAOcIhT/P4=; b=3UukRfd8gylrw1ZpwCBcKWDgYn5B7Eh0tfNVMvuYvfUwMSCM7HaWkcDYYcXMZ0Ow FLyrB4og5HAzV5eBoO1QgaZfstvpJYYLD0CVsWT01rQ1dX0PI+OoOsIf3KinxOGL LnaI7jKIdV7EpxspOZYI6ENOfz01lleMw9Vmj4n3eK+qaCuyHHT7d8PrPiVhIbIq tz2Oznh33P/1T1Nn+ue7B22/C38Xb1+dJ2PELs0sw7+jCcxLXNjp98elsnqVpCJd 4BlCX1olY1JfWAPwRoauNZCIniKO4QL4lYxO2UfHKunmh4P7VSSTGy4w0WipqkNX lPdk50Cv8epq2EQsY+EKnw==; X-AuditID: a2962c47-549ff7000001f819-37-5f1898982805 Received: from copdcexc34.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 61.A8.63513.898981F5; Wed, 22 Jul 2020 13:50:48 -0600 (MDT) Received: from COPDCEX49.cable.comcast.com (147.191.125.148) by copdcexc34.cable.comcast.com (147.191.125.133) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Wed, 22 Jul 2020 13:50:13 -0600 Received: from COPDCEXEDGE01.cable.comcast.com (96.114.158.213) by COPDCEX49.cable.comcast.com (147.191.125.148) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Wed, 22 Jul 2020 13:50:13 -0600 Received: from NAM10-BN7-obe.outbound.protection.outlook.com (104.47.70.106) by webmail.comcast.com (96.114.158.213) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 22 Jul 2020 15:49:46 -0400 Received: from BL0PR11MB3107.namprd11.prod.outlook.com (2603:10b6:208:7c::12) by BL0PR11MB3249.namprd11.prod.outlook.com (2603:10b6:208:6b::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.23; Wed, 22 Jul 2020 19:49:45 +0000 Received: from BL0PR11MB3107.namprd11.prod.outlook.com ([fe80::140b:d467:2295:fc47]) by BL0PR11MB3107.namprd11.prod.outlook.com ([fe80::140b:d467:2295:fc47%6]) with mapi id 15.20.3216.020; Wed, 22 Jul 2020 19:49:45 +0000 From: "Deen, Glenn" To: Mohit Sethi M , ADD Mailing list Thread-Topic: [Add] New Threats ID for ADD Thread-Index: AQHWYDRDe15tPQlI10eFgtk0rMTAVqkT9aqA//+XEgA= Date: Wed, 22 Jul 2020 19:49:45 +0000 Message-ID: References: <5990D901-60E1-474C-BC18-94F069C0201A@nbcuni.com> <150cdf53-e9d8-9f76-4456-5c73c4dbdc79@ericsson.com> In-Reply-To: <150cdf53-e9d8-9f76-4456-5c73c4dbdc79@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: ericsson.com; dkim=none (message not signed) header.d=none;ericsson.com; dmarc=none action=none header.from=comcast.com; x-originating-ip: [2605:e000:141b:121:6011:2b58:8590:7910] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 65b66b03-379d-457c-719b-08d82e78626c x-ms-traffictypediagnostic: BL0PR11MB3249: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:5516; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: LFhCNJoYwwnAMtW4T7KaQioaM6IlBzgoTKNntOa4e0eEqIDKisnbDEYFovV1KoiKsy+WLa6Q1S8izK4tGT4wAxQ3M3HJ1rk09mUNK0QWO9j7HQefELzh1EMfpCZHa4NiwxA2JMt7upXLzJIeX/G/aIqOYkuRG2w6C2Qia2y7dOIXBOL7HedOfHU1Eu13wcHAdKiarE3gLzx2faKi7iTPzhy+/6GGvoFDbT3/daNd67JBpKq6U+6BIdcNd/m7FsK30SNaTmsqXR9TRCo8UdICvRHkESibUysvRp4cd0MBeTB1+tDCCOjRna4pRgWs5DJfDYx57l6PWjWCoL7Tex+mfg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BL0PR11MB3107.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(396003)(346002)(39860400002)(136003)(376002)(6506007)(36756003)(110136005)(83380400001)(316002)(66574015)(2616005)(33656002)(8676002)(478600001)(6486002)(76116006)(66556008)(5660300002)(2906002)(91956017)(8936002)(86362001)(71200400001)(6512007)(66946007)(186003)(66446008)(66476007)(64756008); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: MkPOqLWeOv1A4iU6SBmQdkbt58S13/U9QbvV4wqIa0xewobI/VZI/NHcpx30WiNqjVN8nsI9qkyG50OZIgXgBS07xpvzfOZNZv8nmtgql4PrcqOhK9J2KzfxZ51ejrDrEbTIVVm9kBvV/BFqQynAx11GgAys2er/cjMbJLNYKK1bipguRm4DEBAryk6Lj2Z9dbc7cBKaoy6d6XRDkQZxvT+x+rbGM9uXicDHHAyV0i8RFaSs93JUxcMmPjUSz3i0WHeWxmaQFKsm4b8/Kw/1NHPF2imJuY+wKVk0rz5jlaAfsqH91ciQyvZBANA5Zb2Ttw6AHCbmSg+UqTvZsgtbtlXmbghWeP69THkxbG1HNk1UVxeHdpU6U8LN07Z2NNOukq4ZqMhfblRUguWPzRqj1KRY+iQ4gJvKXa/ruAniXTPLk6ZB0Cd7vvWWFuUPxhUn443qnde5M6EWfAGcrG/stzHrduazvDhP0mf70WDV7jAdV4INQNADI7GsLWqm3tb6Xb1ECPzZoCaBWW3T30ZR87eKZXCPEau7crfXwlymryUlKxREJCoAgn0XvCIdVzpM x-ms-exchange-transport-forked: True arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=PnluYVykHn8JvNnM5+pYaDOZ8jLyubpdmM3mAbGOObxm1l45/2MRPphVMYWeT60WUq9gbITeXPTI2/bbh5G5eow8h84kN5V0i6REuLmaVnARjSDcWh500WAjdriOv3YUp6Pc/o2zA6KEEdYeTmOU6L0DiiATZ8fCN47yF6w9tv9nihrbCLzQk8MuykgCkycoSRD3ZRt0xej5q9HULDpmHkbCaMw8EtLUpjCd2Bjloz41bLGbgmtJMKnr62IdoYO3FPYwiTe/BMKy0578fEgzmfm5nCxsZB7cxqKZ5u9wRCmVAdwp99VpmN9L3ngLzbmEk0Q5QpywalgGOd79v9mO/g== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+5xyXR2uxUgRXz8nqnLTh5dd4I5hp8y+vQ5xxXtDf2o=; b=HN4UKwzGG98SkdXt5SyWgNIVaqMLdRx/dN4xu45CJLnBcF2IjSBFUiR1ysxrULeGhd0TjDhMt6QCSyDDgXP1bacaFoPRTw+svvTzQ1TYWDQk470nmuwC/shUQQi5/O9WHblwIpwtAlOJWdopVYil9paNZGyZDZIiwOtVj1kAxu6JfCvkK+nnzhRV6SxjBZWEGin0RHVaSnexnDbJp1vINH9BQL+lHmPfsKBWUpZCIIR/gQ6unItEcl6RhXJIV+sgLDoquxq4KVpIcN2AFTE6wLjcB2pxgCO63XFPW2enbcn9Wa1F/IhHLtWdpv+3w1Dfl9CfIGkqTwWHVTKBGVHFGw== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=comcast.com; dmarc=pass action=none header.from=comcast.com; dkim=pass header.d=comcast.com; arc=none dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastcorp.onmicrosoft.com; s=selector1-comcastcorp-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+5xyXR2uxUgRXz8nqnLTh5dd4I5hp8y+vQ5xxXtDf2o=; b=Ijt1EB/pdt78iTkeHKNJtFiHV/s/U9GK8d9MxQtHTMM/WAxBj2/ZDpgaa15L5tte8S8eDeI6JO05DNvuGtWVDCyRxsCoabON2a0Qe57hePI9hlY57gUXhyLIq1veEKS+d2r/ymt9jXdYCizJLjttWIIm30LT+mW9X1wS4FmPHZY= x-ms-exchange-crosstenant-authas: Internal x-ms-exchange-crosstenant-authsource: BL0PR11MB3107.namprd11.prod.outlook.com x-ms-exchange-crosstenant-network-message-id: 65b66b03-379d-457c-719b-08d82e78626c x-ms-exchange-crosstenant-originalarrivaltime: 22 Jul 2020 19:49:45.3843 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 906aefe9-76a7-4f65-b82d-5ec20775d5aa x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: KFZEl5cjm3ltpdWr+LJQaAVccjiGQCMo9Rrkn/FI4LVElZWsd3z9DHSXonMga7qXAJFI/bElSyYcYhXxQ/qFOpycSXRTllweVtGnLtFgW3c= x-ms-exchange-transport-crosstenantheadersstamped: BL0PR11MB3249 x-originatororg: comcast.com Content-Type: text/plain; charset="utf-8" Content-ID: <8A306F04567B1D42ABC7B6E80DE58D70@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpjleLIzCtJLcpLzFFi42JJKJozWXfGDIl4g71Nphb/T69js9jycSOz A5PHr69X2TyWLPnJFMAUxWWTkpqTWZZapG+XwJWxeOphloI98hUXOjYyNzBeketi5OSQEDCR 2HziKFsXIxeHkMARJom1rXtYIZxmJomdTxuZIZw7jBJrWh+wg7QICZxklNh0OwIisZhJ4vCp N4wQziNGiY5tvUAtHBxsAjoS2zbbgzSICARKPPu8lQ3EFhbQlFiw6TUTRFxL4vvCH2wQtpXE wt2zGEFsFgFViXP9W1hBbF4BO4kjr+YyQiwuljjSNRvM5hRwkOhb9QVsDqOAmMT3U2vAbGYB cYlbT+YzQfwmILFkz3lmCFtU4uXjf2AzRQX0Je6t/8zSxcgO1DuJUYILosJKoufVGkYIW1bi 0vxuKNtX4uqbvVBTtCTubp0ONT1b4vTWvVC2msT5xutsELacxKrehywQtozEgxvbwaErIfCb SWLh8rmMEM4zZokHj36wTmA0nYXk7FnAkGMGBtH6XfoQYQ+JJW3LmSBsRYkp3Q/ZZ4FDRVDi 5MwnLAsYWVcx8hqaGekZmhromZjomRtuYgSmjkXTdNx3MH44H3uIUYCDUYmHV7RXIl6INbGs uDL3EKMEB7OSCK8Oo3i8EG9KYmVValF+fFFpTmrxIUZpDhYlcd6eqy/ihATSE0tSs1NTC1KL YLJMHJxSDYwiq1sMGe+rVv1WtP7qoO7E8v6pcbNA8l8d/7PT1FJrVPI6kn7xFJeLui7R/vlT edXb52ddGfZ9Zn9/PEv7cP7p7L0rBL+3ai004ZnfqHbUKN6342jhk9YGSZuirYL1h19XRQnE L9nA9vDKiyk/7rdwX/ixYUKspe4+54cX3P8nsZkV30rmma7EUpyRaKjFXFScCAB/Xj8RGQMA AA== X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-22_13:2020-07-22, 2020-07-22 signatures=0 X-Proofpoint-Spam-Reason: safe Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 19:51:05 -0000 TW9oaXQsDQoNClRoYW5rcyBmb3IgdGhlIHZpZXdwb2ludCBhbmQgdGFraW5nIHRoZSB0aW1lIHRv IHRoaW5rIHRocm91Z2ggdGhlIGRyYWZ0J3MgaWRlYXMuDQoNCldoaWxlIEkgMTAwJSBhZ3JlZSB0 aGF0IG5vdCBhbGwgdXNlcnMgYXJlIGVxdWFsLCB0aGV5IGFsbCBkbyBoYXZlIHRoZSBwb3dlciB0 byBtYWtlIGNob2ljZXMgd2hlbiB0aGV5IGNvbm5lY3QgdG8gYSBuZXR3b3JrLiAgVGhlIG1vdGl2 YXRpb24gYmVoaW5kIHRyeWluZyB0byByb3VnaGx5IGNhdGVnb3JpemUgdGhlIGRpZmZlcmVudCB0 aHJlYXQvdHJ1c3QgZW52aXJvbm1lbnRzIHdhcyB0byBoZWxwIEFERCBmb2N1cyBpdHMgZGlzY3Vz c2lvbiBvZiB3aGF0IGlzIG5lZWRlZCBhbmQgd2hhdCBpcyBwcm9wb3J0aW9uYWxseSBhcHByb3By aWF0ZS4gIFdoaWxlIGEgdXNlciBjb25uZWN0aW5nIHRvIGEgbmV0d29yayB0aGF0IHdvdWxkIGZh bGwgaW50byB0aGUgUmVkIGVudmlyb25tZW50IGlzIGFuIGltcG9ydGFudCB1c2Ugc2NlbmFyaW8g Zm9yIHRoZSBncm91cCB0byB0aGUgY29uc2lkZXIsIGl0J3MgYWxzbyBub3Qgc29tZXRoaW5nIHRo YXQgdGhlIHZhc3QgbWFqb3JpdHkgb2YgSW50ZXJuZXQgdXNlcnMgd2lsbCBhY3R1YWxseSBlbmNv dW50ZXIsIHNvICB3aGVuIGNvbnNpZGVyaW5nIHdoYXQgaXMgcHJvcG9ydGlvbmFsbHkgYXBwcm9w cmlhdGUgSSBob3BlIGl0IGNhbiBiZSBoZWxwZnVsIHRvIHJlY29nbml6ZSB0aGF0IHRoZSB1c2Vy IGNvbm5lY3RpbmcgdG8gYSB0cnVzdGVkIGdyZWVuLCBvciBldmVuIGEgeWVsbG93IHNvcnQtb2Yt dHJ1c3RlZCBuZXR3b3JrIGRvZXNuJ3QgbmVlZCB0aGUgc2FtZSBtaXRpZ2F0aW9ucyB0aGF0IHRo ZXkgd291bGQgbmVlZCB3aGVuIGNvbm5lY3RpbmcgYSBkZXZpY2UgdG8gdGhlIEJsYWNrLUhhdCBu ZXR3b3JrLiAgICAgV2UgbWlnaHQgbmVlZCBhIHNwZWNpYWwgY2FzZSBiZXlvbmQgcmVkIC0gY2xh c3NpZmllZCBvaC1oZWxsLW5vIGZvciB0aGUgQmxhY2staGF0IG5ldHdvcmsuDQoNCldoZXJlIEkg dGhpbmsvaG9wZSB3ZSBtYXkgZW5kIHVwIGluIHByYWN0aWNlIGlzIHRoYXQgQUREIHdvdWxkIHBy b2R1Y2Ugb3V0cHV0cyB0aGF0IHdpbGwgd29yayBpbiB0aGUgR3JlZW4gem9uZSB3aXRob3V0IG11 Y2ggaWYgYW55IGZ1c3MgYW5kIGlzc3VlIGZvciB0aG9zZSB1c2VycywgIHdpbGwgd29yayBpbiB0 aGUgWWVsbG93IHpvbmUgd2l0aCBzb21lIGFkZGl0aW9uYWwgbWl0aWdhdGlvbnMsIGFuZCBmaW5h bGx5IGZvciBSZWQgem9uZXMgY2FsbCB1cCBtb3JlIHNvcGhpc3RpY2F0ZWQgbWl0aWdhdGlvbnMg dG8gcHJvcG9ydGlvbmFsbHkgbWVldCB0aGUgdGhyZWF0cyBwcmVzZW50LiBTbyBlc3NlbnRpYWxs eSBjb21tb24gb25lIG1ldGhvZCBmb3IgZGlzY292ZXJ5IGV0YywgYnV0IHdpdGggYXBwcm9wcmlh dGUgYW5kIHByb3BvcnRpb25hbCBtaXRpZ2F0aW9ucyBhZGRlZCB3aGVuIHVzZWQgaW4gZGlmZmVy ZW50IGVudmlyb25tZW50cy4NCg0KVGhlIGNsYXNzaWZpY2F0aW9uIGFwcHJvYWNoIGluIHRoZSBk cmFmdCBpcyBqdXN0IG1lYW50IHRvIGZvc3RlciBwcm9kdWN0aXZlIHRoaW5raW5nIGFuZCBoZWxw IHVzIGZvY3VzIG9uIGFwcHJvcHJpYXRlIHByb3BvcnRpb25hbCBtaXRpZ2F0aW9ucyBmb3IgZWFj aCB0aHJlYXQvdHJ1c3QgZW52aXJvbm1lbnQuDQoNCkl0J3MgdGhhdCBmaW5hbCBjb25zaWRlcmF0 aW9uIC0gYXBwcm9wcmlhdGUgYW5kIHByb3BvcnRpb25hbCAtIHRoYXQgaXMgaW1wb3J0YW50IHRv IGdldCByaWdodDogVG9vIGxpZ2h0IGFuZCB3ZSBleHBvc2UgdGhlIHVzZXIsIHRvbyB0aWdodCBh bmQgd2UgYnVpbGQgYSB3YWxsIHRvIERvSCBhZG9wdGlvbi4NCg0KUmVnYXJkcw0KR2xlbm4NCg0K 77u/T24gNy8yMi8yMCwgMTI6MDUgUE0sICJNb2hpdCBTZXRoaSBNIiA8bW9oaXQubS5zZXRoaUBl cmljc3Nvbi5jb20+IHdyb3RlOg0KDQogICAgQ2hyaXMvR2xlbm46DQoNCiAgICBJIGNlcnRhaW5s eSBkb24ndCB3YW50IHRvIGJlIGEgc2hvdyBzdG9wcGVyIGZvciB3aGF0ZXZlciB0aGUgd29ya2lu Zw0KICAgIGdyb3VwIHdhbnRzIHRvIHdvcmsgb24uIFBsZWFzZSB0cmVhdCBteSBjb21tZW50cyBh cyB0aG9zZSBvZiBhbg0KICAgIGludGVyZXN0ZWQgb2JzZXJ2ZXIgb24gdGhlIHNpZGVsaW5lcy4N Cg0KICAgIEkgdW5kZXJzdGFuZCB0aGF0IHVzZXJzIGNhbiBwaWNrIHRoZSBjbGFzc2lmaWNhdGlv biBiYXNlZCBvbiB0aGVpcg0KICAgIHBlcmNlcHRpb24gb2YgdGhyZWF0IHZzLiBzZWN1cml0eS4g SG93ZXZlciwgbm90IGFsbCB1c2VycyBhcmUgZXF1YWwuDQogICAgV2hpbGUgSSBleHBlY3QgbW9z dCBwZW9wbGUgb24gdGhpcyBsaXN0IHRvIG1ha2UgZXhjZWxsZW50IGRlY2lzaW9ucywNCiAgICB0 aGVyZSBpcyBhIGxhcmdlIGFuZCBkaXZlcnNlIHBvcHVsYXRpb24gb3V0IHRoZXJlIHdoaWNoIG1h eSBsYWJlbCB0aGUNCiAgICBzYW1lIG5ldHdvcmtzIHZlcnkgZGlmZmVyZW50bHkgKGluc2VydCBx dWludGVzc2VudGlhbCBncmFuZG1vdGhlcg0KICAgIGV4YW1wbGUgaGVyZSkuIEkgYWxzbyB3b25k ZXIgYWJvdXQgc2l0dWF0aW9ucyB3aGVyZSB0aGUgdXNlciBpcyBub3QNCiAgICBhY3RpdmVseSBz ZWxlY3RpbmcgbmV0d29ya3MuIEF0IGxlYXN0IGluIHRoZSBwYXN0LCBtYW55IHNtYXJ0cGhvbmVz IHdlcmUNCiAgICBoYXBweSB0byBvcHBvcnR1bmlzdGljYWxseSBqb2luIGFueSBvcGVuIHdpcmVs ZXNzIG5ldHdvcmsgdGhhdCBwcm92aWRlZA0KICAgIHNvbWUgc29ydCBvZiBJbnRlcm5ldCBjb25u ZWN0aXZpdHkuDQoNCiAgICBBbnlob3csIGRvbid0IHRyZWF0IHRoZXNlIGFzIG9iamVjdGlvbnMg YW5kIHJhdGhlciBhcyBpc3N1ZXMgdGhhdCBtaWdodA0KICAgIGJlIHdvcnRoIGNvbnNpZGVyaW5n IGdvaW5nIGZvcndhcmQuDQoNCiAgICAtLU1vaGl0DQoNCg== From nobody Wed Jul 22 13:16:23 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 722C13A085C for ; Wed, 22 Jul 2020 13:16:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mb0b056DsBjM for ; Wed, 22 Jul 2020 13:16:20 -0700 (PDT) Received: from mail-wm1-x329.google.com (mail-wm1-x329.google.com [IPv6:2a00:1450:4864:20::329]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D1C03A0858 for ; Wed, 22 Jul 2020 13:16:20 -0700 (PDT) Received: by mail-wm1-x329.google.com with SMTP id 9so3007647wmj.5 for ; Wed, 22 Jul 2020 13:16:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=NngNivtH+llGdaRlB3xya2RgV4kjvx/VTeKATA6FN00=; b=Ki70sAEyxSqAxa1Stto5tX3BSLJ4FPiYJ4pqoPH6miwuqLZypxb9ahC4YfKoIJ8akz lr7wQvt1RdDQkPNEHBbNbuTUXQ4gl2ARy/ZFiNvq8QrIBpJFVye16m242+wv1R1MCPLF WAYUScm62XqEnTZmKRxa45/3hb+xoExNa86BWL08Mu/Xd6P+ClRLhemkVlFsyEb+K+Sj CLKg8UESt0XCyvC5jvZXu1QbbPlMl38FmKVR5iAed8a9Qo1TmasgYCTzklap3A1VgE1k 1+vrICuAV4DCoIi3GfsUEx0n/Ic16niyGUE19vBWXGZEUBCsoTYecSwaz5nQ3Rq9v6oZ pZag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=NngNivtH+llGdaRlB3xya2RgV4kjvx/VTeKATA6FN00=; b=TMLoG2j9CrnOAJ4W8qBiycuvhN/CCJz/RHSV6BIy7lyQETZ17r9yXxOJYmJqRT8H1a 05fWBIHeNEqAj/IoWwtfmqiUv2dDvcidIOwB7f5ZVrvVfSHnmbbURP9EKFaN+Hp8L7Sn Ca3gCf6osjZiGkhlZ8lI6ZVS58UZDd7pSL31PjRCiDiS0af2XqqVeGJRIAJ2bbtZRoXH IiG4tX1++LvLpy8jn+/kzczbY6E1fV1f7BzfWd6QXZab3sRjYDec4b/EK9v3z7j18Q3l rHeeTtk6/0HjvbcQ6GMT/CWCgqHu6wl2CtmwXTqENffcuRRWGnNLPG/b1MoDiIOdphrO bnUw== X-Gm-Message-State: AOAM533m1Q8EsfNwOG7oNuwmzyvsN9rdP2IS49B5QF7YgouNffPGOaPE tVUtyM2v8AgclC2vS/qx5wN3716npFmyqy/iGwW7zQ== X-Google-Smtp-Source: ABdhPJwJ7FW9vOKLFretemQyds9AeoBARt6Lw2jnb7sY5Dm+bW1o/rWcYQhvFyKcWTiQN/VncR+Yw6zG2QyPBr/5xO8= X-Received: by 2002:a7b:c3c7:: with SMTP id t7mr1039854wmj.97.1595448978684; Wed, 22 Jul 2020 13:16:18 -0700 (PDT) MIME-Version: 1.0 References: <159438950508.10283.6338787113671554159@ietfa.amsl.com> <23877_1594815149_5F0EF2AD_23877_384_1_787AE7BB302AE849A7480A190F8B9330314F9783@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <20200720150751.GA14985@nic.fr> <17264_1595321101_5F16AB0D_17264_254_1_787AE7BB302AE849A7480A190F8B9330314FEE52@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> In-Reply-To: <17264_1595321101_5F16AB0D_17264_254_1_787AE7BB302AE849A7480A190F8B9330314FEE52@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> From: Ben Schwartz Date: Wed, 22 Jul 2020 16:16:07 -0400 Message-ID: To: mohamed.boucadair@orange.com Cc: Stephane Bortzmeyer , "draft-btw-add-home@ietf.org" , "ADD Mailing list (add@ietf.org)" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000a88ec605ab0d69a5" Archived-At: Subject: Re: [Add] TR: I-D Action: draft-btw-add-home-07.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 20:16:22 -0000 --000000000000a88ec605ab0d69a5 Content-Type: multipart/alternative; boundary="000000000000a21f0d05ab0d6979" --000000000000a21f0d05ab0d6979 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 21, 2020 at 4:45 AM wrote: > > > -----Message d'origine----- > > De : Add [mailto:add-bounces@ietf.org] De la part de Stephane > > Bortzmeyer > ... > > the advice in section 4 "DoH/DoT servers SHOULD be > > located by their address literals rather than their names" > > eliminates small DoE resolvers and leave only the big ones, who > > can have (like Google and > > Cloudflare) IP-based certificates. > > [Med] That is not the intent of that text. The recommendation is to supply > a list of IP addresses (locators, if you will) in addition to the ADN to > avoid a dependency on another resolver to resolve the name. > > Please note that the sentence you quoted starts with "From an IP > reachability standpoint, " and then followed by "This avoids > adding a dependency on another server to resolve the DoH/DoT name. " > I read this text similarly to Stephane. Are you saying that the resolver IP addresses in the same RA/DHCP message should be the IP addresses that serve the ADN? What if they are not? Or what if there are multiple ADNs? What is the client supposed to do? The use of DoH/DoT also depends on the user's policies. For example, > the user may indicate his/her consent to use (or not) the locally- > discovered DoH/DoT server or request to review human-readable privacy > policy information of a selected DNS server and to assess whether > that DNS server performs DNS-based content filtering (e.g., > [I-D.reddy-add-server-policy-selection]). The DNS client is assumed > to adhere to these policies. This document does not make any > assumption about the structure of such policies nor mandates specific > requirements. Such policies and their handling is out of scope. > > We wanted to avoid going too far in the "policy land", hence this wording. > This draft is already way too deep in "policy land". Most of Section 1, and much of Section 3, is dedicated to advancing a thesis about resolver selection policy, which is out of scope for this working group. Please remove these claims. I would also recommend removing this quoted text from Section 9. There's no need to spend time on anybody's policies; the drafts should focus on the technical mechanisms and leave policy out of it. --000000000000a21f0d05ab0d6979 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 21, 2020 at 4:45 AM <<= a href=3D"mailto:mohamed.boucadair@orange.com">mohamed.boucadair@orange.com= > wrote:
=
> -----Message d'origine-----
> De=C2=A0: Add [mailto:add-bounces@ietf.org] De la part de Stephane
> Bortzmeyer
...=C2=A0
> the advice in section 4 "DoH/DoT serve= rs SHOULD be
> located by their address literals rather than their names"
> eliminates small DoE resolvers and leave only the big ones, who
> can have (like Google and
> Cloudflare) IP-based certificates.

[Med] That is not the intent of that text. The recommendation is to supply = a list of IP addresses (locators, if you will) in addition to the ADN to av= oid a dependency on another resolver to resolve the name.

Please note that the sentence you quoted starts with "From an IP reach= ability standpoint, " and then followed by "This avoids
adding a dependency on another server to resolve the DoH/DoT name. "

I read this text similarly to Stephane.= =C2=A0 Are you saying that the resolver IP addresses in the same RA/DHCP me= ssage should be the IP addresses that serve the ADN?=C2=A0 What if they are= not?=C2=A0 Or what if there are multiple ADNs?=C2=A0 What is the client su= pposed to do?

=C2=A0 =C2=A0The use of DoH/DoT also depends on the user's p= olicies.=C2=A0 For example,
=C2=A0 =C2=A0the user may indicate his/her consent to use (or not) the loca= lly-
=C2=A0 =C2=A0discovered DoH/DoT server or request to review human-readable = privacy
=C2=A0 =C2=A0policy information of a selected DNS server and to assess whet= her
=C2=A0 =C2=A0that DNS server performs DNS-based content filtering (e.g., =C2=A0 =C2=A0[I-D.reddy-add-server-policy-selection]).=C2=A0 The DNS client= is assumed
=C2=A0 =C2=A0to adhere to these policies.=C2=A0 This document does not make= any
=C2=A0 =C2=A0assumption about the structure of such policies nor mandates s= pecific
=C2=A0 =C2=A0requirements.=C2=A0 Such policies and their handling is out of= scope.

We wanted to avoid going too far in the "policy land", hence this= wording.

This draft is already way to= o deep in "policy land".=C2=A0 Most of Section 1, and much of Sec= tion 3, is dedicated to advancing a thesis about resolver selection policy,= which is out of scope for this working group.=C2=A0 Please remove these cl= aims.

I would also recommend= removing this quoted text from Section 9.=C2=A0 There's no need to spe= nd time on anybody's policies; the drafts should focus on the technical= mechanisms and leave policy out of it.
--000000000000a21f0d05ab0d6979-- --000000000000a88ec605ab0d69a5 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIPBgYJKoZIhvcNAQcCoIIO9zCCDvMCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ggxpMIIEkjCCA3qgAwIBAgINAewckktV4F6Q7sAtGDANBgkqhkiG9w0BAQsFADBMMSAwHgYDVQQL ExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMK R2xvYmFsU2lnbjAeFw0xODA2MjAwMDAwMDBaFw0yODA2MjAwMDAwMDBaMEsxCzAJBgNVBAYTAkJF MRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSEwHwYDVQQDExhHbG9iYWxTaWduIFNNSU1FIENB IDIwMTgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUeobu8FdB5oJg6Fz6SFf8YsPI dNcq4rBSiSDAwqMNYbeTpRrINMBdWuPqVWaBX7WHYMsKQwCOvAF1b7rkD+ROo+CCTJo76EAY25Pp jt7TYP/PxoLesLQ+Ld088+BeyZg9pQaf0VK4tn23fOCWbFWoM8hdnF86Mqn6xB6nLsxJcz4CUGJG qAhC3iedFiCfZfsIp2RNyiUhzPAqalkrtD0bZQvCgi5aSNJseNyCysS1yA58OuxEyn2e9itZJE+O sUeD8VFgz+nAYI5r/dmFEXu5d9npLvTTrSJjrEmw2/ynKn6r6ONueZnCfo6uLmP1SSglhI/SN7dy L1rKUCU7R1MjAgMBAAGjggFyMIIBbjAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUH AwIGCCsGAQUFBwMEBggrBgEFBQcDCTASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRMtwWJ 1lPNI0Ci6A94GuRtXEzs0jAfBgNVHSMEGDAWgBSP8Et/qC5FJK5NUPpjmove4t0bvDA+BggrBgEF BQcBAQQyMDAwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjMw NgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9yb290LXIzLmNybDBn BgNVHSAEYDBeMAsGCSsGAQQBoDIBKDAMBgorBgEEAaAyASgKMEEGCSsGAQQBoDIBXzA0MDIGCCsG AQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG9w0B AQsFAAOCAQEAwREs1zjtnFIIWorsx5XejqZtqaq5pomEvpjM98ebexngUmd7hju2FpYvDvzcnoGu tjm0N3Sqj5vvwEgvDGB5CxDOBkDlmUT+ObRpKbP7eTafq0+BAhEd3z2tHFm3sKE15o9+KjY6O5bb M30BLgvKlLbLrDDyh8xigCPZDwVI7JVuWMeemVmNca/fidKqOVg7a16ptQUyT5hszqpj18MwD9U0 KHRcR1CfVa+3yjK0ELDS+UvTufoB9wp2BoozsqD0yc2VOcZ7SzcwOzomSFfqv7Vdj88EznDbdy4s fq6QvuNiUs8yW0Vb0foCVRNnSlb9T8//uJqQLHxrxy2j03cvtTCCA18wggJHoAMCAQICCwQAAAAA ASFYUwiiMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIz MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTA5MDMxODEwMDAw MFoXDTI5MDMxODEwMDAwMFowTDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzAR BgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDMJXaQeQZ4Ihb1wIO2hMoonv0FdhHFrYhy/EYCQ8eyip0EXyTLLkvhYIJG 4VKrDIFHcGzdZNHr9SyjD4I9DCuul9e2FIYQebs7E4B3jAjhSdJqYi8fXvqWaN+JJ5U4nwbXPsnL JlkNc96wyOkmDoMVxu9bi9IEYMpJpij2aTv2y8gokeWdimFXN6x0FNx04Druci8unPvQu7/1PQDh BjPogiuuU6Y6FnOM3UEOIDrAtKeh6bJPkC4yYOlXy7kEkmho5TgmYHWyn3f/kRTvriBJ/K1AFUjR AjFhGV64l++td7dkmnq/X8ET75ti+w1s4FRpFqkD2m7pg5NxdsZphYIXAgMBAAGjQjBAMA4GA1Ud DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSP8Et/qC5FJK5NUPpjmove4t0b vDANBgkqhkiG9w0BAQsFAAOCAQEAS0DbwFCq/sgM7/eWVEVJu5YACUGssxOGhigHM8pr5nS5ugAt rqQK0/Xx8Q+Kv3NnSoPHRHt44K9ubG8DKY4zOUXDjuS5V2yq/BKW7FPGLeQkbLmUY/vcU2hnVj6D uM81IcPJaP7O2sJTqsyQiunwXUaMld16WCgaLx3ezQA3QY/tRG3XUyiXfvNnBB4V14qWtNPeTCek TBtzc3b0F5nCH3oO4y0IrQocLP88q1UOD5F+NuvDV0m+4S4tfGCLw0FREyOdzvcya5QBqJnnLDMf Ojsl0oZAzjsshnjJYS8Uuu7bVW/fhO4FCU29KNhyztNiUGUe65KXgzHZs7XKR1g/XzCCBGwwggNU oAMCAQICEAH8qNflD4Mi9yKttXfRdHcwDQYJKoZIhvcNAQELBQAwSzELMAkGA1UEBhMCQkUxGTAX BgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExITAfBgNVBAMTGEdsb2JhbFNpZ24gU01JTUUgQ0EgMjAx ODAeFw0yMDA2MDUwODIyMjhaFw0yMDEyMDIwODIyMjhaMCIxIDAeBgkqhkiG9w0BCQEWEWJlbWFz Y0Bnb29nbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2kbyV9S0YLplF3kV 6t3GgD7IyHe8L29pJ7l+UR0Sj31uPgXOFdSSdTVwhPfQvxmB2OUDXWDgDtZdL2xu4DgHhrDyyOXT 8uDJqUCPw004ZSuUfUor1vz5u6+oYNfx2OTPTb81vtsQO2/khni3iAeQlKgO/rUI1c9+zvT6k3mR SZUypAlk/rCyG6NV7NMJMmOaU20/kPBXG297iP8+/F9w4xs+lyb3IkcSfoSUr3fVz7mYqESFato5 JnjRQGT2/f/ehxkc09jATqVGj9nyQMoD2GNPjiNnYyTVBwK5Ol/s9+E2VSL4TSLrgS2R07kY9zPi VOM3lhDDRnceboNSaqnfMwIDAQABo4IBczCCAW8wHAYDVR0RBBUwE4ERYmVtYXNjQGdvb2dsZS5j b20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNVHQ4E FgQUwJS1fB3cBxoLgZFatdIO9Vp5wOcwTAYDVR0gBEUwQzBBBgkrBgEEAaAyASgwNDAyBggrBgEF BQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wUQYIKwYBBQUHAQEE RTBDMEEGCCsGAQUFBzAChjVodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc3Nt aW1lY2EyMDE4LmNydDAfBgNVHSMEGDAWgBRMtwWJ1lPNI0Ci6A94GuRtXEzs0jA/BgNVHR8EODA2 MDSgMqAwhi5odHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2NhL2dzc21pbWVjYTIwMTguY3JsMA0G CSqGSIb3DQEBCwUAA4IBAQCC91PBn9rMxo8kSo1zNY2mxkTQDTVc0oyYk8s3y72y21IEp/d/+h1H VTCD2FR30aFUv8hTJkebJ5Z1/zue2L7sx/lLEOIHm9uYxyTkTWbKup3+XrE1vhODTHVx+ktMuOTY z447/fwjy4praSaFrQsOjTPbAoU6xuC8S2j2K2Yg6XQsctcKHKeAJjN6evZYChDaTBLmtYq9LTSH KVv3Et795vNK3gWKjhEkJtaBu4FfKLoopb1PENJ/zK6p/3edCLFgCRMSlbQ0SGtdVESSJcgezSwW WK2VB1Zcj2kyVzcL1pmV8m1xQuz2aBgUMn7peoVxKxYKP12gMtzeMvkzltYBMYICYTCCAl0CAQEw XzBLMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEhMB8GA1UEAxMYR2xv YmFsU2lnbiBTTUlNRSBDQSAyMDE4AhAB/KjX5Q+DIvcirbV30XR3MA0GCWCGSAFlAwQCAQUAoIHU MC8GCSqGSIb3DQEJBDEiBCDQHF0nN2smJyY5d3EULqfzAR9vBYGcTGwegjom0bEFTzAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA3MjIyMDE2MTlaMGkGCSqGSIb3 DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglghkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAE ggEAvKhj5ALL1FgMdLa7t2KlXdHvRX3IqlKX6wgk41d6uggf5MWapiO/NNvTqZJNFtG6LBKHJRW2 deINdm5yq9b4EOme4RcZIXjOAgN+xl0A2N2jj41atQcaLj/dT72AA+PzUav72sYN21dOvrVNbmWQ lB7UWfBMoMEFz5LvBgQ+axd95uEZT5CYamqBXtSnIXo9ek6QmFz7FXLbTYuykBgkEAM9p4top5rl gAOUITGqkNSWR4wsULTpPkAqESyF4jc9As5UioCHKTtOTcNNGMILktM1SFvv/9kWF6FJlxEAdSxD p9KJcp/V4dEEAW13nFZaHRUH0/d6uF3Fah5DiEcsqg== --000000000000a88ec605ab0d69a5-- From nobody Wed Jul 22 13:17:13 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7A483A085D for ; Wed, 22 Jul 2020 13:17:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hkbOfhouNc1F for ; Wed, 22 Jul 2020 13:17:10 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F399D3A0859 for ; Wed, 22 Jul 2020 13:17:09 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 56E9EC3F16; Wed, 22 Jul 2020 20:17:07 +0000 (UTC) From: Paul Vixie To: Tony Rutkowski , "add@ietf.org" Cc: Vittorio Bertola Date: Wed, 22 Jul 2020 20:17:06 +0000 Message-ID: <7747497.8rzJph4zVO@linux-9daj> Organization: none In-Reply-To: <1656374832.4600.1595419193524@appsuite-gw1.open-xchange.com> References: <452c8cf6-d32e-6971-7839-2275a3565d15@gmail.com> <1656374832.4600.1595419193524@appsuite-gw1.open-xchange.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 20:17:12 -0000 On Wednesday, 22 July 2020 11:59:53 UTC Vittorio Bertola wrote: > > Il 21/07/2020 20:42 Tony Rutkowski ha scritto: > > ... > > http://www.circleid.com/posts/20200711-addressing-anticompetitive-behaviur-in-internet-standards-bodies/ > Very interesting story - also considering Stephen's reply on how RFC 7258 > was done without any specific process, I find more and more signs that the > IETF for quite some years now has treaded recklessly into policy-intensive > territories without giving any real thought at how to do it right :-) It > would be interesting to have that discussion, ... +1, noting that in my pre-pandemic world travels, i've met dozens if not hundreds of technologists capable of reasoning and working at the level required by IETF, and whose careers and other opportunities would be dramatically shifted by the outcomes of IETF, but who cannot afford the time or the travel to participate, or whose english language skills aren't at par. their general sense is that wealthy white people in silicon valley determine the future of the internet for reasons of ideology or business, and the rest of the world just goes along with those outcomes, having no practical alternatives. if this discussion is to be had, i'd like to know where and when. > ... but of course not here. also +1. -- Paul From nobody Wed Jul 22 13:22:07 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82C103A08D8 for ; Wed, 22 Jul 2020 13:22:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2pmQzSBNmU9b for ; Wed, 22 Jul 2020 13:22:03 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9B4F43A08E5 for ; Wed, 22 Jul 2020 13:22:03 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 7AC7DC3F16 for ; Wed, 22 Jul 2020 20:22:03 +0000 (UTC) From: Paul Vixie To: add@ietf.org Date: Wed, 22 Jul 2020 20:22:02 +0000 Message-ID: <34686279.zXsR21MR3o@linux-9daj> Organization: none In-Reply-To: References: <5EFC3442-045F-4F89-A4BA-769C1AFE87A4@comcast.com> <9390.1595363364@localhost> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] IETF108 ADD Agenda X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 20:22:06 -0000 On Wednesday, 22 July 2020 12:54:17 UTC Chris Box (BT) wrote: > ... going by > Glenn's previous reply I think he's expecting the serious review to take > place both on the list, and in the September interim. jfyi, i lack the will to either pay a fee (neither my family nor my employer has an interest in this topic) or request a fee waiver (i could afford to pay but i'm merely a concerned internet citizen) to attend a virtual IETF meeting, so i'll see you all on this mailing list, and at the interrim. -- Paul From nobody Wed Jul 22 13:27:18 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F54F3A0958 for ; Wed, 22 Jul 2020 13:27:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.919 X-Spam-Level: X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eYaxHld3PDQP for ; Wed, 22 Jul 2020 13:27:14 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC60A3A08FF for ; Wed, 22 Jul 2020 13:27:14 -0700 (PDT) Received: from pps.filterd (m0049287.ppops.net [127.0.0.1]) by m0049287.ppops.net-00191d01. (8.16.0.42/8.16.0.42) with SMTP id 06MKBq7g043199; Wed, 22 Jul 2020 16:27:09 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049287.ppops.net-00191d01. with ESMTP id 32e6284vv9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2020 16:27:09 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id 06MKR6iQ019929; Wed, 22 Jul 2020 16:27:08 -0400 Received: from zlp30484.vci.att.com (zlp30484.vci.att.com [135.47.91.179]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id 06MKR2TE019764 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 22 Jul 2020 16:27:02 -0400 Received: from zlp30484.vci.att.com (zlp30484.vci.att.com [127.0.0.1]) by zlp30484.vci.att.com (Service) with ESMTP id 77E8D4009E78; Wed, 22 Jul 2020 20:27:02 +0000 (GMT) Received: from GAALPA1MSGEX1CF.ITServices.sbc.com (unknown [135.50.89.113]) by zlp30484.vci.att.com (Service) with ESMTPS id 5D1DB4009E72; Wed, 22 Jul 2020 20:27:02 +0000 (GMT) Received: from GAALPA1MSGEX1CB.ITServices.sbc.com (135.50.89.109) by GAALPA1MSGEX1CF.ITServices.sbc.com (135.50.89.113) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2044.4; Wed, 22 Jul 2020 16:26:56 -0400 Received: from GAALPA1MSGEX1CB.ITServices.sbc.com ([135.50.89.109]) by GAALPA1MSGEX1CB.ITServices.sbc.com ([135.50.89.109]) with mapi id 15.01.2044.004; Wed, 22 Jul 2020 16:26:56 -0400 From: "STARK, BARBARA H" To: "'Eric Orth'" , "'Chris Box (BT)'" CC: "'ADD Mailing list'" , "'Deen, Glenn'" Thread-Topic: [Add] New Threats ID for ADD Thread-Index: AQHWXveH7JO1nsTxqkKNHNNtJCTm0KkSDnYAgAFco4CAAG66gIAAKuQAgAAb8wCAAAdOgP//x6RA Date: Wed, 22 Jul 2020 20:26:56 +0000 Message-ID: <2afd9527aab8477ea19217eec2f49e44@att.com> References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> <20200721095240.GA10868@nic.fr> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.10.66.16] x-tm-snts-smtp: 032873DB810131F694BB896982CC86B8094125992857DB883D2A61022FA2100F2 Content-Type: multipart/alternative; boundary="_000_2afd9527aab8477ea19217eec2f49e44attcom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-22_13:2020-07-22, 2020-07-22 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 lowpriorityscore=0 malwarescore=0 phishscore=0 priorityscore=1501 impostorscore=0 mlxlogscore=999 bulkscore=0 adultscore=0 spamscore=0 suspectscore=0 mlxscore=0 clxscore=1011 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007220125 Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 20:27:17 -0000 --_000_2afd9527aab8477ea19217eec2f49e44attcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RnJvbTogRXJpYyBPcnRoDQoNCk9uIFdlZCwgSnVsIDIyLCAyMDIwIGF0IDE6MzAgUE0gQ2hyaXMg Qm94IChCVCkgPGNocmlzLmJveC5pZXRmQGdtYWlsLmNvbTxtYWlsdG86Y2hyaXMuYm94LmlldGZA Z21haWwuY29tPj4gd3JvdGU6DQoNCkVyaWMsDQoNCkFuZCBJJ20gY3VyaW91cyBhYm91dCB0aGUg aW50ZW50IGZvciBob3cgdGhpcyB3aWxsIGJlIHVzZWQuICBIb3cgaXMgdGhpcyBleHBlY3RlZCB0 byBiZSBoZWxwZnVsIGluIGRpc2N1c3Npb25zIG9yIGRyYWZ0cz8gU2VlbXMgd2UgbG9zZSBhIGxv dCBvZiB0aGUgcG90ZW50aWFsIGZvciBkaXNjdXNzaW9uIGhlbHBmdWxuZXNzIGlmIHdlIGRvbid0 IGhhdmUgYSBjb21tb24gdW5kZXJzdGFuZGluZyBvZiBjbGFzc2lmaWNhdGlvbnMgb3IgaW1wbGlj YXRpb25zICh3aGljaCB3ZSBzaG91bGRuJ3QgaGF2ZSBiZWNhdXNlIHRoYXQncyBwb2xpY3kpLiAg QW5kIEkgd291bGQgYmUgZXNwZWNpYWxseSBjb25jZXJuZWQgaWYgZHJhZnQgU2VjdXJpdHkgQ29u c2lkZXJhdGlvbnMgc2VjdGlvbnMgc3RhcnRlZCBtYWtpbmcgc3RhdGVtZW50cyBsaWtlICJ0aGlz IGF0dGFjayBvbmx5IGFmZmVjdHMgaG9tZSBuZXR3b3Jrcywgd2hpY2ggYXJlIGEgR3JlZW4gbmV0 d29yayBhbmQgdGhlcmVmb3JlIG5vdCBhIGNvbmNlcm4iLg0KDQoNClRoaW5raW5nIGFsb3VkLCB3 b3VsZCBpdCBiZSB1c2VmdWwgZm9yIGEgZHJhZnQgdG8gc2F5ICJ0aGlzIGF1dG9tYXRpYyBtZWNo YW5pc20gU0hPVUxEIE5PVCBiZSB1c2VkIGluIGEgbmV0d29yayB0aGUgdXNlciBoYXMgY2xhc3Np ZmllZCBhcyBSZWQiPw0KDQpJIHRoaW5rIHRoYXQgd291bGQgYmUgYSBwcm9ibGVtYXRpYyBzdGF0 ZW1lbnQgYmVjYXVzZSwgZm9yIG1hbnkgbWVjaGFuaXNtcyB3aGVyZSBhIGRyYWZ0IG1pZ2h0IGNv bnNpZGVyIG1ha2luZyBzdWNoIGEgc3RhdGVtZW50LCB0aGUgc29mdHdhcmUgY2hvb3NpbmcgdG8g dXNlIHN1Y2ggYSBtZWNoYW5pc20gbWF5IG5vdCBoYXZlIGFueSByZWFzb25hYmxlIHNpZ25hbCBv ZiB3aGV0aGVyIG9yIG5vdCB0aGUgdXNlciB3b3VsZCBjbGFzc2lmeSB0aGUgbmV0d29yayBhcyBz dWNoLiAgTWF5YmUgc3RhdGVtZW50cyBhcm91bmQgIndoZW4gdGhlIGltcGxlbWVudGF0aW9uIGV4 cGVjdHMgaXRzIHVzZXJzIHdvdWxkIGNsYXNzaWZ5IHRoZSBuZXR3b3JrIGFzIFJlZCIsIGJ1dCB0 aGF0IG1pZ2h0IGJlIHRvbyBsb29zZSB0byBiZSBoZWxwZnVsIGluIHN1Y2ggc2VjdXJpdHkgZGlz Y3Vzc2lvbnMuIE1heWJlIGNvdWxkIGJlIGhlbHBmdWwgZm9yIG1vcmUgcmVmaW5lZCBzdGF0ZW1l bnRzIGxpa2UgInRoaXMgbWVjaGFuaXNtIGNvdWxkIGJlIHBhcnRpY3VsYXJseSB2dWxuZXJhYmxl IHRvIGF0dGFja3Mgb24gbmV0d29ya3MgdGhlIHVzZXIgaGFzIGNsYXNzaWZpZWQgYXMgUmVkLCBz byBpbXBsZW1lbnRhdGlvbnMgU0hPVUxEIG1ha2UgYXBwcm9wcmlhdGUgbWl0aWdhdGlvbnMgdW5s ZXNzIHRoZSB1c2VyIGhhcyBzaWduYWxlZCBhIGhpZ2hlciBsZXZlbCBvZiB0cnVzdCIsIGJ1dCB3 aGVuIGdvaW5nIGludG8gdGhhdCBtdWNoIGRldGFpbCwgaXMgdGhlIHNpbXBsaWZpY2F0aW9uIG9m IHNheWluZyAiUmVkIiByZWFsbHkgaGVscGZ1bCBvciBpcyB0aGUgZHJhZnQgZ29pbmcgdG8gbmVl ZCB0byBjbGVhcmx5IGRlZmluZSB0aGUgc2l0dWF0aW9uYWwgZGFuZ2VycyBhbnl3YXk/DQoNCjxi aHM+DQpJIHRoaW5rIHRoZXNlIGNsYXNzaWZpY2F0aW9ucyBhcmUgdG9vIGNvbXBsZXggYW5kIGFk ZCBhbiB1bm5lY2Vzc2FyeSBsZXZlbCBvZiBhYnN0cmFjdGlvbiB0aGF0IHdpbGwgY2F1c2UgdXNl cnMgdG8gZHJhdyBmYWxzZSBjb25jbHVzaW9ucy4NCg0KSXTigJlzIGEgYml0IGZ1enp5IGFzIHRv IHdoYXQgaXQgbWVhbnMgZm9yIGEgdXNlciB0byB0cnVzdCBhIG5ldHdvcmssIGluIHRoZSBjb250 ZXh0IG9mIGRpc2NvdmVyaW5nIERvSCBzZXJ2ZXJzLiBUaGUgZHJhZnQgbWVudGlvbnMgc29tZSBh c3BlY3RzLCBidXQgdGhvc2UgYXNwZWN0cyBhcmUgYWxsIG92ZXIgdGhlIHBsYWNlLCBhbmQgSeKA mW0gbm90IHN1cmUgdGhleeKAmXJlIHRoZSByaWdodCBzZXQuDQpGb3IgZXhhbXBsZSB0aGUgZHJh ZnQgbWVudGlvbnMgd2hldGhlciB0aGUgdXNlciB0cnVzdHMgdGhhdCB0aGUgbmV0d29yayBpcyAo MSkgb3BlcmF0ZWQgd2l0aCBzZWN1cml0eSwgKDIpIG9wZXJhdGVkIHdpdGggb3BlcmF0aW9uYWwg aW50ZWdyaXR5IChJ4oCZbSBub3Qgc3VyZSB3aGF0IHRoaXMgbWVhbnMpLCBvciAoMykgbm90IGNv bXByb21pc2VkIGJ5IGF0dGFja2VycyBvciBtYWx3YXJlLg0KVGhlIFdpbmRvd3MgbW9kZWwgd2Fz IG1lbnRpb25lZCBpbiB0aGlzIHRocmVhZCDigJMgYnV0IFdpbmRvd3MgZG9lc27igJl0IGFzayB1 c2VycyB3aGV0aGVyIG9yIG5vdCB0aGV5IHRydXN0IHRoZSBuZXR3b3JrOyBXaW5kb3dzIGFza3Mg d2hldGhlciB0aGUgbmV0d29yayBpcyBwdWJsaWMgKGNhbiBhbnlvbmUgam9pbiA9IGFyZSBhbGwg dGhlIGRldmljZXMgYXR0YWNoZWQgdG8gdGhlIG5ldHdvcmsga25vd24gdG8gdGhlIHVzZXIgYW5k IG5vdCBzdXNwZWN0ZWQgb2YgYmVpbmcgbWFsaWduYW50KSBvciBwcml2YXRlLiBXaGV0aGVyIG9y IG5vdCB5b3UgdHJ1c3QgdGhlIG90aGVyIGRldmljZXMgb24gdGhlIG5ldHdvcmsgaXMgZGlmZmVy ZW50IGZyb20gdHJ1c3Rpbmcgd2hldGhlciB0aGUgbmV0d29yayBpcyBvcGVyYXRlZCB3aXRoIHNl Y3VyaXR5LCBpbnRlZ3JpdHksIG9yIGhhcyBiZWVuIGNvbXByb21pc2VkLg0KDQpCYXNlZCBvbiB0 aGUgZGlzY3Vzc2lvbiBJ4oCZdmUgc2VlbiwgaXQgc2VlbXMgbGlrZSB3aGF0IHdlIHdhbnQgdG8g a25vdyBpcyB3aGV0aGVyIHRoZSB1c2VyIHdhbnRzIHRvIHVzZSBETlMvRG9IIHNlcnZlcnMgYWR2 ZXJ0aXNlZCBieSB0aGUgbG9jYWwgbmV0d29yaywgb3Igbm90LiBBbmQgdGhlcmUgbWF5IGJlIHNv bWUgbmV0d29ya3MgKG5ldHdvcmsgYWRtaW5zKSB0aGF0IHdvdWxkIHdhbnQgdG8gc2F5IOKAnElm IHlvdSBkb27igJl0IHVzZSBteSBETlMvRG9IIHNlcnZlcnMsIHRoZW4gSeKAmW0gZ29pbmcgdG8g dHJlYXQgeW91IGxpa2UgbWFsd2FyZSBhbmQgZG8gZXZlcnl0aGluZyBpbiBteSBwb3dlciB0byBw cmV2ZW50IHlvdSBmcm9tIHVzaW5nIG15IG5ldHdvcmsu4oCdIEZvciBleGFtcGxlLCBhIHBhcmVu dCBtaWdodCB3YW50IHRvIGhhdmUgdGhpcyBzb3J0IG9mIHNldHRpbmcgZm9yIHRoZWlyIGhvbWUg bmV0d29yay4gQW5kIGEgY29ycG9yYXRlIG5ldHdvcmsgd291bGQgd2FudCB0aGlzLiBJZiBhIGNv ZmZlZSBzaG9wIHNheXMgdGhpcywgdGhlIHVzZXIgY2FuIGRlY2lkZSB3aGV0aGVyIG9yIG5vdCB0 byB1c2UgdGhlIG5ldHdvcmsuIEkgbWVhbiwgdGhlIG5ldHdvcmsgYmVsb25ncyB0byB0aGUgY29m ZmVlIHNob3AgYW5kIG5vdCB0aGUgdXNlciwgc28gdGhlIGNvZmZlZSBzaG9wIHNob3VsZCBoYXZl IHRoZSByaWdodCB0byBkaWN0YXRlIHVzYWdlIHBvbGljeS4gVXNlcnMgYXJlIGNvbXBsZXRlbHkg ZnJlZSBub3QgdG8gdXNlIHRoZSBjb2ZmZWUgc2hvcCBuZXR3b3JrIGlmIHRoZXkgZG9u4oCZdCBs aWtlIHRoZSBzaG9w4oCZcyBuZXR3b3JrIHBvbGljaWVzLg0KDQpBIGNsYXNzaWZpY2F0aW9uIGZv ciB3YXIgem9uZXMgYW5kIGhvc3RpbGUgcmVnaW1lcyBhbmQgYmxhY2toYXQgbmV0d29ya3Mgc3Ry aWtlcyBtZSBhcyBiaXphcnJlLg0KDQpUTDtEUjogSSB0aGluayB0aGUgbmV0d29yayBuZWVkcyB0 byBiZSBhYmxlIHRvIGluZGljYXRlIHdoZXRoZXIgbmV0d29yayBwb2xpY3kgYWxsb3dzIHVzZSBv ZiBETlMvRG9IIHNlcnZlcnMgb3RoZXIgdGhhbiB0aG9zZSBpdCBhZHZlcnRpc2VzLCBhbmQgdXNl cnMgKHdobyBoYXZlIGJlZW4gaW5mb3JtZWQgb2YgdGhlIG5ldHdvcmsgcG9saWN5KSBjYW4gZGVj aWRlIHdoZXRoZXIgb3Igbm90IHRoZXkgd2FudCB0byB1c2UgdGhlIGxvY2FsbHkgYWR2ZXJ0aXNl ZCBEb0ggc2VydmVycyAoaS5lLiwgdGhlcmUgYXJlIGp1c3QgMiB0eXBlcyBvZiBuZXR3b3JrcyDi gJMgKDEpIHVzZSBhZHZlcnRpc2VkIEROUy9Eb0ggYW5kICgyKSBkb27igJl0IHVzZSBhZHZlcnRp c2VkIEROUy9Eb0gpLiBXaGF0IHRoZSBuZXR3b3JrIGRvZXMgdG8gZGV0ZWN0IGFuZCBoYW5kbGUg dmlvbGF0aW9ucyBvZiBpdHMgcG9saWN5IGlzIG91dCBvZiBzY29wZS4gVGhlIG5ldHdvcmsganVz dCBuZWVkcyB0byBiZSBhYmxlIHRvIGV4cHJlc3MgaXRzIHBvbGljeS4gRGVwZW5kaW5nIG9uIHRo ZSBkZXZpY2UvYXBwbGljYXRpb24sIHRoZSB1c2VyIG1heSBiZSBhYmxlIHRvIGdvIGFnYWluc3Qg dGhlIG5ldHdvcmsgcG9saWN5LCBidXQgdGhleSBkbyBzbyBrbm93aW5nbHkuIE9UT0gsIHNvbWUg ZGV2aWNlcy9hcHBsaWNhdGlvbnMgKGUuZy4sIGVudGVycHJpc2UtbWFuYWdlZCBkZXZpY2VzLCBw YXJlbnRhbGx5LWNvbnRyb2xsZWQgZGV2aWNlcykgbWF5IG5vdCBhbGxvdyB1c2VycyB0byBnbyBh Z2FpbnN0IHRoZSBuZXR3b3JrIHBvbGljeS4gVGhlIHN5c3RlbSBjb3VsZCBldmVuIGJlIGRlZmF1 bHRlZCBub3QgdG8gdXNlIGxvY2FsbHkgYWR2ZXJ0aXNlZCBETlMgb24gbmV3L3Vua25vd24gbmV0 d29ya3MgdW5sZXNzIHRoYXQgdmlvbGF0ZXMgZXhwcmVzc2VkIG5ldHdvcmsgcG9saWN5IChpbiB3 aGljaCBjYXNlIHRoZSB1c2VyIGlzIGluZm9ybWVkIGFuZCBhc2tlZCBpZiB0aGV5IHdhbnQgdG8g dXNlIGxvY2FsbHkgYWR2ZXJ0aXNlZCBwZXIgcG9saWN5KS4gIC0gQmFyYmFyYQ0KPC9iaHM+DQo= --_000_2afd9527aab8477ea19217eec2f49e44attcom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IlByb2dJZCIg Y29udGVudD0iV29yZC5Eb2N1bWVudCI+DQo8bWV0YSBuYW1lPSJHZW5lcmF0b3IiIGNvbnRlbnQ9 Ik1pY3Jvc29mdCBXb3JkIDE1Ij4NCjxtZXRhIG5hbWU9Ik9yaWdpbmF0b3IiIGNvbnRlbnQ9Ik1p Y3Jvc29mdCBXb3JkIDE1Ij4NCjxsaW5rIHJlbD0iRmlsZS1MaXN0IiBocmVmPSJjaWQ6ZmlsZWxp c3QueG1sQDAxRDY2MDNDLjdFRDA4RjcwIj48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOk9m ZmljZURvY3VtZW50U2V0dGluZ3M+DQo8bzpBbGxvd1BORy8+DQo8bzpEb05vdFJlbHlPbkNTUy8+ DQo8L286T2ZmaWNlRG9jdW1lbnRTZXR0aW5ncz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPHc6V29yZERvY3VtZW50Pg0KPHc6U3BlbGxpbmdTdGF0ZT5DbGVh bjwvdzpTcGVsbGluZ1N0YXRlPg0KPHc6RG9jdW1lbnRLaW5kPkRvY3VtZW50RW1haWw8L3c6RG9j dW1lbnRLaW5kPg0KPHc6VHJhY2tNb3Zlcy8+DQo8dzpUcmFja0Zvcm1hdHRpbmcvPg0KPHc6RW52 ZWxvcGVWaXMvPg0KPHc6VmFsaWRhdGVBZ2FpbnN0U2NoZW1hcy8+DQo8dzpTYXZlSWZYTUxJbnZh bGlkPmZhbHNlPC93OlNhdmVJZlhNTEludmFsaWQ+DQo8dzpJZ25vcmVNaXhlZENvbnRlbnQ+ZmFs c2U8L3c6SWdub3JlTWl4ZWRDb250ZW50Pg0KPHc6QWx3YXlzU2hvd1BsYWNlaG9sZGVyVGV4dD5m YWxzZTwvdzpBbHdheXNTaG93UGxhY2Vob2xkZXJUZXh0Pg0KPHc6RG9Ob3RQcm9tb3RlUUYvPg0K PHc6TGlkVGhlbWVPdGhlcj5FTi1VUzwvdzpMaWRUaGVtZU90aGVyPg0KPHc6TGlkVGhlbWVBc2lh bj5YLU5PTkU8L3c6TGlkVGhlbWVBc2lhbj4NCjx3OkxpZFRoZW1lQ29tcGxleFNjcmlwdD5YLU5P TkU8L3c6TGlkVGhlbWVDb21wbGV4U2NyaXB0Pg0KPHc6Q29tcGF0aWJpbGl0eT4NCjx3OkRvTm90 RXhwYW5kU2hpZnRSZXR1cm4vPg0KPHc6QnJlYWtXcmFwcGVkVGFibGVzLz4NCjx3OlNuYXBUb0dy aWRJbkNlbGwvPg0KPHc6V3JhcFRleHRXaXRoUHVuY3QvPg0KPHc6VXNlQXNpYW5CcmVha1J1bGVz Lz4NCjx3OkRvbnRHcm93QXV0b2ZpdC8+DQo8dzpTcGxpdFBnQnJlYWtBbmRQYXJhTWFyay8+DQo8 dzpFbmFibGVPcGVuVHlwZUtlcm5pbmcvPg0KPHc6RG9udEZsaXBNaXJyb3JJbmRlbnRzLz4NCjx3 Ok92ZXJyaWRlVGFibGVTdHlsZUhwcy8+DQo8L3c6Q29tcGF0aWJpbGl0eT4NCjxtOm1hdGhQcj4N CjxtOm1hdGhGb250IG06dmFsPSJDYW1icmlhIE1hdGgiLz4NCjxtOmJya0JpbiBtOnZhbD0iYmVm b3JlIi8+DQo8bTpicmtCaW5TdWIgbTp2YWw9IiYjNDU7LSIvPg0KPG06c21hbGxGcmFjIG06dmFs PSJvZmYiLz4NCjxtOmRpc3BEZWYvPg0KPG06bE1hcmdpbiBtOnZhbD0iMCIvPg0KPG06ck1hcmdp biBtOnZhbD0iMCIvPg0KPG06ZGVmSmMgbTp2YWw9ImNlbnRlckdyb3VwIi8+DQo8bTp3cmFwSW5k ZW50IG06dmFsPSIxNDQwIi8+DQo8bTppbnRMaW0gbTp2YWw9InN1YlN1cCIvPg0KPG06bmFyeUxp bSBtOnZhbD0idW5kT3ZyIi8+DQo8L206bWF0aFByPjwvdzpXb3JkRG9jdW1lbnQ+DQo8L3htbD48 IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjx3OkxhdGVudFN0eWxlcyBEZWZM b2NrZWRTdGF0ZT0iZmFsc2UiIERlZlVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgRGVmU2VtaUhpZGRl bj0iZmFsc2UiIERlZlFGb3JtYXQ9ImZhbHNlIiBEZWZQcmlvcml0eT0iOTkiIExhdGVudFN0eWxl Q291bnQ9IjM3NyI+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjAi IFFGb3JtYXQ9InRydWUiIE5hbWU9Ik5vcm1hbCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI5IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDEiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIgU2VtaUhpZGRlbj0idHJ1 ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFGb3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgMiIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI5IiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iaGVhZGlu ZyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjkiIFNlbWlI aWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJo ZWFkaW5nIDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFGb3JtYXQ9InRydWUiIE5h bWU9ImhlYWRpbmcgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZvcm1hdD0idHJ1 ZSIgTmFtZT0iaGVhZGluZyA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBRRm9ybWF0 PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iOSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFG b3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iaGVhZGluZyA5Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 ImluZGV4IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0 cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iaW5kZXggMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJpbmRleCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhp ZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImluZGV4IDQiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iaW5kZXggNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJpbmRleCA2Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRl V2hlblVzZWQ9InRydWUiIE5hbWU9ImluZGV4IDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iaW5k ZXggOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJpbmRleCA5Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0idG9jIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBO YW1lPSJ0b2MgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIz OSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9InRvYyAzIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9jIDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0b2MgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSIzOSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRy dWUiIE5hbWU9InRvYyA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjM5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9j IDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlI aWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0b2MgOCIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzOSIgU2VtaUhpZGRlbj0idHJ1ZSIg VW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9InRvYyA5Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 Ik5vcm1hbCBJbmRlbnQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlk ZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iZm9vdG5vdGUgdGV4dCIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdo ZW5Vc2VkPSJ0cnVlIiBOYW1lPSJhbm5vdGF0aW9uIHRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFt ZT0iaGVhZGVyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImZvb3RlciIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJpbmRleCBoZWFkaW5nIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjM1IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZv cm1hdD0idHJ1ZSIgTmFtZT0iY2FwdGlvbiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0YWJsZSBv ZiBmaWd1cmVzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImVudmVsb3BlIGFkZHJlc3MiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iZW52ZWxvcGUgcmV0dXJuIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 ImZvb3Rub3RlIHJlZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJhbm5vdGF0aW9uIHJl ZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJsaW5lIG51bWJlciIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJwYWdlIG51bWJlciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJlbmRub3RlIHJl ZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJlbmRub3RlIHRleHQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0idGFibGUgb2YgYXV0aG9yaXRpZXMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i bWFjcm8iLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9hIGhlYWRpbmciLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IEJ1bGxldCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0 IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iTGlzdCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 Ikxpc3QgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IDUiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBCdWxsZXQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IEJ1bGxldCAz Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxpc3QgQnVsbGV0IDQiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBCdWxsZXQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxpc3QgTnVtYmVyIDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBOdW1iZXIgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciA1 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjEwIiBRRm9ybWF0 PSJ0cnVlIiBOYW1lPSJUaXRsZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJDbG9zaW5nIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hl blVzZWQ9InRydWUiIE5hbWU9IlNpZ25hdHVyZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSIxIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iRGVmYXVsdCBQYXJhZ3JhcGggRm9udCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJC b2R5IFRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0 cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEluZGVudCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJMaXN0IENvbnRpbnVlIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxp c3QgQ29udGludWUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IENvbnRpbnVlIDMiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iTGlzdCBDb250aW51ZSA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9Ikxpc3QgQ29udGludWUgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJNZXNzYWdlIEhlYWRl ciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIxMSIgUUZvcm1h dD0idHJ1ZSIgTmFtZT0iU3VidGl0bGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iU2FsdXRhdGlv biIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJEYXRlIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkJv ZHkgVGV4dCBGaXJzdCBJbmRlbnQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBT ZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEZp cnN0IEluZGVudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRl bj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ik5vdGUgSGVhZGluZyIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJCb2R5IFRleHQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCb2R5 IFRleHQgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCb2R5IFRleHQgSW5kZW50IDIiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEluZGVudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9IkJsb2NrIFRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlk ZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSHlwZXJsaW5rIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVz ZWQ9InRydWUiIE5hbWU9IkZvbGxvd2VkSHlwZXJsaW5rIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjIyIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJTdHJvbmciLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMjAiIFFGb3JtYXQ9InRy dWUiIE5hbWU9IkVtcGhhc2lzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2Vt aUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkRvY3VtZW50IE1hcCIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJQbGFpbiBUZXh0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IkUtbWFpbCBTaWduYXR1cmUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1p SGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBUb3Agb2YgRm9y bSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIEJvdHRvbSBvZiBGb3JtIi8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9 InRydWUiIE5hbWU9Ik5vcm1hbCAoV2ViKSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIEFj cm9ueW0iLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBBZGRyZXNzIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRy dWUiIE5hbWU9IkhUTUwgQ2l0ZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIENvZGUiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBEZWZpbml0aW9uIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9IkhUTUwgS2V5Ym9hcmQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1p SGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBQcmVmb3JtYXR0 ZWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBTYW1wbGUiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iSFRNTCBUeXBld3JpdGVyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkhUTUwgVmFyaWFi bGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iYW5ub3RhdGlvbiBzdWJqZWN0Ii8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9 InRydWUiIE5hbWU9Ik5vIExpc3QiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBT ZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iT3V0bGluZSBMaXN0 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iT3V0bGluZSBMaXN0IDIiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iT3V0bGluZSBMaXN0IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgU2lt cGxlIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgU2ltcGxlIDIiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0iVGFibGUgU2ltcGxlIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUg Q2xhc3NpYyAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENsYXNzaWMgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDbGFzc2ljIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i VGFibGUgQ2xhc3NpYyA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhp ZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENvbG9yZnVsIDEi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhp ZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgQ29sb3JmdWwgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJUYWJsZSBDb2xvcmZ1bCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENv bHVtbnMgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDb2x1bW5zIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgQ29sdW1ucyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRh YmxlIENvbHVtbnMgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDb2x1bW5zIDUiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IlRhYmxlIEdyaWQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBHcmlkIDMiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRh YmxlIEdyaWQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49 InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBHcmlkIDYiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCA3Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxl IEdyaWQgOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDEiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0iVGFibGUgTGlzdCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIExp c3QgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iVGFibGUgTGlzdCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIExpc3Qg NiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDciLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iVGFibGUgTGlzdCA4Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2Vt aUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIDNEIGVmZmVj dHMgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSAzRCBlZmZlY3RzIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgM0QgZWZmZWN0cyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IlRhYmxlIENvbnRlbXBvcmFyeSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBFbGVnYW50 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIFByb2Zlc3Npb25hbCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJUYWJsZSBTdWJ0bGUgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBT dWJ0bGUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBXZWIgMSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJUYWJsZSBXZWIgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCYWxsb29uIFRl eHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIE5hbWU9 IlRhYmxlIEdyaWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVu PSJ0cnVlIiBOYW1lPSJQbGFjZWhvbGRlciBUZXh0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjEiIFFGb3JtYXQ9InRydWUiIE5hbWU9Ik5vIFNwYWNpbmciLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIE5hbWU9IkxpZ2h0 IFNoYWRpbmciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEi IE5hbWU9IkxpZ2h0IExpc3QiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjIiIE5hbWU9IkxpZ2h0IEdyaWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjMiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDEiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjQiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIE5hbWU9Ik1l ZGl1bSBMaXN0IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NjYiIE5hbWU9Ik1lZGl1bSBMaXN0IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1bSBHcmlkIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5hbWU9Ik1lZGl1bSBHcmlk IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9 IkRhcmsgTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGluZyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI3MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9u IExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgTmFtZT0iQ29sb3JmdWwgR3JpZCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQgU2hh ZGluZyBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2MSIgTmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgMSIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVtIFNo YWRpbmcgMSBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI2NCIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMiBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2Nl bnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IE5hbWU9IlJldmlzaW9uIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjM0IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJMaXN0IFBhcmFncmFwaCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIyOSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0i UXVvdGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzAiIFFG b3JtYXQ9InRydWUiIE5hbWU9IkludGVuc2UgUXVvdGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIE5hbWU9Ik1lZGl1bSBMaXN0IDIgQWNjZW50IDEiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1 bSBHcmlkIDEgQWNjZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNjZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5hbWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9 IkRhcmsgTGlzdCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI3MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGluZyBBY2NlbnQgMSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCBB Y2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIg TmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQgU2hhZGluZyBBY2NlbnQgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MSIgTmFtZT0iTGlnaHQgTGlz dCBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2 MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMSBBY2NlbnQgMiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NCIgTmFtZT0iTWVkaXVt IFNoYWRpbmcgMiBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIgTmFtZT0iTWVkaXVtIExpc3QgMiBBY2Nl bnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NyIgTmFt ZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI2OCIgTmFtZT0iTWVkaXVtIEdyaWQgMiBBY2NlbnQgMiIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OSIgTmFtZT0iTWVkaXVtIEdyaWQg MyBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MCIgTmFtZT0iRGFyayBMaXN0IEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjcxIiBOYW1lPSJDb2xvcmZ1bCBTaGFkaW5nIEFjY2VudCAyIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcyIiBOYW1lPSJDb2xvcmZ1 bCBMaXN0IEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjczIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYwIiBOYW1lPSJMaWdodCBTaGFkaW5nIEFjY2VudCAz Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYxIiBOYW1lPSJM aWdodCBMaXN0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjYyIiBOYW1lPSJMaWdodCBHcmlkIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAxIEFjY2Vu dCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY0IiBOYW1l PSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjY1IiBOYW1lPSJNZWRpdW0gTGlzdCAxIEFjY2VudCAzIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY2IiBOYW1lPSJNZWRpdW0gTGlz dCAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjY3IiBOYW1lPSJNZWRpdW0gR3JpZCAxIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBOYW1lPSJNZWRpdW0gR3JpZCAyIEFjY2VudCAzIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY5IiBOYW1lPSJNZWRp dW0gR3JpZCAzIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjcwIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzEiIE5hbWU9IkNvbG9yZnVsIFNoYWRpbmcgQWNjZW50 IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzIiIE5hbWU9 IkNvbG9yZnVsIExpc3QgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNzMiIE5hbWU9IkNvbG9yZnVsIEdyaWQgQWNjZW50IDMiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIE5hbWU9IkxpZ2h0IFNoYWRpbmcg QWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEi IE5hbWU9IkxpZ2h0IExpc3QgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjIiIE5hbWU9IkxpZ2h0IEdyaWQgQWNjZW50IDQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjMiIE5hbWU9Ik1lZGl1bSBTaGFkaW5n IDEgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NjQiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIE5hbWU9Ik1lZGl1bSBMaXN0IDEgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIE5hbWU9Ik1l ZGl1bSBMaXN0IDIgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1bSBHcmlkIDEgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNj ZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5h bWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9IkRhcmsgTGlzdCBBY2NlbnQgNCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGlu ZyBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgTmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgNCIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQg U2hhZGluZyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI2MSIgTmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgNSIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVt IFNoYWRpbmcgMSBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2NCIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBB Y2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIg TmFtZT0iTWVkaXVtIExpc3QgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2NyIgTmFtZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgNSIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OCIgTmFtZT0iTWVkaXVtIEdy aWQgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2OSIgTmFtZT0iTWVkaXVtIEdyaWQgMyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MCIgTmFtZT0iRGFyayBMaXN0IEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcxIiBOYW1lPSJDb2xvcmZ1 bCBTaGFkaW5nIEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjcyIiBOYW1lPSJDb2xvcmZ1bCBMaXN0IEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNlcHRp b24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjczIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2Vu dCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYwIiBOYW1l PSJMaWdodCBTaGFkaW5nIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjYxIiBOYW1lPSJMaWdodCBMaXN0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYyIiBOYW1lPSJMaWdodCBHcmlkIEFjY2Vu dCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBOYW1l PSJNZWRpdW0gU2hhZGluZyAxIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjY0IiBOYW1lPSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCA2Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY1IiBOYW1lPSJNZWRpdW0g TGlzdCAxIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjY2IiBOYW1lPSJNZWRpdW0gTGlzdCAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY3IiBOYW1lPSJNZWRpdW0gR3JpZCAxIEFjY2VudCA2 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBOYW1lPSJN ZWRpdW0gR3JpZCAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjY5IiBOYW1lPSJNZWRpdW0gR3JpZCAzIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcwIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50 IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzEiIE5hbWU9 IkNvbG9yZnVsIFNoYWRpbmcgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNzIiIE5hbWU9IkNvbG9yZnVsIExpc3QgQWNjZW50IDYiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzMiIE5hbWU9IkNvbG9yZnVsIEdy aWQgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i MTkiIFFGb3JtYXQ9InRydWUiIE5hbWU9IlN1YnRsZSBFbXBoYXNpcyIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIyMSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iSW50 ZW5zZSBFbXBoYXNpcyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSIzMSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iU3VidGxlIFJlZmVyZW5jZSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzMiIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0i SW50ZW5zZSBSZWZlcmVuY2UiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iMzMiIFFGb3JtYXQ9InRydWUiIE5hbWU9IkJvb2sgVGl0bGUiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzciIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCaWJsaW9ncmFwaHkiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJUT0MgSGVhZGluZyIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MSIgTmFtZT0iUGxhaW4gVGFibGUgMSIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MiIgTmFtZT0iUGxh aW4gVGFibGUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0 MyIgTmFtZT0iUGxhaW4gVGFibGUgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0NCIgTmFtZT0iUGxhaW4gVGFibGUgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NSIgTmFtZT0iUGxhaW4gVGFibGUgNSIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MCIgTmFtZT0iR3JpZCBUYWJsZSBM aWdodCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFt ZT0iR3JpZCBUYWJsZSAxIExpZ2h0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iR3JpZCBUYWJsZSA0Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1lPSJHcmlk IFRhYmxlIDUgRGFyayIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2IENvbG9yZnVsIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9IkdyaWQg VGFibGUgMSBMaWdodCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0NyIgTmFtZT0iR3JpZCBUYWJsZSAyIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ4IiBOYW1lPSJHcmlkIFRhYmxlIDMgQWNj ZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5h bWU9IkdyaWQgVGFibGUgNCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iR3JpZCBUYWJsZSA1IERhcmsgQWNjZW50IDEiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9IkdyaWQgVGFi bGUgNiBDb2xvcmZ1bCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI1MiIgTmFtZT0iR3JpZCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCAxIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJHcmlkIFRh YmxlIDEgTGlnaHQgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNDciIE5hbWU9IkdyaWQgVGFibGUgMiBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OCIgTmFtZT0iR3JpZCBUYWJsZSAzIEFjY2Vu dCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1l PSJHcmlkIFRhYmxlIDQgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNTAiIE5hbWU9IkdyaWQgVGFibGUgNSBEYXJrIEFjY2VudCAyIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJHcmlkIFRhYmxl IDYgQ29sb3JmdWwgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNTIiIE5hbWU9IkdyaWQgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iR3JpZCBUYWJs ZSAxIExpZ2h0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyBBY2NlbnQg MyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0i R3JpZCBUYWJsZSA0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjUwIiBOYW1lPSJHcmlkIFRhYmxlIDUgRGFyayBBY2NlbnQgMyIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2 IENvbG9yZnVsIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDMiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9IkdyaWQgVGFibGUg MSBMaWdodCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI0NyIgTmFtZT0iR3JpZCBUYWJsZSAyIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ4IiBOYW1lPSJHcmlkIFRhYmxlIDMgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikdy aWQgVGFibGUgNCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI1MCIgTmFtZT0iR3JpZCBUYWJsZSA1IERhcmsgQWNjZW50IDQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9IkdyaWQgVGFibGUgNiBD b2xvcmZ1bCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI1MiIgTmFtZT0iR3JpZCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCA0Ii8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJHcmlkIFRhYmxlIDEg TGlnaHQgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNDciIE5hbWU9IkdyaWQgVGFibGUgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OCIgTmFtZT0iR3JpZCBUYWJsZSAzIEFjY2VudCA1Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJHcmlk IFRhYmxlIDQgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNTAiIE5hbWU9IkdyaWQgVGFibGUgNSBEYXJrIEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJHcmlkIFRhYmxlIDYgQ29s b3JmdWwgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNTIiIE5hbWU9IkdyaWQgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgNSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iR3JpZCBUYWJsZSAxIExp Z2h0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyBBY2NlbnQgNiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iR3JpZCBU YWJsZSA0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjUwIiBOYW1lPSJHcmlkIFRhYmxlIDUgRGFyayBBY2NlbnQgNiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2IENvbG9y ZnVsIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdo dCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0i TGlzdCBUYWJsZSAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iTGlzdCBUYWJsZSA1IERhcmsiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFi bGUgNiBDb2xvcmZ1bCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI1MiIgTmFtZT0iTGlzdCBUYWJsZSA3IENvbG9yZnVsIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJMaXN0IFRhYmxlIDEgTGlnaHQgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDciIE5hbWU9 Ikxpc3QgVGFibGUgMiBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0OCIgTmFtZT0iTGlzdCBUYWJsZSAzIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJMaXN0IFRhYmxlIDQgQWNj ZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTAiIE5h bWU9Ikxpc3QgVGFibGUgNSBEYXJrIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJMaXN0IFRhYmxlIDYgQ29sb3JmdWwgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTIiIE5hbWU9 Ikxpc3QgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iTGlzdCBUYWJsZSAxIExpZ2h0IEFjY2VudCAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ3IiBOYW1lPSJM aXN0IFRhYmxlIDIgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNDgiIE5hbWU9Ikxpc3QgVGFibGUgMyBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iTGlzdCBUYWJsZSA0IEFjY2Vu dCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1l PSJMaXN0IFRhYmxlIDUgRGFyayBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iTGlzdCBUYWJsZSA2IENvbG9yZnVsIEFjY2VudCAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJM aXN0IFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdodCBBY2NlbnQgMyIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0iTGlz dCBUYWJsZSAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCBBY2NlbnQg MyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0i TGlzdCBUYWJsZSA1IERhcmsgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFibGUgNiBDb2xvcmZ1bCBBY2NlbnQgMyIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MiIgTmFtZT0iTGlz dCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJMaXN0IFRhYmxlIDEgTGlnaHQgQWNjZW50IDQiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDciIE5hbWU9Ikxpc3Qg VGFibGUgMiBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI0OCIgTmFtZT0iTGlzdCBUYWJsZSAzIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJMaXN0IFRhYmxlIDQgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTAiIE5hbWU9Ikxp c3QgVGFibGUgNSBEYXJrIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJMaXN0IFRhYmxlIDYgQ29sb3JmdWwgQWNjZW50IDQiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTIiIE5hbWU9Ikxpc3Qg VGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iTGlzdCBUYWJsZSAxIExpZ2h0IEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ3IiBOYW1lPSJMaXN0IFRh YmxlIDIgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNDgiIE5hbWU9Ikxpc3QgVGFibGUgMyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iTGlzdCBUYWJsZSA0IEFjY2VudCA1Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1lPSJMaXN0 IFRhYmxlIDUgRGFyayBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI1MSIgTmFtZT0iTGlzdCBUYWJsZSA2IENvbG9yZnVsIEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJMaXN0IFRh YmxlIDcgQ29sb3JmdWwgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdodCBBY2NlbnQgNiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0iTGlzdCBUYWJs ZSAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCBBY2NlbnQgNiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iTGlzdCBU YWJsZSA1IERhcmsgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFibGUgNiBDb2xvcmZ1bCBBY2NlbnQgNiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MiIgTmFtZT0iTGlzdCBUYWJs ZSA3IENvbG9yZnVsIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ik1lbnRpb24iLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iU21hcnQgSHlwZXJsaW5rIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9Ikhhc2h0YWciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVW5yZXNvbHZlZCBNZW50aW9uIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRl V2hlblVzZWQ9InRydWUiIE5hbWU9IlNtYXJ0IExpbmsiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i U21hcnQgTGluayBFcnJvciIvPg0KPC93OkxhdGVudFN0eWxlcz4NCjwveG1sPjwhW2VuZGlmXS0t PjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYgMyAyIDQ7DQoJ bXNvLWZvbnQtY2hhcnNldDowOw0KCW1zby1nZW5lcmljLWZvbnQtZmFtaWx5OnJvbWFuOw0KCW1z by1mb250LXBpdGNoOnZhcmlhYmxlOw0KCW1zby1mb250LXNpZ25hdHVyZTotNTM2ODY5MTIxIDEx MDczMDU3MjcgMzM1NTQ0MzIgMCA0MTUgMDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNh bGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7DQoJbXNvLWZvbnQtY2hhcnNl dDowOw0KCW1zby1nZW5lcmljLWZvbnQtZmFtaWx5OnN3aXNzOw0KCW1zby1mb250LXBpdGNoOnZh cmlhYmxlOw0KCW1zby1mb250LXNpZ25hdHVyZTotNTM2ODU4ODgxIC0xMDczNzMyNDg1IDkgMCA1 MTEgMDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1h bCwgZGl2Lk1zb05vcm1hbA0KCXttc28tc3R5bGUtdW5oaWRlOm5vOw0KCW1zby1zdHlsZS1xZm9y bWF0OnllczsNCgltc28tc3R5bGUtcGFyZW50OiIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJv dHRvbTouMDAwMXB0Ow0KCW1zby1wYWdpbmF0aW9uOndpZG93LW9ycGhhbjsNCglmb250LXNpemU6 MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0 LWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28t c3R5bGUtbm9zaG93OnllczsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsN Cgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lOw0KCXRleHQtdW5kZXJsaW5lOnNpbmdsZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLW5vc2hvdzp5 ZXM7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29y YXRpb246dW5kZXJsaW5lOw0KCXRleHQtdW5kZXJsaW5lOnNpbmdsZTt9DQpwLm1zb25vcm1hbDAs IGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1h bDsNCgltc28tc3R5bGUtdW5oaWRlOm5vOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1h cmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxl ZnQ6MGluOw0KCW1zby1wYWdpbmF0aW9uOndpZG93LW9ycGhhbjsNCglmb250LXNpemU6MTEuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0LWZvbnQt ZmFtaWx5OkNhbGlicmk7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVy c29uYWwtcmVwbHk7DQoJbXNvLXN0eWxlLW5vc2hvdzp5ZXM7DQoJbXNvLXN0eWxlLXVuaGlkZTpu bzsNCgltc28tYW5zaS1mb250LXNpemU6MTEuMHB0Ow0KCW1zby1iaWRpLWZvbnQtc2l6ZToxMS4w cHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWFzY2lpLWZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28t aGFuc2ktZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uU3BlbGxFDQoJe21zby1zdHls ZS1uYW1lOiIiOw0KCW1zby1zcGwtZTp5ZXM7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxl LXR5cGU6ZXhwb3J0LW9ubHk7DQoJbXNvLWRlZmF1bHQtcHJvcHM6eWVzOw0KCWZvbnQtZmFtaWx5 OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1hc2NpaS1mb250LWZhbWlseTpDYWxpYnJpOw0K CW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJbXNvLWhhbnNpLWZvbnQtZmFtaWx5 OkNhbGlicmk7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQHBh Z2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBp biAxLjBpbiAxLjBpbjsNCgltc28taGVhZGVyLW1hcmdpbjouNWluOw0KCW1zby1mb290ZXItbWFy Z2luOi41aW47DQoJbXNvLXBhcGVyLXNvdXJjZTowO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFn ZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gMTBdPjxzdHlsZT4v KiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KdGFibGUuTXNvTm9ybWFsVGFibGUNCgl7bXNvLXN0eWxl LW5hbWU6IlRhYmxlIE5vcm1hbCI7DQoJbXNvLXRzdHlsZS1yb3diYW5kLXNpemU6MDsNCgltc28t dHN0eWxlLWNvbGJhbmQtc2l6ZTowOw0KCW1zby1zdHlsZS1ub3Nob3c6eWVzOw0KCW1zby1zdHls ZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtcGFyZW50OiIiOw0KCW1zby1wYWRkaW5nLWFsdDow aW4gNS40cHQgMGluIDUuNHB0Ow0KCW1zby1wYXJhLW1hcmdpbjowaW47DQoJbXNvLXBhcmEtbWFy Z2luLWJvdHRvbTouMDAwMXB0Ow0KCW1zby1wYWdpbmF0aW9uOndpZG93LW9ycGhhbjsNCglmb250 LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1h c2NpaS1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1oYW5zaS1mb250LWZhbWlseTpDYWxpYnJp Ow0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCjwvc3R5bGU+PCFb ZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0 PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUg bXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4 dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4N CjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIiBz dHlsZT0idGFiLWludGVydmFsOi41aW4iPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxk aXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGlu ZzowaW4gMGluIDBpbiA0LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PGZv bnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 bXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7O2ZvbnQt d2VpZ2h0OmJvbGQiPkZyb206PC9zcGFuPjwvZm9udD48L2I+PHNwYW4gc3R5bGU9Im1zby1mYXJl YXN0LWZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+IEVyaWMgT3J0aDxi ciBzdHlsZT0ibXNvLXNwZWNpYWwtY2hhcmFjdGVyOmxpbmUtYnJlYWsiPg0KPCFbaWYgIXN1cHBv cnRMaW5lQnJlYWtOZXdMaW5lXT48YnIgc3R5bGU9Im1zby1zcGVjaWFsLWNoYXJhY3RlcjpsaW5l LWJyZWFrIj4NCjwhW2VuZGlmXT48L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5PbiBXZWQsIEp1bCAyMiwgMjAyMCBhdCAxOjMwIFBN IENocmlzIEJveCAoQlQpICZsdDs8YSBocmVmPSJtYWlsdG86Y2hyaXMuYm94LmlldGZAZ21haWwu Y29tIj5jaHJpcy5ib3guaWV0ZkBnbWFpbC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwv c3Bhbj48L2ZvbnQ+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDttc28tYm9yZGVyLWxlZnQtYWx0OnNvbGlk ICNDQ0NDQ0MgLjc1cHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0Ljhw dDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdCI+RXJpYyw8bzpwPjwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFj ZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvZm9udD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUg c3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7bXNvLWJv cmRlci1sZWZ0LWFsdDpzb2xpZCAjQ0NDQ0NDIC43NXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4w cHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij5BbmQgSSdtIGN1cmlvdXMgYWJvdXQgdGhlIGludGVudCBm b3IgaG93IHRoaXMgd2lsbCBiZSB1c2VkLiZuYnNwOyBIb3cgaXMgdGhpcyBleHBlY3RlZCB0byBi ZSBoZWxwZnVsIGluIGRpc2N1c3Npb25zIG9yIGRyYWZ0cz8gU2VlbXMgd2UgbG9zZSBhIGxvdCBv ZiB0aGUgcG90ZW50aWFsIGZvciBkaXNjdXNzaW9uIGhlbHBmdWxuZXNzDQogaWYgd2UgZG9uJ3Qg aGF2ZSBhIGNvbW1vbiB1bmRlcnN0YW5kaW5nIG9mIGNsYXNzaWZpY2F0aW9ucyBvciBpbXBsaWNh dGlvbnMgKHdoaWNoIHdlIHNob3VsZG4ndCBoYXZlIGJlY2F1c2UgdGhhdCdzIHBvbGljeSkuJm5i c3A7IEFuZCBJIHdvdWxkIGJlIGVzcGVjaWFsbHkgY29uY2VybmVkIGlmIGRyYWZ0IFNlY3VyaXR5 IENvbnNpZGVyYXRpb25zIHNlY3Rpb25zIHN0YXJ0ZWQgbWFraW5nIHN0YXRlbWVudHMgbGlrZSAm cXVvdDt0aGlzIGF0dGFjayBvbmx5IGFmZmVjdHMNCiBob21lIG5ldHdvcmtzLCB3aGljaCBhcmUg YSBHcmVlbiBuZXR3b3JrIGFuZCB0aGVyZWZvcmUgbm90IGEgY29uY2VybiZxdW90Oy48bzpwPjwv bzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPC9ibG9ja3F1b3Rl Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGli cmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L2ZvbnQ+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQg c2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlRo aW5raW5nIGFsb3VkLCB3b3VsZCBpdCBiZSB1c2VmdWwgZm9yIGEgZHJhZnQgdG8gc2F5ICZxdW90 O3RoaXMgYXV0b21hdGljIG1lY2hhbmlzbSBTSE9VTEQgTk9UIGJlIHVzZWQgaW4gYSBuZXR3b3Jr IHRoZSB1c2VyIGhhcyBjbGFzc2lmaWVkIGFzIFJlZCZxdW90Oz88bzpwPjwvbzpwPjwvc3Bhbj48 L2ZvbnQ+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJy aSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvZm9udD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBz aXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+SSB0 aGluayB0aGF0IHdvdWxkIGJlIGEgcHJvYmxlbWF0aWMgc3RhdGVtZW50IGJlY2F1c2UsIGZvciBt YW55IG1lY2hhbmlzbXMgd2hlcmUgYSBkcmFmdCBtaWdodCBjb25zaWRlciBtYWtpbmcgc3VjaCBh IHN0YXRlbWVudCwgdGhlIHNvZnR3YXJlIGNob29zaW5nIHRvIHVzZSBzdWNoIGEgbWVjaGFuaXNt Jm5ic3A7bWF5DQogbm90IGhhdmUgYW55IHJlYXNvbmFibGUgc2lnbmFsIG9mIHdoZXRoZXIgb3Ig bm90IHRoZSB1c2VyIHdvdWxkIGNsYXNzaWZ5IHRoZSBuZXR3b3JrIGFzIHN1Y2guJm5ic3A7IE1h eWJlIHN0YXRlbWVudHMgYXJvdW5kICZxdW90O3doZW4gdGhlIGltcGxlbWVudGF0aW9uIGV4cGVj dHMgaXRzIHVzZXJzIHdvdWxkIGNsYXNzaWZ5IHRoZSBuZXR3b3JrIGFzIFJlZCZxdW90OywgYnV0 IHRoYXQgbWlnaHQgYmUgdG9vIGxvb3NlIHRvIGJlIGhlbHBmdWwgaW4gc3VjaCBzZWN1cml0eQ0K IGRpc2N1c3Npb25zLiBNYXliZSBjb3VsZCBiZSBoZWxwZnVsIGZvciBtb3JlIHJlZmluZWQgc3Rh dGVtZW50cyBsaWtlICZxdW90O3RoaXMgbWVjaGFuaXNtIGNvdWxkIGJlIHBhcnRpY3VsYXJseSB2 dWxuZXJhYmxlIHRvIGF0dGFja3Mgb24gbmV0d29ya3MgdGhlIHVzZXIgaGFzIGNsYXNzaWZpZWQg YXMgUmVkLCBzbyBpbXBsZW1lbnRhdGlvbnMgU0hPVUxEIG1ha2UgYXBwcm9wcmlhdGUgbWl0aWdh dGlvbnMgdW5sZXNzIHRoZSB1c2VyIGhhcyBzaWduYWxlZA0KIGEgaGlnaGVyIGxldmVsIG9mIHRy dXN0JnF1b3Q7LCBidXQgd2hlbiBnb2luZyBpbnRvIHRoYXQgbXVjaCBkZXRhaWwsIGlzIHRoZSBz aW1wbGlmaWNhdGlvbiBvZiBzYXlpbmcgJnF1b3Q7UmVkJnF1b3Q7IHJlYWxseSBoZWxwZnVsIG9y IGlzIHRoZSBkcmFmdCBnb2luZyB0byBuZWVkIHRvIGNsZWFybHkgZGVmaW5lIHRoZSBzaXR1YXRp b25hbCBkYW5nZXJzIGFueXdheT88bzpwPjwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWFzY2lpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWhhbnNp LWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWJpZGktZm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3 IFJvbWFuJnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWFzY2lpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWhhbnNp LWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWJpZGktZm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3 IFJvbWFuJnF1b3Q7Ij4mbHQ7PHNwYW4gY2xhc3M9IlNwZWxsRSI+YmhzPC9zcGFuPiZndDs8bzpw PjwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6 ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWFz Y2lpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNv LWJpZGktZm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij5JIHRoaW5rIHRo ZXNlIGNsYXNzaWZpY2F0aW9ucyBhcmUgdG9vIGNvbXBsZXggYW5kIGFkZCBhbiB1bm5lY2Vzc2Fy eSBsZXZlbCBvZg0KIGFic3RyYWN0aW9uIHRoYXQgd2lsbCBjYXVzZSB1c2VycyB0byBkcmF3IGZh bHNlIGNvbmNsdXNpb25zLjxvOnA+PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDttc28tYXNjaWktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28taGFuc2ktZm9u dC1mYW1pbHk6Q2FsaWJyaTttc28tYmlkaS1mb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9t YW4mcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDttc28tYXNjaWktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28taGFuc2ktZm9u dC1mYW1pbHk6Q2FsaWJyaTttc28tYmlkaS1mb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9t YW4mcXVvdDsiPkl04oCZcyBhIGJpdCBmdXp6eSBhcyB0byB3aGF0IGl0IG1lYW5zIGZvciBhIHVz ZXIgdG8gdHJ1c3QgYSBuZXR3b3JrLCBpbiB0aGUgY29udGV4dA0KIG9mIGRpc2NvdmVyaW5nIDxz cGFuIGNsYXNzPSJTcGVsbEUiPkRvSDwvc3Bhbj4gc2VydmVycy4gVGhlIGRyYWZ0IG1lbnRpb25z IHNvbWUgYXNwZWN0cywgYnV0IHRob3NlIGFzcGVjdHMgYXJlIGFsbCBvdmVyIHRoZSBwbGFjZSwg YW5kIEnigJltIG5vdCBzdXJlIHRoZXnigJlyZSB0aGUgcmlnaHQgc2V0LjxvOnA+PC9vOnA+PC9z cGFuPjwvZm9udD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNl PSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYXNjaWktZm9udC1m YW1pbHk6Q2FsaWJyaTttc28taGFuc2ktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28tYmlkaS1mb250 LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPkZvciBleGFtcGxlIHRoZSBkcmFm dCBtZW50aW9ucyB3aGV0aGVyIHRoZSB1c2VyIHRydXN0cyB0aGF0IHRoZSBuZXR3b3JrIGlzICgx KQ0KIG9wZXJhdGVkIHdpdGggc2VjdXJpdHksICgyKSBvcGVyYXRlZCB3aXRoIG9wZXJhdGlvbmFs IGludGVncml0eSAoSeKAmW0gbm90IHN1cmUgd2hhdCB0aGlzIG1lYW5zKSwgb3IgKDMpIG5vdCBj b21wcm9taXNlZCBieSBhdHRhY2tlcnMgb3IgbWFsd2FyZS48bzpwPjwvbzpwPjwvc3Bhbj48L2Zv bnQ+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJy aSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWFzY2lpLWZvbnQtZmFtaWx5OkNh bGlicmk7bXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWJpZGktZm9udC1mYW1pbHk6 JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij5UaGUgV2luZG93cyBtb2RlbCB3YXMgbWVudGlv bmVkIGluIHRoaXMgdGhyZWFkIOKAkyBidXQgV2luZG93cyBkb2VzbuKAmXQgYXNrIHVzZXJzDQog d2hldGhlciBvciBub3QgdGhleSB0cnVzdCB0aGUgbmV0d29yazsgV2luZG93cyBhc2tzIHdoZXRo ZXIgdGhlIG5ldHdvcmsgaXMgcHVibGljIChjYW4gYW55b25lIGpvaW4gPSBhcmUgYWxsIHRoZSBk ZXZpY2VzIGF0dGFjaGVkIHRvIHRoZSBuZXR3b3JrIGtub3duIHRvIHRoZSB1c2VyIGFuZCBub3Qg c3VzcGVjdGVkIG9mIGJlaW5nIG1hbGlnbmFudCkgb3IgcHJpdmF0ZS4gV2hldGhlciBvciBub3Qg eW91IHRydXN0IHRoZSBvdGhlciBkZXZpY2VzDQogb24gdGhlIG5ldHdvcmsgaXMgZGlmZmVyZW50 IGZyb20gdHJ1c3Rpbmcgd2hldGhlciB0aGUgbmV0d29yayBpcyBvcGVyYXRlZCB3aXRoIHNlY3Vy aXR5LCBpbnRlZ3JpdHksIG9yIGhhcyBiZWVuIGNvbXByb21pc2VkLjxvOnA+PC9vOnA+PC9zcGFu PjwvZm9udD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJD YWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYXNjaWktZm9udC1mYW1p bHk6Q2FsaWJyaTttc28taGFuc2ktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28tYmlkaS1mb250LWZh bWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvZm9udD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJD YWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYXNjaWktZm9udC1mYW1p bHk6Q2FsaWJyaTttc28taGFuc2ktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28tYmlkaS1mb250LWZh bWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPkJhc2VkIG9uIHRoZSBkaXNjdXNzaW9u IEnigJl2ZSBzZWVuLCBpdCBzZWVtcyBsaWtlIHdoYXQgd2Ugd2FudCB0byBrbm93IGlzIHdoZXRo ZXINCiB0aGUgdXNlciB3YW50cyB0byB1c2UgRE5TLzxzcGFuIGNsYXNzPSJTcGVsbEUiPkRvSDwv c3Bhbj4gc2VydmVycyBhZHZlcnRpc2VkIGJ5IHRoZSBsb2NhbCBuZXR3b3JrLCBvciBub3QuIEFu ZCB0aGVyZSBtYXkgYmUgc29tZSBuZXR3b3JrcyAobmV0d29yayBhZG1pbnMpIHRoYXQgd291bGQg d2FudCB0byBzYXkg4oCcSWYgeW91IGRvbuKAmXQgdXNlIG15IEROUy88c3BhbiBjbGFzcz0iU3Bl bGxFIj5Eb0g8L3NwYW4+IHNlcnZlcnMsIHRoZW4gSeKAmW0gZ29pbmcNCiB0byB0cmVhdCB5b3Ug bGlrZSBtYWx3YXJlIGFuZCBkbyBldmVyeXRoaW5nIGluIG15IHBvd2VyIHRvIHByZXZlbnQgeW91 IGZyb20gdXNpbmcgbXkgbmV0d29yay7igJ0gRm9yIGV4YW1wbGUsIGEgcGFyZW50IG1pZ2h0IHdh bnQgdG8gaGF2ZSB0aGlzIHNvcnQgb2Ygc2V0dGluZyBmb3IgdGhlaXIgaG9tZSBuZXR3b3JrLiBB bmQgYSBjb3Jwb3JhdGUgbmV0d29yayB3b3VsZCB3YW50IHRoaXMuIElmIGEgY29mZmVlIHNob3Ag c2F5cyB0aGlzLCB0aGUgdXNlcg0KIGNhbiBkZWNpZGUgd2hldGhlciBvciBub3QgdG8gdXNlIHRo ZSBuZXR3b3JrLiBJIG1lYW4sIHRoZSBuZXR3b3JrIGJlbG9uZ3MgdG8gdGhlIGNvZmZlZSBzaG9w IGFuZCBub3QgdGhlIHVzZXIsIHNvIHRoZSBjb2ZmZWUgc2hvcCBzaG91bGQgaGF2ZSB0aGUgcmln aHQgdG8gZGljdGF0ZSB1c2FnZSBwb2xpY3kuIFVzZXJzIGFyZSBjb21wbGV0ZWx5IGZyZWUgbm90 IHRvIHVzZSB0aGUgY29mZmVlIHNob3AgbmV0d29yayBpZiB0aGV5IGRvbuKAmXQgbGlrZQ0KIHRo ZSBzaG9w4oCZcyBuZXR3b3JrIHBvbGljaWVzLjxvOnA+PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYXNjaWktZm9udC1mYW1pbHk6Q2FsaWJyaTtt c28taGFuc2ktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28tYmlkaS1mb250LWZhbWlseTomcXVvdDtU aW1lcyBOZXcgUm9tYW4mcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYXNjaWktZm9udC1mYW1pbHk6Q2FsaWJyaTtt c28taGFuc2ktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28tYmlkaS1mb250LWZhbWlseTomcXVvdDtU aW1lcyBOZXcgUm9tYW4mcXVvdDsiPkEgY2xhc3NpZmljYXRpb24gZm9yIHdhciB6b25lcyBhbmQg aG9zdGlsZSByZWdpbWVzIGFuZA0KPHNwYW4gY2xhc3M9IlNwZWxsRSI+YmxhY2toYXQ8L3NwYW4+ IG5ldHdvcmtzIHN0cmlrZXMgbWUgYXMgYml6YXJyZS48bzpwPjwvbzpwPjwvc3Bhbj48L2ZvbnQ+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWFzY2lpLWZvbnQtZmFtaWx5OkNhbGli cmk7bXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWJpZGktZm9udC1mYW1pbHk6JnF1 b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2ZvbnQ+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWFzY2lpLWZvbnQtZmFtaWx5OkNhbGli cmk7bXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWJpZGktZm9udC1mYW1pbHk6JnF1 b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij5UTDtEUjogSSB0aGluayB0aGUgbmV0d29yayBuZWVk cyB0byBiZSBhYmxlIHRvIGluZGljYXRlIHdoZXRoZXIgbmV0d29yayBwb2xpY3kNCiBhbGxvd3Mg dXNlIG9mIEROUy88c3BhbiBjbGFzcz0iU3BlbGxFIj5Eb0g8L3NwYW4+IHNlcnZlcnMgb3RoZXIg dGhhbiB0aG9zZSBpdCBhZHZlcnRpc2VzLCBhbmQgdXNlcnMgKHdobyBoYXZlIGJlZW4gaW5mb3Jt ZWQgb2YgdGhlIG5ldHdvcmsgcG9saWN5KSBjYW4gZGVjaWRlIHdoZXRoZXIgb3Igbm90IHRoZXkg d2FudCB0byB1c2UgdGhlIGxvY2FsbHkgYWR2ZXJ0aXNlZA0KPHNwYW4gY2xhc3M9IlNwZWxsRSI+ RG9IPC9zcGFuPiBzZXJ2ZXJzIChpLmUuLCB0aGVyZSBhcmUganVzdCAyIHR5cGVzIG9mIG5ldHdv cmtzIOKAkyAoMSkgdXNlIGFkdmVydGlzZWQgRE5TLzxzcGFuIGNsYXNzPSJTcGVsbEUiPkRvSDwv c3Bhbj4gYW5kICgyKSBkb27igJl0IHVzZSBhZHZlcnRpc2VkIEROUy88c3BhbiBjbGFzcz0iU3Bl bGxFIj5Eb0g8L3NwYW4+KS4gV2hhdCB0aGUgbmV0d29yayBkb2VzIHRvIGRldGVjdCBhbmQgaGFu ZGxlIHZpb2xhdGlvbnMNCiBvZiBpdHMgcG9saWN5IGlzIG91dCBvZiBzY29wZS4gVGhlIG5ldHdv cmsganVzdCBuZWVkcyB0byBiZSBhYmxlIHRvIGV4cHJlc3MgaXRzIHBvbGljeS4gRGVwZW5kaW5n IG9uIHRoZSBkZXZpY2UvYXBwbGljYXRpb24sIHRoZSB1c2VyIG1heSBiZSBhYmxlIHRvIGdvIGFn YWluc3QgdGhlIG5ldHdvcmsgcG9saWN5LCBidXQgdGhleSBkbyBzbyBrbm93aW5nbHkuIE9UT0gs IHNvbWUgZGV2aWNlcy9hcHBsaWNhdGlvbnMgKGUuZy4sIGVudGVycHJpc2UtbWFuYWdlZA0KIGRl dmljZXMsIHBhcmVudGFsbHktY29udHJvbGxlZCBkZXZpY2VzKSBtYXkgbm90IGFsbG93IHVzZXJz IHRvIGdvIGFnYWluc3QgdGhlIG5ldHdvcmsgcG9saWN5LiBUaGUgc3lzdGVtIGNvdWxkIGV2ZW4g YmUgZGVmYXVsdGVkIG5vdCB0byB1c2UgbG9jYWxseSBhZHZlcnRpc2VkIEROUyBvbiBuZXcvdW5r bm93biBuZXR3b3JrcyB1bmxlc3MgdGhhdCB2aW9sYXRlcyBleHByZXNzZWQgbmV0d29yayBwb2xp Y3kgKGluIHdoaWNoIGNhc2UgdGhlIHVzZXINCiBpcyBpbmZvcm1lZCBhbmQgYXNrZWQgaWYgdGhl eSB3YW50IHRvIHVzZSBsb2NhbGx5IGFkdmVydGlzZWQgcGVyIHBvbGljeSkuPHNwYW4gc3R5bGU9 Im1zby1zcGFjZXJ1bjp5ZXMiPiZuYnNwOw0KPC9zcGFuPi0gQmFyYmFyYTxvOnA+PC9vOnA+PC9z cGFuPjwvZm9udD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNl PSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYXNjaWktZm9udC1m YW1pbHk6Q2FsaWJyaTttc28taGFuc2ktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28tYmlkaS1mb250 LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZsdDsvPHNwYW4gY2xhc3M9IlNw ZWxsRSI+YmhzPC9zcGFuPiZndDs8bzpwPjwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_2afd9527aab8477ea19217eec2f49e44attcom_-- From nobody Wed Jul 22 13:34:58 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C095D3A0959 for ; Wed, 22 Jul 2020 13:34:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oB4Wfr-zpmfe for ; Wed, 22 Jul 2020 13:34:55 -0700 (PDT) Received: from mail-wm1-x333.google.com (mail-wm1-x333.google.com [IPv6:2a00:1450:4864:20::333]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0802E3A0958 for ; Wed, 22 Jul 2020 13:34:54 -0700 (PDT) Received: by mail-wm1-x333.google.com with SMTP id o2so3225085wmh.2 for ; Wed, 22 Jul 2020 13:34:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ymIuVDPmsKD2hSZZtvnQ1Qvd5Rbe+ZC4LthqvbszrqE=; b=CHAstOrmcMqWLcCdKJPPoWbmCxjSHX8QrY37zzTK29G29i4I3BYDFSHlXPwy4g4olr seX/Qz0LgC0ZhPQmtXxEXo9RLINxnfbEvwp7MZGnd7rAM+/hlNJaBuvGhP8o2eh0I12b 54p8Fh1Fxu6jKOis3BH+xv82P1UfFX2hr/bALgvJHGLefLhrUyVZx9Wyndi8UzU1d/TL ek2E8Z49cCgno7KBFhcHGia/w4NfzCe77Ws0CItyvnmPUOK6UXuL7RuskPBifIIHNbz+ jrAXoRjv28+dhorZwbo6KlVtF93w4khWrmKx6muET90FYaN955IA0YE+2kf+BC8AMUHd tVBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ymIuVDPmsKD2hSZZtvnQ1Qvd5Rbe+ZC4LthqvbszrqE=; b=WjQ4caxwjJUt1YTUkv1vyheoBCzuF20awoYDsUlNHVPUGuU9ZH3AV62FeeSasnO5/I h1WYBMM0DthCJ7QiEKB6xOT9yOlwVfVyfFZSn4uIL6cGJHTldpEK/tbXGRFND8f7+gfb vh8XS7EjRUzHjiMUw+Kp5LNT1bMvYoO6q71xRZjhvR+Ahj/2L8H7FhAcdcXNbUKzyuEE 34DtCioosI6KxXQ43+b/pTgGImUwralAXiMvVTHOxp9Uk1uHvzm/4E5wQlKMx6YpNkqY 3EEJwr4+x1F0J5V3lRUgy9839yrIyVFJyBeFfbxMk+nOSburOiNk95D0EY+MYaxb/8cJ 4jug== X-Gm-Message-State: AOAM533oof5GiiutMd3s0ig9Jv/XLhhGR77kh7vth3KhTkxCq1pyYj/k g7MuYFtpWqJyMrY+xAPrLv4dzD8NBytknJAZNokgXQ== X-Google-Smtp-Source: ABdhPJwgfx/1U1kwZw+jjhCEFkzdbXVI0LZlcCEudFULnIDWM3Ghw3/W4JsiZAmma1HH+A2mw+YxYjycXVZKpHBnsCw= X-Received: by 2002:a1c:bc8a:: with SMTP id m132mr1121900wmf.1.1595450093119; Wed, 22 Jul 2020 13:34:53 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> In-Reply-To: <20200720152739.GA17509@nic.fr> From: Ben Schwartz Date: Wed, 22 Jul 2020 16:34:41 -0400 Message-ID: To: Stephane Bortzmeyer Cc: Tommy Pauly , ADD Mailing list , David Schinazi Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000001560a805ab0dac01" Archived-At: Subject: Re: [Add] Fwd: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 20:34:57 -0000 --0000000000001560a805ab0dac01 Content-Type: multipart/alternative; boundary="0000000000000f1dd105ab0dac77" --0000000000000f1dd105ab0dac77 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I had some more time to read this and try to understand it. Some more questions: Why is DNSSEC needed for use of =E2=80=9Cdohuri=E2=80=9D in SVCB/HTTPS? An= attacker who can inject this record can also inject false AAAA records for any names of interest, allowing them to proxy and observe all the user=E2=80=99s traffic= (and disable ECH). I can believe there's a relevant attack, but it would help to have an explanation for it. PvD: The use of "https://example.com/.well-known/pvd" makes sense to me, but the use of =E2=80=9Chttps://doh.example.net/.well-known/pvd/dns-query" = seems very odd. Instead, could you do a GET for the DoH URI template with no =E2=80=9Cdns=E2=80=9D parameter, setting the Accept header to =E2=80=9Cappl= ication/pvd+json=E2=80=9D? That would avoid the need for coupling across distant paths, and avoid .well-known=E2=80=99s implication that these are logically properties of th= e entire origin. I'm having trouble understanding which of these mechanisms applies to a whole subdomain tree, and which apply only to the named domain. (And even more trouble understanding why, or why not.) This draft's PvD mechanism (+PUSH) also seems to overlap considerably with draft-schinazi-httpbis-doh-preference-hints, which proposes a "DoH-Preference" response header. I think we should probably avoid standardizing both. The comparison is interesting: I=E2=80=99m not sure Pv= D is really the right semantic for this use case, but I do like that it=E2=80=99= s explicitly scoped to the domain. A response header is syntactically scoped to a single response, although HTTP headers have been used to convey a variety of domain-wide information. One key difference might be how these approaches interact with caching reverse proxies. With a (naive) caching reverse proxy in the middle, I=E2= =80=99m not sure how HTTP/2 PUSH would work. The DoH-Preference header would work, but it would have to be attached to every response, which seems inefficient= . On Mon, Jul 20, 2020 at 11:28 AM Stephane Bortzmeyer wrote: > On Mon, Jul 13, 2020 at 02:13:06PM -0700, > Tommy Pauly wrote > a message of 221 lines which said: > > > We=E2=80=99ve published a revision of draft-pauly-add-resolver-discover= y. This > revision incorporates various pieces of feedback we=E2=80=99ve received. > Specifically, the changes include: > > I'm a bit surprised by the use of PvD which, I thought, were meant for > local configuration, not for remote domains but why not. > > > Note that clients MUST NOT accept designations for effective top- > > level domains (eTLDs), such as ".com". > > I think I understand why, but it creates a problem for .corp (also > called .brand) TLD. I don't see why the Example Corporation could not > designate a resolver for their ".corp" TLD .example. (A full solution > of this problem would probably require to resurrect the Dbound working > group.) > > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000000f1dd105ab0dac77 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I had some more time to read this and try to understa= nd it.=C2=A0 Some more questions:

Why is DNSSEC needed = for use of =E2=80=9Cdohuri=E2=80=9D in SVCB/HTTPS?=C2=A0 An attacker who ca= n inject this record can also inject false AAAA records for any names of in= terest, allowing them to proxy and observe all the user=E2=80=99s traffic (= and disable ECH).=C2=A0 I can believe there's a relevant attack, but it= would help to have an explanation for it.

PvD: The use of "https://example.com/.well-know= n/pvd" makes sense to me, but the use of =E2=80=9Chttps://doh.example.net/.well= -known/pvd/dns-query" seems very odd.=C2=A0 Instead, could you do = a GET for the DoH URI template with no =E2=80=9Cdns=E2=80=9D parameter, set= ting the Accept header to =E2=80=9Capplication/pvd+json=E2=80=9D?=C2=A0 Tha= t would avoid the need for coupling across distant paths, and avoid .well-k= nown=E2=80=99s implication that these are logically properties of the entir= e origin.

I'm having trouble understanding which of these mechan= isms applies to a whole subdomain tree, and which apply only to the named d= omain.=C2=A0 (And even more trouble understanding why, or why not.)

= This draft's PvD mechanism (+PUSH) also seems to overlap considerably w= ith draft-schinazi-httpbis-doh-preference-hints, which proposes a "DoH= -Preference" response header.=C2=A0 I think we should probably avoid s= tandardizing both.=C2=A0 The comparison is interesting: I=E2=80=99m not sur= e PvD is really the right semantic for this use case, but I do like that it= =E2=80=99s explicitly scoped to the domain.=C2=A0 A response header is synt= actically scoped to a single response, although HTTP headers have been used= to convey a variety of domain-wide information.

One key difference= might be how these approaches interact with caching reverse proxies.=C2=A0= With a (naive) caching reverse proxy in the middle, I=E2=80=99m not sure h= ow HTTP/2 PUSH would work.=C2=A0 The DoH-Preference header would work, but = it would have to be attached to every response, which seems inefficient.

On Mon, Jul 20, 2020 at 11:28 AM Stephane Bortzmeyer <bortzmeyer@nic.fr> wrote:
On Mon, Jul 13, 2020 at 02:13:06= PM -0700,
=C2=A0Tommy Pauly <tpauly=3D40apple.com@dmarc.ietf.org> wrote
=C2=A0a message of 221 lines which said:

> We=E2=80=99ve published a revision of draft-pauly-add-resolver-discove= ry. This revision incorporates various pieces of feedback we=E2=80=99ve rec= eived. Specifically, the changes include:

I'm a bit surprised by the use of PvD which, I thought, were meant for<= br> local configuration, not for remote domains but why not.

> Note that clients MUST NOT accept designations for effective top-
>=C2=A0 level domains (eTLDs), such as ".com".

I think I understand why, but it creates a problem for .corp (also
called .brand) TLD. I don't see why the Example Corporation could not designate a resolver for their ".corp" TLD .example. (A full solu= tion
of this problem would probably require to resurrect the Dbound working
group.)



--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000000f1dd105ab0dac77-- --0000000000001560a805ab0dac01 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIPBgYJKoZIhvcNAQcCoIIO9zCCDvMCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ggxpMIIEkjCCA3qgAwIBAgINAewckktV4F6Q7sAtGDANBgkqhkiG9w0BAQsFADBMMSAwHgYDVQQL ExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMK R2xvYmFsU2lnbjAeFw0xODA2MjAwMDAwMDBaFw0yODA2MjAwMDAwMDBaMEsxCzAJBgNVBAYTAkJF MRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSEwHwYDVQQDExhHbG9iYWxTaWduIFNNSU1FIENB IDIwMTgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUeobu8FdB5oJg6Fz6SFf8YsPI dNcq4rBSiSDAwqMNYbeTpRrINMBdWuPqVWaBX7WHYMsKQwCOvAF1b7rkD+ROo+CCTJo76EAY25Pp jt7TYP/PxoLesLQ+Ld088+BeyZg9pQaf0VK4tn23fOCWbFWoM8hdnF86Mqn6xB6nLsxJcz4CUGJG qAhC3iedFiCfZfsIp2RNyiUhzPAqalkrtD0bZQvCgi5aSNJseNyCysS1yA58OuxEyn2e9itZJE+O sUeD8VFgz+nAYI5r/dmFEXu5d9npLvTTrSJjrEmw2/ynKn6r6ONueZnCfo6uLmP1SSglhI/SN7dy L1rKUCU7R1MjAgMBAAGjggFyMIIBbjAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUH AwIGCCsGAQUFBwMEBggrBgEFBQcDCTASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRMtwWJ 1lPNI0Ci6A94GuRtXEzs0jAfBgNVHSMEGDAWgBSP8Et/qC5FJK5NUPpjmove4t0bvDA+BggrBgEF BQcBAQQyMDAwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjMw NgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9yb290LXIzLmNybDBn BgNVHSAEYDBeMAsGCSsGAQQBoDIBKDAMBgorBgEEAaAyASgKMEEGCSsGAQQBoDIBXzA0MDIGCCsG AQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG9w0B AQsFAAOCAQEAwREs1zjtnFIIWorsx5XejqZtqaq5pomEvpjM98ebexngUmd7hju2FpYvDvzcnoGu tjm0N3Sqj5vvwEgvDGB5CxDOBkDlmUT+ObRpKbP7eTafq0+BAhEd3z2tHFm3sKE15o9+KjY6O5bb M30BLgvKlLbLrDDyh8xigCPZDwVI7JVuWMeemVmNca/fidKqOVg7a16ptQUyT5hszqpj18MwD9U0 KHRcR1CfVa+3yjK0ELDS+UvTufoB9wp2BoozsqD0yc2VOcZ7SzcwOzomSFfqv7Vdj88EznDbdy4s fq6QvuNiUs8yW0Vb0foCVRNnSlb9T8//uJqQLHxrxy2j03cvtTCCA18wggJHoAMCAQICCwQAAAAA ASFYUwiiMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIz MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTA5MDMxODEwMDAw MFoXDTI5MDMxODEwMDAwMFowTDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzAR BgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDMJXaQeQZ4Ihb1wIO2hMoonv0FdhHFrYhy/EYCQ8eyip0EXyTLLkvhYIJG 4VKrDIFHcGzdZNHr9SyjD4I9DCuul9e2FIYQebs7E4B3jAjhSdJqYi8fXvqWaN+JJ5U4nwbXPsnL JlkNc96wyOkmDoMVxu9bi9IEYMpJpij2aTv2y8gokeWdimFXN6x0FNx04Druci8unPvQu7/1PQDh BjPogiuuU6Y6FnOM3UEOIDrAtKeh6bJPkC4yYOlXy7kEkmho5TgmYHWyn3f/kRTvriBJ/K1AFUjR AjFhGV64l++td7dkmnq/X8ET75ti+w1s4FRpFqkD2m7pg5NxdsZphYIXAgMBAAGjQjBAMA4GA1Ud DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSP8Et/qC5FJK5NUPpjmove4t0b vDANBgkqhkiG9w0BAQsFAAOCAQEAS0DbwFCq/sgM7/eWVEVJu5YACUGssxOGhigHM8pr5nS5ugAt rqQK0/Xx8Q+Kv3NnSoPHRHt44K9ubG8DKY4zOUXDjuS5V2yq/BKW7FPGLeQkbLmUY/vcU2hnVj6D uM81IcPJaP7O2sJTqsyQiunwXUaMld16WCgaLx3ezQA3QY/tRG3XUyiXfvNnBB4V14qWtNPeTCek TBtzc3b0F5nCH3oO4y0IrQocLP88q1UOD5F+NuvDV0m+4S4tfGCLw0FREyOdzvcya5QBqJnnLDMf Ojsl0oZAzjsshnjJYS8Uuu7bVW/fhO4FCU29KNhyztNiUGUe65KXgzHZs7XKR1g/XzCCBGwwggNU oAMCAQICEAH8qNflD4Mi9yKttXfRdHcwDQYJKoZIhvcNAQELBQAwSzELMAkGA1UEBhMCQkUxGTAX BgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExITAfBgNVBAMTGEdsb2JhbFNpZ24gU01JTUUgQ0EgMjAx ODAeFw0yMDA2MDUwODIyMjhaFw0yMDEyMDIwODIyMjhaMCIxIDAeBgkqhkiG9w0BCQEWEWJlbWFz Y0Bnb29nbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2kbyV9S0YLplF3kV 6t3GgD7IyHe8L29pJ7l+UR0Sj31uPgXOFdSSdTVwhPfQvxmB2OUDXWDgDtZdL2xu4DgHhrDyyOXT 8uDJqUCPw004ZSuUfUor1vz5u6+oYNfx2OTPTb81vtsQO2/khni3iAeQlKgO/rUI1c9+zvT6k3mR SZUypAlk/rCyG6NV7NMJMmOaU20/kPBXG297iP8+/F9w4xs+lyb3IkcSfoSUr3fVz7mYqESFato5 JnjRQGT2/f/ehxkc09jATqVGj9nyQMoD2GNPjiNnYyTVBwK5Ol/s9+E2VSL4TSLrgS2R07kY9zPi VOM3lhDDRnceboNSaqnfMwIDAQABo4IBczCCAW8wHAYDVR0RBBUwE4ERYmVtYXNjQGdvb2dsZS5j b20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNVHQ4E FgQUwJS1fB3cBxoLgZFatdIO9Vp5wOcwTAYDVR0gBEUwQzBBBgkrBgEEAaAyASgwNDAyBggrBgEF BQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wUQYIKwYBBQUHAQEE RTBDMEEGCCsGAQUFBzAChjVodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc3Nt aW1lY2EyMDE4LmNydDAfBgNVHSMEGDAWgBRMtwWJ1lPNI0Ci6A94GuRtXEzs0jA/BgNVHR8EODA2 MDSgMqAwhi5odHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2NhL2dzc21pbWVjYTIwMTguY3JsMA0G CSqGSIb3DQEBCwUAA4IBAQCC91PBn9rMxo8kSo1zNY2mxkTQDTVc0oyYk8s3y72y21IEp/d/+h1H VTCD2FR30aFUv8hTJkebJ5Z1/zue2L7sx/lLEOIHm9uYxyTkTWbKup3+XrE1vhODTHVx+ktMuOTY z447/fwjy4praSaFrQsOjTPbAoU6xuC8S2j2K2Yg6XQsctcKHKeAJjN6evZYChDaTBLmtYq9LTSH KVv3Et795vNK3gWKjhEkJtaBu4FfKLoopb1PENJ/zK6p/3edCLFgCRMSlbQ0SGtdVESSJcgezSwW WK2VB1Zcj2kyVzcL1pmV8m1xQuz2aBgUMn7peoVxKxYKP12gMtzeMvkzltYBMYICYTCCAl0CAQEw XzBLMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEhMB8GA1UEAxMYR2xv YmFsU2lnbiBTTUlNRSBDQSAyMDE4AhAB/KjX5Q+DIvcirbV30XR3MA0GCWCGSAFlAwQCAQUAoIHU MC8GCSqGSIb3DQEJBDEiBCDlaoAMgVmqzIhnpsVSJIxFBuZIfUoVVZhP6gKgkyVHODAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA3MjIyMDM0NTNaMGkGCSqGSIb3 DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglghkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAE ggEANTh4+YEIlMCwM52Wic+KdFruemcZgx215FcnEepVxgL0o9dnNVA16ynJUaSIEa9TspJyEzEm rKLVveJLC5osAO6dL/rd5fFKwomYUrF6DlJrI/1wou49iUZuSU6QCmFFmmOKZ0+5xgTZ5I/W0zY5 Yq6SldSHyW+kiMT39XbnTSNA+RtD8CqUL4ElFs8rAAfJ1TU5UotsJvSnnSnDlghYCmSa9voksbVr dLqjMBJ7OxSdbKvNPa1XDf9uG3L3p1mQjQ3VOP4FQnqNZWUTjoZ7Ka4iU6xUGoR4tWkIyZL3POwO 20ddaXtzKjd7zM4i4bqLnjRnKSoWK0Qg6xtaVSA19A== --0000000000001560a805ab0dac01-- From nobody Wed Jul 22 13:54:51 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 97A9B3A0996 for ; Wed, 22 Jul 2020 13:54:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ya-TCTvtXDI6 for ; Wed, 22 Jul 2020 13:54:48 -0700 (PDT) Received: from mail-wr1-x42f.google.com (mail-wr1-x42f.google.com [IPv6:2a00:1450:4864:20::42f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB4563A0991 for ; Wed, 22 Jul 2020 13:54:47 -0700 (PDT) Received: by mail-wr1-x42f.google.com with SMTP id z15so3160538wrl.8 for ; Wed, 22 Jul 2020 13:54:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=kbIvHLSU4MjGtHS6tCP2M6FT4oOJ/fgd7QIk8QgwIvY=; b=uBrHZnDkPI4XWIskBod5MMixOeskcfQRgGBreODefcTMKIlpuudxpH4RnmzQ/LZs6u gPz5FnFmUBQ0L09jThutjjsRxdUUfw0IBLIONLtUhlGeVxGJsYC0bzGuN+kH1+6yMmZ1 d2172rx4JCfPrWodpSaKEuAsBJJD07ojMTMJ9aknSWT0GSjwNWFZhDrbOGdOUmXRyG95 7xYXtDkCD/LKQgLG2/o0flUtbbrJdveYiEqHyy24Ezfmd4ffoMdRHYqo+9iRB5xyVqRc kx+/YEwGkz+S96LDzeoJ6cqHAcfZF8AkYKyhOjaAvoZrUGYOzZYS+RywQevwGvFo4lsI zkqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=kbIvHLSU4MjGtHS6tCP2M6FT4oOJ/fgd7QIk8QgwIvY=; b=fteV1xRASdgcFY2PpjdMAvdWtY8615wIj/JPDS7PGuYqYbiZILL4LJ+BuJVFiJuNif mBAgHRcTzaOssAIOAJleuROtX/TuZDli+sibSYXw3IHjuN62hbBjcuGL9uxN5kOyDo2L 1+tmDIxyRZq9fjtvnLNg3KsU1rjGMsySeyasM7U/THwjPcYgc36TfHoZkKKrBCF+11DR QVBnsrWX1yby1BAOmTu15gXR8R+raLBzRJBHSP/HMPtEv0eSKM3RKWCMI1hk4FGs8hIq qNLUi23frGUIUQOTCByOhBsr36Ywc2jfwf011BgInqbgsJ48byCnI/Vnd/XEvEdCcpks T1oQ== X-Gm-Message-State: AOAM53126+dDTUAQMamgMEAu1rYRskd7wVE5u/l3vzZ8dcTnErP/ssfX n3ahEmDQd0LhvLj77do8N9kRHtYmUmVBXjY5oFMU/g== X-Google-Smtp-Source: ABdhPJwKgVOnxfCUOAyvnbj+WT+Wd6tYk+qZhw2VxtMGSA2PhC2A+G5Up2MrTfMSGOKUIWhRyM90PjDy8hC+a4zkZkQ= X-Received: by 2002:adf:e850:: with SMTP id d16mr1175472wrn.426.1595451286155; Wed, 22 Jul 2020 13:54:46 -0700 (PDT) MIME-Version: 1.0 References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> <20200721095240.GA10868@nic.fr> <2afd9527aab8477ea19217eec2f49e44@att.com> In-Reply-To: <2afd9527aab8477ea19217eec2f49e44@att.com> From: Ben Schwartz Date: Wed, 22 Jul 2020 16:54:34 -0400 Message-ID: To: "STARK, BARBARA H" Cc: Eric Orth , "Chris Box (BT)" , ADD Mailing list , "Deen, Glenn" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="00000000000031d21705ab0df3a2" Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 20:54:50 -0000 --00000000000031d21705ab0df3a2 Content-Type: multipart/alternative; boundary="0000000000002b4f9705ab0df33e" --0000000000002b4f9705ab0df33e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 22, 2020 at 4:27 PM STARK, BARBARA H wrote: > > TL;DR: I think the network needs to be able to indicate whether network > policy allows use of DNS/DoH servers other than those it advertises, and > users (who have been informed of the network policy) can decide whether o= r > not they want to use the locally advertised DoH servers (i.e., there are > just 2 types of networks =E2=80=93 (1) use advertised DNS/DoH and (2) don= =E2=80=99t use > advertised DNS/DoH). What the network does to detect and handle > violations of its policy is out of scope. The network just needs to be ab= le > to express its policy. > Network operators can certainly have terms of service and usage policies. I would not support making a special mechanism just for the policy related to DNS server selection, to be presented to the user in isolation from any other branding, advice, demands, and legalese. In other words, this problem is not specific to DNS, so ADD is not the place for it. Personally, I would put it in CAPPORT, because network operator terms of service are most naturally presented via a captive portal. --0000000000002b4f9705ab0df33e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 22, 2020 at 4:27 PM STARK, BA= RBARA H <bs7652@att.com> wrote:=


TL;DR: I think the network needs to be able to indicate whethe= r network policy allows use of DNS/DoH servers other than those it advertises, and users (who have been info= rmed of the network policy) can decide whether or not they want to use the = locally advertised DoH servers (i.e.= , there are just 2 types of networks =E2=80=93 (1) use advertised DNS/DoH and (2) don=E2=80= =99t use advertised DNS/= DoH). What the network does to detect and handle violations of its policy is out of scope. The network just needs to be able to expres= s its policy.


Network operators can certainly have terms of serv= ice and usage policies.=C2=A0 I would not support making a special mechanis= m just for the policy related to DNS server selection, to be presented to t= he user in isolation from any other branding, advice, demands, and legalese= .=C2=A0 In other words, this problem is not specific to DNS, so ADD is not = the place for it.=C2=A0 Personally, I would put it in CAPPORT, because netw= ork operator terms of service are most naturally presented via a captive po= rtal.
--0000000000002b4f9705ab0df33e-- --00000000000031d21705ab0df3a2 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIPBgYJKoZIhvcNAQcCoIIO9zCCDvMCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ggxpMIIEkjCCA3qgAwIBAgINAewckktV4F6Q7sAtGDANBgkqhkiG9w0BAQsFADBMMSAwHgYDVQQL ExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMK R2xvYmFsU2lnbjAeFw0xODA2MjAwMDAwMDBaFw0yODA2MjAwMDAwMDBaMEsxCzAJBgNVBAYTAkJF MRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSEwHwYDVQQDExhHbG9iYWxTaWduIFNNSU1FIENB IDIwMTgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUeobu8FdB5oJg6Fz6SFf8YsPI dNcq4rBSiSDAwqMNYbeTpRrINMBdWuPqVWaBX7WHYMsKQwCOvAF1b7rkD+ROo+CCTJo76EAY25Pp jt7TYP/PxoLesLQ+Ld088+BeyZg9pQaf0VK4tn23fOCWbFWoM8hdnF86Mqn6xB6nLsxJcz4CUGJG qAhC3iedFiCfZfsIp2RNyiUhzPAqalkrtD0bZQvCgi5aSNJseNyCysS1yA58OuxEyn2e9itZJE+O sUeD8VFgz+nAYI5r/dmFEXu5d9npLvTTrSJjrEmw2/ynKn6r6ONueZnCfo6uLmP1SSglhI/SN7dy L1rKUCU7R1MjAgMBAAGjggFyMIIBbjAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUH AwIGCCsGAQUFBwMEBggrBgEFBQcDCTASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRMtwWJ 1lPNI0Ci6A94GuRtXEzs0jAfBgNVHSMEGDAWgBSP8Et/qC5FJK5NUPpjmove4t0bvDA+BggrBgEF BQcBAQQyMDAwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjMw NgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9yb290LXIzLmNybDBn BgNVHSAEYDBeMAsGCSsGAQQBoDIBKDAMBgorBgEEAaAyASgKMEEGCSsGAQQBoDIBXzA0MDIGCCsG AQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG9w0B AQsFAAOCAQEAwREs1zjtnFIIWorsx5XejqZtqaq5pomEvpjM98ebexngUmd7hju2FpYvDvzcnoGu tjm0N3Sqj5vvwEgvDGB5CxDOBkDlmUT+ObRpKbP7eTafq0+BAhEd3z2tHFm3sKE15o9+KjY6O5bb M30BLgvKlLbLrDDyh8xigCPZDwVI7JVuWMeemVmNca/fidKqOVg7a16ptQUyT5hszqpj18MwD9U0 KHRcR1CfVa+3yjK0ELDS+UvTufoB9wp2BoozsqD0yc2VOcZ7SzcwOzomSFfqv7Vdj88EznDbdy4s fq6QvuNiUs8yW0Vb0foCVRNnSlb9T8//uJqQLHxrxy2j03cvtTCCA18wggJHoAMCAQICCwQAAAAA ASFYUwiiMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIz MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTA5MDMxODEwMDAw MFoXDTI5MDMxODEwMDAwMFowTDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzAR BgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDMJXaQeQZ4Ihb1wIO2hMoonv0FdhHFrYhy/EYCQ8eyip0EXyTLLkvhYIJG 4VKrDIFHcGzdZNHr9SyjD4I9DCuul9e2FIYQebs7E4B3jAjhSdJqYi8fXvqWaN+JJ5U4nwbXPsnL JlkNc96wyOkmDoMVxu9bi9IEYMpJpij2aTv2y8gokeWdimFXN6x0FNx04Druci8unPvQu7/1PQDh BjPogiuuU6Y6FnOM3UEOIDrAtKeh6bJPkC4yYOlXy7kEkmho5TgmYHWyn3f/kRTvriBJ/K1AFUjR AjFhGV64l++td7dkmnq/X8ET75ti+w1s4FRpFqkD2m7pg5NxdsZphYIXAgMBAAGjQjBAMA4GA1Ud DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSP8Et/qC5FJK5NUPpjmove4t0b vDANBgkqhkiG9w0BAQsFAAOCAQEAS0DbwFCq/sgM7/eWVEVJu5YACUGssxOGhigHM8pr5nS5ugAt rqQK0/Xx8Q+Kv3NnSoPHRHt44K9ubG8DKY4zOUXDjuS5V2yq/BKW7FPGLeQkbLmUY/vcU2hnVj6D uM81IcPJaP7O2sJTqsyQiunwXUaMld16WCgaLx3ezQA3QY/tRG3XUyiXfvNnBB4V14qWtNPeTCek TBtzc3b0F5nCH3oO4y0IrQocLP88q1UOD5F+NuvDV0m+4S4tfGCLw0FREyOdzvcya5QBqJnnLDMf Ojsl0oZAzjsshnjJYS8Uuu7bVW/fhO4FCU29KNhyztNiUGUe65KXgzHZs7XKR1g/XzCCBGwwggNU oAMCAQICEAH8qNflD4Mi9yKttXfRdHcwDQYJKoZIhvcNAQELBQAwSzELMAkGA1UEBhMCQkUxGTAX BgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExITAfBgNVBAMTGEdsb2JhbFNpZ24gU01JTUUgQ0EgMjAx ODAeFw0yMDA2MDUwODIyMjhaFw0yMDEyMDIwODIyMjhaMCIxIDAeBgkqhkiG9w0BCQEWEWJlbWFz Y0Bnb29nbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2kbyV9S0YLplF3kV 6t3GgD7IyHe8L29pJ7l+UR0Sj31uPgXOFdSSdTVwhPfQvxmB2OUDXWDgDtZdL2xu4DgHhrDyyOXT 8uDJqUCPw004ZSuUfUor1vz5u6+oYNfx2OTPTb81vtsQO2/khni3iAeQlKgO/rUI1c9+zvT6k3mR SZUypAlk/rCyG6NV7NMJMmOaU20/kPBXG297iP8+/F9w4xs+lyb3IkcSfoSUr3fVz7mYqESFato5 JnjRQGT2/f/ehxkc09jATqVGj9nyQMoD2GNPjiNnYyTVBwK5Ol/s9+E2VSL4TSLrgS2R07kY9zPi VOM3lhDDRnceboNSaqnfMwIDAQABo4IBczCCAW8wHAYDVR0RBBUwE4ERYmVtYXNjQGdvb2dsZS5j b20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNVHQ4E FgQUwJS1fB3cBxoLgZFatdIO9Vp5wOcwTAYDVR0gBEUwQzBBBgkrBgEEAaAyASgwNDAyBggrBgEF BQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wUQYIKwYBBQUHAQEE RTBDMEEGCCsGAQUFBzAChjVodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc3Nt aW1lY2EyMDE4LmNydDAfBgNVHSMEGDAWgBRMtwWJ1lPNI0Ci6A94GuRtXEzs0jA/BgNVHR8EODA2 MDSgMqAwhi5odHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2NhL2dzc21pbWVjYTIwMTguY3JsMA0G CSqGSIb3DQEBCwUAA4IBAQCC91PBn9rMxo8kSo1zNY2mxkTQDTVc0oyYk8s3y72y21IEp/d/+h1H VTCD2FR30aFUv8hTJkebJ5Z1/zue2L7sx/lLEOIHm9uYxyTkTWbKup3+XrE1vhODTHVx+ktMuOTY z447/fwjy4praSaFrQsOjTPbAoU6xuC8S2j2K2Yg6XQsctcKHKeAJjN6evZYChDaTBLmtYq9LTSH KVv3Et795vNK3gWKjhEkJtaBu4FfKLoopb1PENJ/zK6p/3edCLFgCRMSlbQ0SGtdVESSJcgezSwW WK2VB1Zcj2kyVzcL1pmV8m1xQuz2aBgUMn7peoVxKxYKP12gMtzeMvkzltYBMYICYTCCAl0CAQEw XzBLMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEhMB8GA1UEAxMYR2xv YmFsU2lnbiBTTUlNRSBDQSAyMDE4AhAB/KjX5Q+DIvcirbV30XR3MA0GCWCGSAFlAwQCAQUAoIHU MC8GCSqGSIb3DQEJBDEiBCCopAoH/lbtlCq9G8JLD/XKRQplWRMXgVTbIYIZwcASLzAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA3MjIyMDU0NDZaMGkGCSqGSIb3 DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglghkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAE ggEAieimq+VQ5vqIabMz7ffavEZkAJazbwGGxTyNo/84cuhh/hKR1KuRxy1Ec3nOuc5dYSp+1Ig9 T8MrqJZcoWxjHvi4mPoXP6DVoX37SJfsAEyyovUzwV26OpOWlNSo6+BFCObNSNSkMMV2Zt9CVhal Xz+rfwrhreRFua5vH9Fa5mhQkS6cLk9uZ8OZ3emsHW8TIdSuztDfack3GAYoQ+pR9biTzikerNwR HvG+eX3qkaPvtUALK2gF0WjivxSjSHulhFoTvSlNeUBHTuK/1riCPxtHP6C/Bbb/2dj1/z/ZCaDn tpxii1U49THpMLhB31oUjOdrM9x9gzOaMpPIN0BGMQ== --00000000000031d21705ab0df3a2-- From nobody Wed Jul 22 13:55:01 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C6B53A09E9 for ; Wed, 22 Jul 2020 13:54:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y85okmm_nmjE for ; Wed, 22 Jul 2020 13:54:51 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B93A23A09B1 for ; Wed, 22 Jul 2020 13:54:51 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 999C3C3F16 for ; Wed, 22 Jul 2020 20:54:50 +0000 (UTC) From: Paul Vixie To: ADD Mailing list Date: Wed, 22 Jul 2020 20:54:49 +0000 Message-ID: <1777294.VHrhjNhOuf@linux-9daj> Organization: none In-Reply-To: References: <5990D901-60E1-474C-BC18-94F069C0201A@nbcuni.com> <150cdf53-e9d8-9f76-4456-5c73c4dbdc79@ericsson.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 20:54:59 -0000 On Wednesday, 22 July 2020 19:49:45 UTC Deen, Glenn wrote: > Mohit, > ... i am not mohit, but i have comments. > While I 100% agree that not all users are equal, they all do have the power > to make choices when they connect to a network. ... > While a user connecting to a network that would fall into the > Red environment is an important use scenario for the group to the consider, > it's also not something that the vast majority of Internet users will > actually encounter, ... > I hope it can be helpful to recognize that the user connecting to a trusted > green, or even a yellow sort-of-trusted network doesn't need the same > mitigations that they would need when connecting a device to the Black-Hat > network. We might need a special case beyond red - classified > oh-hell-no for the Black-hat network. glenn, i am concerned about your use of the words "user" and "trust" here. most of today's DHCP clients are embedded or IoT, and that trend will likely accelerate. they don't have UI's for the most part, other than for initial setup in some cases (like a chromecast). if we expect a judgement to be made based on trust, we have to make an assumption about whose judgement that will be and what their standard of trust will be. noting that my chromecast ignores my DNS settings as told to it in DHCP, and just always goes to 8.8.8.8, this question is not editorial or academic in nature. surveillance capitalists who produce embedded Internet connected devices are likely to have a trust rubrik very different from mine. and in any case, users are vastly unlikely to be able to make an informed decision about what kind of network they are connecting to. so even if a browser insisted on obtaining consent _before_ switching to an external DoH service, that would be _uninformed_ consent. > The classification approach in the draft is just meant to foster productive > thinking and help us focus on appropriate proportional mitigations for each > threat/trust environment. my reason for supporting adoption of your draft is that it will drag in all of these questions. good engineering must acknowledge economics and even politics, and either expressly avoid or expressly serve those interests. > It's that final consideration - appropriate and proportional - that is > important to get right: Too light and we expose the user, too tight and we > build a wall to DoH adoption. where you say user, i would say "privately-owned edge network operator". we may be able to coalesce around some kind of middle term so that the interests of some real or corporate person can always be held as paramount, and our task is reduced to enumerating or designating those so-called persons. -- Paul From nobody Wed Jul 22 14:09:52 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A834F3A09A2 for ; Wed, 22 Jul 2020 14:09:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T-UbtCz6rOfz for ; Wed, 22 Jul 2020 14:09:50 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95D693A09A0 for ; Wed, 22 Jul 2020 14:09:50 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 4C958C3F16 for ; Wed, 22 Jul 2020 21:09:50 +0000 (UTC) From: Paul Vixie To: add@ietf.org Date: Wed, 22 Jul 2020 21:09:49 +0000 Message-ID: <20722757.iu7U28Ghu2@linux-9daj> Organization: none In-Reply-To: References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> <2afd9527aab8477ea19217eec2f49e44@att.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 21:09:52 -0000 On Wednesday, 22 July 2020 20:54:34 UTC Ben Schwartz wrote: > On Wed, Jul 22, 2020 at 4:27 PM STARK, BARBARA H wrote: > > TL;DR: I think the network needs to be able to indicate whether network > > policy allows use of DNS/DoH servers other than those it advertises, and > > users (who have been informed of the network policy) can decide whether= or > > not they want to use the locally advertised DoH servers (i.e., there are > > just 2 types of networks =E2=80=93 (1) use advertised DNS/DoH and (2) d= on=E2=80=99t use > > advertised DNS/DoH). What the network does to detect and handle > > violations of its policy is out of scope. The network just needs to be > > able to express its policy. i mostly resonate to this, except i'd like to see reliable signalling not j= ust=20 of policy but of violations. when something isn't working and the reason is= =20 network policy, i'd like to be able to tell the chromecast or the web brows= er=20 or the IoT light bulb that what they're trying to do is expressly forbidden= ,=20 rather than produce silent and ambiguous "doesn't work dunno why" condition= s. > Network operators can certainly have terms of service and usage policies. > I would not support making a special mechanism just for the policy related > to DNS server selection, to be presented to the user in isolation from any > other branding, advice, demands, and legalese. DNS is part of bootstrapping. i may have to make a DNS request to validate = a=20 TLS certificate for example. if that's not going to work i'd like to be sur= e i=20 know that it's not an accident, misconfiguration, or outage, but rather=20 intent. > In other words, this > problem is not specific to DNS, so ADD is not the place for it. > Personally, I would put it in CAPPORT, because network operator terms of > service are most naturally presented via a captive portal. my privately-owned edge network has only family, employees, and privately=20 owned equipment. yes, there are terms of service. no, there aren't customer= s.=20 CAPPORT is meant for a broader, distinct audience, and as written above, i = may=20 need to know why my DNS isn't working before i can speak to a policy servic= e. =2D-=20 Paul From nobody Wed Jul 22 14:10:13 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F419D3A09A2 for ; Wed, 22 Jul 2020 14:10:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nWxs60_0D4KK for ; Wed, 22 Jul 2020 14:10:10 -0700 (PDT) Received: from ppa3.lax.icann.org (ppa3.lax.icann.org [192.0.33.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF7453A09A0 for ; Wed, 22 Jul 2020 14:10:10 -0700 (PDT) Received: from MBX112-W2-CO-1.pexch112.icann.org (out.mail.icann.org [64.78.33.5]) by ppa3.lax.icann.org (8.16.0.42/8.16.0.42) with ESMTPS id 06MLA7RE004531 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2020 21:10:09 GMT Received: from MBX112-W2-CO-1.pexch112.icann.org (10.226.41.128) by MBX112-W2-CO-2.pexch112.icann.org (10.226.41.130) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.595.3; Wed, 22 Jul 2020 14:10:08 -0700 Received: from MBX112-W2-CO-1.pexch112.icann.org ([10.226.41.128]) by MBX112-W2-CO-1.pexch112.icann.org ([10.226.41.128]) with mapi id 15.02.0595.003; Wed, 22 Jul 2020 14:10:08 -0700 From: Paul Hoffman To: "Deen, Glenn" CC: ADD Mailing list Thread-Topic: [Ext] [Add] New Threats ID for ADD Thread-Index: AQHWYDRDK66s5qosfkKhJzK0Q9aMKqkUawOAgAAMbICAABZ0gA== Date: Wed, 22 Jul 2020 21:10:07 +0000 Message-ID: <617AD3F5-1E97-420B-8D04-D9F1616AFFF0@icann.org> References: <5990D901-60E1-474C-BC18-94F069C0201A@nbcuni.com> <150cdf53-e9d8-9f76-4456-5c73c4dbdc79@ericsson.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [192.0.32.234] x-source-routing-agent: Processed Content-Type: multipart/signed; boundary="Apple-Mail=_01219F3B-24CE-4E8B-A805-92CF05B5B4D5"; protocol="application/pkcs7-signature"; micalg=sha-256 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-22_13:2020-07-22, 2020-07-22 signatures=0 Archived-At: Subject: Re: [Add] [Ext] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 21:10:12 -0000 --Apple-Mail=_01219F3B-24CE-4E8B-A805-92CF05B5B4D5 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Jul 22, 2020, at 12:49 PM, Deen, Glenn = wrote: >=20 > While I 100% agree that not all users are equal, they all do have the = power to make choices when they connect to a network. There is widespread disagreement on the latter point. Proposals for = operational practices and/or protocols that rely on that point are = doomed to interminable discussion. --Paul Hoffman= --Apple-Mail=_01219F3B-24CE-4E8B-A805-92CF05B5B4D5 Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCC/Qw ggWeMIIEhqADAgECAhAG83jiXlqePPrfwUUEH4ZnMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi BgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQTAeFw0xODA2MTMwMDAwMDBaFw0yMTA2 MTMxMjAwMDBaMIG9MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEUMBIGA1UEBxML TG9zIEFuZ2VsZXMxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0aW9uIGZvciBBc3NpZ25lZCBO YW1lcyBhbmQgTnVtYmVyczEeMBwGA1UEAxMVUGF1bCBIb2ZmbWFuIDIwMTgwNjEzMSUwIwYJKoZI hvcNAQkBFhZwYXVsLmhvZmZtYW5AaWNhbm4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEArTbxBbfxbk1VxDQsOmEm14Yta2AE5cBcJ/ktMkC+aQrTCMSXrQJfjiMUUndnfAT1DWcf jg706vvITa1lkFaLoF9b6cNICMKsibFruFy8ZA2bsIPRXPPzSsY6zibdStNCpruNTQoiL9bIxlQp qRUx/BfvHAhS7g5dAOcRgkpW9Q4Si5bl6A2qS0ImIMzktNcVxrWAn0HsG9u8cKcSCBJxavRAnMt/ XhE7tCICjyoeoprYZ2ztmdZUL6UgMNrDz/KoeNHAWzTAH45hn1Jz1IguGLM/M2Vb8mF8eP3wAh4p MVIi2jCwNqC497R8x0lsNryoG+uy/26nK6fhCTqVfF6hgQIDAQABo4IB7zCCAeswHwYDVR0jBBgw FoAU5wIjgABP2Ne8lAvZP3Q5STI8inkwHQYDVR0OBBYEFD+ST5hEHbTuHJZT9husDN7VLQdgMAwG A1UdEwEB/wQCMAAwIQYDVR0RBBowGIEWcGF1bC5ob2ZmbWFuQGljYW5uLm9yZzAOBgNVHQ8BAf8E BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYKYIZIAYb9 bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGIBgNVHR8E gYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJ RENBLWcyLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFz c3VyZWRJRENBLWcyLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG9w0BAQsFAAOCAQEAA7vGiITVJvEIgFN3 UVszD4nyt8ks8d/Ik5Uj1jPuD8+NX4lBpDOIvfYkCn8KYSrx+sMQrpoS2enbOMwekef3tObl2hVK 2Q+tv1GksPq9tQ98Ab1Odv1IM9aYaU1alR5/EEhc0uqs1Ulz2WUc8x/anf3/IpbHyEPdOCLiL9mi b4GDM8z9mqvAE+MtisqRs2+wlMzC/63sNKpA6KdfBNKMLHnyqCAKF7luGWp612yPmGoh63bBLrpR JQorI/fsv5SE2pK3Xf53W/ELf6sxWMsXm9iEgMeoAOtDeJHrv+i+vlldwHHJK6zlXIdVrjxRklyg ISXmlsdHs/sDp1MEqZTOXDCCBk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcN AQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEz MTEwNTEyMDAwMFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hB MiBBc3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr+Lp+ yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQelAfJUXo 8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK3OnZ9ZEXjsYh rTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uCig1xGOSm4IksG/Oy czzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV HQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp Y2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp Q2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwME MIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgBhv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6 Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMA ZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0 AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMA ZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABh AHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkA YQBiAGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP 2Ne8lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrgYhmZ pgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg4/mgVgxI EM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmwXZG0k4f5lpaB VUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1YEhEybr1DDE0023vG QtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIxggMpMIIDJQIBATB5MGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQBvN44l5anjz638FFBB+G ZzANBglghkgBZQMEAgEFAKCCAYEwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMjAwNzIyMjExMDA3WjAvBgkqhkiG9w0BCQQxIgQgHvKLBPBfEdPZ1fBCeI19Iv5o42co YmMxGbuCtuEpetswgYgGCSsGAQQBgjcQBDF7MHkwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERp Z2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQg U0hBMiBBc3N1cmVkIElEIENBAhAG83jiXlqePPrfwUUEH4ZnMIGKBgsqhkiG9w0BCRACCzF7oHkw ZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj ZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENBAhAG83jiXlqePPrf wUUEH4ZnMA0GCSqGSIb3DQEBAQUABIIBAHSGsAKAGMVF/xAwNbjs+EXg9LE+063aWCfXsqqM4N13 r5HlJFTvsgWtiqgrIrDjSi6OiN5Qgg4juKb2ve/302C5MkSYSjEOtqWbJJPgvntzaNQTc8SqF7I1 iubGhHI8Z5EBN3gsepkOme92RUVR8BAv26l8THVXJzmOc3r60hp9VSh6cu0ag8nJaHdeulX1B1Mw C+oyXqOpyQDJvGwFUEx4o3npQrrg1m9W33+EfwOSahVDC96LVAWHIvSjqkAQhC3z/ahJk/Kjjgy2 BhSXC0aLNGyqV+yEia00e7pEV8GrhFsqmpvMAvgcznJlED/RC1JX+VDX15Ughe+Yf+6gzy4AAAAA AAA= --Apple-Mail=_01219F3B-24CE-4E8B-A805-92CF05B5B4D5-- From nobody Wed Jul 22 14:16:14 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DF0E3A09B8 for ; Wed, 22 Jul 2020 14:16:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.918 X-Spam-Level: X-Spam-Status: No, score=-1.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jEyXkNVRxJsG for ; Wed, 22 Jul 2020 14:16:11 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A2DF3A09B3 for ; Wed, 22 Jul 2020 14:16:11 -0700 (PDT) Received: from pps.filterd (m0053301.ppops.net [127.0.0.1]) by mx0a-00191d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06MLDbWn006000; Wed, 22 Jul 2020 17:16:05 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by mx0a-00191d01.pphosted.com with ESMTP id 32e4dj01rn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2020 17:16:05 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id 06MLG1mh010210; Wed, 22 Jul 2020 17:16:04 -0400 Received: from zlp30487.vci.att.com (zlp30487.vci.att.com [135.47.91.176]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id 06MLFrGS009913 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 22 Jul 2020 17:15:53 -0400 Received: from zlp30487.vci.att.com (zlp30487.vci.att.com [127.0.0.1]) by zlp30487.vci.att.com (Service) with ESMTP id 660A04016D82; Wed, 22 Jul 2020 21:15:53 +0000 (GMT) Received: from GAALPA1MSGEX1CD.ITServices.sbc.com (unknown [135.50.89.111]) by zlp30487.vci.att.com (Service) with ESMTPS id 443C64016D81; Wed, 22 Jul 2020 21:15:53 +0000 (GMT) Received: from GAALPA1MSGEX1CB.ITServices.sbc.com (135.50.89.109) by GAALPA1MSGEX1CD.ITServices.sbc.com (135.50.89.111) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2044.4; Wed, 22 Jul 2020 17:15:52 -0400 Received: from GAALPA1MSGEX1CB.ITServices.sbc.com ([135.50.89.109]) by GAALPA1MSGEX1CB.ITServices.sbc.com ([135.50.89.109]) with mapi id 15.01.2044.004; Wed, 22 Jul 2020 17:15:52 -0400 From: "STARK, BARBARA H" To: "'Ben Schwartz'" CC: "'Eric Orth'" , "'Chris Box (BT)'" , "'ADD Mailing list'" , "'Deen, Glenn'" Thread-Topic: [Add] New Threats ID for ADD Thread-Index: AQHWXveH7JO1nsTxqkKNHNNtJCTm0KkSDnYAgAFco4CAAG66gIAAKuQAgAAb8wCAAAdOgP//x6RAgABqHgD//77/kA== Date: Wed, 22 Jul 2020 21:15:52 +0000 Message-ID: References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> <20200721095240.GA10868@nic.fr> <2afd9527aab8477ea19217eec2f49e44@att.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.10.66.16] x-tm-snts-smtp: 635CDA5285EB53CE81E6A2B222D8A75DD57CC4CCCC7733D8E7722BCF271FD0F32 Content-Type: multipart/alternative; boundary="_000_e567166b70854a658bad26e32c50d8edattcom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-22_16:2020-07-22, 2020-07-22 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 lowpriorityscore=0 adultscore=0 impostorscore=0 malwarescore=0 suspectscore=0 mlxscore=0 bulkscore=0 clxscore=1015 spamscore=0 priorityscore=1501 phishscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007220132 Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 21:16:13 -0000 --_000_e567166b70854a658bad26e32c50d8edattcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQoNCkZyb206IEJlbiBTY2h3YXJ0eiA8YmVtYXNjQGdvb2dsZS5jb20+DQoNCk9uIFdlZCwgSnVs IDIyLCAyMDIwIGF0IDQ6MjcgUE0gU1RBUkssIEJBUkJBUkEgSCA8YnM3NjUyQGF0dC5jb208bWFp bHRvOmJzNzY1MkBhdHQuY29tPj4gd3JvdGU6DQpUTDtEUjogSSB0aGluayB0aGUgbmV0d29yayBu ZWVkcyB0byBiZSBhYmxlIHRvIGluZGljYXRlIHdoZXRoZXIgbmV0d29yayBwb2xpY3kgYWxsb3dz IHVzZSBvZiBETlMvRG9IIHNlcnZlcnMgb3RoZXIgdGhhbiB0aG9zZSBpdCBhZHZlcnRpc2VzLCBh bmQgdXNlcnMgKHdobyBoYXZlIGJlZW4gaW5mb3JtZWQgb2YgdGhlIG5ldHdvcmsgcG9saWN5KSBj YW4gZGVjaWRlIHdoZXRoZXIgb3Igbm90IHRoZXkgd2FudCB0byB1c2UgdGhlIGxvY2FsbHkgYWR2 ZXJ0aXNlZCBEb0ggc2VydmVycyAoaS5lLiwgdGhlcmUgYXJlIGp1c3QgMiB0eXBlcyBvZiBuZXR3 b3JrcyDigJMgKDEpIHVzZSBhZHZlcnRpc2VkIEROUy9Eb0ggYW5kICgyKSBkb27igJl0IHVzZSBh ZHZlcnRpc2VkIEROUy9Eb0gpLiBXaGF0IHRoZSBuZXR3b3JrIGRvZXMgdG8gZGV0ZWN0IGFuZCBo YW5kbGUgdmlvbGF0aW9ucyBvZiBpdHMgcG9saWN5IGlzIG91dCBvZiBzY29wZS4gVGhlIG5ldHdv cmsganVzdCBuZWVkcyB0byBiZSBhYmxlIHRvIGV4cHJlc3MgaXRzIHBvbGljeS4NCk5ldHdvcmsg b3BlcmF0b3JzIGNhbiBjZXJ0YWlubHkgaGF2ZSB0ZXJtcyBvZiBzZXJ2aWNlIGFuZCB1c2FnZSBw b2xpY2llcy4gIEkgd291bGQgbm90IHN1cHBvcnQgbWFraW5nIGEgc3BlY2lhbCBtZWNoYW5pc20g anVzdCBmb3IgdGhlIHBvbGljeSByZWxhdGVkIHRvIEROUyBzZXJ2ZXIgc2VsZWN0aW9uLCB0byBi ZSBwcmVzZW50ZWQgdG8gdGhlIHVzZXIgaW4gaXNvbGF0aW9uIGZyb20gYW55IG90aGVyIGJyYW5k aW5nLCBhZHZpY2UsIGRlbWFuZHMsIGFuZCBsZWdhbGVzZS4gIEluIG90aGVyIHdvcmRzLCB0aGlz IHByb2JsZW0gaXMgbm90IHNwZWNpZmljIHRvIEROUywgc28gQUREIGlzIG5vdCB0aGUgcGxhY2Ug Zm9yIGl0LiAgUGVyc29uYWxseSwgSSB3b3VsZCBwdXQgaXQgaW4gQ0FQUE9SVCwgYmVjYXVzZSBu ZXR3b3JrIG9wZXJhdG9yIHRlcm1zIG9mIHNlcnZpY2UgYXJlIG1vc3QgbmF0dXJhbGx5IHByZXNl bnRlZCB2aWEgYSBjYXB0aXZlIHBvcnRhbC4NCg0KSSB3YW50IGRldmljZXMgYW5kIGFwcGxpY2F0 aW9ucyBpbnNpZGUgbXkgaG9tZSBuZXR3b3JrIHRvIGtub3cgdGhhdCBJIHdhbnQgdGhlbSB0byB1 c2UgdGhlIEROUyByZXNvbHZlcnMgbXkgaG9tZSBuZXR3b3JrIGFkdmVydGlzZXMuIEkgZG9u4oCZ dCB3YW50IHRvIGhhdmUgdG8gY29uZmlndXJlIGEgY2FwdGl2ZSBwb3J0YWwgZm9yIG15IGhvbWUg bmV0d29yay4gVGhhdOKAmXMgc2lsbHkuIEFuZCBteSBob21lIG5ldHdvcmvigJlzIEROUyBwb2xp Y3kgaXMgYWJzb2x1dGVseSBzcGVjaWZpYyB0byBETlMuIEl04oCZcyBhbHNvIHNpbXBsZTogTXkg cG9saWN5IGlzIGVpdGhlciAoMSkgSSBkb27igJl0IGNhcmUgd2hhdCByZXNvbHZlcnMgdGhlIGFw cCBvciBkZXZpY2UgdXNlcywgb3IgKDIpIEkgZXhwZWN0IGFwcHMgYW5kIGRldmljZXMgdG8gdXNl IHRoZSByZXNvbHZlcnMgbXkgbmV0d29yayBhZHZlcnRpc2VzIChhbmQgZGV2aWNlcy9hcHBzIHRo YXQgZG9u4oCZdCBhcmUgc3VzcGVjdGVkIHRvIGJlIGNvbXByb21pc2VkL21hbHdhcmUgYW5kIG1h eSBiZSB0cmVhdGVkIGFzIHN1Y2gpLiBUaGVzZSBhcmVu4oCZdCB0ZXJtcyBhbmQgY29uZGl0aW9u cyBmb3Igc29tZW9uZSB0byBhZ3JlZSB0by4gSXTigJlzIGJpbmFyeSBpbmZvcm1hdGlvbi4gSG93 IG9yIHdoZXRoZXIgYW4gYXBwIG9yIGRldmljZSBvciBtYWx3YXJlIHByZXNlbnRzIHRoaXMgaW5m b3JtYXRpb24gdG8gYSB1c2VyIGlzIHVwIHRvIHRoZSBhcHAvZGV2aWNlL21hbHdhcmUuIEkgZXhw ZWN0IGFsbCBtYWx3YXJlIHRvIGNvbXBsZXRlbHkgaWdub3JlIG15IHdpc2hlcy4gICAtIEJhcmJh cmENCg== --_000_e567166b70854a658bad26e32c50d8edattcom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IlByb2dJZCIg Y29udGVudD0iV29yZC5Eb2N1bWVudCI+DQo8bWV0YSBuYW1lPSJHZW5lcmF0b3IiIGNvbnRlbnQ9 Ik1pY3Jvc29mdCBXb3JkIDE1Ij4NCjxtZXRhIG5hbWU9Ik9yaWdpbmF0b3IiIGNvbnRlbnQ9Ik1p Y3Jvc29mdCBXb3JkIDE1Ij4NCjxsaW5rIHJlbD0iRmlsZS1MaXN0IiBocmVmPSJjaWQ6ZmlsZWxp c3QueG1sQDAxRDY2MDQzLjU2QjAyQ0IwIj48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOk9m ZmljZURvY3VtZW50U2V0dGluZ3M+DQo8bzpBbGxvd1BORy8+DQo8bzpEb05vdFJlbHlPbkNTUy8+ DQo8L286T2ZmaWNlRG9jdW1lbnRTZXR0aW5ncz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPHc6V29yZERvY3VtZW50Pg0KPHc6U3BlbGxpbmdTdGF0ZT5DbGVh bjwvdzpTcGVsbGluZ1N0YXRlPg0KPHc6RG9jdW1lbnRLaW5kPkRvY3VtZW50RW1haWw8L3c6RG9j dW1lbnRLaW5kPg0KPHc6VHJhY2tNb3Zlcy8+DQo8dzpUcmFja0Zvcm1hdHRpbmcvPg0KPHc6RW52 ZWxvcGVWaXMvPg0KPHc6VmFsaWRhdGVBZ2FpbnN0U2NoZW1hcy8+DQo8dzpTYXZlSWZYTUxJbnZh bGlkPmZhbHNlPC93OlNhdmVJZlhNTEludmFsaWQ+DQo8dzpJZ25vcmVNaXhlZENvbnRlbnQ+ZmFs c2U8L3c6SWdub3JlTWl4ZWRDb250ZW50Pg0KPHc6QWx3YXlzU2hvd1BsYWNlaG9sZGVyVGV4dD5m YWxzZTwvdzpBbHdheXNTaG93UGxhY2Vob2xkZXJUZXh0Pg0KPHc6RG9Ob3RQcm9tb3RlUUYvPg0K PHc6TGlkVGhlbWVPdGhlcj5FTi1VUzwvdzpMaWRUaGVtZU90aGVyPg0KPHc6TGlkVGhlbWVBc2lh bj5YLU5PTkU8L3c6TGlkVGhlbWVBc2lhbj4NCjx3OkxpZFRoZW1lQ29tcGxleFNjcmlwdD5YLU5P TkU8L3c6TGlkVGhlbWVDb21wbGV4U2NyaXB0Pg0KPHc6Q29tcGF0aWJpbGl0eT4NCjx3OkRvTm90 RXhwYW5kU2hpZnRSZXR1cm4vPg0KPHc6QnJlYWtXcmFwcGVkVGFibGVzLz4NCjx3OlNuYXBUb0dy aWRJbkNlbGwvPg0KPHc6V3JhcFRleHRXaXRoUHVuY3QvPg0KPHc6VXNlQXNpYW5CcmVha1J1bGVz Lz4NCjx3OkRvbnRHcm93QXV0b2ZpdC8+DQo8dzpTcGxpdFBnQnJlYWtBbmRQYXJhTWFyay8+DQo8 dzpFbmFibGVPcGVuVHlwZUtlcm5pbmcvPg0KPHc6RG9udEZsaXBNaXJyb3JJbmRlbnRzLz4NCjx3 Ok92ZXJyaWRlVGFibGVTdHlsZUhwcy8+DQo8L3c6Q29tcGF0aWJpbGl0eT4NCjxtOm1hdGhQcj4N CjxtOm1hdGhGb250IG06dmFsPSJDYW1icmlhIE1hdGgiLz4NCjxtOmJya0JpbiBtOnZhbD0iYmVm b3JlIi8+DQo8bTpicmtCaW5TdWIgbTp2YWw9IiYjNDU7LSIvPg0KPG06c21hbGxGcmFjIG06dmFs PSJvZmYiLz4NCjxtOmRpc3BEZWYvPg0KPG06bE1hcmdpbiBtOnZhbD0iMCIvPg0KPG06ck1hcmdp biBtOnZhbD0iMCIvPg0KPG06ZGVmSmMgbTp2YWw9ImNlbnRlckdyb3VwIi8+DQo8bTp3cmFwSW5k ZW50IG06dmFsPSIxNDQwIi8+DQo8bTppbnRMaW0gbTp2YWw9InN1YlN1cCIvPg0KPG06bmFyeUxp bSBtOnZhbD0idW5kT3ZyIi8+DQo8L206bWF0aFByPjwvdzpXb3JkRG9jdW1lbnQ+DQo8L3htbD48 IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjx3OkxhdGVudFN0eWxlcyBEZWZM b2NrZWRTdGF0ZT0iZmFsc2UiIERlZlVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgRGVmU2VtaUhpZGRl bj0iZmFsc2UiIERlZlFGb3JtYXQ9ImZhbHNlIiBEZWZQcmlvcml0eT0iOTkiIExhdGVudFN0eWxl Q291bnQ9IjM3NyI+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjAi IFFGb3JtYXQ9InRydWUiIE5hbWU9Ik5vcm1hbCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI5IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDEiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIgU2VtaUhpZGRlbj0idHJ1 ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFGb3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgMiIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI5IiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iaGVhZGlu ZyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjkiIFNlbWlI aWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJo ZWFkaW5nIDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFGb3JtYXQ9InRydWUiIE5h bWU9ImhlYWRpbmcgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZvcm1hdD0idHJ1 ZSIgTmFtZT0iaGVhZGluZyA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBRRm9ybWF0 PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iOSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFG b3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iaGVhZGluZyA5Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 ImluZGV4IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0 cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iaW5kZXggMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJpbmRleCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhp ZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImluZGV4IDQiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iaW5kZXggNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJpbmRleCA2Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRl V2hlblVzZWQ9InRydWUiIE5hbWU9ImluZGV4IDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iaW5k ZXggOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJpbmRleCA5Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0idG9jIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBO YW1lPSJ0b2MgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIz OSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9InRvYyAzIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9jIDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0b2MgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSIzOSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRy dWUiIE5hbWU9InRvYyA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjM5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9j IDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlI aWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0b2MgOCIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzOSIgU2VtaUhpZGRlbj0idHJ1ZSIg VW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9InRvYyA5Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 Ik5vcm1hbCBJbmRlbnQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlk ZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iZm9vdG5vdGUgdGV4dCIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdo ZW5Vc2VkPSJ0cnVlIiBOYW1lPSJhbm5vdGF0aW9uIHRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFt ZT0iaGVhZGVyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImZvb3RlciIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJpbmRleCBoZWFkaW5nIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjM1IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZv cm1hdD0idHJ1ZSIgTmFtZT0iY2FwdGlvbiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0YWJsZSBv ZiBmaWd1cmVzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImVudmVsb3BlIGFkZHJlc3MiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iZW52ZWxvcGUgcmV0dXJuIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 ImZvb3Rub3RlIHJlZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJhbm5vdGF0aW9uIHJl ZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJsaW5lIG51bWJlciIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJwYWdlIG51bWJlciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJlbmRub3RlIHJl ZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJlbmRub3RlIHRleHQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0idGFibGUgb2YgYXV0aG9yaXRpZXMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i bWFjcm8iLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9hIGhlYWRpbmciLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IEJ1bGxldCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0 IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iTGlzdCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 Ikxpc3QgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IDUiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBCdWxsZXQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IEJ1bGxldCAz Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxpc3QgQnVsbGV0IDQiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBCdWxsZXQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxpc3QgTnVtYmVyIDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBOdW1iZXIgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciA1 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjEwIiBRRm9ybWF0 PSJ0cnVlIiBOYW1lPSJUaXRsZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJDbG9zaW5nIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hl blVzZWQ9InRydWUiIE5hbWU9IlNpZ25hdHVyZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSIxIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iRGVmYXVsdCBQYXJhZ3JhcGggRm9udCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJC b2R5IFRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0 cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEluZGVudCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJMaXN0IENvbnRpbnVlIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxp c3QgQ29udGludWUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IENvbnRpbnVlIDMiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iTGlzdCBDb250aW51ZSA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9Ikxpc3QgQ29udGludWUgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJNZXNzYWdlIEhlYWRl ciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIxMSIgUUZvcm1h dD0idHJ1ZSIgTmFtZT0iU3VidGl0bGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iU2FsdXRhdGlv biIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJEYXRlIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkJv ZHkgVGV4dCBGaXJzdCBJbmRlbnQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBT ZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEZp cnN0IEluZGVudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRl bj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ik5vdGUgSGVhZGluZyIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJCb2R5IFRleHQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCb2R5 IFRleHQgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCb2R5IFRleHQgSW5kZW50IDIiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEluZGVudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9IkJsb2NrIFRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlk ZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSHlwZXJsaW5rIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVz ZWQ9InRydWUiIE5hbWU9IkZvbGxvd2VkSHlwZXJsaW5rIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjIyIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJTdHJvbmciLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMjAiIFFGb3JtYXQ9InRy dWUiIE5hbWU9IkVtcGhhc2lzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2Vt aUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkRvY3VtZW50IE1hcCIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJQbGFpbiBUZXh0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IkUtbWFpbCBTaWduYXR1cmUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1p SGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBUb3Agb2YgRm9y bSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIEJvdHRvbSBvZiBGb3JtIi8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9 InRydWUiIE5hbWU9Ik5vcm1hbCAoV2ViKSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIEFj cm9ueW0iLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBBZGRyZXNzIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRy dWUiIE5hbWU9IkhUTUwgQ2l0ZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIENvZGUiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBEZWZpbml0aW9uIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9IkhUTUwgS2V5Ym9hcmQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1p SGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBQcmVmb3JtYXR0 ZWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBTYW1wbGUiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iSFRNTCBUeXBld3JpdGVyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkhUTUwgVmFyaWFi bGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iYW5ub3RhdGlvbiBzdWJqZWN0Ii8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9 InRydWUiIE5hbWU9Ik5vIExpc3QiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBT ZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iT3V0bGluZSBMaXN0 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iT3V0bGluZSBMaXN0IDIiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iT3V0bGluZSBMaXN0IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgU2lt cGxlIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgU2ltcGxlIDIiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0iVGFibGUgU2ltcGxlIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUg Q2xhc3NpYyAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENsYXNzaWMgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDbGFzc2ljIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i VGFibGUgQ2xhc3NpYyA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhp ZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENvbG9yZnVsIDEi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhp ZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgQ29sb3JmdWwgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJUYWJsZSBDb2xvcmZ1bCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENv bHVtbnMgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDb2x1bW5zIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgQ29sdW1ucyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRh YmxlIENvbHVtbnMgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDb2x1bW5zIDUiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IlRhYmxlIEdyaWQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBHcmlkIDMiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRh YmxlIEdyaWQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49 InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBHcmlkIDYiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCA3Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxl IEdyaWQgOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDEiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0iVGFibGUgTGlzdCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIExp c3QgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iVGFibGUgTGlzdCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIExpc3Qg NiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDciLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iVGFibGUgTGlzdCA4Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2Vt aUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIDNEIGVmZmVj dHMgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSAzRCBlZmZlY3RzIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgM0QgZWZmZWN0cyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IlRhYmxlIENvbnRlbXBvcmFyeSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBFbGVnYW50 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIFByb2Zlc3Npb25hbCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJUYWJsZSBTdWJ0bGUgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBT dWJ0bGUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBXZWIgMSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJUYWJsZSBXZWIgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCYWxsb29uIFRl eHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIE5hbWU9 IlRhYmxlIEdyaWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVu PSJ0cnVlIiBOYW1lPSJQbGFjZWhvbGRlciBUZXh0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjEiIFFGb3JtYXQ9InRydWUiIE5hbWU9Ik5vIFNwYWNpbmciLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIE5hbWU9IkxpZ2h0 IFNoYWRpbmciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEi IE5hbWU9IkxpZ2h0IExpc3QiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjIiIE5hbWU9IkxpZ2h0IEdyaWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjMiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDEiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjQiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIE5hbWU9Ik1l ZGl1bSBMaXN0IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NjYiIE5hbWU9Ik1lZGl1bSBMaXN0IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1bSBHcmlkIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5hbWU9Ik1lZGl1bSBHcmlk IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9 IkRhcmsgTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGluZyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI3MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9u IExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgTmFtZT0iQ29sb3JmdWwgR3JpZCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQgU2hh ZGluZyBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2MSIgTmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgMSIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVtIFNo YWRpbmcgMSBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI2NCIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMiBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2Nl bnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IE5hbWU9IlJldmlzaW9uIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjM0IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJMaXN0IFBhcmFncmFwaCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIyOSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0i UXVvdGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzAiIFFG b3JtYXQ9InRydWUiIE5hbWU9IkludGVuc2UgUXVvdGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIE5hbWU9Ik1lZGl1bSBMaXN0IDIgQWNjZW50IDEiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1 bSBHcmlkIDEgQWNjZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNjZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5hbWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9 IkRhcmsgTGlzdCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI3MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGluZyBBY2NlbnQgMSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCBB Y2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIg TmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQgU2hhZGluZyBBY2NlbnQgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MSIgTmFtZT0iTGlnaHQgTGlz dCBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2 MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMSBBY2NlbnQgMiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NCIgTmFtZT0iTWVkaXVt IFNoYWRpbmcgMiBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIgTmFtZT0iTWVkaXVtIExpc3QgMiBBY2Nl bnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NyIgTmFt ZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI2OCIgTmFtZT0iTWVkaXVtIEdyaWQgMiBBY2NlbnQgMiIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OSIgTmFtZT0iTWVkaXVtIEdyaWQg MyBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MCIgTmFtZT0iRGFyayBMaXN0IEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjcxIiBOYW1lPSJDb2xvcmZ1bCBTaGFkaW5nIEFjY2VudCAyIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcyIiBOYW1lPSJDb2xvcmZ1 bCBMaXN0IEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjczIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYwIiBOYW1lPSJMaWdodCBTaGFkaW5nIEFjY2VudCAz Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYxIiBOYW1lPSJM aWdodCBMaXN0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjYyIiBOYW1lPSJMaWdodCBHcmlkIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAxIEFjY2Vu dCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY0IiBOYW1l PSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjY1IiBOYW1lPSJNZWRpdW0gTGlzdCAxIEFjY2VudCAzIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY2IiBOYW1lPSJNZWRpdW0gTGlz dCAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjY3IiBOYW1lPSJNZWRpdW0gR3JpZCAxIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBOYW1lPSJNZWRpdW0gR3JpZCAyIEFjY2VudCAzIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY5IiBOYW1lPSJNZWRp dW0gR3JpZCAzIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjcwIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzEiIE5hbWU9IkNvbG9yZnVsIFNoYWRpbmcgQWNjZW50 IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzIiIE5hbWU9 IkNvbG9yZnVsIExpc3QgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNzMiIE5hbWU9IkNvbG9yZnVsIEdyaWQgQWNjZW50IDMiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIE5hbWU9IkxpZ2h0IFNoYWRpbmcg QWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEi IE5hbWU9IkxpZ2h0IExpc3QgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjIiIE5hbWU9IkxpZ2h0IEdyaWQgQWNjZW50IDQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjMiIE5hbWU9Ik1lZGl1bSBTaGFkaW5n IDEgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NjQiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIE5hbWU9Ik1lZGl1bSBMaXN0IDEgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIE5hbWU9Ik1l ZGl1bSBMaXN0IDIgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1bSBHcmlkIDEgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNj ZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5h bWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9IkRhcmsgTGlzdCBBY2NlbnQgNCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGlu ZyBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgTmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgNCIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQg U2hhZGluZyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI2MSIgTmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgNSIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVt IFNoYWRpbmcgMSBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2NCIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBB Y2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIg TmFtZT0iTWVkaXVtIExpc3QgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2NyIgTmFtZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgNSIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OCIgTmFtZT0iTWVkaXVtIEdy aWQgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2OSIgTmFtZT0iTWVkaXVtIEdyaWQgMyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MCIgTmFtZT0iRGFyayBMaXN0IEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcxIiBOYW1lPSJDb2xvcmZ1 bCBTaGFkaW5nIEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjcyIiBOYW1lPSJDb2xvcmZ1bCBMaXN0IEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNlcHRp b24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjczIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2Vu dCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYwIiBOYW1l PSJMaWdodCBTaGFkaW5nIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjYxIiBOYW1lPSJMaWdodCBMaXN0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYyIiBOYW1lPSJMaWdodCBHcmlkIEFjY2Vu dCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBOYW1l PSJNZWRpdW0gU2hhZGluZyAxIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjY0IiBOYW1lPSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCA2Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY1IiBOYW1lPSJNZWRpdW0g TGlzdCAxIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjY2IiBOYW1lPSJNZWRpdW0gTGlzdCAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY3IiBOYW1lPSJNZWRpdW0gR3JpZCAxIEFjY2VudCA2 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBOYW1lPSJN ZWRpdW0gR3JpZCAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjY5IiBOYW1lPSJNZWRpdW0gR3JpZCAzIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcwIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50 IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzEiIE5hbWU9 IkNvbG9yZnVsIFNoYWRpbmcgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNzIiIE5hbWU9IkNvbG9yZnVsIExpc3QgQWNjZW50IDYiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzMiIE5hbWU9IkNvbG9yZnVsIEdy aWQgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i MTkiIFFGb3JtYXQ9InRydWUiIE5hbWU9IlN1YnRsZSBFbXBoYXNpcyIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIyMSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iSW50 ZW5zZSBFbXBoYXNpcyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSIzMSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iU3VidGxlIFJlZmVyZW5jZSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzMiIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0i SW50ZW5zZSBSZWZlcmVuY2UiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iMzMiIFFGb3JtYXQ9InRydWUiIE5hbWU9IkJvb2sgVGl0bGUiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzciIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCaWJsaW9ncmFwaHkiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJUT0MgSGVhZGluZyIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MSIgTmFtZT0iUGxhaW4gVGFibGUgMSIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MiIgTmFtZT0iUGxh aW4gVGFibGUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0 MyIgTmFtZT0iUGxhaW4gVGFibGUgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0NCIgTmFtZT0iUGxhaW4gVGFibGUgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NSIgTmFtZT0iUGxhaW4gVGFibGUgNSIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MCIgTmFtZT0iR3JpZCBUYWJsZSBM aWdodCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFt ZT0iR3JpZCBUYWJsZSAxIExpZ2h0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iR3JpZCBUYWJsZSA0Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1lPSJHcmlk IFRhYmxlIDUgRGFyayIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2IENvbG9yZnVsIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9IkdyaWQg VGFibGUgMSBMaWdodCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0NyIgTmFtZT0iR3JpZCBUYWJsZSAyIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ4IiBOYW1lPSJHcmlkIFRhYmxlIDMgQWNj ZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5h bWU9IkdyaWQgVGFibGUgNCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iR3JpZCBUYWJsZSA1IERhcmsgQWNjZW50IDEiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9IkdyaWQgVGFi bGUgNiBDb2xvcmZ1bCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI1MiIgTmFtZT0iR3JpZCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCAxIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJHcmlkIFRh YmxlIDEgTGlnaHQgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNDciIE5hbWU9IkdyaWQgVGFibGUgMiBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OCIgTmFtZT0iR3JpZCBUYWJsZSAzIEFjY2Vu dCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1l PSJHcmlkIFRhYmxlIDQgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNTAiIE5hbWU9IkdyaWQgVGFibGUgNSBEYXJrIEFjY2VudCAyIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJHcmlkIFRhYmxl IDYgQ29sb3JmdWwgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNTIiIE5hbWU9IkdyaWQgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iR3JpZCBUYWJs ZSAxIExpZ2h0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyBBY2NlbnQg MyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0i R3JpZCBUYWJsZSA0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjUwIiBOYW1lPSJHcmlkIFRhYmxlIDUgRGFyayBBY2NlbnQgMyIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2 IENvbG9yZnVsIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDMiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9IkdyaWQgVGFibGUg MSBMaWdodCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI0NyIgTmFtZT0iR3JpZCBUYWJsZSAyIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ4IiBOYW1lPSJHcmlkIFRhYmxlIDMgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikdy aWQgVGFibGUgNCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI1MCIgTmFtZT0iR3JpZCBUYWJsZSA1IERhcmsgQWNjZW50IDQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9IkdyaWQgVGFibGUgNiBD b2xvcmZ1bCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI1MiIgTmFtZT0iR3JpZCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCA0Ii8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJHcmlkIFRhYmxlIDEg TGlnaHQgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNDciIE5hbWU9IkdyaWQgVGFibGUgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OCIgTmFtZT0iR3JpZCBUYWJsZSAzIEFjY2VudCA1Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJHcmlk IFRhYmxlIDQgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNTAiIE5hbWU9IkdyaWQgVGFibGUgNSBEYXJrIEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJHcmlkIFRhYmxlIDYgQ29s b3JmdWwgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNTIiIE5hbWU9IkdyaWQgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgNSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iR3JpZCBUYWJsZSAxIExp Z2h0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyBBY2NlbnQgNiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iR3JpZCBU YWJsZSA0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjUwIiBOYW1lPSJHcmlkIFRhYmxlIDUgRGFyayBBY2NlbnQgNiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2IENvbG9y ZnVsIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdo dCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0i TGlzdCBUYWJsZSAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iTGlzdCBUYWJsZSA1IERhcmsiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFi bGUgNiBDb2xvcmZ1bCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI1MiIgTmFtZT0iTGlzdCBUYWJsZSA3IENvbG9yZnVsIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJMaXN0IFRhYmxlIDEgTGlnaHQgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDciIE5hbWU9 Ikxpc3QgVGFibGUgMiBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0OCIgTmFtZT0iTGlzdCBUYWJsZSAzIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJMaXN0IFRhYmxlIDQgQWNj ZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTAiIE5h bWU9Ikxpc3QgVGFibGUgNSBEYXJrIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJMaXN0IFRhYmxlIDYgQ29sb3JmdWwgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTIiIE5hbWU9 Ikxpc3QgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iTGlzdCBUYWJsZSAxIExpZ2h0IEFjY2VudCAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ3IiBOYW1lPSJM aXN0IFRhYmxlIDIgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNDgiIE5hbWU9Ikxpc3QgVGFibGUgMyBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iTGlzdCBUYWJsZSA0IEFjY2Vu dCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1l PSJMaXN0IFRhYmxlIDUgRGFyayBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iTGlzdCBUYWJsZSA2IENvbG9yZnVsIEFjY2VudCAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJM aXN0IFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdodCBBY2NlbnQgMyIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0iTGlz dCBUYWJsZSAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCBBY2NlbnQg MyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0i TGlzdCBUYWJsZSA1IERhcmsgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFibGUgNiBDb2xvcmZ1bCBBY2NlbnQgMyIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MiIgTmFtZT0iTGlz dCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJMaXN0IFRhYmxlIDEgTGlnaHQgQWNjZW50IDQiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDciIE5hbWU9Ikxpc3Qg VGFibGUgMiBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI0OCIgTmFtZT0iTGlzdCBUYWJsZSAzIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJMaXN0IFRhYmxlIDQgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTAiIE5hbWU9Ikxp c3QgVGFibGUgNSBEYXJrIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJMaXN0IFRhYmxlIDYgQ29sb3JmdWwgQWNjZW50IDQiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTIiIE5hbWU9Ikxpc3Qg VGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iTGlzdCBUYWJsZSAxIExpZ2h0IEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ3IiBOYW1lPSJMaXN0IFRh YmxlIDIgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNDgiIE5hbWU9Ikxpc3QgVGFibGUgMyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iTGlzdCBUYWJsZSA0IEFjY2VudCA1Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1lPSJMaXN0 IFRhYmxlIDUgRGFyayBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI1MSIgTmFtZT0iTGlzdCBUYWJsZSA2IENvbG9yZnVsIEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJMaXN0IFRh YmxlIDcgQ29sb3JmdWwgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdodCBBY2NlbnQgNiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0iTGlzdCBUYWJs ZSAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCBBY2NlbnQgNiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iTGlzdCBU YWJsZSA1IERhcmsgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFibGUgNiBDb2xvcmZ1bCBBY2NlbnQgNiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MiIgTmFtZT0iTGlzdCBUYWJs ZSA3IENvbG9yZnVsIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ik1lbnRpb24iLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iU21hcnQgSHlwZXJsaW5rIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9Ikhhc2h0YWciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVW5yZXNvbHZlZCBNZW50aW9uIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRl V2hlblVzZWQ9InRydWUiIE5hbWU9IlNtYXJ0IExpbmsiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i U21hcnQgTGluayBFcnJvciIvPg0KPC93OkxhdGVudFN0eWxlcz4NCjwveG1sPjwhW2VuZGlmXS0t PjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYgMyAyIDQ7DQoJ bXNvLWZvbnQtY2hhcnNldDowOw0KCW1zby1nZW5lcmljLWZvbnQtZmFtaWx5OnJvbWFuOw0KCW1z by1mb250LXBpdGNoOnZhcmlhYmxlOw0KCW1zby1mb250LXNpZ25hdHVyZTotNTM2ODY5MTIxIDEx MDczMDU3MjcgMzM1NTQ0MzIgMCA0MTUgMDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNh bGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7DQoJbXNvLWZvbnQtY2hhcnNl dDowOw0KCW1zby1nZW5lcmljLWZvbnQtZmFtaWx5OnN3aXNzOw0KCW1zby1mb250LXBpdGNoOnZh cmlhYmxlOw0KCW1zby1mb250LXNpZ25hdHVyZTotNTM2ODU4ODgxIC0xMDczNzMyNDg1IDkgMCA1 MTEgMDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1h bCwgZGl2Lk1zb05vcm1hbA0KCXttc28tc3R5bGUtdW5oaWRlOm5vOw0KCW1zby1zdHlsZS1xZm9y bWF0OnllczsNCgltc28tc3R5bGUtcGFyZW50OiIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJv dHRvbTouMDAwMXB0Ow0KCW1zby1wYWdpbmF0aW9uOndpZG93LW9ycGhhbjsNCglmb250LXNpemU6 MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0 LWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28t c3R5bGUtbm9zaG93OnllczsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsN Cgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lOw0KCXRleHQtdW5kZXJsaW5lOnNpbmdsZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLW5vc2hvdzp5 ZXM7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29y YXRpb246dW5kZXJsaW5lOw0KCXRleHQtdW5kZXJsaW5lOnNpbmdsZTt9DQpwLm1zb25vcm1hbDAs IGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1h bDsNCgltc28tc3R5bGUtdW5oaWRlOm5vOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1h cmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxl ZnQ6MGluOw0KCW1zby1wYWdpbmF0aW9uOndpZG93LW9ycGhhbjsNCglmb250LXNpemU6MTEuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0LWZvbnQt ZmFtaWx5OkNhbGlicmk7fQ0Kc3Bhbi5nbWFpbC1tLTMwMDgxMjk4NjE4NjYwODM1OThzcGVsbGUN Cgl7bXNvLXN0eWxlLW5hbWU6Z21haWwtbV8tMzAwODEyOTg2MTg2NjA4MzU5OHNwZWxsZTsNCglt c28tc3R5bGUtdW5oaWRlOm5vO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBl OnBlcnNvbmFsLXJlcGx5Ow0KCW1zby1zdHlsZS1ub3Nob3c6eWVzOw0KCW1zby1zdHlsZS11bmhp ZGU6bm87DQoJbXNvLWFuc2ktZm9udC1zaXplOjExLjBwdDsNCgltc28tYmlkaS1mb250LXNpemU6 MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1hc2NpaS1m b250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ bXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRp bWVzIE5ldyBSb21hbiI7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXtt c28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCgltc28tZGVmYXVsdC1wcm9wczp5ZXM7DQoJZm9u dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWFzY2lpLWZvbnQtZmFtaWx5OkNh bGlicmk7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28taGFuc2ktZm9u dC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFu Ijt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEu MGluIDEuMGluIDEuMGluIDEuMGluOw0KCW1zby1oZWFkZXItbWFyZ2luOi41aW47DQoJbXNvLWZv b3Rlci1tYXJnaW46LjVpbjsNCgltc28tcGFwZXItc291cmNlOjA7fQ0KZGl2LldvcmRTZWN0aW9u MQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyAxMF0+ PHN0eWxlPi8qIFN0eWxlIERlZmluaXRpb25zICovDQp0YWJsZS5Nc29Ob3JtYWxUYWJsZQ0KCXtt c28tc3R5bGUtbmFtZToiVGFibGUgTm9ybWFsIjsNCgltc28tdHN0eWxlLXJvd2JhbmQtc2l6ZTow Ow0KCW1zby10c3R5bGUtY29sYmFuZC1zaXplOjA7DQoJbXNvLXN0eWxlLW5vc2hvdzp5ZXM7DQoJ bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1wYXJlbnQ6IiI7DQoJbXNvLXBhZGRp bmctYWx0OjBpbiA1LjRwdCAwaW4gNS40cHQ7DQoJbXNvLXBhcmEtbWFyZ2luOjBpbjsNCgltc28t cGFyYS1tYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJbXNvLXBhZ2luYXRpb246d2lkb3ctb3JwaGFu Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 DQoJbXNvLWFzY2lpLWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJbXNvLWhhbnNpLWZvbnQtZmFtaWx5 OkNhbGlicmk7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KPC9z dHlsZT48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVs dHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0t W2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlk bWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2Vu ZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJw dXJwbGUiIHN0eWxlPSJ0YWItaW50ZXJ2YWw6LjVpbiI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlv bjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWFzY2lpLWZvbnQtZmFtaWx5OkNhbGli cmk7bXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWJpZGktZm9udC1mYW1pbHk6JnF1 b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2ZvbnQ+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWFzY2lpLWZvbnQtZmFtaWx5OkNhbGli cmk7bXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWJpZGktZm9udC1mYW1pbHk6JnF1 b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2ZvbnQ+ PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVw dDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxm b250IHNpemU9IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O21zby1mYXJlYXN0LWZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90Oztmb250 LXdlaWdodDpib2xkIj5Gcm9tOjwvc3Bhbj48L2ZvbnQ+PC9iPjxzcGFuIHN0eWxlPSJtc28tZmFy ZWFzdC1mb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiBCZW4gU2Nod2Fy dHogJmx0O2JlbWFzY0Bnb29nbGUuY29tJmd0Ow0KPGJyIHN0eWxlPSJtc28tc3BlY2lhbC1jaGFy YWN0ZXI6bGluZS1icmVhayI+DQo8IVtpZiAhc3VwcG9ydExpbmVCcmVha05ld0xpbmVdPjxiciBz dHlsZT0ibXNvLXNwZWNpYWwtY2hhcmFjdGVyOmxpbmUtYnJlYWsiPg0KPCFbZW5kaWZdPjwvc3Bh bj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9IjIi IGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5PbiBXZWQsIEp1 bCAyMiwgMjAyMCBhdCA0OjI3IFBNIFNUQVJLLCBCQVJCQVJBIEggJmx0OzxhIGhyZWY9Im1haWx0 bzpiczc2NTJAYXR0LmNvbSI+YnM3NjUyQGF0dC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpw Pjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7bXNvLWJvcmRlci1sZWZ0 LWFsdDpzb2xpZCAjQ0NDQ0NDIC43NXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2lu LWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGlu IDBpbiA0LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i Pjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0Ij5UTDtEUjogSSB0aGluayB0aGUgbmV0d29yayBuZWVkcyB0byBiZSBhYmxlIHRvIGluZGlj YXRlIHdoZXRoZXIgbmV0d29yayBwb2xpY3kgYWxsb3dzIHVzZSBvZiBETlMvPHNwYW4gY2xhc3M9 ImdtYWlsLW0tMzAwODEyOTg2MTg2NjA4MzU5OHNwZWxsZSI+RG9IPC9zcGFuPg0KIHNlcnZlcnMg b3RoZXIgdGhhbiB0aG9zZSBpdCBhZHZlcnRpc2VzLCBhbmQgdXNlcnMgKHdobyBoYXZlIGJlZW4g aW5mb3JtZWQgb2YgdGhlIG5ldHdvcmsgcG9saWN5KSBjYW4gZGVjaWRlIHdoZXRoZXIgb3Igbm90 IHRoZXkgd2FudCB0byB1c2UgdGhlIGxvY2FsbHkgYWR2ZXJ0aXNlZA0KPHNwYW4gY2xhc3M9Imdt YWlsLW0tMzAwODEyOTg2MTg2NjA4MzU5OHNwZWxsZSI+RG9IPC9zcGFuPiBzZXJ2ZXJzIChpLmUu LCB0aGVyZSBhcmUganVzdCAyIHR5cGVzIG9mIG5ldHdvcmtzIOKAkyAoMSkgdXNlIGFkdmVydGlz ZWQgRE5TLzxzcGFuIGNsYXNzPSJnbWFpbC1tLTMwMDgxMjk4NjE4NjYwODM1OThzcGVsbGUiPkRv SDwvc3Bhbj4gYW5kICgyKSBkb27igJl0IHVzZSBhZHZlcnRpc2VkIEROUy88c3BhbiBjbGFzcz0i Z21haWwtbS0zMDA4MTI5ODYxODY2MDgzNTk4c3BlbGxlIj5Eb0g8L3NwYW4+KS4NCiBXaGF0IHRo ZSBuZXR3b3JrIGRvZXMgdG8gZGV0ZWN0IGFuZCBoYW5kbGUgdmlvbGF0aW9ucyBvZiBpdHMgcG9s aWN5IGlzIG91dCBvZiBzY29wZS4gVGhlIG5ldHdvcmsganVzdCBuZWVkcyB0byBiZSBhYmxlIHRv IGV4cHJlc3MgaXRzIHBvbGljeS48bzpwPjwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGlicmki PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5OZXR3b3JrIG9wZXJhdG9ycyBjYW4gY2Vy dGFpbmx5IGhhdmUgdGVybXMgb2Ygc2VydmljZSBhbmQgdXNhZ2UgcG9saWNpZXMuJm5ic3A7IEkg d291bGQgbm90IHN1cHBvcnQgbWFraW5nIGEgc3BlY2lhbCBtZWNoYW5pc20ganVzdCBmb3IgdGhl IHBvbGljeSByZWxhdGVkIHRvIEROUyBzZXJ2ZXIgc2VsZWN0aW9uLA0KIHRvIGJlIHByZXNlbnRl ZCB0byB0aGUgdXNlciBpbiBpc29sYXRpb24gZnJvbSBhbnkgb3RoZXIgYnJhbmRpbmcsIGFkdmlj ZSwgZGVtYW5kcywgYW5kIGxlZ2FsZXNlLiZuYnNwOyBJbiBvdGhlciB3b3JkcywgdGhpcyBwcm9i bGVtIGlzIG5vdCBzcGVjaWZpYyB0byBETlMsIHNvIEFERCBpcyBub3QgdGhlIHBsYWNlIGZvciBp dC4mbmJzcDsgUGVyc29uYWxseSwgSSB3b3VsZCBwdXQgaXQgaW4gQ0FQUE9SVCwgYmVjYXVzZSBu ZXR3b3JrIG9wZXJhdG9yIHRlcm1zIG9mDQogc2VydmljZSBhcmUgbW9zdCBuYXR1cmFsbHkgcHJl c2VudGVkIHZpYSBhIGNhcHRpdmUgcG9ydGFsLjxvOnA+PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYXNjaWktZm9udC1mYW1pbHk6Q2FsaWJyaTtt c28taGFuc2ktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28tYmlkaS1mb250LWZhbWlseTomcXVvdDtU aW1lcyBOZXcgUm9tYW4mcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYXNjaWktZm9udC1mYW1pbHk6Q2FsaWJyaTtt c28taGFuc2ktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28tYmlkaS1mb250LWZhbWlseTomcXVvdDtU aW1lcyBOZXcgUm9tYW4mcXVvdDsiPkkgd2FudCBkZXZpY2VzIGFuZCBhcHBsaWNhdGlvbnMgaW5z aWRlIG15IGhvbWUgbmV0d29yayB0byBrbm93IHRoYXQgSSB3YW50IHRoZW0NCiB0byB1c2UgdGhl IEROUyByZXNvbHZlcnMgbXkgaG9tZSBuZXR3b3JrIGFkdmVydGlzZXMuIEkgZG9u4oCZdCB3YW50 IHRvIGhhdmUgdG8gY29uZmlndXJlIGEgY2FwdGl2ZSBwb3J0YWwgZm9yIG15IGhvbWUgbmV0d29y ay4gVGhhdOKAmXMgc2lsbHkuIEFuZCBteSBob21lIG5ldHdvcmvigJlzIEROUyBwb2xpY3kgaXMg YWJzb2x1dGVseSBzcGVjaWZpYyB0byBETlMuIEl04oCZcyBhbHNvIHNpbXBsZTogTXkgcG9saWN5 IGlzIGVpdGhlciAoMSkgSSBkb27igJl0IGNhcmUNCiB3aGF0IHJlc29sdmVycyB0aGUgYXBwIG9y IGRldmljZSB1c2VzLCBvciAoMikgSSBleHBlY3QgYXBwcyBhbmQgZGV2aWNlcyB0byB1c2UgdGhl IHJlc29sdmVycyBteSBuZXR3b3JrIGFkdmVydGlzZXMgKGFuZCBkZXZpY2VzL2FwcHMgdGhhdCBk b27igJl0IGFyZSBzdXNwZWN0ZWQgdG8gYmUgY29tcHJvbWlzZWQvbWFsd2FyZSBhbmQgbWF5IGJl IHRyZWF0ZWQgYXMgc3VjaCkuIFRoZXNlIGFyZW7igJl0IHRlcm1zIGFuZCBjb25kaXRpb25zIGZv ciBzb21lb25lDQogdG8gYWdyZWUgdG8uIEl04oCZcyBiaW5hcnkgaW5mb3JtYXRpb24uIEhvdyBv ciB3aGV0aGVyIGFuIGFwcCBvciBkZXZpY2Ugb3IgbWFsd2FyZSBwcmVzZW50cyB0aGlzIGluZm9y bWF0aW9uIHRvIGEgdXNlciBpcyB1cCB0byB0aGUgYXBwL2RldmljZS9tYWx3YXJlLiBJIGV4cGVj dCBhbGwgbWFsd2FyZSB0byBjb21wbGV0ZWx5IGlnbm9yZSBteSB3aXNoZXMuDQo8c3BhbiBzdHls ZT0ibXNvLXNwYWNlcnVuOnllcyI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJtc28tc3BhY2Vy dW46eWVzIj4mbmJzcDs8L3NwYW4+LSBCYXJiYXJhPG86cD48L286cD48L3NwYW4+PC9mb250Pjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0 bWw+DQo= --_000_e567166b70854a658bad26e32c50d8edattcom_-- From nobody Wed Jul 22 14:27:35 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A33E33A09E3 for ; Wed, 22 Jul 2020 14:27:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WAN9nYA_5zPo for ; Wed, 22 Jul 2020 14:27:28 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7AC33A09E4 for ; Wed, 22 Jul 2020 14:27:27 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id ABEFB38A1D; Wed, 22 Jul 2020 17:06:58 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 1se0Q6LKYkSx; Wed, 22 Jul 2020 17:06:57 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 2986038A10; Wed, 22 Jul 2020 17:06:57 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 8AC7B1CB; Wed, 22 Jul 2020 17:27:23 -0400 (EDT) From: Michael Richardson To: "STARK\, BARBARA H" , 'ADD Mailing list' In-Reply-To: References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> <20200721095240.GA10868@nic.fr> <2afd9527aab8477ea19217eec2f49e44@att.com> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 21:27:30 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable STARK, BARBARA H wrote: > I want devices and applications inside my home network to know that I > want them to use the DNS resolvers my home network advertises. I don= =E2=80=99t > want to have to configure a captive portal for my home network. That= =E2=80=99s > silly. And my home network=E2=80=99s DNS policy is absolutely specifi= c to I find that the CAPPORT API interface is rather interesting because it is an API to the local network that devices can programmatically connect to. There doesn't have to be a "captive portal" (web page with silly logo) to u= se the CAPPORT API. It can easily be built in to home routers, or IoT security devices. The most useful thing that I've proposed (with reasonable reception from CAPPORT) is that there be an API return that says "quarantine" to a device. I think that this is pretty important. As Paul and others have said: it important that devices are able to understand that the network connectivity challenges they are experiencing a= re intentional. =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl8YrzsACgkQgItw+93Q 3WWR6Qf/YFP0shn8zPaPdIlucNZWi99UhrJgj+uZmPRXtEp2czRT7p9tI18DQT8U 1h7326bk7QBa2aHoC7NH/N5+1uSkF7e57qtnRjQuSM+Rah+hreC7EETYFuzXT2Ys 9frstaS1z8u7AozWxM6I4AllN1pvMSmumFtEITEEdBXKSE/ztI0nDH5TGZH1aVIo fW73/KPxbWKAJp79w6ZhWFiToEvx+oasTKpKlwF4ksh0o8wtjI9vAl49/IK/sSEJ 4J9yCIeqC9ENsvutLXNEmyr4TXR0olTrj4tBjQcnrJcuPhvUJwdGaYhCTgwvqcYL MW5okXgx5SD+2WlZYhOnVjBA7BUJkw== =TKUp -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Jul 22 16:15:58 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBE923A093D for ; Wed, 22 Jul 2020 16:15:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pjej16f7hsd6 for ; Wed, 22 Jul 2020 16:15:54 -0700 (PDT) Received: from sdaoden.eu (sdaoden.eu [217.144.132.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5000E3A093C for ; Wed, 22 Jul 2020 16:15:53 -0700 (PDT) Received: by sdaoden.eu (Postfix, from userid 1000) id CE2D71605C; Thu, 23 Jul 2020 01:15:51 +0200 (CEST) Date: Thu, 23 Jul 2020 01:15:51 +0200 From: Steffen Nurpmeso To: Paul Hoffman Cc: "Deen, Glenn" , ADD Mailing list , Steffen Nurpmeso Message-ID: <20200722231551.PYFQy%steffen@sdaoden.eu> In-Reply-To: <617AD3F5-1E97-420B-8D04-D9F1616AFFF0@icann.org> References: <5990D901-60E1-474C-BC18-94F069C0201A@nbcuni.com> <150cdf53-e9d8-9f76-4456-5c73c4dbdc79@ericsson.com> <617AD3F5-1E97-420B-8D04-D9F1616AFFF0@icann.org> Mail-Followup-To: Paul Hoffman , "Deen, Glenn" , ADD Mailing list , Steffen Nurpmeso User-Agent: s-nail v14.9.19-87-gef7dc32e OpenPGP: id=EE19E1C1F2F7054F8D3954D8308964B51883A0DD; url=https://ftp.sdaoden.eu/steffen.asc; preference=signencrypt BlahBlahBlah: Any stupid boy can crush a beetle. But all the professors in the world can make no bugs. Archived-At: Subject: Re: [Add] [Ext] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 23:15:56 -0000 Paul Hoffman wrote in <617AD3F5-1E97-420B-8D04-D9F1616AFFF0@icann.org>: |On Jul 22, 2020, at 12:49 PM, Deen, Glenn wrote: |> |> While I 100% agree that not all users are equal, they all do have \ |> the power to make choices when they connect to a network. | |There is widespread disagreement on the latter point. Proposals for \ And especially if it involves such an immense technical background, beyond traffic light systems for things like cola. |operational practices and/or protocols that rely on that point are \ |doomed to interminable discussion. I favour separation of well-tested modules (since ever), so DNS+D/TLS, xy+D/TLS etc. That is hard for a light bulb which is used first five years after it has been bought, even if DHCP would be DHCP+DTLS, shall Michael Richardson have blinked in this direction. It is either root server based, ca-certificate based or company-specific verification, then. Bluetooth-like pairing btw worked for my 2019 TV of a company from the Netherlands only with verification on the computer side, i did not see the ID on the TV. (It also has serious software problems, and the PDF handbook, copyright 2018, like i think the entire TV series, which earned industry prices, mentions OpenSSL 1.0.1j, glibc 2.12.2, Libcurl 7.30.0, and i have disabled internet access for it. I do not know.) --steffen | |Der Kragenbaer, The moon bear, |der holt sich munter he cheerfully and one by one |einen nach dem anderen runter wa.ks himself off |(By Robert Gernhardt) From nobody Wed Jul 22 17:15:31 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 17AC13A0A47 for ; Wed, 22 Jul 2020 17:15:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.12 X-Spam-Level: X-Spam-Status: No, score=-2.12 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=apple.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dcbO1EB5rj3w for ; Wed, 22 Jul 2020 17:15:27 -0700 (PDT) Received: from ma1-aaemail-dr-lapp01.apple.com (ma1-aaemail-dr-lapp01.apple.com [17.171.2.60]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B7FC03A0A4A for ; Wed, 22 Jul 2020 17:15:27 -0700 (PDT) Received: from pps.filterd (ma1-aaemail-dr-lapp01.apple.com [127.0.0.1]) by ma1-aaemail-dr-lapp01.apple.com (8.16.0.42/8.16.0.42) with SMTP id 06N07Ruc027419; Wed, 22 Jul 2020 17:15:24 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apple.com; h=from : message-id : content-type : mime-version : subject : date : in-reply-to : cc : to : references; s=20180706; bh=Efwkx0EkOdkRAAL87gfzCR6ZQLAjvn4SUgwx1STwn6U=; b=cZ7ccoQYZeWTIV6t718TF/g/NwECRGCL8AtTxddSfHA8SntIb3fayhELQDewTLrcmtGi S7DsrpXt9dcXo0LC5KMT7P5JEV+kTjulpyzT0leCrQUBjEbwayDmmwGLC4BK2dxk2fW+ SaaQ4VR42oGk/C0yTbSsGHgOMgwA/gstjqCEMrCVLuQOEwk+CzmY1FeyTHuSMerH5OSp VfSAnjYZNFUY4vakHVH8dAdnSOA7304lDh2iXxfjX/3wFPJqo20yMF1UzLuRC/+ytkrD WLE2MiSYW+rLi/AxOaWbkDucbHYXrS1t8yR2Ec7XL1KSfZzfjGIdlwwm1vN+xS4Wlq9Q 0Q== Received: from rn-mailsvcp-mta-lapp02.rno.apple.com (rn-mailsvcp-mta-lapp02.rno.apple.com [10.225.203.150]) by ma1-aaemail-dr-lapp01.apple.com with ESMTP id 32byr3cdub-4 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Wed, 22 Jul 2020 17:15:24 -0700 Received: from rn-mailsvcp-mmp-lapp03.rno.apple.com (rn-mailsvcp-mmp-lapp03.rno.apple.com [17.179.253.16]) by rn-mailsvcp-mta-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPS id <0QDW00GRPBDNR6G0@rn-mailsvcp-mta-lapp02.rno.apple.com>; Wed, 22 Jul 2020 17:15:23 -0700 (PDT) Received: from process_milters-daemon.rn-mailsvcp-mmp-lapp03.rno.apple.com by rn-mailsvcp-mmp-lapp03.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) id <0QDW00I00BDGEZ00@rn-mailsvcp-mmp-lapp03.rno.apple.com>; Wed, 22 Jul 2020 17:15:23 -0700 (PDT) X-Va-A: X-Va-T-CD: 2ce39ff0c0ed9d51382b7e8c781d4e54 X-Va-E-CD: 70bcdc11c9d31840c4d740c8fd997a66 X-Va-R-CD: 9efa4d046db31f83a71c66eaba62594d X-Va-CD: 0 X-Va-ID: a2506f46-c9d6-42fc-8b3a-c6fe12f66645 X-V-A: X-V-T-CD: 2ce39ff0c0ed9d51382b7e8c781d4e54 X-V-E-CD: 70bcdc11c9d31840c4d740c8fd997a66 X-V-R-CD: 9efa4d046db31f83a71c66eaba62594d X-V-CD: 0 X-V-ID: 50688afa-59c8-443b-9130-ef18be1f6b35 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-22_16:2020-07-22, 2020-07-22 signatures=0 Received: from [17.234.41.20] (unknown [17.234.41.20]) by rn-mailsvcp-mmp-lapp03.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPSA id <0QDW00SEEBDLWB00@rn-mailsvcp-mmp-lapp03.rno.apple.com>; Wed, 22 Jul 2020 17:15:23 -0700 (PDT) From: Tommy Pauly Message-id: Content-type: multipart/alternative; boundary="Apple-Mail=_2CF46F70-238F-4E2C-9892-AE85583FD18F" MIME-version: 1.0 (Mac OS X Mail 13.4 \(3608.80.7.2.3\)) Date: Wed, 22 Jul 2020 17:15:21 -0700 In-reply-to: Cc: Stephane Bortzmeyer , David Schinazi , ADD Mailing list , Tommy Pauly To: Ben Schwartz References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> X-Mailer: Apple Mail (2.3608.80.7.2.3) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-22_16:2020-07-22, 2020-07-22 signatures=0 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 00:15:30 -0000 --Apple-Mail=_2CF46F70-238F-4E2C-9892-AE85583FD18F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Ben, Thanks for the comments and thoughts! Responses inline. > On Jul 22, 2020, at 1:34 PM, Ben Schwartz = wrote: >=20 > I had some more time to read this and try to understand it. Some more = questions: >=20 > Why is DNSSEC needed for use of =E2=80=9Cdohuri=E2=80=9D in = SVCB/HTTPS? An attacker who can inject this record can also inject = false AAAA records for any names of interest, allowing them to proxy and = observe all the user=E2=80=99s traffic (and disable ECH). I can believe = there's a relevant attack, but it would help to have an explanation for = it. We want to verify the designation if we=E2=80=99re going to start = steering traffic to a new resolver. This is indeed a higher bar than = what an attacker can do for a cleartext record. Note that DNSSEC is not the only way to prove that the designation is = legitimate. It can also happen by checking HTTPS resources that are = signed with a name that matches the name or is a parent of the name = doing the designation. For the attack about a user disabling ECH, etc, by blocking packets, = that=E2=80=99s an area where a client can protect itself by having a = default encrypted resolver, or by using a mechanism like Oblivious DoH. >=20 > PvD: The use of "https://example.com/.well-known/pvd = " makes sense to me, but the use of = =E2=80=9Chttps://doh.example.net/.well-known/pvd/dns-query = " seems very odd. = Instead, could you do a GET for the DoH URI template with no =E2=80=9Cdns=E2= =80=9D parameter, setting the Accept header to = =E2=80=9Capplication/pvd+json=E2=80=9D? That would avoid the need for = coupling across distant paths, and avoid .well-known=E2=80=99s = implication that these are logically properties of the entire origin. The point of this way of finding the well-known JSON by taking the path = into account is to allow specifying information in case multiple DoH = servers are running on a given host. However, it certainly could be OK to do the query like you mention=E2=80=94= for our server implementation, it was easier to split out the hosting of = a JSON file as opposed to handling DNS messages based on a path, rather = than merely an accept content type. It was mainly a practical concern. = Happy to bikeshed. >=20 > I'm having trouble understanding which of these mechanisms applies to = a whole subdomain tree, and which apply only to the named domain. (And = even more trouble understanding why, or why not.) I=E2=80=99ve filed an issue to help address this. In general, a = designation applies to the whole subdomain tree, but we want to add some = additional information in the JSON data to indicate if there is a given = subdomain that should be explicitly separated. https://github.com/tfpauly/draft-pauly-adaptive-dns-privacy/issues/121 = Of course, if a more specific subdomain has a different designation, = that already would take precedence and cause clients to switch over. >=20 > This draft's PvD mechanism (+PUSH) also seems to overlap considerably = with draft-schinazi-httpbis-doh-preference-hints, which proposes a = "DoH-Preference" response header. I think we should probably avoid = standardizing both. The comparison is interesting: I=E2=80=99m not sure = PvD is really the right semantic for this use case, but I do like that = it=E2=80=99s explicitly scoped to the domain. A response header is = syntactically scoped to a single response, although HTTP headers have = been used to convey a variety of domain-wide information. >=20 > One key difference might be how these approaches interact with caching = reverse proxies. With a (naive) caching reverse proxy in the middle, = I=E2=80=99m not sure how HTTP/2 PUSH would work. The DoH-Preference = header would work, but it would have to be attached to every response, = which seems inefficient. We will discuss this more in the ADD meeting. I think the preference = hints proposal mainly overlaps with the discovery mechanism over DoH, as = opposed to the mechanism to discover additional information. =46rom the = discovery perspective, we believe that a solution based in DNS and SVCB = makes more sense for the DNS operator (with multi-CDN concerns, etc) = than putting things in an origin=E2=80=99s response headers. As for the information, mainly we believe there just needs to be some = content (probably JSON) that a client can query on a DoH server to get = information about how it can be used. The reason we like PvD here is = that it can align with a resolver configuration blob that can be sent = directly from a local network. Generally, the reason I see this as = fitting PvD semantics is that, since resolver configurations and = split-DNS configurations are inherently defining a new set of consistent = information about accessing the Internet, it falls under the same = purpose as PvD additional information. But this can be a bikeshed too! >=20 Going to your previous comment/suggestion: I don't claim to have understood this proposal in full (for starters, = I'm not familiar with PvD), but it seems like a plausible direction to = me. One small, but perhaps consequential suggestion: Instead of placing a "dohuri" SvcParamKey in the HTTPS record (Section = 3.1), I think it would be better to put a domain name there (e.g. = "resolver=3Ddoh.example.net"). Then the client would do a SVCB query = for "_dns.doh.example.net", retrieving a SVCB record containing the DoH = URI (as in Section 5). This adds a roundtrip, but I think it maintains = better separation of concerns (e.g. server choice vs. protocol choice). = If lookup latency is a problem, I think we could find an optional = optimization to collapse this roundtrip (perhaps with a design much like = the current draft). More generally, any use of SVCB requires a mapping document for the = scheme. I'd be happy to help write a mapping document for dns:// -> = _dns, if we decide to go in that direction. This is an interesting direction. Certainly, if we can look up the _dns = (dns://) SVCB type for a SUDN like resolver.arpa to upgrade a given = resolver, being able to look up that type on a domain seems like it = should work. I don=E2=80=99t love the idea of requiring an extra round trip, but I = could see that being mitigated if a given client already knows about a = resolver, and is just correlating them. I may suggest a middle-ground: let=E2=80=99s define the =E2=80=9Cresolver=3D= =E2=80=9C parameter for indicating a designated resolver name in the way = you suggest, but also be able to provide hint parameters like what we = have here to allow clients to skip the extra round trip if the resolver = information in the _dns record is simply a DoH URI or a DoT port. Best, Tommy >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add = > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_2CF46F70-238F-4E2C-9892-AE85583FD18F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Ben,

Thanks for the = comments and thoughts! Responses inline.

On Jul = 22, 2020, at 1:34 PM, Ben Schwartz <bemasc=3D40google.com@dmarc.ietf.org> wrote:

I had some more time to read this and try to = understand it.  Some more questions:

Why is DNSSEC needed for use of =E2=80=9Cdohuri=E2=80=9D = in SVCB/HTTPS?  An attacker who can inject this record can also = inject false AAAA records for any names of interest, allowing them to = proxy and observe all the user=E2=80=99s traffic (and disable = ECH).  I can believe there's a relevant attack, but it would help = to have an explanation for it.

We = want to verify the designation if we=E2=80=99re going to start steering = traffic to a new resolver. This is indeed a higher bar than what an = attacker can do for a cleartext record.

Note that DNSSEC is not the only way to prove that = the designation is legitimate. It can also happen by checking HTTPS = resources that are signed with a name that matches the name or is a = parent of the name doing the designation.

For the attack about a user disabling ECH, etc, by = blocking packets, that=E2=80=99s an area where a client can protect = itself by having a default encrypted resolver, or by using a mechanism = like Oblivious DoH.


PvD:= The use of "https://example.com/.well-known/pvd" makes sense to me, = but the use of =E2=80=9Chttps://doh.example.net/.well-known/pvd/dns-query" seems = very odd.  Instead, could you do a GET for the DoH URI template = with no =E2=80=9Cdns=E2=80=9D parameter, setting the Accept header to = =E2=80=9Capplication/pvd+json=E2=80=9D?  That would avoid the need = for coupling across distant paths, and avoid .well-known=E2=80=99s = implication that these are logically properties of the entire origin.

The = point of this way of finding the well-known JSON by taking the path into = account is to allow specifying information in case multiple DoH servers = are running on a given host.

However, = it certainly could be OK to do the query like you mention=E2=80=94for = our server implementation, it was easier to split out the hosting of a = JSON file as opposed to handling DNS messages based on a path, rather = than merely an accept content type. It was mainly a practical concern. = Happy to bikeshed.


I'm = having trouble understanding which of these mechanisms applies to a = whole subdomain tree, and which apply only to the named domain.  = (And even more trouble understanding why, or why not.)

I=E2=80=99ve= filed an issue to help address this. In general, a designation applies = to the whole subdomain tree, but we want to add some additional = information in the JSON data to indicate if there is a given subdomain = that should be explicitly separated.

https://github.com/tfpauly/draft-pauly-adaptive-dns-privacy/iss= ues/121

Of course, if a more = specific subdomain has a different designation, that already would take = precedence and cause clients to switch over.


This draft's PvD mechanism (+PUSH) = also seems to overlap considerably with = draft-schinazi-httpbis-doh-preference-hints, which proposes a = "DoH-Preference" response header.  I think we should probably avoid = standardizing both.  The comparison is interesting: I=E2=80=99m not = sure PvD is really the right semantic for this use case, but I do like = that it=E2=80=99s explicitly scoped to the domain.  A response = header is syntactically scoped to a single response, although HTTP = headers have been used to convey a variety of domain-wide = information.

One key difference might be = how these approaches interact with caching reverse proxies.  With a = (naive) caching reverse proxy in the middle, I=E2=80=99m not sure how = HTTP/2 PUSH would work.  The DoH-Preference header would work, but = it would have to be attached to every response, which seems = inefficient.

We will discuss this more in the ADD meeting. I = think the preference hints proposal mainly overlaps with the discovery = mechanism over DoH, as opposed to the mechanism to discover additional = information. =46rom the discovery perspective, we believe that a = solution based in DNS and SVCB makes more sense for the DNS operator = (with multi-CDN concerns, etc) than putting things in an origin=E2=80=99s = response headers.

As for the = information, mainly we believe there just needs to be some content = (probably JSON) that a client can query on a DoH server to get = information about how it can be used. The reason we like PvD here is = that it can align with a resolver configuration blob that can be sent = directly from a local network. Generally, the reason I see this as = fitting PvD semantics is that, since resolver configurations and = split-DNS configurations are inherently defining a new set of consistent = information about accessing the Internet, it falls under the same = purpose as PvD additional information. But this can be a bikeshed = too!



Going to your previous = comment/suggestion:

I don't claim to = have understood this proposal in full (for starters, I'm not familiar = with PvD), but it seems like a plausible direction to me.  One = small, but perhaps consequential = suggestion:

Instead of placing a "dohuri" SvcParamKey in the HTTPS record = (Section 3.1), I think it would be better to put a domain name there = (e.g. "resolver=3Ddoh.example.net").  Then the client would do a SVCB = query for "_dns.doh.example.net", retrieving a SVCB record containing = the DoH URI (as in Section 5).  This adds a roundtrip, but I = think it maintains better separation of concerns (e.g. server choice vs. = protocol choice).  If lookup latency is a problem, I think we = could find an optional optimization to collapse this roundtrip (perhaps = with a design much like the current = draft).

More = generally, any use of SVCB requires a mapping document for the scheme. =  I'd be happy to help write a mapping document for dns:// -> = _dns, if we decide to go in that = direction.

This = is an interesting direction. Certainly, if we can look up the _dns = (dns://) SVCB type for a SUDN like resolver.arpa to upgrade a given = resolver, being able to look up that type on a domain seems like it = should work.

I = don=E2=80=99t love the idea of requiring an extra round trip, but I = could see that being mitigated if a given client already knows about a = resolver, and is just correlating them.

I may suggest a middle-ground: let=E2=80=99= s define the =E2=80=9Cresolver=3D=E2=80=9C parameter for indicating a = designated resolver name in the way you suggest, but also be able to = provide hint parameters like what we have here to allow clients to skip = the extra round trip if the resolver information in the _dns record is = simply a DoH URI or a DoT port.

Best,
Tommy


--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_2CF46F70-238F-4E2C-9892-AE85583FD18F-- From nobody Thu Jul 23 01:42:28 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A9DFA3A0A78; Thu, 23 Jul 2020 01:42:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.117 X-Spam-Level: X-Spam-Status: No, score=-2.117 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=orange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LFO_hsxCeGVb; Thu, 23 Jul 2020 01:42:24 -0700 (PDT) Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.70.35]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F3E73A0A6E; Thu, 23 Jul 2020 01:42:24 -0700 (PDT) Received: from opfednr07.francetelecom.fr (unknown [xx.xx.xx.71]) by opfednr27.francetelecom.fr (ESMTP service) with ESMTP id 4BC5Ry6Llgz4xLs; Thu, 23 Jul 2020 10:42:22 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.com; s=ORANGE001; t=1595493742; bh=6rnApS4G+GVsN+gQ3P1LKRAmN7e14iqfhoVRaOT+sV8=; h=From:To:Subject:Date:Message-ID:Content-Type:MIME-Version; b=ifA9VtRNV/nqLJNuqAIBHB4T5Vehrc7MNZaAuIFPFzzInYx3BcOAIss83D3BDzgPs UJ5S+yn2W2vnteIhrEJChK/CE3RzlAAm9iidLHcAN7YEdSKuVtK8c8LU97/rUfQcOz aud1bM8rbQBUyzhRaPB9zrwLE84BLqc9haSGW26aGePesUDfybYopFe+34as70UWOo azWs6kP41Sg4RQZm9aKQHDeDMjNueYywQ8MWvydm7GZyuQ9fxqKnD7HemOpbw9qYS2 Mz+OhuxElC63HqWc4qFPmMdQP7NpuuVCN1eoaZGmSmIaCZkbazysAGbcUqA3v8gOyZ PUw6Eb/o5DCWw== Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.60]) by opfednr07.francetelecom.fr (ESMTP service) with ESMTP id 4BC5Ry5bH1zFpWf; Thu, 23 Jul 2020 10:42:22 +0200 (CEST) From: To: Ben Schwartz CC: Stephane Bortzmeyer , "draft-btw-add-home@ietf.org" , "ADD Mailing list (add@ietf.org)" Thread-Topic: [Add] TR: I-D Action: draft-btw-add-home-07.txt Thread-Index: AQHWYGT262rIPxpSL0qJH3F9BRa9DqkUugqg Date: Thu, 23 Jul 2020 08:42:22 +0000 Message-ID: <21508_1595493742_5F194D6E_21508_156_1_787AE7BB302AE849A7480A190F8B9330315006B4@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> References: <159438950508.10283.6338787113671554159@ietfa.amsl.com> <23877_1594815149_5F0EF2AD_23877_384_1_787AE7BB302AE849A7480A190F8B9330314F9783@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <20200720150751.GA14985@nic.fr> <17264_1595321101_5F16AB0D_17264_254_1_787AE7BB302AE849A7480A190F8B9330314FEE52@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> In-Reply-To: Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.114.13.245] Content-Type: multipart/alternative; boundary="_000_787AE7BB302AE849A7480A190F8B9330315006B4OPEXCAUBMA2corp_" MIME-Version: 1.0 Archived-At: Subject: Re: [Add] TR: I-D Action: draft-btw-add-home-07.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 08:42:27 -0000 --_000_787AE7BB302AE849A7480A190F8B9330315006B4OPEXCAUBMA2corp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQmVuLA0KDQpQbGVhc2Ugc2VlIGlubGluZS4NCg0KQ2hlZXJzLA0KTWVkDQoNCkRlIDogQmVu IFNjaHdhcnR6IFttYWlsdG86YmVtYXNjQGdvb2dsZS5jb21dDQpFbnZvecOpIDogbWVyY3JlZGkg MjIganVpbGxldCAyMDIwIDIyOjE2DQrDgCA6IEJPVUNBREFJUiBNb2hhbWVkIFRHSS9PTE4gPG1v aGFtZWQuYm91Y2FkYWlyQG9yYW5nZS5jb20+DQpDYyA6IFN0ZXBoYW5lIEJvcnR6bWV5ZXIgPGJv cnR6bWV5ZXJAbmljLmZyPjsgZHJhZnQtYnR3LWFkZC1ob21lQGlldGYub3JnOyBBREQgTWFpbGlu ZyBsaXN0IChhZGRAaWV0Zi5vcmcpIDxhZGRAaWV0Zi5vcmc+DQpPYmpldCA6IFJlOiBbQWRkXSBU UjogSS1EIEFjdGlvbjogZHJhZnQtYnR3LWFkZC1ob21lLTA3LnR4dA0KDQoNCg0KT24gVHVlLCBK dWwgMjEsIDIwMjAgYXQgNDo0NSBBTSA8bW9oYW1lZC5ib3VjYWRhaXJAb3JhbmdlLmNvbTxtYWls dG86bW9oYW1lZC5ib3VjYWRhaXJAb3JhbmdlLmNvbT4+IHdyb3RlOg0KDQo+IC0tLS0tTWVzc2Fn ZSBkJ29yaWdpbmUtLS0tLQ0KPiBEZSA6IEFkZCBbbWFpbHRvOmFkZC1ib3VuY2VzQGlldGYub3Jn PG1haWx0bzphZGQtYm91bmNlc0BpZXRmLm9yZz5dIERlIGxhIHBhcnQgZGUgU3RlcGhhbmUNCj4g Qm9ydHptZXllcg0KLi4uDQo+IHRoZSBhZHZpY2UgaW4gc2VjdGlvbiA0ICJEb0gvRG9UIHNlcnZl cnMgU0hPVUxEIGJlDQo+IGxvY2F0ZWQgYnkgdGhlaXIgYWRkcmVzcyBsaXRlcmFscyByYXRoZXIg dGhhbiB0aGVpciBuYW1lcyINCj4gZWxpbWluYXRlcyBzbWFsbCBEb0UgcmVzb2x2ZXJzIGFuZCBs ZWF2ZSBvbmx5IHRoZSBiaWcgb25lcywgd2hvDQo+IGNhbiBoYXZlIChsaWtlIEdvb2dsZSBhbmQN Cj4gQ2xvdWRmbGFyZSkgSVAtYmFzZWQgY2VydGlmaWNhdGVzLg0KDQpbTWVkXSBUaGF0IGlzIG5v dCB0aGUgaW50ZW50IG9mIHRoYXQgdGV4dC4gVGhlIHJlY29tbWVuZGF0aW9uIGlzIHRvIHN1cHBs eSBhIGxpc3Qgb2YgSVAgYWRkcmVzc2VzIChsb2NhdG9ycywgaWYgeW91IHdpbGwpIGluIGFkZGl0 aW9uIHRvIHRoZSBBRE4gdG8gYXZvaWQgYSBkZXBlbmRlbmN5IG9uIGFub3RoZXIgcmVzb2x2ZXIg dG8gcmVzb2x2ZSB0aGUgbmFtZS4NCg0KUGxlYXNlIG5vdGUgdGhhdCB0aGUgc2VudGVuY2UgeW91 IHF1b3RlZCBzdGFydHMgd2l0aCAiRnJvbSBhbiBJUCByZWFjaGFiaWxpdHkgc3RhbmRwb2ludCwg IiBhbmQgdGhlbiBmb2xsb3dlZCBieSAiVGhpcyBhdm9pZHMNCmFkZGluZyBhIGRlcGVuZGVuY3kg b24gYW5vdGhlciBzZXJ2ZXIgdG8gcmVzb2x2ZSB0aGUgRG9IL0RvVCBuYW1lLiAiDQoNCkkgcmVh ZCB0aGlzIHRleHQgc2ltaWxhcmx5IHRvIFN0ZXBoYW5lLg0KDQpbTWVkXSBPSy4gUGxlYXNlIG5v dGUgdGhhdCB0aGUgdGV4dCB0YWxrcyBhYm91dCDigJxsb2NhdGVk4oCdIG5vdCDigJxpZGVudGlm aWVk4oCdLiBBbnl3YXksIHdpbGwgc2VlIGhvdyB0byBtYWtlIHRoYXQgdGV4dCBiZXR0ZXIuDQoN CiAgQXJlIHlvdSBzYXlpbmcgdGhhdCB0aGUgcmVzb2x2ZXIgSVAgYWRkcmVzc2VzIGluIHRoZSBz YW1lIFJBL0RIQ1AgbWVzc2FnZSBzaG91bGQgYmUgdGhlIElQIGFkZHJlc3NlcyB0aGF0IHNlcnZl IHRoZSBBRE4/DQoNCltNZWRdIFRoZSBjdXJyZW50IHByb3Bvc2FsIGlzIHRvIGxldmVyYWdlIFJG QzIxMzIvUkZDMzY0Ni9SRkM4MTA2LiBGb3IgZXhhbXBsZSwgYSBESENQdjYgY2xpZW50IHRoYXQg YXNrcyBmb3IgZW5jcnlwdGVkIEROUyBzZXJ2ZXJzIHNob3VsZCBpbmNsdWRlIE9QVElPTl9ETlNf U0VSVkVSUyBpbiBpdHMgcmVxdWVzdCBhcyB3ZWxsLiBBbiBhbHRlcm5hdGUgZGVzaWduIGlzIHRv IGRlZmluZSB0aGUgbmV3IG9wdGlvbnMgdG8gY2FycnkgYm90aCB0aGUgQUROIGFuZCBhIGxpc3Qg b2YgSVAgYWRkcmVzc2VzLiBUaGlzIGFsdGVybmF0ZSBkZXNpZ24gaGFzIGltcGxpY2F0aW9ucyBv biB0aGUgc2l6ZSBvZiB0aGUgbWVzc2FnZXMgaWYgdGhlIGNsaWVudCByZXF1ZXN0cyBEbzUzIGFu ZCBvbmUgb3IgbW9yZSBlbmNyeXB0ZWQgRE5TIHRoYXQgaGFwcGVuIHRvIHRlcm1pbmF0ZSBhbGwg dGhlIG9uIHRoZSBzYW1lIElQIGFkZHJlc3MoZXMpLiBXaGljaCBkZXNpZ24gdG8gcGljayBpcyB1 cCB0byB0aGUgV0cuDQoNCiAgV2hhdCBpZiB0aGV5IGFyZSBub3Q/DQpbTWVkXSBUaGUgc2VydmVy IHdpbGwgcmV0dXJuIGEgbGlzdCBvZiBAZXMgaWYgcmVxdWVzdGVkIGJ5IHRoZSBjbGllbnQuIElm IHRoZSBjbGllbnQgZG9lcyBub3QgYXNrIGZvciB0aGUgT1BUSU9OX0ROU19TRVJWRVJTLCB0aGlz IG1lYW5zIHRoYXQgY2xpZW50IGlzIGFibGUgdG8gcmVzb2x2ZSB0aGUgQUROIGJ5IHBhc3Npbmcg aXQgdG8gYSByZXNvbHV0aW9uIGxpYnJhcnkuDQoNCk9yIHdoYXQgaWYgdGhlcmUgYXJlIG11bHRp cGxlIEFETnM/DQpbTWVkXSBJZiB0aGVyZSBhcmUgbXVsdGlwbGUgQUROcyBidXQgdGVybWluYXRl IG9uIGRpc3RpbmN0IElQQGVzLCBtdWx0aXBsZSBhZGRyZXNzZXMgd2lsbCBiZSBpbmNsdWRlZC4g V2UgdXNlIHRvIGhhdmUgYW4gYXBwZW5kaXggZXhwbGFpbmluZyB0aGlzIGJlaGF2aW91ciAoaHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWJ0dy1hZGQtaG9tZS0wMyNhcHBlbmRpeC1B KS4gVGhlIG1haW4gc3RvcnkgaXMgdGhhdCB0aGUgc2VydmVyIHdpbGwgcmV0dXJuIGEg4oCcY3Vz dG9taXplZOKAnSBsaXN0IG9mIElQIGFkZHJlc3NlcyBhcyBhIGZ1bmN0aW9uIG9mIHRoZSByZXF1 ZXN0ZWQgZW5jcnlwdGVkIEROUy4gSWYsIGZvciBleGFtcGxlLCBEb1QgaXMgcmVhY2hhYmxlIGF0 IEAxIGFuZCBEb0ggaW4gQDIsIHRoZSBzZXJ2ZXIgd2lsbCByZXR1cm4gYm90aCBAMSBhbmQgQDIg Zm9yIGEgY2xpZW50IHJlcXVlc3RpbmcgYm90aCBEb1QgYW5kIERvSC4NCg0KDQogIFdoYXQgaXMg dGhlIGNsaWVudCBzdXBwb3NlZCB0byBkbz8NCltNZWRdIFRoZSBEb1QgY2xpZW50IHdpbGwgZ28g dGhyb3VnaCB0aGUgQCBsaXN0IHJldHVybmVkIGJ5IHRoZSBzZXJ2ZXIgYW5kIHdpbGwgc3VjY2Vl ZCB0byBlc3RhYmxpc2ggYSBzZXNzaW9uIHdpdGggQDEuIFRoZSBEb0ggY2xpZW50IHdpbGwgZG8g dGhlIHNhbWUgYnV0IHdpbGwgY29uY2x1ZGUgdGhhdCBAMiBpcyByZXNwb25zaXZlIGFuZCB3aWxs IGVzdGFibGlzaCBhIERvSCBzZXNzaW9uIHdpdGggQDIuDQoNCg0KICAgVGhlIHVzZSBvZiBEb0gv RG9UIGFsc28gZGVwZW5kcyBvbiB0aGUgdXNlcidzIHBvbGljaWVzLiAgRm9yIGV4YW1wbGUsDQog ICB0aGUgdXNlciBtYXkgaW5kaWNhdGUgaGlzL2hlciBjb25zZW50IHRvIHVzZSAob3Igbm90KSB0 aGUgbG9jYWxseS0NCiAgIGRpc2NvdmVyZWQgRG9IL0RvVCBzZXJ2ZXIgb3IgcmVxdWVzdCB0byBy ZXZpZXcgaHVtYW4tcmVhZGFibGUgcHJpdmFjeQ0KICAgcG9saWN5IGluZm9ybWF0aW9uIG9mIGEg c2VsZWN0ZWQgRE5TIHNlcnZlciBhbmQgdG8gYXNzZXNzIHdoZXRoZXINCiAgIHRoYXQgRE5TIHNl cnZlciBwZXJmb3JtcyBETlMtYmFzZWQgY29udGVudCBmaWx0ZXJpbmcgKGUuZy4sDQogICBbSS1E LnJlZGR5LWFkZC1zZXJ2ZXItcG9saWN5LXNlbGVjdGlvbl0pLiAgVGhlIEROUyBjbGllbnQgaXMg YXNzdW1lZA0KICAgdG8gYWRoZXJlIHRvIHRoZXNlIHBvbGljaWVzLiAgVGhpcyBkb2N1bWVudCBk b2VzIG5vdCBtYWtlIGFueQ0KICAgYXNzdW1wdGlvbiBhYm91dCB0aGUgc3RydWN0dXJlIG9mIHN1 Y2ggcG9saWNpZXMgbm9yIG1hbmRhdGVzIHNwZWNpZmljDQogICByZXF1aXJlbWVudHMuICBTdWNo IHBvbGljaWVzIGFuZCB0aGVpciBoYW5kbGluZyBpcyBvdXQgb2Ygc2NvcGUuDQoNCldlIHdhbnRl ZCB0byBhdm9pZCBnb2luZyB0b28gZmFyIGluIHRoZSAicG9saWN5IGxhbmQiLCBoZW5jZSB0aGlz IHdvcmRpbmcuDQoNClRoaXMgZHJhZnQgaXMgYWxyZWFkeSB3YXkgdG9vIGRlZXAgaW4gInBvbGlj eSBsYW5kIi4gIE1vc3Qgb2YgU2VjdGlvbiAxLCBhbmQgbXVjaCBvZiBTZWN0aW9uIDMsIGlzIGRl ZGljYXRlZCB0byBhZHZhbmNpbmcgYSB0aGVzaXMgYWJvdXQgcmVzb2x2ZXIgc2VsZWN0aW9uIHBv bGljeSwgd2hpY2ggaXMgb3V0IG9mIHNjb3BlIGZvciB0aGlzIHdvcmtpbmcgZ3JvdXAuICBQbGVh c2UgcmVtb3ZlIHRoZXNlIGNsYWltcy4NCg0KW01lZF0gV2lsbCBkb3VibGUgY2hlY2sgaWYgdGhl cmUgYXJlIOKAnHBvbGljeSBjbGFpbXPigJ0gaW4gdGhlc2Ugc2VjdGlvbnMgYW5kIHJlbW92ZSB0 aGVtLg0KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18KCkNlIG1lc3NhZ2UgZXQgc2VzIHBpZWNlcyBqb2ludGVzIHBldXZlbnQg Y29udGVuaXIgZGVzIGluZm9ybWF0aW9ucyBjb25maWRlbnRpZWxsZXMgb3UgcHJpdmlsZWdpZWVz IGV0IG5lIGRvaXZlbnQgZG9uYwpwYXMgZXRyZSBkaWZmdXNlcywgZXhwbG9pdGVzIG91IGNvcGll cyBzYW5zIGF1dG9yaXNhdGlvbi4gU2kgdm91cyBhdmV6IHJlY3UgY2UgbWVzc2FnZSBwYXIgZXJy ZXVyLCB2ZXVpbGxleiBsZSBzaWduYWxlcgphIGwnZXhwZWRpdGV1ciBldCBsZSBkZXRydWlyZSBh aW5zaSBxdWUgbGVzIHBpZWNlcyBqb2ludGVzLiBMZXMgbWVzc2FnZXMgZWxlY3Ryb25pcXVlcyBl dGFudCBzdXNjZXB0aWJsZXMgZCdhbHRlcmF0aW9uLApPcmFuZ2UgZGVjbGluZSB0b3V0ZSByZXNw b25zYWJpbGl0ZSBzaSBjZSBtZXNzYWdlIGEgZXRlIGFsdGVyZSwgZGVmb3JtZSBvdSBmYWxzaWZp ZS4gTWVyY2kuCgpUaGlzIG1lc3NhZ2UgYW5kIGl0cyBhdHRhY2htZW50cyBtYXkgY29udGFpbiBj b25maWRlbnRpYWwgb3IgcHJpdmlsZWdlZCBpbmZvcm1hdGlvbiB0aGF0IG1heSBiZSBwcm90ZWN0 ZWQgYnkgbGF3Owp0aGV5IHNob3VsZCBub3QgYmUgZGlzdHJpYnV0ZWQsIHVzZWQgb3IgY29waWVk IHdpdGhvdXQgYXV0aG9yaXNhdGlvbi4KSWYgeW91IGhhdmUgcmVjZWl2ZWQgdGhpcyBlbWFpbCBp biBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGFuZCBkZWxldGUgdGhpcyBtZXNzYWdl IGFuZCBpdHMgYXR0YWNobWVudHMuCkFzIGVtYWlscyBtYXkgYmUgYWx0ZXJlZCwgT3JhbmdlIGlz IG5vdCBsaWFibGUgZm9yIG1lc3NhZ2VzIHRoYXQgaGF2ZSBiZWVuIG1vZGlmaWVkLCBjaGFuZ2Vk IG9yIGZhbHNpZmllZC4KVGhhbmsgeW91LgoK --_000_787AE7BB302AE849A7480A190F8B9330315006B4OPEXCAUBMA2corp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLkVtYWlsU3R5bGUxNw0K CXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ291cmllciBO ZXciOw0KCWNvbG9yOmJsYWNrOw0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0eWxlOm5v cm1hbDsNCgl0ZXh0LWRlY29yYXRpb246bm9uZSBub25lO30NCi5Nc29DaHBEZWZhdWx0DQoJe21z by1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCW1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTO30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCgltYXJnaW46NzAu ODVwdCA3MC44NXB0IDcwLjg1cHQgNzAuODVwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6 V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpz aGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5k aWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRp dCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48 L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkZSIiBsaW5rPSJibHVlIiB2 bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjazttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+ SGkgQmVuLA0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcm cXVvdDs7Y29sb3I6YmxhY2s7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJs YWNrO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5QbGVhc2Ugc2VlIGlubGluZS48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFj azttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2s7bXNvLWZhcmVhc3Qt bGFuZ3VhZ2U6RU4tVVMiPkNoZWVycyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjazttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1V UyI+TWVkPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDs7Y29sb3I6YmxhY2s7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlk IGJsdWUgMS41cHQ7cGFkZGluZzowY20gMGNtIDBjbSA0LjBwdCI+DQo8ZGl2Pg0KPGRpdiBzdHls ZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4w cHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij5EZSZuYnNwOzo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IEJlbiBTY2h3YXJ0eiBbbWFp bHRvOmJlbWFzY0Bnb29nbGUuY29tXQ0KPGJyPg0KPGI+RW52b3nDqSZuYnNwOzo8L2I+IG1lcmNy ZWRpIDIyIGp1aWxsZXQgMjAyMCAyMjoxNjxicj4NCjxiPsOAJm5ic3A7OjwvYj4gQk9VQ0FEQUlS IE1vaGFtZWQgVEdJL09MTiAmbHQ7bW9oYW1lZC5ib3VjYWRhaXJAb3JhbmdlLmNvbSZndDs8YnI+ DQo8Yj5DYyZuYnNwOzo8L2I+IFN0ZXBoYW5lIEJvcnR6bWV5ZXIgJmx0O2JvcnR6bWV5ZXJAbmlj LmZyJmd0OzsgZHJhZnQtYnR3LWFkZC1ob21lQGlldGYub3JnOyBBREQgTWFpbGluZyBsaXN0IChh ZGRAaWV0Zi5vcmcpICZsdDthZGRAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+T2JqZXQmbmJzcDs6PC9i PiBSZTogW0FkZF0gVFI6IEktRCBBY3Rpb246IGRyYWZ0LWJ0dy1hZGQtaG9tZS0wNy50eHQ8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24g VHVlLCBKdWwgMjEsIDIwMjAgYXQgNDo0NSBBTSAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1vaGFtZWQu Ym91Y2FkYWlyQG9yYW5nZS5jb20iPm1vaGFtZWQuYm91Y2FkYWlyQG9yYW5nZS5jb208L2E+Jmd0 OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBj bSA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGNtIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxicj4NCiZndDsgLS0tLS1NZXNzYWdlIGQnb3JpZ2luZS0tLS0tPGJyPg0KJmd0 OyBEZSZuYnNwOzogQWRkIFttYWlsdG86PGEgaHJlZj0ibWFpbHRvOmFkZC1ib3VuY2VzQGlldGYu b3JnIiB0YXJnZXQ9Il9ibGFuayI+YWRkLWJvdW5jZXNAaWV0Zi5vcmc8L2E+XSBEZSBsYSBwYXJ0 IGRlIFN0ZXBoYW5lPGJyPg0KJmd0OyBCb3J0em1leWVyPG86cD48L286cD48L3A+DQo8L2Jsb2Nr cXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Li4uJm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpz b2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGNtIDBjbSAwY20gNi4wcHQ7bWFyZ2luLWxlZnQ6 NC44cHQ7bWFyZ2luLXJpZ2h0OjBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mZ3Q7IHRoZSBh ZHZpY2UgaW4gc2VjdGlvbiA0ICZxdW90O0RvSC9Eb1Qgc2VydmVycyBTSE9VTEQgYmU8YnI+DQom Z3Q7IGxvY2F0ZWQgYnkgdGhlaXIgYWRkcmVzcyBsaXRlcmFscyByYXRoZXIgdGhhbiB0aGVpciBu YW1lcyZxdW90Ozxicj4NCiZndDsgZWxpbWluYXRlcyBzbWFsbCBEb0UgcmVzb2x2ZXJzIGFuZCBs ZWF2ZSBvbmx5IHRoZSBiaWcgb25lcywgd2hvPGJyPg0KJmd0OyBjYW4gaGF2ZSAobGlrZSBHb29n bGUgYW5kPGJyPg0KJmd0OyBDbG91ZGZsYXJlKSBJUC1iYXNlZCBjZXJ0aWZpY2F0ZXMuPGJyPg0K PGJyPg0KW01lZF0gVGhhdCBpcyBub3QgdGhlIGludGVudCBvZiB0aGF0IHRleHQuIFRoZSByZWNv bW1lbmRhdGlvbiBpcyB0byBzdXBwbHkgYSBsaXN0IG9mIElQIGFkZHJlc3NlcyAobG9jYXRvcnMs IGlmIHlvdSB3aWxsKSBpbiBhZGRpdGlvbiB0byB0aGUgQUROIHRvIGF2b2lkIGEgZGVwZW5kZW5j eSBvbiBhbm90aGVyIHJlc29sdmVyIHRvIHJlc29sdmUgdGhlIG5hbWUuPGJyPg0KPGJyPg0KUGxl YXNlIG5vdGUgdGhhdCB0aGUgc2VudGVuY2UgeW91IHF1b3RlZCBzdGFydHMgd2l0aCAmcXVvdDtG cm9tIGFuIElQIHJlYWNoYWJpbGl0eSBzdGFuZHBvaW50LCAmcXVvdDsgYW5kIHRoZW4gZm9sbG93 ZWQgYnkgJnF1b3Q7VGhpcyBhdm9pZHM8YnI+DQphZGRpbmcgYSBkZXBlbmRlbmN5IG9uIGFub3Ro ZXIgc2VydmVyIHRvIHJlc29sdmUgdGhlIERvSC9Eb1QgbmFtZS4gJnF1b3Q7PG86cD48L286cD48 L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHJlYWQg dGhpcyB0ZXh0IHNpbWlsYXJseSB0byBTdGVwaGFuZS48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2si PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90Oztjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj5bTWVk XSBPSy4gUGxlYXNlIG5vdGUgdGhhdCB0aGUgdGV4dCB0YWxrcyBhYm91dCDigJxsb2NhdGVk4oCd IG5vdCDigJxpZGVudGlmaWVk4oCdLiBBbnl3YXksIHdpbGwgc2VlIGhvdyB0byBtYWtlIHRoYXQg dGV4dCBiZXR0ZXIuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7IEFy ZSB5b3Ugc2F5aW5nIHRoYXQgdGhlIHJlc29sdmVyIElQIGFkZHJlc3NlcyBpbiB0aGUgc2FtZSBS QS9ESENQIG1lc3NhZ2Ugc2hvdWxkIGJlIHRoZSBJUCBhZGRyZXNzZXMgdGhhdCBzZXJ2ZSB0aGUg QUROPzxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFj ayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj5bTWVkXSBUaGUgY3VycmVudCBwcm9wb3Nh bCBpcyB0byBsZXZlcmFnZSBSRkMyMTMyL1JGQzM2NDYvUkZDODEwNi4gRm9yIGV4YW1wbGUsIGEg REhDUHY2IGNsaWVudCB0aGF0IGFza3MgZm9yIGVuY3J5cHRlZCBETlMgc2VydmVycyBzaG91bGQg aW5jbHVkZSBPUFRJT05fRE5TX1NFUlZFUlMNCiBpbiBpdHMgcmVxdWVzdCBhcyB3ZWxsLiBBbiBh bHRlcm5hdGUgZGVzaWduIGlzIHRvIGRlZmluZSB0aGUgbmV3IG9wdGlvbnMgdG8gY2FycnkgYm90 aCB0aGUgQUROIGFuZCBhIGxpc3Qgb2YgSVAgYWRkcmVzc2VzLiBUaGlzIGFsdGVybmF0ZSBkZXNp Z24gaGFzIGltcGxpY2F0aW9ucyBvbiB0aGUgc2l6ZSBvZiB0aGUgbWVzc2FnZXMgaWYgdGhlIGNs aWVudCByZXF1ZXN0cyBEbzUzIGFuZCBvbmUgb3IgbW9yZSBlbmNyeXB0ZWQgRE5TIHRoYXQgaGFw cGVuDQogdG8gdGVybWluYXRlIGFsbCB0aGUgb24gdGhlIHNhbWUgSVAgYWRkcmVzcyhlcykuIFdo aWNoIGRlc2lnbiB0byBwaWNrIGlzIHVwIHRvIHRoZSBXRy4gJm5ic3A7Jm5ic3A7PG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 O2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7IFdoYXQgaWYgdGhleSBhcmUgbm90PyZu YnNwOzxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFj ayI+W01lZF0gVGhlIHNlcnZlciB3aWxsIHJldHVybiBhIGxpc3Qgb2YgQGVzIGlmIHJlcXVlc3Rl ZCBieSB0aGUgY2xpZW50LiBJZiB0aGUgY2xpZW50IGRvZXMgbm90IGFzayBmb3IgdGhlIE9QVElP Tl9ETlNfU0VSVkVSUywgdGhpcyBtZWFucyB0aGF0IGNsaWVudCBpcyBhYmxlDQogdG8gcmVzb2x2 ZSB0aGUgQUROIGJ5IHBhc3NpbmcgaXQgdG8gYSByZXNvbHV0aW9uIGxpYnJhcnkuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 O2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+T3Igd2hhdCBpZiB0aGVyZSBhcmUgbXVsdGlwbGUg QUROcz88c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6NC42cHQiPjxzcGFu IGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+W01lZF0gSWYgdGhlcmUgYXJlIG11bHRpcGxl IEFETnMgYnV0IHRlcm1pbmF0ZSBvbiBkaXN0aW5jdCBJUEBlcywgbXVsdGlwbGUgYWRkcmVzc2Vz IHdpbGwgYmUgaW5jbHVkZWQuIFdlIHVzZSB0byBoYXZlIGFuIGFwcGVuZGl4DQogZXhwbGFpbmlu ZyB0aGlzIGJlaGF2aW91ciAoPGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2Ry YWZ0LWJ0dy1hZGQtaG9tZS0wMyNhcHBlbmRpeC1BIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0 bWwvZHJhZnQtYnR3LWFkZC1ob21lLTAzI2FwcGVuZGl4LUE8L2E+KS4gVGhlIG1haW4gc3Rvcnkg aXMgdGhhdCB0aGUgc2VydmVyIHdpbGwgcmV0dXJuIGEg4oCcY3VzdG9taXplZOKAnSBsaXN0IG9m IElQIGFkZHJlc3NlcyBhcyBhIGZ1bmN0aW9uDQogb2YgdGhlIHJlcXVlc3RlZCBlbmNyeXB0ZWQg RE5TLiBJZiwgZm9yIGV4YW1wbGUsIERvVCBpcyByZWFjaGFibGUgYXQgQDEgYW5kIERvSCBpbiBA MiwgdGhlIHNlcnZlciB3aWxsIHJldHVybiBib3RoIEAxIGFuZCBAMiBmb3IgYSBjbGllbnQgcmVx dWVzdGluZyBib3RoIERvVCBhbmQgRG9ILjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+Jm5ic3A7Jm5i c3A7Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7IFdoYXQg aXMgdGhlIGNsaWVudCBzdXBwb3NlZCB0byBkbz88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPltNZWRd IFRoZSBEb1QgY2xpZW50IHdpbGwgZ28gdGhyb3VnaCB0aGUgQCBsaXN0IHJldHVybmVkIGJ5IHRo ZSBzZXJ2ZXIgYW5kIHdpbGwgc3VjY2VlZCB0byBlc3RhYmxpc2ggYSBzZXNzaW9uIHdpdGggQDEu IFRoZSBEb0ggY2xpZW50IHdpbGwgZG8gdGhlIHNhbWUgYnV0DQogd2lsbCBjb25jbHVkZSB0aGF0 IEAyIGlzIHJlc3BvbnNpdmUgYW5kIHdpbGwgZXN0YWJsaXNoIGEgRG9IIHNlc3Npb24gd2l0aCBA Mi4gPG86cD4NCjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJi b3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGNtIDBj bSAwY20gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBjbSI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7ICZuYnNwO1RoZSB1c2Ugb2Yg RG9IL0RvVCBhbHNvIGRlcGVuZHMgb24gdGhlIHVzZXIncyBwb2xpY2llcy4mbmJzcDsNCjwvc3Bh bj5Gb3IgZXhhbXBsZSw8YnI+DQombmJzcDsgJm5ic3A7dGhlIHVzZXIgbWF5IGluZGljYXRlIGhp cy9oZXIgY29uc2VudCB0byB1c2UgKG9yIG5vdCkgdGhlIGxvY2FsbHktPGJyPg0KJm5ic3A7ICZu YnNwO2Rpc2NvdmVyZWQgRG9IL0RvVCBzZXJ2ZXIgb3IgcmVxdWVzdCB0byByZXZpZXcgaHVtYW4t cmVhZGFibGUgcHJpdmFjeTxicj4NCiZuYnNwOyAmbmJzcDtwb2xpY3kgaW5mb3JtYXRpb24gb2Yg YSBzZWxlY3RlZCBETlMgc2VydmVyIGFuZCB0byBhc3Nlc3Mgd2hldGhlcjxicj4NCiZuYnNwOyAm bmJzcDt0aGF0IEROUyBzZXJ2ZXIgcGVyZm9ybXMgRE5TLWJhc2VkIGNvbnRlbnQgZmlsdGVyaW5n IChlLmcuLDxicj4NCiZuYnNwOyAmbmJzcDtbSS1ELnJlZGR5LWFkZC1zZXJ2ZXItcG9saWN5LXNl bGVjdGlvbl0pLiZuYnNwOyBUaGUgRE5TIGNsaWVudCBpcyBhc3N1bWVkPGJyPg0KJm5ic3A7ICZu YnNwO3RvIGFkaGVyZSB0byB0aGVzZSBwb2xpY2llcy4mbmJzcDsgVGhpcyBkb2N1bWVudCBkb2Vz IG5vdCBtYWtlIGFueTxicj4NCiZuYnNwOyAmbmJzcDthc3N1bXB0aW9uIGFib3V0IHRoZSBzdHJ1 Y3R1cmUgb2Ygc3VjaCBwb2xpY2llcyBub3IgbWFuZGF0ZXMgc3BlY2lmaWM8YnI+DQombmJzcDsg Jm5ic3A7cmVxdWlyZW1lbnRzLiZuYnNwOyBTdWNoIHBvbGljaWVzIGFuZCB0aGVpciBoYW5kbGlu ZyBpcyBvdXQgb2Ygc2NvcGUuPGJyPg0KPGJyPg0KV2Ugd2FudGVkIHRvIGF2b2lkIGdvaW5nIHRv byBmYXIgaW4gdGhlICZxdW90O3BvbGljeSBsYW5kJnF1b3Q7LCBoZW5jZSB0aGlzIHdvcmRpbmcu IDxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+VGhpcyBkcmFmdCBpcyBhbHJlYWR5IHdheSB0b28gZGVlcCBpbiAmcXVvdDtwb2xpY3kg bGFuZCZxdW90Oy4mbmJzcDsgTW9zdCBvZiBTZWN0aW9uIDEsIGFuZCBtdWNoIG9mIFNlY3Rpb24g MywgaXMgZGVkaWNhdGVkIHRvIGFkdmFuY2luZyBhIHRoZXNpcyBhYm91dCByZXNvbHZlciBzZWxl Y3Rpb24gcG9saWN5LCB3aGljaCBpcyBvdXQgb2Ygc2NvcGUgZm9yIHRoaXMgd29ya2luZyBncm91 cC4mbmJzcDsgUGxlYXNlIHJlbW92ZSB0aGVzZSBjbGFpbXMuPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2Nv bG9yOmJsYWNrIj5bTWVkXSBXaWxsIGRvdWJsZSBjaGVjayBpZiB0aGVyZSBhcmUg4oCccG9saWN5 IGNsYWltc+KAnSBpbiB0aGVzZSBzZWN0aW9ucyBhbmQgcmVtb3ZlIHRoZW0uDQo8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPFBS RT5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgpDZSBtZXNzYWdlIGV0IHNlcyBwaWVjZXMgam9pbnRlcyBwZXV2ZW50IGNvbnRl bmlyIGRlcyBpbmZvcm1hdGlvbnMgY29uZmlkZW50aWVsbGVzIG91IHByaXZpbGVnaWVlcyBldCBu ZSBkb2l2ZW50IGRvbmMKcGFzIGV0cmUgZGlmZnVzZXMsIGV4cGxvaXRlcyBvdSBjb3BpZXMgc2Fu cyBhdXRvcmlzYXRpb24uIFNpIHZvdXMgYXZleiByZWN1IGNlIG1lc3NhZ2UgcGFyIGVycmV1ciwg dmV1aWxsZXogbGUgc2lnbmFsZXIKYSBsJ2V4cGVkaXRldXIgZXQgbGUgZGV0cnVpcmUgYWluc2kg cXVlIGxlcyBwaWVjZXMgam9pbnRlcy4gTGVzIG1lc3NhZ2VzIGVsZWN0cm9uaXF1ZXMgZXRhbnQg c3VzY2VwdGlibGVzIGQnYWx0ZXJhdGlvbiwKT3JhbmdlIGRlY2xpbmUgdG91dGUgcmVzcG9uc2Fi aWxpdGUgc2kgY2UgbWVzc2FnZSBhIGV0ZSBhbHRlcmUsIGRlZm9ybWUgb3UgZmFsc2lmaWUuIE1l cmNpLgoKVGhpcyBtZXNzYWdlIGFuZCBpdHMgYXR0YWNobWVudHMgbWF5IGNvbnRhaW4gY29uZmlk ZW50aWFsIG9yIHByaXZpbGVnZWQgaW5mb3JtYXRpb24gdGhhdCBtYXkgYmUgcHJvdGVjdGVkIGJ5 IGxhdzsKdGhleSBzaG91bGQgbm90IGJlIGRpc3RyaWJ1dGVkLCB1c2VkIG9yIGNvcGllZCB3aXRo b3V0IGF1dGhvcmlzYXRpb24uCklmIHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMgZW1haWwgaW4gZXJy b3IsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBhbmQgZGVsZXRlIHRoaXMgbWVzc2FnZSBhbmQg aXRzIGF0dGFjaG1lbnRzLgpBcyBlbWFpbHMgbWF5IGJlIGFsdGVyZWQsIE9yYW5nZSBpcyBub3Qg bGlhYmxlIGZvciBtZXNzYWdlcyB0aGF0IGhhdmUgYmVlbiBtb2RpZmllZCwgY2hhbmdlZCBvciBm YWxzaWZpZWQuClRoYW5rIHlvdS4KPC9QUkU+PC9ib2R5Pg0KPC9odG1sPg0K --_000_787AE7BB302AE849A7480A190F8B9330315006B4OPEXCAUBMA2corp_-- From nobody Thu Jul 23 07:13:22 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB5AB3A078C for ; Thu, 23 Jul 2020 07:13:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mae29xvYEOEZ for ; Thu, 23 Jul 2020 07:13:17 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 83BB33A0788 for ; Thu, 23 Jul 2020 07:13:16 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 03FE32805C0; Thu, 23 Jul 2020 16:13:15 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id F155728062D; Thu, 23 Jul 2020 16:13:14 +0200 (CEST) Received: from relay01.prive.nic.fr (unknown [10.1.50.11]) by mx4.nic.fr (Postfix) with ESMTP id EB88C2805C0; Thu, 23 Jul 2020 16:13:14 +0200 (CEST) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id DDA6164C6C03; Thu, 23 Jul 2020 16:13:14 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id B54B03FE50; Thu, 23 Jul 2020 16:13:14 +0200 (CEST) Date: Thu, 23 Jul 2020 16:13:14 +0200 From: Stephane Bortzmeyer To: Ben Schwartz Cc: Stephane Bortzmeyer , Tommy Pauly , ADD Mailing list , David Schinazi Message-ID: <20200723141314.GA32028@nic.fr> References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.000201, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 14:13:20 -0000 On Wed, Jul 22, 2020 at 04:34:41PM -0400, Ben Schwartz wrote a message of 232 lines which said: > This draft's PvD mechanism (+PUSH) also seems to overlap considerably with > draft-schinazi-httpbis-doh-preference-hints, Both proposals (draft-schinazi-httpbis-doh-preference-hints and draft-pauly-add-resolver-discovery) have in common that a Web server can tell the user agent which DNS resolver to use for subsequent queries. I'm not convinced it is a good idea. Before discussing the details of the proposal, did anyone write a pros-and-cons document about this idea, which is quite new for the Internet? From nobody Thu Jul 23 07:34:52 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB3793A07E2 for ; Thu, 23 Jul 2020 07:34:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZtXq0Yh3MCxS for ; Thu, 23 Jul 2020 07:34:49 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DEB253A07E1 for ; Thu, 23 Jul 2020 07:34:48 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id B13CA280100; Thu, 23 Jul 2020 16:34:46 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id A96E828060C; Thu, 23 Jul 2020 16:34:46 +0200 (CEST) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id A1C70280100; Thu, 23 Jul 2020 16:34:46 +0200 (CEST) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 92C3164C6C03; Thu, 23 Jul 2020 16:34:46 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id 69ABF3FE50; Thu, 23 Jul 2020 16:34:46 +0200 (CEST) Date: Thu, 23 Jul 2020 16:34:46 +0200 From: Stephane Bortzmeyer To: Neil Cook Cc: Stephane Bortzmeyer , Eric Rescorla , Andrew Campling , "add@ietf.org" , Martin Thomson Message-ID: <20200723143446.GA648@nic.fr> References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <20200721073934.GA29757@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.207176, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 14:34:51 -0000 On Tue, Jul 21, 2020 at 07:14:47PM +0100, Neil Cook wrote a message of 30 lines which said: > People are free to choose their CPE. This is not true in many cases (example: Orange, the biggest IAP in France). From nobody Thu Jul 23 07:59:25 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3CD93A084C for ; Thu, 23 Jul 2020 07:59:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I26XczzK44kl for ; Thu, 23 Jul 2020 07:59:17 -0700 (PDT) Received: from mail-wr1-x42f.google.com (mail-wr1-x42f.google.com [IPv6:2a00:1450:4864:20::42f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9750A3A084D for ; Thu, 23 Jul 2020 07:59:16 -0700 (PDT) Received: by mail-wr1-x42f.google.com with SMTP id a15so5464560wrh.10 for ; Thu, 23 Jul 2020 07:59:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=8TrnYebJqV4iLfH11LlYpSRJ7GIc1X/w5HLzlL4jn3A=; b=QJ6X33vW85tozjL8++LB2fI9dof598k9Ffc4RL8cawwkadw1g8HJv+wK6T6ov28MZT 3kqko3IbtFYB0g/j3EtgBAQVXIAsIYsxbJBs21tAU21yyiuWDbJpofrg/UuLbWzoxY8s B9yaUKnS6wLALIdDeUAcwxfJYyOEkk/4toAex90/W1IBD2VNayhgKs7GWQL2gigFhzqv Pv9+GoHMqOqrfkL2OcI+XYiJejJDp9I8yISXTG8EPQfiP6Opztdz1lLMsGZz1hfpm1aZ MlxHTzuwoKGu2CcmcrCoaauN+X3Kk0fV1KHVUzx1xzJBOd7zaCP+PFZEsOgCuojtFBij Swww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=8TrnYebJqV4iLfH11LlYpSRJ7GIc1X/w5HLzlL4jn3A=; b=tWt7WGwUWtVBLF0cftSPAJrWw/XypCB0VBVKrV+yNZTfCgApPTSc+S7lWhTT+TR6SQ rEMPe6+KGmuL68e1gm20KlrJXuhnvuH9L+5WxwbUaxSQQiwCJBVF65bmBsKSYj5RxHoY aBpVB5etMPT7ABJoSOUkn7tLeLFop/HBpuK1mNkHGTTfgpXxdDoVRCnJdPWALNkPPpZx zhKvE48MoYS/EJtTwZZSsWI204balkV5LwLDp5uiVwz9wJdRVjLF1ToW3vCGtoiGEvT6 /c5wiup/+PBjQaJ/LaBBJrGF6LwJfPyO9Ry+8RuzP7X+3EyZHFyFV+GHjM4OMRuvqQLY e7fg== X-Gm-Message-State: AOAM5320xkF/aIK8MTiR22RLIq8iLNoZ9JA2M5wyawOBajJ7LyEifJPA B4Wj2Ic3mXCrr6iWpCELZ2SXKxOoy/5oW1blofKCHA== X-Google-Smtp-Source: ABdhPJz+PWMeq7VCPZOP9JXh2nHBebdtpEyMPOP2aN4iBev6nBMQoesZSBjwegiVzPouM4zHT6yZjSXu798enfBLa8w= X-Received: by 2002:adf:e486:: with SMTP id i6mr4356928wrm.258.1595516354795; Thu, 23 Jul 2020 07:59:14 -0700 (PDT) MIME-Version: 1.0 References: <159438950508.10283.6338787113671554159@ietfa.amsl.com> <23877_1594815149_5F0EF2AD_23877_384_1_787AE7BB302AE849A7480A190F8B9330314F9783@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <20200720150751.GA14985@nic.fr> <17264_1595321101_5F16AB0D_17264_254_1_787AE7BB302AE849A7480A190F8B9330314FEE52@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <21508_1595493742_5F194D6E_21508_156_1_787AE7BB302AE849A7480A190F8B9330315006B4@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> In-Reply-To: <21508_1595493742_5F194D6E_21508_156_1_787AE7BB302AE849A7480A190F8B9330315006B4@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> From: Ben Schwartz Date: Thu, 23 Jul 2020 10:58:45 -0400 Message-ID: To: mohamed.boucadair@orange.com Cc: Stephane Bortzmeyer , "draft-btw-add-home@ietf.org" , "ADD Mailing list (add@ietf.org)" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000009790c205ab1d195d" Archived-At: Subject: Re: [Add] TR: I-D Action: draft-btw-add-home-07.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 14:59:22 -0000 --0000000000009790c205ab1d195d Content-Type: multipart/alternative; boundary="000000000000900dc905ab1d19fb" --000000000000900dc905ab1d19fb Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Jul 23, 2020 at 4:42 AM wrote: > Hi Ben, > > > > Please see inline. > > > > Cheers, > > Med > > > > *De :* Ben Schwartz [mailto:bemasc@google.com] > *Envoy=C3=A9 :* mercredi 22 juillet 2020 22:16 > *=C3=80 :* BOUCADAIR Mohamed TGI/OLN > *Cc :* Stephane Bortzmeyer ; > draft-btw-add-home@ietf.org; ADD Mailing list (add@ietf.org) > > *Objet :* Re: [Add] TR: I-D Action: draft-btw-add-home-07.txt > > > > > > > > On Tue, Jul 21, 2020 at 4:45 AM wrote: > > > > -----Message d'origine----- > > De : Add [mailto:add-bounces@ietf.org] De la part de Stephane > > Bortzmeyer > > ... > > > the advice in section 4 "DoH/DoT servers SHOULD be > > located by their address literals rather than their names" > > eliminates small DoE resolvers and leave only the big ones, who > > can have (like Google and > > Cloudflare) IP-based certificates. > > [Med] That is not the intent of that text. The recommendation is to suppl= y > a list of IP addresses (locators, if you will) in addition to the ADN to > avoid a dependency on another resolver to resolve the name. > > Please note that the sentence you quoted starts with "From an IP > reachability standpoint, " and then followed by "This avoids > adding a dependency on another server to resolve the DoH/DoT name. " > > > > I read this text similarly to Stephane. > > > > [Med] OK. Please note that the text talks about =E2=80=9Clocated=E2=80=9D= not > =E2=80=9Cidentified=E2=80=9D. Anyway, will see how to make that text bett= er. > > > > Are you saying that the resolver IP addresses in the same RA/DHCP > message should be the IP addresses that serve the ADN? > > > > [Med] The current proposal is to leverage RFC2132/RFC3646/RFC8106. For > example, a DHCPv6 client that asks for encrypted DNS servers should inclu= de > OPTION_DNS_SERVERS in its request as well. An alternate design is to defi= ne > the new options to carry both the ADN and a list of IP addresses. This > alternate design has implications on the size of the messages if the clie= nt > requests Do53 and one or more encrypted DNS that happen to terminate all > the on the same IP address(es). Which design to pick is up to the WG. > > > > What if they are not? > > [Med] The server will return a list of @es if requested by the client. If > the client does not ask for the OPTION_DNS_SERVERS, this means that clien= t > is able to resolve the ADN by passing it to a resolution library. > And where is this resolution library supposed to send its queries? Are you proposing that the client run its own full recursive? Or what if there are multiple ADNs? > > [Med] If there are multiple ADNs but terminate on distinct IP@es, > multiple addresses will be included. We use to have an appendix explainin= g > this behaviour ( > https://tools.ietf.org/html/draft-btw-add-home-03#appendix-A). The main > story is that the server will return a =E2=80=9Ccustomized=E2=80=9D list = of IP addresses as > a function of the requested encrypted DNS. If, for example, DoT is > reachable at @1 and DoH in @2, the server will return both @1 and @2 for = a > client requesting both DoT and DoH. > > > > > > What is the client supposed to do? > > [Med] The DoT client will go through the @ list returned by the server an= d > will succeed to establish a session with @1. The DoH client will do the > same but will conclude that @2 is responsive and will establish a DoH > session with @2. > OK, so clients are expected to try every combination of ADN/protocol and IP until they find a pair that works. This seems like an inefficiency that we should be able to avoid. For example, we could allow multiple OPTION_DNS_SERVERS, assign each one an index (e.g. in order of appearance), and refer to it by index in the TBA2 option. > The use of DoH/DoT also depends on the user's policies. For example, > the user may indicate his/her consent to use (or not) the locally- > discovered DoH/DoT server or request to review human-readable privacy > policy information of a selected DNS server and to assess whether > that DNS server performs DNS-based content filtering (e.g., > [I-D.reddy-add-server-policy-selection]). The DNS client is assumed > to adhere to these policies. This document does not make any > assumption about the structure of such policies nor mandates specific > requirements. Such policies and their handling is out of scope. > > We wanted to avoid going too far in the "policy land", hence this wording= . > > > > This draft is already way too deep in "policy land". Most of Section 1, > and much of Section 3, is dedicated to advancing a thesis about resolver > selection policy, which is out of scope for this working group. Please > remove these claims. > > > > [Med] Will double check if there are =E2=80=9Cpolicy claims=E2=80=9D in t= hese sections and > remove them. > > _________________________________________________________________________= ________________________________________________ > > Ce message et ses pieces jointes peuvent contenir des informations confid= entielles ou privilegiees et ne doivent donc > pas etre diffuses, exploites ou copies sans autorisation. Si vous avez re= cu ce message par erreur, veuillez le signaler > a l'expediteur et le detruire ainsi que les pieces jointes. Les messages = electroniques etant susceptibles d'alteration, > Orange decline toute responsabilite si ce message a ete altere, deforme o= u falsifie. Merci. > > This message and its attachments may contain confidential or privileged i= nformation that may be protected by law; > they should not be distributed, used or copied without authorisation. > If you have received this email in error, please notify the sender and de= lete this message and its attachments. > As emails may be altered, Orange is not liable for messages that have bee= n modified, changed or falsified. > Thank you. > > --000000000000900dc905ab1d19fb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Jul 23, 2020 at 4:42 AM <<= a href=3D"mailto:mohamed.boucadair@orange.com">mohamed.boucadair@orange.com= > wrote:

Hi Ben,

=C2=A0

Please see inline.

=C2=A0

Cheers,

Med

=C2=A0

De=C2=A0: Ben Schwartz [mailto:bemasc@google.com]
Envoy=C3=A9=C2=A0: mercredi 22 juillet 2020 22:16
=C3=80=C2=A0: BOUCADAIR Mohamed TGI/OLN <mohamed.boucadair@orange.com&= gt;
Cc=C2=A0: Stephane Bortzmeyer <bortzmeyer@nic.fr>; draft-btw-add-home@ietf.org; ADD = Mailing list (add@ietf.or= g) <add@ietf.org>
Objet=C2=A0: Re: [Add] TR: I-D Action: draft-btw-add-home-07.txt<= /u>

=C2=A0

=C2=A0

=C2=A0


> -----Message d'origine-----
> De=C2=A0: Add [mailto:add-bounces@ietf.org] De la part de Stephane
> Bortzmeyer

...=C2=A0

> the advice in section 4 "DoH/DoT servers S= HOULD be
> located by their address literals rather than their names"
> eliminates small DoE resolvers and leave only the big ones, who
> can have (like Google and
> Cloudflare) IP-based certificates.

[Med] That is not the intent of that text. The recommendation is to supply = a list of IP addresses (locators, if you will) in addition to the ADN to av= oid a dependency on another resolver to resolve the name.

Please note that the sentence you quoted starts with "From an IP reach= ability standpoint, " and then followed by "This avoids
adding a dependency on another server to resolve the DoH/DoT name. "

=C2=A0

I read this text similarly to Stephane.

=C2=A0

[Med] OK. Please note that the te= xt talks about =E2=80=9Clocated=E2=80=9D not =E2=80=9Cidentified=E2=80=9D. = Anyway, will see how to make that text better.

=C2=A0

=C2=A0 Are you saying that the = resolver IP addresses in the same RA/DHCP message should be the IP addresse= s that serve the ADN?

=C2=A0

[Med] The current proposal is to = leverage RFC2132/RFC3646/RFC8106. For example, a DHCPv6 client that asks fo= r encrypted DNS servers should include OPTION_DNS_SERVERS in its request as well. An alternate design is to define the new options t= o carry both the ADN and a list of IP addresses. This alternate design has = implications on the size of the messages if the client requests Do53 and on= e or more encrypted DNS that happen to terminate all the on the same IP address(es). Which design to pick is u= p to the WG. =C2=A0=C2=A0

=C2=A0

=C2=A0 What if they are not?=C2= =A0

[Med] The server will return a li= st of @es if requested by the client. If the client does not ask for the OP= TION_DNS_SERVERS, this means that client is able to resolve the ADN by passing it to a resolution library.

=

And where is= this resolution library supposed to send its queries?=C2=A0 Are you propos= ing that the client run its own full recursive?

Or what if there are multiple A= DNs?

[Med]= If there are multiple ADNs but terminate on distinct IP@es, multiple addre= sses will be included. We use to have an appendix explaining this behaviour (https://tools.ietf.org/html/dra= ft-btw-add-home-03#appendix-A). The main story is that the server will = return a =E2=80=9Ccustomized=E2=80=9D list of IP addresses as a function of the requested encrypted DNS. If, for example, DoT is reachable at @1 an= d DoH in @2, the server will return both @1 and @2 for a client requesting = both DoT and DoH.

=C2=A0=C2=A0=C2=A0<= /span>

=C2=A0

=C2=A0 What is the client suppo= sed to do?

[Med] The DoT client will go thro= ugh the @ list returned by the server and will succeed to establish a sessi= on with @1. The DoH client will do the same but will conclude that @2 is responsive and will establish a DoH session with = @2.


OK, so clients are expected to try every combination of ADN/protoco= l and IP until they find a pair that works.=C2=A0 This seems like an ineffi= ciency that we should be able to avoid.=C2=A0 For example, we could allow m= ultiple OPTION_DNS_SERVERS, assign each one an index (e.g. in order of appe= arance), and refer to it by index in the TBA2 option.

=C2=A0 =C2=A0The use of DoH/DoT= also depends on the user's policies.=C2=A0 For example,
=C2=A0 =C2=A0the user may indicate his/her consent to use (or not) the loca= lly-
=C2=A0 =C2=A0discovered DoH/DoT server or request to review human-readable = privacy
=C2=A0 =C2=A0policy information of a selected DNS server and to assess whet= her
=C2=A0 =C2=A0that DNS server performs DNS-based content filtering (e.g., =C2=A0 =C2=A0[I-D.reddy-add-server-policy-selection]).=C2=A0 The DNS client= is assumed
=C2=A0 =C2=A0to adhere to these policies.=C2=A0 This document does not make= any
=C2=A0 =C2=A0assumption about the structure of such policies nor mandates s= pecific
=C2=A0 =C2=A0requirements.=C2=A0 Such policies and their handling is out of= scope.

We wanted to avoid going too far in the "policy land", hence this= wording.

=C2=A0

This draft is already way too deep in "policy l= and".=C2=A0 Most of Section 1, and much of Section 3, is dedicated to = advancing a thesis about resolver selection policy, which is out of scope f= or this working group.=C2=A0 Please remove these claims.

=C2=A0

[Med] Will double check if there = are =E2=80=9Cpolicy claims=E2=80=9D in these sections and remove them. 

______________________________________________________________________=
___________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confiden=
tielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu=
 ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les message=
s electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou =
falsifie. Merci.

This message and its attachments may contain confidential or privileged inf=
ormation that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and dele=
te this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been =
modified, changed or falsified.
Thank you.
--000000000000900dc905ab1d19fb-- --0000000000009790c205ab1d195d Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIPBgYJKoZIhvcNAQcCoIIO9zCCDvMCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ggxpMIIEkjCCA3qgAwIBAgINAewckktV4F6Q7sAtGDANBgkqhkiG9w0BAQsFADBMMSAwHgYDVQQL ExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMK R2xvYmFsU2lnbjAeFw0xODA2MjAwMDAwMDBaFw0yODA2MjAwMDAwMDBaMEsxCzAJBgNVBAYTAkJF MRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSEwHwYDVQQDExhHbG9iYWxTaWduIFNNSU1FIENB IDIwMTgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUeobu8FdB5oJg6Fz6SFf8YsPI dNcq4rBSiSDAwqMNYbeTpRrINMBdWuPqVWaBX7WHYMsKQwCOvAF1b7rkD+ROo+CCTJo76EAY25Pp jt7TYP/PxoLesLQ+Ld088+BeyZg9pQaf0VK4tn23fOCWbFWoM8hdnF86Mqn6xB6nLsxJcz4CUGJG qAhC3iedFiCfZfsIp2RNyiUhzPAqalkrtD0bZQvCgi5aSNJseNyCysS1yA58OuxEyn2e9itZJE+O sUeD8VFgz+nAYI5r/dmFEXu5d9npLvTTrSJjrEmw2/ynKn6r6ONueZnCfo6uLmP1SSglhI/SN7dy L1rKUCU7R1MjAgMBAAGjggFyMIIBbjAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUH AwIGCCsGAQUFBwMEBggrBgEFBQcDCTASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRMtwWJ 1lPNI0Ci6A94GuRtXEzs0jAfBgNVHSMEGDAWgBSP8Et/qC5FJK5NUPpjmove4t0bvDA+BggrBgEF BQcBAQQyMDAwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjMw NgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9yb290LXIzLmNybDBn BgNVHSAEYDBeMAsGCSsGAQQBoDIBKDAMBgorBgEEAaAyASgKMEEGCSsGAQQBoDIBXzA0MDIGCCsG AQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG9w0B AQsFAAOCAQEAwREs1zjtnFIIWorsx5XejqZtqaq5pomEvpjM98ebexngUmd7hju2FpYvDvzcnoGu tjm0N3Sqj5vvwEgvDGB5CxDOBkDlmUT+ObRpKbP7eTafq0+BAhEd3z2tHFm3sKE15o9+KjY6O5bb M30BLgvKlLbLrDDyh8xigCPZDwVI7JVuWMeemVmNca/fidKqOVg7a16ptQUyT5hszqpj18MwD9U0 KHRcR1CfVa+3yjK0ELDS+UvTufoB9wp2BoozsqD0yc2VOcZ7SzcwOzomSFfqv7Vdj88EznDbdy4s fq6QvuNiUs8yW0Vb0foCVRNnSlb9T8//uJqQLHxrxy2j03cvtTCCA18wggJHoAMCAQICCwQAAAAA ASFYUwiiMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIz MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTA5MDMxODEwMDAw MFoXDTI5MDMxODEwMDAwMFowTDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzAR BgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDMJXaQeQZ4Ihb1wIO2hMoonv0FdhHFrYhy/EYCQ8eyip0EXyTLLkvhYIJG 4VKrDIFHcGzdZNHr9SyjD4I9DCuul9e2FIYQebs7E4B3jAjhSdJqYi8fXvqWaN+JJ5U4nwbXPsnL JlkNc96wyOkmDoMVxu9bi9IEYMpJpij2aTv2y8gokeWdimFXN6x0FNx04Druci8unPvQu7/1PQDh BjPogiuuU6Y6FnOM3UEOIDrAtKeh6bJPkC4yYOlXy7kEkmho5TgmYHWyn3f/kRTvriBJ/K1AFUjR AjFhGV64l++td7dkmnq/X8ET75ti+w1s4FRpFqkD2m7pg5NxdsZphYIXAgMBAAGjQjBAMA4GA1Ud DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSP8Et/qC5FJK5NUPpjmove4t0b vDANBgkqhkiG9w0BAQsFAAOCAQEAS0DbwFCq/sgM7/eWVEVJu5YACUGssxOGhigHM8pr5nS5ugAt rqQK0/Xx8Q+Kv3NnSoPHRHt44K9ubG8DKY4zOUXDjuS5V2yq/BKW7FPGLeQkbLmUY/vcU2hnVj6D uM81IcPJaP7O2sJTqsyQiunwXUaMld16WCgaLx3ezQA3QY/tRG3XUyiXfvNnBB4V14qWtNPeTCek TBtzc3b0F5nCH3oO4y0IrQocLP88q1UOD5F+NuvDV0m+4S4tfGCLw0FREyOdzvcya5QBqJnnLDMf Ojsl0oZAzjsshnjJYS8Uuu7bVW/fhO4FCU29KNhyztNiUGUe65KXgzHZs7XKR1g/XzCCBGwwggNU oAMCAQICEAH8qNflD4Mi9yKttXfRdHcwDQYJKoZIhvcNAQELBQAwSzELMAkGA1UEBhMCQkUxGTAX BgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExITAfBgNVBAMTGEdsb2JhbFNpZ24gU01JTUUgQ0EgMjAx ODAeFw0yMDA2MDUwODIyMjhaFw0yMDEyMDIwODIyMjhaMCIxIDAeBgkqhkiG9w0BCQEWEWJlbWFz Y0Bnb29nbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2kbyV9S0YLplF3kV 6t3GgD7IyHe8L29pJ7l+UR0Sj31uPgXOFdSSdTVwhPfQvxmB2OUDXWDgDtZdL2xu4DgHhrDyyOXT 8uDJqUCPw004ZSuUfUor1vz5u6+oYNfx2OTPTb81vtsQO2/khni3iAeQlKgO/rUI1c9+zvT6k3mR SZUypAlk/rCyG6NV7NMJMmOaU20/kPBXG297iP8+/F9w4xs+lyb3IkcSfoSUr3fVz7mYqESFato5 JnjRQGT2/f/ehxkc09jATqVGj9nyQMoD2GNPjiNnYyTVBwK5Ol/s9+E2VSL4TSLrgS2R07kY9zPi VOM3lhDDRnceboNSaqnfMwIDAQABo4IBczCCAW8wHAYDVR0RBBUwE4ERYmVtYXNjQGdvb2dsZS5j b20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNVHQ4E FgQUwJS1fB3cBxoLgZFatdIO9Vp5wOcwTAYDVR0gBEUwQzBBBgkrBgEEAaAyASgwNDAyBggrBgEF BQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wUQYIKwYBBQUHAQEE RTBDMEEGCCsGAQUFBzAChjVodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc3Nt aW1lY2EyMDE4LmNydDAfBgNVHSMEGDAWgBRMtwWJ1lPNI0Ci6A94GuRtXEzs0jA/BgNVHR8EODA2 MDSgMqAwhi5odHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2NhL2dzc21pbWVjYTIwMTguY3JsMA0G CSqGSIb3DQEBCwUAA4IBAQCC91PBn9rMxo8kSo1zNY2mxkTQDTVc0oyYk8s3y72y21IEp/d/+h1H VTCD2FR30aFUv8hTJkebJ5Z1/zue2L7sx/lLEOIHm9uYxyTkTWbKup3+XrE1vhODTHVx+ktMuOTY z447/fwjy4praSaFrQsOjTPbAoU6xuC8S2j2K2Yg6XQsctcKHKeAJjN6evZYChDaTBLmtYq9LTSH KVv3Et795vNK3gWKjhEkJtaBu4FfKLoopb1PENJ/zK6p/3edCLFgCRMSlbQ0SGtdVESSJcgezSwW WK2VB1Zcj2kyVzcL1pmV8m1xQuz2aBgUMn7peoVxKxYKP12gMtzeMvkzltYBMYICYTCCAl0CAQEw XzBLMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEhMB8GA1UEAxMYR2xv YmFsU2lnbiBTTUlNRSBDQSAyMDE4AhAB/KjX5Q+DIvcirbV30XR3MA0GCWCGSAFlAwQCAQUAoIHU MC8GCSqGSIb3DQEJBDEiBCAwjHZZANmfcQq+I4kprM0+tVPg6v7b8NlIiGEcUGJU3zAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA3MjMxNDU5MTVaMGkGCSqGSIb3 DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglghkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAE ggEAndkGm6AGLIN2R+qwf9T2Z2fZgLC/7/FZcG5dbmGXOL4CltlP5qlSAb3w/ntl3RkUHYCZ6BB4 bXDpl8BUpfreQJKdHFAmnnP23l0cb2aeBoHFhc4+lIrd0lxYct/cI2uRJt0WrYz2XaHKDqthq67D WS5EWcw2yOrNp0MNwt5f9cD/w9dYgmygu3OT+My/Nh+qhXm4xe+E+TNF0wavaQR89qlB4sQE1d0D vtTGfZTYww/SdV/0Vx2YaWFApEvowRaLI7aNZaQkjOWLpESABsFobxfiNq96tQfsYw1/9K68rh5w xWz1usZC3mRCnXG6QjaLGL9F+zxI1bQ9NK6VK3F6Jg== --0000000000009790c205ab1d195d-- From nobody Thu Jul 23 08:02:56 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2CB263A0864 for ; Thu, 23 Jul 2020 08:02:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UtcuoAIROHUJ for ; Thu, 23 Jul 2020 08:02:54 -0700 (PDT) Received: from mail-oi1-x22c.google.com (mail-oi1-x22c.google.com [IPv6:2607:f8b0:4864:20::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D9AE63A0865 for ; Thu, 23 Jul 2020 08:02:53 -0700 (PDT) Received: by mail-oi1-x22c.google.com with SMTP id w17so5255788oie.6 for ; Thu, 23 Jul 2020 08:02:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=arb82radcmOJt8QX5q40L81jbitqoUk+5jH96N4Leuk=; b=Z64g5Exk+iLWGGatA5MPefbB/XEKwMtvFfb+78fqc/67rATYevmzTrlwc40xpSpJR+ 7sP0jlfEjctItBlQa7AmfK9fK/g94PLBFQ8v1ImdOOFs2a8X/jhcF4v/kV65KvcLRbBV Er0WuVAJ4gOwXahdztT1TyHheA8CYPH/drpIVTgR4rKLflX4UkJct9GupWylND3W/oV5 FrJjvrCWpinCdp//cjLTv2ct/k1NKrefgqY6ICoSjx8yHjySiekfgxzVF0KnPW5sDAHs 6oYAYxeAzl6+GqMbOow6PbyIKLnLriwPSYseaKqJnaA1QxZglPUelOJOlkRIEYWKNAKe 8/nw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=arb82radcmOJt8QX5q40L81jbitqoUk+5jH96N4Leuk=; b=ssbt2bSXcon9atyCG4gtkHEsj7yOWOOqJOh+mxsVDOe8tTpjivuybZlcflNB5rpHfY csiVJW6jexEAwGGfuuDy1JnNw7cy7ZMkDju2sE/d4NlqOd19iOq0KyKAovcTQxtXPz0e BcYWWNbPe3qkOgfn+yEQkRaLNp25UMi5PZHCkNtWtbzBJt/Rq3A03yOVfzvyZPYC0dGN kbHH8p8By+qIe1BnkIIAI6bfGrbONwDYTlyZAjiMLVv/PnFLHQL5/DLPm9CPAPyO1xVr 96BqSBYCCelk01NpHX4VgxJD81iCoNZ0zyn7CdkAKxsI9Z8JLGYjEReR4oaa2178Bm5k /tng== X-Gm-Message-State: AOAM531nKm5OrraJ6U3ag6eiRg0jWj0xnP7CDYn7By3EAdNFysuniFfZ VqdCNqp+iAOMUABFefdOCAxoxbB6Ii4OXYWL+vE= X-Google-Smtp-Source: ABdhPJxhsLQbDfqwTEZIHNe1RGdswqGFPHyiUR9u+MbZYASjnrCfcSAx0xVYng+ww2jIHIPlxLYGVGy8aPRC13kii1I= X-Received: by 2002:aca:5c03:: with SMTP id q3mr4277442oib.132.1595516573156; Thu, 23 Jul 2020 08:02:53 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> <20200723141314.GA32028@nic.fr> In-Reply-To: <20200723141314.GA32028@nic.fr> From: Tim Wicinski Date: Thu, 23 Jul 2020 11:02:42 -0400 Message-ID: To: Stephane Bortzmeyer Cc: Ben Schwartz , David Schinazi , ADD Mailing list , Tommy Pauly Content-Type: multipart/alternative; boundary="000000000000938b8005ab1d2650" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 15:02:55 -0000 --000000000000938b8005ab1d2650 Content-Type: text/plain; charset="UTF-8" As a DNS person, I want to use DNS for that discovery mechanism. I imagine that non-DNS people want to use non-DNS mechanisms for that discovery. I would ask how do you see this draft as a better solution than the add-resinfo draft. tim On Thu, Jul 23, 2020 at 10:13 AM Stephane Bortzmeyer wrote: > On Wed, Jul 22, 2020 at 04:34:41PM -0400, > Ben Schwartz wrote > a message of 232 lines which said: > > > This draft's PvD mechanism (+PUSH) also seems to overlap considerably > with > > draft-schinazi-httpbis-doh-preference-hints, > > Both proposals (draft-schinazi-httpbis-doh-preference-hints and > draft-pauly-add-resolver-discovery) have in common that a Web server > can tell the user agent which DNS resolver to use for subsequent > queries. I'm not convinced it is a good idea. Before discussing the > details of the proposal, did anyone write a pros-and-cons document > about this idea, which is quite new for the Internet? > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000938b8005ab1d2650 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
As a DNS person, I want to use DNS for that discovery mechanism.=C2=A0
I imagine = that non-DNS people want to use non-DNS mechanisms for that discovery.=C2= =A0

<= /div>
I would a= sk how do you see this draft as a better=C2=A0solution than the add-resinfo= draft.=C2=A0

tim

=

On Thu, Jul 23, 2020 at 10:13 AM Stephane Bortzmeyer <bortzmeyer@nic.fr> wrote:=
On Wed, Jul 22,= 2020 at 04:34:41PM -0400,
=C2=A0Ben Schwartz <bemasc@google.com> wrote
=C2=A0a message of 232 lines which said:

> This draft's PvD mechanism (+PUSH) also seems to overlap considera= bly with
> draft-schinazi-httpbis-doh-preference-hints,

Both proposals (draft-schinazi-httpbis-doh-preference-hints and
draft-pauly-add-resolver-discovery) have in common that a Web server
can tell the user agent which DNS resolver to use for subsequent
queries. I'm not convinced it is a good idea. Before discussing the
details of the proposal, did anyone write a pros-and-cons document
about this idea, which is quite new for the Internet?

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000938b8005ab1d2650-- From nobody Thu Jul 23 08:55:09 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 77DDA3A09D1 for ; Thu, 23 Jul 2020 08:55:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lS4bF1TZfrdF for ; Thu, 23 Jul 2020 08:55:05 -0700 (PDT) Received: from mail-wm1-x32b.google.com (mail-wm1-x32b.google.com [IPv6:2a00:1450:4864:20::32b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F15093A09AA for ; Thu, 23 Jul 2020 08:55:04 -0700 (PDT) Received: by mail-wm1-x32b.google.com with SMTP id f18so5665844wml.3 for ; Thu, 23 Jul 2020 08:55:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=EEBvI7JqfXuHh1Fhc3OmuZC86RXUh66zTWTrsd7hirk=; b=Cu3jALlRWbpJCOGH1nfJeNoZk340dL2NDfbAl4gx8MmdgKGzzYPp0s4egeMNA1OKMg /9yafjdTBxpBNqH/8ewO5suo016tIacMwnNBVNV9janjKd1DGZ4Mk+ERSQJM4BecD7MT Pof+dQZiOG9I8PfW4xMh1CurKQTUsoJex5qxQjwpC2d4rBUA0iLm1jXVIr1Cy851j3XU H8G8Jwn//w2TmVzOOlNn6xhrJ+9ENp3Wu3NtUyPd2ZTC5KAVpujfTPEynoeRkfS014oR oCtvtNSQOtWWXTWVi5UkfZFkReSNlSdRQjMFuwjCqku8OhYxNWfOFZPfSipP6qhlpy76 3ZGw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=EEBvI7JqfXuHh1Fhc3OmuZC86RXUh66zTWTrsd7hirk=; b=OCHfS3LBO+ms2jc8nLf9SqzX8sYa+BKx5O5TV7xKc6OtN+lJwzyftpR9UEEKGJ10Br K7I9ErDQwGeZzdCYnQ55r+Q6hoCtOQFS5Mvsxjw9dTTOpx6RRma1OCu98rXkXfULSQCt qGMTxWHyp8MVX+9ce1a6CDFTM3N1W+AgeFM6m1089JTbXvw7zf0eVMgRfJO8SYve8zww sXBeSpqTrtW3/pQ1qLllkrBAMH7+K4KMUS4riHURH3sm5srbKmy7bkivGkW14rAO4ra8 bUyk6W46PF9Dp3ISYLfa+sGg//US8l+8U39vA6dnFielO70yiRQ0UjqGWtMTUX12kpsP UNZQ== X-Gm-Message-State: AOAM530YMWFvT4iYS9AZ+MGK0ELAtNgPybfnezkxKiy3Qff3WWQI/M6i 76uSLJ7nwjjILVQHSeGU7jAJoGxC6M0gzngZ0E2iUQ== X-Google-Smtp-Source: ABdhPJyydY+5awW570NDV4RC6tloQ9Azj1S4lnArUX/BuFmsHwqTsoPmZujDZ2IUUZuIfURc/QFK2PJt6yyiaV+fvG0= X-Received: by 2002:a1c:49c6:: with SMTP id w189mr2342688wma.97.1595519703036; Thu, 23 Jul 2020 08:55:03 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> In-Reply-To: From: Ben Schwartz Date: Thu, 23 Jul 2020 11:54:50 -0400 Message-ID: To: Tommy Pauly Cc: Stephane Bortzmeyer , David Schinazi , ADD Mailing list , Tommy Pauly Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000002be41305ab1de194" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 15:55:08 -0000 --0000000000002be41305ab1de194 Content-Type: multipart/alternative; boundary="000000000000224e4b05ab1de1af" --000000000000224e4b05ab1de1af Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 22, 2020 at 8:15 PM Tommy Pauly wrote: > Hi Ben, > > Thanks for the comments and thoughts! Responses inline. > > On Jul 22, 2020, at 1:34 PM, Ben Schwartz < > bemasc=3D40google.com@dmarc.ietf.org> wrote: > > I had some more time to read this and try to understand it. Some more > questions: > > Why is DNSSEC needed for use of =E2=80=9Cdohuri=E2=80=9D in SVCB/HTTPS? = An attacker who > can inject this record can also inject false AAAA records for any names o= f > interest, allowing them to proxy and observe all the user=E2=80=99s traff= ic (and > disable ECH). I can believe there's a relevant attack, but it would help > to have an explanation for it. > > > We want to verify the designation if we=E2=80=99re going to start steerin= g traffic > to a new resolver. This is indeed a higher bar than what an attacker can = do > for a cleartext record. > Similar steering attacks already exist via A, AAAA, CNAME, and DNAME records, so this "MUST" seems strange. Doing this without DNSSEC doesn't make anything worse than the status quo. I think it would help if the draft had a clearer confidentiality criterion. What guarantee are you trying to provide? I think this requirement would be easier to motivate if the guarantee is "Accessing a webpage that includes subresources from subdomains does not reveal the subdomain labels to any active attacker when both server and client implement this specification.". Even so, this requirement seems unnecessarily restrictive. Note that DNSSEC is not the only way to prove that the designation is > legitimate. It can also happen by checking HTTPS resources that are signe= d > with a name that matches the name or is a parent of the name doing the > designation. > > For the attack about a user disabling ECH, etc, by blocking packets, > that=E2=80=99s an area where a client can protect itself by having a defa= ult > encrypted resolver, or by using a mechanism like Oblivious DoH. > > > PvD: The use of "https://example.com/.well-known/pvd" makes sense to me, > but the use of =E2=80=9Chttps://doh.example.net/.well-known/pvd/dns-query= " seems > very odd. Instead, could you do a GET for the DoH URI template with no > =E2=80=9Cdns=E2=80=9D parameter, setting the Accept header to =E2=80=9Cap= plication/pvd+json=E2=80=9D? That > would avoid the need for coupling across distant paths, and avoid > .well-known=E2=80=99s implication that these are logically properties of = the entire > origin. > > > The point of this way of finding the well-known JSON by taking the path > into account is to allow specifying information in case multiple DoH > servers are running on a given host. > > However, it certainly could be OK to do the query like you mention=E2=80= =94for our > server implementation, it was easier to split out the hosting of a JSON > file as opposed to handling DNS messages based on a path, rather than > merely an accept content type. It was mainly a practical concern. Happy t= o > bikeshed. > > > I'm having trouble understanding which of these mechanisms applies to a > whole subdomain tree, and which apply only to the named domain. (And eve= n > more trouble understanding why, or why not.) > > > I=E2=80=99ve filed an issue to help address this. In general, a designati= on > applies to the whole subdomain tree, but we want to add some additional > information in the JSON data to indicate if there is a given subdomain th= at > should be explicitly separated. > > https://github.com/tfpauly/draft-pauly-adaptive-dns-privacy/issues/121 > > Of course, if a more specific subdomain has a different designation, that > already would take precedence and cause clients to switch over. > > > This draft's PvD mechanism (+PUSH) also seems to overlap considerably wit= h > draft-schinazi-httpbis-doh-preference-hints, which proposes a > "DoH-Preference" response header. I think we should probably avoid > standardizing both. The comparison is interesting: I=E2=80=99m not sure = PvD is > really the right semantic for this use case, but I do like that it=E2=80= =99s > explicitly scoped to the domain. A response header is syntactically scop= ed > to a single response, although HTTP headers have been used to convey a > variety of domain-wide information. > > One key difference might be how these approaches interact with caching > reverse proxies. With a (naive) caching reverse proxy in the middle, I= =E2=80=99m > not sure how HTTP/2 PUSH would work. The DoH-Preference header would wor= k, > but it would have to be attached to every response, which seems inefficie= nt. > > > We will discuss this more in the ADD meeting. I think the preference hint= s > proposal mainly overlaps with the discovery mechanism over DoH, as oppose= d > to the mechanism to discover additional information. From the discovery > perspective, we believe that a solution based in DNS and SVCB makes more > sense for the DNS operator (with multi-CDN concerns, etc) than putting > things in an origin=E2=80=99s response headers. > > As for the information, mainly we believe there just needs to be some > content (probably JSON) that a client can query on a DoH server to get > information about how it can be used. The reason we like PvD here is that > it can align with a resolver configuration blob that can be sent directly > from a local network. Generally, the reason I see this as fitting PvD > semantics is that, since resolver configurations and split-DNS > configurations are inherently defining a new set of consistent informatio= n > about accessing the Internet, it falls under the same purpose as PvD > additional information. But this can be a bikeshed too! > > >> > Going to your previous comment/suggestion: > > I don't claim to have understood this proposal in full (for starters, I'm > not familiar with PvD), but it seems like a plausible direction to me. O= ne > small, but perhaps consequential suggestion: > > Instead of placing a "dohuri" SvcParamKey in the HTTPS record (Section > 3.1), I think it would be better to put a domain name there (e.g. "resolv= er=3D > doh.example.net"). Then the client would do a SVCB query for "_ > dns.doh.example.net", retrieving a SVCB record containing the DoH URI (as > in Section 5). This adds a roundtrip, but I think it maintains better > separation of concerns (e.g. server choice vs. protocol choice). If look= up > latency is a problem, I think we could find an optional optimization to > collapse this roundtrip (perhaps with a design much like the current draf= t). > > More generally, any use of SVCB requires a mapping document for the > scheme. I'd be happy to help write a mapping document for dns:// -> _dns= , > if we decide to go in that direction. > > This is an interesting direction. Certainly, if we can look up the _dns > (dns://) SVCB type for a SUDN like resolver.arpa to upgrade a given > resolver, being able to look up that type on a domain seems like it shoul= d > work. > > I don=E2=80=99t love the idea of requiring an extra round trip, but I cou= ld see > that being mitigated if a given client already knows about a resolver, an= d > is just correlating them. > > I may suggest a middle-ground: let=E2=80=99s define the =E2=80=9Cresolver= =3D=E2=80=9C parameter for > indicating a designated resolver name in the way you suggest, but also be > able to provide hint parameters like what we have here to allow clients t= o > skip the extra round trip if the resolver information in the _dns record = is > simply a DoH URI or a DoT port. > > Best, > Tommy > > > >> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > --000000000000224e4b05ab1de1af Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 22, 2020 at 8:15 PM Tommy= Pauly <tpauly=3D40apple.c= om@dmarc.ietf.org> wrote:
Hi Ben,

=
Thanks for the comments and thoughts! Responses inline.

On Jul 22, 2020, at 1:34 PM, Ben = Schwartz <bemasc=3D40google.com@dmarc.ietf.org> wrote:

I had some more time to read this and try to under= stand it.=C2=A0 Some more questions:

Why is DNSSEC need= ed for use of =E2=80=9Cdohuri=E2=80=9D in SVCB/HTTPS?=C2=A0 An attacker who= can inject this record can also inject false AAAA records for any names of= interest, allowing them to proxy and observe all the user=E2=80=99s traffi= c (and disable ECH).=C2=A0 I can believe there's a relevant attack, but= it would help to have an explanation for it.
<= div>
We want to verify the designation if we=E2=80=99re going= to start steering traffic to a new resolver. This is indeed a higher bar t= han what an attacker can do for a cleartext record.
=

Similar steering attacks already exist via= A, AAAA, CNAME, and DNAME records, so this "MUST" seems strange.= =C2=A0 Doing this without DNSSEC doesn't make anything worse than the s= tatus quo.

I think it would help if the draft had = a clearer confidentiality criterion.=C2=A0 What guarantee are you trying to= provide?=C2=A0 I think this requirement would be easier to motivate if the= guarantee is "Accessing a webpage that includes subresources from sub= domains does not reveal the subdomain labels to any active attacker when bo= th server and client implement this specification.".=C2=A0 Even so, th= is requirement seems unnecessarily restrictive.

Note that DNSSEC is not the only way to prove that= the designation is legitimate. It can also happen by checking HTTPS resour= ces that are signed with a name that matches the name or is a parent of the= name doing the designation.

For the attack about = a user disabling ECH, etc, by blocking packets, that=E2=80=99s an area wher= e a client can protect itself by having a default encrypted resolver, or by= using a mechanism like Oblivious DoH.

<= div>

PvD: The use of "https://example.com/.well-known/pvd" makes sense to me, but the use of =E2=80=9Chttps://doh.exampl= e.net/.well-known/pvd/dns-query" seems very odd.=C2=A0 Instead, co= uld you do a GET for the DoH URI template with no =E2=80=9Cdns=E2=80=9D par= ameter, setting the Accept header to =E2=80=9Capplication/pvd+json=E2=80=9D= ?=C2=A0 That would avoid the need for coupling across distant paths, and av= oid .well-known=E2=80=99s implication that these are logically properties o= f the entire origin.

The po= int of this way of finding the well-known JSON by taking the path into acco= unt is to allow specifying information in case multiple DoH servers are run= ning on a given host.

However, it certainly could = be OK to do the query like you mention=E2=80=94for our server implementatio= n, it was easier to split out the hosting of a JSON file as opposed to hand= ling DNS messages based on a path, rather than merely an accept content typ= e. It was mainly a practical concern. Happy to bikeshed.


I'm having trouble understan= ding which of these mechanisms applies to a whole subdomain tree, and which= apply only to the named domain.=C2=A0 (And even more trouble understanding= why, or why not.)

I=E2=80=99ve = filed an issue to help address this. In general, a designation applies to t= he whole subdomain tree, but we want to add some additional information in = the JSON data to indicate if there is a given subdomain that should be expl= icitly separated.

https://githu= b.com/tfpauly/draft-pauly-adaptive-dns-privacy/issues/121
Of course, if a more specific subdomain has a different designa= tion, that already would take precedence and cause clients to switch over.<= /div>


This draf= t's PvD mechanism (+PUSH) also seems to overlap considerably with draft= -schinazi-httpbis-doh-preference-hints, which proposes a "DoH-Preferen= ce" response header.=C2=A0 I think we should probably avoid standardiz= ing both.=C2=A0 The comparison is interesting: I=E2=80=99m not sure PvD is = really the right semantic for this use case, but I do like that it=E2=80=99= s explicitly scoped to the domain.=C2=A0 A response header is syntactically= scoped to a single response, although HTTP headers have been used to conve= y a variety of domain-wide information.

One key difference might be= how these approaches interact with caching reverse proxies.=C2=A0 With a (= naive) caching reverse proxy in the middle, I=E2=80=99m not sure how HTTP/2= PUSH would work.=C2=A0 The DoH-Preference header would work, but it would = have to be attached to every response, which seems inefficient.

We will discuss this more in the= ADD meeting. I think the preference hints proposal mainly overlaps with th= e discovery mechanism over DoH, as opposed to the mechanism to discover add= itional information. From the discovery perspective, we believe that a solu= tion based in DNS and SVCB makes more sense for the DNS operator (with mult= i-CDN concerns, etc) than putting things in an origin=E2=80=99s response he= aders.

As for the information, mainly we believe t= here just needs to be some content (probably JSON) that a client can query = on a DoH server to get information about how it can be used. The reason we = like PvD here is that it can align with a resolver configuration blob that = can be sent directly from a local network. Generally, the reason I see this= as fitting PvD semantics is that, since resolver configurations and split-= DNS configurations are inherently defining a new set of consistent informat= ion about accessing the Internet, it falls under the same purpose as PvD ad= ditional information. But this can be a bikeshed too!



Going to your previous comment/suggestion:

I don't claim to have understood this proposal in = full (for starters, I'm not familiar with PvD), but it seems like a pla= usible direction to me.=C2=A0 One small, but=C2=A0perhaps consequential sug= gestion:

<= /font>
Instead of placing a "d= ohuri" SvcParamKey in the HTTPS record (Section 3.1), I think it would= be better to put a domain name there (e.g.=C2=A0"resolver=3Ddoh.example.net").= =C2=A0 Then the client would do a SVCB query for "_dns.doh.example.net", retrie= ving a SVCB record containing the DoH URI=C2=A0(as in Section 5).=C2=A0 Thi= s adds a roundtrip, but I think it maintains better separation of concerns = (e.g. server choice vs. protocol choice).=C2=A0 If lookup latency=C2=A0is a= problem, I think we could find an optional optimization to collapse this r= oundtrip (perhaps with a design much like the current draft).=

More generally, any use of SVCB requires a mapping= document for the scheme.=C2=A0 I'd be happy to help write a mapping do= cument for dns:// -> _dns, if=C2=A0we decide to go in that direction.

This is an interesting directi= on. Certainly, if we can look up the _dns (dns://) SVCB type for a SUDN lik= e resolver.arpa to upgrade a given resolver, being able to look up that typ= e on a domain seems like it should work.

I don=E2= =80=99t love the idea of requiring an extra round trip, but I could see tha= t being mitigated if a given client already knows about a resolver, and is = just correlating them.

I may suggest a middle-grou= nd: let=E2=80=99s define the =E2=80=9Cresolver=3D=E2=80=9C parameter for in= dicating a designated resolver name in the way you suggest, but also be abl= e to provide hint parameters like what we have here to allow clients to ski= p the extra round trip if the resolver information in the _dns record is si= mply a DoH URI or a DoT port.

Best,
Tommy

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
<= /blockquote>
--000000000000224e4b05ab1de1af-- --0000000000002be41305ab1de194 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIPBgYJKoZIhvcNAQcCoIIO9zCCDvMCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ggxpMIIEkjCCA3qgAwIBAgINAewckktV4F6Q7sAtGDANBgkqhkiG9w0BAQsFADBMMSAwHgYDVQQL ExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMK R2xvYmFsU2lnbjAeFw0xODA2MjAwMDAwMDBaFw0yODA2MjAwMDAwMDBaMEsxCzAJBgNVBAYTAkJF MRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSEwHwYDVQQDExhHbG9iYWxTaWduIFNNSU1FIENB IDIwMTgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUeobu8FdB5oJg6Fz6SFf8YsPI dNcq4rBSiSDAwqMNYbeTpRrINMBdWuPqVWaBX7WHYMsKQwCOvAF1b7rkD+ROo+CCTJo76EAY25Pp jt7TYP/PxoLesLQ+Ld088+BeyZg9pQaf0VK4tn23fOCWbFWoM8hdnF86Mqn6xB6nLsxJcz4CUGJG qAhC3iedFiCfZfsIp2RNyiUhzPAqalkrtD0bZQvCgi5aSNJseNyCysS1yA58OuxEyn2e9itZJE+O sUeD8VFgz+nAYI5r/dmFEXu5d9npLvTTrSJjrEmw2/ynKn6r6ONueZnCfo6uLmP1SSglhI/SN7dy L1rKUCU7R1MjAgMBAAGjggFyMIIBbjAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUH AwIGCCsGAQUFBwMEBggrBgEFBQcDCTASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRMtwWJ 1lPNI0Ci6A94GuRtXEzs0jAfBgNVHSMEGDAWgBSP8Et/qC5FJK5NUPpjmove4t0bvDA+BggrBgEF BQcBAQQyMDAwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjMw NgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9yb290LXIzLmNybDBn BgNVHSAEYDBeMAsGCSsGAQQBoDIBKDAMBgorBgEEAaAyASgKMEEGCSsGAQQBoDIBXzA0MDIGCCsG AQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG9w0B AQsFAAOCAQEAwREs1zjtnFIIWorsx5XejqZtqaq5pomEvpjM98ebexngUmd7hju2FpYvDvzcnoGu tjm0N3Sqj5vvwEgvDGB5CxDOBkDlmUT+ObRpKbP7eTafq0+BAhEd3z2tHFm3sKE15o9+KjY6O5bb M30BLgvKlLbLrDDyh8xigCPZDwVI7JVuWMeemVmNca/fidKqOVg7a16ptQUyT5hszqpj18MwD9U0 KHRcR1CfVa+3yjK0ELDS+UvTufoB9wp2BoozsqD0yc2VOcZ7SzcwOzomSFfqv7Vdj88EznDbdy4s fq6QvuNiUs8yW0Vb0foCVRNnSlb9T8//uJqQLHxrxy2j03cvtTCCA18wggJHoAMCAQICCwQAAAAA ASFYUwiiMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIz MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTA5MDMxODEwMDAw MFoXDTI5MDMxODEwMDAwMFowTDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzAR BgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDMJXaQeQZ4Ihb1wIO2hMoonv0FdhHFrYhy/EYCQ8eyip0EXyTLLkvhYIJG 4VKrDIFHcGzdZNHr9SyjD4I9DCuul9e2FIYQebs7E4B3jAjhSdJqYi8fXvqWaN+JJ5U4nwbXPsnL JlkNc96wyOkmDoMVxu9bi9IEYMpJpij2aTv2y8gokeWdimFXN6x0FNx04Druci8unPvQu7/1PQDh BjPogiuuU6Y6FnOM3UEOIDrAtKeh6bJPkC4yYOlXy7kEkmho5TgmYHWyn3f/kRTvriBJ/K1AFUjR AjFhGV64l++td7dkmnq/X8ET75ti+w1s4FRpFqkD2m7pg5NxdsZphYIXAgMBAAGjQjBAMA4GA1Ud DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSP8Et/qC5FJK5NUPpjmove4t0b vDANBgkqhkiG9w0BAQsFAAOCAQEAS0DbwFCq/sgM7/eWVEVJu5YACUGssxOGhigHM8pr5nS5ugAt rqQK0/Xx8Q+Kv3NnSoPHRHt44K9ubG8DKY4zOUXDjuS5V2yq/BKW7FPGLeQkbLmUY/vcU2hnVj6D uM81IcPJaP7O2sJTqsyQiunwXUaMld16WCgaLx3ezQA3QY/tRG3XUyiXfvNnBB4V14qWtNPeTCek TBtzc3b0F5nCH3oO4y0IrQocLP88q1UOD5F+NuvDV0m+4S4tfGCLw0FREyOdzvcya5QBqJnnLDMf Ojsl0oZAzjsshnjJYS8Uuu7bVW/fhO4FCU29KNhyztNiUGUe65KXgzHZs7XKR1g/XzCCBGwwggNU oAMCAQICEAH8qNflD4Mi9yKttXfRdHcwDQYJKoZIhvcNAQELBQAwSzELMAkGA1UEBhMCQkUxGTAX BgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExITAfBgNVBAMTGEdsb2JhbFNpZ24gU01JTUUgQ0EgMjAx ODAeFw0yMDA2MDUwODIyMjhaFw0yMDEyMDIwODIyMjhaMCIxIDAeBgkqhkiG9w0BCQEWEWJlbWFz Y0Bnb29nbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2kbyV9S0YLplF3kV 6t3GgD7IyHe8L29pJ7l+UR0Sj31uPgXOFdSSdTVwhPfQvxmB2OUDXWDgDtZdL2xu4DgHhrDyyOXT 8uDJqUCPw004ZSuUfUor1vz5u6+oYNfx2OTPTb81vtsQO2/khni3iAeQlKgO/rUI1c9+zvT6k3mR SZUypAlk/rCyG6NV7NMJMmOaU20/kPBXG297iP8+/F9w4xs+lyb3IkcSfoSUr3fVz7mYqESFato5 JnjRQGT2/f/ehxkc09jATqVGj9nyQMoD2GNPjiNnYyTVBwK5Ol/s9+E2VSL4TSLrgS2R07kY9zPi VOM3lhDDRnceboNSaqnfMwIDAQABo4IBczCCAW8wHAYDVR0RBBUwE4ERYmVtYXNjQGdvb2dsZS5j b20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNVHQ4E FgQUwJS1fB3cBxoLgZFatdIO9Vp5wOcwTAYDVR0gBEUwQzBBBgkrBgEEAaAyASgwNDAyBggrBgEF BQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wUQYIKwYBBQUHAQEE RTBDMEEGCCsGAQUFBzAChjVodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc3Nt aW1lY2EyMDE4LmNydDAfBgNVHSMEGDAWgBRMtwWJ1lPNI0Ci6A94GuRtXEzs0jA/BgNVHR8EODA2 MDSgMqAwhi5odHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2NhL2dzc21pbWVjYTIwMTguY3JsMA0G CSqGSIb3DQEBCwUAA4IBAQCC91PBn9rMxo8kSo1zNY2mxkTQDTVc0oyYk8s3y72y21IEp/d/+h1H VTCD2FR30aFUv8hTJkebJ5Z1/zue2L7sx/lLEOIHm9uYxyTkTWbKup3+XrE1vhODTHVx+ktMuOTY z447/fwjy4praSaFrQsOjTPbAoU6xuC8S2j2K2Yg6XQsctcKHKeAJjN6evZYChDaTBLmtYq9LTSH KVv3Et795vNK3gWKjhEkJtaBu4FfKLoopb1PENJ/zK6p/3edCLFgCRMSlbQ0SGtdVESSJcgezSwW WK2VB1Zcj2kyVzcL1pmV8m1xQuz2aBgUMn7peoVxKxYKP12gMtzeMvkzltYBMYICYTCCAl0CAQEw XzBLMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEhMB8GA1UEAxMYR2xv YmFsU2lnbiBTTUlNRSBDQSAyMDE4AhAB/KjX5Q+DIvcirbV30XR3MA0GCWCGSAFlAwQCAQUAoIHU MC8GCSqGSIb3DQEJBDEiBCDgQ2DP3tzNxL8GmBGPywFLcLDDvmFJ7D/SoMmf+GrT8jAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA3MjMxNTU1MDNaMGkGCSqGSIb3 DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglghkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAE ggEAXfIe8/21SK420VxUGJkEWj4Crkp93lNqHTunrblU7y6qOwlvzvg9IM9l6FoQsgPdvmOtLiQR hHq4ItLju3jJSZFQof72Y0mXp4dm2bsd0QeMNW5soHWX+VE6CDUJjgWvNKOYvlpf/Kp4tFb5A+Rm g3APahZC31w7sOikyNSvcHH2uX63oHYXaJuBO4NM5vy0tIGZk2+pb3JvOewgaoR/4gcNvqtqGAt3 BU8Fh02EzGXqMuifibAL1CtRDMeSLjYu5GDHEkxiYzoJsNf14SzP9Y36Vzy2/mMztZMzw0Z+lIi7 gyA66HQAHKPwxRSuok4jCF/iWniymMvjYUNPAY+abw== --0000000000002be41305ab1de194-- From nobody Thu Jul 23 09:01:03 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C99C3A0A63 for ; Thu, 23 Jul 2020 09:01:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wRshyt2KkneG for ; Thu, 23 Jul 2020 09:00:59 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650123.outbound.protection.outlook.com [40.107.65.123]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 683293A09E3 for ; Thu, 23 Jul 2020 09:00:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Bh3RjSKAAK3+dspk+BZGOcPrfsgHPo70AkFQfmsl6dSUqO1F6M5E/xYRyA9jS0/cbyvY3wg9K9zBuUwjEbuaNrfCrbFeJPPQcYMFctopxP3Z2I+PYmPUpq6c/GBQHhXm4BOrcbq2thQAFZ0MnOo6lk8ifCcfgy+YoEaV7/TweWO+73U6XpBTHND+/ZWrT/7QTZkBdgJvAh0pCLLuqvR1CDXMZylMRtoQRlUP+CX39N2B3bwA+9Uoo0NPmpnt4w8Nbt0XLvWMGbBXKMkhqVOwIZeI3TjXJdlmdIUlqgXEuIHjiJvEQGwPS1yVo/tbZ7fz51vDSQzkJEs4dEb1cikg5Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=h18geQkdHdig7HGGrawolxqIDO0sUyoskxWy6vX4tB4=; b=duNMt3hnj9EQNJ+QfHEcrMRlLTS2j9aG4mzyPf5Gd4LtJpAU3QNDvk9ROnkJPCQSuphPLFBUwOZjirNzJzsqCsP1TTj8lRXYDeAmrVNOs4QGnmZKATMq+Q0vFkpTZd/81AYyzDi+x8Q24DD+mrIiYNEHmZQEpxyC1D5IFT8ljVf5WCYdraCuq3kazI2Fp5U1h8Yandk4vPHch7qOj9OSMtKb5Z/CM5S/LlMnt5nlRFq4ahFCz90SkMALh5vBJeLIitX51Ynu0AHOcLRk7WDDEnIU8RaU9xCbsq7iTAqBF/Ietr/qCpVqXP7nGAG8widJps75FnPZo2F0d4fDtq+oHg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=h18geQkdHdig7HGGrawolxqIDO0sUyoskxWy6vX4tB4=; b=WQzP93FClRF36wjfsWALe07QdF0SPz6IoKWjJaD442pI1hnj56ZmeEC9HiGiIqOcDO/rCRR0XmlY62auSW/wPAee/8ATdBipTbqWxG3v94Wo0bOmgeuO4HSfoCg7sWvgmUk0PJQc/fzl1X+HXqZt86/Yx8G/TR4dLc2XF34QUZQ= Received: from BL0PR00MB0772.namprd00.prod.outlook.com (2603:10b6:208:1ca::24) by MN2PR00MB0879.namprd00.prod.outlook.com (2603:10b6:208:a1::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3256.0; Thu, 23 Jul 2020 16:00:55 +0000 Received: from BL0PR00MB0772.namprd00.prod.outlook.com ([fe80::516e:201a:b83d:4229]) by BL0PR00MB0772.namprd00.prod.outlook.com ([fe80::516e:201a:b83d:4229%6]) with mapi id 15.20.3260.000; Thu, 23 Jul 2020 16:00:55 +0000 From: Tommy Jensen To: Tim Wicinski , Stephane Bortzmeyer CC: Ben Schwartz , David Schinazi , ADD Mailing list , Tommy Pauly Thread-Topic: [EXTERNAL] Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWYPtxmeEDeeoLd0a/5+pH93p1/KkVQqkAgAAKn4E= Date: Thu, 23 Jul 2020 16:00:55 +0000 Message-ID: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> <20200723141314.GA32028@nic.fr>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-23T16:00:55.055Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2601:600:a080:aff0:3465:f5b0:6755:8b3e] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 0de2c280-8287-4845-e79e-08d82f21954a x-ms-traffictypediagnostic: MN2PR00MB0879: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: /BC6hZK0f+nvXmW0PD6Dt5wAD7H1wRBQNo1qwIbv7zwp5IoB+2rkcJHIyjywMthLB3GKaEHckwCO9wSJ7tyiqcti6IY/5hL0btaQDSCPqoUzqjc/owd4QMupsH35D8gOAf8eX68Y3LURREWjAhVZwGUfqNfjL2y2NONwOtSwkG5EJ0fONLPN+f6/ZYzvDsQ7YpsT9BOI83lQxL3aP+6WBUDEpB0VywBv79XJMOATpflg1FqQ4K0qR+UcWQxDlcJew5Rh3pFGXrZhTcyvzSB2oUtk9fmx0NTUVVI7e/zSMXYz3CzHJFNM2Iryrsyui9d4+5WFP3AXEoWucaP6vsxuL6nyYNSDwRxXj5mcaOtcfDmHX9380l0AjG7TiZD/Y+GXGsQVkFOGOoCx1pel9u+5ug== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BL0PR00MB0772.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(136003)(346002)(376002)(39860400002)(396003)(366004)(8990500004)(6506007)(71200400001)(54906003)(110136005)(8936002)(53546011)(186003)(4326008)(10290500003)(316002)(19627405001)(15650500001)(966005)(8676002)(33656002)(2906002)(82950400001)(82960400001)(76116006)(52536014)(83380400001)(66574015)(478600001)(166002)(5660300002)(86362001)(7696005)(91956017)(55016002)(9686003)(66946007)(66556008)(64756008)(66446008)(66476007); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: 90PpPtDIXcK9OaJk5wRPpa2a0kByfVmypJMBErYl6c/o4fYiaBvsG21SrfYHwzpZ2aLYc74/Z8g3ROKJbUm78/Cv/u6UpSrcCpz2AW19jdRbbLgktvBYr3jiCNuMscxlyFMfMhIH0OevTv3ARLkbuae+xMU9Uv7p/VdaU+8ZAlksJJlEk8axaOM1eP4Xa9PzeULqLm4G0HSXXDG65UDgmtFUtlmcrl0PoMPaK0YCisQOCKgPhNRrA3im+KahIytUW7g/cBZqoyU0lZFlR5D5lUM5qm4ni72n1FcDTj9y34cDp/XG2aB/rRtNuvZ/JHDc+QDksMALNrqbNoM18q9po6KrcPNe4kuV+ugo8PWEUQgrJ3Ft3iAn963zp1OJFmPRNSjcNV+sFLg0A9myq+9gnwRZ6U1/eo9PBRUbu/DMEkUqpkqPNGOQQlxRkkcvkURJCVYAMgXAMZPVnJt1Ix26vXejM5FF2dggt6sJwaI7y2yX1DU2LlO3RprR5xM3B7xv+rmUU2cAlHCDifRyFgz6qbYIvhrwMNnJnT0xsrSdENzUiMmKpoAd5cCt7zmZ/BDYtcCJKVOimMILYaZyNLGAaSZG5NYmpW5nAhx3Id7fd6oE0xnVUTput4BC2NhnXmitWX3DNmoV4mXMvwC2pG/P8lNSRLYo6DoD705SbjmEERsCdoVes7PZlJ57L5cOPKQByIpDtEsXFeGZFkRSbWZC9w== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_BL0PR00MB0772F2BC03A2F38A50CE1FD2FA760BL0PR00MB0772namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BL0PR00MB0772.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0de2c280-8287-4845-e79e-08d82f21954a X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Jul 2020 16:00:55.6781 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 29LAs1IUfN44tLIapNh8QGinrgF1Gh6PDBN3+ay4ornzvCTTz2MrYrHmPo2fSHvc+ZxeTXtPNSiqirxa+xDVcQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR00MB0879 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 16:01:02 -0000 --_000_BL0PR00MB0772F2BC03A2F38A50CE1FD2FA760BL0PR00MB0772namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hey Tim, One reason we see our draft as a better approach is that we reuse the recor= d type used for advertising the keys needed for Encrypted ClientHello. This= means a client wanting to implement both standards only needs to add one n= ew query type rather than two. Notice our primary discovery mechanism is a DNS approach (querying for the = designation record), as well as our bootstrapping mechanism (querying a res= olver for its DoH configuration and confirmed during its handshake). I thin= k we agree on DNS being the best mechanism as it solves many problems that = primary discovery through non-DNS mechanism introduces, such as complicatio= ns with multiple CDN hosting. However, it also makes sense to allow a DoH client to query a DoH server ab= out its properties once it has discovered the server. The method of using H= TTPS to confirm designation is provided as an alternative to DNSSEC, which = doesn't enjoy universal deployment even today. Hey Stephane, Do you have specific concerns with our approach? Is your question about the= concept of Adaptive DNS as a whole (zones designating DNS servers for futu= re queries), or about the specific implementation mechanism (using PvDs, wh= ere the designation comes from)? Thanks, Tommy Jensen =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The latest in Windows Internet Protocols: Native gRPC support: https://aka.ms/grpcblogpost DNS over HTTPS: https://aka.ms/dohblogpost ________________________________ From: Add on behalf of Tim Wicinski Sent: Thursday, July 23, 2020 8:02 AM To: Stephane Bortzmeyer Cc: Ben Schwartz ; David Schinazi ; ADD Mailing list ; Tommy Pauly Subject: [EXTERNAL] Re: [Add] New Version Notification for draft-pauly-add-= resolver-discovery-01.txt As a DNS person, I want to use DNS for that discovery mechanism. I imagine that non-DNS people want to use non-DNS mechanisms for that disco= very. I would ask how do you see this draft as a better solution than the add-res= info draft. tim On Thu, Jul 23, 2020 at 10:13 AM Stephane Bortzmeyer > wrote: On Wed, Jul 22, 2020 at 04:34:41PM -0400, Ben Schwartz > wrote a message of 232 lines which said: > This draft's PvD mechanism (+PUSH) also seems to overlap considerably wit= h > draft-schinazi-httpbis-doh-preference-hints, Both proposals (draft-schinazi-httpbis-doh-preference-hints and draft-pauly-add-resolver-discovery) have in common that a Web server can tell the user agent which DNS resolver to use for subsequent queries. I'm not convinced it is a good idea. Before discussing the details of the proposal, did anyone write a pros-and-cons document about this idea, which is quite new for the Internet? -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add --_000_BL0PR00MB0772F2BC03A2F38A50CE1FD2FA760BL0PR00MB0772namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hey Tim,

One reason we see our draft as a better approach is that we reuse the recor= d type used for advertising the keys needed for Encrypted ClientHello. This= means a client wanting to implement both standards only needs to add one n= ew query type rather than two. 

Notice our primary discovery mechanism is a DNS approach (querying for the = designation record), as well as our bootstrapping mechanism (querying a res= olver for its DoH configuration and confirmed during its handshake). I thin= k we agree on DNS being the best mechanism as it solves many problems that primary discovery through non-DN= S mechanism introduces, such as complications with multiple CDN hosting.&nb= sp;

However, it also makes sense to allow a DoH client to query a DoH server ab= out its properties once it has discovered the server. The method of using H= TTPS to confirm designation is provided as an alternative to DNSSEC, which = doesn't enjoy universal deployment even today.

Hey Stephane,

Do you have specific concerns with our approach? Is your question about the= concept of Adaptive DNS as a whole (zones designating DNS servers for futu= re queries), or about the specific implementation mechanism (using PvDs, wh= ere the designation comes from)? 

Thanks,=
Tommy Jensen
=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The latest in Wi= ndows Internet Protocols:
  Native gR= PC support: https://aka.ms/grpcblogpost 
  DNS over = HTTPS: https://aka.ms/dohblogpost=  

From: Add = <add-bounces@ietf.org> on behalf of Tim Wicinski <tjw.ietf@gmail.c= om>
Sent: Thursday, July 23, 2020 8:02 AM
To: Stephane Bortzmeyer <bortzmeyer@nic.fr>
Cc: Ben Schwartz <bemasc@google.com>; David Schinazi <dschi= nazi.ietf@gmail.com>; ADD Mailing list <add@ietf.org>; Tommy Pauly= <tpauly=3D40apple.com@dmarc.ietf.org>
Subject: [EXTERNAL] Re: [Add] New Version Notification for draft-pau= ly-add-resolver-discovery-01.txt
 
As a DNS per= son, I want to use DNS for that discovery mechanism. 
I imagine th= at non-DNS people want to use non-DNS mechanisms for that discovery. <= /div>

I would ask = how do you see this draft as a better solution than the add-resinfo dr= aft. 

tim


On Thu, Jul 23, 2020 at 10:13 AM St= ephane Bortzmeyer <bortzmeyer@nic.fr> wrote:
On Wed, Jul 22, 2020 at 04:34:41PM -0400,
 Ben Schwartz <bemasc@google.com> wrote
 a message of 232 lines which said:

> This draft's PvD mechanism (+PUSH) also seems to overlap considerably = with
> draft-schinazi-httpbis-doh-preference-hints,

Both proposals (draft-schinazi-httpbis-doh-preference-hints and
draft-pauly-add-resolver-discovery) have in common that a Web server
can tell the user agent which DNS resolver to use for subsequent
queries. I'm not convinced it is a good idea. Before discussing the
details of the proposal, did anyone write a pros-and-cons document
about this idea, which is quite new for the Internet?

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add=
--_000_BL0PR00MB0772F2BC03A2F38A50CE1FD2FA760BL0PR00MB0772namp_-- From nobody Thu Jul 23 09:13:22 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C2A23A0BB5 for ; Thu, 23 Jul 2020 09:13:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id orJo8bqRbsRf for ; Thu, 23 Jul 2020 09:13:19 -0700 (PDT) Received: from mx3.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C9843A0BB0 for ; Thu, 23 Jul 2020 09:13:18 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx3.open-xchange.com (Postfix) with ESMTPS id E50116A305; Thu, 23 Jul 2020 18:13:16 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1595520796; bh=pJ2QckJZoJY4SLOO+kSZoidWo4Lc/w9LhPH9SrzeoiY=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=6Byw1sK+q9r2Ns3h5/zSO8+sbESTFUCHgREHFbCY4JuO0PTsO+cgZqALawXha2hKC 0bReO6nrpbd8eW3DkREz+8pDkSbz0Rx+Ncctfj2ZzXdhOh64gKpzze0ZBHq5KQiGTc pJxkUQuJ3EU6UsLAa35Vr9LVR6fhOzHALRnKBKQA9BBds8Z3guDo+9JHDby24ng7hV 98UDpGOT4CvXOSdzRn82irv9jqpoy05yHAYyBzNEi2gSgMyV+LqX0mj8X98oGijrlZ jlnGPHz+VGtlSfgCkeCX4Q2HrPYwKbNOPD3blg69T6THH8F1kg21RfP9BK7JseQnkB jOxTI/PECgmgA== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id D6D423C023B; Thu, 23 Jul 2020 18:13:16 +0200 (CEST) Date: Thu, 23 Jul 2020 18:13:16 +0200 (CEST) From: Vittorio Bertola To: Stephane Bortzmeyer Cc: ADD Mailing list Message-ID: <1357064544.7200.1595520796779@appsuite-gw1.open-xchange.com> In-Reply-To: <20200723141314.GA32028@nic.fr> References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> <20200723141314.GA32028@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev17 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 16:13:21 -0000 > Il 23/07/2020 16:13 Stephane Bortzmeyer ha scritto: > > Both proposals (draft-schinazi-httpbis-doh-preference-hints and > draft-pauly-add-resolver-discovery) have in common that a Web server > can tell the user agent which DNS resolver to use for subsequent > queries. I'm not convinced it is a good idea. Before discussing the > details of the proposal, did anyone write a pros-and-cons document > about this idea, which is quite new for the Internet? Also, I don't think I heard any explanation of how this (having each destination domain provide its own resolver) is better than just getting rid of (intermediate) resolvers and letting each client connect directly to the authoritatives for the destination domain - something which would already be possible today without the need for new protocols. What's the advantage of locating a resolver just in front of the authoritative? -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Thu Jul 23 09:31:46 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FC033A0C44 for ; Thu, 23 Jul 2020 09:31:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.918 X-Spam-Level: X-Spam-Status: No, score=-1.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZNSHGa1DXWk3 for ; Thu, 23 Jul 2020 09:31:43 -0700 (PDT) Received: from ppsw-43.csi.cam.ac.uk (ppsw-43.csi.cam.ac.uk [131.111.8.143]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6D92C3A0C43 for ; Thu, 23 Jul 2020 09:31:43 -0700 (PDT) X-Cam-AntiVirus: no malware found X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus Received: from grey.csi.cam.ac.uk ([131.111.57.57]:51660) by ppsw-43.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.139]:25) with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) id 1jye8B-000VLM-oj (Exim 4.92.3) (return-path ); Thu, 23 Jul 2020 17:31:39 +0100 Date: Thu, 23 Jul 2020 17:31:39 +0100 From: Tony Finch To: Vittorio Bertola cc: Stephane Bortzmeyer , ADD Mailing list In-Reply-To: <1357064544.7200.1595520796779@appsuite-gw1.open-xchange.com> Message-ID: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> <20200723141314.GA32028@nic.fr> <1357064544.7200.1595520796779@appsuite-gw1.open-xchange.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 16:31:45 -0000 Vittorio Bertola wrote: > > Also, I don't think I heard any explanation of how this (having each > destination domain provide its own resolver) is better than just getting > rid of (intermediate) resolvers and letting each client connect directly > to the authoritatives for the destination domain - something which would > already be possible today without the need for new protocols. What's the > advantage of locating a resolver just in front of the authoritative? A stub resolver isn't able to chase CNAMEs or delegations, so if the destination site has a setup that is even slightly non-trivial, stub resolvers will need to use a recursive server to walk the namespace for them. DNS with RD=1 and RD=0 are different protocols in a similar way to message submission and SMTP-to-MX - they involve different protocol semantics (especially in terms of what is allowed or forbidden) even though the syntax is similar, and the trust boundaries and relationships are quite different. Tony. -- f.anthony.n.finch http://dotat.at/ Isle of Man: Northwest 3 or 4 backing south 4 or 5 later. Slight, occasionally moderate later. Fair, rain later. Good, occasionally moderate or poor later. From nobody Thu Jul 23 09:50:32 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5643F3A0C6E for ; Thu, 23 Jul 2020 09:50:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cTdUYW5wkshb for ; Thu, 23 Jul 2020 09:50:28 -0700 (PDT) Received: from mail-qk1-x735.google.com (mail-qk1-x735.google.com [IPv6:2607:f8b0:4864:20::735]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD6F83A0BB6 for ; Thu, 23 Jul 2020 09:50:28 -0700 (PDT) Received: by mail-qk1-x735.google.com with SMTP id l6so5980351qkc.6 for ; Thu, 23 Jul 2020 09:50:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=V7AOcvAgLr4u+TSiFbCmR1SsCwebM2ax3lTvnE9OYFI=; b=EJETXECl6GzwyMbeP+TL6Sdu0hZk/nv22jgpTLgm4CRydPkqWoHwKcrFNO6NUWEeKs oGGV5+nhqVNRpR6w3Stj9+I1UTqIKUKeLHEVVqqk7S4tHuFixrB0aGPWFFI9DxLXHqlD qJ2W8ixwkNVLejFPVkza43y1CbwLNsmUThNbWM+dEUSJFqKQd6+CCGx7lMPrgWXHVPSq wpRc76swAumzwjBjpL4QKDojH1HlwDyaVTSXEjm+2zvQFgc7VKK/KY6Omp+W0KY0f26L LoeLeJlxhkXB57FgyUU+WJxokvOa583/aR2JfKBNrO9TkU2B9+7LCbJq3u1O4t4sGQg6 /xbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=V7AOcvAgLr4u+TSiFbCmR1SsCwebM2ax3lTvnE9OYFI=; b=lnclilGja6N+x4/pvyjFHk+zoLEF+oA14Iv4U2m2ymDYr1jJYMGueb/bLRGKhF7lCk WO5uKkLNTLevHZcuVcDkrJlUSFpfGUcvgiIdbDWHPcBLPTy8lAbLzPE70FPyxwJCjBox U3kHaYr4ex1YJTYLjAecWB2LHIFaXPVpJ+LuSh6dHah5lCTqoNniCxHd9M+nSkXZa49Y w75lZ+qbO8wAOS8MHZPNpA5voTYGbqEtcRfeMP1w6jqNB0XnLrPEqJEzCP+r6iUPdS9y 3t+vtlvGwSR4sjXDZ/FsWzv3FcOXiIPQ3Z+xJiUK9W952wCCNVEDc49nr3LXDlJOHINO WiQg== X-Gm-Message-State: AOAM532LjsjMaMgMR09GKs2zHB1zAxL7v5LXFnxmMglopB9iuCM97Lkl Q92DTnwAvjc4/Zsg8kQMA0KXEm/PqvXluv158fA= X-Google-Smtp-Source: ABdhPJxbu/VV2XfYt2tsHl+v0cQdyzsf+2MC0amjvSQo26xNO3M5+uD7Rc0b0HfbHSXL0ri3y3v+D1Jp3afCqXV5WUo= X-Received: by 2002:a05:620a:209b:: with SMTP id e27mr5974151qka.431.1595523027882; Thu, 23 Jul 2020 09:50:27 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <20200721073934.GA29757@nic.fr> <20200723143446.GA648@nic.fr> In-Reply-To: <20200723143446.GA648@nic.fr> From: "Chris Box (BT)" Date: Thu, 23 Jul 2020 17:50:15 +0100 Message-ID: To: Stephane Bortzmeyer Cc: Neil Cook , "add@ietf.org" , Andrew Campling Content-Type: multipart/alternative; boundary="0000000000004ed83b05ab1ea7a9" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 16:50:30 -0000 --0000000000004ed83b05ab1ea7a9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Stephane, EU's Network Neutrality regulation ( https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=3DCELEX:32015R2120= &rid=3D2#d1e445-1-1) states: 1. *End-users shall have the right to* access and distribute information and content, use and provide applications and services, and *use terminal equipment of their choice*, irrespective of the end-user=E2=80=99s or provi= der=E2=80=99s location or the location, origin or destination of the information, content, application or service, via their internet access service. These have been in force for some years. If Orange don't let you change, they are most likely in breach of the French law which adopts these regulations. Chris On Thu, 23 Jul 2020 at 15:34, Stephane Bortzmeyer wrote= : > On Tue, Jul 21, 2020 at 07:14:47PM +0100, > Neil Cook wrote > a message of 30 lines which said: > > > People are free to choose their CPE. > > This is not true in many cases (example: Orange, the biggest IAP in > France). > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000004ed83b05ab1ea7a9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Stephane,


1.=C2=A0=C2=A0=C2=A0= End-users shall have the right to access and distribute information and content, use and provide applications and services, and use=20 terminal equipment of their choice, irrespective of the end-user=E2=80= =99s or=20 provider=E2=80=99s location or the location, origin or destination of the= =20 information, content, application or service, via their internet access=20 service.

These have been in force for some years. If Orange don'= t let you change, they are most likely in breach of the French law which ad= opts these regulations.

Chris

On Thu, 23 Jul 2020 at 15:34, Step= hane Bortzmeyer <bortzmeyer@nic.fr<= /a>> wrote:
O= n Tue, Jul 21, 2020 at 07:14:47PM +0100,
=C2=A0Neil Cook <neil.cook@noware.co.uk> wrote
=C2=A0a message of 30 lines which said:

> People are free to choose their CPE.

This is not true in many cases (example: Orange, the biggest IAP in
France).

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000004ed83b05ab1ea7a9-- From nobody Thu Jul 23 09:54:11 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 262B63A0C94 for ; Thu, 23 Jul 2020 09:54:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.121 X-Spam-Level: X-Spam-Status: No, score=-2.121 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=apple.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pcfNyUZ3UTEK for ; Thu, 23 Jul 2020 09:54:09 -0700 (PDT) Received: from nwk-aaemail-lapp02.apple.com (nwk-aaemail-lapp02.apple.com [17.151.62.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B0C13A0C81 for ; Thu, 23 Jul 2020 09:54:09 -0700 (PDT) Received: from pps.filterd (nwk-aaemail-lapp02.apple.com [127.0.0.1]) by nwk-aaemail-lapp02.apple.com (8.16.0.43/8.16.0.42) with SMTP id 06NGnw5d023530; Thu, 23 Jul 2020 09:54:03 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apple.com; h=content-type : mime-version : subject : from : in-reply-to : date : cc : content-transfer-encoding : message-id : references : to; s=20180706; bh=QmFTApDf+WS+BZZskTR7KV7rVUFLFB6ccNu03JrZezA=; b=VujOfbwRxO0SD5Jv+NAKzVgAVee7NI1+Jo0mg/xa2jKqY/z/9Eymdt+rb+8G5UsQzXZx V0PflWmjTbyxC5/jCqdSk5Qkvv4Krkx5p0pzY1XtOp45mQB1AyxGorlJI7iLBOT2J3LC A+9md0aV8HBMChtpd9g3SIpFW7Gk9/tXNeUGBqJZB76dbFsbJs+DWgbhDrBD/vjvC6I6 MLoBh6kIUDo3VF2Tre3/O9FxFlNKBzyIOR2xAHUMHJbEOFclwhj30dEgz4WfMYKAHS50 vDbDqnNPC8kPs2RbBMLyWKogDaPdMMZZIEOSIN9esgjhp56DPjyELbtFYsr8d6pv/3ok FA== Received: from rn-mailsvcp-mta-lapp04.rno.apple.com (rn-mailsvcp-mta-lapp04.rno.apple.com [10.225.203.152]) by nwk-aaemail-lapp02.apple.com with ESMTP id 32bwnhtjsq-9 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 23 Jul 2020 09:54:03 -0700 Received: from rn-mailsvcp-mmp-lapp01.rno.apple.com (rn-mailsvcp-mmp-lapp01.rno.apple.com [17.179.253.14]) by rn-mailsvcp-mta-lapp04.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPS id <0QDX004BMLM26SQ0@rn-mailsvcp-mta-lapp04.rno.apple.com>; Thu, 23 Jul 2020 09:54:03 -0700 (PDT) Received: from process_milters-daemon.rn-mailsvcp-mmp-lapp01.rno.apple.com by rn-mailsvcp-mmp-lapp01.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) id <0QDX00X00LGJ1L00@rn-mailsvcp-mmp-lapp01.rno.apple.com>; Thu, 23 Jul 2020 09:54:02 -0700 (PDT) X-Va-A: X-Va-T-CD: 0a008174194a758a01d2a17305d35152 X-Va-E-CD: 70bcdc11c9d31840c4d740c8fd997a66 X-Va-R-CD: 9efa4d046db31f83a71c66eaba62594d X-Va-CD: 0 X-Va-ID: 318b51bf-4b1e-4198-acea-f5108a28410b X-V-A: X-V-T-CD: 0a008174194a758a01d2a17305d35152 X-V-E-CD: 70bcdc11c9d31840c4d740c8fd997a66 X-V-R-CD: 9efa4d046db31f83a71c66eaba62594d X-V-CD: 0 X-V-ID: 2d2a890a-cea4-4acc-b13d-d957865b2200 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-23_09:2020-07-23, 2020-07-23 signatures=0 Received: from [17.234.41.20] (unknown [17.234.41.20]) by rn-mailsvcp-mmp-lapp01.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPSA id <0QDX00QAYLM1AW00@rn-mailsvcp-mmp-lapp01.rno.apple.com>; Thu, 23 Jul 2020 09:54:02 -0700 (PDT) Content-type: text/plain; charset=us-ascii MIME-version: 1.0 (Mac OS X Mail 13.4 \(3608.80.7.2.3\)) From: Tommy Pauly In-reply-to: <20200723141314.GA32028@nic.fr> Date: Thu, 23 Jul 2020 09:54:01 -0700 Cc: Ben Schwartz , David Schinazi , ADD Mailing list , Tommy Pauly Content-transfer-encoding: quoted-printable Message-id: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> <20200723141314.GA32028@nic.fr> To: Stephane Bortzmeyer X-Mailer: Apple Mail (2.3608.80.7.2.3) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-23_09:2020-07-23, 2020-07-23 signatures=0 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 16:54:10 -0000 > On Jul 23, 2020, at 7:13 AM, Stephane Bortzmeyer = wrote: >=20 > On Wed, Jul 22, 2020 at 04:34:41PM -0400, > Ben Schwartz wrote=20 > a message of 232 lines which said: >=20 >> This draft's PvD mechanism (+PUSH) also seems to overlap considerably = with >> draft-schinazi-httpbis-doh-preference-hints, >=20 > Both proposals (draft-schinazi-httpbis-doh-preference-hints and > draft-pauly-add-resolver-discovery) have in common that a Web server > can tell the user agent which DNS resolver to use for subsequent > queries. I'm not convinced it is a good idea. Before discussing the > details of the proposal, did anyone write a pros-and-cons document > about this idea, which is quite new for the Internet? Hi Stephane, To be clear, draft-pauly-add-resolver-discovery does not have any = mechanism in which a client learns from arbitrary Web server about which = DNS resolver to use. All of the designation for resolvers occurs either = from DNS records, or from information fetched directly from a DNS server = (as a request to the DoH server for a JSON configuration file). We = believe it is important to root this in DNS. Thanks, Tommy >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Thu Jul 23 09:58:32 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84DF23A0BCC for ; Thu, 23 Jul 2020 09:58:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.12 X-Spam-Level: X-Spam-Status: No, score=-2.12 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=apple.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t3muj5UUf92A for ; Thu, 23 Jul 2020 09:58:30 -0700 (PDT) Received: from nwk-aaemail-lapp01.apple.com (nwk-aaemail-lapp01.apple.com [17.151.62.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5942C3A0BCA for ; Thu, 23 Jul 2020 09:58:30 -0700 (PDT) Received: from pps.filterd (nwk-aaemail-lapp01.apple.com [127.0.0.1]) by nwk-aaemail-lapp01.apple.com (8.16.0.43/8.16.0.42) with SMTP id 06NGovHj023657; Thu, 23 Jul 2020 09:58:26 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apple.com; h=from : message-id : content-type : mime-version : subject : date : in-reply-to : cc : to : references; s=20180706; bh=nxDpFtxPeWgKZonYi49TD00NtcwHMFqpqBRk3OVUZJ4=; b=cmZjW3kEcAuelHzZ64puT34wzTt4z3/b0KwcT1s2iqgLCatFsnGNi17us2qNmrTI+1Ds Y2eQJT060rfL2FMcV3+4ZkNZ6IMXTxbRtgIilQVkslyZpgkdzu7ra+tig4QD6Hy79foN A4aqvlahchw9At/TYM7Sr+2hOOzSDUy4N9+cpZ+gr93CcouCxF1sFY8l4OiBdhSW6uyd eR0NDoSX8Rloml30uwPsLA5N3PMGgbsPYVavg4teryHymL/UYm7HPrKXJPCo7DGReW2o eLh7ObBIwVu26lhjh+xvP/9h3O1IMzo3oTWy1jXl4FOelMdK4VAr0iggKEInpeSBsPXA Jg== Received: from rn-mailsvcp-mta-lapp01.rno.apple.com (rn-mailsvcp-mta-lapp01.rno.apple.com [10.225.203.149]) by nwk-aaemail-lapp01.apple.com with ESMTP id 32c010mgta-12 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 23 Jul 2020 09:58:26 -0700 Received: from rn-mailsvcp-mmp-lapp01.rno.apple.com (rn-mailsvcp-mmp-lapp01.rno.apple.com [17.179.253.14]) by rn-mailsvcp-mta-lapp01.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPS id <0QDX0000WLTDVE50@rn-mailsvcp-mta-lapp01.rno.apple.com>; Thu, 23 Jul 2020 09:58:25 -0700 (PDT) Received: from process_milters-daemon.rn-mailsvcp-mmp-lapp01.rno.apple.com by rn-mailsvcp-mmp-lapp01.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) id <0QDX00P00KQUZE00@rn-mailsvcp-mmp-lapp01.rno.apple.com>; Thu, 23 Jul 2020 09:58:25 -0700 (PDT) X-Va-A: X-Va-T-CD: c913097a86589a1bd9d31c6c6ead3a00 X-Va-E-CD: 70bcdc11c9d31840c4d740c8fd997a66 X-Va-R-CD: 9efa4d046db31f83a71c66eaba62594d X-Va-CD: 0 X-Va-ID: f2e49e54-74fe-48f9-864a-4e0ee163c9dc X-V-A: X-V-T-CD: c913097a86589a1bd9d31c6c6ead3a00 X-V-E-CD: 70bcdc11c9d31840c4d740c8fd997a66 X-V-R-CD: 9efa4d046db31f83a71c66eaba62594d X-V-CD: 0 X-V-ID: 1c3197f2-8712-4c46-a1b0-2b468fa705ba X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-23_09:2020-07-23, 2020-07-23 signatures=0 Received: from [17.234.41.20] (unknown [17.234.41.20]) by rn-mailsvcp-mmp-lapp01.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPSA id <0QDX00A9CLTAQZ00@rn-mailsvcp-mmp-lapp01.rno.apple.com>; Thu, 23 Jul 2020 09:58:24 -0700 (PDT) From: Tommy Pauly Message-id: Content-type: multipart/alternative; boundary="Apple-Mail=_3176DEDD-453C-4CDF-B264-9915DD439287" MIME-version: 1.0 (Mac OS X Mail 13.4 \(3608.80.7.2.3\)) Date: Thu, 23 Jul 2020 09:58:22 -0700 In-reply-to: Cc: Stephane Bortzmeyer , Ben Schwartz , David Schinazi , ADD Mailing list To: Tim Wicinski References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> <20200723141314.GA32028@nic.fr> X-Mailer: Apple Mail (2.3608.80.7.2.3) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-23_09:2020-07-23, 2020-07-23 signatures=0 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 16:58:31 -0000 --Apple-Mail=_3176DEDD-453C-4CDF-B264-9915DD439287 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I agree that the discovery should all be based in DNS. The mechanism = described in draft-pauly-add-resolver-discovery uses DNS messages for = discovery, and can use additional information served up by a DoH server. = It does not get any discovery information from arbitrary web servers, = and I think doing so would be a problem for deployment models. Regarding the way to fetch JSON information=E2=80=94be that in a GET = request to a DoH server or with a new RRType=E2=80=94I think that is = something that can equally go either way, and I=E2=80=99d be happy to = see this bike-shedded. To that end, I think these approaches can be = reconciled and combined. What is more important for us is the content of = the information and how it is used. Thanks, Tommy > On Jul 23, 2020, at 8:02 AM, Tim Wicinski wrote: >=20 > As a DNS person, I want to use DNS for that discovery mechanism.=20 > I imagine that non-DNS people want to use non-DNS mechanisms for that = discovery.=20 >=20 > I would ask how do you see this draft as a better solution than the = add-resinfo draft.=20 >=20 > tim >=20 >=20 > On Thu, Jul 23, 2020 at 10:13 AM Stephane Bortzmeyer = > wrote: > On Wed, Jul 22, 2020 at 04:34:41PM -0400, > Ben Schwartz > wrote=20 > a message of 232 lines which said: >=20 > > This draft's PvD mechanism (+PUSH) also seems to overlap = considerably with > > draft-schinazi-httpbis-doh-preference-hints, >=20 > Both proposals (draft-schinazi-httpbis-doh-preference-hints and > draft-pauly-add-resolver-discovery) have in common that a Web server > can tell the user agent which DNS resolver to use for subsequent > queries. I'm not convinced it is a good idea. Before discussing the > details of the proposal, did anyone write a pros-and-cons document > about this idea, which is quite new for the Internet? >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add = --Apple-Mail=_3176DEDD-453C-4CDF-B264-9915DD439287 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I = agree that the discovery should all be based in DNS. The mechanism = described in draft-pauly-add-resolver-discovery uses DNS messages for = discovery, and can use additional information served up by a DoH server. = It does not get any discovery information from arbitrary web servers, = and I think doing so would be a problem for deployment models.

Regarding the way to = fetch JSON information=E2=80=94be that in a GET request to a DoH server = or with a new RRType=E2=80=94I think that is something that can equally = go either way, and I=E2=80=99d be happy to see this bike-shedded. To = that end, I think these approaches can be reconciled and combined. What = is more important for us is the content of the information and how it is = used.

Thanks,
Tommy

On Jul = 23, 2020, at 8:02 AM, Tim Wicinski <tjw.ietf@gmail.com> = wrote:

As a DNS person, I want to use DNS for = that discovery mechanism. 
I imagine that non-DNS people want to = use non-DNS mechanisms for that discovery. 

I would ask how do you see this draft as = a better solution than the add-resinfo draft. 

tim


On Thu, Jul 23, 2020 at 10:13 AM Stephane = Bortzmeyer <bortzmeyer@nic.fr> wrote:
On Wed, Jul 22, 2020 at 04:34:41PM = -0400,
 Ben Schwartz <bemasc@google.com> wrote
 a message of 232 lines which said:

> This draft's PvD mechanism (+PUSH) also seems to overlap = considerably with
> draft-schinazi-httpbis-doh-preference-hints,

Both proposals (draft-schinazi-httpbis-doh-preference-hints and
draft-pauly-add-resolver-discovery) have in common that a Web server
can tell the user agent which DNS resolver to use for subsequent
queries. I'm not convinced it is a good idea. Before discussing the
details of the proposal, did anyone write a pros-and-cons document
about this idea, which is quite new for the Internet?

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_3176DEDD-453C-4CDF-B264-9915DD439287-- From nobody Thu Jul 23 09:59:39 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 544663A0BDD for ; Thu, 23 Jul 2020 09:59:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nzeD5112qvY0 for ; Thu, 23 Jul 2020 09:59:35 -0700 (PDT) Received: from mail-ot1-x32c.google.com (mail-ot1-x32c.google.com [IPv6:2607:f8b0:4864:20::32c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CEB533A0BCD for ; Thu, 23 Jul 2020 09:59:30 -0700 (PDT) Received: by mail-ot1-x32c.google.com with SMTP id w17so4883130otl.4 for ; Thu, 23 Jul 2020 09:59:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=0kTLUYkWMhSiP0MogjRf4DNnbR8IRkx2vQ2OKdI9um8=; b=pbeKJLBLTiE+nZaPXnFNxTLFvcYm/EM1ob3ABgGfRDeJ6YuyebrFnqOiVgL5B7fYsl h9QAT4ybq61qpOiDuvLdwAPAZnpbgIZMpWig/ANgBkwVvIuuiX3IkioTu1mAzJz5gXFc BQdI7ANOcWRLh+kNab4IzT8fkG60oXvSJB8YyABD2uBxzkqZHKBae1CgB8Ab6tBwEzXe uRa7t968OPlfomlsD1SNo5Z8kx9fI4emdNHUnJG+8TGVUm4MWwX0J524Dq0vmLVzGrGp BspAd4zUR0wqbDxqLwefPmM07ZpVhOkdT/zudGxgjm2cQc/XnXtQhxXLrxhcrCdBFYrq 55uQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=0kTLUYkWMhSiP0MogjRf4DNnbR8IRkx2vQ2OKdI9um8=; b=IctnOdcKsO3Y8MsD25zViGwQv+qgxj3nGQtE1qgo+/3IuMKsixYx6uA4tcuHHem2kK qfDoJPFxlL2htKG2AON1oIIAT/S0Zacy3YIcNXCwtWcnHixWh98D7p790T92pLI6eOFV PczTzqJkkIyjgQH7KkLX8FYV2SBTBQaomFajYERwYkwif5iMlWyK91JtACzx+ob2uS++ UxPLXhgswgkJ1EzftXyl3T1djviIHKR+TB0y4bUAD35dpCHrodOMNJh8a+9t/BOCpVaI f82kxEWGv+hW54sqM8JS6d+qnyDxA+27BnBBKC3KCfJYlfKXLKmMFnS2bGreR5y83aN8 HlUQ== X-Gm-Message-State: AOAM531fi2S7x8wtO1bXtqDRDFYjnnujIgtbb4ws9mONVtINCQBaXJ9u iZDl8Bbtk3ruRkysE2WZfqqBSGDrqblPDOcfR9I= X-Google-Smtp-Source: ABdhPJw4gXvexl4gIhobtNJ0LVXJk2Zs6+K/jPbunPQkSykz/YrmkWrEprdquCYkqWTSydm5TY7VQQZJmujGFjd36Lw= X-Received: by 2002:a9d:480d:: with SMTP id c13mr4032523otf.4.1595523569955; Thu, 23 Jul 2020 09:59:29 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> <20200723141314.GA32028@nic.fr> In-Reply-To: From: Tim Wicinski Date: Thu, 23 Jul 2020 12:59:19 -0400 Message-ID: To: Tommy Pauly Cc: Stephane Bortzmeyer , Ben Schwartz , David Schinazi , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000009e375b05ab1ec7e0" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 16:59:37 -0000 --0000000000009e375b05ab1ec7e0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks Tommy. Stephane also pointed out I was confusing my drafts in my replies. So you should just carry on. tim On Thu, Jul 23, 2020 at 12:58 PM Tommy Pauly wrote: > I agree that the discovery should all be based in DNS. The mechanism > described in draft-pauly-add-resolver-discovery uses DNS messages for > discovery, and can use additional information served up by a DoH server. = It > does not get any discovery information from arbitrary web servers, and I > think doing so would be a problem for deployment models. > > Regarding the way to fetch JSON information=E2=80=94be that in a GET requ= est to a > DoH server or with a new RRType=E2=80=94I think that is something that ca= n equally > go either way, and I=E2=80=99d be happy to see this bike-shedded. To that= end, I > think these approaches can be reconciled and combined. What is more > important for us is the content of the information and how it is used. > > Thanks, > Tommy > > On Jul 23, 2020, at 8:02 AM, Tim Wicinski wrote: > > As a DNS person, I want to use DNS for that discovery mechanism. > I imagine that non-DNS people want to use non-DNS mechanisms for that > discovery. > > I would ask how do you see this draft as a better solution than the > add-resinfo draft. > > tim > > > On Thu, Jul 23, 2020 at 10:13 AM Stephane Bortzmeyer > wrote: > >> On Wed, Jul 22, 2020 at 04:34:41PM -0400, >> Ben Schwartz wrote >> a message of 232 lines which said: >> >> > This draft's PvD mechanism (+PUSH) also seems to overlap considerably >> with >> > draft-schinazi-httpbis-doh-preference-hints, >> >> Both proposals (draft-schinazi-httpbis-doh-preference-hints and >> draft-pauly-add-resolver-discovery) have in common that a Web server >> can tell the user agent which DNS resolver to use for subsequent >> queries. I'm not convinced it is a good idea. Before discussing the >> details of the proposal, did anyone write a pros-and-cons document >> about this idea, which is quite new for the Internet? >> >> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> > > --0000000000009e375b05ab1ec7e0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks Tommy.

Stephane also pointed out I was confusing my drafts in my repli= es.=C2=A0 So you should just carry on.

tim


On Thu, Jul 23, 2020 at 12:58 PM Tommy Paul= y <tpauly@apple.com> wrote:
I agree that the discovery should all be based in = DNS. The mechanism described in draft-pauly-add-resolver-discovery uses DNS= messages for discovery, and can use additional information served up by a = DoH server. It does not get any discovery information from arbitrary web se= rvers, and I think doing so would be a problem for deployment models.
<= br>
Regarding the way to fetch JSON information=E2=80=94be that i= n a GET request to a DoH server or with a new RRType=E2=80=94I think that i= s something that can equally go either way, and I=E2=80=99d be happy to see= this bike-shedded. To that end, I think these approaches can be reconciled= and combined. What is more important for us is the content of the informat= ion and how it is used.

Thanks,
Tommy

On Jul 23, 2020, at 8:02 AM, Tim W= icinski <tjw.iet= f@gmail.com> wrote:

As a DNS person, I want to use = DNS for that discovery mechanism.=C2=A0
I imagine that non-DNS people want to use no= n-DNS mechanisms for that discovery.=C2=A0

I would ask how do you see this draft as a be= tter=C2=A0solution than the add-resinfo draft.=C2=A0

tim


On Thu, Jul 23, 2020 at 10:13 = AM Stephane Bortzmeyer <bortzmeyer@nic.fr> wrote:
On Wed, Jul 22, 2020 at 04:34:41PM -0400,
=C2=A0Ben Schwartz <bemasc@google.com> wrote
=C2=A0a message of 232 lines which said:

> This draft's PvD mechanism (+PUSH) also seems to overlap considera= bly with
> draft-schinazi-httpbis-doh-preference-hints,

Both proposals (draft-schinazi-httpbis-doh-preference-hints and
draft-pauly-add-resolver-discovery) have in common that a Web server
can tell the user agent which DNS resolver to use for subsequent
queries. I'm not convinced it is a good idea. Before discussing the
details of the proposal, did anyone write a pros-and-cons document
about this idea, which is quite new for the Internet?

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

--0000000000009e375b05ab1ec7e0-- From nobody Thu Jul 23 15:34:47 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9ECF43A07D0 for ; Thu, 23 Jul 2020 15:34:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com header.b=31jM/I8f; dkim=pass (2048-bit key) header.d=comcast.com header.b=MYURWQ8X; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=comcastcorp.onmicrosoft.com header.b=oBqIUxPr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mD87EblHgdNc for ; Thu, 23 Jul 2020 15:34:43 -0700 (PDT) Received: from mx0b-00143702.pphosted.com (mx0b-00143702.pphosted.com [148.163.141.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD20C3A07CE for ; Thu, 23 Jul 2020 15:34:43 -0700 (PDT) Received: from pps.filterd (m0184889.ppops.net [127.0.0.1]) by mx0b-00143702.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06NMOJ6C011569 for ; Thu, 23 Jul 2020 18:34:42 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.com; h=from : to : subject : date : message-id : content-type : mime-version; s=20190412; bh=fYZ1coONUsRu3lnfbOjTxxmDkXlQNf/kxjdmrJm0EN0=; b=31jM/I8f7qsMecMyJXmlrcXS1iaqAKB3w5QM6nuNAEHe7ZrCnN2zvowlzjG2WIJNKIZ/ CjBVmQP4623akEenSFY1//CM/EskGDHshohEi2XdIrZbEUPCS5E+8XpZX+CK3cc+5VTB XGOv7yeKDO6hq3pjRN6G+dZb0C2udk4OUwqfRj6WMfS7zCrmYmY9x6g3ON0T7DgJf2NC egd5LTLH1ekdHWrWCnN7vkHW4RIDAlqgsDcIj99siqej47/TSLvEg1w+VnT0K7aJBO+y 7QM6dVQcTeRG9lTNx4lJqHxgTuVcfe0M1aC3Sfzdu8v4Nnh86uGCcy/VDdSBj7+8wS1g WQ== Received: from pacdcmhout02.cable.comcast.com (pacdcmhout02.cable.comcast.com [68.87.96.15]) by mx0b-00143702.pphosted.com with ESMTP id 32eqa11q3t-6 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 23 Jul 2020 18:34:42 -0400 DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1595543682; x=2459457282; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=fYZ1coONUsRu3lnfbOjTxxmDkXlQNf/kxjdmrJm0EN0=; b=MYURWQ8XHmkg8ThHj9sKRWFvmvZZLuXMTd3WhvwNAM8Gjgb9v8OYk+h8iKimYTOJ 9IYWA1vwd/qLINRirP0YPmj4lMCnjSI5Frw8unBT99jfFWn/iS9KZy5/wDKPoPSp adzDyHTAPG1TGhiq4gvqNfKc9NND4FKH1q6DKLfUjU7OWhCqpWCsiWsx7cD5JIfp 441YKqlce00OuVLuparyDVuPWQ3hr2kgz8ujukm3+LXvL55kcUdqys1kARE4/YJe FyE3A5Sy+DbueQj2LOZjnzjQp5+HeXi1MMmcMXzi1vTsDbrBl/DjgRwTkOOOi3be G8px1j4kvCn4h7OUSsXRug==; X-AuditID: 4457600f-f0fff70000005543-9d-5f1a1081a918 Received: from PACDCEX54.cable.comcast.com (cas-umc02.ndceast.pa.bo.comcast.net [68.87.34.28]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by pacdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id D7.5C.21827.1801A1F5; Thu, 23 Jul 2020 18:34:42 -0400 (EDT) Received: from PACDCEX10.cable.comcast.com (24.40.1.133) by PACDCEX54.cable.comcast.com (24.40.2.153) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 23 Jul 2020 18:34:41 -0400 Received: from PACDCEXEDGE01.cable.comcast.com (76.96.78.71) by PACDCEX10.cable.comcast.com (24.40.1.133) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Thu, 23 Jul 2020 18:34:41 -0400 Received: from NAM12-MW2-obe.outbound.protection.outlook.com (104.47.66.42) by webmail.comcast.com (76.96.78.71) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 23 Jul 2020 18:34:40 -0400 Received: from BYAPR11MB3111.namprd11.prod.outlook.com (2603:10b6:a03:90::25) by BYAPR11MB3304.namprd11.prod.outlook.com (2603:10b6:a03:7a::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.24; Thu, 23 Jul 2020 22:34:39 +0000 Received: from BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0]) by BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0%4]) with mapi id 15.20.3216.023; Thu, 23 Jul 2020 22:34:39 +0000 From: "Deen, Glenn" To: ADD Mailing list Thread-Topic: Getting Ready for ADD at IETF108 - July 30 14:10 UTC Thread-Index: AQHWYUFzxNSY0IGHQUqh+ITYCMxb9w== Date: Thu, 23 Jul 2020 22:34:39 +0000 Message-ID: <16243176-7ACC-4C48-B3FB-BD2297F48A3A@comcast.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=comcast.com; x-originating-ip: [2605:e000:141b:121:6011:2b58:8590:7910] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 0ac5f395-fd85-42f2-d2df-08d82f5895fc x-ms-traffictypediagnostic: BYAPR11MB3304: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 86q5WtgVzFDbn3HqeGXLvM1lzn7j37YCoxvGeMLbxq+wOCyj6Nhx6cwm5Sc0wh5VGVIbgAw9YPEvc86eAADgtFSiPp+vmoVBBuSLdz9mdQfP/o620jVLremEuPct844zdroHNu1QQeDQ2cQkwx4IDJAMhBZ+rdv4cX+yGBxrD0l02UwKSeUTK1bpe7p2HXfYhgaqjOSvH4bjDlXyA4NSj9igVZVSvPPurbv3hC2l966KWHkuuv5uYVzXBRFRov9goaif0REDHrql4q3NENe32tSk3VNqYBmnpL8x7ns0nrlkeqn5cT9RD0EnskowxM38EubzBbFzscLtqnWv+knnmelC6mYM2eiABFmwJx2rR3GuFc9KXl7HEGmwXjKeVAD90hNGu7JobwUhFUbz1/SL4A== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3111.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(396003)(346002)(39860400002)(136003)(366004)(376002)(71200400001)(966005)(478600001)(6916009)(316002)(6506007)(186003)(83380400001)(6512007)(2616005)(86362001)(166002)(6486002)(33656002)(36756003)(76116006)(8936002)(66946007)(5660300002)(2906002)(66476007)(66446008)(64756008)(66556008)(8676002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: dFA3HvgJ0S7qnaMAvEGvPtu0MN6kq/w7/yYxAZ0CLZUXmJqpXc1iW77kNoxNIG4lUMpIep+od2f+RHJGHk43gtLHXfQ5omjWSuEyOmji+MOchmmcwcxaoiDbSzkLxr35Q6LVVqQW+YOiQ7if4CHr/Y3WiKlEbBNqhbdaLQPVwfwaSCEGIeHdaBXkm4N1vtBI2vWFvjSRRwhN+kYGVUUeJC+5+p9xWNDLJ8HJtrzYUdz5JCIg6JupG8OvF85dXT0FqmdfC7vSE7gHs4MpHcnc/mwFhF1Pa5y6kvDuZI17yBk0ihsTJPT5tLFW4VkfnbJgf3ICkm3XXf/OQNNQerAq4QBY3gH/0curdu4tH3jFlZb/AlXEFai1rEvm7zlL/xbnmz0eiXwYlLgXOlAc01Av21dpSl/t+00ehKEEALyjjTCXQmdy10Ny0nc9Cy2fAsst3qM3TI/wNqg9WTkWna/1vrm5+xOWUtrIadmeiJP9z25aFhxqdp01UjvaS6cxMp8MGPW/eqilrRZYQtsZLID3rr3MLRGEwAxmQlrlWYiFaWZ7B/sqyIuB5oEebZhghloz x-ms-exchange-transport-forked: True arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Qhr4H7KuXSgX2DlifCYR4252uKfD1i7Dfs3B/7iq4YD1Ksb8X1JX5OuT9R8H3UD/RKzm/MLG0HNgN5rNeN96vjlv2b8kdUX+3JnxJGpsQkVQifYBKglLXQWcOFD9f9y0XRTuMhYHuUqtKrLuoCb6r6dP+hqdOtX7Kj0kDI2bfWnUKmg62xKAGeQsBbesmeJDRVsw/dW8pfgDz6JlBHXs6QD7spsajih78ZncUw57u3u92izO1SleVH60fbiHgouSTVp86QGnMfVhjE2HGGtgM6B5WwXDoko766aKjLcaHcrM80vRsMG7twgTQIx+dZwRXhZ8ScaHmv6qdHlcMT9a+g== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qcZlCPZ/DcalHDCP4J/pTIY4aR2Q1JKUiCF1heG+2E4=; b=Y71uibpL0HVgbF45pFo8hGfTh4lGRiQJ3wsoTDU5n5Y/av6iECchGf+usPMAv97ETXHRvXJ0UQzhCwJPKdInC0C69knbqp1fSPyf1asGNFSExZR8i0PqEiqsis1Rh+nh4kA1upwN2IliFeCukDgLu1MUz+irgp7o+k39AdbmHgOkkcCDvIv6RfyaVt/yawunJlhWbQEiE57EvbevjOREUN7IdqEUaV6pvATWtnmUA9CcpPkHjJYLVNu6BdQ6f0/6ToARq4Nay2SuZJvGj5IgsfreGoHh5D+bQtbLK/j0CohhVNJVUrr58jL0QqSvRoysJ0p0KqY1M/KOjYiVLWPLwQ== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=comcast.com; dmarc=pass action=none header.from=comcast.com; dkim=pass header.d=comcast.com; arc=none dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastcorp.onmicrosoft.com; s=selector1-comcastcorp-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qcZlCPZ/DcalHDCP4J/pTIY4aR2Q1JKUiCF1heG+2E4=; b=oBqIUxPrJZaCVXxvd3uXuZIx6/mRmV+u65k54cOr2yQzpRjR2pgNd5Ws92JVUg3hfdjk3GbwpSjf1j48crK+f5fMYJLKigOSLySB9P/oco/ENgfZbSp5ucCCTMeay5qkazeyB/Re/4/hJMYpvRkm9UJbK0ToFaKuw8HOnxYLAnY= x-ms-exchange-crosstenant-authas: Internal x-ms-exchange-crosstenant-authsource: BYAPR11MB3111.namprd11.prod.outlook.com x-ms-exchange-crosstenant-network-message-id: 0ac5f395-fd85-42f2-d2df-08d82f5895fc x-ms-exchange-crosstenant-originalarrivaltime: 23 Jul 2020 22:34:39.1998 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 906aefe9-76a7-4f65-b82d-5ec20775d5aa x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: 8HnNYBv5e60o1TFOgc8Y0FI1z0bjWBrg/e/bKq7cWFKOlsSFzBr1gmu8ow5KWlI75b0lHU7mi5GuDLCJsRDK4rg6Izy1o8HV9Vi1w8MNpEk= x-ms-exchange-transport-crosstenantheadersstamped: BYAPR11MB3304 x-originatororg: comcast.com Content-Type: multipart/alternative; boundary="_000_162431767ACC4C48B3FBBD2297F48A3Acomcastcom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA02SbUhTYRTHeXbvtuty+bhmOy41XFkquimpaZlmhPnFLPwQWDRnXlJ8STaV VhFiSTWTXEihWC7cIs2aJTnTiBgOTDPBUIeU+Ro6pRVitaSttrvAb7//Of/nvPFQhEDHFlOF peW0slRRLOHwyMMnJEHR1Vgsj3GcSnQNPeUcRBl6vYN1DOXwkvPp4sJKWilLyeUVzKw84pTV GdB5rWmJW4WsOqRBFAU4DiaHAzWIRwlwPwucD+xsRvQiuGF7TzBiDIGz54NXWBCsG9tIRrSy oLnptjczi2Cie4F0F+bgKOjuStUgH0qId4Dhk4nl5i34APR9n2Uz8UPgXHTP4WYp2K5d5biZ xGGg67Z44nycAp+fVXveIrwVfg52eJjAIpicb/EwYAz6VyMEwwGwNOf01A/AMpgyrnoGRViD wKZ5gxjTPrhp6/ByMIy21Ho5E+wOC4fhSJgafMFluAg0a/e9DXaBdeW6l0OgvW6GZDgIpq0m jrsZ4D4CtF0NLEZME9DZ4ECMmCdh/fc7NnP7neA0q+tRbNOGjZr+ZQicB/bF0ibPAfzhbeM8 yYQjwNgrY9yh0FA7w2U4HGqa73EZSwY0TuRttOgQ1Y42JSRKE/dKkxKksfHPkeff5Pr1IMvd DDPCFJL48mu+BMoFbEWlSl1iRkAREiE/ConkAn6+Qn2BVp6TKyuKaZUZbaNIiYh/a2zxtACf VZTTRTRdRiv/Z1mUj7gKpRmyThouDgwcSW/eP8RNDqn6Yb8TXH9UG+cyWrhhm00xazKN/pLW HBH4unp70ujxXHv+5dS0oJYn6iv9roLHfgn1fyqysx5OGoQl48P+vumtyXu+Cgej+0fGx0J/ rb4cmmuLt+9ua7WGlxgWsr9Fu5TiM37LsOzqjGClZOZ8FElIVYEiNpJQqhR/Aco4zcozAwAA X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-23_09:2020-07-23, 2020-07-23 signatures=0 X-Proofpoint-Spam-Reason: safe Archived-At: Subject: [Add] Getting Ready for ADD at IETF108 - July 30 14:10 UTC X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 22:34:46 -0000 --_000_162431767ACC4C48B3FBBD2297F48A3Acomcastcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UmVtaW5kZXI6ICBBREQgbWVldHMgVGh1cnNkYXkgSnVseSAzMCBhdCAxNDoxMCBVVEMuICAgIFlv dSBjYW4gZ2V0IGludG8gdGhlIHZpcnR1YWwgc2Vzc2lvbiBmcm9tIHRoZSBBREQgTWVldGVjaG8g bGluayBvbiB0aGUgSUVURiBBZ2VuZGEgKGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvbWVl dGluZy8xMDgvYWdlbmRhKQ0KDQotZ2xlbm4NCg0KDQoNCuKAplRoZSBmb2xsb3dpbmcgZ3JlYXQg c2V0IG9mIGluZm8gcG9pbnRlcnMgSXMg4oCcYm9ycm93ZWTigJ0gZnJvbSB3aGF0IHRoZSBNT1BT IGNoYWlycyBzZW50IHRvIE1PUFMgZWFybGllciB0b2RheS4NCg0KDQoNCkxlc2xpZSBEYWlnbGUg d3JvdGUgdG8gTU9QU+KApi4NCg0KSSBzdHJvbmdseSBzdWdnZXN0IHRoYXQgeW91IHRha2UgdGhl IG9wcG9ydHVuaXR5IHRvIHJldmlldyB0aGUgYXZhaWxhYmxlIG1hdGVyaWFsIGJlZm9yZSB5b3Vy IGZpcnN0IElFVEYgbWVldGluZyBuZXh0IHdlZWsuIE15IGJpZ2dlc3QgdGFrZWF3YXkgZnJvbSB0 aGUgdGVzdCBzZXNzaW9uIHdhczogaXTigJlzIHNpbWlsYXIgdG8sIGJ1dCBub3QgdGhlIHNhbWUg YXMsIGV2ZXJ5IG90aGVyIHRvb2wgd2XigJl2ZSB1c2VkIGZvciBvbmxpbmUgbWVldGluZ3MsIHNv IHRoZXJlIHdpbGwgYmUgc29tZSBoaWNjdXBzLg0KDQpZb3XigJl2ZSBwcm9iYWJseSBzZWVuIHRo aXMgZWxzZXdoZXJlLCBidXQgdGhlIGtleSB0aGluZyBpcyB0aGF0IHRoZSBNZWV0ZWNobyBzZXNz aW9uIGlzIGxpbmtlZCB0byB0aGUgdmlkZW8gY2FtZXJhIGljb24gd2l0aCB0aGUgdG9vbCB0aXAg 4oCcTWVldGVjaG8gdmlkZW8gc3RyZWFtIiBvbiB0aGUgZGF0YXRyYWNrZXIgYWdlbmRhIHBhZ2U6 DQoNCmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvbWVldGluZy9hZ2VuZGEvPGh0dHBzOi8v dXJsZGVmZW5zZS5jb20vdjMvX19odHRwczovZGF0YXRyYWNrZXIuaWV0Zi5vcmcvbWVldGluZy9h Z2VuZGEvX187ISFQSVplZVc1d3NjeW5SUSEtSGFRaVVDU2VicTJJcHphRVBRQml4ZUp2aGZfbVVj SHhHTHFfSnc5MHNJbjJlUGZVNGxJQllwMmdTekJqRThPJD4NCg0KQW5kIGl0IHdpbGwgYmUgbGl2 ZSAxMG1pbiBiZWZvcmUgb3VyIHNlc3Npb24uDQoNClRoZXJlIGFyZSB0ZXN0IHNlc3Npb25zIHBv aW50ZWQgYXQgaW4gdGhlIGRvY3VtZW50YXRpb24uDQoNCkhlcmUgYXJlIHNvbWUgcG9pbnRlcnM6 DQoNClJFU09VUkNFUw0KDQogICogICBJRVRGIDEwOCBzZXNzaW9uIGNoYWlyIGd1aWRlDQpodHRw czovL3d3dy5pZXRmLm9yZy9ob3cvbWVldGluZ3MvMTA4L3Nlc3Npb24tY2hhaXItZ3VpZGUvPGh0 dHBzOi8vdXJsZGVmZW5zZS5jb20vdjMvX19odHRwczovd3d3LmlldGYub3JnL2hvdy9tZWV0aW5n cy8xMDgvc2Vzc2lvbi1jaGFpci1ndWlkZS9fXzshIVBJWmVlVzV3c2N5blJRIS1IYVFpVUNTZWJx MklwemFFUFFCaXhlSnZoZl9tVWNIeEdMcV9Kdzkwc0luMmVQZlU0bElCWXAyZ1RoYUIzYzQkPg0K ICAqICAgSUVURiAxMDggcGFydGljaXBhbnQgZ3VpZGUNCmh0dHBzOi8vd3d3LmlldGYub3JnL2hv dy9tZWV0aW5ncy8xMDgvc2Vzc2lvbi1wYXJ0aWNpcGFudC1ndWlkZS88aHR0cHM6Ly91cmxkZWZl bnNlLmNvbS92My9fX2h0dHBzOi93d3cuaWV0Zi5vcmcvaG93L21lZXRpbmdzLzEwOC9zZXNzaW9u LXBhcnRpY2lwYW50LWd1aWRlL19fOyEhUElaZWVXNXdzY3luUlEhLUhhUWlVQ1NlYnEySXB6YUVQ UUJpeGVKdmhmX21VY0h4R0xxX0p3OTBzSW4yZVBmVTRsSUJZcDJnZEFobjFDUSQ+DQogICogICBU dXRvcmlhbCB2aWRlbyBmcm9tIE1lZXRlY2hvDQpodHRwczovL3lvdXR1LmJlL2NuaUF4dU1jekVr PGh0dHBzOi8vdXJsZGVmZW5zZS5jb20vdjMvX19odHRwczoveW91dHUuYmUvY25pQXh1TWN6RWtf XzshIVBJWmVlVzV3c2N5blJRIS1IYVFpVUNTZWJxMklwemFFUFFCaXhlSnZoZl9tVWNIeEdMcV9K dzkwc0luMmVQZlU0bElCWXAyZ1RHN1VnMlUkPg0KICAqICAgTWVldGVjaG8gZG9jdW1lbnRhdGlv biBmb3IgSUVURiAxMDgNCmh0dHBzOi8vd3d3LmlldGYub3JnL21lZGlhL2RvY3VtZW50cy9Eb2N1 bWVudGF0aW9uLU1lZXRlY2hvLUlFVEYucGRmPGh0dHBzOi8vdXJsZGVmZW5zZS5jb20vdjMvX19o dHRwczovd3d3LmlldGYub3JnL21lZGlhL2RvY3VtZW50cy9Eb2N1bWVudGF0aW9uLU1lZXRlY2hv LUlFVEYucGRmX187ISFQSVplZVc1d3NjeW5SUSEtSGFRaVVDU2VicTJJcHphRVBRQml4ZUp2aGZf bVVjSHhHTHFfSnc5MHNJbjJlUGZVNGxJQllwMmdmLTVIUEduJD4NCiAgKiAgIFJlY29yZGluZ3Mg b2YgTWVldGVjaG8gdGVzdCBzZXNzaW9ucyBmb3IgSUVURiAxMDgNCiAgKiAgIFBhcnRpY2lwYW50 IHRlc3Qgc2Vzc2lvbiByZWNvcmRpbmcNCmh0dHBzOi8veW91dHUuYmUvU2lEM1JqLUJlYWc8aHR0 cHM6Ly91cmxkZWZlbnNlLmNvbS92My9fX2h0dHBzOi95b3V0dS5iZS9TaUQzUmotQmVhZ19fOyEh UElaZWVXNXdzY3luUlEhLUhhUWlVQ1NlYnEySXB6YUVQUUJpeGVKdmhmX21VY0h4R0xxX0p3OTBz SW4yZVBmVTRsSUJZcDJnY0FPTll5QyQ+DQogICogICBDaGFpciB0ZXN0IHNlc3Npb24gcmVjb3Jk aW5nDQpodHRwczovL3lvdXR1LmJlL3ZNWTFNSGdqRV9jPGh0dHBzOi8vdXJsZGVmZW5zZS5jb20v djMvX19odHRwczoveW91dHUuYmUvdk1ZMU1IZ2pFX2NfXzshIVBJWmVlVzV3c2N5blJRIS1IYVFp VUNTZWJxMklwemFFUFFCaXhlSnZoZl9tVWNIeEdMcV9Kdzkwc0luMmVQZlU0bElCWXAyZ1JmY25z OFEkPg0KDQoNCg== --_000_162431767ACC4C48B3FBBD2297F48A3Acomcastcom_ Content-Type: text/html; charset="utf-8" Content-ID: <46F50B094A1EB34EB70A856668248D46@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OldpbmdkaW5nczsNCglwYW5vc2UtMTo1IDAg MCAwIDAgMCAwIDAgMCAwO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0 aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQt ZmFjZQ0KCXtmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIFwoQm9keSBDU1wpIjsNCglwYW5v c2UtMToyIDIgNiAzIDUgNCA1IDIgMyA0O30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1z b05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFy Z2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5 bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6IzA1NjNDMTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJs aW5lO30NCnNwYW4uRW1haWxTdHlsZTE3DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLWNvbXBv c2U7DQoJZm9udC1mYW1pbHk6SGVsdmV0aWNhOw0KCWNvbG9yOndpbmRvd3RleHQ7DQoJZm9udC13 ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFsO30NCi5Nc29DaHBEZWZhdWx0DQoJe21z by1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41 aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNl Y3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBs aXN0IGwwDQoJe21zby1saXN0LWlkOjE5MjY5MTUyNDI7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRz OjEyNjIxMjQwNzQ7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlz dCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXpl OjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciOw0KCW1zby1iaWRpLWZvbnQtZmFt aWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwwOmxldmVsMw0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWIt c3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2lu Z2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0 IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNg0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1z by1sZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9u dC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3Rv cDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rp bmdzO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1h bnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGww OmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlk OjE5NzU4NjMzMjg7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUt aWRzOjEzMzQ3NDI4MzggLTE4MTYzODIzOTAgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2 OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTM7fQ0KQGxpc3QgbDE6bGV2 ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDot Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkFyaWFsIixzYW5zLXNl cmlmOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0 IGwxOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVy IE5ldyI7fQ0KQGxpc3QgbDE6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250 LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTpsZXZl bDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C pzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpA bGlzdCBsMTpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5 bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZh bWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwxOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGlu O30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9k eSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFz cz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjpibGFjayI+UmVtaW5kZXI6Jm5ic3A7IEFERCBtZWV0cyBUaHVyc2RheSBKdWx5IDMwIGF0IDE0 OjEwIFVUQy4mbmJzcDsmbmJzcDsmbmJzcDsgWW91IGNhbiBnZXQgaW50byB0aGUgdmlydHVhbCBz ZXNzaW9uIGZyb20gdGhlIEFERCBNZWV0ZWNobyBsaW5rIG9uIHRoZSBJRVRGIEFnZW5kYSAoPC9z cGFuPjxhIGhyZWY9Imh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvbWVldGluZy8xMDgvYWdl bmRhIj5odHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL21lZXRpbmcvMTA4L2FnZW5kYTwvYT4p PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+LWdsZW5u PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGlj YSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0ibXNvLWVsZW1lbnQ6cGFyYS1i b3JkZXItZGl2O2JvcmRlcjpub25lO2JvcmRlci1ib3R0b206c29saWQgd2luZG93dGV4dCAxLjBw dDtwYWRkaW5nOjBpbiAwaW4gMS4wcHQgMGluIj4NCjxwIHN0eWxlPSJib3JkZXI6bm9uZTtwYWRk aW5nOjBpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIHN0eWxlPSJib3JkZXI6bm9uZTtwYWRkaW5nOjBp biI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPuKAplRoZSBmb2xs b3dpbmcgZ3JlYXQgc2V0IG9mIGluZm8gcG9pbnRlcnMgSXMg4oCcYm9ycm93ZWTigJ0gZnJvbSB3 aGF0IHRoZSBNT1BTIGNoYWlycyBzZW50IHRvIE1PUFMgZWFybGllciB0b2RheS4mbmJzcDsmbmJz cDsgJm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cD48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHA+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPkxlc2xpZSBEYWlnbGUgd3Jv dGUgdG8gTU9QU+KApi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0iY2FyZXQtY29s b3I6IHJnYigwLCAwLCAwKTtmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsO29ycGhhbnM6IGF1dG87 dGV4dC1hbGlnbjpzdGFydDt3aWRvd3M6IGF1dG87LXdlYmtpdC10ZXh0LXNpemUtYWRqdXN0OiBh dXRvOy13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDt3b3JkLXNwYWNpbmc6MHB4Ij4NCjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OmJsYWNrIj5JIHN0cm9uZ2x5IHN1Z2dlc3QgdGhhdCB5b3UgdGFrZSB0aGUgb3Bwb3J0dW5pdHkg dG8gcmV2aWV3IHRoZSBhdmFpbGFibGUgbWF0ZXJpYWwgYmVmb3JlIHlvdXIgZmlyc3QgSUVURiBt ZWV0aW5nIG5leHQgd2Vlay4gTXkgYmlnZ2VzdCB0YWtlYXdheSBmcm9tIHRoZSB0ZXN0IHNlc3Np b24gd2FzOiBpdOKAmXMgc2ltaWxhciB0bywgYnV0IG5vdCB0aGUNCiBzYW1lIGFzLCBldmVyeSBv dGhlciB0b29sIHdl4oCZdmUgdXNlZCBmb3Igb25saW5lIG1lZXRpbmdzLCBzbyB0aGVyZSB3aWxs IGJlIHNvbWUgaGljY3Vwcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0iY2FyZXQt Y29sb3I6IHJnYigwLCAwLCAwKTtmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsO29ycGhhbnM6IGF1 dG87dGV4dC1hbGlnbjpzdGFydDt3aWRvd3M6IGF1dG87LXdlYmtpdC10ZXh0LXNpemUtYWRqdXN0 OiBhdXRvOy13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDt3b3JkLXNwYWNpbmc6MHB4Ij4N CjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOmJsYWNrIj5Zb3XigJl2ZSBwcm9iYWJseSBzZWVuIHRoaXMgZWxzZXdoZXJlLCBidXQgdGhl IGtleSB0aGluZyBpcyB0aGF0IHRoZSBNZWV0ZWNobyBzZXNzaW9uIGlzIGxpbmtlZCB0byB0aGUg dmlkZW8gY2FtZXJhIGljb24gd2l0aCB0aGUgdG9vbCB0aXAg4oCcTWVldGVjaG8gdmlkZW8gc3Ry ZWFtJnF1b3Q7IG9uIHRoZSBkYXRhdHJhY2tlciBhZ2VuZGEgcGFnZTo8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBzdHlsZT0iY2FyZXQtY29sb3I6IHJnYigwLCAwLCAwKTtmb250LXZhcmlhbnQt Y2Fwczogbm9ybWFsO29ycGhhbnM6IGF1dG87dGV4dC1hbGlnbjpzdGFydDt3aWRvd3M6IGF1dG87 LXdlYmtpdC10ZXh0LXNpemUtYWRqdXN0OiBhdXRvOy13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6 IDBweDt3b3JkLXNwYWNpbmc6MHB4Ij4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtB cmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48YSBocmVmPSJodHRwczovL3VybGRl ZmVuc2UuY29tL3YzL19faHR0cHM6L2RhdGF0cmFja2VyLmlldGYub3JnL21lZXRpbmcvYWdlbmRh L19fOyEhUElaZWVXNXdzY3luUlEhLUhhUWlVQ1NlYnEySXB6YUVQUUJpeGVKdmhmX21VY0h4R0xx X0p3OTBzSW4yZVBmVTRsSUJZcDJnU3pCakU4TyQiPjxzcGFuIHN0eWxlPSJjb2xvcjojMzk4M0M0 Ij5odHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL21lZXRpbmcvYWdlbmRhLzwvc3Bhbj48L2E+ PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgc3R5bGU9ImNhcmV0LWNvbG9yOiByZ2IoMCwgMCwg MCk7Zm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDtvcnBoYW5zOiBhdXRvO3RleHQtYWxpZ246c3Rh cnQ7d2lkb3dzOiBhdXRvOy13ZWJraXQtdGV4dC1zaXplLWFkanVzdDogYXV0bzstd2Via2l0LXRl eHQtc3Ryb2tlLXdpZHRoOiAwcHg7d29yZC1zcGFjaW5nOjBweCI+DQo8c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+QW5kIGl0 IHdpbGwgYmUgbGl2ZSAxMG1pbiBiZWZvcmUgb3VyIHNlc3Npb24uPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgc3R5bGU9ImNhcmV0LWNvbG9yOiByZ2IoMCwgMCwgMCk7Zm9udC12YXJpYW50LWNh cHM6IG5vcm1hbDtvcnBoYW5zOiBhdXRvO3RleHQtYWxpZ246c3RhcnQ7d2lkb3dzOiBhdXRvOy13 ZWJraXQtdGV4dC1zaXplLWFkanVzdDogYXV0bzstd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAw cHg7d29yZC1zcGFjaW5nOjBweCI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJp YWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+VGhlcmUgYXJlIHRlc3Qgc2Vzc2lvbnMg cG9pbnRlZCBhdCBpbiB0aGUgZG9jdW1lbnRhdGlvbi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBzdHlsZT0iY2FyZXQtY29sb3I6IHJnYigwLCAwLCAwKTtmb250LXZhcmlhbnQtY2Fwczogbm9y bWFsO29ycGhhbnM6IGF1dG87dGV4dC1hbGlnbjpzdGFydDt3aWRvd3M6IGF1dG87LXdlYmtpdC10 ZXh0LXNpemUtYWRqdXN0OiBhdXRvOy13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDt3b3Jk LXNwYWNpbmc6MHB4Ij4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5IZXJlIGFyZSBzb21lIHBvaW50ZXJzOjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDAsIDAsIDApO2ZvbnQt dmFyaWFudC1jYXBzOiBub3JtYWw7b3JwaGFuczogYXV0bzt0ZXh0LWFsaWduOnN0YXJ0O3dpZG93 czogYXV0bzstd2Via2l0LXRleHQtc2l6ZS1hZGp1c3Q6IGF1dG87LXdlYmtpdC10ZXh0LXN0cm9r ZS13aWR0aDogMHB4O3dvcmQtc3BhY2luZzowcHgiPg0KPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPlJFU09VUkNFUzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjx1bCB0eXBlPSJkaXNjIj4NCjxsaSBzdHlsZT0iY29sb3I6Ymxh Y2s7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmIj5JRVRGIDEwOCBzZXNzaW9uIGNoYWlyIGd1aWRlPGJy Pg0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLmNvbS92My9fX2h0dHBzOi93d3cuaWV0Zi5v cmcvaG93L21lZXRpbmdzLzEwOC9zZXNzaW9uLWNoYWlyLWd1aWRlL19fOyEhUElaZWVXNXdzY3lu UlEhLUhhUWlVQ1NlYnEySXB6YUVQUUJpeGVKdmhmX21VY0h4R0xxX0p3OTBzSW4yZVBmVTRsSUJZ cDJnVGhhQjNjNCQiPjxzcGFuIHN0eWxlPSJjb2xvcjojMzk4M0M0Ij5odHRwczovL3d3dy5pZXRm Lm9yZy9ob3cvbWVldGluZ3MvMTA4L3Nlc3Npb24tY2hhaXItZ3VpZGUvPC9zcGFuPjwvYT48bzpw PjwvbzpwPjwvc3Bhbj48L2xpPjxsaSBzdHlsZT0iY29sb3I6YmxhY2s7bXNvLWxpc3Q6bDAgbGV2 ZWwxIGxmbzEiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5z LXNlcmlmIj5JRVRGIDEwOCBwYXJ0aWNpcGFudCBndWlkZTxicj4NCjxhIGhyZWY9Imh0dHBzOi8v dXJsZGVmZW5zZS5jb20vdjMvX19odHRwczovd3d3LmlldGYub3JnL2hvdy9tZWV0aW5ncy8xMDgv c2Vzc2lvbi1wYXJ0aWNpcGFudC1ndWlkZS9fXzshIVBJWmVlVzV3c2N5blJRIS1IYVFpVUNTZWJx MklwemFFUFFCaXhlSnZoZl9tVWNIeEdMcV9Kdzkwc0luMmVQZlU0bElCWXAyZ2RBaG4xQ1EkIj48 c3BhbiBzdHlsZT0iY29sb3I6IzM5ODNDNCI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvaG93L21lZXRp bmdzLzEwOC9zZXNzaW9uLXBhcnRpY2lwYW50LWd1aWRlLzwvc3Bhbj48L2E+PG86cD48L286cD48 L3NwYW4+PC9saT48bGkgc3R5bGU9ImNvbG9yOmJsYWNrO21zby1saXN0OmwwIGxldmVsMSBsZm8x Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZiI+ VHV0b3JpYWwgdmlkZW8gZnJvbSBNZWV0ZWNobzxicj4NCjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVm ZW5zZS5jb20vdjMvX19odHRwczoveW91dHUuYmUvY25pQXh1TWN6RWtfXzshIVBJWmVlVzV3c2N5 blJRIS1IYVFpVUNTZWJxMklwemFFUFFCaXhlSnZoZl9tVWNIeEdMcV9Kdzkwc0luMmVQZlU0bElC WXAyZ1RHN1VnMlUkIj48c3BhbiBzdHlsZT0iY29sb3I6IzM5ODNDNCI+aHR0cHM6Ly95b3V0dS5i ZS9jbmlBeHVNY3pFazwvc3Bhbj48L2E+PG86cD48L286cD48L3NwYW4+PC9saT48bGkgc3R5bGU9 ImNvbG9yOmJsYWNrO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZiI+TWVldGVjaG8gZG9jdW1lbnRhdGlv biBmb3IgSUVURiAxMDg8YnI+DQo8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UuY29tL3YzL19f aHR0cHM6L3d3dy5pZXRmLm9yZy9tZWRpYS9kb2N1bWVudHMvRG9jdW1lbnRhdGlvbi1NZWV0ZWNo by1JRVRGLnBkZl9fOyEhUElaZWVXNXdzY3luUlEhLUhhUWlVQ1NlYnEySXB6YUVQUUJpeGVKdmhm X21VY0h4R0xxX0p3OTBzSW4yZVBmVTRsSUJZcDJnZi01SFBHbiQiPjxzcGFuIHN0eWxlPSJjb2xv cjojMzk4M0M0Ij5odHRwczovL3d3dy5pZXRmLm9yZy9tZWRpYS9kb2N1bWVudHMvRG9jdW1lbnRh dGlvbi1NZWV0ZWNoby1JRVRGLnBkZjwvc3Bhbj48L2E+PG86cD48L286cD48L3NwYW4+PC9saT48 bGkgc3R5bGU9ImNvbG9yOmJsYWNrO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZiI+UmVjb3JkaW5ncyBv ZiBNZWV0ZWNobyB0ZXN0IHNlc3Npb25zIGZvciBJRVRGIDEwODxvOnA+PC9vOnA+PC9zcGFuPjwv bGk+PGxpIHN0eWxlPSJjb2xvcjpibGFjazttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWYiPlBhcnRpY2lw YW50IHRlc3Qgc2Vzc2lvbiByZWNvcmRpbmc8YnI+DQo8YSBocmVmPSJodHRwczovL3VybGRlZmVu c2UuY29tL3YzL19faHR0cHM6L3lvdXR1LmJlL1NpRDNSai1CZWFnX187ISFQSVplZVc1d3NjeW5S USEtSGFRaVVDU2VicTJJcHphRVBRQml4ZUp2aGZfbVVjSHhHTHFfSnc5MHNJbjJlUGZVNGxJQllw MmdjQU9OWXlDJCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMzOTgzQzQiPmh0dHBzOi8veW91dHUuYmUv U2lEM1JqLUJlYWc8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PGxpIHN0eWxlPSJj b2xvcjpibGFjazttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWYiPkNoYWlyIHRlc3Qgc2Vzc2lvbiByZWNv cmRpbmc8YnI+DQo8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UuY29tL3YzL19faHR0cHM6L3lv dXR1LmJlL3ZNWTFNSGdqRV9jX187ISFQSVplZVc1d3NjeW5SUSEtSGFRaVVDU2VicTJJcHphRVBR Qml4ZUp2aGZfbVVjSHhHTHFfSnc5MHNJbjJlUGZVNGxJQllwMmdSZmNuczhRJCI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMzOTgzQzQiPmh0dHBzOi8veW91dHUuYmUvdk1ZMU1IZ2pFX2M8L3NwYW4+PC9h PjxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PC91bD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_162431767ACC4C48B3FBBD2297F48A3Acomcastcom_-- From nobody Fri Jul 24 01:42:14 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 822CC3A0C04 for ; Fri, 24 Jul 2020 01:42:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CLHPVnVMi4ff for ; Fri, 24 Jul 2020 01:42:10 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CAB963A0BFD for ; Fri, 24 Jul 2020 01:42:10 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx4.open-xchange.com (Postfix) with ESMTPS id AABFC6A259; Fri, 24 Jul 2020 10:42:05 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1595580125; bh=U0TlnQlNKaKmTR/hwcmhxNQIAYyiiwTShp8VfbRobOQ=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=mNV7I/TBeAXYs50fAjXmPPAt+Ym+rDllNKV0NPvEB3VkVAROgM0EJ71b6igb58IsI BTERiT9C19+eUhKRx6/S8+Ndd81bf1UbljctTInT8XZbRiJn9Bl4vJ2IZR72NDpDpD 71B9oUbyIf/UUeTIELIfoDbqdaiT11plUPxRFGKXBqhjxToiPogl8R7rHnT7A48k+v ot0QlFIODzMY/6PuYFEeBpB/Szzd4DtyIWEQYRf7pQkCfBJ37TAWsnLJIsr+rgZZUG QZEBk32LjYC1NJ2WLh5nK68uQzJE4fycb3MBcXFzs4bgultR0FtJXg891q+KcgTSB6 mv0pGXKdPMl6g== Received: from appsuite-gw2.open-xchange.com (appsuite-gw2.open-xchange.com [10.20.28.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 9C0223C0358; Fri, 24 Jul 2020 10:42:05 +0200 (CEST) Date: Fri, 24 Jul 2020 10:42:05 +0200 (CEST) From: Vittorio Bertola To: Tony Finch Cc: ADD Mailing list , Stephane Bortzmeyer Message-ID: <349288020.8370.1595580125534@appsuite-gw2.open-xchange.com> In-Reply-To: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> <20200723141314.GA32028@nic.fr> <1357064544.7200.1595520796779@appsuite-gw1.open-xchange.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev17 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2020 08:42:13 -0000 > Il 23/07/2020 18:31 Tony Finch ha scritto: >=20 > A stub resolver isn't able to chase CNAMEs or delegations, so if the > destination site has a setup that is even slightly non-trivial, stub > resolvers will need to use a recursive server to walk the namespace for > them. Of course in this scenario you would then have a full resolver in the clien= t, which is something that browsers etc could already have today. It would = even make DNSSEC more useful, by not relying on a third party (the resolver= ) for validation.=20 You need to discuss whether the additional complexity in the client would b= e a problem, and you would have to compare it with the additional complexit= y of each destination domain having to also provide a resolver; and you nee= d to discuss the privacy implications, as until now having the ISP's resolv= er aggregate queries by all its users and cache most results was also consi= dered a form of privacy protection that would disappear both if clients had= a full resolver and if clients had a stub resolver that directly contacts = each destination domain (with Tommy's counter-argument that these domains w= ould get contacted anyway at the following step, i.e. the application level= connection).=20 These are examples of the discussions that we could be having in the "pros-= and-cons" analysis suggested by St=C3=A9phane. --=20 Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com=20 Office @ Via Treviso 12, 10144 Torino, Italy From nobody Fri Jul 24 06:32:50 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4BAD3A08EC for ; Fri, 24 Jul 2020 06:32:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yKMD6sf97BNZ for ; Fri, 24 Jul 2020 06:32:47 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 16BD63A0B23 for ; Fri, 24 Jul 2020 06:32:46 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 7EB942804E9; Fri, 24 Jul 2020 15:32:45 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id 778A0280643; Fri, 24 Jul 2020 15:32:45 +0200 (CEST) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id 71DBD2804E9; Fri, 24 Jul 2020 15:32:45 +0200 (CEST) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 6647F64C6C03; Fri, 24 Jul 2020 15:32:45 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id 3F95E401F4; Fri, 24 Jul 2020 15:32:45 +0200 (CEST) Date: Fri, 24 Jul 2020 15:32:45 +0200 From: Stephane Bortzmeyer To: "Chris Box (BT)" Cc: Eric Orth , ADD Mailing list , "Deen, Glenn" Message-ID: <20200724133245.GA26662@nic.fr> References: <02A55BA8-5A8D-4B7D-B0F0-A2A3DE12A776@comcast.com> <20200721095240.GA10868@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.043099, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] New Threats ID for ADD X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2020 13:32:49 -0000 On Wed, Jul 22, 2020 at 06:30:20PM +0100, Chris Box (BT) wrote a message of 58 lines which said: > Thinking aloud, would it be useful for a draft to say "this > automatic mechanism SHOULD NOT be used in a network the user has > classified as Red"? I like the wording. (After of course proper warnings about the fact that assessing the security/trust/etc of a network is hard, and you can be wrong.) But the real problem is that this draft deviates from the idea that you can never now what the network does and therefore end-to-end security is important (RFC 3552). From nobody Fri Jul 24 06:49:07 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 522793A0475; Fri, 24 Jul 2020 06:49:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.117 X-Spam-Level: X-Spam-Status: No, score=-2.117 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=orange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BMWrL6uIRsj5; Fri, 24 Jul 2020 06:49:03 -0700 (PDT) Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.66.41]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA7B03A043E; Fri, 24 Jul 2020 06:49:02 -0700 (PDT) Received: from opfedar00.francetelecom.fr (unknown [xx.xx.xx.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by opfedar23.francetelecom.fr (ESMTP service) with ESMTPS id 4BCrCK428MzBtc8; Fri, 24 Jul 2020 15:49:01 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.com; s=ORANGE001; t=1595598541; bh=lW6LPn7EGrpc85w/A/FgttJqfPrt1vQZOc0SOYU7iCo=; h=From:To:Subject:Date:Message-ID:Content-Type:MIME-Version; b=ZLtuW4AeqzV9jZg9Tjb+wzK9/GyQjBjPoVzbR+NuExBB1poV7qXMfDT9HzwPQVU0g 1sqlhNlH+kuLvGGwhBE70qwdAtw3jy7XS2tC0lsvS+ZC60t8BXkTFdw9uFr21kdfxm UYf62pL+joetoU7Nd4vBJmmgVzqa9yaOoIHk6IiOnmy/NHYmBdjzNNdJK6S+Jf2PlG bUpC52a/CA1E+Xe7YNe6DHEAlGT65puPEc7P2rqiE+RqLxn4nWBC03GTXnDhn6txw6 +6R87hMJ57CklE7M+bTcwK55lo9eA0y9jQTKSWQCwY4hGlRR9RDPM9IUp1RKtzePtA dNEWQKJ9I5Whw== Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by opfedar00.francetelecom.fr (ESMTP service) with ESMTPS id 4BCrCK2mT3zCqjj; Fri, 24 Jul 2020 15:49:01 +0200 (CEST) From: To: Ben Schwartz CC: Stephane Bortzmeyer , "draft-btw-add-home@ietf.org" , "ADD Mailing list (add@ietf.org)" Thread-Topic: [Add] TR: I-D Action: draft-btw-add-home-07.txt Thread-Index: AQHWYQHWnYAjtMi+00WqJDspz3JyGKkWutZg Date: Fri, 24 Jul 2020 13:48:59 +0000 Message-ID: <6457_1595598541_5F1AE6CD_6457_169_1_787AE7BB302AE849A7480A190F8B9330315016B4@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> References: <159438950508.10283.6338787113671554159@ietfa.amsl.com> <23877_1594815149_5F0EF2AD_23877_384_1_787AE7BB302AE849A7480A190F8B9330314F9783@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <20200720150751.GA14985@nic.fr> <17264_1595321101_5F16AB0D_17264_254_1_787AE7BB302AE849A7480A190F8B9330314FEE52@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <21508_1595493742_5F194D6E_21508_156_1_787AE7BB302AE849A7480A190F8B9330315006B4@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> In-Reply-To: Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.114.13.247] Content-Type: multipart/alternative; boundary="_000_787AE7BB302AE849A7480A190F8B9330315016B4OPEXCAUBMA2corp_" MIME-Version: 1.0 Archived-At: Subject: Re: [Add] TR: I-D Action: draft-btw-add-home-07.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2020 13:49:05 -0000 --_000_787AE7BB302AE849A7480A190F8B9330315016B4OPEXCAUBMA2corp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQmVuLA0KDQpQbGVhc2Ugc2VlIGlubGluZS4NCg0KQ2hlZXJzLA0KTWVkDQoNCkRlIDogQmVu IFNjaHdhcnR6IFttYWlsdG86YmVtYXNjQGdvb2dsZS5jb21dDQpFbnZvecOpIDogamV1ZGkgMjMg anVpbGxldCAyMDIwIDE2OjU5DQrDgCA6IEJPVUNBREFJUiBNb2hhbWVkIFRHSS9PTE4gPG1vaGFt ZWQuYm91Y2FkYWlyQG9yYW5nZS5jb20+DQpDYyA6IFN0ZXBoYW5lIEJvcnR6bWV5ZXIgPGJvcnR6 bWV5ZXJAbmljLmZyPjsgZHJhZnQtYnR3LWFkZC1ob21lQGlldGYub3JnOyBBREQgTWFpbGluZyBs aXN0IChhZGRAaWV0Zi5vcmcpIDxhZGRAaWV0Zi5vcmc+DQpPYmpldCA6IFJlOiBbQWRkXSBUUjog SS1EIEFjdGlvbjogZHJhZnQtYnR3LWFkZC1ob21lLTA3LnR4dA0KDQoNCg0KT24gVGh1LCBKdWwg MjMsIDIwMjAgYXQgNDo0MiBBTSA8bW9oYW1lZC5ib3VjYWRhaXJAb3JhbmdlLmNvbTxtYWlsdG86 bW9oYW1lZC5ib3VjYWRhaXJAb3JhbmdlLmNvbT4+IHdyb3RlOg0KSGkgQmVuLA0KDQpQbGVhc2Ug c2VlIGlubGluZS4NCg0KQ2hlZXJzLA0KTWVkDQoNCkRlIDogQmVuIFNjaHdhcnR6IFttYWlsdG86 YmVtYXNjQGdvb2dsZS5jb208bWFpbHRvOmJlbWFzY0Bnb29nbGUuY29tPl0NCkVudm95w6kgOiBt ZXJjcmVkaSAyMiBqdWlsbGV0IDIwMjAgMjI6MTYNCsOAIDogQk9VQ0FEQUlSIE1vaGFtZWQgVEdJ L09MTiA8bW9oYW1lZC5ib3VjYWRhaXJAb3JhbmdlLmNvbTxtYWlsdG86bW9oYW1lZC5ib3VjYWRh aXJAb3JhbmdlLmNvbT4+DQpDYyA6IFN0ZXBoYW5lIEJvcnR6bWV5ZXIgPGJvcnR6bWV5ZXJAbmlj LmZyPG1haWx0bzpib3J0em1leWVyQG5pYy5mcj4+OyBkcmFmdC1idHctYWRkLWhvbWVAaWV0Zi5v cmc8bWFpbHRvOmRyYWZ0LWJ0dy1hZGQtaG9tZUBpZXRmLm9yZz47IEFERCBNYWlsaW5nIGxpc3Qg KGFkZEBpZXRmLm9yZzxtYWlsdG86YWRkQGlldGYub3JnPikgPGFkZEBpZXRmLm9yZzxtYWlsdG86 YWRkQGlldGYub3JnPj4NCk9iamV0IDogUmU6IFtBZGRdIFRSOiBJLUQgQWN0aW9uOiBkcmFmdC1i dHctYWRkLWhvbWUtMDcudHh0DQoNCg0KDQpPbiBUdWUsIEp1bCAyMSwgMjAyMCBhdCA0OjQ1IEFN IDxtb2hhbWVkLmJvdWNhZGFpckBvcmFuZ2UuY29tPG1haWx0bzptb2hhbWVkLmJvdWNhZGFpckBv cmFuZ2UuY29tPj4gd3JvdGU6DQoNCj4gLS0tLS1NZXNzYWdlIGQnb3JpZ2luZS0tLS0tDQo+IERl IDogQWRkIFttYWlsdG86YWRkLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmFkZC1ib3VuY2VzQGll dGYub3JnPl0gRGUgbGEgcGFydCBkZSBTdGVwaGFuZQ0KPiBCb3J0em1leWVyDQouLi4NCj4gdGhl IGFkdmljZSBpbiBzZWN0aW9uIDQgIkRvSC9Eb1Qgc2VydmVycyBTSE9VTEQgYmUNCj4gbG9jYXRl ZCBieSB0aGVpciBhZGRyZXNzIGxpdGVyYWxzIHJhdGhlciB0aGFuIHRoZWlyIG5hbWVzIg0KPiBl bGltaW5hdGVzIHNtYWxsIERvRSByZXNvbHZlcnMgYW5kIGxlYXZlIG9ubHkgdGhlIGJpZyBvbmVz LCB3aG8NCj4gY2FuIGhhdmUgKGxpa2UgR29vZ2xlIGFuZA0KPiBDbG91ZGZsYXJlKSBJUC1iYXNl ZCBjZXJ0aWZpY2F0ZXMuDQoNCltNZWRdIFRoYXQgaXMgbm90IHRoZSBpbnRlbnQgb2YgdGhhdCB0 ZXh0LiBUaGUgcmVjb21tZW5kYXRpb24gaXMgdG8gc3VwcGx5IGEgbGlzdCBvZiBJUCBhZGRyZXNz ZXMgKGxvY2F0b3JzLCBpZiB5b3Ugd2lsbCkgaW4gYWRkaXRpb24gdG8gdGhlIEFETiB0byBhdm9p ZCBhIGRlcGVuZGVuY3kgb24gYW5vdGhlciByZXNvbHZlciB0byByZXNvbHZlIHRoZSBuYW1lLg0K DQpQbGVhc2Ugbm90ZSB0aGF0IHRoZSBzZW50ZW5jZSB5b3UgcXVvdGVkIHN0YXJ0cyB3aXRoICJG cm9tIGFuIElQIHJlYWNoYWJpbGl0eSBzdGFuZHBvaW50LCAiIGFuZCB0aGVuIGZvbGxvd2VkIGJ5 ICJUaGlzIGF2b2lkcw0KYWRkaW5nIGEgZGVwZW5kZW5jeSBvbiBhbm90aGVyIHNlcnZlciB0byBy ZXNvbHZlIHRoZSBEb0gvRG9UIG5hbWUuICINCg0KSSByZWFkIHRoaXMgdGV4dCBzaW1pbGFybHkg dG8gU3RlcGhhbmUuDQoNCltNZWRdIE9LLiBQbGVhc2Ugbm90ZSB0aGF0IHRoZSB0ZXh0IHRhbGtz IGFib3V0IOKAnGxvY2F0ZWTigJ0gbm90IOKAnGlkZW50aWZpZWTigJ0uIEFueXdheSwgd2lsbCBz ZWUgaG93IHRvIG1ha2UgdGhhdCB0ZXh0IGJldHRlci4NCg0KICBBcmUgeW91IHNheWluZyB0aGF0 IHRoZSByZXNvbHZlciBJUCBhZGRyZXNzZXMgaW4gdGhlIHNhbWUgUkEvREhDUCBtZXNzYWdlIHNo b3VsZCBiZSB0aGUgSVAgYWRkcmVzc2VzIHRoYXQgc2VydmUgdGhlIEFETj8NCg0KW01lZF0gVGhl IGN1cnJlbnQgcHJvcG9zYWwgaXMgdG8gbGV2ZXJhZ2UgUkZDMjEzMi9SRkMzNjQ2L1JGQzgxMDYu IEZvciBleGFtcGxlLCBhIERIQ1B2NiBjbGllbnQgdGhhdCBhc2tzIGZvciBlbmNyeXB0ZWQgRE5T IHNlcnZlcnMgc2hvdWxkIGluY2x1ZGUgT1BUSU9OX0ROU19TRVJWRVJTIGluIGl0cyByZXF1ZXN0 IGFzIHdlbGwuIEFuIGFsdGVybmF0ZSBkZXNpZ24gaXMgdG8gZGVmaW5lIHRoZSBuZXcgb3B0aW9u cyB0byBjYXJyeSBib3RoIHRoZSBBRE4gYW5kIGEgbGlzdCBvZiBJUCBhZGRyZXNzZXMuIFRoaXMg YWx0ZXJuYXRlIGRlc2lnbiBoYXMgaW1wbGljYXRpb25zIG9uIHRoZSBzaXplIG9mIHRoZSBtZXNz YWdlcyBpZiB0aGUgY2xpZW50IHJlcXVlc3RzIERvNTMgYW5kIG9uZSBvciBtb3JlIGVuY3J5cHRl ZCBETlMgdGhhdCBoYXBwZW4gdG8gdGVybWluYXRlIGFsbCB0aGUgb24gdGhlIHNhbWUgSVAgYWRk cmVzcyhlcykuIFdoaWNoIGRlc2lnbiB0byBwaWNrIGlzIHVwIHRvIHRoZSBXRy4NCg0KICBXaGF0 IGlmIHRoZXkgYXJlIG5vdD8NCltNZWRdIFRoZSBzZXJ2ZXIgd2lsbCByZXR1cm4gYSBsaXN0IG9m IEBlcyBpZiByZXF1ZXN0ZWQgYnkgdGhlIGNsaWVudC4gSWYgdGhlIGNsaWVudCBkb2VzIG5vdCBh c2sgZm9yIHRoZSBPUFRJT05fRE5TX1NFUlZFUlMsIHRoaXMgbWVhbnMgdGhhdCBjbGllbnQgaXMg YWJsZSB0byByZXNvbHZlIHRoZSBBRE4gYnkgcGFzc2luZyBpdCB0byBhIHJlc29sdXRpb24gbGli cmFyeS4NCg0KQW5kIHdoZXJlIGlzIHRoaXMgcmVzb2x1dGlvbiBsaWJyYXJ5IHN1cHBvc2VkIHRv IHNlbmQgaXRzIHF1ZXJpZXM/DQoNCltNZWRdIEl0IGRlcGVuZHMgb24gdGhlIHJlc29sdXRpb24g bGlicmFyeSwgc2VlIGZvciBleGFtcGxlIHRoZSBsaXN0IGluIGh0dHBzOi8vZGF0YXRyYWNrZXIu aWV0Zi5vcmcvZG9jL2h0bWwvcmZjNjA1NSNzZWN0aW9uLTEuIFRoZSBhc3N1bXB0aW9uIGlzOiBp ZiBhIGNsaWVudCBkb2VzIG5vdCBhc2sgZm9yIE9QVElPTl9ETlNfU0VSVkVSUywgdGhpcyBtZWFu cyB0aGF0IHRoZSBjbGllbnQgaXMgYWJsZSB0byByZXNvbHZlIHRoZSBuYW1lLCBvdGhlcndpc2Ug aXQgc2hvdWxkIHJlcXVlc3RlZCBPUFRJT05fRE5TX1NFUlZFUlMgYXMgd2VsbC4NCg0KICBBcmUg eW91IHByb3Bvc2luZyB0aGF0IHRoZSBjbGllbnQgcnVuIGl0cyBvd24gZnVsbCByZWN1cnNpdmU/ DQoNCk9yIHdoYXQgaWYgdGhlcmUgYXJlIG11bHRpcGxlIEFETnM/DQpbTWVkXSBJZiB0aGVyZSBh cmUgbXVsdGlwbGUgQUROcyBidXQgdGVybWluYXRlIG9uIGRpc3RpbmN0IElQQGVzLCBtdWx0aXBs ZSBhZGRyZXNzZXMgd2lsbCBiZSBpbmNsdWRlZC4gV2UgdXNlIHRvIGhhdmUgYW4gYXBwZW5kaXgg ZXhwbGFpbmluZyB0aGlzIGJlaGF2aW91ciAoaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2Ry YWZ0LWJ0dy1hZGQtaG9tZS0wMyNhcHBlbmRpeC1BKS4gVGhlIG1haW4gc3RvcnkgaXMgdGhhdCB0 aGUgc2VydmVyIHdpbGwgcmV0dXJuIGEg4oCcY3VzdG9taXplZOKAnSBsaXN0IG9mIElQIGFkZHJl c3NlcyBhcyBhIGZ1bmN0aW9uIG9mIHRoZSByZXF1ZXN0ZWQgZW5jcnlwdGVkIEROUy4gSWYsIGZv ciBleGFtcGxlLCBEb1QgaXMgcmVhY2hhYmxlIGF0IEAxIGFuZCBEb0ggaW4gQDIsIHRoZSBzZXJ2 ZXIgd2lsbCByZXR1cm4gYm90aCBAMSBhbmQgQDIgZm9yIGEgY2xpZW50IHJlcXVlc3RpbmcgYm90 aCBEb1QgYW5kIERvSC4NCg0KDQogIFdoYXQgaXMgdGhlIGNsaWVudCBzdXBwb3NlZCB0byBkbz8N CltNZWRdIFRoZSBEb1QgY2xpZW50IHdpbGwgZ28gdGhyb3VnaCB0aGUgQCBsaXN0IHJldHVybmVk IGJ5IHRoZSBzZXJ2ZXIgYW5kIHdpbGwgc3VjY2VlZCB0byBlc3RhYmxpc2ggYSBzZXNzaW9uIHdp dGggQDEuIFRoZSBEb0ggY2xpZW50IHdpbGwgZG8gdGhlIHNhbWUgYnV0IHdpbGwgY29uY2x1ZGUg dGhhdCBAMiBpcyByZXNwb25zaXZlIGFuZCB3aWxsIGVzdGFibGlzaCBhIERvSCBzZXNzaW9uIHdp dGggQDIuDQoNCk9LLCBzbyBjbGllbnRzIGFyZSBleHBlY3RlZCB0byB0cnkgZXZlcnkgY29tYmlu YXRpb24gb2YgQUROL3Byb3RvY29sIGFuZCBJUCB1bnRpbCB0aGV5IGZpbmQgYSBwYWlyIHRoYXQg d29ya3MuDQoNCltNZWRdIFllcy4gTm90ZSB0aGF0IGJlaGF2aW9yIHdpbGwgYmUgbmVlZGVkIGFu eXdheSB0byBhY2NvbW1vZGF0ZTogZHVhbC1zdGFjayAoSVB2NC9JUHY2KSBjbGllbnRzIG9yIHRo ZSBmYWlsdXJlIG9mIHRoZSBwcmltYXJ5IEROUyBzZXJ2ZXIgYW5kIGZhbGwgYmFjayB0byBhIHNl Y29uZGFyeSBvbmUuDQoNCiAgVGhpcyBzZWVtcyBsaWtlIGFuIGluZWZmaWNpZW5jeSB0aGF0IHdl IHNob3VsZCBiZSBhYmxlIHRvIGF2b2lkLiAgRm9yIGV4YW1wbGUsIHdlIGNvdWxkIGFsbG93IG11 bHRpcGxlIE9QVElPTl9ETlNfU0VSVkVSUywgYXNzaWduIGVhY2ggb25lIGFuIGluZGV4IChlLmcu IGluIG9yZGVyIG9mIGFwcGVhcmFuY2UpLCBhbmQgcmVmZXIgdG8gaXQgYnkgaW5kZXggaW4gdGhl IFRCQTIgb3B0aW9uLg0KDQpbTWVkXSBJZiB3ZSB0aGluayB0aGF0IGl0IGlzIGxpa2VseSB0aGF0 IG1vcmUgZGVwbG95bWVudHMgd2lsbCBiZSBiYXNlZCBvbiBkaXN0aW5jdCBJUEBlcywgdGhlIHNp bXBsZSBhcHByb2FjaCBpcyB0byBlbmNvZGUgYm90aCB0aGUgQUROIGFuZCB0aGUgbGlzdCBpbiB0 aGUgc2FtZSBvcHRpb24uIFJlbHlpbmcgb24gYW4gaW5kZXggd2lsbCBjcmVhdGUgYSBkZXBlbmRl bmN5IG9uIGhvdyB0aGUgQUROIGFuZCBPUFRJT05fRE5TX1NFUlZFUlMgd2lsbCBiZSBwb3B1bGF0 ZWQuDQoNCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fCgpDZSBtZXNzYWdlIGV0IHNlcyBwaWVjZXMgam9pbnRlcyBwZXV2ZW50 IGNvbnRlbmlyIGRlcyBpbmZvcm1hdGlvbnMgY29uZmlkZW50aWVsbGVzIG91IHByaXZpbGVnaWVl cyBldCBuZSBkb2l2ZW50IGRvbmMKcGFzIGV0cmUgZGlmZnVzZXMsIGV4cGxvaXRlcyBvdSBjb3Bp ZXMgc2FucyBhdXRvcmlzYXRpb24uIFNpIHZvdXMgYXZleiByZWN1IGNlIG1lc3NhZ2UgcGFyIGVy cmV1ciwgdmV1aWxsZXogbGUgc2lnbmFsZXIKYSBsJ2V4cGVkaXRldXIgZXQgbGUgZGV0cnVpcmUg YWluc2kgcXVlIGxlcyBwaWVjZXMgam9pbnRlcy4gTGVzIG1lc3NhZ2VzIGVsZWN0cm9uaXF1ZXMg ZXRhbnQgc3VzY2VwdGlibGVzIGQnYWx0ZXJhdGlvbiwKT3JhbmdlIGRlY2xpbmUgdG91dGUgcmVz cG9uc2FiaWxpdGUgc2kgY2UgbWVzc2FnZSBhIGV0ZSBhbHRlcmUsIGRlZm9ybWUgb3UgZmFsc2lm aWUuIE1lcmNpLgoKVGhpcyBtZXNzYWdlIGFuZCBpdHMgYXR0YWNobWVudHMgbWF5IGNvbnRhaW4g Y29uZmlkZW50aWFsIG9yIHByaXZpbGVnZWQgaW5mb3JtYXRpb24gdGhhdCBtYXkgYmUgcHJvdGVj dGVkIGJ5IGxhdzsKdGhleSBzaG91bGQgbm90IGJlIGRpc3RyaWJ1dGVkLCB1c2VkIG9yIGNvcGll ZCB3aXRob3V0IGF1dGhvcmlzYXRpb24uCklmIHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMgZW1haWwg aW4gZXJyb3IsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBhbmQgZGVsZXRlIHRoaXMgbWVzc2Fn ZSBhbmQgaXRzIGF0dGFjaG1lbnRzLgpBcyBlbWFpbHMgbWF5IGJlIGFsdGVyZWQsIE9yYW5nZSBp cyBub3QgbGlhYmxlIGZvciBtZXNzYWdlcyB0aGF0IGhhdmUgYmVlbiBtb2RpZmllZCwgY2hhbmdl ZCBvciBmYWxzaWZpZWQuClRoYW5rIHlvdS4KCg== --_000_787AE7BB302AE849A7480A190F8B9330315016B4OPEXCAUBMA2corp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IlByw6lmb3JtYXTDqSBI VE1MIENhciI7DQoJbWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1z aXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCnNwYW4uUHJmb3JtYXRI VE1MQ2FyDQoJe21zby1zdHlsZS1uYW1lOiJQcsOpZm9ybWF0w6kgSFRNTCBDYXIiOw0KCW1zby1z dHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiUHLDqWZvcm1hdMOpIEhUTUwiOw0K CWZvbnQtZmFtaWx5OkNvbnNvbGFzOw0KCW1zby1mYXJlYXN0LWxhbmd1YWdlOkZSO30NCnNwYW4u RW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFt aWx5OiJDb3VyaWVyIE5ldyI7DQoJY29sb3I6YmxhY2s7DQoJZm9udC13ZWlnaHQ6bm9ybWFsOw0K CWZvbnQtc3R5bGU6bm9ybWFsOw0KCXRleHQtZGVjb3JhdGlvbjpub25lIG5vbmU7fQ0KLk1zb0No cERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVM7fQ0KQHBhZ2Ug V29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3MC44NXB0IDcw Ljg1cHQgNzAuODVwdCA3MC44NXB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2Vj dGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVm YXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48 IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxv OmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwh W2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRlIiIGxpbms9ImJsdWUiIHZsaW5rPSJw dXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjazttc28tZmFyZWFzdC1sYW5ndWFnZTpF Ti1VUyI+SGkgQmVuLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjazttc28tZmFyZWFzdC1sYW5ndWFnZTpF Ti1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrO21zby1mYXJlYXN0LWxhbmd1YWdlOkVO LVVTIj5QbGVhc2Ugc2VlIGlubGluZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2s7bXNvLWZhcmVhc3Qt bGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjazttc28tZmFyZWFzdC1s YW5ndWFnZTpFTi1VUyI+Q2hlZXJzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjazttc28tZmFyZWFzdC1s YW5ndWFnZTpFTi1VUyI+TWVkPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrO21zby1mYXJlYXN0LWxhbmd1 YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6MGNtIDBjbSAwY20g NC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQg I0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RGUmbmJzcDs6PC9zcGFuPjwvYj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiBCZW4gU2Nod2FydHogW21haWx0bzpiZW1hc2NAZ29vZ2xlLmNvbV0NCjxicj4NCjxi PkVudm95w6kmbmJzcDs6PC9iPiBqZXVkaSAyMyBqdWlsbGV0IDIwMjAgMTY6NTk8YnI+DQo8Yj7D gCZuYnNwOzo8L2I+IEJPVUNBREFJUiBNb2hhbWVkIFRHSS9PTE4gJmx0O21vaGFtZWQuYm91Y2Fk YWlyQG9yYW5nZS5jb20mZ3Q7PGJyPg0KPGI+Q2MmbmJzcDs6PC9iPiBTdGVwaGFuZSBCb3J0em1l eWVyICZsdDtib3J0em1leWVyQG5pYy5mciZndDs7IGRyYWZ0LWJ0dy1hZGQtaG9tZUBpZXRmLm9y ZzsgQUREIE1haWxpbmcgbGlzdCAoYWRkQGlldGYub3JnKSAmbHQ7YWRkQGlldGYub3JnJmd0Ozxi cj4NCjxiPk9iamV0Jm5ic3A7OjwvYj4gUmU6IFtBZGRdIFRSOiBJLUQgQWN0aW9uOiBkcmFmdC1i dHctYWRkLWhvbWUtMDcudHh0PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPk9uIFRodSwgSnVsIDIzLCAyMDIwIGF0IDQ6NDIgQU0gJmx0Ozxh IGhyZWY9Im1haWx0bzptb2hhbWVkLmJvdWNhZGFpckBvcmFuZ2UuY29tIj5tb2hhbWVkLmJvdWNh ZGFpckBvcmFuZ2UuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxi bG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEu MHB0O3BhZGRpbmc6MGNtIDBjbSAwY20gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJp Z2h0OjBjbSI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7 Y29sb3I6YmxhY2siPkhpIEJlbiwNCjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPlBsZWFz ZSBzZWUgaW5saW5lLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmll ciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPkNoZWVycyw8L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJs YWNrIj5NZWQ8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7O2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2IHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6MGNt IDBjbSAwY20gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10 b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5EZSZuYnNwOzo8L3NwYW4+PC9i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+IEJlbiBTY2h3YXJ0eiBbbWFpbHRvOjxhIGhyZWY9Im1haWx0bzpi ZW1hc2NAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmJlbWFzY0Bnb29nbGUuY29tPC9hPl0N Cjxicj4NCjxiPkVudm95w6kmbmJzcDs6PC9iPiBtZXJjcmVkaSAyMiBqdWlsbGV0IDIwMjAgMjI6 MTY8YnI+DQo8Yj7DgCZuYnNwOzo8L2I+IEJPVUNBREFJUiBNb2hhbWVkIFRHSS9PTE4gJmx0Ozxh IGhyZWY9Im1haWx0bzptb2hhbWVkLmJvdWNhZGFpckBvcmFuZ2UuY29tIiB0YXJnZXQ9Il9ibGFu ayI+bW9oYW1lZC5ib3VjYWRhaXJAb3JhbmdlLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2MmbmJzcDs6 PC9iPiBTdGVwaGFuZSBCb3J0em1leWVyICZsdDs8YSBocmVmPSJtYWlsdG86Ym9ydHptZXllckBu aWMuZnIiIHRhcmdldD0iX2JsYW5rIj5ib3J0em1leWVyQG5pYy5mcjwvYT4mZ3Q7Ow0KPGEgaHJl Zj0ibWFpbHRvOmRyYWZ0LWJ0dy1hZGQtaG9tZUBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmRy YWZ0LWJ0dy1hZGQtaG9tZUBpZXRmLm9yZzwvYT47IEFERCBNYWlsaW5nIGxpc3QgKDxhIGhyZWY9 Im1haWx0bzphZGRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5hZGRAaWV0Zi5vcmc8L2E+KSAm bHQ7PGEgaHJlZj0ibWFpbHRvOmFkZEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmFkZEBpZXRm Lm9yZzwvYT4mZ3Q7PGJyPg0KPGI+T2JqZXQmbmJzcDs6PC9iPiBSZTogW0FkZF0gVFI6IEktRCBB Y3Rpb246IGRyYWZ0LWJ0dy1hZGQtaG9tZS0wNy50eHQ8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbiBUdWUsIEp1bCAyMSwg MjAyMCBhdCA0OjQ1IEFNICZsdDs8YSBocmVmPSJtYWlsdG86bW9oYW1lZC5ib3VjYWRhaXJAb3Jh bmdlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm1vaGFtZWQuYm91Y2FkYWlyQG9yYW5nZS5jb208L2E+ Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNt IDBjbSA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdo dDowY207bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxicj4N CiZndDsgLS0tLS1NZXNzYWdlIGQnb3JpZ2luZS0tLS0tPGJyPg0KJmd0OyBEZSZuYnNwOzogQWRk IFttYWlsdG86PGEgaHJlZj0ibWFpbHRvOmFkZC1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9i bGFuayI+YWRkLWJvdW5jZXNAaWV0Zi5vcmc8L2E+XSBEZSBsYSBwYXJ0IGRlIFN0ZXBoYW5lPGJy Pg0KJmd0OyBCb3J0em1leWVyPG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj4uLi4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0Mg MS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4t dG9wOjUuMHB0O21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPiZndDsgdGhlIGFkdmljZSBpbiBzZWN0aW9uIDQgJnF1b3Q7RG9IL0Rv VCBzZXJ2ZXJzIFNIT1VMRCBiZTxicj4NCiZndDsgbG9jYXRlZCBieSB0aGVpciBhZGRyZXNzIGxp dGVyYWxzIHJhdGhlciB0aGFuIHRoZWlyIG5hbWVzJnF1b3Q7PGJyPg0KJmd0OyBlbGltaW5hdGVz IHNtYWxsIERvRSByZXNvbHZlcnMgYW5kIGxlYXZlIG9ubHkgdGhlIGJpZyBvbmVzLCB3aG88YnI+ DQomZ3Q7IGNhbiBoYXZlIChsaWtlIEdvb2dsZSBhbmQ8YnI+DQomZ3Q7IENsb3VkZmxhcmUpIElQ LWJhc2VkIGNlcnRpZmljYXRlcy48YnI+DQo8YnI+DQpbTWVkXSBUaGF0IGlzIG5vdCB0aGUgaW50 ZW50IG9mIHRoYXQgdGV4dC4gVGhlIHJlY29tbWVuZGF0aW9uIGlzIHRvIHN1cHBseSBhIGxpc3Qg b2YgSVAgYWRkcmVzc2VzIChsb2NhdG9ycywgaWYgeW91IHdpbGwpIGluIGFkZGl0aW9uIHRvIHRo ZSBBRE4gdG8gYXZvaWQgYSBkZXBlbmRlbmN5IG9uIGFub3RoZXIgcmVzb2x2ZXIgdG8gcmVzb2x2 ZSB0aGUgbmFtZS48YnI+DQo8YnI+DQpQbGVhc2Ugbm90ZSB0aGF0IHRoZSBzZW50ZW5jZSB5b3Ug cXVvdGVkIHN0YXJ0cyB3aXRoICZxdW90O0Zyb20gYW4gSVAgcmVhY2hhYmlsaXR5IHN0YW5kcG9p bnQsICZxdW90OyBhbmQgdGhlbiBmb2xsb3dlZCBieSAmcXVvdDtUaGlzIGF2b2lkczxicj4NCmFk ZGluZyBhIGRlcGVuZGVuY3kgb24gYW5vdGhlciBzZXJ2ZXIgdG8gcmVzb2x2ZSB0aGUgRG9IL0Rv VCBuYW1lLiAmcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj5JIHJlYWQgdGhpcyB0ZXh0IHNpbWlsYXJseSB0byBTdGVw aGFuZS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0i RU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+W01l ZF0gT0suIFBsZWFzZSBub3RlIHRoYXQgdGhlIHRleHQgdGFsa3MgYWJvdXQg4oCcbG9jYXRlZOKA nSBub3Qg4oCcaWRlbnRpZmllZOKAnS4gQW55d2F5LCB3aWxsIHNlZSBob3cNCiB0byBtYWtlIHRo YXQgdGV4dCBiZXR0ZXIuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPiZu YnNwOyBBcmUgeW91IHNheWluZyB0aGF0IHRoZSByZXNvbHZlciBJUCBhZGRyZXNzZXMgaW4gdGhl IHNhbWUgUkEvREhDUCBtZXNzYWdlIHNob3VsZCBiZSB0aGUgSVAgYWRkcmVzc2VzIHRoYXQgc2Vy dmUgdGhlIEFETj88L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29s b3I6YmxhY2siPltNZWRdIFRoZSBjdXJyZW50IHByb3Bvc2FsIGlzIHRvIGxldmVyYWdlIFJGQzIx MzIvUkZDMzY0Ni9SRkM4MTA2LiBGb3IgZXhhbXBsZSwgYSBESENQdjYgY2xpZW50DQogdGhhdCBh c2tzIGZvciBlbmNyeXB0ZWQgRE5TIHNlcnZlcnMgc2hvdWxkIGluY2x1ZGUgT1BUSU9OX0ROU19T RVJWRVJTIGluIGl0cyByZXF1ZXN0IGFzIHdlbGwuIEFuIGFsdGVybmF0ZSBkZXNpZ24gaXMgdG8g ZGVmaW5lIHRoZSBuZXcgb3B0aW9ucyB0byBjYXJyeSBib3RoIHRoZSBBRE4gYW5kIGEgbGlzdCBv ZiBJUCBhZGRyZXNzZXMuIFRoaXMgYWx0ZXJuYXRlIGRlc2lnbiBoYXMgaW1wbGljYXRpb25zIG9u IHRoZSBzaXplIG9mIHRoZSBtZXNzYWdlcw0KIGlmIHRoZSBjbGllbnQgcmVxdWVzdHMgRG81MyBh bmQgb25lIG9yIG1vcmUgZW5jcnlwdGVkIEROUyB0aGF0IGhhcHBlbiB0byB0ZXJtaW5hdGUgYWxs IHRoZSBvbiB0aGUgc2FtZSBJUCBhZGRyZXNzKGVzKS4gV2hpY2ggZGVzaWduIHRvIHBpY2sgaXMg dXAgdG8gdGhlIFdHLiAmbmJzcDsmbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5n PSJFTi1HQiI+Jm5ic3A7IFdoYXQgaWYgdGhleSBhcmUgbm90PyZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2Nv bG9yOmJsYWNrIj5bTWVkXSBUaGUgc2VydmVyIHdpbGwgcmV0dXJuIGEgbGlzdCBvZiBAZXMgaWYg cmVxdWVzdGVkIGJ5IHRoZSBjbGllbnQuIElmIHRoZSBjbGllbnQgZG9lcyBub3QgYXNrDQogZm9y IHRoZSBPUFRJT05fRE5TX1NFUlZFUlMsIHRoaXMgbWVhbnMgdGhhdCBjbGllbnQgaXMgYWJsZSB0 byByZXNvbHZlIHRoZSBBRE4gYnkgcGFzc2luZyBpdCB0byBhIHJlc29sdXRpb24gbGlicmFyeS48 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5BbmQgd2hlcmUgaXMgdGhpcyByZXNvbHV0aW9uIGxpYnJhcnkgc3VwcG9zZWQgdG8gc2VuZCBp dHMgcXVlcmllcz88c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFj ayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj5bTWVkXSBJdCBkZXBlbmRzIG9uIHRoZSBy ZXNvbHV0aW9uIGxpYnJhcnksIHNlZSBmb3IgZXhhbXBsZSB0aGUgbGlzdCBpbg0KPGEgaHJlZj0i aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9yZmM2MDU1I3NlY3Rpb24tMSI+ aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9yZmM2MDU1I3NlY3Rpb24tMTwv YT4uIFRoZSBhc3N1bXB0aW9uIGlzOiBpZiBhIGNsaWVudCBkb2VzIG5vdCBhc2sgZm9yDQo8L3Nw YW4+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj5PUFRJT05fRE5TX1NFUlZFUlMs IHRoaXMgbWVhbnMgdGhhdCB0aGUgY2xpZW50IGlzIGFibGUgdG8gcmVzb2x2ZSB0aGUgbmFtZSwg b3RoZXJ3aXNlIGl0IHNob3VsZCByZXF1ZXN0ZWQgT1BUSU9OX0ROU19TRVJWRVJTIGFzIHdlbGwu ICZuYnNwOzwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOyZu YnNwOyZuYnNwOzwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVT IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90Oztjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyBBcmUgeW91IHByb3Bvc2luZyB0 aGF0IHRoZSBjbGllbnQgcnVuIGl0cyBvd24gZnVsbCByZWN1cnNpdmU/PG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0i RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUg c3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGlu ZzowY20gMGNtIDBjbSA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGNtIj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQg Ymx1ZSAxLjVwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPk9yIHdoYXQgaWYg dGhlcmUgYXJlIG11bHRpcGxlIEFETnM/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjQuNnB0Ij4NCjxzcGFuIGxhbmc9IkVOLUdCIiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztj b2xvcjpibGFjayI+W01lZF0gSWYgdGhlcmUgYXJlIG11bHRpcGxlIEFETnMgYnV0IHRlcm1pbmF0 ZSBvbiBkaXN0aW5jdCBJUEBlcywgbXVsdGlwbGUgYWRkcmVzc2VzIHdpbGwgYmUgaW5jbHVkZWQu IFdlIHVzZSB0byBoYXZlIGFuIGFwcGVuZGl4IGV4cGxhaW5pbmcgdGhpcyBiZWhhdmlvdXIgKDxh IGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1idHctYWRkLWhvbWUtMDMj YXBwZW5kaXgtQSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9k cmFmdC1idHctYWRkLWhvbWUtMDMjYXBwZW5kaXgtQTwvYT4pLg0KIFRoZSBtYWluIHN0b3J5IGlz IHRoYXQgdGhlIHNlcnZlciB3aWxsIHJldHVybiBhIOKAnGN1c3RvbWl6ZWTigJ0gbGlzdCBvZiBJ UCBhZGRyZXNzZXMgYXMgYSBmdW5jdGlvbiBvZiB0aGUgcmVxdWVzdGVkIGVuY3J5cHRlZCBETlMu IElmLCBmb3IgZXhhbXBsZSwgRG9UIGlzIHJlYWNoYWJsZSBhdCBAMSBhbmQgRG9IIGluIEAyLCB0 aGUgc2VydmVyIHdpbGwgcmV0dXJuIGJvdGggQDEgYW5kIEAyIGZvciBhIGNsaWVudCByZXF1ZXN0 aW5nIGJvdGggRG9UIGFuZA0KIERvSC48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+Jm5ic3A7Jm5i c3A7Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48 c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOyBX aGF0IGlzIHRoZSBjbGllbnQgc3VwcG9zZWQgdG8gZG8/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2si PltNZWRdIFRoZSBEb1QgY2xpZW50IHdpbGwgZ28gdGhyb3VnaCB0aGUgQCBsaXN0IHJldHVybmVk IGJ5IHRoZSBzZXJ2ZXIgYW5kIHdpbGwgc3VjY2VlZCB0byBlc3RhYmxpc2gNCiBhIHNlc3Npb24g d2l0aCBAMS4gVGhlIERvSCBjbGllbnQgd2lsbCBkbyB0aGUgc2FtZSBidXQgd2lsbCBjb25jbHVk ZSB0aGF0IEAyIGlzIHJlc3BvbnNpdmUgYW5kIHdpbGwgZXN0YWJsaXNoIGEgRG9IIHNlc3Npb24g d2l0aCBAMi48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5PSywgc28gY2xpZW50cyBhcmUgZXhwZWN0ZWQgdG8gdHJ5IGV2ZXJ5IGNvbWJp bmF0aW9uIG9mIEFETi9wcm90b2NvbCBhbmQgSVAgdW50aWwgdGhleSBmaW5kIGEgcGFpciB0aGF0 IHdvcmtzLjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPltNZWRdIFllcy4gTm90ZSB0aGF0IGJlaGF2aW9y IHdpbGwgYmUgbmVlZGVkIGFueXdheSB0byBhY2NvbW1vZGF0ZTogZHVhbC1zdGFjayAoSVB2NC9J UHY2KSBjbGllbnRzIG9yIHRoZSBmYWlsdXJlIG9mIHRoZSBwcmltYXJ5IEROUyBzZXJ2ZXIgYW5k IGZhbGwgYmFjaw0KIHRvIGEgc2Vjb25kYXJ5IG9uZS4gPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1VUyI+Jm5ic3A7IFRoaXMgc2VlbXMgbGlrZSBhbiBpbmVmZmljaWVuY3kgdGhhdCB3 ZSBzaG91bGQgYmUgYWJsZSB0byBhdm9pZC4mbmJzcDsgRm9yIGV4YW1wbGUsIHdlIGNvdWxkIGFs bG93IG11bHRpcGxlIE9QVElPTl9ETlNfU0VSVkVSUywgYXNzaWduIGVhY2ggb25lIGFuIGluZGV4 IChlLmcuIGluIG9yZGVyIG9mIGFwcGVhcmFuY2UpLCBhbmQgcmVmZXIgdG8gaXQgYnkgaW5kZXgg aW4gdGhlIFRCQTINCiBvcHRpb24uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFj ayI+W01lZF0gSWYgd2UgdGhpbmsgdGhhdCBpdCBpcyBsaWtlbHkgdGhhdCBtb3JlIGRlcGxveW1l bnRzIHdpbGwgYmUgYmFzZWQgb24gZGlzdGluY3QgSVBAZXMsIHRoZSBzaW1wbGUgYXBwcm9hY2gg aXMgdG8gZW5jb2RlIGJvdGggdGhlIEFETiBhbmQgdGhlIGxpc3QgaW4gdGhlDQogc2FtZSBvcHRp b24uIFJlbHlpbmcgb24gYW4gaW5kZXggd2lsbCBjcmVhdGUgYSBkZXBlbmRlbmN5IG9uIGhvdyB0 aGUgQUROIGFuZCA8L3NwYW4+DQo8c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPk9Q VElPTl9ETlNfU0VSVkVSUyB3aWxsIGJlIHBvcHVsYXRlZC48L3NwYW4+PHNwYW4gbGFuZz0iRU4t R0IiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7O2NvbG9yOmJsYWNrIj4gJm5ic3A7Jm5ic3A7PC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVT IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90Oztjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPFBS RT5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgpDZSBtZXNzYWdlIGV0IHNlcyBwaWVjZXMgam9pbnRlcyBwZXV2ZW50IGNvbnRl bmlyIGRlcyBpbmZvcm1hdGlvbnMgY29uZmlkZW50aWVsbGVzIG91IHByaXZpbGVnaWVlcyBldCBu ZSBkb2l2ZW50IGRvbmMKcGFzIGV0cmUgZGlmZnVzZXMsIGV4cGxvaXRlcyBvdSBjb3BpZXMgc2Fu cyBhdXRvcmlzYXRpb24uIFNpIHZvdXMgYXZleiByZWN1IGNlIG1lc3NhZ2UgcGFyIGVycmV1ciwg dmV1aWxsZXogbGUgc2lnbmFsZXIKYSBsJ2V4cGVkaXRldXIgZXQgbGUgZGV0cnVpcmUgYWluc2kg cXVlIGxlcyBwaWVjZXMgam9pbnRlcy4gTGVzIG1lc3NhZ2VzIGVsZWN0cm9uaXF1ZXMgZXRhbnQg c3VzY2VwdGlibGVzIGQnYWx0ZXJhdGlvbiwKT3JhbmdlIGRlY2xpbmUgdG91dGUgcmVzcG9uc2Fi aWxpdGUgc2kgY2UgbWVzc2FnZSBhIGV0ZSBhbHRlcmUsIGRlZm9ybWUgb3UgZmFsc2lmaWUuIE1l cmNpLgoKVGhpcyBtZXNzYWdlIGFuZCBpdHMgYXR0YWNobWVudHMgbWF5IGNvbnRhaW4gY29uZmlk ZW50aWFsIG9yIHByaXZpbGVnZWQgaW5mb3JtYXRpb24gdGhhdCBtYXkgYmUgcHJvdGVjdGVkIGJ5 IGxhdzsKdGhleSBzaG91bGQgbm90IGJlIGRpc3RyaWJ1dGVkLCB1c2VkIG9yIGNvcGllZCB3aXRo b3V0IGF1dGhvcmlzYXRpb24uCklmIHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMgZW1haWwgaW4gZXJy b3IsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBhbmQgZGVsZXRlIHRoaXMgbWVzc2FnZSBhbmQg aXRzIGF0dGFjaG1lbnRzLgpBcyBlbWFpbHMgbWF5IGJlIGFsdGVyZWQsIE9yYW5nZSBpcyBub3Qg bGlhYmxlIGZvciBtZXNzYWdlcyB0aGF0IGhhdmUgYmVlbiBtb2RpZmllZCwgY2hhbmdlZCBvciBm YWxzaWZpZWQuClRoYW5rIHlvdS4KPC9QUkU+PC9ib2R5Pg0KPC9odG1sPg0K --_000_787AE7BB302AE849A7480A190F8B9330315016B4OPEXCAUBMA2corp_-- From nobody Fri Jul 24 09:13:10 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53ECE3A0F3F for ; Fri, 24 Jul 2020 09:13:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com header.b=ayuvk/XX; dkim=pass (2048-bit key) header.d=comcast.com header.b=uHUAol7Y; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=comcastcorp.onmicrosoft.com header.b=U2tzi9dx Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id REsVvWfWl2U3 for ; Fri, 24 Jul 2020 09:13:00 -0700 (PDT) Received: from mx0b-00143702.pphosted.com (mx0b-00143702.pphosted.com [148.163.141.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 485DC3A0F49 for ; Fri, 24 Jul 2020 09:12:58 -0700 (PDT) Received: from pps.filterd (m0156896.ppops.net [127.0.0.1]) by mx0b-00143702.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06OGAGe8023949 for ; Fri, 24 Jul 2020 12:12:57 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.com; h=from : to : cc : subject : date : message-id : content-type : mime-version; s=20190412; bh=YvDXtEc5IzMsGlh1Pwb3o06JEPkLPfXa8MO+t4Ysq6s=; b=ayuvk/XXsYN9Gm/yugoIF1Z9gpbUFEAbIZTBY8xIal+VAwJZfnpU7wUlvfxX6DKtxjRr guIbJwDvl2BAWxf5m+MrMH1XrL1Tjp0F5LjkeTDdXFtkkMnTEdWowSlVsRPrUX+nVpjN etvbBacT2mAdsh3iSMlP8oGQHcIHTifEpbxQpoQoe2hzP1NNtz/DyCUprCHBht1zplTw R2PropHN5xfFxvElrLB9/zAqyXweG9ipy9CnyB6IrOluicwL4qYoY6GG0RMNgfIy1u77 LxDkuzNl1inVFxMPmOHwwOtnrjROxTzsOYkuOSP4icluqdKqAC/k7lRdb8LHSBDNZ6IA PA== Received: from pacdcmhout01.cable.comcast.com (PACDCMHOUT01.cable.comcast.com [68.87.31.167]) by mx0b-00143702.pphosted.com with ESMTP id 32bv39m99f-8 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 24 Jul 2020 12:12:57 -0400 DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1595607177; x=2459520777; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=YvDXtEc5IzMsGlh1Pwb3o06JEPkLPfXa8MO+t4Ysq6s=; b=uHUAol7Y/v53vWSRJ7Q3QULdvAdk4kD2GDb0sJBmYxgTzkNH8PXA2EYxkNk4Y5fh y2KODMtHlic3xd8/14EgbYbA+RjFd3eWjDHvUZTKqZMyIiJYGWdKVvTJm7dq9Yvj Z8MBq0AA7vQN5Ltc5FJIHHq053fN6NSrNLD0SgL2NL367RpUeSuRU3R7BL5i8ffA 5oSF1z/sGFiSmECRBg2xnt6S95K6+al99CVWaZP6mMKCfMDr/lEkKdAgRaDa1k5R /aQWN3vDUgZNn+MmG02Rn7nuRH2gteD/UfsNebZ+B+LcycD1VwLo4jhlL32q8qyC qFJG5JHB5Br467SBvwB0Xg==; X-AuditID: 44571fa7-3fdff70000018e96-42-5f1b0888a3e0 Received: from PACDCEX41.cable.comcast.com (cas-umc02.ndceast.pa.bo.comcast.net [68.87.34.28]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by pacdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id CF.A6.36502.8880B1F5; Fri, 24 Jul 2020 12:12:56 -0400 (EDT) Received: from PACDCEX54.cable.comcast.com (24.40.2.153) by PACDCEX41.cable.comcast.com (24.40.2.140) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 24 Jul 2020 12:12:56 -0400 Received: from PACDCEXEDGE01.cable.comcast.com (76.96.78.71) by PACDCEX54.cable.comcast.com (24.40.2.153) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Fri, 24 Jul 2020 12:12:56 -0400 Received: from NAM11-DM6-obe.outbound.protection.outlook.com (104.47.57.177) by webmail.comcast.com (76.96.78.71) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 24 Jul 2020 12:12:43 -0400 Received: from BYAPR11MB3111.namprd11.prod.outlook.com (2603:10b6:a03:90::25) by BYAPR11MB3112.namprd11.prod.outlook.com (2603:10b6:a03:85::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.23; Fri, 24 Jul 2020 16:12:42 +0000 Received: from BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0]) by BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0%4]) with mapi id 15.20.3216.023; Fri, 24 Jul 2020 16:12:42 +0000 From: "Deen, Glenn" To: ADD Mailing list CC: "add-chairs@ietf.org" Thread-Topic: ADD Note takers for IETF108 Thread-Index: AQHWYdVCsHBG5yqTQk+HWEfuItZoRw== Date: Fri, 24 Jul 2020 16:12:42 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=comcast.com; x-originating-ip: [2605:e000:141b:121:95bd:44ae:1389:4ef] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: fa6185df-7dd0-478b-14ba-08d82fec64d2 x-ms-traffictypediagnostic: BYAPR11MB3112: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7219; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: pJRdaFsQq2xZH+CA1n2E5jynuRGYzY4HDbvHETFUIY+hhiTdPnSOPy3p6xvUV2QOoQo6L/W9Pvz2VmtEzJ2OexR/wry0rSDYUrlVJTWANnM+Xb+ImiY/EQ6B+egr3ReZtQUnltRSDY4bdwW5iZ+d355SvW+d9qXZERiEMhX7cJLQs08E5pAmMYXDnUHR70xi6g5Y7XRnKX1WBgH44iTRc3Grp6zgWjqavk0MP2TgXfaDezNBfX3GHjrGiyTpXf2g6QJjQM6g/dzNChOzsNZHvQHKtGtK8/mRHayK2epE7R18cX7Huu7p4sMtLZBpZKr2 x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3111.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(39860400002)(136003)(376002)(346002)(366004)(396003)(4326008)(6916009)(66556008)(64756008)(4744005)(450100002)(66476007)(36756003)(5660300002)(66446008)(66946007)(8936002)(86362001)(6506007)(33656002)(2616005)(71200400001)(6486002)(8676002)(316002)(83380400001)(186003)(76116006)(6512007)(2906002)(478600001)(9326002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: OGWoRo2g/x7sctKiRSHKs6TbeEYcUrc14hYcUd7680LQjfHTZde/8atRK3ZSWmP5TNV7Ut7iSkp5B3tGZfEA8IqW5HhoK2SH6EHDlwH2I0r1T4/+TbgtWRqdt4xl1+s+VVZDt3q59AQJUdsK6zSy5T/Mri88TaeD958ZorGgCyhnMf+sXjERgjbnlEHvZGd2ZBK3G2vx7W5/8/xOMz+T0PEAsg5X4oUJGUfpsqVGLccvHfCj8oT95PXoIuvuPajPfsqx9GxAFa82KDCTe6ZBTvMOdXpJET8YHXroj+7Rc2yAsmNI4WJ0ed6NTJmSLaZB2mbkyeb1ZnqgmkvQ7JUe3bC1IGjlLp48zrE3KZXhoivPhbh0M29ov06qSFE19IZrUPdg+LRHOzLSowRahWSxnkXGPqrNeILOnasFjP9Y5lKeIer0/83psbCuNldGFiXMuXF8fZdEAmuHfy1AGyIitRmLgp509uyajXCidLqtAbyn7kNIG6Xx+Kt6niixLxcWIoinR0F57DLK8oJgSNPxPrDemI/vQcamy1uOVVeSgeE= x-ms-exchange-transport-forked: True arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=K88bOwVljfTTDlMEffA23figOnajaTEiItSX+S6FuYVbe7aHSDLZCc6S0MK8FvWz2Lh09p5q6+l04CBSW27g5zNol2gCAc/RgGoGHeMZfCefJu3lkBBNQNtODwnKImKCkhLQ39I+155fuBqYPfu8/Eg1MP4rRB/DABWxHEYTCx7hhM6jg2I+WcFC0q7MMw2k4nBpHBtQLZC0VPE2DCZPLMmfg3eB9BLMrS1cHsWPF84vSOWB7hvD2IDBcy+4bQq7W0r5CHUcqF3F4i4PNWyKTA1vpythRyA6TWWvMk9LYbUJNgYVNGfvYJwWQtO7ON/cd8/YCsCtpLDCJZpq/6/94g== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FAzpsJgHGL6rawGUhjpi+fTCzDwPwPYcojMKWIHvqBE=; b=U/s1MUqQYHZpl0l/GYoJAoyORUrQva9D4+NcX3+gHPUCARZw80ay/5GSkB8fZiseBOf5qSNfh1LttgJ0MYv6mlOU4HB4F2vvWyCz/OXs3jfHsIM9e9PB3LRNFqBw4kxAPHqU2Xh2IhpUUAJajidzjPmYIAnUZD00vFjohBhOj1RJMj+G9IXxI1QjlEBLc0FkREKdbRkfQvJY2Ld7g46ItUi+3bS+flHC/W1f0cBIPUWJrAsTAjYatNhgLgICFuQyqD1PebZ01qJkiRx3z9Ceb7pP+BAPWC2LHaaldm92D3j4uwm+Ra9dp6FyMVU0cLkeXJNcdJJKf2vg0m4tH8WkOg== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=comcast.com; dmarc=pass action=none header.from=comcast.com; dkim=pass header.d=comcast.com; arc=none dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastcorp.onmicrosoft.com; s=selector1-comcastcorp-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FAzpsJgHGL6rawGUhjpi+fTCzDwPwPYcojMKWIHvqBE=; b=U2tzi9dxfvu0NzjeFbGtqBIgzC5brgl61cBFcuMgbDKzKaPjNRbF9LVyNtUvSitl4ruxN1ZB8aIYLJDshTX9A2sLnhOm6XyaTLuzOlNWdeVL3AuEW+cBZDPMxXMPTZycok0XqpbxEwlr0Ci4Z4zeR/BZ8p15myQoMV98KHPW8e4= x-ms-exchange-crosstenant-authas: Internal x-ms-exchange-crosstenant-authsource: BYAPR11MB3111.namprd11.prod.outlook.com x-ms-exchange-crosstenant-network-message-id: fa6185df-7dd0-478b-14ba-08d82fec64d2 x-ms-exchange-crosstenant-originalarrivaltime: 24 Jul 2020 16:12:42.0761 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 906aefe9-76a7-4f65-b82d-5ec20775d5aa x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: yL+2ieTR7Nw/Vu70zmOGVPpoBZE6yFV6Ij4E7lTbsfa4uD7el2kV7Zomn4JYvYS2Fbm8PIYPJLbxzY8QwAjXErFVTaG7Bc5U4/B7/4fkFVA= x-ms-exchange-transport-crosstenantheadersstamped: BYAPR11MB3112 x-originatororg: comcast.com Content-Type: multipart/alternative; boundary="_000_C09EB9E960B546E6BD63940BFF73DDA8comcastcom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA02SfUhTURjGPffebXfi4DY13/ykWU1nzUybGmFRkYaVQX8IEa6ZlxSXyaZS YmCEmhuBkUgtdaELP/ArI01J02GBSlnpIK5pupmkJoKaZpC27Szwv9/znuech+fl0KS4gedL Z2TlsJoslVrCd6dOJUv8D9yj/ZQHK4yxMZ1rpVTM1nAL/ziRYDJtEBfQJfejaaw6I4/VhMdd cU9vGR4RZPeE3Szsr6cK0SOZDglpYKKgd3aO0iF3WswMENAyeJfAohvBQj1HYmFB8HbkKx+L dwg+DNTysKgloMnKCbCwIhjpXbTfoWk+sx86XhxzhHgxwfBsopNwMMmEQ/FzPd/BnsweGF36 xseeUGjebCAxy4Frt1EOppi9sPT7ocDBIiYOGm0lTkbMTlgfanK96QPcjJHAhRgwvR4hMXvD nG2T52Bve+5k64qzKGJ0COZ1fQibYmHVOMjHHACfjXrX/Bz8aplyzWWwPP5HgDkTLLNDrvk+ KG9ddoUFQuP9aQqzP0x96XSuCxgbAdY7HMJijQRzUbtLfKTge1cTKkOHDNtqYE4Fi2mdNDhr 74DBxzOUwb5V0r6m1u5wbNkN5fppAeYQKKqscnECcNwob7vnKaIbkYciRh4TLY+MkEcootuR 8wMF1b1CnYZ0M2JoJPEQXXTzU4p5qjztretmBDQp8RLVr/kqxaI01a18VnNDqclVs1oz8qMp iY+ozPIjRcxcU+WwmSybzWr+nxK00LcQnWiYTy+eDar5tFL5xOipbzxrqUusezkVNh5Vcph9 UCWr6SktVkcKx6SZ702h1fncT6leHhRceFta8CZeUVDZsdAWq7F1xHOpIW4Vl1sDJ1b/opPN PX3Jm4m50jPkkavZurCx7vPC013GzcQkRVvK5CJPsRE3OmFNygno31W9JaG06aoIGanRqv4B cLFfKjwDAAA= X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-24_05:2020-07-24, 2020-07-24 signatures=0 X-Proofpoint-Spam-Reason: safe Archived-At: Subject: [Add] ADD Note takers for IETF108 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2020 16:13:09 -0000 --_000_C09EB9E960B546E6BD63940BFF73DDA8comcastcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkNCg0KV2UgbmVlZCB2b2x1bnRlZXJzIHRvIGhlbHAgY2FwdHVyZSBub3RlcyBmcm9tIHRoZSBB REQgc2Vzc2lvbiBuZXh0IFRodXJzZGF5LiAgICBUaGVzZSBub3RlcyBhcmVu4oCZdCB3b3JkIGZv ciB3b3JkIHRyYW5zY3JpcHRzIOKAkyBqdXN0IHRoZSBoaWdobGlnaHRzIG9mIHdoYXQgd2VudCBv biDigJMgc28gZWFzeSB0byBkbyB3aGlsZSBhbHNvIHBhcnRpY2lwYXRpbmcuDQoNCkNvdWxkIGFs c28gdXNlIGEgamFiYmVyIHNjcmliZeKAkyB0aG91Z2h0IHdpdGggYWxsIG9mIHVzIG9ubGluZSB0 aGlzIHRhc2sgZ290IGEgbG90IGVhc2llciB0aGFuIGluIGEgZmFjZSB0byBmYWNlIG1lZXRpbmc7 ICAgSnVzdCB3YXRjaCB0aGUgamFiYmVyL21lZXRlY2hvIGNoYXQgYW5kIGZsYWcgYW55dGhpbmcg Y3JpdGljYWwgdGhhdCBwb3BzIHVwLg0KDQpQbGVhc2Ugc2VudCBhIG5vdGUgdG8gYWRkLWNoYWly c0BpZXRmLm9yZzxtYWlsdG86YWRkLWNoYWlyc0BpZXRmLm9yZz4gaWYgeW914oCZcmUgd2lsbCB0 byBoZWxwIG91dC4NCg0KWW91ciBmcmllbmRseSBBREQgY2hhaXJzDQogIEdsZW5uIERlZW4gYW5k IERhdmlkIExhd3JlbmNlDQoNCg== --_000_C09EB9E960B546E6BD63940BFF73DDA8comcastcom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6IlRpbWVzIE5ldyBSb21hbiBcKEJvZHkgQ1NcKSI7DQoJcGFub3NlLTE6MiAyIDYgMyA1 IDQgNSAyIDMgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1z b05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAw MDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLkVt YWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZvbnQtZmFt aWx5OkhlbHZldGljYTsNCgljb2xvcjp3aW5kb3d0ZXh0Ow0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsN Cglmb250LXN0eWxlOm5vcm1hbDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpl eHBvcnQtb25seTsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCglt YXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdl OldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMi IGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9u MSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTpIZWx2ZXRpY2EiPkhpPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVs dmV0aWNhIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPldl IG5lZWQgdm9sdW50ZWVycyB0byBoZWxwIGNhcHR1cmUgbm90ZXMgZnJvbSB0aGUgQUREIHNlc3Np b24gbmV4dCBUaHVyc2RheS4mbmJzcDsmbmJzcDsmbmJzcDsgVGhlc2Ugbm90ZXMgYXJlbuKAmXQg d29yZCBmb3Igd29yZCB0cmFuc2NyaXB0cyDigJMganVzdCB0aGUgaGlnaGxpZ2h0cyBvZiB3aGF0 IHdlbnQgb24g4oCTIHNvIGVhc3kgdG8gZG8gd2hpbGUNCiBhbHNvIHBhcnRpY2lwYXRpbmcuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPkNvdWxkIGFsc28gdXNlIGEgamFiYmVyIHNjcmli ZeKAkyB0aG91Z2h0IHdpdGggYWxsIG9mIHVzIG9ubGluZSB0aGlzIHRhc2sgZ290IGEgbG90IGVh c2llciB0aGFuIGluIGEgZmFjZSB0byBmYWNlIG1lZXRpbmc7Jm5ic3A7Jm5ic3A7IEp1c3Qgd2F0 Y2ggdGhlIGphYmJlci9tZWV0ZWNobyBjaGF0IGFuZCBmbGFnIGFueXRoaW5nIGNyaXRpY2FsDQog dGhhdCBwb3BzIHVwLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5QbGVhc2Ugc2VudCBh IG5vdGUgdG8NCjxhIGhyZWY9Im1haWx0bzphZGQtY2hhaXJzQGlldGYub3JnIj5hZGQtY2hhaXJz QGlldGYub3JnPC9hPiBpZiB5b3XigJlyZSB3aWxsIHRvIGhlbHAgb3V0LjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6SGVsdmV0aWNhIj5Zb3VyIGZyaWVuZGx5IEFERCBjaGFpcnM8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPiZuYnNwOyZuYnNwO0dsZW5uIERlZW4gYW5kIERhdmlk IExhd3JlbmNlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_C09EB9E960B546E6BD63940BFF73DDA8comcastcom_-- From nobody Fri Jul 24 09:53:07 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B6CC3A0FD3 for ; Fri, 24 Jul 2020 09:53:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.918 X-Spam-Level: X-Spam-Status: No, score=-1.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jctVcBzEzYcQ for ; Fri, 24 Jul 2020 09:53:04 -0700 (PDT) Received: from ppsw-33.csi.cam.ac.uk (ppsw-33.csi.cam.ac.uk [131.111.8.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C10693A0FC5 for ; Fri, 24 Jul 2020 09:53:04 -0700 (PDT) X-Cam-AntiVirus: no malware found X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus Received: from grey.csi.cam.ac.uk ([131.111.57.57]:49614) by ppsw-33.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.137]:25) with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) id 1jz0wQ-000KR0-iD (Exim 4.92.3) (return-path ); Fri, 24 Jul 2020 17:53:02 +0100 Date: Fri, 24 Jul 2020 17:53:02 +0100 From: Tony Finch To: Vittorio Bertola cc: ADD Mailing list , Stephane Bortzmeyer In-Reply-To: <349288020.8370.1595580125534@appsuite-gw2.open-xchange.com> Message-ID: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> <20200723141314.GA32028@nic.fr> <1357064544.7200.1595520796779@appsuite-gw1.open-xchange.com> <349288020.8370.1595580125534@appsuite-gw2.open-xchange.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; CHARSET=US-ASCII Content-ID: Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2020 16:53:06 -0000 Vittorio Bertola wrote: > > Of course in this scenario you would then have a full resolver in the > client, which is something that browsers etc could already have today. Except that stub resolvers have to cope with networks that don't allow end-user devices to talk to arbitrary authoritative DNS servers. > It would even make DNSSEC more useful, by not relying on a third party > (the resolver) for validation. DNSSEC validation is perfectly possible whether or not you are using a recursive server. There are several validating stub resolvers. There's no need to trust your recursive server's validation. Stubs that don't do DNSSEC validation are for backwards compatibility, not part of the DNSSEC architecture. Tony. -- f.anthony.n.finch http://dotat.at/ public services of the highest quality From nobody Fri Jul 24 10:01:06 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9E953A0FBE for ; Fri, 24 Jul 2020 10:01:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.102 X-Spam-Level: X-Spam-Status: No, score=-2.102 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=apple.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wkSiXS3B_Ks6 for ; Fri, 24 Jul 2020 10:01:03 -0700 (PDT) Received: from ma1-aaemail-dr-lapp02.apple.com (ma1-aaemail-dr-lapp02.apple.com [17.171.2.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 57D633A0D58 for ; Fri, 24 Jul 2020 10:01:03 -0700 (PDT) Received: from pps.filterd (ma1-aaemail-dr-lapp02.apple.com [127.0.0.1]) by ma1-aaemail-dr-lapp02.apple.com (8.16.0.42/8.16.0.42) with SMTP id 06OGxNQI057040; Fri, 24 Jul 2020 10:00:58 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apple.com; h=content-type : mime-version : subject : from : in-reply-to : date : cc : content-transfer-encoding : message-id : references : to; s=20180706; bh=9RPfbRBnXaaGFGlejiOxoMMBjYyGZMtH0iLjHHdFyt0=; b=od3j5MvhhtE1e9lszJLepCwWuQLHUrIGUgQwcf5X2v1q3FNRKv4RNx9oty0IxolED5JP gqlpSbdPbIJ0zGEOLbhp2MKBJ1tdb7JzU6tu4cVHiQKK42Xqaxo2D5CJozoIyTchuLgo hsTY8p27GtYnjALdzvxJv/OaYjiwkNVvZ4nYhcGTMq0yxqtufwR4bC90hhtzE9fxVrNZ adJprrpRIz22mLebDbAmvvmC48IHRmvhd4+WKecMp6l/ffJc9PqjVYS1dCxN1sCDcwfc ckJUea0gQFQvBclbAfoKRaEgI7f+JSvpxA2sdMNa1cE2zNi1jVu1zrL6Uc+pJWEZxLRS 4w== Received: from rn-mailsvcp-mta-lapp02.rno.apple.com (rn-mailsvcp-mta-lapp02.rno.apple.com [10.225.203.150]) by ma1-aaemail-dr-lapp02.apple.com with ESMTP id 32bwrum0jv-15 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Fri, 24 Jul 2020 10:00:58 -0700 Received: from rn-mailsvcp-mmp-lapp02.rno.apple.com (rn-mailsvcp-mmp-lapp02.rno.apple.com [17.179.253.15]) by rn-mailsvcp-mta-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPS id <0QDZ00ASFGLK7E50@rn-mailsvcp-mta-lapp02.rno.apple.com>; Fri, 24 Jul 2020 10:00:56 -0700 (PDT) Received: from process_milters-daemon.rn-mailsvcp-mmp-lapp02.rno.apple.com by rn-mailsvcp-mmp-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) id <0QDZ00500GK16Q00@rn-mailsvcp-mmp-lapp02.rno.apple.com>; Fri, 24 Jul 2020 10:00:56 -0700 (PDT) X-Va-CD: 0 X-Va-ID: 052a1799-736c-41aa-802a-7b77cb26bc87 X-V-A: X-V-T-CD: 17aaeed30da1e57ad90e360caf53fea6 X-V-E-CD: 70bcdc11c9d31840c4d740c8fd997a66 X-V-R-CD: 9efa4d046db31f83a71c66eaba62594d X-V-CD: 0 X-V-ID: ae0ceb14-6b14-47f3-a11c-2e07e85c18c2 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-24_07:2020-07-24, 2020-07-24 signatures=0 Received: from [17.234.91.196] (unknown [17.234.91.196]) by rn-mailsvcp-mmp-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPSA id <0QDZ003NFGL36Y00@rn-mailsvcp-mmp-lapp02.rno.apple.com>; Fri, 24 Jul 2020 10:00:40 -0700 (PDT) Content-type: text/plain; charset=us-ascii MIME-version: 1.0 (Mac OS X Mail 13.4 \(3608.80.7.2.3\)) From: Tommy Pauly In-reply-to: Date: Fri, 24 Jul 2020 10:00:38 -0700 Cc: Vittorio Bertola , ADD Mailing list , Stephane Bortzmeyer Content-transfer-encoding: quoted-printable Message-id: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> <20200723141314.GA32028@nic.fr> <1357064544.7200.1595520796779@appsuite-gw1.open-xchange.com> <349288020.8370.1595580125534@appsuite-gw2.open-xchange.com> To: Tony Finch X-Mailer: Apple Mail (2.3608.80.7.2.3) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-24_07:2020-07-24, 2020-07-24 signatures=0 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2020 17:01:05 -0000 > On Jul 24, 2020, at 9:53 AM, Tony Finch wrote: >=20 > Vittorio Bertola wrote: >>=20 >> Of course in this scenario you would then have a full resolver in the >> client, which is something that browsers etc could already have = today. >=20 > Except that stub resolvers have to cope with networks that don't allow > end-user devices to talk to arbitrary authoritative DNS servers. Right. The designated encrypted resolver for a given domain or zone may = be equivalent to its authoritative server, but (a) it may not always be = the same, (b) the authoritative may not always be accessible, and (c) = even if the clients stubs can chase CNAMEs and delegations, its far more = efficient to not require that. >=20 >> It would even make DNSSEC more useful, by not relying on a third = party >> (the resolver) for validation. >=20 > DNSSEC validation is perfectly possible whether or not you are using a > recursive server. There are several validating stub resolvers. There's = no > need to trust your recursive server's validation. Stubs that don't do > DNSSEC validation are for backwards compatibility, not part of the = DNSSEC > architecture. DNSSEC validation is indeed a case that the client reasonably would want = to do on its own. I could see a world in which if we trust a designated = server for a zone, we would trust its hints about DNSSEC (or not really = need to validate DNSSEC, since we have a more trusted channel), but = validating records that come from an arbitrary resolver provisioned by = the network (especially an unencrypted and unauthenticated one) should = usually involve the client stub doing the full validation. Best, Tommy >=20 > Tony. > --=20 > f.anthony.n.finch http://dotat.at/ > public services of the highest quality >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Sun Jul 26 13:43:58 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 977E93A1466 for ; Sun, 26 Jul 2020 13:43:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.101 X-Spam-Level: X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=apple.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MqMxz69NuYgO for ; Sun, 26 Jul 2020 13:43:53 -0700 (PDT) Received: from ma1-aaemail-dr-lapp02.apple.com (ma1-aaemail-dr-lapp02.apple.com [17.171.2.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 950F33A1463 for ; Sun, 26 Jul 2020 13:43:53 -0700 (PDT) Received: from pps.filterd (ma1-aaemail-dr-lapp02.apple.com [127.0.0.1]) by ma1-aaemail-dr-lapp02.apple.com (8.16.0.42/8.16.0.42) with SMTP id 06QKhWNj056667; Sun, 26 Jul 2020 13:43:49 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apple.com; h=from : message-id : content-type : mime-version : subject : date : in-reply-to : cc : to : references; s=20180706; bh=BZ0ztnlPeE4TVobS/Kh+cwOXP+ggyeu5YgLW2zIMQWc=; b=H71qAzPt4rx0gNpPQgTiLvppOakgIjoUsOudKOvHcqqqOtOnLSXpg2Ngq2VD0VYu6sJJ vBe4n4tdQPO+L+VqEd/9keuSDIYyQAcO3U6IKxxR2eZ8+YPjyL/8t/1sr6hIaNfsU6jq tTVl9N7w2Gcx1LoW5Lp7HHnr76yZhvbSbM1xzrbQWzPxpIaAZHtpGHsnNyCNfHP928dj zGPbKrVdrxE3f5XfV+gTARqEJPETYuk42r5zEJsZ0/8oWKaHjxA+4Lm5zQkBlbwyZ7km Udvls4gB80oMeKR8EXnKND1RxMvq7aDw3ya07HWYSOPKEX5zvhLO64pZhqx9XgfbhCsI UA== Received: from rn-mailsvcp-mta-lapp04.rno.apple.com (rn-mailsvcp-mta-lapp04.rno.apple.com [10.225.203.152]) by ma1-aaemail-dr-lapp02.apple.com with ESMTP id 32ghdr96cs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Sun, 26 Jul 2020 13:43:49 -0700 Received: from rn-mailsvcp-mmp-lapp03.rno.apple.com (rn-mailsvcp-mmp-lapp03.rno.apple.com [17.179.253.16]) by rn-mailsvcp-mta-lapp04.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPS id <0QE300AZVG913820@rn-mailsvcp-mta-lapp04.rno.apple.com>; Sun, 26 Jul 2020 13:43:49 -0700 (PDT) Received: from process_milters-daemon.rn-mailsvcp-mmp-lapp03.rno.apple.com by rn-mailsvcp-mmp-lapp03.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) id <0QE300T00G1UBN00@rn-mailsvcp-mmp-lapp03.rno.apple.com>; Sun, 26 Jul 2020 13:43:49 -0700 (PDT) X-Va-A: X-Va-T-CD: 1d0713b5ec5777d6e607ea339af5e84e X-Va-E-CD: c0a15148a047f207d7806c318f1e2aba X-Va-R-CD: 4b530eb579ccb6abf4a0a5e6c3ba33b5 X-Va-CD: 0 X-Va-ID: a036670c-9f29-4bfe-a7ae-045be3895943 X-V-A: X-V-T-CD: 1d0713b5ec5777d6e607ea339af5e84e X-V-E-CD: c0a15148a047f207d7806c318f1e2aba X-V-R-CD: 4b530eb579ccb6abf4a0a5e6c3ba33b5 X-V-CD: 0 X-V-ID: 76c263e9-5d9e-4928-85d1-25ba191a461a X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-26_12:2020-07-24, 2020-07-26 signatures=0 Received: from [17.232.223.236] (unknown [17.232.223.236]) by rn-mailsvcp-mmp-lapp03.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPSA id <0QE300P98G8ZMR00@rn-mailsvcp-mmp-lapp03.rno.apple.com>; Sun, 26 Jul 2020 13:43:48 -0700 (PDT) From: Tommy Pauly Message-id: Content-type: multipart/alternative; boundary="Apple-Mail=_6CF2130A-832D-4959-B9AF-5E11B0E59F4B" MIME-version: 1.0 (Mac OS X Mail 13.4 \(3608.80.7.2.3\)) Date: Sun, 26 Jul 2020 13:43:47 -0700 In-reply-to: Cc: ADD Mailing list , David Schinazi , Jesse Kipp To: Nick Sullivan References: <159466897500.14799.423774862197475126@ietfa.amsl.com> X-Mailer: Apple Mail (2.3608.80.7.2.3) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-26_12:2020-07-24, 2020-07-26 signatures=0 Archived-At: Subject: Re: [Add] New Version Notification for draft-schinazi-httpbis-doh-preference-hints-02.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Jul 2020 20:43:57 -0000 --Apple-Mail=_6CF2130A-832D-4959-B9AF-5E11B0E59F4B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Nick, I definitely like the optimizations that this mechanism is looking = for=E2=80=94specifically, binding resolutions to a DoH server that is = hosted by the same CDN that provides the desired web content. This not = only allows for faster resolution (based on being near the = authoritative) and faster connections (based on tailoring DNS answers = for the client=E2=80=99s subnet) as you describe, but has some privacy = benefits in limiting the number of parties involved in subsequent = resolutions. The specific mechanism does cause some concerns for me, however. I know this is just a hint, but the weak relationship between this hint = and the DNS may cause issues. The DoH preference hint is one-way only, = and determined only by the entity that is generating HTTP headers for a = given URL. This means that neither the operator of the DNS zone for the = origin, nor the target DoH resolver, have any way to influence or = validate this hint. It is possible that these are all the same entity = (Google content in a google.com zone pointing to 8.8.8.8), but that=E2=80=99= s not guaranteed. Nothing stops any website from providing a hint to = direct clients to whichever DoH server it wants, for as long as it = wants. I have no problem with HTTPS content helping to confirm that the = owner of the cert for a name agrees to using a specific DoH server (see = https://www.ietf.org/id/draft-pauly-add-resolver-discovery-01.html#name-co= nfirmation-of-designation), but the primary control over DNS routing = should lie with the operator of the DNS zone in order to get the = optimizations described in the document. It also seems like it would be more optimal for this indication of DoH = server to be expressed for a set of names (names within a zone, or all = subdomains, etc), rather than just a single host name. The text limits = any hint to only apply to one name, which is good because the hint could = otherwise cause problems for an entire zone, but means that the benefit = is limited. If every YouTube video has a unique hostname that is only = resolved once, wouldn=E2=80=99t it be better to learn that I should use = 8.8.8.8 for all YouTube names? What would the client behavior for this header be if there is a = redirect? For any content that uses redirects, I assume these hints must = be ignored? Best, Tommy > On Jul 13, 2020, at 1:25 PM, Nick Sullivan = wrote: >=20 > ADD Working Group, >=20 > This is to inform you of a new submission of the doh-preference-hints = document. This document was originally intended for the HTTPbis working = group, but we were directed to the ADD group as a more appropriate venue = to discuss it. Our intention is to put this document up for = consideration to be adopted as a working group item. >=20 > Nick, David, Jesse >=20 > ---------- Forwarded message --------- > From: > > Date: Mon, Jul 13, 2020 at 12:36 PM > Subject: New Version Notification for = draft-schinazi-httpbis-doh-preference-hints-02.txt > To: Jesse Kipp >, = Nick Sullivan >, David = Schinazi > >=20 >=20 >=20 > A new version of I-D, = draft-schinazi-httpbis-doh-preference-hints-02.txt > has been successfully submitted by David Schinazi and posted to the > IETF repository. >=20 > Name: draft-schinazi-httpbis-doh-preference-hints > Revision: 02 > Title: DoH Preference Hints for HTTP > Document date: 2020-07-13 > Group: Individual Submission > Pages: 8 > URL: = https://www.ietf.org/internet-drafts/draft-schinazi-httpbis-doh-preference= -hints-02.txt = > Status: = https://datatracker.ietf.org/doc/draft-schinazi-httpbis-doh-preference-hin= ts/ = > Htmlized: = https://tools.ietf.org/html/draft-schinazi-httpbis-doh-preference-hints-02= = > Htmlized: = https://datatracker.ietf.org/doc/html/draft-schinazi-httpbis-doh-preferenc= e-hints = > Diff: = https://www.ietf.org/rfcdiff?url2=3Ddraft-schinazi-httpbis-doh-preference-= hints-02 = >=20 > Abstract: > When using a publicly available DNS-over-HTTPS (DoH) server, some > clients may suffer poor performance when the authoritative DNS = server > is located far from the DoH server. For example, a publicly > available DoH server provided by a Content Delivery Network (CDN) > should be able to resolve names hosted by that CDN with good > performance but might take longer to resolve names provided by = other > CDNs, or might provide suboptimal results if that CDN is using DNS- > based load balancing and returns different address records = depending > or where the DNS query originated from. This document attempts to > lessen these issues by allowing the web server to indicate to the > client which DoH server can best resolve its addresses. This > document defines an HTTP header field that enables web host = operators > to inform user agents of the preferred DoH servers to use for > subsequent DNS lookups for the host's domain. >=20 > Discussion of this work is encouraged to happen on the ADD IETF > mailing list add@ietf.org or on the GitHub = repository which contains > the draft: https://github.com/DavidSchinazi/draft-httpbis-doh- = > preference-hints. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org = . >=20 > The IETF Secretariat >=20 >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_6CF2130A-832D-4959-B9AF-5E11B0E59F4B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Nick,

I definitely = like the optimizations that this mechanism is looking = for=E2=80=94specifically, binding resolutions to a DoH server that is = hosted by the same CDN that provides the desired web content. This = not only allows for faster resolution (based on being near the = authoritative) and faster connections (based on tailoring DNS = answers for the client=E2=80=99s subnet) as you describe, but has some = privacy benefits in limiting the number of parties involved = in subsequent resolutions.

The = specific mechanism does cause some concerns for me, however.

I know this is just a hint, but the weak = relationship between this hint and the DNS may cause issues. The DoH = preference hint is one-way only, and determined only by the entity = that is generating HTTP headers for a given URL. This means that neither = the operator of the DNS zone for the origin, nor the target DoH = resolver, have any way to influence or validate this hint. It is = possible that these are all the same entity (Google content in a google.com zone pointing = to 8.8.8.8), but that=E2=80=99s not guaranteed. Nothing stops any = website from providing a hint to direct clients to whichever = DoH server it wants, for as long as it wants. I have no problem = with HTTPS content helping to confirm that the owner of the cert for a = name agrees to using a specific DoH server = (see https://www.ietf.org/id/draft-pauly-add-resolver-discovery-01.ht= ml#name-confirmation-of-designation), but the primary control over = DNS routing should lie with the operator of the DNS zone in order to get = the optimizations described in the document.

It also seems like it would be more optimal for this = indication of DoH server to be expressed for a set of names (names = within a zone, or all subdomains, etc), rather than just a single = host name. The text limits any hint to only apply to one name, which is = good because the hint could otherwise cause problems for an entire = zone, but means that the benefit is limited. If every YouTube video has = a unique hostname that is only resolved once, wouldn=E2=80=99t it = be better to learn that I should use 8.8.8.8 for all YouTube names?

What would the client behavior for this header = be if there is a redirect? For any content that uses redirects, I assume = these hints must be ignored?

Best,
Tommy

On Jul 13, 2020, at 1:25 PM, = Nick Sullivan <nick=3D40cloudflare.com@dmarc.ietf.org> = wrote:

ADD Working Group,

This is to inform you of a new = submission of the doh-preference-hints document. This document was = originally intended for the HTTPbis working group, but we were = directed to the ADD group as a more appropriate venue to discuss it. Our = intention is to put this document up for consideration to be = adopted as a working group item.

Nick, David, Jesse

---------- Forwarded message ---------
From: <internet-drafts@ietf.org>
Date: = Mon, Jul 13, 2020 at 12:36 PM
Subject: New Version = Notification for draft-schinazi-httpbis-doh-preference-hints-02.txt
To: Jesse Kipp <jkipp@cloudflare.com>, Nick Sullivan <nick@cloudflare.com>, David Schinazi <dschinazi.ietf@gmail.com>



A new version of I-D, = draft-schinazi-httpbis-doh-preference-hints-02.txt
has been successfully submitted by David Schinazi and posted to the
IETF repository.

Name:          =  draft-schinazi-httpbis-doh-preference-hints
Revision:       02
Title:          DoH Preference Hints for = HTTP
Document date:  2020-07-13
Group:          Individual Submission
Pages:          8
URL:            https://www.ietf.org/internet-drafts/draft-schinazi-httpbis-doh= -preference-hints-02.txt
Status:         https://datatracker.ietf.org/doc/draft-schinazi-httpbis-doh-pre= ference-hints/
Htmlized:       https://tools.ietf.org/html/draft-schinazi-httpbis-doh-preferen= ce-hints-02
Htmlized:       https://datatracker.ietf.org/doc/html/draft-schinazi-httpbis-do= h-preference-hints
Diff:           https://www.ietf.org/rfcdiff?url2=3Ddraft-schinazi-httpbis-doh-= preference-hints-02

Abstract:
   When using a publicly available DNS-over-HTTPS (DoH) = server, some
   clients may suffer poor performance when the authoritative = DNS server
   is located far from the DoH server.  For example, a = publicly
   available DoH server provided by a Content Delivery Network = (CDN)
   should be able to resolve names hosted by that CDN with = good
   performance but might take longer to resolve names provided = by other
   CDNs, or might provide suboptimal results if that CDN is = using DNS-
   based load balancing and returns different address records = depending
   or where the DNS query originated from.  This document = attempts to
   lessen these issues by allowing the web server to indicate = to the
   client which DoH server can best resolve its = addresses.  This
   document defines an HTTP header field that enables web host = operators
   to inform user agents of the preferred DoH servers to use = for
   subsequent DNS lookups for the host's domain.

   Discussion of this work is encouraged to happen on the ADD = IETF
   mailing list add@ietf.org or on the GitHub = repository which contains
   the draft: https://github.com/DavidSchinazi/draft-httpbis-doh-
   preference-hints.




Please note that it may take a couple of minutes from the time of = submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat


--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_6CF2130A-832D-4959-B9AF-5E11B0E59F4B-- From nobody Sun Jul 26 16:03:22 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF47B3A150F for ; Sun, 26 Jul 2020 16:03:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Sg-L3Dhw3QLp for ; Sun, 26 Jul 2020 16:03:11 -0700 (PDT) Received: from mail-lj1-x230.google.com (mail-lj1-x230.google.com [IPv6:2a00:1450:4864:20::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D04D73A153C for ; Sun, 26 Jul 2020 16:03:10 -0700 (PDT) Received: by mail-lj1-x230.google.com with SMTP id q4so15237135lji.2 for ; Sun, 26 Jul 2020 16:03:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9gUu1DKRtKn0r9D4CKCYRPJsHHfA2UcABwBFKO83X4c=; b=dfzlYNfxw3oKOnmcfjApQxNvwZEinz2bZAk5voMgV9+G6JGFHATy1YBK3PqbTOuRRL aUoHb5gm486dqYm0JB3TeZqZBJr0T/q14SgotqbWOcGaghLgpRLPulsvE+sLTF5X58tb EzX854SA4x4Erp/r4GnMl7ZdlGPiWtm6ZiOqKnxDLTnMMZiVzqQw3hc8rHLXBnVz1xgJ /se+1gh0c/3IOhTdibo9D6QcRmFj2iOzv3+Gd4AayQqyQMERT5v8lcrXk1Ze61lQO+uM 8+E4YzbfxoPWQ5uydmDVs6ECwoOy/su1MyLqvZwYQ61g7rHUYAJRGHVTexQCg8q01prj zirg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9gUu1DKRtKn0r9D4CKCYRPJsHHfA2UcABwBFKO83X4c=; b=m2pSzc+G2grZp3hfwodt7ooFQj3M1RNclXX4L3vA+Aqxs0CsZFH1/RpT3TwbCIZnKS hUpIQPbkyzqfT/G3Ftj9fuJEKLm1gp4GzGz9g1l8NshsRrCADoj3M+Gq3JpTHOj8l4EQ 85Q5Dsjbdnq4WkjZrVY/4+tDCx62+7bLcsV0NBP+KmTeUSkpyGHLecHHuHz/uvq0JM21 xnx4smM2p2HedQMvRCBhI2Nhp5fEI9SSvkOvZ9MpqNc2VJ+CRCzh8Knx581ifJoNO+X5 yRjVOgLhA5nsYVnUqLCSGtN3BhrQ2Tmr8L3ug0W/Vp81MZK/+i9WCS7aOQL7KvaC2MSN RROA== X-Gm-Message-State: AOAM5323bsuRu0ntqobduSLvpSEBik4nY2aJz3F7PKxgRREmC4xoEt4M wCVV3g92KUHcvrntbUJrejKSl4m0id221scVSLY= X-Google-Smtp-Source: ABdhPJxFGIioh53AGpjTUxCNBQYaHcY5CE4MWQ7N/wbMmGH1Dcl+ZPQ03HuXoFXT6NSu7BdlRiJOIu5xAyE/sgeO8Fk= X-Received: by 2002:a2e:9644:: with SMTP id z4mr8916577ljh.333.1595804588767; Sun, 26 Jul 2020 16:03:08 -0700 (PDT) MIME-Version: 1.0 References: <159466897500.14799.423774862197475126@ietfa.amsl.com> In-Reply-To: From: David Schinazi Date: Sun, 26 Jul 2020 16:02:57 -0700 Message-ID: To: Tommy Pauly Cc: Nick Sullivan , ADD Mailing list , Jesse Kipp Content-Type: multipart/alternative; boundary="000000000000a4fbc305ab6035dc" Archived-At: Subject: Re: [Add] New Version Notification for draft-schinazi-httpbis-doh-preference-hints-02.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Jul 2020 23:03:20 -0000 --000000000000a4fbc305ab6035dc Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Tommy, Thanks for your comments! Responses inline. On Sun, Jul 26, 2020 at 1:43 PM Tommy Pauly wrote: > Hi Nick, > > I definitely like the optimizations that this mechanism is looking > for=E2=80=94specifically, binding resolutions to a DoH server that is hos= ted by the > same CDN that provides the desired web content. This not only allows for > faster resolution (based on being near the authoritative) and faster > connections (based on tailoring DNS answers for the client=E2=80=99s subn= et) as you > describe, but has some privacy benefits in limiting the number of parties > involved in subsequent resolutions. > > The specific mechanism does cause some concerns for me, however. > > I know this is just a hint, but the weak relationship between this hint > and the DNS may cause issues. The DoH preference hint is one-way only, > and determined only by the entity that is generating HTTP headers for a > given URL. This means that neither the operator of the DNS zone for the > origin, nor the target DoH resolver, have any way to influence or validat= e > this hint. It is possible that these are all the same entity (Google > content in a google.com zone pointing to 8.8.8.8), but that=E2=80=99s not > guaranteed. Nothing stops any website from providing a hint to direct > clients to whichever DoH server it wants, for as long as it wants. I have > no problem with HTTPS content helping to confirm that the owner of the ce= rt > for a name agrees to using a specific DoH server (see > https://www.ietf.org/id/draft-pauly-add-resolver-discovery-01.html#name-c= onfirmation-of-designation), > but the primary control over DNS routing should lie with the operator of > the DNS zone in order to get the optimizations described in the document. > Your statement that "the primary control over DNS routing should lie with the operator of the DNS zone" contradicts existing best practices. Today, when my devices connect to a first hop network (Wi-Fi, cellular, etc.), that network will almost always provide me with a list of DNS servers, using mechanisms such as IPv6 RAs or DHCP. My device then proceeds to route its DNS based on that information. This control over DNS routing does not lie with the operator of the DNS zone, it lies with the first hop network operator - or with the device administrator who can override DNS configuration. Our proposal allows HTTP server operators to influence DNS routing, and your proposal allows DNS zone operators to influence DNS routing, but neither of those solutions is "more correct" based on how DNS works today. > It also seems like it would be more optimal for this indication of DoH > server to be expressed for a set of names (names within a zone, or > all subdomains, etc), rather than just a single host name. The text limit= s > any hint to only apply to one name, which is good because the hint > could otherwise cause problems for an entire zone, but means that the > benefit is limited. If every YouTube video has a unique hostname that is > only resolved once, wouldn=E2=80=99t it be better to learn that I should = use > 8.8.8.8 for all YouTube names? > Definitely agree. We could change the draft to allow these hints to influence other hostnames that are covered by the same TLS certificate, though we'd have to consider the security implications carefully. > What would the client behavior for this header be if there is a redirect? > For any content that uses redirects, I assume these hints must be ignored= ? > I don't think HTTP redirects should have any impact on the DoH-Preference header. If https://foo.example.com/abc returns a 301 redirect to https://bar.example.net/def it can still tell the client that subsequent resolutions for foo.example.com can be made to a given DoH server. The key distinction here is that the DoH-Preference operates at the scope of a hostname, whereas an HTTP redirect operates at the scope of a given request (i.e. it's specific to the full path, not just the hostname). Cheers, David Best, > Tommy > > On Jul 13, 2020, at 1:25 PM, Nick Sullivan < > nick=3D40cloudflare.com@dmarc.ietf.org> wrote: > > ADD Working Group, > > This is to inform you of a new submission of the doh-preference-hints > document. This document was originally intended for the HTTPbis working > group, but we were directed to the ADD group as a more appropriate venue = to > discuss it. Our intention is to put this document up for consideration to > be adopted as a working group item. > > Nick, David, Jesse > > ---------- Forwarded message --------- > From: > Date: Mon, Jul 13, 2020 at 12:36 PM > Subject: New Version Notification for > draft-schinazi-httpbis-doh-preference-hints-02.txt > To: Jesse Kipp , Nick Sullivan , > David Schinazi > > > > A new version of I-D, draft-schinazi-httpbis-doh-preference-hints-02.txt > has been successfully submitted by David Schinazi and posted to the > IETF repository. > > Name: draft-schinazi-httpbis-doh-preference-hints > Revision: 02 > Title: DoH Preference Hints for HTTP > Document date: 2020-07-13 > Group: Individual Submission > Pages: 8 > URL: > https://www.ietf.org/internet-drafts/draft-schinazi-httpbis-doh-preferenc= e-hints-02.txt > Status: > https://datatracker.ietf.org/doc/draft-schinazi-httpbis-doh-preference-hi= nts/ > Htmlized: > https://tools.ietf.org/html/draft-schinazi-httpbis-doh-preference-hints-0= 2 > Htmlized: > https://datatracker.ietf.org/doc/html/draft-schinazi-httpbis-doh-preferen= ce-hints > Diff: > https://www.ietf.org/rfcdiff?url2=3Ddraft-schinazi-httpbis-doh-preference= -hints-02 > > Abstract: > When using a publicly available DNS-over-HTTPS (DoH) server, some > clients may suffer poor performance when the authoritative DNS server > is located far from the DoH server. For example, a publicly > available DoH server provided by a Content Delivery Network (CDN) > should be able to resolve names hosted by that CDN with good > performance but might take longer to resolve names provided by other > CDNs, or might provide suboptimal results if that CDN is using DNS- > based load balancing and returns different address records depending > or where the DNS query originated from. This document attempts to > lessen these issues by allowing the web server to indicate to the > client which DoH server can best resolve its addresses. This > document defines an HTTP header field that enables web host operators > to inform user agents of the preferred DoH servers to use for > subsequent DNS lookups for the host's domain. > > Discussion of this work is encouraged to happen on the ADD IETF > mailing list add@ietf.org or on the GitHub repository which contains > the draft: https://github.com/DavidSchinazi/draft-httpbis-doh- > preference-hints. > > > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > The IETF Secretariat > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > --000000000000a4fbc305ab6035dc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Tommy,

Thanks f= or your comments! Responses inline.

On Sun, Jul 26, 2020 at 1:43 PM To= mmy Pauly <tpauly@apple.com> = wrote:
Hi Nick,

I definitely l= ike the optimizations that this mechanism is looking for=E2=80=94specifical= ly, binding resolutions to a DoH server that is hosted by the same CDN=C2= =A0that provides the desired web content. This not only allows for faster r= esolution (based on being near the authoritative) and faster connections (b= ased=C2=A0on tailoring DNS answers for the client=E2=80=99s subnet) as you = describe, but has some privacy benefits in limiting the number of parties i= nvolved in=C2=A0subsequent resolutions.

The specific mechanism does = cause some concerns for me, however.

I know this is just a hint, but= the weak relationship between this hint and the DNS may cause issues. The = DoH preference hint is one-way only, and=C2=A0determined only by the entity= that is generating HTTP headers for a given URL. This means that neither t= he operator of the DNS zone for the origin,=C2=A0nor the target DoH resolve= r, have any way to influence or validate this hint. It is possible that the= se are all the same entity (Google content in a=C2=A0google.com=C2=A0zone pointing to 8.8.8.8), bu= t that=E2=80=99s not guaranteed. Nothing stops any website from providing a= hint to direct clients to whichever DoH=C2=A0server it wants, for as long = as it wants. I have no problem with HTTPS content helping to confirm that t= he owner of the cert for a name agrees to=C2=A0using a specific DoH server = (see=C2=A0https://ww= w.ietf.org/id/draft-pauly-add-resolver-discovery-01.html#name-confirmation-= of-designation), but the=C2=A0primary control over DNS routing should l= ie with the operator of the DNS zone in order to get the optimizations desc= ribed in the document.

Your= statement that "the=C2=A0primary control over DNS routing should lie = with the operator of the DNS zone" contradicts existing best practices= . Today, when my devices connect to a first hop network (Wi-Fi, cellular, e= tc.), that network will almost always provide me with a list of DNS servers= , using mechanisms such as IPv6 RAs or DHCP. My device then proceeds to rou= te its DNS based on that information. This control over DNS routing does no= t lie with the operator of the DNS zone, it lies with the first hop network= operator - or with the device administrator who can override DNS configura= tion. Our proposal allows HTTP server operators to influence DNS routing, a= nd your proposal allows DNS zone operators to influence DNS routing, but ne= ither of those solutions is "more correct" based on how DNS works= today.
=C2=A0
It also seems like it w= ould be more optimal for this indication of DoH server to be expressed for = a set of names (names within a zone, or all=C2=A0subdomains, etc), rather t= han just a single host name. The text limits any hint to only apply to one = name, which is good because the hint could=C2=A0otherwise cause problems fo= r an entire zone, but means that the benefit is limited. If every YouTube v= ideo has a unique hostname that is only=C2=A0resolved once, wouldn=E2=80=99= t it be better to learn that I should use 8.8.8.8 for all YouTube names?

Definitely agree. We could ch= ange the draft to allow these hints to influence other hostnames that are c= overed by the same TLS certificate, though we'd have to consider the se= curity implications carefully.
=C2=A0
= What would the client behavior for this header be if there is a redirect? F= or any content that uses redirects, I assume these hints must be ignored?

I don't think HTTP redirects= should=C2=A0have any impact on the=C2=A0DoH-Preference header. If https://foo.example.com/abc returns a = 301 redirect to https://bar.example= .net/def it can still tell the client that subsequent resolutions for <= a href=3D"http://foo.example.com">foo.example.com can be made to a give= n DoH server. The key distinction here is that the=C2=A0DoH-Preference oper= ates at the scope of a hostname, whereas an HTTP redirect operates at the s= cope of a given request (i.e. it's specific to the full path, not just = the hostname).
=C2=A0
Cheers,
David


Best,
Tommy
=

On Jul 13, 2020, at 1:25 PM, N= ick Sullivan <nick=3D40cloudflare.com@dmarc.ietf.org> wrote:
ADD Working Group,

This is t= o inform you of a new submission of the=C2=A0doh-preference-hints document.= This document was originally=C2=A0intended for the HTTPbis working group, = but we were directed to the ADD group as a more appropriate venue to discus= s it. Our intention is to put=C2=A0this document up for consideration to be= adopted as a working group item.

Nick, David, Jes= se

---------- Forwarded message ---------
From: <= ;internet-dra= fts@ietf.org>
Date: Mon, Jul 13, 2020 at 12:36 PM
Subje= ct: New Version Notification for draft-schinazi-httpbis-doh-preference-hint= s-02.txt
To: Jesse Kipp <jkipp@cloudflare.com>, Nick Sullivan <nick@cloudflare.com>, Da= vid Schinazi <dschinazi.ietf@gmail.com>



A new version of I-D, draft-schinazi-httpbis-doh-preference-hints-02.txt has been successfully submitted by David Schinazi and posted to the
IETF repository.

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-schinazi-httpbis-doh-pr= eference-hints
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A002
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 DoH Preference Hints for HTTP
Document date:=C2=A0 2020-07-13
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 8
URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 https://www.ietf.org/internet-drafts/draf= t-schinazi-httpbis-doh-preference-hints-02.txt
Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/draft-schinazi-httpbis-d= oh-preference-hints/
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://tools.ietf.org/html/draft-schinazi-httpbis-doh-preferen= ce-hints-02
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/html/draft-schinazi-httpb= is-doh-preference-hints
Diff:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://www.ietf.org/rfcdiff?url2=3Ddraft-schin= azi-httpbis-doh-preference-hints-02

Abstract:
=C2=A0 =C2=A0When using a publicly available DNS-over-HTTPS (DoH) server, s= ome
=C2=A0 =C2=A0clients may suffer poor performance when the authoritative DNS= server
=C2=A0 =C2=A0is located far from the DoH server.=C2=A0 For example, a publi= cly
=C2=A0 =C2=A0available DoH server provided by a Content Delivery Network (C= DN)
=C2=A0 =C2=A0should be able to resolve names hosted by that CDN with good =C2=A0 =C2=A0performance but might take longer to resolve names provided by= other
=C2=A0 =C2=A0CDNs, or might provide suboptimal results if that CDN is using= DNS-
=C2=A0 =C2=A0based load balancing and returns different address records dep= ending
=C2=A0 =C2=A0or where the DNS query originated from.=C2=A0 This document at= tempts to
=C2=A0 =C2=A0lessen these issues by allowing the web server to indicate to = the
=C2=A0 =C2=A0client which DoH server can best resolve its addresses.=C2=A0 = This
=C2=A0 =C2=A0document defines an HTTP header field that enables web host op= erators
=C2=A0 =C2=A0to inform user agents of the preferred DoH servers to use for<= br> =C2=A0 =C2=A0subsequent DNS lookups for the host's domain.

=C2=A0 =C2=A0Discussion of this work is encouraged to happen on the ADD IET= F
=C2=A0 =C2=A0mailing list add@ietf.org or on the GitHub repository which contains
=C2=A0 =C2=A0the draft: https://github.com/DavidS= chinazi/draft-httpbis-doh-
=C2=A0 =C2=A0preference-hints.




Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat


--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
<= /blockquote>

--000000000000a4fbc305ab6035dc-- From nobody Sun Jul 26 16:33:23 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 770073A154D for ; Sun, 26 Jul 2020 16:33:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xU2irhFQSzTp for ; Sun, 26 Jul 2020 16:33:20 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D28633A154C for ; Sun, 26 Jul 2020 16:33:20 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 9D3C3C3F16 for ; Sun, 26 Jul 2020 23:33:18 +0000 (UTC) From: Paul Vixie To: add@ietf.org Date: Sun, 26 Jul 2020 23:33:17 +0000 Message-ID: <5870714.Gq5UQWgKNX@linux-9daj> Organization: none In-Reply-To: References: <159466897500.14799.423774862197475126@ietfa.amsl.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Jul 2020 23:33:22 -0000 On Sunday, 26 July 2020 23:02:57 UTC David Schinazi wrote: > Hi Tommy, > > ... i am not tommy, but i have a comment. > Your statement that "the primary control over DNS routing should lie with > the operator of the DNS zone" contradicts existing best practices. ... this is the hardest truth i've seen in this forum. please disagree out loud if you disagree, because it's the fundamental difference between user-centric, app-centric, and service-centric networking "on one side", and decentralization and autonomy "on the other side". we who secure things, do it by controlling what an app can reach. sometimes we do it with a "dns firewall". we will continue, at any and all costs, even if it means fighting an unwanted cold war against app makers, dns zone operators, service providers, governments, and activists. dns in particular is a distributed, hierarchical, autonomous, reliable, and coherent database. operators of dns zones will not, at the end of the day, reduce the autonomy of recursive server operators, edge network operators, or system administrators. that's where we are now, and that's where this ends. we should talk about how we remain here, because that can be more costly or less. see also: http://www.circleid.com/posts/20100728_taking_back_the_dns/ and this: https://www.youtube.com/watch?v=ChyrkCFpkNg and maybe this: https://dnsrpz.info/ -- Paul From nobody Sun Jul 26 19:18:23 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C0993A15F0 for ; Sun, 26 Jul 2020 19:18:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uupUynRJ2fO0 for ; Sun, 26 Jul 2020 19:18:18 -0700 (PDT) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8BDC03A15EA for ; Sun, 26 Jul 2020 19:18:18 -0700 (PDT) Received: by mail-io1-xd2a.google.com with SMTP id q75so7238750iod.1 for ; Sun, 26 Jul 2020 19:18:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=sJbNgbZ3LqKw+k49ON/g1EKV7ZZNGa46tIxIug7bWwI=; b=VNCW77l3Q0xVLejYg6j1Wngd95A3kZjcv6mypIpL5xPDw9KHzkydxXn8nnVW+5NL5o ROox6+PB18IBD5UhEHZfYuRKyILKW5Me2CdAHLBW5wh2YLu5FND6QMC+xdAZdgvz09Df eA9r5xBCfFGyA8PL4v4f4PYbM8MMQIIIHIlNz/t+p4ctkfluTSvYgyhzmGF/UHo4pDAt lCaHfmCDCEvlLMSQpp6NTTpXjoclilNPN4MD2AZUQYJX9V4/mzY3/S18siijaix87tIC yqaKV9KbM5tE9nLZmxXPJ+XRHs0PJGMxVq5FEzr9hm8/PQ6BVcoPYWg8vK+ti3Q7qxNa 3jvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=sJbNgbZ3LqKw+k49ON/g1EKV7ZZNGa46tIxIug7bWwI=; b=sW3WBX+NTNdhPDPH3c5VMT6If5clo3CwUZB/pkuCHodLByvz6AAZEzIy5ykOx16+ls xe2hHlPbkdpqHg7vDz7Cnkc1fZZorX6cKWUb6hX9p+sLm98A969uRP/eQMpsW75q6v7T jJ8Mp4Z7aLtkaZ9JHTM7g7KoTArA+0oPBceRNwICRtzROFJfSx7jniPdeLSdit3eDJhP /9DaT+DX0nq7alqWqf5SFdEL7Px5/T8sS0+0mXvYN6OHzU9ZMGJIVwbbjiRXOv4ZrcWf UNTPz/f/FV8sPcXYNsj9DrRhs5y1ppcRWvFYT4StEY8pauOQ68x1bo/WtTE3TNDQVsOt ElHA== X-Gm-Message-State: AOAM530I++AOMZc/X4ewoe2PAEtVmf0owA0U4Ewn6anA6a1zEkoeLsUY LgYqy3SldrvLBAkMlzdp2YFfKCfovxdNrJ/acPxXMw== X-Google-Smtp-Source: ABdhPJz9hUTKJdozqXP2o+gD6E4YmEiLpVjNgDRbeiPb7dKcpPbVCdrGE+RCqUgTmicVCusBarhqzM0geTk6Hvl1K3g= X-Received: by 2002:a6b:b5cd:: with SMTP id e196mr21473311iof.46.1595816297641; Sun, 26 Jul 2020 19:18:17 -0700 (PDT) MIME-Version: 1.0 References: <159466897500.14799.423774862197475126@ietfa.amsl.com> <5870714.Gq5UQWgKNX@linux-9daj> In-Reply-To: <5870714.Gq5UQWgKNX@linux-9daj> From: Rob Sayre Date: Sun, 26 Jul 2020 19:18:06 -0700 Message-ID: To: Paul Vixie Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000008c3c6505ab62ef45" Archived-At: Subject: Re: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 02:18:21 -0000 --0000000000008c3c6505ab62ef45 Content-Type: text/plain; charset="UTF-8" On Sun, Jul 26, 2020 at 4:33 PM Paul Vixie wrote: > we who secure things, do it by controlling what an app can reach. > sometimes we > do it with a "dns firewall". we will continue, at any and all costs, even > if > it means fighting an unwanted cold war against app makers, dns zone > operators, > service providers, governments, and activists. > Whatever one might think of these aims, they don't actually work. Either you can install PKI software on a device, or you can't. The rest of this is stupid. thanks, Rob --0000000000008c3c6505ab62ef45 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sun, Jul 26, 2020 at 4:33 PM Paul Vixi= e <paul@redbarn.org> wrote:
we who secure things, do it by controlling what an app can reach. sometimes= we
do it with a "dns firewall". we will continue, at any and all cos= ts, even if
it means fighting an unwanted cold war against app makers, dns zone operato= rs,
service providers, governments, and activists.

Whatever one might think of these aims, they don't actually wor= k.

Either you can install PKI software on a device= , or you can't. The rest of this is stupid.

th= anks,
Rob

--0000000000008c3c6505ab62ef45-- From nobody Sun Jul 26 19:30:16 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 625F93A1612 for ; Sun, 26 Jul 2020 19:30:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.08 X-Spam-Level: X-Spam-Status: No, score=-2.08 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.001, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tVkL7Q3YDTTN for ; Sun, 26 Jul 2020 19:30:13 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A3073A160E for ; Sun, 26 Jul 2020 19:30:13 -0700 (PDT) Received: from [172.17.121.48] (76-218-40-253.lightspeed.dllstx.sbcglobal.net [76.218.40.253]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id 06R2UBqt055344 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO) for ; Sun, 26 Jul 2020 21:30:12 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1595817012; bh=1APt/rxWdHltnC+UPWRQxyVz3ndE8WeGhgzKkqZX3aw=; h=Subject:To:References:From:Date:In-Reply-To; b=gAD8m1vFPdX7Ciu0auPepkXmlcQgf/CasZy9xzC7vnLDuc3hEKfqljKifbYKQ+i2r oo46HPx8LZYLcA8wG2NXnYXK9qY/5h9bRzM+Q61kcjM/B8qAASSaRHldEIPEb42Pgb zVKNWhSlYTKKx3JYjt9TYFOoTCzAGkoubRIigSFQ= X-Authentication-Warning: raven.nostrum.com: Host 76-218-40-253.lightspeed.dllstx.sbcglobal.net [76.218.40.253] claimed to be [172.17.121.48] To: add@ietf.org References: <159466897500.14799.423774862197475126@ietfa.amsl.com> <5870714.Gq5UQWgKNX@linux-9daj> From: Adam Roach Message-ID: Date: Sun, 26 Jul 2020 21:30:05 -0500 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: <5870714.Gq5UQWgKNX@linux-9daj> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 02:30:14 -0000 On 7/26/2020 6:33 PM, Paul Vixie wrote: > On Sunday, 26 July 2020 23:02:57 UTC David Schinazi wrote: > >> Your statement that "the primary control over DNS routing should lie with >> the operator of the DNS zone" contradicts existing best practices. ... > this is the hardest truth i've seen in this forum. please disagree out loud if > you disagree Only because you asked: the status quo is, of course, more nuanced than this. Onion routing, VPNs, HTTP proxies, and SOCKS proxies provide some of the most obvious counterexamples. /a From nobody Sun Jul 26 19:40:39 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E376B3A15EA for ; Sun, 26 Jul 2020 19:40:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 39VFZX8uFwZL for ; Sun, 26 Jul 2020 19:40:36 -0700 (PDT) Received: from mail-qv1-xf29.google.com (mail-qv1-xf29.google.com [IPv6:2607:f8b0:4864:20::f29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 07EB53A08FE for ; Sun, 26 Jul 2020 19:40:35 -0700 (PDT) Received: by mail-qv1-xf29.google.com with SMTP id di5so6769079qvb.11 for ; Sun, 26 Jul 2020 19:40:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=ij+kOreE5eRwKuh5sXuXaEC6DDXzSQdRhXXkC7ZOEWI=; b=HNtQNIbODIWAOps6tNziuzC6IgPo8iq4DIA0LV9LJoSo8uszU6m52RD64fF07n+PN2 Cg4TvC37At1v/3qdPocHuOGOFjGwXBZ0vKNQflj4dzGK0tnbFGOSZWFO5T8JAJXv4Ph7 w7KzpaGMdcVT27xKq7xASrn2cykVf4fZbo9GHAfkPxj0chweHffPqHFvInMGMMS+/snJ +rA/xFTOo5vSiWgRzcMqLz6yS1LrgJRuOlL45e4PTpDQO0w3Bt3fHAuGMNTAXvXR3wyp Y5f5dYCq+mCKJpqSPdozueGYaOF/MiVrmh8Ly8MVznrzgtleusBZunvlP2gmNc8YjfR7 Bn3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=ij+kOreE5eRwKuh5sXuXaEC6DDXzSQdRhXXkC7ZOEWI=; b=QuK0/ejJsrIiDWSLEnFE0oFLYxFdbDigMsKlRi/1KqXraooVtlJn76IpFHgmdL8X6n ERR8RhuVTuyHoshlCxhKbfYiuBYxE9Kd3n7K8nkzh+/ycDsMnQdZiTIV9EhoMam0LFY4 Hv4S1APg9GyI12aDuEwMBqH0dWeAEYE6uUZP/aqkMnRYdvktDpPOw4U/DUmPOPSwxeyP zf1HaesHJbNcE4dsNm8+KFcNeEzmgWZGc9Y+L77eR82M3TeGMGQkCL+oRu//jYfhSewv KggsT5Ul57n2VBG9j00VWG7YPeytE5mkCTYnbTj6HZ4YEuozC9g+5CLUIHlLpwz3CUsV tJTQ== X-Gm-Message-State: AOAM530hSHyJuTo7EiHy6Mz6umZf2crajNapCm2djaRtnTBZ5fORUpx+ A0tMWXT+o1xL+yWzi/agUelrB3pDC3M= X-Google-Smtp-Source: ABdhPJzHlgoStsKlPV2ZwjTNfwi1J0et07ynwptmR+5hC1iXM1SdBAElH10LwhnJwABzppat2Ys1Xw== X-Received: by 2002:ad4:4b62:: with SMTP id m2mr21311951qvx.68.1595817634723; Sun, 26 Jul 2020 19:40:34 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:6006:2043:7843:2a9e? ([2601:18b:300:36ee:6006:2043:7843:2a9e]) by smtp.gmail.com with ESMTPSA id o2sm16444287qkh.102.2020.07.26.19.40.32 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sun, 26 Jul 2020 19:40:32 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) From: Ted Lemon In-Reply-To: Date: Sun, 26 Jul 2020 22:40:30 -0400 Cc: add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <097243FD-F655-4EEC-BC3F-DBE0428D4191@fugue.com> References: <159466897500.14799.423774862197475126@ietfa.amsl.com> <5870714.Gq5UQWgKNX@linux-9daj> To: Adam Roach X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 02:40:38 -0000 On Jul 26, 2020, at 10:30 PM, Adam Roach wrote: >>> Your statement that "the primary control over DNS routing should lie = with >>> the operator of the DNS zone" contradicts existing best practices. = ... >> this is the hardest truth i've seen in this forum. please disagree = out loud if >> you disagree >=20 >=20 > Only because you asked: the status quo is, of course, more nuanced = than this. Onion routing, VPNs, HTTP proxies, and SOCKS proxies provide = some of the most obvious counterexamples. Let=E2=80=99s be honest here: the error is in asserting that there is = such a thing as primary control over DNS routing. In fact, various = entities have control over DNS routing. These controls may interact = well, or poorly. These may accomplish the goals of some combination of = the device owner, the network operator, the totalitarian government, the = advertising service, the malware, etc. Personally I think the IETF has a strong interest in serving the needs = of the end user. Different mechanisms may accomplish different aspects = of what the end user wants. In some cases these will be in conflict, = even without trying to imagine that someone other than the end user = ought to be the primary stakeholder. Our job is not to pretend that things exist that do not. It=E2=80=99s to = deal with the situation as it actually is.=20 From nobody Sun Jul 26 19:48:23 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E21B73A162D for ; Sun, 26 Jul 2020 19:48:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yDeqc5BE2dsm for ; Sun, 26 Jul 2020 19:48:19 -0700 (PDT) Received: from mail-il1-x12e.google.com (mail-il1-x12e.google.com [IPv6:2607:f8b0:4864:20::12e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 69E043A1628 for ; Sun, 26 Jul 2020 19:48:19 -0700 (PDT) Received: by mail-il1-x12e.google.com with SMTP id y18so3399255ilp.10 for ; Sun, 26 Jul 2020 19:48:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=a4bC/L1bW30QZp+IfOXJMBMzTfJOISIuxbikpVH5Ex8=; b=YscXgqM6yJcFCUi8OZSAb1ZJEn1M8wOcV9op/qnjxXReyIxlBbIw6EQPEj+3BeuZh7 f/lCD5yHd5Vj8HZO6AJhl0SryoFMLHUNw6MqVbCU8/YcNUV/xBB2xBCaS8XoP6yWhkct 0Ho2IgY5rpxI80pEVFwMJQi65Jv5vgxqA3bOUxTItIipwXoNkOIYv6LmpGXfdUL1zgbi xKMqP62lBB26shCjhJBsVILPkAhTz70ZimjRvbcFABv4vd58hXCwlpBhGEau0AlM5rEN I+UqrYTDB4iLtFzC9i/rdDhGs53F3bQOMRFothTa8rGfUsD/MYtQgQmac2hpJ5jnrpFW RxRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=a4bC/L1bW30QZp+IfOXJMBMzTfJOISIuxbikpVH5Ex8=; b=Bxt/MojSDuJQv4R4gGHQVT7oL2qBdzkFB4fxn6ImKNGWpOgAS69UpKWk40/AtZ1Q4b L4jKYdVwZhK2lnMjirZCg/hHGqFVUFCDE5u3dlywsMs2jl77H3+AYmT89F+6Y6mKj16D M3AG7XRq3NRHl3GpkMnjJJLW5RakaTsVls3z6b0NKL57D2u+RHRRb9LL4mWtQER/4XBm GN/IfsxuuuCZZzIY1ivN6SVSgzGcBkvJKvdHN2wDXxBREflHvXKTQmKTzzY0Zo2pU8O5 QKH6dN+wgpKSNg3fg6HzSAEGr3/+o59GVZDvoced/5n408S54u2qIRI0pa8z6jtQk3hG 5JLw== X-Gm-Message-State: AOAM530fYO3UMFrY6MY2B6Eu56JSiafnovG0pE2SSXTpFOwotmcJof8p 9Ssb8pg6zUXt0vuC6UXjdUTaYiMvfnl3A2u2d4s9vg== X-Google-Smtp-Source: ABdhPJwXnykqGm4uNsrkIndb8RzFX1/3YCbI0F8SBgWrtUnR/3jAKavMMer7VcmaJfkJrIgsgZT9f26sv7kIyLdYbfg= X-Received: by 2002:a92:cf06:: with SMTP id c6mr21818083ilo.73.1595818098409; Sun, 26 Jul 2020 19:48:18 -0700 (PDT) MIME-Version: 1.0 References: <159466897500.14799.423774862197475126@ietfa.amsl.com> <5870714.Gq5UQWgKNX@linux-9daj> <097243FD-F655-4EEC-BC3F-DBE0428D4191@fugue.com> In-Reply-To: <097243FD-F655-4EEC-BC3F-DBE0428D4191@fugue.com> From: Rob Sayre Date: Sun, 26 Jul 2020 19:48:07 -0700 Message-ID: To: Ted Lemon Cc: Adam Roach , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000e1c4d605ab635a36" Archived-At: Subject: Re: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 02:48:21 -0000 --000000000000e1c4d605ab635a36 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sun, Jul 26, 2020 at 7:40 PM Ted Lemon wrote: > Let=E2=80=99s be honest here: the error is in asserting that there is suc= h a thing > as primary control over DNS routing. Yes. And, conflating "security" with this imaginary power is also magical thinking. thanks, Rob --000000000000e1c4d605ab635a36 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sun, Jul 26, 2020 at 7:40 PM Ted Lemon= <mellon@fugue.com= > wrote:
Let=E2=80=99s be honest here: the error is in asserting that there is such = a thing as primary control over DNS routing.

Yes. And, conflating "security" with this imaginary power is al= so magical thinking.

thanks,
Rob=C2=A0
=C2=A0
--000000000000e1c4d605ab635a36-- From nobody Sun Jul 26 22:52:26 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C419C3A16EB for ; Sun, 26 Jul 2020 22:52:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.119 X-Spam-Level: X-Spam-Status: No, score=-2.119 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=apple.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GqquPYYex974 for ; Sun, 26 Jul 2020 22:52:21 -0700 (PDT) Received: from ma1-aaemail-dr-lapp03.apple.com (ma1-aaemail-dr-lapp03.apple.com [17.171.2.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 22F283A16AF for ; Sun, 26 Jul 2020 22:52:21 -0700 (PDT) Received: from pps.filterd (ma1-aaemail-dr-lapp03.apple.com [127.0.0.1]) by ma1-aaemail-dr-lapp03.apple.com (8.16.0.42/8.16.0.42) with SMTP id 06R5nQ91040896; Sun, 26 Jul 2020 22:52:16 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apple.com; h=content-type : content-transfer-encoding : mime-version : subject : from : in-reply-to : cc : date : message-id : references : to; s=20180706; bh=UuR/Ui3iI8ugeXN7i1VsVc7qSeyXiVOAEKgE02/VMnQ=; b=c3gKNaEuYCmnT2iosUq+gWJ8RQGeEwA+QVUR1LRH0gvLG8f1PapWyH+xsJwgSL0ik/tg sEmXNGdX4Kh09hHp91/ke1oKqWL2TJ9Dclih5Wrna08cj2902qxiFUxFO1fVlQEmk++V BnC1UHzNRb/QSH3qSIyfveNNHSjRUEv0RSO0c9fFa8Al8amyNbWwHI6sY67304p//4k5 RhCTfRzI9DlUkh79BsBNnHvNLmUE/VSCZzbF7JqFKkUqShCUTIHs9Gf52kz1dY1UEOmZ pWQiRRcvupluQ+RARXutagqXy8mGiW2GTIZTVCssj9GaSN3CVyiZgisQ6qEA5vS/zhnO Cg== Received: from rn-mailsvcp-mta-lapp01.rno.apple.com (rn-mailsvcp-mta-lapp01.rno.apple.com [10.225.203.149]) by ma1-aaemail-dr-lapp03.apple.com with ESMTP id 32gkqte1ef-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Sun, 26 Jul 2020 22:52:16 -0700 Received: from rn-mailsvcp-mmp-lapp02.rno.apple.com (rn-mailsvcp-mmp-lapp02.rno.apple.com [17.179.253.15]) by rn-mailsvcp-mta-lapp01.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPS id <0QE400YV15N4FC70@rn-mailsvcp-mta-lapp01.rno.apple.com>; Sun, 26 Jul 2020 22:52:16 -0700 (PDT) Received: from process_milters-daemon.rn-mailsvcp-mmp-lapp02.rno.apple.com by rn-mailsvcp-mmp-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) id <0QE400O005J98N00@rn-mailsvcp-mmp-lapp02.rno.apple.com>; Sun, 26 Jul 2020 22:52:16 -0700 (PDT) X-Va-A: X-Va-T-CD: ec1d9bcb0a2ffdc289d15037a0d908e6 X-Va-E-CD: c0a15148a047f207d7806c318f1e2aba X-Va-R-CD: 4b530eb579ccb6abf4a0a5e6c3ba33b5 X-Va-CD: 0 X-Va-ID: a724a85a-6263-4588-b406-fc6285467335 X-V-A: X-V-T-CD: ec1d9bcb0a2ffdc289d15037a0d908e6 X-V-E-CD: c0a15148a047f207d7806c318f1e2aba X-V-R-CD: 4b530eb579ccb6abf4a0a5e6c3ba33b5 X-V-CD: 0 X-V-ID: fa4dd4d6-de88-4638-88da-de68732ce7b8 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-27_04:2020-07-27, 2020-07-27 signatures=0 Received: from localhost (unknown [10.104.16.46]) by rn-mailsvcp-mmp-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPSA id <0QE400GOV5N3XF00@rn-mailsvcp-mmp-lapp02.rno.apple.com>; Sun, 26 Jul 2020 22:52:15 -0700 (PDT) Content-type: multipart/alternative; boundary=Apple-Mail-3B380643-3F09-451C-AA11-058C66C62191 Content-transfer-encoding: 7bit MIME-version: 1.0 (1.0) From: Tommy Pauly In-reply-to: Cc: Nick Sullivan , ADD Mailing list , Jesse Kipp Date: Sun, 26 Jul 2020 22:52:12 -0700 Message-id: <86879DB3-B31C-4F07-A302-588659FF54DF@apple.com> References: To: David Schinazi X-Mailer: iPhone Mail (18A336) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-27_04:2020-07-27, 2020-07-27 signatures=0 Archived-At: Subject: Re: [Add] New Version Notification for draft-schinazi-httpbis-doh-preference-hints-02.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 05:52:24 -0000 --Apple-Mail-3B380643-3F09-451C-AA11-058C66C62191 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable > On Jul 26, 2020, at 4:03 PM, David Schinazi wro= te: > =EF=BB=BF > Hi Tommy, >=20 > Thanks for your comments! Responses inline. >=20 > On Sun, Jul 26, 2020 at 1:43 PM Tommy Pauly wrote: >> Hi Nick, >>=20 >> I definitely like the optimizations that this mechanism is looking for=E2= =80=94specifically, binding resolutions to a DoH server that is hosted by th= e same CDN that provides the desired web content. This not only allows for f= aster resolution (based on being near the authoritative) and faster connecti= ons (based on tailoring DNS answers for the client=E2=80=99s subnet) as you d= escribe, but has some privacy benefits in limiting the number of parties inv= olved in subsequent resolutions. >>=20 >> The specific mechanism does cause some concerns for me, however. >>=20 >> I know this is just a hint, but the weak relationship between this hint a= nd the DNS may cause issues. The DoH preference hint is one-way only, and de= termined only by the entity that is generating HTTP headers for a given URL.= This means that neither the operator of the DNS zone for the origin, nor th= e target DoH resolver, have any way to influence or validate this hint. It i= s possible that these are all the same entity (Google content in a google.co= m zone pointing to 8.8.8.8), but that=E2=80=99s not guaranteed. Nothing stop= s any website from providing a hint to direct clients to whichever DoH serve= r it wants, for as long as it wants. I have no problem with HTTPS content he= lping to confirm that the owner of the cert for a name agrees to using a spe= cific DoH server (see https://www.ietf.org/id/draft-pauly-add-resolver-disco= very-01.html#name-confirmation-of-designation), but the primary control over= DNS routing should lie with the operator of the DNS zone in order to get th= e optimizations described in the document. >=20 > Your statement that "the primary control over DNS routing should lie with t= he operator of the DNS zone" contradicts existing best practices. > Today, when my devices connect to a first hop network (Wi-Fi, cellular, et= c.), that network will almost always provide me with a list of DNS servers, u= sing mechanisms such as IPv6 RAs or DHCP. My device then proceeds to route i= ts DNS based on that information. This control over DNS routing does not lie= with the operator of the DNS zone, it lies with the first hop network opera= tor - or with the device administrator who can override DNS configuration. O= ur proposal allows HTTP server operators to influence DNS routing, and your p= roposal allows DNS zone operators to influence DNS routing, but neither of t= hose solutions is "more correct" based on how DNS works today. Yes, of course the first hop network operator generally provides the actual v= iew of DNS content. And many other entities influence the actual view. That=E2= =80=99s not the kind of control I was referring to.=20 To clarify this point, which I see has been taken a bit out of context, I wa= s referring to the choice between having the owner of a name indicate its DN= S resolver designation via information in its DNS records and having that en= tity indicate this designation purely through an HTTP response to a non-DNS r= equest. If =E2=80=9Cexample.com=E2=80=9D wants to indicate that DNS queries c= an be optimized if they are directed to =E2=80=9Cdoh.example.com=E2=80=9D, t= his control should generally be given to the DNS zone for example.com instea= d of the content HTTP server, since the DNS zone operator knows more context= about its own DNS configuration. One of the premises your document describes us that there can be optimizatio= n if the preferred DoH server is closer to or related to the authoritative D= NS server. This is the kind of information that makes sense to keep related t= o DNS records. Let=E2=80=99s say that I have a large number of names under e= xample.com. Every name under example.com originally indicates a preference f= or doh.dns.example.com. Then, at some point, I change how names under foo.ex= ample.com are managed such that another DoH server should be preferred (mayb= e a change of CDN, etc). If the preference had been previously marked using H= TTP headers, this DNS-centric change could mean I need to track down every H= TTP server and make sure the response is updated; and since this hint is ent= irely request-specific, there could be paths that redirect in non-obvious wa= ys, and updates could be missed. If the preference is communicated in DNS re= cords, however, I can perform the update across all the records in the appro= priate zone. I totally understand that there are deployments, like Google=E2=80=99s, for w= hich it is more convenient to use a hint in HTTP, since you can update that e= asily and uniformly, and you can ignore multi-CDN concerns, etc. But a stand= ard mechanism that is based in the DNS might avoid a lot of headache and mis= configuration risks for other common deployments. >> It also seems like it would be more optimal for this indication of DoH se= rver to be expressed for a set of names (names within a zone, or all subdoma= ins, etc), rather than just a single host name. The text limits any hint to o= nly apply to one name, which is good because the hint could otherwise cause p= roblems for an entire zone, but means that the benefit is limited. If every Y= ouTube video has a unique hostname that is only resolved once, wouldn=E2=80=99= t it be better to learn that I should use 8.8.8.8 for all YouTube names? >=20 > Definitely agree. We could change the draft to allow these hints to influe= nce other hostnames that are covered by the same TLS certificate, though we'= d have to consider the security implications carefully. > =20 >> What would the client behavior for this header be if there is a redirect?= For any content that uses redirects, I assume these hints must be ignored? >=20 > I don't think HTTP redirects should have any impact on the DoH-Preference h= eader. If https://foo.example.com/abc returns a 301 redirect to https://bar.= example.net/def it can still tell the client that subsequent resolutions for= foo.example.com can be made to a given DoH server. The key distinction here= is that the DoH-Preference operates at the scope of a hostname, whereas an H= TTP redirect operates at the scope of a given request (i.e. it's specific to= the full path, not just the hostname). Okay, that=E2=80=99s good to clarify=E2=80=94you may want to mention that in= the doc. The fact that the DoH preference operates at the scope of the host= name and not the request is another reason I=E2=80=99d prefer to see it tied= to something about the hostname (a DNS record, or at the very least, a well= -known URL off the hostname). What happens if the client receives different p= reference headers across different responses? Best, Tommy > =20 > Cheers, > David >=20 >=20 >> Best, >> Tommy >>=20 >>> On Jul 13, 2020, at 1:25 PM, Nick Sullivan wrote: >>>=20 >>> ADD Working Group, >>>=20 >>> This is to inform you of a new submission of the doh-preference-hints do= cument. This document was originally intended for the HTTPbis working group,= but we were directed to the ADD group as a more appropriate venue to discus= s it. Our intention is to put this document up for consideration to be adopt= ed as a working group item. >>>=20 >>> Nick, David, Jesse >>>=20 >>> ---------- Forwarded message --------- >>> From: >>> Date: Mon, Jul 13, 2020 at 12:36 PM >>> Subject: New Version Notification for draft-schinazi-httpbis-doh-prefere= nce-hints-02.txt >>> To: Jesse Kipp , Nick Sullivan , David Schinazi >>>=20 >>>=20 >>>=20 >>> A new version of I-D, draft-schinazi-httpbis-doh-preference-hints-02.txt= >>> has been successfully submitted by David Schinazi and posted to the >>> IETF repository. >>>=20 >>> Name: draft-schinazi-httpbis-doh-preference-hints >>> Revision: 02 >>> Title: DoH Preference Hints for HTTP >>> Document date: 2020-07-13 >>> Group: Individual Submission >>> Pages: 8 >>> URL: https://www.ietf.org/internet-drafts/draft-schinazi-http= bis-doh-preference-hints-02.txt >>> Status: https://datatracker.ietf.org/doc/draft-schinazi-httpbis-= doh-preference-hints/ >>> Htmlized: https://tools.ietf.org/html/draft-schinazi-httpbis-doh-p= reference-hints-02 >>> Htmlized: https://datatracker.ietf.org/doc/html/draft-schinazi-htt= pbis-doh-preference-hints >>> Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-schinazi-httpb= is-doh-preference-hints-02 >>>=20 >>> Abstract: >>> When using a publicly available DNS-over-HTTPS (DoH) server, some >>> clients may suffer poor performance when the authoritative DNS server= >>> is located far from the DoH server. For example, a publicly >>> available DoH server provided by a Content Delivery Network (CDN) >>> should be able to resolve names hosted by that CDN with good >>> performance but might take longer to resolve names provided by other >>> CDNs, or might provide suboptimal results if that CDN is using DNS- >>> based load balancing and returns different address records depending >>> or where the DNS query originated from. This document attempts to >>> lessen these issues by allowing the web server to indicate to the >>> client which DoH server can best resolve its addresses. This >>> document defines an HTTP header field that enables web host operators= >>> to inform user agents of the preferred DoH servers to use for >>> subsequent DNS lookups for the host's domain. >>>=20 >>> Discussion of this work is encouraged to happen on the ADD IETF >>> mailing list add@ietf.org or on the GitHub repository which contains >>> the draft: https://github.com/DavidSchinazi/draft-httpbis-doh- >>> preference-hints. >>>=20 >>>=20 >>>=20 >>>=20 >>> Please note that it may take a couple of minutes from the time of submis= sion >>> until the htmlized version and diff are available at tools.ietf.org. >>>=20 >>> The IETF Secretariat >>>=20 >>>=20 >>> --=20 >>> Add mailing list >>> Add@ietf.org >>> https://www.ietf.org/mailman/listinfo/add --Apple-Mail-3B380643-3F09-451C-AA11-058C66C62191 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable


On Jul 26, 2020, at 4:03 PM, Da= vid Schinazi <dschinazi.ietf@gmail.com> wrote:

=EF=BB=BF
Hi Tommy,

Thanks for your comments! Resp= onses inline.

On Sun, Jul 26, 2020 at 1:43 PM Tommy Pauly <tpauly@apple.com> wrote:
Hi Nick,

I definitely like the optimizations that t= his mechanism is looking for=E2=80=94specifically, binding resolutions to a D= oH server that is hosted by the same CDN that provides the desired web c= ontent. This not only allows for faster resolution (based on being near the a= uthoritative) and faster connections (based on tailoring DNS answers fo= r the client=E2=80=99s subnet) as you describe, but has some privacy benefit= s in limiting the number of parties involved in subsequent resolutions.=

The specific mechanism does cause some concerns for me, however.
=
I know this is just a hint, but the weak relationship between this hint a= nd the DNS may cause issues. The DoH preference hint is one-way only, and&nb= sp;determined only by the entity that is generating HTTP headers for a given= URL. This means that neither the operator of the DNS zone for the origin,&n= bsp;nor the target DoH resolver, have any way to influence or validate this h= int. It is possible that these are all the same entity (Google content in a&= nbsp;google.com zon= e pointing to 8.8.8.8), but that=E2=80=99s not guaranteed. Nothing stops any= website from providing a hint to direct clients to whichever DoH serve= r it wants, for as long as it wants. I have no problem with HTTPS content he= lping to confirm that the owner of the cert for a name agrees to using a= specific DoH server (see https://www.ietf.org/id/draft-pauly-add-resolver-discovery-01.html#= name-confirmation-of-designation), but the primary control over DNS= routing should lie with the operator of the DNS zone in order to get the op= timizations described in the document.

=
Your statement that "the primary control over DNS routing sh= ould lie with the operator of the DNS zone" contradicts existing best practi= ces.
Today, when my device= s connect to a first hop network (Wi-Fi, cellular, etc.), that network will a= lmost always provide me with a list of DNS servers, using mechanisms such as= IPv6 RAs or DHCP. My device then proceeds to route its DNS based on that in= formation. This control over DNS routing does not lie with the operator of t= he DNS zone, it lies with the first hop network operator - or with the devic= e administrator who can override DNS configuration. Our proposal allows HTTP= server operators to influence DNS routing, and your proposal allows DNS zon= e operators to influence DNS routing, but neither of those solutions is "mor= e correct" based on how DNS works today.

Yes, of course the first hop network operator generally= provides the actual view of DNS content. And many other entities influence t= he actual view. That=E2=80=99s not the kind of control I was referring to.&n= bsp;

To clarify this point, which I see has been taken a bit ou= t of context, I was referring to the choice between having the owner of a na= me indicate its DNS resolver designation via information in its DNS records a= nd having that entity indicate this designation purely through an HTTP respo= nse to a non-DNS request. If =E2=80=9Cexample.com=E2=80=9D wants to indicate= that DNS queries can be optimized if they are directed to =E2=80=9Cdoh.exam= ple.com=E2=80=9D, this control should generally be given to the DNS zone for= example.com instead of the content HTTP server, since the DNS zone operator= knows more context about its own DNS configuration.

One of th= e premises your document describes us that there can be optimization if the p= referred DoH server is closer to or related to the authoritative DNS server.= This is the kind of information that makes sense to keep related to DNS rec= ords. Let=E2=80=99s say that I have a large number of names under example.co= m. Every name under example.com originally indicates a preference for doh.dn= s.example.com. Then, at some point, I change how names under foo.example.com= are managed such that another DoH server should be preferred (maybe a chang= e of CDN, etc). If the preference had been previously marked using HTTP head= ers, this DNS-centric change could mean I need to track down every HTTP serv= er and make sure the response is updated; and since this hint is entirely re= quest-specific, there could be paths that redirect in non-obvious ways, and u= pdates could be missed. If the preference is communicated in DNS records, ho= wever, I can perform the update across all the records in the appropriate zo= ne.

I totally understand that there are deployments, like Goo= gle=E2=80=99s, for which it is more convenient to use a hint in HTTP, since y= ou can update that easily and uniformly, and you can ignore multi-CDN concer= ns, etc. But a standard mechanism that is based in the DNS might avoid a lot= of headache and misconfiguration risks for other common deployments.=
<= br>
=
=
It also seems like it would b= e more optimal for this indication of DoH server to be expressed for a set o= f names (names within a zone, or all subdomains, etc), rather than just= a single host name. The text limits any hint to only apply to one name, whi= ch is good because the hint could otherwise cause problems for an entir= e zone, but means that the benefit is limited. If every YouTube video has a u= nique hostname that is only resolved once, wouldn=E2=80=99t it be bette= r to learn that I should use 8.8.8.8 for all YouTube names?
<= /blockquote>

Definitely agree. We could change the draft t= o allow these hints to influence other hostnames that are covered by the sam= e TLS certificate, though we'd have to consider the security implications ca= refully.
 
What would the client beh= avior for this header be if there is a redirect? For any content that uses r= edirects, I assume these hints must be ignored?

I don't think HTTP redirects should have any impact on t= he DoH-Preference header. If ht= tps://foo.example.com/abc returns a 301 redirect to https://bar.example.net/def it can still tell the cl= ient that subsequent resolutions for foo.= example.com can be made to a given DoH server. The key distinction here i= s that the DoH-Preference operates at the scope of a hostname, whereas a= n HTTP redirect operates at the scope of a given request (i.e. it's specific= to the full path, not just the hostname).

Okay, that=E2=80=99s good to c= larify=E2=80=94you may want to mention that in the doc. The fact that the Do= H preference operates at the scope of the hostname and not the request is an= other reason I=E2=80=99d prefer to see it tied to something about the hostna= me (a DNS record, or at the very least, a well-known URL off the hostname). W= hat happens if the client receives different preference headers across diffe= rent responses?

Best,
=
Tommy

<= div dir=3D"ltr">
 
Cheers,
David


Best,
Tommy

On Jul 13, 2= 020, at 1:25 PM, Nick Sullivan <nick=3D40cloudflare.com@dmarc.ietf.org> wrote:

ADD Working Group,

This is to inform you of a new submission of the doh-preference-h= ints document. This document was originally intended for the HTTPbis wo= rking group, but we were directed to the ADD group as a more appropriate ven= ue to discuss it. Our intention is to put this document up for consider= ation to be adopted as a working group item.

Nick, D= avid, Jesse

---------- Forwarded message ---------
From: <intern= et-drafts@ietf.org>
Date: Mon, Jul 13, 2020 at 12:36 PM
= Subject: New Version Notification for draft-schinazi-httpbis-doh-preference-= hints-02.txt
To: Jesse Kipp <jkipp@cloudflare.com>, Nick Sullivan <nick@cloudflare.com>, D= avid Schinazi <dschinazi.ietf@gmail.com>



A new version of I-D, draft-schinazi-httpbis-doh-preference-hints-02.txt
= has been successfully submitted by David Schinazi and posted to the
IETF repository.

Name:           draft-schinazi-httpbis-doh-pre= ference-hints
Revision:       02
Title:          DoH Preference Hints for HTTP
Document date:  2020-07-13
Group:          Individual Submission
Pages:          8
URL:            https://www.ietf.org/internet-drafts/draft-sc= hinazi-httpbis-doh-preference-hints-02.txt
Status:         https://datatracker.ietf.org/doc/draft-schinazi-httpbis-doh-= preference-hints/
Htmlized:       https://tools.ietf.org/html/draft-schinazi-httpbis-doh-preference-hi= nts-02
Htmlized:       https://datatracker.ietf.org/doc/html/draft-schinazi-httpbis-= doh-preference-hints
Diff:           https://www.ietf.org/rfcdiff?url2=3Ddraft-schinazi= -httpbis-doh-preference-hints-02

Abstract:
   When using a publicly available DNS-over-HTTPS (DoH) server, so= me
   clients may suffer poor performance when the authoritative DNS s= erver
   is located far from the DoH server.  For example, a public= ly
   available DoH server provided by a Content Delivery Network (CD= N)
   should be able to resolve names hosted by that CDN with good    performance but might take longer to resolve names provided by o= ther
   CDNs, or might provide suboptimal results if that CDN is using D= NS-
   based load balancing and returns different address records depe= nding
   or where the DNS query originated from.  This document att= empts to
   lessen these issues by allowing the web server to indicate to t= he
   client which DoH server can best resolve its addresses.  T= his
   document defines an HTTP header field that enables web host ope= rators
   to inform user agents of the preferred DoH servers to use for    subsequent DNS lookups for the host's domain.

   Discussion of this work is encouraged to happen on the ADD IETF<= br>    mailing list = add@ietf.org or on the GitHub repository which contains
   the draft: https://github.com/DavidSch= inazi/draft-httpbis-doh-
   preference-hints.




Please note that it may take a couple of minutes from the time of submission=
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat


--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail-3B380643-3F09-451C-AA11-058C66C62191-- From nobody Mon Jul 27 00:54:32 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7DE043A1767 for ; Mon, 27 Jul 2020 00:54:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9jXL4eoSdR6R for ; Mon, 27 Jul 2020 00:54:27 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8EE293A1775 for ; Mon, 27 Jul 2020 00:54:26 -0700 (PDT) Received: from linux-9daj.localnet (full.e-r.fsi.io [104.244.14.22]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id D5EB8C3F16 for ; Mon, 27 Jul 2020 07:54:23 +0000 (UTC) From: Paul Vixie To: add@ietf.org Date: Mon, 27 Jul 2020 07:54:20 +0000 Message-ID: <1776930.eNfv2hk2N7@linux-9daj> Organization: none In-Reply-To: References: <159466897500.14799.423774862197475126@ietfa.amsl.com> <5870714.Gq5UQWgKNX@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 07:54:30 -0000 On Monday, 27 July 2020 02:30:05 UTC Adam Roach wrote: > On 7/26/2020 6:33 PM, Paul Vixie wrote: > > On Sunday, 26 July 2020 23:02:57 UTC David Schinazi wrote: > >> Your statement that "the primary control over DNS routing should lie with > >> the operator of the DNS zone" contradicts existing best practices. ... > > > > this is the hardest truth i've seen in this forum. please disagree out > > loud if you disagree > > Only because you asked: the status quo is, of course, more nuanced than > this. Onion routing, VPNs, HTTP proxies, and SOCKS proxies provide some > of the most obvious counterexamples. privately operated edge networks make investment choices around risks and costs. since the internet edge was 100% private before commercialization and privatization began, i think it's a century too soon to exclude that model. if you want to try those counterexamples from within some corporate, military, government, and other non-public-access non-ISP networks such as the one i operate for my family, you'll be treated as an attacker. that won't change. i beg you, please remember that i'm not talking about public-access networks where the end users are receiving connectivity as a service. rather, networks operated by the owner of all the devices plugged into them. we are legion. -- Paul From nobody Mon Jul 27 07:24:51 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F1B803A19F7 for ; Mon, 27 Jul 2020 07:24:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ziSNGMIczf-2 for ; Mon, 27 Jul 2020 07:24:46 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3260A3A1ABD for ; Mon, 27 Jul 2020 07:23:55 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 9DC0D28054F; Mon, 27 Jul 2020 16:23:53 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id 95A6B2806CA; Mon, 27 Jul 2020 16:23:53 +0200 (CEST) Received: from relay01.prive.nic.fr (unknown [10.1.50.11]) by mx4.nic.fr (Postfix) with ESMTP id 8DA3A28054F; Mon, 27 Jul 2020 16:23:53 +0200 (CEST) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 80D67642C582; Mon, 27 Jul 2020 16:23:53 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id 24CB73FF16; Mon, 27 Jul 2020 16:23:53 +0200 (CEST) Date: Mon, 27 Jul 2020 16:23:53 +0200 From: Stephane Bortzmeyer To: Tommy Jensen Cc: Tim Wicinski , Stephane Bortzmeyer , Ben Schwartz , David Schinazi , ADD Mailing list , Tommy Pauly Message-ID: <20200727142353.GA4377@nic.fr> References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> <20200723141314.GA32028@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.083324, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 14:24:49 -0000 On Thu, Jul 23, 2020 at 04:00:55PM +0000, Tommy Jensen wrote a message of 276 lines which said: > Do you have specific concerns with our approach? Is your question > about the concept of Adaptive DNS as a whole (zones designating DNS > servers for future queries), or I did not even know the term of "Adaptive DNS". It is not in RFC 8499. Is it in common use? So, yes, I have concerns with the idea of having a Web site directing the future DNS queries, I'm afraid it will make debugging harder (you cannot know which resolver was used, there can be many in a typical Web session). For the related idea of a DNS zone directing to specific resolvers, I'm confused: isn't it simply what DNS delegation is about? From nobody Mon Jul 27 07:27:49 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5559C3A1AEA for ; Mon, 27 Jul 2020 07:27:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vzAGm_VHuKnN for ; Mon, 27 Jul 2020 07:27:42 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97DFD3A1C72 for ; Mon, 27 Jul 2020 07:26:34 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id E4483280567; Mon, 27 Jul 2020 16:26:32 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id DD6282806E3; Mon, 27 Jul 2020 16:26:32 +0200 (CEST) Received: from relay01.prive.nic.fr (unknown [10.1.50.11]) by mx4.nic.fr (Postfix) with ESMTP id D58D5280567; Mon, 27 Jul 2020 16:26:32 +0200 (CEST) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id C66D1642C589; Mon, 27 Jul 2020 16:26:32 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id 9FAD43FF16; Mon, 27 Jul 2020 16:26:32 +0200 (CEST) Date: Mon, 27 Jul 2020 16:26:32 +0200 From: Stephane Bortzmeyer To: Tony Finch Cc: Vittorio Bertola , ADD Mailing list , Stephane Bortzmeyer Message-ID: <20200727142632.GB4377@nic.fr> References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> <20200723141314.GA32028@nic.fr> <1357064544.7200.1595520796779@appsuite-gw1.open-xchange.com> <349288020.8370.1595580125534@appsuite-gw2.open-xchange.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.000000, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 14:27:48 -0000 On Fri, Jul 24, 2020 at 05:53:02PM +0100, Tony Finch wrote a message of 21 lines which said: > Except that stub resolvers have to cope with networks that don't > allow end-user devices to talk to arbitrary authoritative DNS > servers. These violations of network neutrality seem a reason to use DoH (or DoT) with authoritative name servers. From nobody Mon Jul 27 07:29:25 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B840A3A1A46 for ; Mon, 27 Jul 2020 07:29:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PNO0K7UtpfwK for ; Mon, 27 Jul 2020 07:29:22 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8FE83A1B96 for ; Mon, 27 Jul 2020 07:28:13 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 56B20280567; Mon, 27 Jul 2020 16:28:12 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id 4F8DB2806CC; Mon, 27 Jul 2020 16:28:12 +0200 (CEST) Received: from relay01.prive.nic.fr (unknown [10.1.50.11]) by mx4.nic.fr (Postfix) with ESMTP id 47A97280567; Mon, 27 Jul 2020 16:28:12 +0200 (CEST) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 3ACF4642C582; Mon, 27 Jul 2020 16:28:12 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id 171853FF16; Mon, 27 Jul 2020 16:28:12 +0200 (CEST) Date: Mon, 27 Jul 2020 16:28:12 +0200 From: Stephane Bortzmeyer To: "Chris Box (BT)" Cc: Stephane Bortzmeyer , Neil Cook , "add@ietf.org" , Andrew Campling Message-ID: <20200727142812.GC4377@nic.fr> References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <20200721073934.GA29757@nic.fr> <20200723143446.GA648@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.072134, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 14:29:24 -0000 On Thu, Jul 23, 2020 at 05:50:15PM +0100, Chris Box (BT) wrote a message of 87 lines which said: > These have been in force for some years. If Orange don't let you > change, they are most likely in breach of the French law which > adopts these regulations. IANAL (and I don't know if you are) but I guess the problem is in the definition of "terminal equipment of their choice". Some people may claim it is the PC (or smartphone), and that the CPE is actually part of the network, not a terminal equipment. From nobody Mon Jul 27 07:58:56 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 501643A19C7 for ; Mon, 27 Jul 2020 07:58:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JyWAIqPa5aOl for ; Mon, 27 Jul 2020 07:58:53 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 099D43A1A75 for ; Mon, 27 Jul 2020 07:55:04 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 1BE21280173; Mon, 27 Jul 2020 16:55:03 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id 156BB2806D9; Mon, 27 Jul 2020 16:55:03 +0200 (CEST) Received: from relay01.prive.nic.fr (unknown [10.1.50.11]) by mx4.nic.fr (Postfix) with ESMTP id 0DD18280173; Mon, 27 Jul 2020 16:55:03 +0200 (CEST) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 02E8C642C582; Mon, 27 Jul 2020 16:55:03 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id 987F53FF16; Mon, 27 Jul 2020 16:55:02 +0200 (CEST) Date: Mon, 27 Jul 2020 16:55:02 +0200 From: Stephane Bortzmeyer To: Daniel Migault Cc: ADD Mailing list Message-ID: <20200727145502.GA7147@nic.fr> References: <159078807168.11416.12425165143603046178@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.000000, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] New Version Notification for draft-mglt-add-rdp-02.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 14:58:55 -0000 On Fri, May 29, 2020 at 08:21:59PM -0400, Daniel Migault wrote a message of 218 lines which said: > Please find an update version of the DNS Resolver Discovery Protocol (DRDP) To tell the truth, I do not completely understand the protocol, or the problem it tries to solve. But I work on that. A high-level description would help. Section 2 is quite confusing. It says "The DNS client may obtain the contextual resolving domains via various way, including a configuration or via DHCP Options [I-D.btw-add-home]" and later "This document describes two mechanisms for a DNS client to retrieve resolving domains", these mechanisms being different from the ones mentioned in the first sentence. First question, about the concept of "resolving domain". 5.1 says "FQDN - such as resolver.example.com - and the domain part ( example.com ) is designated as the resolving domain". The term "the domain part" is unclear. Does it mean "the FQDN without the most-specific label"? If the resolving service is foo.bar.example.eu.org, is the resolving domain bar.example.eu.org? (5.3 seems to imply this.) Second, I do not get the relationship between "resolving domain" and "resolving domain list". What is called "resolving domain" in 5.1 seems to be a "resolving domain list" in 5.2. From nobody Mon Jul 27 08:27:02 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E7113A1AAE for ; Mon, 27 Jul 2020 08:26:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T12NYpt_Q9to for ; Mon, 27 Jul 2020 08:26:47 -0700 (PDT) Received: from mail-il1-x129.google.com (mail-il1-x129.google.com [IPv6:2607:f8b0:4864:20::129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB8393A1A0D for ; Mon, 27 Jul 2020 08:26:11 -0700 (PDT) Received: by mail-il1-x129.google.com with SMTP id c16so1615276ils.8 for ; Mon, 27 Jul 2020 08:26:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hk0HI6/LaDkXMoCF3HXyQmAQzqtZFAMsEOT95eSGBws=; b=MscCqLdaQrVTQntnbkM8Lqyba9D2OaIaT7QwdsQU/sAylw/FVJQX+POdw3Tb2PVtHD x6tRcqDvyZL7vcQQt74D660Ol/VFBEVVHz3IRCTOCSqASZabpPCaoiC4cumQrhhvVRC5 bH6JFfjhpp2tpwFIg8H0WsXs0Ei0dTSqs2bYpyrxk21Rgtqv31osp9CPqUUFeLsmdtkB cciI+bH/tCuHhCpKIAf+Kvxp7Qgurt6I7hk6WFqfeiYQXoqWVWCsXpprMAAwqsDGRx1k T/FQeW8W9m4MD5i2r7hFQmxZiGyRStkTEUIxTqdY93WfM/LbqiVcbUz/cR+z4Fq8Qtab flzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hk0HI6/LaDkXMoCF3HXyQmAQzqtZFAMsEOT95eSGBws=; b=g4JclaqklQUgQKl7IbYYigrlFkvECONzS49dHEH0X/5jVRomeL8VtzK4B0ICd/Tfxv hIWmW2ytOOSsKPPT8S1pAinqIZcJUmMnrwzUBIHJ85kxIE5pTON6CYgsUmyB51TEIarB hlCORnxncQ1W0b8KMkV47MtXRVhkvFJ/APhIg7oW6MV7SKNl/koGsOwvlnUbV0rsu6jI pxcwao8Jc3dKZl0MMZhUR1mScBmKSv81bxZwnF70nX+Ml2ZojBTdA/nehcmGAyi9zdLb DIg+dijExMjXLY2eBYs1GF32Xvweu5HcpDnHecVi9b9PvHuodvY33fnZkvdZTBAeY8jv ORSQ== X-Gm-Message-State: AOAM533I8+t6pYhRMbz7VDKB4KB13oxzGJ2/qh5MpEqyPWgk4UhDkAnG fuNJmadIiBXhKeBCQpGJDl4Wuf8hDZsegbCS7/JsuA== X-Google-Smtp-Source: ABdhPJwYY65+OfFGf3i4V/W+AbOHjG0FGO1ak5/lr5dkU7Du/sWtdDDOxSCYHs0Q3WmkBff5SV65Xegmszbtn9RPHYA= X-Received: by 2002:a92:cf06:: with SMTP id c6mr24448193ilo.73.1595863570992; Mon, 27 Jul 2020 08:26:10 -0700 (PDT) MIME-Version: 1.0 References: <159466897500.14799.423774862197475126@ietfa.amsl.com> <5870714.Gq5UQWgKNX@linux-9daj> <1776930.eNfv2hk2N7@linux-9daj> In-Reply-To: <1776930.eNfv2hk2N7@linux-9daj> From: Rob Sayre Date: Mon, 27 Jul 2020 08:26:00 -0700 Message-ID: To: Paul Vixie Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000042547d05ab6df185" Archived-At: Subject: Re: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 15:26:59 -0000 --00000000000042547d05ab6df185 Content-Type: text/plain; charset="UTF-8" On Mon, Jul 27, 2020 at 12:54 AM Paul Vixie wrote: > > i beg you, please remember that i'm not talking about public-access > networks > where the end users are receiving connectivity as a service. rather, > networks > operated by the owner of all the devices plugged into them. we are legion. > I'd suggest using management software. thanks, Rob --00000000000042547d05ab6df185 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, Jul 27, 2020 at 12:54 AM Paul Vix= ie <paul@redbarn.org> wrote:<= br>

i beg you, please remember that i'm not talking about public-access net= works
where the end users are receiving connectivity as a service. rather, networ= ks
operated by the owner of all the devices plugged into them. we are legion.<= br>

I'd suggest using management softwa= re.

thanks,
Rob
=C2=A0
--00000000000042547d05ab6df185-- From nobody Mon Jul 27 09:49:41 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B7913A1A24 for ; Mon, 27 Jul 2020 09:49:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZenxKQyTHjjE for ; Mon, 27 Jul 2020 09:49:36 -0700 (PDT) Received: from mail-qt1-x835.google.com (mail-qt1-x835.google.com [IPv6:2607:f8b0:4864:20::835]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 36C533A0F93 for ; Mon, 27 Jul 2020 09:49:36 -0700 (PDT) Received: by mail-qt1-x835.google.com with SMTP id a32so12722361qtb.5 for ; Mon, 27 Jul 2020 09:49:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=1nroRyBl5vE5cKXtqpYtAsctOuHkglx3IVd7whcSzoM=; b=Bl6a6rv4niK9/hGmJce5G3evi4HOQHraRNnwBGqdb7N1bHeQKr1coSu4YDfoW24o2h lRdAKbiTuz3fI9YKAehrE7N2wmcPwI0YtBX5Q7CXQo53QbkQ+3/D82sjao+FmbjFtIQY IWnDjmdHfcOskSHOzP42baeluSo90Gp4/JmrPQ6FEexbCIXaNsfz1FzdYk2MLVDSaLJ2 lDdQTqa0Z4rpWE4up6Q1MUk/hSbyokSWySwuCxWEJ84DDgStVx/SdBckYt6dDG9ImHso 0DdlJjyzOgPpE7VNMS4xXk6kftkMnOt8Yg2u+Wg+lSkAJ1b4lZLJGggElDKFhzF9XHf+ 4XJw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=1nroRyBl5vE5cKXtqpYtAsctOuHkglx3IVd7whcSzoM=; b=pLsTxDR73N9kszodeBf6NhsBEt+wqlP1yxDY17+Noo7UEqUdlQynDGuGW5TpNGYUh9 tiDMx1oUO5TVSX/PQ1YniWL6BeoAyUGc9HRQaL43g4mJGnVp0gM/NtMJZLG9aa8ycQST tB9zvwXRTmtUMPYe4OEQsGPo7W6FKrcdE3omFAnrwpNt0jqV8OG/GwAlT0o9ms0ByekK UiccMx1VC8IUj0xKy4P1X5MzI6NcDb4vMr+RNjiauRx00J38jq3hY+uLzHDhsK4UZzPp xqlheKS106p1IbN/BtV5nDv1YAbPNaT/yPd0xrkc9+LB/hL2jUj2plIdchn6NxfHvDag vqDA== X-Gm-Message-State: AOAM530aJPhjW5NRn8IxF5mYbaMXEv9fBW5vmKkVVNJKLCl6VvSz9o2y gHAxMBUgGY8cgy4tzwM3QwVXrUspfPsU9tQtcgrJk2hK X-Google-Smtp-Source: ABdhPJwc6AbHid17l2axIbhqeffZWjbppoKGH7N6RDcwefFE0LmMXErPm0uEhOZctVtq/tqc0oOt2FrTmReVgaSxFZU= X-Received: by 2002:ac8:53d9:: with SMTP id c25mr20958142qtq.205.1595868575267; Mon, 27 Jul 2020 09:49:35 -0700 (PDT) MIME-Version: 1.0 References: <0d768d14-0a11-46fa-8ff8-1b63c578df2a@www.fastmail.com> <20200721073934.GA29757@nic.fr> <20200723143446.GA648@nic.fr> <20200727142812.GC4377@nic.fr> In-Reply-To: <20200727142812.GC4377@nic.fr> From: "Chris Box (BT)" Date: Mon, 27 Jul 2020 17:49:21 +0100 Message-ID: To: Stephane Bortzmeyer Cc: "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000897ee605ab6f1bc3" Archived-At: Subject: Re: [Add] Practical Observations from Encrypted DNS Deployments by Network Operators X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 16:49:39 -0000 --000000000000897ee605ab6f1bc3 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I'm not a lawyer either, but as a designer of ISP services I need to understand them. The rules are expanded by BEREC, as shown below. 25. Thirdly, end-users have the right to use terminal equipment of their choice. Directive 2008/63/EC defines =E2=80=9Cterminal equipment=E2=80=9D a= s =E2=80=9Cequipment directly or indirectly connected to the interface of a public telecommunication network=E2=80=9D. The right to choose terminal equipment therefore covers equipment which connects to the interface of the public telecommunications network. This interface, the network termination point (NTP)11, is defined in Article 2 (da) of the Framework Directive (2002/21/EC),12 meaning the physical point at which a subscriber is provided with access to a public communications network. 26. In considering whether end-users may use the terminal equipment of their choice, NRAs should assess whether an ISP provides equipment for its subscribers and restricts the end-users=E2=80=99 ability to replace that eq= uipment with their own equipment, i.e. whether it provides =E2=80=9Cobligatory equi= pment=E2=80=9D. 27. Moreover, NRAs should consider whether there is an objective technological necessity for the obligatory equipment to be considered as part of the ISP network. If there is not, and if the choice of terminal equipment is limited, the practice would be in conflict with the Regulation. For example, the practice of restricting tethering is likely to constitute a restriction on choice of terminal equipment because ISPs =E2=80=9Cshould not impose restrictions on the use of terminal equipment co= nnecting to the network in addition to those imposed by manufacturers or distributors of terminal equipment in accordance with Union law=E2=80=9D (R= ecital 5). Source: https://berec.europa.eu/eng/document_register/subject_matter/berec/regulato= ry_best_practices/guidelines/9277-berec-guidelines-on-the-implementation-of= -the-open-internet-regulation On Mon, 27 Jul 2020 at 15:28, Stephane Bortzmeyer wrote= : > On Thu, Jul 23, 2020 at 05:50:15PM +0100, > Chris Box (BT) wrote > a message of 87 lines which said: > > > These have been in force for some years. If Orange don't let you > > change, they are most likely in breach of the French law which > > adopts these regulations. > > IANAL (and I don't know if you are) but I guess the problem is in the > definition of "terminal equipment of their choice". Some people may > claim it is the PC (or smartphone), and that the CPE is actually part > of the network, not a terminal equipment. > > --000000000000897ee605ab6f1bc3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I'm not a lawyer either, but as a designer of ISP= services I need to understand them. The rules are expanded by BEREC, as sh= own below.

25. Thir= dly, end-users have the right to use terminal equipment of their choice. Di= rective 2008/63/EC defines =E2=80=9Cterminal equipment=E2=80=9D as =E2=80= =9Cequipment directly or indirectly connected to the interface of a public = telecommunication network=E2=80=9D. The right to choose terminal equipment = therefore covers equipment which connects to the interface of the public te= lecommunications network. This interface, the network termination point (NT= P)11, is defined in Article 2 (da) of the Framework Directive (2002/21/EC),= 12 meaning the physical point at which a subscriber is provided with access= to a public communications network.
26. In considering whether end-user= s may use the terminal equipment of their choice, NRAs should assess whethe= r an ISP provides equipment for its subscribers and restricts the end-users= =E2=80=99 ability to replace that equipment with their own equipment, i.e. = whether it provides =E2=80=9Cobligatory equipment=E2=80=9D.
27. Moreover= , NRAs should consider whether there is an objective technological necessit= y for the obligatory equipment to be considered as part of the ISP network.= If there is not, and if the choice of terminal equipment is limited, the p= ractice would be in conflict with the Regulation. For example, the practice= of restricting tethering is likely to constitute a restriction on choice o= f terminal equipment because ISPs =E2=80=9Cshould not impose restrictions o= n the use of terminal equipment connecting to the network in addition to th= ose imposed by manufacturers or distributors of terminal equipment in accor= dance with Union law=E2=80=9D (Recital 5).



On Mon, 27 Jul 2020 at 15:28, Stephane Bor= tzmeyer <bortzmeyer@nic.fr> = wrote:
On Thu, J= ul 23, 2020 at 05:50:15PM +0100,
=C2=A0Chris Box (BT) <chris.box.ietf@gmail.com> wrote
=C2=A0a message of 87 lines which said:

> These have been in force for some years. If Orange don't let you > change, they are most likely in breach of the French law which
> adopts these regulations.

IANAL (and I don't know if you are) but I guess the problem is in the definition of "terminal equipment of their choice". Some people m= ay
claim it is the PC (or smartphone), and that the CPE is actually part
of the network, not a terminal equipment.

--000000000000897ee605ab6f1bc3-- From nobody Mon Jul 27 09:51:25 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A891B3A1B7F for ; Mon, 27 Jul 2020 09:51:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.101 X-Spam-Level: X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vNGE8OqOLSwr for ; Mon, 27 Jul 2020 09:51:22 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650127.outbound.protection.outlook.com [40.107.65.127]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E58043A1B1B for ; Mon, 27 Jul 2020 09:51:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=R35IihkK/iNtR7qQmybaAareFgtoF8YcSqubg8Bzb3zWfjH8L0km74NfFfofwhnt5QZh7ZjdpsqBVjI0qAXS/9nvkYBDHv0+3F7c1OUHl0GB9x7wr53PthH9lLUUG+jPZxKx0St6rttsdLHcJR+RLT+E0W4mMU/9oNAXVdvubF/AxSP0YoItwV6iA5iW1/bx5TAtpNy4Hyq9QzMmlWnjASm5cdA76YAJTjg8+Gdr4nFx09+FCUrqR6jOJGv/drJgeWVKkWJplQ/KcU0fDO+XbiQ5MJzjwyXpZNi3Fv7oqSfI4Ne9x5cFrYLLvcWCt7cb8P+Wl9H9EfZTgelGJaCEzg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GI7aX8o9JKCIcu3kIrdJFyd6gBwFxgHudBey/RDr+iU=; b=FCpeX2/7H27rng/tW7c/jvOCX7AAty+MzImDKpFDnvbkqSv0pyamydk7cRTlSc63z3NfrFqB3bLejEUZCpdQdjBq9qcg5xrrAIpa7bFZ3wgJwanL2KyF0HlEnnaDYVljARMp0O2OHpAadVMqqhaaS5qKFmrjbB3GOYHAGywvTesde9JKAeFVGiEFWEe9ng12MltRlffY0UhJdTH8mNxNWSdj+tqrkQxeyirKyzEK8mPItKUVl37IiBN4f9aUp3tsCaO7TavfvgtAsEAGyzM4z5EKkLmElidGCNiP7cw/OnG0NQblyb8VFCgw17Cz7Ktc3pX2Fu43TvXuSZ3bAj0d2w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GI7aX8o9JKCIcu3kIrdJFyd6gBwFxgHudBey/RDr+iU=; b=Zkk0HAtMH+H28SYUy9NAZXOnpZlL7rSunfPS01kw8klx4/uS8I00ES6aZIbLBRbptEOi+QIPcrnY4oo2yGf/lPwKuflmA8m/DuTvu2xv50fytG10E10TE1AegASBw3NXRvBBowI1c0zDw77R5Tyanj2c8ajqh46bJtUjGzdUUx4= Received: from BY5PR00MB0773.namprd00.prod.outlook.com (2603:10b6:a03:1d8::23) by BYAPR00MB0869.namprd00.prod.outlook.com (2603:10b6:a03:10d::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3274.0; Mon, 27 Jul 2020 16:51:08 +0000 Received: from BY5PR00MB0773.namprd00.prod.outlook.com ([fe80::243b:859:4321:2eb4]) by BY5PR00MB0773.namprd00.prod.outlook.com ([fe80::243b:859:4321:2eb4%8]) with mapi id 15.20.3273.000; Mon, 27 Jul 2020 16:51:08 +0000 From: Tommy Jensen To: Stephane Bortzmeyer CC: Tim Wicinski , Ben Schwartz , David Schinazi , ADD Mailing list , Tommy Pauly Thread-Topic: [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWZCGRCR73vve0CES4GyuazzbKz6kborD8 Date: Mon, 27 Jul 2020 16:51:07 +0000 Message-ID: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> <20200723141314.GA32028@nic.fr> , <20200727142353.GA4377@nic.fr> In-Reply-To: <20200727142353.GA4377@nic.fr> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-27T16:51:07.272Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; authentication-results: nic.fr; dkim=none (message not signed) header.d=none;nic.fr; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2601:600:a080:aff0:f1cd:f7ba:46d3:252f] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 2f3c77ec-d87d-432c-8129-08d8324d4266 x-ms-traffictypediagnostic: BYAPR00MB0869: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: jb2jyi9P9DYEFQb7Jwp95MC5CKVuabTY2tHa7Kukp8D9UcTQW2DnVV8AqiHi20QpBqMJIkWoZ5h/Nm1Q/9a7/PO6UfrI+BkXd/m8jN/G2wbDM+jzSRTJATlRN2hpjF3NJDr78/OwInBdcLHOz1iZXGB2fAeaS7JVyp2j73g8TMBUhniXhzBsJSESd/Yjjk76PCT4oMDVf4f4IU2yElyfwR1xTRqiadlXKyiQ63N6xsuLy8eEnVLf2loi1lo7odqJOSGQl+1WN+uuIFbV42A/rmBn7Kn2c6f/7Sr0Wuv2B0wGLOwkjEm1RNyWGUJrpQQ06lzfSOqGdCbrBLIThvJAx8cib5uTM2k1Xi+dGubN905Xz9D4IcfTITD5H412NVob8/qz19UYC9tmUSvMePZMqA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR00MB0773.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(39860400002)(366004)(136003)(396003)(376002)(52536014)(8990500004)(19627405001)(83380400001)(66446008)(64756008)(66556008)(66476007)(82960400001)(82950400001)(33656002)(53546011)(6506007)(166002)(7696005)(6916009)(8676002)(54906003)(71200400001)(4326008)(8936002)(5660300002)(966005)(15650500001)(2906002)(86362001)(76116006)(55016002)(186003)(66946007)(9686003)(316002)(10290500003)(66574015)(478600001)(91956017); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: Ff1T8dYCTbLDy9Ol6B7s3aelgD4G9Na9sXLlFFbyTVYGl7tToSRl8CX0jBUxkV0YJ/Bk9AKbiKycUKV89gzrRHFR+7LgXBGCAzfrtDMOtmwZ2wyI1mY5en+iu65/4ZmdOzq5VgjqNw7GrsURGnJWm3MhBB3uLDIlw/NoOMd01C+u5NAYtuzj3jp8dPMce6kcLgNsMlzWrWC4zkMG3g1KoinNmE1bZBXhQKCTuvbO9cxYXxgoESfOkm6YejBKC/tt0f+uXMjS0sNofduJ/9luSYrbbEUx8WI1ygpEDHwRQTpNaOi1P5muXpcV9asEBTRYSFXi7H8DQUIAjEgA6aUlupwIvyafdwXxsYEbhx8WJtfh3ellhdIAi1bGlOGfmO8n28z12pmPIkWfJr4knbDNTceUUU3RV1mXu1DobvM3wLuY0e8f4GVqehW8DiPdgmZwWCiiq3Fa2TKHNS2PL9RVxOcdw5q/TzAxQJvrtiWZKNkIu3OBzi4Yr841dR2knasMj9MZyuZMKBAcFsmCqrKn/MSiWuB6uzKTSN65vUkpdgL5ZncCv86yjCH+6PBQk/C2SOmW2v9fzXykRSmm6cok3Ia0kr1XO9D1tMZvxcMrO8AYkemiKQ7aVir5IyyKf7TNjwwaHD7/4Xj3dlNy3qxCaPGj/tT4RYs0+Q3FUJB0qPDBCbP8s3U6GIdAenRG+QyI+4pYHBQ1wHS+vGcBtNr0EQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_BY5PR00MB077397D4B2A03FD03858F3E7FA720BY5PR00MB0773namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY5PR00MB0773.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2f3c77ec-d87d-432c-8129-08d8324d4266 X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Jul 2020 16:51:07.9246 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: axGM+QvEogWcVB1cF4BAmVLRmweTM/cGq+zVl/ke+ThxqQnmrwYodcvUj+iPheiiY+JH0/5Yn/Zz0d7ZeD82Mg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR00MB0869 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 16:51:24 -0000 --_000_BY5PR00MB077397D4B2A03FD03858F3E7FA720BY5PR00MB0773namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Adaptive DNS was originally the draft name until the content was split into= multiple documents. That's my bad. What I meant to refer to was the concep= t altogether of DNS zones designating their preferred DoH resolvers. Keep in mind as Tommy Pauly said to Tim on a different fork that the primar= y discovery mechanism for DoH resolver designation is through the DNS itsel= f (via SVCB records queried alongside the typical A/AAAA). The HTTPS channe= ls are used for confirming that SVCB claim or to ask the DoH server itself = about what zones it has been delegated. Thanks, Tommy Jensen =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The latest in Windows Internet Protocols: Native gRPC support: https://aka.ms/grpcblogpost DNS over HTTPS: https://aka.ms/dohblogpost ________________________________ From: Stephane Bortzmeyer Sent: Monday, July 27, 2020 7:23 AM To: Tommy Jensen Cc: Tim Wicinski ; Stephane Bortzmeyer ; Ben Schwartz ; David Schinazi ; ADD Mailing list ; Tommy Pauly Subject: [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolv= er-discovery-01.txt On Thu, Jul 23, 2020 at 04:00:55PM +0000, Tommy Jensen wrote a message of 276 lines which said: > Do you have specific concerns with our approach? Is your question > about the concept of Adaptive DNS as a whole (zones designating DNS > servers for future queries), or I did not even know the term of "Adaptive DNS". It is not in RFC 8499. Is it in common use? So, yes, I have concerns with the idea of having a Web site directing the future DNS queries, I'm afraid it will make debugging harder (you cannot know which resolver was used, there can be many in a typical Web session). For the related idea of a DNS zone directing to specific resolvers, I'm confused: isn't it simply what DNS delegation is about? --_000_BY5PR00MB077397D4B2A03FD03858F3E7FA720BY5PR00MB0773namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Adaptive DNS was originally the draft name until the content was split into= multiple documents. That's my bad. What I meant to refer to was the concep= t altogether of DNS zones designating their preferred DoH resolvers.

Keep in mind as Tommy Pauly said to Tim on a different fork that the primar= y discovery mechanism for DoH resolver designation is through the DNS itsel= f (via SVCB records queried alongside the typical A/AAAA). The HTTPS channe= ls are used for confirming that SVCB claim or to ask the DoH server itself about what zones it has been de= legated. 

Thanks,=
Tommy Jensen
=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The latest in Wi= ndows Internet Protocols:
  Native gR= PC support: https://aka.ms/grpcblogpost 
  DNS over = HTTPS: https://aka.ms/dohblogpost=  
From: Stephane Bortzmeyer &= lt;bortzmeyer@nic.fr>
Sent: Monday, July 27, 2020 7:23 AM
To: Tommy Jensen <Jensen.Thomas@microsoft.com>
Cc: Tim Wicinski <tjw.ietf@gmail.com>; Stephane Bortzmeyer <= ;bortzmeyer@nic.fr>; Ben Schwartz <bemasc@google.com>; David Schin= azi <dschinazi.ietf@gmail.com>; ADD Mailing list <add@ietf.org>= ; Tommy Pauly <tpauly=3D40apple.com@dmarc.ietf.org>
Subject: [EXTERNAL] Re: New Version Notification for draft-pauly-add= -resolver-discovery-01.txt
 
On Thu, Jul 23, 2020 at 04:00:55PM +0000,
 Tommy Jensen <Jensen.Thomas@microsoft.com> wrote
 a message of 276 lines which said:

> Do you have specific concerns with our approach? Is your question
> about the concept of Adaptive DNS as a whole (zones designating DNS > servers for future queries), or

I did not even know the term of "Adaptive DNS". It is not in RFC<= br> 8499. Is it in common use?

So, yes, I have concerns with the idea of having a Web site directing
the future DNS queries, I'm afraid it will make debugging harder (you
cannot know which resolver was used, there can be many in a typical
Web session).

For the related idea of a DNS zone directing to specific resolvers,
I'm confused: isn't it simply what DNS delegation is about?
--_000_BY5PR00MB077397D4B2A03FD03858F3E7FA720BY5PR00MB0773namp_-- From nobody Mon Jul 27 11:00:46 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B36D23A1BC3 for ; Mon, 27 Jul 2020 11:00:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nHZfRwwtqsD9 for ; Mon, 27 Jul 2020 11:00:09 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100043.outbound.protection.outlook.com [40.107.10.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40B243A1B68 for ; Mon, 27 Jul 2020 11:00:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jdBQgjIQxpWkdoRmOSRGWA3FlxBxgTNi9tJbzuQu6GF3XQrJUTsft6wx4h7nblK/u9qrc6bZnyP0l5H4G6G03NXiJIe8aFA8l0ps4B4d0dnzqZPDf6qIsHZCk+jzlCloFh8qpvyJTZk5Ch/rcju1npff+IURkTuhWStZjVwJJhe7xeXrz9UR5ZRjjBqYWkXhylzLI0+/3ksrYqHW3rD6K7oT5vB4D2i3/YLXNuyV99mEcAAj6zAeviPU9d5jhN5rgz5iAphSMv71E8PEvcYvyvGkEmDdv9wnbBP/t+lfi1yj/K7QKB1umzHXdqLGx5HOQ3Wezs8kUgFDGIVC6qXkpw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=K2b2gDtJ3GAZYdEe4WQus/ejy6qOWNsr+98rahdP5pI=; b=E2bPbYcPV9k+Wvnlbc20CB8insZ7ru1e7sahOHk4XvG/Kr4p6NTSZA734LsGiCyxjr2JaAxwrG0CAEh6arPH9uoofyijcQuwfUjobBsPZ+49xHwmqO4Ppokcc6/I2dtS95UsPraYhBjjLfHmAGH6FLVGear2GwlJm/zxfqOz6P63y5pxZz/Qde/zp/LvIhWmjghrfGqYpuj/xGBxtHJ1FxsvROSX7SLJG5WuWn0BEgSK38Ixkj21hJCrxaq9zb7DJrXDJYSxohJLuLEeQcho/uFpQ9R+YrgIcPfCf4GhXN8wLjYuHDFtDIpW++glpUP12eGoN8gKBD49iUz+2dRvRQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=K2b2gDtJ3GAZYdEe4WQus/ejy6qOWNsr+98rahdP5pI=; b=ljvoazq5kCcIS7O+WUReqthtWU3tqco0Jg9hBnwMzNRWJvKzte+PvDOMlnJQpVFzoxEfRp8T06WO8d8/IDRBPckWdeXykEI3+t/SQhcDbgUka4jQ3RUb0jog+EImNbaZ7uuM+A/pCabaFtvY5NqqgKHDu3E4Wjn+JArRY2uVJtA= Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:71::15) by LO2P265MB1408.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:96::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.24; Mon, 27 Jul 2020 18:00:06 +0000 Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6]) by LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6%6]) with mapi id 15.20.3216.033; Mon, 27 Jul 2020 18:00:06 +0000 From: Andrew Campling To: Tommy Pauly , Nick Sullivan CC: ADD Mailing list , David Schinazi , Jesse Kipp Thread-Topic: [Add] New Version Notification for draft-schinazi-httpbis-doh-preference-hints-02.txt Thread-Index: AQHWY6EAb3bOFGhn9ES/uKJEi/jLkqkbtk+Q Date: Mon, 27 Jul 2020 18:00:06 +0000 Message-ID: References: <159466897500.14799.423774862197475126@ietfa.amsl.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: apple.com; dkim=none (message not signed) header.d=none;apple.com; dmarc=none action=none header.from=419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:5135:8f15:e232:9ce8] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 3dd3f463-2c8d-4fd8-738b-08d83256e546 x-ms-traffictypediagnostic: LO2P265MB1408: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: A7+rD0ihTW0fB5F+rTXEhc8vrIB1nihGz8pW5eP2ZUlgs5Ro/kx7DMnzxX3q9XAcS1Q9NFYCML2E7e9qxLIt7Hh+Q0DIUdtYNIHrQqKHaabsQ1KVdV4YlvjXG/1XmyNermJ9SGlMI93OkXd9kEyuOdF4B5Y3dYgk4gIQnrtMHahLyTCBCmVpECyevnd/SnqI8fW9qWCqpxfRNPpPxdrUh6zaSm25QgV6xzmOufNacIM7JbZxstwrW3IcPXOJws+DpSn17ZYIxLvTX87IQmptxWtvJfTaTTk95QNoSWbRtN6RN916ZknuFONHYNWmVDKn5sw17MrsEcqjS6CS1YFdtuUW6rOkhMJOm0rpCIwtNSi07lmvhHJpajoU7P7yJSnIMf7nKX3WTKJSzAnt490ZektLF/21slmlG6digrKzUtfQvvWTtdLN5S64dv5e+9927rKgEA/jhx2H7YdPIuKstCc5CjsZAfVvqf1/PGx2+s8= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFTY:; SFS:(366004)(136003)(396003)(376002)(39830400003)(346002)(4326008)(316002)(2906002)(66946007)(83380400001)(76116006)(9686003)(66556008)(6506007)(64756008)(66476007)(71200400001)(86362001)(55016002)(7696005)(186003)(53546011)(66446008)(8936002)(166002)(44832011)(66574015)(966005)(5660300002)(54906003)(33656002)(52536014)(8676002)(110136005)(15650500001)(508600001)(46492007)(16940595002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: /Yw8bA8g8iLR2vqU/vrEY3kCrpss9yLpqpWW7FGrbgVrZX+T5sP1byZVa/EHFhEZ++8o92GAKKOChmcrqsLCcD5bqyH+SXhrEMjSsgmODXR3Vi9tQeNOsvqWm8AXMIOr1L4mR1roV6Mj+/LVbu5aNOGzEx1FANCubGL2X8QrnBPL/31W386mMl6NKLomt/pbVXhV6LXYWUxqg1rF8A9LMA0ZnIu/BVuoK9xzXZfEGqVxypi3COCdehkou44PNMPEqio/vhVj6bAL9OovyPpeircAq7w0cehQe8EbUMTpm2FiGMIVbBcCHH59NKwVHuiENrfjUx5KxoDllmjnZrUO3BzKtNxF2FrjVdwdP1iM0QLsWvlwwBXgLH4Sp2NDe7/NHpZp+65HnY1RZJI07dhwx9PfmwNSD4RuWAEgxpSaGBIjYrUHCPpT3HEMeDGKJy0gUH6eix37gKC2+HZiMRwPQtfBJFw+sbB5N3rkyQmO3sXpgBDbQxQH5M16Q9mCkKXhyrzBfjCy1eBTNLq8oTobkM8/fHFSnaDeEhFTlsi/5DP0s5oc9sjd7ldR9P1pYywX x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_LO2P265MB0573833EBDDF007C7DFA7B2DC2720LO2P265MB0573GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 3dd3f463-2c8d-4fd8-738b-08d83256e546 X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Jul 2020 18:00:06.6751 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 77R/Zcac8cD4k2t4hotj4/IZ7gpdP4vKYb8AQ3Bjhg1MjBCjgwZ5LiULQi0oRfNRP0Z3QzNvp9MvXdlzZ0GKDUEzuT74TC7iCT5r3BDTpF4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1408 Archived-At: Subject: Re: [Add] New Version Notification for draft-schinazi-httpbis-doh-preference-hints-02.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 18:00:21 -0000 --_000_LO2P265MB0573833EBDDF007C7DFA7B2DC2720LO2P265MB0573GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Q2FuIEkgY2hlY2sgd2l0aCB5b3UgYm90aCwgZm9yIHlvdXIgcmVzcGVjdGl2ZSBJLURzLCBmb3Ig Y2xhcmlmaWNhdGlvbjoNCg0KICAqICAgSXMgcGVyc29uYWwgZGF0YSBzaGFyZWQgYW5kL29yIHBy b2Nlc3NlZCBieSByZXNvbHZlcnMgZGV0ZXJtaW5lZCBtZWNoYW5pc3RpY2FsbHksIGFzIG9wcG9z ZWQgdG8gYmVpbmcgZGV0ZXJtaW5lZCBieSBhIHNldHRpbmcgZnJvbSB0aGUgdXNlciBkZXZpY2U/ ICBJZiBzbywgd2hhdCBvcHRpb25zIGFyZSB0aGVyZSBmb3IgdGhlIG93bmVyIG9mIHRoYXQgZGF0 YSB0byBnaXZlIHRoZWlyIGNvbnNlbnQgdG8gaXQgYmVpbmcgc2hhcmVkIGluIHRoaXMgd2F5Pw0K ICAqICAgQ2FuIHRoZSBkZXZpY2Ugb3duZXIgc2V0IGEgdW5pdmVyc2FsIHBvbGljeSB0aGF0IG1p Z2h0IGRpc2FibGUgb3IgcmVzdHJpY3QgdGhlIG1lY2hhbmlzbXMgdGhhdCB5b3UgYXJlIHByb3Bv c2luZz8NCg0KSW4gb3RoZXIgd29yZHMsIHdoYXQgY29udHJvbCwgaWYgYW55LCBkb2VzIHRoZSB1 c2VyIGhhdmUgb3ZlciBhbnkgb2YgdGhpcz8NCg0KDQpBbmRyZXcNCg0KRnJvbTogVG9tbXkgUGF1 bHkgPHRwYXVseUBhcHBsZS5jb20+DQpTZW50OiAyNiBKdWx5IDIwMjAgMjE6NDQNClRvOiBOaWNr IFN1bGxpdmFuIDxuaWNrPTQwY2xvdWRmbGFyZS5jb21AZG1hcmMuaWV0Zi5vcmc+DQpDYzogQURE IE1haWxpbmcgbGlzdCA8YWRkQGlldGYub3JnPjsgRGF2aWQgU2NoaW5hemkgPGRzY2hpbmF6aS5p ZXRmQGdtYWlsLmNvbT47IEplc3NlIEtpcHAgPGpraXBwQGNsb3VkZmxhcmUuY29tPg0KU3ViamVj dDogUmU6IFtBZGRdIE5ldyBWZXJzaW9uIE5vdGlmaWNhdGlvbiBmb3IgZHJhZnQtc2NoaW5hemkt aHR0cGJpcy1kb2gtcHJlZmVyZW5jZS1oaW50cy0wMi50eHQNCg0KSGkgTmljaywNCg0KSSBkZWZp bml0ZWx5IGxpa2UgdGhlIG9wdGltaXphdGlvbnMgdGhhdCB0aGlzIG1lY2hhbmlzbSBpcyBsb29r aW5nIGZvcuKAlHNwZWNpZmljYWxseSwgYmluZGluZyByZXNvbHV0aW9ucyB0byBhIERvSCBzZXJ2 ZXIgdGhhdCBpcyBob3N0ZWQgYnkgdGhlIHNhbWUgQ0ROIHRoYXQgcHJvdmlkZXMgdGhlIGRlc2ly ZWQgd2ViIGNvbnRlbnQuIFRoaXMgbm90IG9ubHkgYWxsb3dzIGZvciBmYXN0ZXIgcmVzb2x1dGlv biAoYmFzZWQgb24gYmVpbmcgbmVhciB0aGUgYXV0aG9yaXRhdGl2ZSkgYW5kIGZhc3RlciBjb25u ZWN0aW9ucyAoYmFzZWQgb24gdGFpbG9yaW5nIEROUyBhbnN3ZXJzIGZvciB0aGUgY2xpZW504oCZ cyBzdWJuZXQpIGFzIHlvdSBkZXNjcmliZSwgYnV0IGhhcyBzb21lIHByaXZhY3kgYmVuZWZpdHMg aW4gbGltaXRpbmcgdGhlIG51bWJlciBvZiBwYXJ0aWVzIGludm9sdmVkIGluIHN1YnNlcXVlbnQg cmVzb2x1dGlvbnMuDQoNClRoZSBzcGVjaWZpYyBtZWNoYW5pc20gZG9lcyBjYXVzZSBzb21lIGNv bmNlcm5zIGZvciBtZSwgaG93ZXZlci4NCg0KSSBrbm93IHRoaXMgaXMganVzdCBhIGhpbnQsIGJ1 dCB0aGUgd2VhayByZWxhdGlvbnNoaXAgYmV0d2VlbiB0aGlzIGhpbnQgYW5kIHRoZSBETlMgbWF5 IGNhdXNlIGlzc3Vlcy4gVGhlIERvSCBwcmVmZXJlbmNlIGhpbnQgaXMgb25lLXdheSBvbmx5LCBh bmQgZGV0ZXJtaW5lZCBvbmx5IGJ5IHRoZSBlbnRpdHkgdGhhdCBpcyBnZW5lcmF0aW5nIEhUVFAg aGVhZGVycyBmb3IgYSBnaXZlbiBVUkwuIFRoaXMgbWVhbnMgdGhhdCBuZWl0aGVyIHRoZSBvcGVy YXRvciBvZiB0aGUgRE5TIHpvbmUgZm9yIHRoZSBvcmlnaW4sIG5vciB0aGUgdGFyZ2V0IERvSCBy ZXNvbHZlciwgaGF2ZSBhbnkgd2F5IHRvIGluZmx1ZW5jZSBvciB2YWxpZGF0ZSB0aGlzIGhpbnQu IEl0IGlzIHBvc3NpYmxlIHRoYXQgdGhlc2UgYXJlIGFsbCB0aGUgc2FtZSBlbnRpdHkgKEdvb2ds ZSBjb250ZW50IGluIGEgZ29vZ2xlLmNvbTxodHRwOi8vZ29vZ2xlLmNvbT4gem9uZSBwb2ludGlu ZyB0byA4LjguOC44KSwgYnV0IHRoYXTigJlzIG5vdCBndWFyYW50ZWVkLiBOb3RoaW5nIHN0b3Bz IGFueSB3ZWJzaXRlIGZyb20gcHJvdmlkaW5nIGEgaGludCB0byBkaXJlY3QgY2xpZW50cyB0byB3 aGljaGV2ZXIgRG9IIHNlcnZlciBpdCB3YW50cywgZm9yIGFzIGxvbmcgYXMgaXQgd2FudHMuIEkg aGF2ZSBubyBwcm9ibGVtIHdpdGggSFRUUFMgY29udGVudCBoZWxwaW5nIHRvIGNvbmZpcm0gdGhh dCB0aGUgb3duZXIgb2YgdGhlIGNlcnQgZm9yIGEgbmFtZSBhZ3JlZXMgdG8gdXNpbmcgYSBzcGVj aWZpYyBEb0ggc2VydmVyIChzZWUgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvaWQvZHJhZnQtcGF1bHkt YWRkLXJlc29sdmVyLWRpc2NvdmVyeS0wMS5odG1sI25hbWUtY29uZmlybWF0aW9uLW9mLWRlc2ln bmF0aW9uKSwgYnV0IHRoZSBwcmltYXJ5IGNvbnRyb2wgb3ZlciBETlMgcm91dGluZyBzaG91bGQg bGllIHdpdGggdGhlIG9wZXJhdG9yIG9mIHRoZSBETlMgem9uZSBpbiBvcmRlciB0byBnZXQgdGhl IG9wdGltaXphdGlvbnMgZGVzY3JpYmVkIGluIHRoZSBkb2N1bWVudC4NCg0KSXQgYWxzbyBzZWVt cyBsaWtlIGl0IHdvdWxkIGJlIG1vcmUgb3B0aW1hbCBmb3IgdGhpcyBpbmRpY2F0aW9uIG9mIERv SCBzZXJ2ZXIgdG8gYmUgZXhwcmVzc2VkIGZvciBhIHNldCBvZiBuYW1lcyAobmFtZXMgd2l0aGlu IGEgem9uZSwgb3IgYWxsIHN1YmRvbWFpbnMsIGV0YyksIHJhdGhlciB0aGFuIGp1c3QgYSBzaW5n bGUgaG9zdCBuYW1lLiBUaGUgdGV4dCBsaW1pdHMgYW55IGhpbnQgdG8gb25seSBhcHBseSB0byBv bmUgbmFtZSwgd2hpY2ggaXMgZ29vZCBiZWNhdXNlIHRoZSBoaW50IGNvdWxkIG90aGVyd2lzZSBj YXVzZSBwcm9ibGVtcyBmb3IgYW4gZW50aXJlIHpvbmUsIGJ1dCBtZWFucyB0aGF0IHRoZSBiZW5l Zml0IGlzIGxpbWl0ZWQuIElmIGV2ZXJ5IFlvdVR1YmUgdmlkZW8gaGFzIGEgdW5pcXVlIGhvc3Ru YW1lIHRoYXQgaXMgb25seSByZXNvbHZlZCBvbmNlLCB3b3VsZG7igJl0IGl0IGJlIGJldHRlciB0 byBsZWFybiB0aGF0IEkgc2hvdWxkIHVzZSA4LjguOC44IGZvciBhbGwgWW91VHViZSBuYW1lcz8N Cg0KV2hhdCB3b3VsZCB0aGUgY2xpZW50IGJlaGF2aW9yIGZvciB0aGlzIGhlYWRlciBiZSBpZiB0 aGVyZSBpcyBhIHJlZGlyZWN0PyBGb3IgYW55IGNvbnRlbnQgdGhhdCB1c2VzIHJlZGlyZWN0cywg SSBhc3N1bWUgdGhlc2UgaGludHMgbXVzdCBiZSBpZ25vcmVkPw0KDQpCZXN0LA0KVG9tbXkNCg0K DQpPbiBKdWwgMTMsIDIwMjAsIGF0IDE6MjUgUE0sIE5pY2sgU3VsbGl2YW4gPG5pY2s9NDBjbG91 ZGZsYXJlLmNvbUBkbWFyYy5pZXRmLm9yZzxtYWlsdG86bmljaz00MGNsb3VkZmxhcmUuY29tQGRt YXJjLmlldGYub3JnPj4gd3JvdGU6DQoNCkFERCBXb3JraW5nIEdyb3VwLA0KDQpUaGlzIGlzIHRv IGluZm9ybSB5b3Ugb2YgYSBuZXcgc3VibWlzc2lvbiBvZiB0aGUgZG9oLXByZWZlcmVuY2UtaGlu dHMgZG9jdW1lbnQuIFRoaXMgZG9jdW1lbnQgd2FzIG9yaWdpbmFsbHkgaW50ZW5kZWQgZm9yIHRo ZSBIVFRQYmlzIHdvcmtpbmcgZ3JvdXAsIGJ1dCB3ZSB3ZXJlIGRpcmVjdGVkIHRvIHRoZSBBREQg Z3JvdXAgYXMgYSBtb3JlIGFwcHJvcHJpYXRlIHZlbnVlIHRvIGRpc2N1c3MgaXQuIE91ciBpbnRl bnRpb24gaXMgdG8gcHV0IHRoaXMgZG9jdW1lbnQgdXAgZm9yIGNvbnNpZGVyYXRpb24gdG8gYmUg YWRvcHRlZCBhcyBhIHdvcmtpbmcgZ3JvdXAgaXRlbS4NCg0KTmljaywgRGF2aWQsIEplc3NlDQoN Ci0tLS0tLS0tLS0gRm9yd2FyZGVkIG1lc3NhZ2UgLS0tLS0tLS0tDQpGcm9tOiA8aW50ZXJuZXQt ZHJhZnRzQGlldGYub3JnPG1haWx0bzppbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmc+Pg0KRGF0ZTog TW9uLCBKdWwgMTMsIDIwMjAgYXQgMTI6MzYgUE0NClN1YmplY3Q6IE5ldyBWZXJzaW9uIE5vdGlm aWNhdGlvbiBmb3IgZHJhZnQtc2NoaW5hemktaHR0cGJpcy1kb2gtcHJlZmVyZW5jZS1oaW50cy0w Mi50eHQNClRvOiBKZXNzZSBLaXBwIDxqa2lwcEBjbG91ZGZsYXJlLmNvbTxtYWlsdG86amtpcHBA Y2xvdWRmbGFyZS5jb20+PiwgTmljayBTdWxsaXZhbiA8bmlja0BjbG91ZGZsYXJlLmNvbTxtYWls dG86bmlja0BjbG91ZGZsYXJlLmNvbT4+LCBEYXZpZCBTY2hpbmF6aSA8ZHNjaGluYXppLmlldGZA Z21haWwuY29tPG1haWx0bzpkc2NoaW5hemkuaWV0ZkBnbWFpbC5jb20+Pg0KDQoNCg0KQSBuZXcg dmVyc2lvbiBvZiBJLUQsIGRyYWZ0LXNjaGluYXppLWh0dHBiaXMtZG9oLXByZWZlcmVuY2UtaGlu dHMtMDIudHh0DQpoYXMgYmVlbiBzdWNjZXNzZnVsbHkgc3VibWl0dGVkIGJ5IERhdmlkIFNjaGlu YXppIGFuZCBwb3N0ZWQgdG8gdGhlDQpJRVRGIHJlcG9zaXRvcnkuDQoNCk5hbWU6ICAgICAgICAg ICBkcmFmdC1zY2hpbmF6aS1odHRwYmlzLWRvaC1wcmVmZXJlbmNlLWhpbnRzDQpSZXZpc2lvbjog ICAgICAgMDINClRpdGxlOiAgICAgICAgICBEb0ggUHJlZmVyZW5jZSBIaW50cyBmb3IgSFRUUA0K RG9jdW1lbnQgZGF0ZTogIDIwMjAtMDctMTMNCkdyb3VwOiAgICAgICAgICBJbmRpdmlkdWFsIFN1 Ym1pc3Npb24NClBhZ2VzOiAgICAgICAgICA4DQpVUkw6ICAgICAgICAgICAgaHR0cHM6Ly93d3cu aWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRzL2RyYWZ0LXNjaGluYXppLWh0dHBiaXMtZG9oLXByZWZl cmVuY2UtaGludHMtMDIudHh0DQpTdGF0dXM6ICAgICAgICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5p ZXRmLm9yZy9kb2MvZHJhZnQtc2NoaW5hemktaHR0cGJpcy1kb2gtcHJlZmVyZW5jZS1oaW50cy8N Ckh0bWxpemVkOiAgICAgICBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtc2NoaW5h emktaHR0cGJpcy1kb2gtcHJlZmVyZW5jZS1oaW50cy0wMg0KSHRtbGl6ZWQ6ICAgICAgIGh0dHBz Oi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2h0bWwvZHJhZnQtc2NoaW5hemktaHR0cGJpcy1k b2gtcHJlZmVyZW5jZS1oaW50cw0KRGlmZjogICAgICAgICAgIGh0dHBzOi8vd3d3LmlldGYub3Jn L3JmY2RpZmY/dXJsMj1kcmFmdC1zY2hpbmF6aS1odHRwYmlzLWRvaC1wcmVmZXJlbmNlLWhpbnRz LTAyDQoNCkFic3RyYWN0Og0KICAgV2hlbiB1c2luZyBhIHB1YmxpY2x5IGF2YWlsYWJsZSBETlMt b3Zlci1IVFRQUyAoRG9IKSBzZXJ2ZXIsIHNvbWUNCiAgIGNsaWVudHMgbWF5IHN1ZmZlciBwb29y IHBlcmZvcm1hbmNlIHdoZW4gdGhlIGF1dGhvcml0YXRpdmUgRE5TIHNlcnZlcg0KICAgaXMgbG9j YXRlZCBmYXIgZnJvbSB0aGUgRG9IIHNlcnZlci4gIEZvciBleGFtcGxlLCBhIHB1YmxpY2x5DQog ICBhdmFpbGFibGUgRG9IIHNlcnZlciBwcm92aWRlZCBieSBhIENvbnRlbnQgRGVsaXZlcnkgTmV0 d29yayAoQ0ROKQ0KICAgc2hvdWxkIGJlIGFibGUgdG8gcmVzb2x2ZSBuYW1lcyBob3N0ZWQgYnkg dGhhdCBDRE4gd2l0aCBnb29kDQogICBwZXJmb3JtYW5jZSBidXQgbWlnaHQgdGFrZSBsb25nZXIg dG8gcmVzb2x2ZSBuYW1lcyBwcm92aWRlZCBieSBvdGhlcg0KICAgQ0ROcywgb3IgbWlnaHQgcHJv dmlkZSBzdWJvcHRpbWFsIHJlc3VsdHMgaWYgdGhhdCBDRE4gaXMgdXNpbmcgRE5TLQ0KICAgYmFz ZWQgbG9hZCBiYWxhbmNpbmcgYW5kIHJldHVybnMgZGlmZmVyZW50IGFkZHJlc3MgcmVjb3JkcyBk ZXBlbmRpbmcNCiAgIG9yIHdoZXJlIHRoZSBETlMgcXVlcnkgb3JpZ2luYXRlZCBmcm9tLiAgVGhp cyBkb2N1bWVudCBhdHRlbXB0cyB0bw0KICAgbGVzc2VuIHRoZXNlIGlzc3VlcyBieSBhbGxvd2lu ZyB0aGUgd2ViIHNlcnZlciB0byBpbmRpY2F0ZSB0byB0aGUNCiAgIGNsaWVudCB3aGljaCBEb0gg c2VydmVyIGNhbiBiZXN0IHJlc29sdmUgaXRzIGFkZHJlc3Nlcy4gIFRoaXMNCiAgIGRvY3VtZW50 IGRlZmluZXMgYW4gSFRUUCBoZWFkZXIgZmllbGQgdGhhdCBlbmFibGVzIHdlYiBob3N0IG9wZXJh dG9ycw0KICAgdG8gaW5mb3JtIHVzZXIgYWdlbnRzIG9mIHRoZSBwcmVmZXJyZWQgRG9IIHNlcnZl cnMgdG8gdXNlIGZvcg0KICAgc3Vic2VxdWVudCBETlMgbG9va3VwcyBmb3IgdGhlIGhvc3QncyBk b21haW4uDQoNCiAgIERpc2N1c3Npb24gb2YgdGhpcyB3b3JrIGlzIGVuY291cmFnZWQgdG8gaGFw cGVuIG9uIHRoZSBBREQgSUVURg0KICAgbWFpbGluZyBsaXN0IGFkZEBpZXRmLm9yZzxtYWlsdG86 YWRkQGlldGYub3JnPiBvciBvbiB0aGUgR2l0SHViIHJlcG9zaXRvcnkgd2hpY2ggY29udGFpbnMN CiAgIHRoZSBkcmFmdDogaHR0cHM6Ly9naXRodWIuY29tL0RhdmlkU2NoaW5hemkvZHJhZnQtaHR0 cGJpcy1kb2gtDQogICBwcmVmZXJlbmNlLWhpbnRzLg0KDQoNCg0KDQpQbGVhc2Ugbm90ZSB0aGF0 IGl0IG1heSB0YWtlIGEgY291cGxlIG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGltZSBvZiBzdWJtaXNz aW9uDQp1bnRpbCB0aGUgaHRtbGl6ZWQgdmVyc2lvbiBhbmQgZGlmZiBhcmUgYXZhaWxhYmxlIGF0 IHRvb2xzLmlldGYub3JnPGh0dHA6Ly90b29scy5pZXRmLm9yZy8+Lg0KDQpUaGUgSUVURiBTZWNy ZXRhcmlhdA0KDQotLQ0KQWRkIG1haWxpbmcgbGlzdA0KQWRkQGlldGYub3JnPG1haWx0bzpBZGRA aWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZA0KDQo= --_000_LO2P265MB0573833EBDDF007C7DFA7B2DC2720LO2P265MB0573GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1z b0xpc3RQYXJhZ3JhcGgsIGxpLk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBo DQoJe21zby1zdHlsZS1wcmlvcml0eTozNDsNCgltYXJnaW4tdG9wOjBjbTsNCgltYXJnaW4tcmln aHQ6MGNtOw0KCW1hcmdpbi1ib3R0b206MGNtOw0KCW1hcmdpbi1sZWZ0OjM2LjBwdDsNCgltYXJn aW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2Fs aWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpw ZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xv cjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1v bmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEy LjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2 LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25z ICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoxOTQ1NjUxMjM3Ow0KCW1zby1saXN0LXR5cGU6 aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotNDc4NTI3MTUyIDEzNDgwNzU1MyAxMzQ4 MDc1NTUgMTM0ODA3NTU3IDEzNDgwNzU1MyAxMzQ4MDc1NTUgMTM0ODA3NTU3IDEzNDgwNzU1MyAx MzQ4MDc1NTUgMTM0ODA3NTU3O30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDox OC4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxp c3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDo1NC4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBw dDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsMw0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCglt YXJnaW4tbGVmdDo5MC4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpX aW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjEyNi4wcHQ7DQoJ dGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2 ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpv Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgltYXJnaW4tbGVmdDoxNjIuMHB0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9u dC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxl ZnQ6MTk4LjBwdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6MjM0LjBwdDsNCgl0ZXh0LWlu ZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CW1hcmdpbi1sZWZ0OjI3MC4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWls eToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpu b25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDozMDYu MHB0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCm9s DQoJe21hcmdpbi1ib3R0b206MGNtO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGNtO30NCi0tPjwv c3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJl ZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0i ZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwv aGVhZD4NCjxib2R5IGxhbmc9IkVOLUdCIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxk aXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+Q2FuIEkgY2hl Y2sgd2l0aCB5b3UgYm90aCwgZm9yIHlvdXIgcmVzcGVjdGl2ZSBJLURzLCBmb3IgY2xhcmlmaWNh dGlvbjo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8dWwgc3R5bGU9Im1hcmdpbi10b3A6MGNtIiB0 eXBlPSJkaXNjIj4NCjxsaSBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi0xOC4wcHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPg0KPHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQ7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPklzIHBlcnNvbmFsIGRhdGEg c2hhcmVkIGFuZC9vciBwcm9jZXNzZWQgYnkgcmVzb2x2ZXJzIGRldGVybWluZWQgbWVjaGFuaXN0 aWNhbGx5LCBhcyBvcHBvc2VkIHRvIGJlaW5nIGRldGVybWluZWQgYnkgYSBzZXR0aW5nIGZyb20g dGhlIHVzZXIgZGV2aWNlPyZuYnNwOyBJZiBzbywgd2hhdCBvcHRpb25zIGFyZSB0aGVyZSBmb3Ig dGhlIG93bmVyIG9mIHRoYXQNCiBkYXRhIHRvIGdpdmUgdGhlaXIgY29uc2VudCB0byBpdCBiZWlu ZyBzaGFyZWQgaW4gdGhpcyB3YXk/PG86cD48L286cD48L3NwYW4+PC9saT48bGkgY2xhc3M9Ik1z b0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDotMTguMHB0O21zby1saXN0OmwwIGxl dmVsMSBsZm8xIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0LWxh bmd1YWdlOkVOLVVTIj5DYW4gdGhlIGRldmljZSBvd25lciBzZXQgYSB1bml2ZXJzYWwgcG9saWN5 IHRoYXQgbWlnaHQgZGlzYWJsZSBvciByZXN0cmljdCB0aGUgbWVjaGFuaXNtcyB0aGF0IHlvdSBh cmUgcHJvcG9zaW5nPzxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PC91bD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0LWxhbmd1YWdl OkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1V UyI+SW4gb3RoZXIgd29yZHMsIHdoYXQgY29udHJvbCwgaWYgYW55LCBkb2VzIHRoZSB1c2VyIGhh dmUgb3ZlciBhbnkgb2YgdGhpcz8mbmJzcDsNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0 LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDttc28tZmFyZWFzdC1s YW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9iPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0 LWxhbmd1YWdlOkVOLVVTIj5BbmRyZXcNCjxvOnA+PC9vOnA+PC9zcGFuPjwvYj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDttc28tZmFyZWFz dC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxk aXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRk aW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxh bmc9IkVOLVVTIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tVVMiPiBUb21teSBQYXVs eSAmbHQ7dHBhdWx5QGFwcGxlLmNvbSZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiAyNiBKdWx5IDIw MjAgMjE6NDQ8YnI+DQo8Yj5Ubzo8L2I+IE5pY2sgU3VsbGl2YW4gJmx0O25pY2s9NDBjbG91ZGZs YXJlLmNvbUBkbWFyYy5pZXRmLm9yZyZndDs8YnI+DQo8Yj5DYzo8L2I+IEFERCBNYWlsaW5nIGxp c3QgJmx0O2FkZEBpZXRmLm9yZyZndDs7IERhdmlkIFNjaGluYXppICZsdDtkc2NoaW5hemkuaWV0 ZkBnbWFpbC5jb20mZ3Q7OyBKZXNzZSBLaXBwICZsdDtqa2lwcEBjbG91ZGZsYXJlLmNvbSZndDs8 YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtBZGRdIE5ldyBWZXJzaW9uIE5vdGlmaWNhdGlvbiBm b3IgZHJhZnQtc2NoaW5hemktaHR0cGJpcy1kb2gtcHJlZmVyZW5jZS1oaW50cy0wMi50eHQ8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBOaWNrLDxvOnA+ PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBkZWZpbml0ZWx5IGxp a2UgdGhlIG9wdGltaXphdGlvbnMgdGhhdCB0aGlzIG1lY2hhbmlzbSBpcyBsb29raW5nIGZvcuKA lHNwZWNpZmljYWxseSwgYmluZGluZyByZXNvbHV0aW9ucyB0byBhIERvSCBzZXJ2ZXIgdGhhdCBp cyBob3N0ZWQgYnkgdGhlIHNhbWUgQ0ROJm5ic3A7dGhhdCBwcm92aWRlcyB0aGUgZGVzaXJlZCB3 ZWIgY29udGVudC4gVGhpcyBub3Qgb25seSBhbGxvd3MgZm9yIGZhc3RlciByZXNvbHV0aW9uIChi YXNlZA0KIG9uIGJlaW5nIG5lYXIgdGhlIGF1dGhvcml0YXRpdmUpIGFuZCBmYXN0ZXIgY29ubmVj dGlvbnMgKGJhc2VkJm5ic3A7b24gdGFpbG9yaW5nIEROUyBhbnN3ZXJzIGZvciB0aGUgY2xpZW50 4oCZcyBzdWJuZXQpIGFzIHlvdSBkZXNjcmliZSwgYnV0IGhhcyBzb21lIHByaXZhY3kgYmVuZWZp dHMgaW4gbGltaXRpbmcgdGhlIG51bWJlciBvZiBwYXJ0aWVzIGludm9sdmVkIGluJm5ic3A7c3Vi c2VxdWVudCByZXNvbHV0aW9ucy48YnI+DQo8YnI+DQpUaGUgc3BlY2lmaWMgbWVjaGFuaXNtIGRv ZXMgY2F1c2Ugc29tZSBjb25jZXJucyBmb3IgbWUsIGhvd2V2ZXIuPGJyPg0KPGJyPg0KSSBrbm93 IHRoaXMgaXMganVzdCBhIGhpbnQsIGJ1dCB0aGUgd2VhayByZWxhdGlvbnNoaXAgYmV0d2VlbiB0 aGlzIGhpbnQgYW5kIHRoZSBETlMgbWF5IGNhdXNlIGlzc3Vlcy4gVGhlIERvSCBwcmVmZXJlbmNl IGhpbnQgaXMgb25lLXdheSBvbmx5LCBhbmQmbmJzcDtkZXRlcm1pbmVkIG9ubHkgYnkgdGhlIGVu dGl0eSB0aGF0IGlzIGdlbmVyYXRpbmcgSFRUUCBoZWFkZXJzIGZvciBhIGdpdmVuIFVSTC4gVGhp cyBtZWFucyB0aGF0IG5laXRoZXIgdGhlIG9wZXJhdG9yDQogb2YgdGhlIEROUyB6b25lIGZvciB0 aGUgb3JpZ2luLCZuYnNwO25vciB0aGUgdGFyZ2V0IERvSCByZXNvbHZlciwgaGF2ZSBhbnkgd2F5 IHRvIGluZmx1ZW5jZSBvciB2YWxpZGF0ZSB0aGlzIGhpbnQuIEl0IGlzIHBvc3NpYmxlIHRoYXQg dGhlc2UgYXJlIGFsbCB0aGUgc2FtZSBlbnRpdHkgKEdvb2dsZSBjb250ZW50IGluIGEmbmJzcDs8 YSBocmVmPSJodHRwOi8vZ29vZ2xlLmNvbSI+Z29vZ2xlLmNvbTwvYT4mbmJzcDt6b25lIHBvaW50 aW5nIHRvIDguOC44LjgpLCBidXQgdGhhdOKAmXMNCiBub3QgZ3VhcmFudGVlZC4gTm90aGluZyBz dG9wcyBhbnkgd2Vic2l0ZSBmcm9tIHByb3ZpZGluZyBhIGhpbnQgdG8gZGlyZWN0IGNsaWVudHMg dG8gd2hpY2hldmVyIERvSCZuYnNwO3NlcnZlciBpdCB3YW50cywgZm9yIGFzIGxvbmcgYXMgaXQg d2FudHMuIEkgaGF2ZSBubyBwcm9ibGVtIHdpdGggSFRUUFMgY29udGVudCBoZWxwaW5nIHRvIGNv bmZpcm0gdGhhdCB0aGUgb3duZXIgb2YgdGhlIGNlcnQgZm9yIGEgbmFtZSBhZ3JlZXMgdG8mbmJz cDt1c2luZyBhIHNwZWNpZmljDQogRG9IIHNlcnZlciAoc2VlJm5ic3A7PGEgaHJlZj0iaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvaWQvZHJhZnQtcGF1bHktYWRkLXJlc29sdmVyLWRpc2NvdmVyeS0wMS5o dG1sI25hbWUtY29uZmlybWF0aW9uLW9mLWRlc2lnbmF0aW9uIj5odHRwczovL3d3dy5pZXRmLm9y Zy9pZC9kcmFmdC1wYXVseS1hZGQtcmVzb2x2ZXItZGlzY292ZXJ5LTAxLmh0bWwjbmFtZS1jb25m aXJtYXRpb24tb2YtZGVzaWduYXRpb248L2E+KSwgYnV0IHRoZSZuYnNwO3ByaW1hcnkgY29udHJv bA0KIG92ZXIgRE5TIHJvdXRpbmcgc2hvdWxkIGxpZSB3aXRoIHRoZSBvcGVyYXRvciBvZiB0aGUg RE5TIHpvbmUgaW4gb3JkZXIgdG8gZ2V0IHRoZSBvcHRpbWl6YXRpb25zIGRlc2NyaWJlZCBpbiB0 aGUgZG9jdW1lbnQuPGJyPg0KPGJyPg0KSXQgYWxzbyBzZWVtcyBsaWtlIGl0IHdvdWxkIGJlIG1v cmUgb3B0aW1hbCBmb3IgdGhpcyBpbmRpY2F0aW9uIG9mIERvSCBzZXJ2ZXIgdG8gYmUgZXhwcmVz c2VkIGZvciBhIHNldCBvZiBuYW1lcyAobmFtZXMgd2l0aGluIGEgem9uZSwgb3IgYWxsJm5ic3A7 c3ViZG9tYWlucywgZXRjKSwgcmF0aGVyIHRoYW4ganVzdCBhIHNpbmdsZSBob3N0IG5hbWUuIFRo ZSB0ZXh0IGxpbWl0cyBhbnkgaGludCB0byBvbmx5IGFwcGx5IHRvIG9uZSBuYW1lLCB3aGljaCBp cw0KIGdvb2QgYmVjYXVzZSB0aGUgaGludCBjb3VsZCZuYnNwO290aGVyd2lzZSBjYXVzZSBwcm9i bGVtcyBmb3IgYW4gZW50aXJlIHpvbmUsIGJ1dCBtZWFucyB0aGF0IHRoZSBiZW5lZml0IGlzIGxp bWl0ZWQuIElmIGV2ZXJ5IFlvdVR1YmUgdmlkZW8gaGFzIGEgdW5pcXVlIGhvc3RuYW1lIHRoYXQg aXMgb25seSZuYnNwO3Jlc29sdmVkIG9uY2UsIHdvdWxkbuKAmXQgaXQgYmUgYmV0dGVyIHRvIGxl YXJuIHRoYXQgSSBzaG91bGQgdXNlIDguOC44LjggZm9yIGFsbCBZb3VUdWJlDQogbmFtZXM/PGJy Pg0KPGJyPg0KV2hhdCB3b3VsZCB0aGUgY2xpZW50IGJlaGF2aW9yIGZvciB0aGlzIGhlYWRlciBi ZSBpZiB0aGVyZSBpcyBhIHJlZGlyZWN0PyBGb3IgYW55IGNvbnRlbnQgdGhhdCB1c2VzIHJlZGly ZWN0cywgSSBhc3N1bWUgdGhlc2UgaGludHMgbXVzdCBiZSBpZ25vcmVkPzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CZXN0LDxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VG9tbXk8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQo8 YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0 O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIEp1 bCAxMywgMjAyMCwgYXQgMToyNSBQTSwgTmljayBTdWxsaXZhbiAmbHQ7PGEgaHJlZj0ibWFpbHRv Om5pY2s9NDBjbG91ZGZsYXJlLmNvbUBkbWFyYy5pZXRmLm9yZyI+bmljaz00MGNsb3VkZmxhcmUu Y29tQGRtYXJjLmlldGYub3JnPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BREQgV29ya2luZyBHcm91cCw8bzpwPjwvbzpwPjwvcD4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoaXMgaXMgdG8gaW5mb3JtIHlvdSBvZiBh IG5ldyBzdWJtaXNzaW9uIG9mIHRoZSZuYnNwO2RvaC1wcmVmZXJlbmNlLWhpbnRzIGRvY3VtZW50 LiBUaGlzIGRvY3VtZW50IHdhcyBvcmlnaW5hbGx5Jm5ic3A7aW50ZW5kZWQgZm9yIHRoZSBIVFRQ YmlzIHdvcmtpbmcgZ3JvdXAsIGJ1dCB3ZSB3ZXJlIGRpcmVjdGVkIHRvIHRoZSBBREQgZ3JvdXAg YXMgYSBtb3JlIGFwcHJvcHJpYXRlIHZlbnVlIHRvIGRpc2N1c3MgaXQuIE91ciBpbnRlbnRpb24N CiBpcyB0byBwdXQmbmJzcDt0aGlzIGRvY3VtZW50IHVwIGZvciBjb25zaWRlcmF0aW9uIHRvIGJl IGFkb3B0ZWQgYXMgYSB3b3JraW5nIGdyb3VwIGl0ZW0uPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk5pY2ssIERhdmlkLCBKZXNzZTxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLS0tLS0tLS0tIEZvcndhcmRl ZCBtZXNzYWdlIC0tLS0tLS0tLTxicj4NCkZyb206ICZsdDs8YSBocmVmPSJtYWlsdG86aW50ZXJu ZXQtZHJhZnRzQGlldGYub3JnIj5pbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4N CkRhdGU6IE1vbiwgSnVsIDEzLCAyMDIwIGF0IDEyOjM2IFBNPGJyPg0KU3ViamVjdDogTmV3IFZl cnNpb24gTm90aWZpY2F0aW9uIGZvciBkcmFmdC1zY2hpbmF6aS1odHRwYmlzLWRvaC1wcmVmZXJl bmNlLWhpbnRzLTAyLnR4dDxicj4NClRvOiBKZXNzZSBLaXBwICZsdDs8YSBocmVmPSJtYWlsdG86 amtpcHBAY2xvdWRmbGFyZS5jb20iPmpraXBwQGNsb3VkZmxhcmUuY29tPC9hPiZndDssIE5pY2sg U3VsbGl2YW4gJmx0OzxhIGhyZWY9Im1haWx0bzpuaWNrQGNsb3VkZmxhcmUuY29tIj5uaWNrQGNs b3VkZmxhcmUuY29tPC9hPiZndDssIERhdmlkIFNjaGluYXppICZsdDs8YSBocmVmPSJtYWlsdG86 ZHNjaGluYXppLmlldGZAZ21haWwuY29tIj5kc2NoaW5hemkuaWV0ZkBnbWFpbC5jb208L2E+Jmd0 OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWJvdHRvbToxMi4wcHQiPjxicj4NCjxicj4NCjxicj4NCkEgbmV3IHZlcnNpb24gb2YgSS1E LCBkcmFmdC1zY2hpbmF6aS1odHRwYmlzLWRvaC1wcmVmZXJlbmNlLWhpbnRzLTAyLnR4dDxicj4N CmhhcyBiZWVuIHN1Y2Nlc3NmdWxseSBzdWJtaXR0ZWQgYnkgRGF2aWQgU2NoaW5hemkgYW5kIHBv c3RlZCB0byB0aGU8YnI+DQpJRVRGIHJlcG9zaXRvcnkuPGJyPg0KPGJyPg0KTmFtZTombmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO2RyYWZ0LXNjaGluYXppLWh0dHBiaXMt ZG9oLXByZWZlcmVuY2UtaGludHM8YnI+DQpSZXZpc2lvbjombmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDswMjxicj4NClRpdGxlOiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgRG9I IFByZWZlcmVuY2UgSGludHMgZm9yIEhUVFA8YnI+DQpEb2N1bWVudCBkYXRlOiZuYnNwOyAyMDIw LTA3LTEzPGJyPg0KR3JvdXA6Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBJbmRp dmlkdWFsIFN1Ym1pc3Npb248YnI+DQpQYWdlczombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7IDg8YnI+DQpVUkw6Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRzL2RyYWZ0LXNj aGluYXppLWh0dHBiaXMtZG9oLXByZWZlcmVuY2UtaGludHMtMDIudHh0IiB0YXJnZXQ9Il9ibGFu ayI+DQpodHRwczovL3d3dy5pZXRmLm9yZy9pbnRlcm5ldC1kcmFmdHMvZHJhZnQtc2NoaW5hemkt aHR0cGJpcy1kb2gtcHJlZmVyZW5jZS1oaW50cy0wMi50eHQ8L2E+PGJyPg0KU3RhdHVzOiZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDs8YSBocmVmPSJodHRwczovL2RhdGF0cmFja2Vy LmlldGYub3JnL2RvYy9kcmFmdC1zY2hpbmF6aS1odHRwYmlzLWRvaC1wcmVmZXJlbmNlLWhpbnRz LyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0 LXNjaGluYXppLWh0dHBiaXMtZG9oLXByZWZlcmVuY2UtaGludHMvPC9hPjxicj4NCkh0bWxpemVk OiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5v cmcvaHRtbC9kcmFmdC1zY2hpbmF6aS1odHRwYmlzLWRvaC1wcmVmZXJlbmNlLWhpbnRzLTAyIiB0 YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXNjaGluYXpp LWh0dHBiaXMtZG9oLXByZWZlcmVuY2UtaGludHMtMDI8L2E+PGJyPg0KSHRtbGl6ZWQ6Jm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9y Zy9kb2MvaHRtbC9kcmFmdC1zY2hpbmF6aS1odHRwYmlzLWRvaC1wcmVmZXJlbmNlLWhpbnRzIiB0 YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFm dC1zY2hpbmF6aS1odHRwYmlzLWRvaC1wcmVmZXJlbmNlLWhpbnRzPC9hPjxicj4NCkRpZmY6Jm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDs8YSBocmVmPSJodHRwczovL3d3 dy5pZXRmLm9yZy9yZmNkaWZmP3VybDI9ZHJhZnQtc2NoaW5hemktaHR0cGJpcy1kb2gtcHJlZmVy ZW5jZS1oaW50cy0wMiIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2Rp ZmY/dXJsMj1kcmFmdC1zY2hpbmF6aS1odHRwYmlzLWRvaC1wcmVmZXJlbmNlLWhpbnRzLTAyPC9h Pjxicj4NCjxicj4NCkFic3RyYWN0Ojxicj4NCiZuYnNwOyAmbmJzcDtXaGVuIHVzaW5nIGEgcHVi bGljbHkgYXZhaWxhYmxlIEROUy1vdmVyLUhUVFBTIChEb0gpIHNlcnZlciwgc29tZTxicj4NCiZu YnNwOyAmbmJzcDtjbGllbnRzIG1heSBzdWZmZXIgcG9vciBwZXJmb3JtYW5jZSB3aGVuIHRoZSBh dXRob3JpdGF0aXZlIEROUyBzZXJ2ZXI8YnI+DQombmJzcDsgJm5ic3A7aXMgbG9jYXRlZCBmYXIg ZnJvbSB0aGUgRG9IIHNlcnZlci4mbmJzcDsgRm9yIGV4YW1wbGUsIGEgcHVibGljbHk8YnI+DQom bmJzcDsgJm5ic3A7YXZhaWxhYmxlIERvSCBzZXJ2ZXIgcHJvdmlkZWQgYnkgYSBDb250ZW50IERl bGl2ZXJ5IE5ldHdvcmsgKENETik8YnI+DQombmJzcDsgJm5ic3A7c2hvdWxkIGJlIGFibGUgdG8g cmVzb2x2ZSBuYW1lcyBob3N0ZWQgYnkgdGhhdCBDRE4gd2l0aCBnb29kPGJyPg0KJm5ic3A7ICZu YnNwO3BlcmZvcm1hbmNlIGJ1dCBtaWdodCB0YWtlIGxvbmdlciB0byByZXNvbHZlIG5hbWVzIHBy b3ZpZGVkIGJ5IG90aGVyPGJyPg0KJm5ic3A7ICZuYnNwO0NETnMsIG9yIG1pZ2h0IHByb3ZpZGUg c3Vib3B0aW1hbCByZXN1bHRzIGlmIHRoYXQgQ0ROIGlzIHVzaW5nIEROUy08YnI+DQombmJzcDsg Jm5ic3A7YmFzZWQgbG9hZCBiYWxhbmNpbmcgYW5kIHJldHVybnMgZGlmZmVyZW50IGFkZHJlc3Mg cmVjb3JkcyBkZXBlbmRpbmc8YnI+DQombmJzcDsgJm5ic3A7b3Igd2hlcmUgdGhlIEROUyBxdWVy eSBvcmlnaW5hdGVkIGZyb20uJm5ic3A7IFRoaXMgZG9jdW1lbnQgYXR0ZW1wdHMgdG88YnI+DQom bmJzcDsgJm5ic3A7bGVzc2VuIHRoZXNlIGlzc3VlcyBieSBhbGxvd2luZyB0aGUgd2ViIHNlcnZl ciB0byBpbmRpY2F0ZSB0byB0aGU8YnI+DQombmJzcDsgJm5ic3A7Y2xpZW50IHdoaWNoIERvSCBz ZXJ2ZXIgY2FuIGJlc3QgcmVzb2x2ZSBpdHMgYWRkcmVzc2VzLiZuYnNwOyBUaGlzPGJyPg0KJm5i c3A7ICZuYnNwO2RvY3VtZW50IGRlZmluZXMgYW4gSFRUUCBoZWFkZXIgZmllbGQgdGhhdCBlbmFi bGVzIHdlYiBob3N0IG9wZXJhdG9yczxicj4NCiZuYnNwOyAmbmJzcDt0byBpbmZvcm0gdXNlciBh Z2VudHMgb2YgdGhlIHByZWZlcnJlZCBEb0ggc2VydmVycyB0byB1c2UgZm9yPGJyPg0KJm5ic3A7 ICZuYnNwO3N1YnNlcXVlbnQgRE5TIGxvb2t1cHMgZm9yIHRoZSBob3N0J3MgZG9tYWluLjxicj4N Cjxicj4NCiZuYnNwOyAmbmJzcDtEaXNjdXNzaW9uIG9mIHRoaXMgd29yayBpcyBlbmNvdXJhZ2Vk IHRvIGhhcHBlbiBvbiB0aGUgQUREIElFVEY8YnI+DQombmJzcDsgJm5ic3A7bWFpbGluZyBsaXN0 IDxhIGhyZWY9Im1haWx0bzphZGRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5hZGRAaWV0Zi5v cmc8L2E+IG9yIG9uIHRoZSBHaXRIdWIgcmVwb3NpdG9yeSB3aGljaCBjb250YWluczxicj4NCiZu YnNwOyAmbmJzcDt0aGUgZHJhZnQ6IDxhIGhyZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9EYXZpZFNj aGluYXppL2RyYWZ0LWh0dHBiaXMtZG9oLSIgdGFyZ2V0PSJfYmxhbmsiPg0KaHR0cHM6Ly9naXRo dWIuY29tL0RhdmlkU2NoaW5hemkvZHJhZnQtaHR0cGJpcy1kb2gtPC9hPjxicj4NCiZuYnNwOyAm bmJzcDtwcmVmZXJlbmNlLWhpbnRzLjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxicj4NClBsZWFz ZSBub3RlIHRoYXQgaXQgbWF5IHRha2UgYSBjb3VwbGUgb2YgbWludXRlcyBmcm9tIHRoZSB0aW1l IG9mIHN1Ym1pc3Npb248YnI+DQp1bnRpbCB0aGUgaHRtbGl6ZWQgdmVyc2lvbiBhbmQgZGlmZiBh cmUgYXZhaWxhYmxlIGF0IDxhIGhyZWY9Imh0dHA6Ly90b29scy5pZXRmLm9yZy8iIHRhcmdldD0i X2JsYW5rIj4NCnRvb2xzLmlldGYub3JnPC9hPi48YnI+DQo8YnI+DQpUaGUgSUVURiBTZWNyZXRh cmlhdDxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLSA8YnI+DQpBZGQgbWFpbGluZyBsaXN0PGJy Pg0KPGEgaHJlZj0ibWFpbHRvOkFkZEBpZXRmLm9yZyI+QWRkQGlldGYub3JnPC9hPjxicj4NCjxh IGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWRkIj5odHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZDwvYT48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_LO2P265MB0573833EBDDF007C7DFA7B2DC2720LO2P265MB0573GBRP_-- From nobody Mon Jul 27 11:22:38 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D691E3A1B8D for ; Mon, 27 Jul 2020 11:22:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id awZAFkX9gwyz for ; Mon, 27 Jul 2020 11:22:32 -0700 (PDT) Received: from mail-lj1-x244.google.com (mail-lj1-x244.google.com [IPv6:2a00:1450:4864:20::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C080E3A1B7F for ; Mon, 27 Jul 2020 11:22:31 -0700 (PDT) Received: by mail-lj1-x244.google.com with SMTP id r19so18282094ljn.12 for ; Mon, 27 Jul 2020 11:22:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=IxEMsZE9k+73kr2KMcE+8psILBH6pwytGrULRW2q1TA=; b=BpA4utlqGUlu5lP/iZOCc/kmotwRv96by0zC07rAplfvgRkdLVHIPCz/6GTtogfFfW MakI6PV70AbDUh0wcU4WhzB2fCnSjrpkWYge3lXFHddzC9NDKuv5kyysTSBRtDsPcL7F maODxwNx6YjeNVn6irEhKhF35QAaSUfh/UD263rgsegZaxM1/m95J1Z1ZwsFZ+FhKEaz mGGah0dhrqGpCE4nbMxmYPw6XPuJjquv/N63H2cE2txxkTIOT0AiM3+zo4mCzUFmCNiP GGONXPRYQBiqI30yqIwhk6+x4JUKzmu57Em5Gftgglv69bcjyNmnWvY9IyhUPH8lEG5F ufdg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=IxEMsZE9k+73kr2KMcE+8psILBH6pwytGrULRW2q1TA=; b=Jlt24KoRLZn8B3uh+y38CaYtD0UgDzXfUws0rsdm3x78lHtzqX5juk+lXlERizG7vC ECTZiN1pisRC4qgUaVQSKDDCSNidIcjNWd9H277hOHwoyZOEydmZxRy3ExeUJ9dN5Qu0 GzoNHkldPB9oxoPu8mUwGbZo47Fc8UJmlvMtjxGY+fc8lv6FudTonbra0QbO6zrBQ9V4 4iCogkyWT5znEyVJGR+4GEOIFELmliNnWgTUsYEAOlm7pJVO2nTnzbR0Mtj5NkNvMnAF zREz91pAFp0ccGRYVaz3WXkJWPnsBHWTHlIqJCFJe402dCx5GYNPVyENNwIKWSZLuAlz WvJQ== X-Gm-Message-State: AOAM531bUMOVb2dbGsi7dkR8DO7XujFwqw2eAWhY3YKutE9DpWLxE9fz /YZkQw0KONXGDfy3bp24rscLosQENEUMJG6G1/s= X-Google-Smtp-Source: ABdhPJyRf7NR/tinJgGsujUw37Tjv2O0Bam5N6rg+/m4x70UDAPc4cP0OvEcZU2gNfyndthlWRXRy3ylnHGvszddcyI= X-Received: by 2002:a2e:858e:: with SMTP id b14mr11172142lji.301.1595874149663; Mon, 27 Jul 2020 11:22:29 -0700 (PDT) MIME-Version: 1.0 References: <159466897500.14799.423774862197475126@ietfa.amsl.com> In-Reply-To: From: David Schinazi Date: Mon, 27 Jul 2020 11:22:18 -0700 Message-ID: To: Andrew Campling Cc: Tommy Pauly , Nick Sullivan , ADD Mailing list , Jesse Kipp Content-Type: multipart/alternative; boundary="000000000000cc088f05ab70672f" Archived-At: Subject: Re: [Add] New Version Notification for draft-schinazi-httpbis-doh-preference-hints-02.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 18:22:36 -0000 --000000000000cc088f05ab70672f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Andrew, I think user control is out of scope of both drafts. Both proposals provide a way for server deployments to indicate a preference to the client. One involves an HTTP header, the other involves a DNS record, but conceptually they're both hints: "I offer this resolver which might work better than your default one for this hostname". I think this is pretty much in line with recent IETF practices, we don't define how a browser builds its user preferences UI. My expectatio= n is that browsers that implement these hints will most likely decide to also implement a UI toggle to let users disable this feature if they prefer. (And note that in my statement above, "browser" can be replaced by "operating system" or "application" depending on the use case). David On Mon, Jul 27, 2020 at 11:00 AM Andrew Campling wrote: > Can I check with you both, for your respective I-Ds, for clarification: > > - Is personal data shared and/or processed by resolvers determined > mechanistically, as opposed to being determined by a setting from the = user > device? If so, what options are there for the owner of that data to g= ive > their consent to it being shared in this way? > - Can the device owner set a universal policy that might disable or > restrict the mechanisms that you are proposing? > > > > In other words, what control, if any, does the user have over any of > this? > > > > > > *Andrew * > > > > *From:* Tommy Pauly > *Sent:* 26 July 2020 21:44 > *To:* Nick Sullivan > *Cc:* ADD Mailing list ; David Schinazi < > dschinazi.ietf@gmail.com>; Jesse Kipp > *Subject:* Re: [Add] New Version Notification for > draft-schinazi-httpbis-doh-preference-hints-02.txt > > > > Hi Nick, > > > > I definitely like the optimizations that this mechanism is looking > for=E2=80=94specifically, binding resolutions to a DoH server that is hos= ted by the > same CDN that provides the desired web content. This not only allows for > faster resolution (based on being near the authoritative) and faster > connections (based on tailoring DNS answers for the client=E2=80=99s subn= et) as you > describe, but has some privacy benefits in limiting the number of parties > involved in subsequent resolutions. > > The specific mechanism does cause some concerns for me, however. > > I know this is just a hint, but the weak relationship between this hint > and the DNS may cause issues. The DoH preference hint is one-way only, > and determined only by the entity that is generating HTTP headers for a > given URL. This means that neither the operator of the DNS zone for the > origin, nor the target DoH resolver, have any way to influence or validat= e > this hint. It is possible that these are all the same entity (Google > content in a google.com zone pointing to 8.8.8.8), but that=E2=80=99s not > guaranteed. Nothing stops any website from providing a hint to direct > clients to whichever DoH server it wants, for as long as it wants. I have > no problem with HTTPS content helping to confirm that the owner of the ce= rt > for a name agrees to using a specific DoH server (see > https://www.ietf.org/id/draft-pauly-add-resolver-discovery-01.html#name-c= onfirmation-of-designation), > but the primary control over DNS routing should lie with the operator of > the DNS zone in order to get the optimizations described in the document. > > It also seems like it would be more optimal for this indication of DoH > server to be expressed for a set of names (names within a zone, or > all subdomains, etc), rather than just a single host name. The text limit= s > any hint to only apply to one name, which is good because the hint > could otherwise cause problems for an entire zone, but means that the > benefit is limited. If every YouTube video has a unique hostname that is > only resolved once, wouldn=E2=80=99t it be better to learn that I should = use > 8.8.8.8 for all YouTube names? > > What would the client behavior for this header be if there is a redirect? > For any content that uses redirects, I assume these hints must be ignored= ? > > > > Best, > > Tommy > > > > On Jul 13, 2020, at 1:25 PM, Nick Sullivan < > nick=3D40cloudflare.com@dmarc.ietf.org> wrote: > > > > ADD Working Group, > > > > This is to inform you of a new submission of the doh-preference-hints > document. This document was originally intended for the HTTPbis working > group, but we were directed to the ADD group as a more appropriate venue = to > discuss it. Our intention is to put this document up for consideration to > be adopted as a working group item. > > > > Nick, David, Jesse > > > > ---------- Forwarded message --------- > From: > Date: Mon, Jul 13, 2020 at 12:36 PM > Subject: New Version Notification for > draft-schinazi-httpbis-doh-preference-hints-02.txt > To: Jesse Kipp , Nick Sullivan , > David Schinazi > > > > > A new version of I-D, draft-schinazi-httpbis-doh-preference-hints-02.txt > has been successfully submitted by David Schinazi and posted to the > IETF repository. > > Name: draft-schinazi-httpbis-doh-preference-hints > Revision: 02 > Title: DoH Preference Hints for HTTP > Document date: 2020-07-13 > Group: Individual Submission > Pages: 8 > URL: > https://www.ietf.org/internet-drafts/draft-schinazi-httpbis-doh-preferenc= e-hints-02.txt > Status: > https://datatracker.ietf.org/doc/draft-schinazi-httpbis-doh-preference-hi= nts/ > Htmlized: > https://tools.ietf.org/html/draft-schinazi-httpbis-doh-preference-hints-0= 2 > Htmlized: > https://datatracker.ietf.org/doc/html/draft-schinazi-httpbis-doh-preferen= ce-hints > Diff: > https://www.ietf.org/rfcdiff?url2=3Ddraft-schinazi-httpbis-doh-preference= -hints-02 > > Abstract: > When using a publicly available DNS-over-HTTPS (DoH) server, some > clients may suffer poor performance when the authoritative DNS server > is located far from the DoH server. For example, a publicly > available DoH server provided by a Content Delivery Network (CDN) > should be able to resolve names hosted by that CDN with good > performance but might take longer to resolve names provided by other > CDNs, or might provide suboptimal results if that CDN is using DNS- > based load balancing and returns different address records depending > or where the DNS query originated from. This document attempts to > lessen these issues by allowing the web server to indicate to the > client which DoH server can best resolve its addresses. This > document defines an HTTP header field that enables web host operators > to inform user agents of the preferred DoH servers to use for > subsequent DNS lookups for the host's domain. > > Discussion of this work is encouraged to happen on the ADD IETF > mailing list add@ietf.org or on the GitHub repository which contains > the draft: https://github.com/DavidSchinazi/draft-httpbis-doh- > preference-hints. > > > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > The IETF Secretariat > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > --000000000000cc088f05ab70672f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Andrew,

I think user control is out = of scope of both drafts. Both proposals provide a way
for server = deployments to indicate a preference to the client. One involves an
HTTP header, the other involves a DNS record, but conceptually they'= re both
hints: "I offer this resolver which might work bette= r than your default one for
this hostname". I think this is = pretty much in line with recent IETF practices,
we don't defi= ne how a browser builds its user preferences UI. My expectation
i= s that browsers that implement these hints will most likely decide to also<= /div>
implement a UI toggle to let users disable this feature if they p= refer. (And note
that in my statement above, "browser" = can be replaced by "operating system"
or "applicat= ion" depending on the use case).

David
<= /div>
O= n Mon, Jul 27, 2020 at 11:00 AM Andrew Campling <andrew.campling@419.con= sulting> wrote:

Can I check with you = both, for your respective I-Ds, for clarification:

  • Is personal data shared and/or processed by = resolvers determined mechanistically, as opposed to being determined by a s= etting from the user device?=C2=A0 If so, what options are there for the ow= ner of that data to give their consent to it being shared in this way?
  • Can the device owner set a universal policy = that might disable or restrict the mechanisms that you are proposing?

=C2=A0<= /span>

In other words, what = control, if any, does the user have over any of this?=C2=A0

=C2=A0<= /span>

=C2=A0

Andrew

=C2=A0<= /span>

From: Tommy Pauly <tpauly@apple.com>
Sent: 26 July 2020 21:44
To: Nick Sullivan <nick=3D40cloudflare.com@dmarc.ietf.org>
Cc: ADD Mailing list <add@ietf.org>; David Schinazi <dschinazi.ietf@gmail.com>; Jesse = Kipp <jkipp@cl= oudflare.com>
Subject: Re: [Add] New Version Notification for draft-schinazi-httpb= is-doh-preference-hints-02.txt

=C2=A0

Hi Nick,

=C2=A0

I definitely like the optimizations that this mechan= ism is looking for=E2=80=94specifically, binding resolutions to a DoH serve= r that is hosted by the same CDN=C2=A0that provides the desired web content= . This not only allows for faster resolution (based on being near the authoritative) and faster connections (based=C2=A0on tai= loring DNS answers for the client=E2=80=99s subnet) as you describe, but ha= s some privacy benefits in limiting the number of parties involved in=C2=A0= subsequent resolutions.

The specific mechanism does cause some concerns for me, however.

I know this is just a hint, but the weak relationship between this hint and= the DNS may cause issues. The DoH preference hint is one-way only, and=C2= =A0determined only by the entity that is generating HTTP headers for a give= n URL. This means that neither the operator of the DNS zone for the origin,=C2=A0nor the target DoH resolver, have any= way to influence or validate this hint. It is possible that these are all = the same entity (Google content in a=C2=A0google.com=C2=A0zone pointing to 8.8.8.8), but that=E2= =80=99s not guaranteed. Nothing stops any website from providing a hint to direct = clients to whichever DoH=C2=A0server it wants, for as long as it wants. I h= ave no problem with HTTPS content helping to confirm that the owner of the = cert for a name agrees to=C2=A0using a specific DoH server (see=C2=A0https://www.ietf.org/id/draft-pauly-add-resolver-discovery-01.html#name-c= onfirmation-of-designation), but the=C2=A0primary control over DNS routing should lie with the operator of the DNS zone in order to = get the optimizations described in the document.

It also seems like it would be more optimal for this indication of DoH serv= er to be expressed for a set of names (names within a zone, or all=C2=A0sub= domains, etc), rather than just a single host name. The text limits any hin= t to only apply to one name, which is good because the hint could=C2=A0otherwise cause problems for an entire zo= ne, but means that the benefit is limited. If every YouTube video has a uni= que hostname that is only=C2=A0resolved once, wouldn=E2=80=99t it be better= to learn that I should use 8.8.8.8 for all YouTube names?

What would the client behavior for this header be if there is a redirect? F= or any content that uses redirects, I assume these hints must be ignored?

=C2=A0

Best,

Tommy



On Jul 13, 2020, at 1:25 PM, Nick Sullivan <nick= =3D40cloudflare.com@dmarc.ietf.org> wrote:

=C2=A0

ADD Working Group,

=C2=A0

This is to inform you of a new submission of the=C2= =A0doh-preference-hints document. This document was originally=C2=A0intende= d for the HTTPbis working group, but we were directed to the ADD group as a= more appropriate venue to discuss it. Our intention is to put=C2=A0this document up for consideration to be adopted as a worki= ng group item.

=C2=A0

Nick, David, Jesse

=C2=A0

---------- Forwarded message ---------
From: <int= ernet-drafts@ietf.org>
Date: Mon, Jul 13, 2020 at 12:36 PM
Subject: New Version Notification for draft-schinazi-httpbis-doh-preference= -hints-02.txt
To: Jesse Kipp <jkipp@cloudflare.com>, Nick Sullivan <nick@cloudflare.com>, David Schinazi= <dschinaz= i.ietf@gmail.com>




A new version of I-D, draft-schinazi-httpbis-doh-preference-hints-02.txt has been successfully submitted by David Schinazi and posted to the
IETF repository.

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-schinazi-httpbis-doh-pr= eference-hints
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A002
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 DoH Preference Hints for HTTP
Document date:=C2=A0 2020-07-13
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 8
URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 https://www.ietf.org/internet-drafts/draft-schinazi-httpbis-doh-preference-= hints-02.txt
Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0h= ttps://datatracker.ietf.org/doc/draft-schinazi-httpbis-doh-preference-hints= /
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://t= ools.ietf.org/html/draft-schinazi-httpbis-doh-preference-hints-02
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0ht= tps://datatracker.ietf.org/doc/html/draft-schinazi-httpbis-doh-preference-h= ints
Diff:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://www.ietf.org/rfcdiff?url2=3Ddraft-schinazi-httpbis-doh-pre= ference-hints-02

Abstract:
=C2=A0 =C2=A0When using a publicly available DNS-over-HTTPS (DoH) server, s= ome
=C2=A0 =C2=A0clients may suffer poor performance when the authoritative DNS= server
=C2=A0 =C2=A0is located far from the DoH server.=C2=A0 For example, a publi= cly
=C2=A0 =C2=A0available DoH server provided by a Content Delivery Network (C= DN)
=C2=A0 =C2=A0should be able to resolve names hosted by that CDN with good =C2=A0 =C2=A0performance but might take longer to resolve names provided by= other
=C2=A0 =C2=A0CDNs, or might provide suboptimal results if that CDN is using= DNS-
=C2=A0 =C2=A0based load balancing and returns different address records dep= ending
=C2=A0 =C2=A0or where the DNS query originated from.=C2=A0 This document at= tempts to
=C2=A0 =C2=A0lessen these issues by allowing the web server to indicate to = the
=C2=A0 =C2=A0client which DoH server can best resolve its addresses.=C2=A0 = This
=C2=A0 =C2=A0document defines an HTTP header field that enables web host op= erators
=C2=A0 =C2=A0to inform user agents of the preferred DoH servers to use for<= br> =C2=A0 =C2=A0subsequent DNS lookups for the host's domain.

=C2=A0 =C2=A0Discussion of this work is encouraged to happen on the ADD IET= F
=C2=A0 =C2=A0mailing list add@ietf.org or on the GitHub repository which contains
=C2=A0 =C2=A0the draft: https://github.com/DavidSchinazi/draft-httpbis-doh-
=C2=A0 =C2=A0preference-hints.




Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

--
Add mailing list
Add@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/add

=C2=A0

--000000000000cc088f05ab70672f-- From nobody Mon Jul 27 11:39:07 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1EC363A1BB9 for ; Mon, 27 Jul 2020 11:39:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gMPVcWikGF3F for ; Mon, 27 Jul 2020 11:39:01 -0700 (PDT) Received: from mail-wm1-x32c.google.com (mail-wm1-x32c.google.com [IPv6:2a00:1450:4864:20::32c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 552333A101B for ; Mon, 27 Jul 2020 11:39:01 -0700 (PDT) Received: by mail-wm1-x32c.google.com with SMTP id p14so14692721wmg.1 for ; Mon, 27 Jul 2020 11:39:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=irn4W29syNzBuY6Ee0OZeG0UKPN7pQmNcIgwkKKeuqs=; b=YLCxVQKdMgbWJoHp72Q9zukRw7s5Lxx7crQljeoWYiQmVY/AZjGwb4eL6M2JuA0ssa HUUK7NtSgZV7v7DElYHwp0sFRpFYX+GeQ8ZG+nn3YW1ptHCp/raiLbRxwkz0axiDl8rM wzG5K//5zwXSXiopuHAX473FCkaN6IKTT16IR32OPEKwZ3oK8zNua/oQqFvdimptrtEP VKsgLbsLEATB9ydhZXuGB+6oAOGqXJV6yE5/JDJ00wTlp1/0/L0P6jUDgX3AnPoorp9i Y6OsGb4zu23Q6veBLJCOlj9BwlM9DqPTdz0m9RvKCu8j3PmGBpwqQ2d77n+SNQYJrLnq GanQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=irn4W29syNzBuY6Ee0OZeG0UKPN7pQmNcIgwkKKeuqs=; b=P7VaAm9v8XRtXsodB5QXNRnUrx2k2A1bnGahYyOix9/eexcfjf6n5RIaOK/YC9pM+f PbBx8TQGsConge7KCwO69TnZEImFogwRMEysGxQBh+mjSgSr58Vf+t4H70MEiZJenRtH iJcYvr0re1pYPgPm5ReaSSzpJxHtuB5npeoAVtfuiXiwXKeUAaeZ671qbdBQa903cLph l+Fv4fiJldM1WxaIx1jm0+YFBa4TkmExONbUg8FsAsjkPxBRRhaGwFHD7EeSsORl2Gpn WHm0tNwNPzbKmFDYQ12cdyygP8+xKbRC49Ey8nFDHDPv5Y1akjARFikIayHvjEYmAUP8 ozjA== X-Gm-Message-State: AOAM531pFZp+lan3X9hPdPF28ls0lplsMYHY1SpixO0s4bXKwXJcKxlW elkd5HMRcMqMB3UHegEB9LSCzxBSP/eIO9CoMLW/tg== X-Google-Smtp-Source: ABdhPJyXmVR1TjNG1tGssq63soABX2pcJgNJDN+BeNSH2yOypNBDFKhZenVLWAWK1Dw9D5gg1wh+DhzH5EP8N3gD/YE= X-Received: by 2002:a1c:49c6:: with SMTP id w189mr474622wma.97.1595875139454; Mon, 27 Jul 2020 11:38:59 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200720152739.GA17509@nic.fr> <20200723141314.GA32028@nic.fr> <20200727142353.GA4377@nic.fr> In-Reply-To: <20200727142353.GA4377@nic.fr> From: Ben Schwartz Date: Mon, 27 Jul 2020 14:38:47 -0400 Message-ID: To: Stephane Bortzmeyer Cc: Tommy Jensen , Tim Wicinski , David Schinazi , ADD Mailing list , Tommy Pauly Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000d2478a05ab70a212" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 18:39:03 -0000 --000000000000d2478a05ab70a212 Content-Type: multipart/alternative; boundary="000000000000cb6b7605ab70a2cc" --000000000000cb6b7605ab70a2cc Content-Type: text/plain; charset="UTF-8" On Mon, Jul 27, 2020 at 10:23 AM Stephane Bortzmeyer wrote: > On Thu, Jul 23, 2020 at 04:00:55PM +0000, > Tommy Jensen wrote > a message of 276 lines which said: > > > Do you have specific concerns with our approach? Is your question > > about the concept of Adaptive DNS as a whole (zones designating DNS > > servers for future queries), or > ... > For the related idea of a DNS zone directing to specific resolvers, > I'm confused: isn't it simply what DNS delegation is about? > To me, this is the most interesting question about this draft. The proposal is so close to DPRIVE's ADoT charter that it feels like there ought to be a unified solution. Earlier, Tony Finch wrote: A stub resolver isn't able to chase CNAMEs or delegations, so if the > destination site has a setup that is even slightly non-trivial, stub > resolvers will need to use a recursive server to walk the namespace for > them. This makes me wonder, could we solve this with a flag on delegations that means "I promise I can answer any question below this point, no need for recursion", or perhaps "there are no zone cuts below this point"? --000000000000cb6b7605ab70a2cc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Jul 27, 2020 at 10:23 AM Step= hane Bortzmeyer <bortzmeyer@nic.fr<= /a>> wrote:
O= n Thu, Jul 23, 2020 at 04:00:55PM +0000,
=C2=A0Tommy Jensen <Jensen.Thomas@microsoft.com> wrote
=C2=A0a message of 276 lines which said:

> Do you have specific concerns with our approach? Is your question
> about the concept of Adaptive DNS as a whole (zones designating DNS > servers for future queries), or
...=C2=A0
For the related idea of a DNS zone directing to specific resolvers,
I'm confused: isn't it simply what DNS delegation is about?

To me, this is the most interesting question a= bout this draft.=C2=A0 The proposal is so close to DPRIVE's=C2=A0ADoT c= harter that it feels like there ought to be a unified solution.
<= br>
Earlier, Tony Finch wrote:

A stub resolver isn't able to chase= CNAMEs or delegations, so if the
destination site has a setup that is e= ven slightly non-trivial, stub
resolvers will need to use a recursive se= rver to walk the namespace for
them.

Thi= s makes me wonder, could we solve this with a flag on delegations that mean= s "I promise I can answer any question below this point, no need for r= ecursion", or perhaps "there are no zone cuts below this point&qu= ot;?
--000000000000cb6b7605ab70a2cc-- --000000000000d2478a05ab70a212 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIPBgYJKoZIhvcNAQcCoIIO9zCCDvMCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ggxpMIIEkjCCA3qgAwIBAgINAewckktV4F6Q7sAtGDANBgkqhkiG9w0BAQsFADBMMSAwHgYDVQQL ExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMK R2xvYmFsU2lnbjAeFw0xODA2MjAwMDAwMDBaFw0yODA2MjAwMDAwMDBaMEsxCzAJBgNVBAYTAkJF MRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSEwHwYDVQQDExhHbG9iYWxTaWduIFNNSU1FIENB IDIwMTgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUeobu8FdB5oJg6Fz6SFf8YsPI dNcq4rBSiSDAwqMNYbeTpRrINMBdWuPqVWaBX7WHYMsKQwCOvAF1b7rkD+ROo+CCTJo76EAY25Pp jt7TYP/PxoLesLQ+Ld088+BeyZg9pQaf0VK4tn23fOCWbFWoM8hdnF86Mqn6xB6nLsxJcz4CUGJG qAhC3iedFiCfZfsIp2RNyiUhzPAqalkrtD0bZQvCgi5aSNJseNyCysS1yA58OuxEyn2e9itZJE+O sUeD8VFgz+nAYI5r/dmFEXu5d9npLvTTrSJjrEmw2/ynKn6r6ONueZnCfo6uLmP1SSglhI/SN7dy L1rKUCU7R1MjAgMBAAGjggFyMIIBbjAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUH AwIGCCsGAQUFBwMEBggrBgEFBQcDCTASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRMtwWJ 1lPNI0Ci6A94GuRtXEzs0jAfBgNVHSMEGDAWgBSP8Et/qC5FJK5NUPpjmove4t0bvDA+BggrBgEF BQcBAQQyMDAwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjMw NgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9yb290LXIzLmNybDBn BgNVHSAEYDBeMAsGCSsGAQQBoDIBKDAMBgorBgEEAaAyASgKMEEGCSsGAQQBoDIBXzA0MDIGCCsG AQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG9w0B AQsFAAOCAQEAwREs1zjtnFIIWorsx5XejqZtqaq5pomEvpjM98ebexngUmd7hju2FpYvDvzcnoGu tjm0N3Sqj5vvwEgvDGB5CxDOBkDlmUT+ObRpKbP7eTafq0+BAhEd3z2tHFm3sKE15o9+KjY6O5bb M30BLgvKlLbLrDDyh8xigCPZDwVI7JVuWMeemVmNca/fidKqOVg7a16ptQUyT5hszqpj18MwD9U0 KHRcR1CfVa+3yjK0ELDS+UvTufoB9wp2BoozsqD0yc2VOcZ7SzcwOzomSFfqv7Vdj88EznDbdy4s fq6QvuNiUs8yW0Vb0foCVRNnSlb9T8//uJqQLHxrxy2j03cvtTCCA18wggJHoAMCAQICCwQAAAAA ASFYUwiiMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIz MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTA5MDMxODEwMDAw MFoXDTI5MDMxODEwMDAwMFowTDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzAR BgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDMJXaQeQZ4Ihb1wIO2hMoonv0FdhHFrYhy/EYCQ8eyip0EXyTLLkvhYIJG 4VKrDIFHcGzdZNHr9SyjD4I9DCuul9e2FIYQebs7E4B3jAjhSdJqYi8fXvqWaN+JJ5U4nwbXPsnL JlkNc96wyOkmDoMVxu9bi9IEYMpJpij2aTv2y8gokeWdimFXN6x0FNx04Druci8unPvQu7/1PQDh BjPogiuuU6Y6FnOM3UEOIDrAtKeh6bJPkC4yYOlXy7kEkmho5TgmYHWyn3f/kRTvriBJ/K1AFUjR AjFhGV64l++td7dkmnq/X8ET75ti+w1s4FRpFqkD2m7pg5NxdsZphYIXAgMBAAGjQjBAMA4GA1Ud DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSP8Et/qC5FJK5NUPpjmove4t0b vDANBgkqhkiG9w0BAQsFAAOCAQEAS0DbwFCq/sgM7/eWVEVJu5YACUGssxOGhigHM8pr5nS5ugAt rqQK0/Xx8Q+Kv3NnSoPHRHt44K9ubG8DKY4zOUXDjuS5V2yq/BKW7FPGLeQkbLmUY/vcU2hnVj6D uM81IcPJaP7O2sJTqsyQiunwXUaMld16WCgaLx3ezQA3QY/tRG3XUyiXfvNnBB4V14qWtNPeTCek TBtzc3b0F5nCH3oO4y0IrQocLP88q1UOD5F+NuvDV0m+4S4tfGCLw0FREyOdzvcya5QBqJnnLDMf Ojsl0oZAzjsshnjJYS8Uuu7bVW/fhO4FCU29KNhyztNiUGUe65KXgzHZs7XKR1g/XzCCBGwwggNU oAMCAQICEAH8qNflD4Mi9yKttXfRdHcwDQYJKoZIhvcNAQELBQAwSzELMAkGA1UEBhMCQkUxGTAX BgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExITAfBgNVBAMTGEdsb2JhbFNpZ24gU01JTUUgQ0EgMjAx ODAeFw0yMDA2MDUwODIyMjhaFw0yMDEyMDIwODIyMjhaMCIxIDAeBgkqhkiG9w0BCQEWEWJlbWFz Y0Bnb29nbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2kbyV9S0YLplF3kV 6t3GgD7IyHe8L29pJ7l+UR0Sj31uPgXOFdSSdTVwhPfQvxmB2OUDXWDgDtZdL2xu4DgHhrDyyOXT 8uDJqUCPw004ZSuUfUor1vz5u6+oYNfx2OTPTb81vtsQO2/khni3iAeQlKgO/rUI1c9+zvT6k3mR SZUypAlk/rCyG6NV7NMJMmOaU20/kPBXG297iP8+/F9w4xs+lyb3IkcSfoSUr3fVz7mYqESFato5 JnjRQGT2/f/ehxkc09jATqVGj9nyQMoD2GNPjiNnYyTVBwK5Ol/s9+E2VSL4TSLrgS2R07kY9zPi VOM3lhDDRnceboNSaqnfMwIDAQABo4IBczCCAW8wHAYDVR0RBBUwE4ERYmVtYXNjQGdvb2dsZS5j b20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNVHQ4E FgQUwJS1fB3cBxoLgZFatdIO9Vp5wOcwTAYDVR0gBEUwQzBBBgkrBgEEAaAyASgwNDAyBggrBgEF BQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wUQYIKwYBBQUHAQEE RTBDMEEGCCsGAQUFBzAChjVodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc3Nt aW1lY2EyMDE4LmNydDAfBgNVHSMEGDAWgBRMtwWJ1lPNI0Ci6A94GuRtXEzs0jA/BgNVHR8EODA2 MDSgMqAwhi5odHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2NhL2dzc21pbWVjYTIwMTguY3JsMA0G CSqGSIb3DQEBCwUAA4IBAQCC91PBn9rMxo8kSo1zNY2mxkTQDTVc0oyYk8s3y72y21IEp/d/+h1H VTCD2FR30aFUv8hTJkebJ5Z1/zue2L7sx/lLEOIHm9uYxyTkTWbKup3+XrE1vhODTHVx+ktMuOTY z447/fwjy4praSaFrQsOjTPbAoU6xuC8S2j2K2Yg6XQsctcKHKeAJjN6evZYChDaTBLmtYq9LTSH KVv3Et795vNK3gWKjhEkJtaBu4FfKLoopb1PENJ/zK6p/3edCLFgCRMSlbQ0SGtdVESSJcgezSwW WK2VB1Zcj2kyVzcL1pmV8m1xQuz2aBgUMn7peoVxKxYKP12gMtzeMvkzltYBMYICYTCCAl0CAQEw XzBLMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEhMB8GA1UEAxMYR2xv YmFsU2lnbiBTTUlNRSBDQSAyMDE4AhAB/KjX5Q+DIvcirbV30XR3MA0GCWCGSAFlAwQCAQUAoIHU MC8GCSqGSIb3DQEJBDEiBCC6njbodSV1xgrJg72S+FgoAjJt7d5e3qUwf+yJRJNhADAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA3MjcxODM4NTlaMGkGCSqGSIb3 DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglghkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAE ggEAuyJ4F7q32DycpC2jAJn9rY4ZGSYKK1EzyX07DA6HbUCz/bDIZnRPrm4mbeRWfTtmumg3iXAr 9s4WnHlxmo62hOheSYxaHclykSCeqPqrngnOkJ0Qwdy1M4BMSVy7LdANr+igWzOsjTvMN7iyVMYK NQwLCLGFzvp0ZRHT6xgHDX3aToOcKWantMHvOdlrRN9xGUOsPqCj4NFyKYdu/oHWAv54cYugLBoF RkWkK9csXppuDA2Yh5Oxgdl0gYj2X7fpMYKYFgxOGPLeoxRJYpgb25CTrrLUfafyPz+orRZTS1Wt NrLLz6lJmA90A7KgAxk70zpanMBgfdVKV50En4tlUQ== --000000000000d2478a05ab70a212-- From nobody Mon Jul 27 11:45:08 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C60F3A1D57 for ; Mon, 27 Jul 2020 11:45:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tt7AHmnX57gD for ; Mon, 27 Jul 2020 11:44:58 -0700 (PDT) Received: from mail-vs1-xe32.google.com (mail-vs1-xe32.google.com [IPv6:2607:f8b0:4864:20::e32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE5723A1CF8 for ; Mon, 27 Jul 2020 11:44:44 -0700 (PDT) Received: by mail-vs1-xe32.google.com with SMTP id p25so8857223vsg.4 for ; Mon, 27 Jul 2020 11:44:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=S7geGc3MO79yRxmySJoQ73rihcuMx5t6K1mg0Q9OFUs=; b=d2HnZNZFhdxlqlrwHGPoh+nliU6AVIWlcTpAh6MKxlHVBo4HqaJjBvHqdmNXBoxxAh 2uxlTuyMWF+Q75f2mTXzGWNGJxi+0zdXhJ1Tnw/iepvjP2yaQoacRKkCJyCFD7EdFBB/ Fdt49Si9OJVgSMIdVOvLcsA30V/2T3TeSlFCuZwPGPKFjJ0ag4kRFuX/6qGkrxo/Bk/k JNYzMvtSNcbslFsiDCBtnAZVEDsYgimftcWgDvpwEnhgCKF8I1J8FtdpaBp21+5g4aGm f0T5Wc54mDQ2UO/pEvVSUag18WtEQJFc0hKaQgIly6DVb51FXBO/6Ut05+gQN0GNMK9q q+EQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=S7geGc3MO79yRxmySJoQ73rihcuMx5t6K1mg0Q9OFUs=; b=p24zakvxptEouna4Lq3SPbUwdcG9bbh5fKSBFiUjePrn4Rp8hkdZmh6mJgERDAXgLh zSSpf37XU5iU+xYdce/P0Z+jT379bUFnryqqcZDfX83o2jbET6CZxkDjur9Uu80IvySY p2Q2Y50geew4styrVappT4HgrZDhqm3vIQWNxymlJ/ctqV+NNEZ9Vet0oqkT9C//xpho V3s8+IXRE3YCzFD9XtffrtgSH5w/uyVaUAez1U872k7iyezBnXW+hEge6IlqGmz3O9EY Su6kI+1qs37KgI7ruwyrh3az26VSO/vs+DLa30h3YLJlWR/zHTRYaQuMr4sZM4X1FoWX iD1Q== X-Gm-Message-State: AOAM530XQvsU6Vt6gbeGsXWoyY88AmrmqvCnx8n9xpX1EHK48+r9jRoa jQSxsSTWKXmC8QcYMYsLeQO44ByUQoy+0ZUL3li83Nu5 X-Google-Smtp-Source: ABdhPJzmbved34o9HVlfry+Ls84BcpwSV1GLBzke9JpF4LXqPoAexze4XKQvrZNbNxbwznLKOhU59X3NDYH7mDwEUrc= X-Received: by 2002:a67:f696:: with SMTP id n22mr18460510vso.169.1595875483917; Mon, 27 Jul 2020 11:44:43 -0700 (PDT) MIME-Version: 1.0 References: <159078807168.11416.12425165143603046178@ietfa.amsl.com> <20200727145502.GA7147@nic.fr> In-Reply-To: <20200727145502.GA7147@nic.fr> From: Daniel Migault Date: Mon, 27 Jul 2020 14:44:32 -0400 Message-ID: To: Stephane Bortzmeyer Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000531fe605ab70b718" Archived-At: Subject: Re: [Add] New Version Notification for draft-mglt-add-rdp-02.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 18:45:07 -0000 --000000000000531fe605ab70b718 Content-Type: text/plain; charset="UTF-8" Hi, Thanks for the comment. Please see inline my responses. I am working on updating the draft. Yours, Daniel On Mon, Jul 27, 2020 at 10:55 AM Stephane Bortzmeyer wrote: > On Fri, May 29, 2020 at 08:21:59PM -0400, > Daniel Migault wrote > a message of 218 lines which said: > > > Please find an update version of the DNS Resolver Discovery Protocol > (DRDP) > > To tell the truth, I do not completely understand the protocol, or the > problem it tries to solve. But I work on that. I will work on clarifying the text. > A high-level > description would help. Section 2 is quite confusing. It says "The > DNS client may obtain the contextual resolving domains via various > way, including a configuration or via DHCP Options [I-D.btw-add-home]" > and later "This document describes two mechanisms for a DNS client to > retrieve resolving domains", these mechanisms being different from the > ones mentioned in the first sentence. > > My intention here was to say that DRDP takes some parameters and can be started. More specifically, the DNS client can start DRDP several time with different parameters. Currently the parameters mentioned in the document are a resolving domain (rd) or a pointer to a a list of resolving domains (rd_list). Both resolving domain and resolving_domain list are FQDN. The discovery can be perform as follows: drpd -rd example.com drpd -rd example.net drpd -rd_list list.example.org .... In each case a set of resolvers with associated characteristics are returned. The current draft leaves open how one DRDP client gets the necessary parameters to start the discovery. The parameters can be configured in the application, other alternatives can include some specific provisioning methods such as a specific DHCP option. The draft describes a mechanism to derive these parameters from the Recursive Name Server option. I tend to agree that this would be clarifying to have one document that differentiate DRDP and the way the DRDP client can be configured. I think the confusion of the text is that the text currently considered resolving domains as an input to drdp. Leaving it open on how the DRDP client how the resolving domains are retrieved, it described two mechanisms to retrieve these resolving domains: 1) through the list of resolving domains and 2) through the Recursive Name Server option. I tend to think it would be clearer to consider that DRDP may have different inputs and describe ways to retrieve these inputs. Will update the document. > First question, about the concept of "resolving domain". 5.1 says > "FQDN - such as resolver.example.com - and the domain part ( > example.com ) is designated as the resolving domain". The term "the > domain part" is unclear. Does it mean "the FQDN without the > most-specific label"? If the resolving service is > foo.bar.example.eu.org, is the resolving domain bar.example.eu.org? > (5.3 seems to imply this.) > > I would say this is what the text suggests but that needs to be refined a bit. The motivation for defining the resolving domains as opposed to the resolving service FQDN was to introduce a sort of abstraction which was expected to be useful when something is notified to the end user or if a selection is needed. The selection was expected to represent the trust an user has with one of the operator of the resolving service. In that sense the hostname of the server is not necessarily relevant in the sense that the most important information is orange, verizon, videotron, google, cloudflare..... We also noticed that in a lot of cases the resolver fqdn is hostname.intelligible_domain and we chose to designate intelligible_domain as the resolving domain. Now the mapping between the resolving service and the resolving domain does not work all the time. DRDP makes the correspondence between the resolving domain and the resolving service. The correspondence between the resolving service and the resolving domain is only a guess and in the example foo.bar.example.eu.org, a few candidates could be derived. bar.example.eu.org, example.eu.org. As you seem to point out, determining a resolving domain from the resolving service name is mostly necessary to derive the resolving domain from the IP address received by the DHCP server which may not be part of DRPD itself. > Second, I do not get the relationship between "resolving domain" and > "resolving domain list". What is called "resolving domain" in 5.1 > seems to be a "resolving domain list" in 5.2. > > > The resolving domain (example.com) is what you use to discover the resolvers, typically, _dns.example.com. SVCB ? a resolving domain list (rd_list.example.net) contains a list of resolving domains. You get the different resolving domains _b.rd_list.example.net PTR This is correct that in section 5.1 and 5.2 I am using example.com in both cases which is misleading. I will address this in the next version. -- Daniel Migault Ericsson --000000000000531fe605ab70b718 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,=C2=A0

Thanks for t= he comment. Please see inline my responses. I am working on updating=C2=A0t= he draft.=C2=A0

Yours,=C2=A0
Daniel
=
On Mon= , Jul 27, 2020 at 10:55 AM Stephane Bortzmeyer <bortzmeyer@nic.fr> wrote:
On Fri, May 29, 2020 at 08:21:59PM -0400,
=C2=A0Daniel Migault <mglt.ietf@gmail.com> wrote
=C2=A0a message of 218 lines which said:

> Please find an update version of the DNS Resolver Discovery Protocol (= DRDP)

To tell the truth, I do not completely understand the protocol, or the
problem it tries to solve. But I work on that.
<mglt&g= t;
I will work on clarifying the text.
</mglt>=C2= =A0
=C2=A0
A high-level
description would help. Section 2 is quite confusing. It says "The
DNS client may obtain the contextual resolving domains via various
way, including a configuration or via DHCP Options [I-D.btw-add-home]"=
and later "This document describes two mechanisms for a DNS client to<= br> retrieve resolving domains", these mechanisms being different from the=
ones mentioned in the first sentence.

<mglt>
My intention here was to say t= hat DRDP takes some parameters and can be started. More specifically, the D= NS client can start DRDP several=C2=A0time with different parameters. Curre= ntly=C2=A0the parameters mentioned in the document are a resolving domain (= rd) or a pointer to a a list of resolving domains (rd_list). Both resolving= domain and resolving_domain list are FQDN. The discovery can be perform as= follows:

drpd -rd = example.com=C2=A0
drpd -rd exa= mple.net
drpd -rd_list li= st.example.org
....

In each case a s= et of resolvers with associated characteristics are returned.=C2=A0

The current draft leaves open how one DRDP client gets th= e necessary parameters to start the discovery. The parameters can be config= ured in the application, other alternatives can include some specific provi= sioning methods such as a specific DHCP option. The draft describes a mecha= nism to derive these parameters from the Recursive Name Server option. I te= nd to agree=C2=A0that this would be clarifying to have one document that di= fferentiate DRDP and the way the DRDP client can be configured.=C2=A0
=

I think the confusion of the text is that the text curr= ently=C2=A0considered resolving domains as an input to drdp. Leaving it ope= n on how the DRDP client how the resolving domains are retrieved, it descri= bed two mechanisms to retrieve these resolving domains: 1) through the list= of resolving domains and 2) through the=C2=A0Recursive Name Server option.= I tend to think it would be clearer to consider that DRDP may have differe= nt inputs and describe ways to retrieve these inputs.=C2=A0=C2=A0
=C2=A0
Will update the=C2=A0document.

&= lt;/mglt>
=C2=A0
First question, about the concept of "resolving domain". 5.1 says=
"FQDN - such as resolver.example.com - and the domain part (
example= .com ) is designated as the resolving domain". The term "the<= br> domain part" is unclear. Does it mean "the FQDN without the
most-specific label"? If the resolving service is
foo.bar.example.eu.org, is the resolving domain bar.example.eu.org<= /a>?
(5.3 seems to imply this.)


=
The motivation for defining the resolving domains as opposed to the re= solving service FQDN was to introduce a sort of abstraction which was expec= ted to be useful when something is notified to the end user or if a selecti= on is needed. The selection was expected to represent the trust an user has= with one of the operator=C2=A0 of the resolving service. In that sense the= hostname of the server is not necessarily relevant in the sense that the m= ost important information is orange, verizon, videotron, google, cloudflare= ..... We also noticed that in a lot of cases the resolver fqdn is hostname.= intelligible_domain and we chose to designate intelligible_domain as the re= solving domain.=C2=A0


As you seem to point out, determining a resolving domain fr= om the resolving service name is mostly necessary to derive the resolving d= omain from the IP address received by the DHCP server which may not be part= of DRPD itself.=C2=A0 =C2=A0 =C2=A0=C2=A0

=C2=A0= =C2=A0=C2=A0

</mglt>=C2=A0
Second, I do not get the relationship between "resolving domain" = and
"resolving domain list". What is called "resolving domain&qu= ot; in 5.1
seems to be a "resolving domain list" in 5.2.


<mglt>
The resolving domain (example.com) is what you use to discover=C2=A0= the resolvers, typically,=C2=A0
a resolving domain list (rd_list.example.net) contains a list of resolving domains. Y= ou get the different resolving domains=C2=A0
This is correct that in se= ction 5.1 and 5.2 I am using example.com= in both cases which=C2=A0is misleading.

I will address this in= the next version.=C2=A0=C2=A0
<= div></mglt>

--
Daniel Migault
Ericsson
--000000000000531fe605ab70b718-- From nobody Mon Jul 27 12:01:06 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 999783A0B57 for ; Mon, 27 Jul 2020 12:00:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.6 X-Spam-Level: X-Spam-Status: No, score=-17.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5gdsP8kug3A9 for ; Mon, 27 Jul 2020 12:00:57 -0700 (PDT) Received: from mail-wr1-x42c.google.com (mail-wr1-x42c.google.com [IPv6:2a00:1450:4864:20::42c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3521C3A0ADF for ; Mon, 27 Jul 2020 12:00:40 -0700 (PDT) Received: by mail-wr1-x42c.google.com with SMTP id f1so15393786wro.2 for ; Mon, 27 Jul 2020 12:00:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=h/JAgwxt+bwNLN+GSGX60AkkrFKujIM7IlBPHzWvjb0=; b=MHaMcKpZUnLUueTUEXmkqGostXvQh3UzvKsXEYrVnxuYyazI30e/exSR/BX3Ok9yqc JZPqk4JfJShX+PaX6pQFe+cUXR+0I7l15BlZjzcYyr/XNIZA3UGjADGyYvBmxbasFZrp la+hCNjmYQvIBoLEj4fBimBMPBXkaOkizVpkPTge9F0XTlXhjPRk6RYwL2YK0u/muyuK G/DpSvAvA62979GaaNAIHMvKPJHLhWXs4UG7Er+yw3QSx7pAyWQzDYgI73LTqoRpx3uM yvnRQGwS+LOxqmFq5MLiHjNHEYWxUceZWzP6ughtCoJYRt2vKu588jxb+lCLmiM4otV7 zYzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=h/JAgwxt+bwNLN+GSGX60AkkrFKujIM7IlBPHzWvjb0=; b=iiHgcS+pl7aHwUgKaz4irBhaxqz4EyfSNy2N/1zQ87zTAD7TXKeNxVeYIbEGF2yAhK TDZxwyHGKawrm3Xt8jUybyFT03TfC2G2sA/D7Gy1riVpQ+MNcs3IT6raWpyz+yKZzV89 piehkJKoAOikgTCgiBSt0E6E7uAC7IZQfvpjFJvVLQ6gud21HMgGCafUtLVgF2+75ZFP Y75DeScOhmJezAoBk25Nf8n5eh1Ri6lr1aZX38UhyDTI6xzne7wJqDk4bTJUHvrmHj+z kLaneLrqreqtKj99Rfl76STgTXzgf7tq2ARObvnlWVq/4fWvZs/ZFcz+ifMqviaD5kLR 2cbA== X-Gm-Message-State: AOAM530B12hJKuGHz3nfhizNT1Yv+diAqQOM5cmhAU9aFIp8GFNSrGYC QSwsYFMoOzXPgDXisvkW34t6c9eCvfYJmCsEVHxpzQ== X-Google-Smtp-Source: ABdhPJyVAsnCp6vwoPi02vytUYQNLZ981vlLzr5dCYi6GQqpBR5l4sPIhyZq+WLIgVJjDDkFJ83sFAhiemCEd/82d2c= X-Received: by 2002:a5d:5588:: with SMTP id i8mr21542390wrv.177.1595876438457; Mon, 27 Jul 2020 12:00:38 -0700 (PDT) MIME-Version: 1.0 References: <159078807168.11416.12425165143603046178@ietfa.amsl.com> <20200727145502.GA7147@nic.fr> In-Reply-To: From: Ben Schwartz Date: Mon, 27 Jul 2020 15:00:26 -0400 Message-ID: To: Daniel Migault Cc: Stephane Bortzmeyer , ADD Mailing list Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000003d5cb605ab70f0d6" Archived-At: Subject: Re: [Add] New Version Notification for draft-mglt-add-rdp-02.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 19:01:04 -0000 --0000000000003d5cb605ab70f0d6 Content-Type: multipart/alternative; boundary="00000000000038909405ab70f0f4" --00000000000038909405ab70f0f4 Content-Type: text/plain; charset="UTF-8" On Mon, Jul 27, 2020 at 2:45 PM Daniel Migault wrote: > > a resolving domain list (rd_list.example.net) contains a list of > resolving domains. You get the different resolving domains > _b.rd_list.example.net PTR > This is the part of the draft that seems strangest to me (apart from the odd use of PTR). It violates the usual expectation about data in the DNS: records published by a domain provide information about that domain. These lists instead appear to provide information about the wider world. The "owner name" just indicates whose opinion this is. If you want to present this type of information, I would encourage you to define a MIME type and distribute it using a general information transfer system like HTTP, FTP, or e-mail. The concerns about size (since these lists could be arbitrarily large) are a hint that you're trying to store the wrong sort of data in the DNS. Alternatively, if these lists are really meant to be "resolvers to use on this network" or something like that, the text could be clearer about that, with an explanation of how the user would learn the owner name. --00000000000038909405ab70f0f4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, Jul 27, 2020 at 2:45 PM Daniel Mi= gault <mglt.ietf@gmail.com>= ; wrote:

a resolving domain list (rd_list.example.net) contains a list of resolv= ing domains. You get the different resolving domains=C2=A0
_b.rd_list.example.net PTR
<= br>
This is the part of the draft that seems strangest to me (apa= rt from the odd use of PTR).=C2=A0 It violates the usual expectation about = data in the DNS: records published by a domain provide information about th= at domain.=C2=A0 These lists instead appear to provide information about th= e wider world.=C2=A0 The "owner name" just indicates whose opinio= n this is.

If you want to present this type of inf= ormation, I would encourage you to define a MIME type and distribute it usi= ng a general information transfer system like HTTP, FTP, or e-mail.=C2=A0 T= he concerns about size (since these lists could be arbitrarily large) are a= hint that you're trying to store the wrong sort of data in the DNS.

Alternatively, if these lists are really meant to be= "resolvers to use on this network" or something like that, the t= ext could be clearer about that, with an explanation of how the user would = learn the owner name.
--00000000000038909405ab70f0f4-- --0000000000003d5cb605ab70f0d6 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIPBgYJKoZIhvcNAQcCoIIO9zCCDvMCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ggxpMIIEkjCCA3qgAwIBAgINAewckktV4F6Q7sAtGDANBgkqhkiG9w0BAQsFADBMMSAwHgYDVQQL ExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMK R2xvYmFsU2lnbjAeFw0xODA2MjAwMDAwMDBaFw0yODA2MjAwMDAwMDBaMEsxCzAJBgNVBAYTAkJF MRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSEwHwYDVQQDExhHbG9iYWxTaWduIFNNSU1FIENB IDIwMTgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUeobu8FdB5oJg6Fz6SFf8YsPI dNcq4rBSiSDAwqMNYbeTpRrINMBdWuPqVWaBX7WHYMsKQwCOvAF1b7rkD+ROo+CCTJo76EAY25Pp jt7TYP/PxoLesLQ+Ld088+BeyZg9pQaf0VK4tn23fOCWbFWoM8hdnF86Mqn6xB6nLsxJcz4CUGJG qAhC3iedFiCfZfsIp2RNyiUhzPAqalkrtD0bZQvCgi5aSNJseNyCysS1yA58OuxEyn2e9itZJE+O sUeD8VFgz+nAYI5r/dmFEXu5d9npLvTTrSJjrEmw2/ynKn6r6ONueZnCfo6uLmP1SSglhI/SN7dy L1rKUCU7R1MjAgMBAAGjggFyMIIBbjAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUH AwIGCCsGAQUFBwMEBggrBgEFBQcDCTASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRMtwWJ 1lPNI0Ci6A94GuRtXEzs0jAfBgNVHSMEGDAWgBSP8Et/qC5FJK5NUPpjmove4t0bvDA+BggrBgEF BQcBAQQyMDAwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjMw NgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9yb290LXIzLmNybDBn BgNVHSAEYDBeMAsGCSsGAQQBoDIBKDAMBgorBgEEAaAyASgKMEEGCSsGAQQBoDIBXzA0MDIGCCsG AQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG9w0B AQsFAAOCAQEAwREs1zjtnFIIWorsx5XejqZtqaq5pomEvpjM98ebexngUmd7hju2FpYvDvzcnoGu tjm0N3Sqj5vvwEgvDGB5CxDOBkDlmUT+ObRpKbP7eTafq0+BAhEd3z2tHFm3sKE15o9+KjY6O5bb M30BLgvKlLbLrDDyh8xigCPZDwVI7JVuWMeemVmNca/fidKqOVg7a16ptQUyT5hszqpj18MwD9U0 KHRcR1CfVa+3yjK0ELDS+UvTufoB9wp2BoozsqD0yc2VOcZ7SzcwOzomSFfqv7Vdj88EznDbdy4s fq6QvuNiUs8yW0Vb0foCVRNnSlb9T8//uJqQLHxrxy2j03cvtTCCA18wggJHoAMCAQICCwQAAAAA ASFYUwiiMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIz MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTA5MDMxODEwMDAw MFoXDTI5MDMxODEwMDAwMFowTDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzAR BgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDMJXaQeQZ4Ihb1wIO2hMoonv0FdhHFrYhy/EYCQ8eyip0EXyTLLkvhYIJG 4VKrDIFHcGzdZNHr9SyjD4I9DCuul9e2FIYQebs7E4B3jAjhSdJqYi8fXvqWaN+JJ5U4nwbXPsnL JlkNc96wyOkmDoMVxu9bi9IEYMpJpij2aTv2y8gokeWdimFXN6x0FNx04Druci8unPvQu7/1PQDh BjPogiuuU6Y6FnOM3UEOIDrAtKeh6bJPkC4yYOlXy7kEkmho5TgmYHWyn3f/kRTvriBJ/K1AFUjR AjFhGV64l++td7dkmnq/X8ET75ti+w1s4FRpFqkD2m7pg5NxdsZphYIXAgMBAAGjQjBAMA4GA1Ud DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSP8Et/qC5FJK5NUPpjmove4t0b vDANBgkqhkiG9w0BAQsFAAOCAQEAS0DbwFCq/sgM7/eWVEVJu5YACUGssxOGhigHM8pr5nS5ugAt rqQK0/Xx8Q+Kv3NnSoPHRHt44K9ubG8DKY4zOUXDjuS5V2yq/BKW7FPGLeQkbLmUY/vcU2hnVj6D uM81IcPJaP7O2sJTqsyQiunwXUaMld16WCgaLx3ezQA3QY/tRG3XUyiXfvNnBB4V14qWtNPeTCek TBtzc3b0F5nCH3oO4y0IrQocLP88q1UOD5F+NuvDV0m+4S4tfGCLw0FREyOdzvcya5QBqJnnLDMf Ojsl0oZAzjsshnjJYS8Uuu7bVW/fhO4FCU29KNhyztNiUGUe65KXgzHZs7XKR1g/XzCCBGwwggNU oAMCAQICEAH8qNflD4Mi9yKttXfRdHcwDQYJKoZIhvcNAQELBQAwSzELMAkGA1UEBhMCQkUxGTAX BgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExITAfBgNVBAMTGEdsb2JhbFNpZ24gU01JTUUgQ0EgMjAx ODAeFw0yMDA2MDUwODIyMjhaFw0yMDEyMDIwODIyMjhaMCIxIDAeBgkqhkiG9w0BCQEWEWJlbWFz Y0Bnb29nbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2kbyV9S0YLplF3kV 6t3GgD7IyHe8L29pJ7l+UR0Sj31uPgXOFdSSdTVwhPfQvxmB2OUDXWDgDtZdL2xu4DgHhrDyyOXT 8uDJqUCPw004ZSuUfUor1vz5u6+oYNfx2OTPTb81vtsQO2/khni3iAeQlKgO/rUI1c9+zvT6k3mR SZUypAlk/rCyG6NV7NMJMmOaU20/kPBXG297iP8+/F9w4xs+lyb3IkcSfoSUr3fVz7mYqESFato5 JnjRQGT2/f/ehxkc09jATqVGj9nyQMoD2GNPjiNnYyTVBwK5Ol/s9+E2VSL4TSLrgS2R07kY9zPi VOM3lhDDRnceboNSaqnfMwIDAQABo4IBczCCAW8wHAYDVR0RBBUwE4ERYmVtYXNjQGdvb2dsZS5j b20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNVHQ4E FgQUwJS1fB3cBxoLgZFatdIO9Vp5wOcwTAYDVR0gBEUwQzBBBgkrBgEEAaAyASgwNDAyBggrBgEF BQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wUQYIKwYBBQUHAQEE RTBDMEEGCCsGAQUFBzAChjVodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc3Nt aW1lY2EyMDE4LmNydDAfBgNVHSMEGDAWgBRMtwWJ1lPNI0Ci6A94GuRtXEzs0jA/BgNVHR8EODA2 MDSgMqAwhi5odHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2NhL2dzc21pbWVjYTIwMTguY3JsMA0G CSqGSIb3DQEBCwUAA4IBAQCC91PBn9rMxo8kSo1zNY2mxkTQDTVc0oyYk8s3y72y21IEp/d/+h1H VTCD2FR30aFUv8hTJkebJ5Z1/zue2L7sx/lLEOIHm9uYxyTkTWbKup3+XrE1vhODTHVx+ktMuOTY z447/fwjy4praSaFrQsOjTPbAoU6xuC8S2j2K2Yg6XQsctcKHKeAJjN6evZYChDaTBLmtYq9LTSH KVv3Et795vNK3gWKjhEkJtaBu4FfKLoopb1PENJ/zK6p/3edCLFgCRMSlbQ0SGtdVESSJcgezSwW WK2VB1Zcj2kyVzcL1pmV8m1xQuz2aBgUMn7peoVxKxYKP12gMtzeMvkzltYBMYICYTCCAl0CAQEw XzBLMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEhMB8GA1UEAxMYR2xv YmFsU2lnbiBTTUlNRSBDQSAyMDE4AhAB/KjX5Q+DIvcirbV30XR3MA0GCWCGSAFlAwQCAQUAoIHU MC8GCSqGSIb3DQEJBDEiBCCwuesdEw9iSb0BUBqcTAmGIowILpa0ardYKU0r3U1TADAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA3MjcxOTAwMzhaMGkGCSqGSIb3 DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglghkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAE ggEAOkBWMDj9iSVq6ppXB0K7tk7t93LUzB8idVjccY8nKeChqqXfSOerrQhnf+it5kAzqDd7JFCu 6Nzt/EJ+gmvfKZ5kzrcIvwk3G0Lw8Luo6mkB7DMVR9Mv0hCivstPeRuqTJJKgXp3F+r7HKmCQNdl 0smgt63TnfPdTkpgcBpA0PSaxo9d6PEQ+kB7MeE6npGPjIIq/0gxwtU1wasC3bgjZnIEsW7dcJKU iYrzMl3tNwqkss7URVUdowozvjLeq/i4q9K2gPyYSZpOtxH+6k48dovngw+P+d5zImcxGd5P1n8c v6J40y6x+aW7ARCa0n7T+XPfO9yTppTojBykWIJShw== --0000000000003d5cb605ab70f0d6-- From nobody Mon Jul 27 13:47:31 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 09D8E3A03EE for ; Mon, 27 Jul 2020 13:47:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aXGXUC8b8cMc for ; Mon, 27 Jul 2020 13:47:27 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DD8753A03ED for ; Mon, 27 Jul 2020 13:47:27 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 9D831C3F16 for ; Mon, 27 Jul 2020 20:47:25 +0000 (UTC) From: Paul Vixie To: add@ietf.org Date: Mon, 27 Jul 2020 20:47:24 +0000 Message-ID: <10299797.CFGZsHVd10@linux-9daj> Organization: none In-Reply-To: <20200727142632.GB4377@nic.fr> References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200727142632.GB4377@nic.fr> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 20:47:29 -0000 On Monday, 27 July 2020 14:26:32 UTC Stephane Bortzmeyer wrote: > On Fri, Jul 24, 2020 at 05:53:02PM +0100, > Tony Finch wrote > > a message of 21 lines which said: > > Except that stub resolvers have to cope with networks that don't > > allow end-user devices to talk to arbitrary authoritative DNS > > servers. > > These violations of network neutrality seem a reason to use DoH (or > DoT) with authoritative name servers. in the USA at this time, network neutrality is nobody's obligation. on privately operated edge networks having only employees or family but no customers, network neutrality will never be an obligation. on those networks, DoH will be seen as, and treated as, an attack. i don't think network neutrality is a useful rubric for ADD's proposals. -- Paul From nobody Mon Jul 27 13:51:42 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 289F43A040F for ; Mon, 27 Jul 2020 13:51:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m6yF3GHjCj5C for ; Mon, 27 Jul 2020 13:51:37 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C242A3A0400 for ; Mon, 27 Jul 2020 13:51:37 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 81886C3F16 for ; Mon, 27 Jul 2020 20:51:35 +0000 (UTC) From: Paul Vixie To: ADD Mailing list Date: Mon, 27 Jul 2020 20:51:34 +0000 Message-ID: <4563444.M2OsY2uYO4@linux-9daj> Organization: none In-Reply-To: References: <159466897500.14799.423774862197475126@ietfa.amsl.com> <1776930.eNfv2hk2N7@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 20:51:40 -0000 On Monday, 27 July 2020 15:26:00 UTC Rob Sayre wrote: > On Mon, Jul 27, 2020 at 12:54 AM Paul Vixie wrote: > > i beg you, please remember that i'm not talking about public-access > > networks where the end users are receiving connectivity as a service. > > rather, networks operated by the owner of all the devices plugged > > into them. we are legion. > > I'd suggest using management software. since intruders, malware, poisoned supply chains, and BYOD will not be participating in "management software", that recommendation is off-topic. a network which is only as secure as its least-secure node is _not secure_. -- Paul From nobody Mon Jul 27 13:55:18 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD10B3A044A for ; Mon, 27 Jul 2020 13:55:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4tZ-sQ_ntVJv for ; Mon, 27 Jul 2020 13:55:14 -0700 (PDT) Received: from mail-io1-xd29.google.com (mail-io1-xd29.google.com [IPv6:2607:f8b0:4864:20::d29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A45223A043E for ; Mon, 27 Jul 2020 13:55:14 -0700 (PDT) Received: by mail-io1-xd29.google.com with SMTP id w12so4861926iom.4 for ; Mon, 27 Jul 2020 13:55:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=3qVUWj8U3ZWeJY8JZZ2RtqjY0eBcJk5Rgx3wP0Ls7iA=; b=ripiOuE8weE5LIJp1IOc7beSWU48zkan0xsn2z3ETAM5rNLNawElrr398kuuSl+VWH E6Mc41fg7uay090bmk8u7mpAUeWWRQ61Dedkhk2zY0HvLbp7mrYyaK0U7+U4j4POWUQK ge9bZsIuZCWFkmuxLgr0qI+UKqecIN9xodNDFWig8aNdwmdseD7ptB8MGBexDwoRBIch xkq0Int73BMA1MqC3sDFpuY+lPGQlmUvvTeY/fz5/rVDj2jZFt/hWHFEshbDB8J8NW5I IVgFmzqVUa7s3NPOmbulg2f4g4gWYyKr58f4rPLlqqYZjaBm05Q3STy7sHSrjPaH424v YzfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=3qVUWj8U3ZWeJY8JZZ2RtqjY0eBcJk5Rgx3wP0Ls7iA=; b=iSqdA91E4nPeWliio7gZO7HiDiicj926AQBLvOyNbL0JoT9cWIkxDlzR174BymioNs njRTe8cTMAYTn1QUM/p9w3DSjpmAmWSuELzzZ2P/gRtg5FMj9aiaOWz6RKvDDK5jqFN1 0QrZrMZM6qlMA+iZ+t1tKQmDG3VF2VvZW2NAcKvC9+WycF8H07aEIQyDoEuKM22TcDoG kH+VQd8K/SIPHiyIWqnpg7noF8+SiNiUCtJ1gA/ZvmMxq2qtFBsgUVEtSZTkJgBjkPu8 2ERIG73HGAxv11JR0/qThjk9IWXoL14zxpNa6oQPk416LgNRIdxdY6eio1DSGXOHUPeH Wrzg== X-Gm-Message-State: AOAM533PuAjvHK3zOvMVEa66wmOFLHAdYlueqCi1OKXdZKEgXlDE3ReF y8J+cRx4d+adgTsVkO8i+jrWmDMh1V2mrAq24qjXmw== X-Google-Smtp-Source: ABdhPJw3bmhuCsmD5Bm/CSA5TSqKv84GUjeXK2wHA0c7XZUh0rrMdFNjcQUFSkvEDeuq/Uxvo2JjdqnrllBWVN5Ug8s= X-Received: by 2002:a02:108a:: with SMTP id 132mr29380180jay.131.1595883313775; Mon, 27 Jul 2020 13:55:13 -0700 (PDT) MIME-Version: 1.0 References: <159466897500.14799.423774862197475126@ietfa.amsl.com> <1776930.eNfv2hk2N7@linux-9daj> <4563444.M2OsY2uYO4@linux-9daj> In-Reply-To: <4563444.M2OsY2uYO4@linux-9daj> From: Rob Sayre Date: Mon, 27 Jul 2020 13:55:02 -0700 Message-ID: To: Paul Vixie Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000000546f905ab728a45" Archived-At: Subject: Re: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 20:55:17 -0000 --0000000000000546f905ab728a45 Content-Type: text/plain; charset="UTF-8" On Mon, Jul 27, 2020 at 1:51 PM Paul Vixie wrote: > On Monday, 27 July 2020 15:26:00 UTC Rob Sayre wrote: > > On Mon, Jul 27, 2020 at 12:54 AM Paul Vixie wrote: > > > i beg you, please remember that i'm not talking about public-access > > > networks where the end users are receiving connectivity as a service. > > > rather, networks operated by the owner of all the devices plugged > > > into them. we are legion. > > > > I'd suggest using management software. > > since intruders, malware, poisoned supply chains, and BYOD will not be > participating in "management software", that recommendation is off-topic. > a > network which is only as secure as its least-secure node is _not secure_. > It doesn't seem like your idea of "security" aligns with IETF consensus. thanks, Rob --0000000000000546f905ab728a45 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Jul 27, 2020 at 1:51 PM Paul = Vixie <paul@redbarn.org> wrot= e:
On Monday, 27= July 2020 15:26:00 UTC Rob Sayre wrote:
> On Mon, Jul 27, 2020 at 12:54 AM Paul Vixie <paul@redbarn.org> wrote:
> > i beg you, please remember that i'm not talking about public-= access
> > networks where the end users are receiving connectivity as a serv= ice.
> > rather, networks operated by the owner of all the devices plugged=
> > into them. we are legion.
>
> I'd suggest using management software.

since intruders, malware, poisoned supply chains, and BYOD will not be
participating in "management software", that recommendation is of= f-topic. a
network which is only as secure as its least-secure node is _not secure_.

It doesn't seem like your idea of &q= uot;security" aligns=C2=A0with IETF consensus.

thanks,
Rob

--0000000000000546f905ab728a45-- From nobody Mon Jul 27 14:07:08 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 829E93A0486 for ; Mon, 27 Jul 2020 14:07:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Chiv_qm90s_x for ; Mon, 27 Jul 2020 14:07:02 -0700 (PDT) Received: from mail-vs1-xe2d.google.com (mail-vs1-xe2d.google.com [IPv6:2607:f8b0:4864:20::e2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C0FE3A0476 for ; Mon, 27 Jul 2020 14:07:02 -0700 (PDT) Received: by mail-vs1-xe2d.google.com with SMTP id b26so4505450vsa.13 for ; Mon, 27 Jul 2020 14:07:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4neifOMULOGJsMuuGjlGze2pQGFux7yAJxe4ilS8TLw=; b=gPXv9qx+h7D+VvWG5J0yqQ3rhyPsZnAdBb9y3HILhSsSu7fxLIyqhjVSemL88v1Z+9 fAIZN9vbRQJg3n3P2b19Nwb7YCVPsZ0hPMdAQwEmkDKKn9/gbvRE7d4X3cAA4zYOZ1vf xEG0hyrw+glBU/pWLOJ7ejqwY7fUah1TcG0udrGMuJZ5LYv9lFiv9eal+eNgCD9w0+4T CHUp9tk5xMie46kngKK1769KeG9Bz08o0/A3Nq3I67lrIesA6f+GcjsRGXNS0UW/Rg2c HC/B974/4ZYARB9kiDU8lzKPmxtIi4K53Ucz7W6+v7DO2HZHrh/2QAPnK8nTj+i2jwFS dE+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4neifOMULOGJsMuuGjlGze2pQGFux7yAJxe4ilS8TLw=; b=ad4S46YtqwExqj/h6PkYJMe4xDCG7zhRM6n4kcB+0db12NZhMBZ/b7gHbXTjOWkmpe 4s9d6qPHQmnH48ufbhvQjxDqLVdv9CR674zK/XzJGnrWQm+Ukacfw84jDBd2SkXtkDaW lHNs7/jh/KU/UcNDnR6KhWMpK1GK5QqiLutOrUj7JpMeEtqyCBrT/CNnSyAJ8Kn4BUEI Sb2zqGQ2eTU/tSBC67hiY5/CwfYvu10T7ddVfmTWO6oPwWx3M3lRsp0MBVjfnPiZoPYB N6/AYxxJR3DAXeVQj/jyYIjVujEyXxLrgsRiydX25kXopBH5IqJg5Kdtr58gd52NELYp rd6Q== X-Gm-Message-State: AOAM530XCtSP4a5vJbvJantlhNr+5Rw1Rx9QdjN+UvHLn71FC0Ejx4fi ck7OPfA7DbMm/nmBnqrgpPmnew8hsqojGOT2vt8= X-Google-Smtp-Source: ABdhPJzpZko1x8Pk5kZDZdy54Pi67lExNKoUs30GcHD9FiZX0UhdqNK83ddXksck0RqSBkAcldtryPd7prjPKLKD2Ys= X-Received: by 2002:a67:7fd5:: with SMTP id a204mr17492320vsd.97.1595884021459; Mon, 27 Jul 2020 14:07:01 -0700 (PDT) MIME-Version: 1.0 References: <159078807168.11416.12425165143603046178@ietfa.amsl.com> <20200727145502.GA7147@nic.fr> In-Reply-To: From: Daniel Migault Date: Mon, 27 Jul 2020 17:06:50 -0400 Message-ID: To: Ben Schwartz Cc: Stephane Bortzmeyer , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000033ae8b05ab72b473" Archived-At: Subject: Re: [Add] New Version Notification for draft-mglt-add-rdp-02.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 21:07:07 -0000 --00000000000033ae8b05ab72b473 Content-Type: text/plain; charset="UTF-8" Hi Ben, Thanks for the comment. First I agree that I should clarify the text and I am working on it. The intent of the list is to provide a "list of recommended resolvers". However, the list does not provide the resolvers as well as their characteristics. Instead it provides the resolving domain that can be seen as an indirection to these resolvers. As a result, the final candidate resolvers are retrieved from a SVCB query over the resolving domain. The resolver and associated characteristics of the resolver are clearly provided by the owner of the resolving domain and not the owner of the "list of resolvers". I think I understand what you mean by the violation of the principle of the DNS. This would typically be the case if connectivity information ( IP addresses for example) would be provided directly by the owner of the FQDN that represents the list of resolvers. It is a bit different here as PTR indicates an indirection. The reason I am using PTR is that I would like to use DNS only and not necessarily mandate that HTTP, FTP or email be mandatory. In addition, the use of PTR enables some sanity checks of the resolving domains. I agree that this might not be very convenient for very very large list. I would envision that systems that need such very large lists of resolving domains may have their own mechanisms to provision resolving domains. EDNS buffer size of 1232 bytes will not cause fragmentation for an UDP packet and that size corresponds to the first 94 most popular domain names. Of course more could be provided over TCP. Not saying that no other mechanisms should be considered, I believe that could be sufficient for many use cases without requiring an additional protocol (HTTP, FTP, email). Yours, Daniel [1] https://moz.com/top500 On Mon, Jul 27, 2020 at 3:00 PM Ben Schwartz wrote: > On Mon, Jul 27, 2020 at 2:45 PM Daniel Migault > wrote: > >> >> a resolving domain list (rd_list.example.net) contains a list of >> resolving domains. You get the different resolving domains >> _b.rd_list.example.net PTR >> > > This is the part of the draft that seems strangest to me (apart from the > odd use of PTR). It violates the usual expectation about data in the DNS: > records published by a domain provide information about that domain. These > lists instead appear to provide information about the wider world. The > "owner name" just indicates whose opinion this is. > > If you want to present this type of information, I would encourage you to > define a MIME type and distribute it using a general information transfer > system like HTTP, FTP, or e-mail. The concerns about size (since these > lists could be arbitrarily large) are a hint that you're trying to store > the wrong sort of data in the DNS. > > Alternatively, if these lists are really meant to be "resolvers to use on > this network" or something like that, the text could be clearer about that, > with an explanation of how the user would learn the owner name. > -- Daniel Migault Ericsson --00000000000033ae8b05ab72b473 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Ben,=C2=A0

Thanks for the comment. F= irst I agree that I should=C2=A0clarify the text and I am working on it.=C2= =A0
=C2=A0
The intent of the list is to provide a &= quot;list of recommended resolvers". However, the list does not provid= e the resolvers as well as their characteristics. Instead it provides the r= esolving domain that can be seen as an indirection to these resolvers. As a= result, the final candidate resolvers are retrieved from a SVCB query over= the resolving domain. The resolver and associated characteristics of the r= esolver are clearly provided by the owner of the resolving domain and not t= he owner of the "list of resolvers".=C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0

I think I understand what you mean by the v= iolation of the principle of the DNS. This would typically be the case if c= onnectivity information ( IP addresses for example) would be provided direc= tly by the owner of the FQDN that represents the list of resolvers. It is a= bit different here as PTR indicates an indirection.=C2=A0

The reason I am using PTR is that I would like to use DNS only and= not necessarily mandate that HTTP, FTP or email be mandatory.=C2=A0 In add= ition, the use of PTR enables some sanity checks of the resolving domains.<= /div>
I agree that this might not be very convenient=C2=A0for very very= large list. I would envision that systems that need such very large lists = of resolving domains may have their own mechanisms to provision resolving d= omains.=C2=A0=C2=A0
EDNS buffer size of 1232 bytes will not cause= fragmentation for an UDP packet and that size corresponds to the first 94 = most popular domain names.=C2=A0 Of course more could be provided over TCP.= Not saying that no other=C2=A0mechanisms should be considered, I believe t= hat could be sufficient for many use cases without requiring an additional = protocol (HTTP, FTP, email).=C2=A0

Yours,=C2=A0Daniel
=C2=A0=C2=A0=C2=A0




=C2=A0

On Mon, Jul 27, 2020 at 3= :00 PM Ben Schwartz <bemasc@google.= com> wrote:
On Mon, Jul 27, 2020 at 2:45 PM Daniel= Migault <mglt.= ietf@gmail.com> wrote:
=
a resolving domain list (rd_list.example.net) cont= ains a list of resolving domains. You get the different resolving domains= =C2=A0

This is the part of the draft that see= ms strangest to me (apart from the odd use of PTR).=C2=A0 It violates the u= sual expectation about data in the DNS: records published by a domain provi= de information about that domain.=C2=A0 These lists instead appear to provi= de information about the wider world.=C2=A0 The "owner name" just= indicates whose opinion this is.

If you want to p= resent this type of information, I would encourage you to define a MIME typ= e and distribute it using a general information transfer system like HTTP, = FTP, or e-mail.=C2=A0 The concerns about size (since these lists could be a= rbitrarily large) are a hint that you're trying to store the wrong sort= of data in the DNS.

Alternatively, if these lists= are really meant to be "resolvers to use on this network" or som= ething like that, the text could be clearer about that, with an explanation= of how the user would learn the owner name.


--
Daniel Migault
Ericsson
--00000000000033ae8b05ab72b473-- From nobody Mon Jul 27 14:15:49 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8635E3A07A0 for ; Mon, 27 Jul 2020 14:15:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cvu3SVbayiKG for ; Mon, 27 Jul 2020 14:15:44 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C4E063A07B3 for ; Mon, 27 Jul 2020 14:15:43 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 62027BE2F; Mon, 27 Jul 2020 22:15:41 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FlBcOV-xEHH7; Mon, 27 Jul 2020 22:15:39 +0100 (IST) Received: from [10.244.2.119] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 8DC70BE2E; Mon, 27 Jul 2020 22:15:39 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1595884539; bh=3QXX2iTCwS4WlpTWSu78LvI3rqqiWh3gfD0J+E8yyn0=; h=Subject:To:References:From:Date:In-Reply-To:From; b=VwP9MbcjTVwE5k2d8xPADuuiGe3j9rkGE6AhrLuSyP4BmHHh+Hms1i6ySkJwitPaw chJDulXOE9um7472Wo6KnP3Sgnu/hptfSKxqmFb0OLxfoRiWK8Jbl3aLhKkX7kHxJg qr1jExh/33sRhaSh7lMv1DSd7ayJhTRC1DPB1Dig= To: Paul Vixie , add@ietf.org References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200727142632.GB4377@nic.fr> <10299797.CFGZsHVd10@linux-9daj> From: Stephen Farrell Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Mon, 27 Jul 2020 22:15:38 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: <10299797.CFGZsHVd10@linux-9daj> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="XMtl3FWtsXoxCTFsMkq7fDGlJQ139aeI9" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 21:15:48 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --XMtl3FWtsXoxCTFsMkq7fDGlJQ139aeI9 Content-Type: multipart/mixed; boundary="lFh6caEYqfaMpToUy4bnsDgUN549sFYzA"; protected-headers="v1" From: Stephen Farrell To: Paul Vixie , add@ietf.org Message-ID: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <20200727142632.GB4377@nic.fr> <10299797.CFGZsHVd10@linux-9daj> In-Reply-To: <10299797.CFGZsHVd10@linux-9daj> --lFh6caEYqfaMpToUy4bnsDgUN549sFYzA Content-Type: multipart/mixed; boundary="------------C6BAE73CBB2988081054274F" Content-Language: en-US This is a multi-part message in MIME format. --------------C6BAE73CBB2988081054274F Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Paul, On 27/07/2020 21:47, Paul Vixie wrote: > on privately operated edge networks having only employees or family but= no=20 > customers, network neutrality will never be an obligation. on those net= works,=20 > DoH will be seen as, and treated as, an attack. I run a home network and consider DoH a fine countermeasure against the potential I have to snoop on my family and all of our visitors. I don't question your right to hold your view of DoH. I do maintain mine is as legitimate. S. --------------C6BAE73CBB2988081054274F Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------C6BAE73CBB2988081054274F-- --lFh6caEYqfaMpToUy4bnsDgUN549sFYzA-- --XMtl3FWtsXoxCTFsMkq7fDGlJQ139aeI9 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl8fQ/oACgkQWrL68XsX K+q9fQ/8D9VtS0TvGXn8NCfayC8PYoIqSvE1ja1uneHSmpor0j34u9VttxqP7DQk X4mLGdVq4nJONVsFD6knoiAgDvxZqirWii2z9U3CnqKHB1TURMJGLGAtIx0rRPzY 0xmze0YshTx2dX6gfUNxCQbimU+rRq/GyuI6YnSrRzvCk9Sv7ksxc4aXfrJiXLXG ffuu9TnI9p7oqzh//8HRXYg8qOTeTeyPy2deaiTVJiSDzBGGv6Q0ItvB1QjPX7VI nkRoFaV+cZmRh9d3BBHPtZnDx/PT58NCehZ7S4nIg1vQBxUXFJjpUHn6JJCp84Em 1GI4js2YEz6n6KByBcdXxS5/J7YUT5aGEFkqb2meikn0FyWUmZYJhgYfc9HtCI4p YDJPPkP6sdWU6Del4+C5NEjtSv9u3R4WTRgqbv5oeYlP8PCMPSff3Ii8pezbJCFa mO3jKSINQsxsg6uVIL10JwKIdyfxD9rNTEjHRPzQposxAUreWyVslUcL8WmuuNK6 gt8cdRFgbY2zhMjf0T5DlAGTWIbbgPRcgYheWTNev6c49DrOupWJWvJ341zizVdu ioKT1dD1piFwiG9JaGnDZkHpQ9LfwOGSa4M+CkT/4QUyy9YQBRAWffhd9VP/ALba yQ9qlE/pWi1qcS3xu5RcltSMh2CvdsYOdO7te231CnXCUvxa4Go= =gsbD -----END PGP SIGNATURE----- --XMtl3FWtsXoxCTFsMkq7fDGlJQ139aeI9-- From nobody Mon Jul 27 14:18:35 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D3083A07B3 for ; Mon, 27 Jul 2020 14:18:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KHpJbub2WOSj for ; Mon, 27 Jul 2020 14:18:32 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 34AE63A07B1 for ; Mon, 27 Jul 2020 14:18:32 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 029EDC3F16 for ; Mon, 27 Jul 2020 21:18:30 +0000 (UTC) From: Paul Vixie To: ADD Mailing list Date: Mon, 27 Jul 2020 21:18:29 +0000 Message-ID: <6625707.7O0PBCkuz3@linux-9daj> Organization: none In-Reply-To: References: <159466897500.14799.423774862197475126@ietfa.amsl.com> <4563444.M2OsY2uYO4@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 21:18:33 -0000 On Monday, 27 July 2020 20:55:02 UTC Rob Sayre wrote: > On Mon, Jul 27, 2020 at 1:51 PM Paul Vixie wrote: > > ... > > > I'd suggest using management software. > > > > since intruders, malware, poisoned supply chains, and BYOD will not be > > participating in "management software", that recommendation is off-topic. > > a network which is only as secure as its least-secure node is > > _not secure_. > > It doesn't seem like your idea of "security" aligns with IETF consensus. i'm using security the way it's defined in the dictionary. it's not "my idea". the internet was once 100% enterprise. today it's probably 20%. on that trend, the IETF has lost touch with the internet's enterprise roots, and the IETF consensus remains determined by those who attend meetings, read or write drafts, or participate in mailing lists. i am not here to tell the IETF that it's ignorant of an important market segment, nor request outreach beyond open meetings and open mailing lists, nor ask that consensus be artificially biased to include the under-represented. those things are true and i have spoken them often. but that's not my topic here and now on this thread. my topic is to inform this working group that there are market segments who will treat DoH as an attack, and one of those segments (operators of private networks) have the resources and the will needed to defend themselves against that attack. my advice is to avoid those predictable consequences, as a matter of good engineering (anticipates real-world range of use cases). -- Paul From nobody Mon Jul 27 14:24:36 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 10A3D3A07C0 for ; Mon, 27 Jul 2020 14:24:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lD5_PSK6wT9q for ; Mon, 27 Jul 2020 14:24:32 -0700 (PDT) Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BE1863A07C5 for ; Mon, 27 Jul 2020 14:24:32 -0700 (PDT) Received: by mail-io1-xd2c.google.com with SMTP id d18so18584189ion.0 for ; Mon, 27 Jul 2020 14:24:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=VcomqgDLjiGWRSiNk1w/cCE1ITeEyQoNWZkVPY3P86g=; b=bP7mqFdXv5ZUxXmPVR8oXqWjqRg4ZJNc8afpFDddYeza5wT/QuaqDn6KMEII4/Bf03 2MpAdJOlAD0ws1b0SUxQGo5+b+aVrEl8zicSkWQzZMFK9+URmD3pdMuNSFvxqjoG5JIb FbqYASrLWQIUHwk+oN6W7Xsu5vAavyy8i3eGqngrqvz1H95wgkQDpLpUwZbh+EY+fEVn JpNyp+6xdZqHnEiMnRbmtQ5mlZ9TgVB8MBQBQQ2IkY8PC9tvECBzgyOgcVGzGMIylvtp /5+Beip4ZMakzEsFF0R4tPr1dOdwNgd3KLZukywEjRooNdP515S4s6OaO0Klo0zKZwjW hPjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=VcomqgDLjiGWRSiNk1w/cCE1ITeEyQoNWZkVPY3P86g=; b=m+/QQIvIgL59alfaelOieIPGzc06qMwsFdPjzPuMLH97KafltXJz6sqlkzE/69N94Y l3bQxNZMCEldbAewQUZqP8+22Xdf4TCx8xDYcBzI/lOXHXzkoQ0PMwbri67tU3NQJXG2 g0SabASWjfLyKpGOMRTwAjcMiQbt7i/9ydVTc3UYCWERHW7BNxBNG88QrjEKBXjMbZSt yxHPo/949D8k9+TGz0lLXp4k+UI4h/gdHCnQm+5XnVbRxqEtAI6GZ96YVeUy3by/1la/ +8puizG7HifPGBpXrdKwH/DZayCaCm8XrvkD8EohMCrJvgC9DTxd0PMJvNWnORuspXLX ZzPw== X-Gm-Message-State: AOAM530m0EMq868nGh5QnQ63closX2m9dqH1izV/pEEZlUUa+olJEJNy R0QHK+ca4vIt/PGEKI3rBKx/T9NxjuwqJjM62j361pr6 X-Google-Smtp-Source: ABdhPJwM3ycwZa+tOLx3zmD9zJjSVNNhgEBXP63+lAtKYMzhPbupozn6sM4qpwKamxRsEl86rjWifm397ktAn3Oo21Y= X-Received: by 2002:a05:6602:2417:: with SMTP id s23mr8345615ioa.94.1595885072008; Mon, 27 Jul 2020 14:24:32 -0700 (PDT) MIME-Version: 1.0 References: <159466897500.14799.423774862197475126@ietfa.amsl.com> <4563444.M2OsY2uYO4@linux-9daj> <6625707.7O0PBCkuz3@linux-9daj> In-Reply-To: <6625707.7O0PBCkuz3@linux-9daj> From: Rob Sayre Date: Mon, 27 Jul 2020 14:24:20 -0700 Message-ID: To: Paul Vixie Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000d1c96a05ab72f22b" Archived-At: Subject: Re: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 21:24:34 -0000 --000000000000d1c96a05ab72f22b Content-Type: text/plain; charset="UTF-8" On Mon, Jul 27, 2020 at 2:18 PM Paul Vixie wrote: > On Monday, 27 July 2020 20:55:02 UTC Rob Sayre wrote: > > On Mon, Jul 27, 2020 at 1:51 PM Paul Vixie wrote: > > > ... > > > > I'd suggest using management software. > > > > > > since intruders, malware, poisoned supply chains, and BYOD will not be > > > participating in "management software", that recommendation is > off-topic. > > > a network which is only as secure as its least-secure node is > > > _not secure_. > > > > It doesn't seem like your idea of "security" aligns with IETF consensus. > > i'm using security the way it's defined in the dictionary. it's not "my > idea". > The relevant RFCs are: https://tools.ietf.org/html/rfc1958 https://tools.ietf.org/html/rfc7624 thanks, Rob --000000000000d1c96a05ab72f22b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Jul 27, 2020 at 2:18 PM Paul = Vixie <paul@redbarn.org> wrot= e:
On Monday, 27= July 2020 20:55:02 UTC Rob Sayre wrote:
> On Mon, Jul 27, 2020 at 1:51 PM Paul Vixie <paul@redbarn.org> wrote:
> > ...
> > > I'd suggest using management software.
> >
> > since intruders, malware, poisoned supply chains, and BYOD will n= ot be
> > participating in "management software", that recommenda= tion is off-topic.
> > a network which is only as secure as its least-secure node is
> > _not secure_.
>
> It doesn't seem like your idea of "security" aligns with= IETF consensus.

i'm using security the way it's defined in the dictionary. it's= not "my idea".

The relevant = RFCs are:

https://tools.ietf.org/html/rfc7624<= /div>

thanks,
Rob

=C2=A0
--000000000000d1c96a05ab72f22b-- From nobody Mon Jul 27 14:32:15 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C22E3A07E7 for ; Mon, 27 Jul 2020 14:32:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AJNiml30NSvm for ; Mon, 27 Jul 2020 14:32:12 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 891D73A07E2 for ; Mon, 27 Jul 2020 14:32:12 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 243C7C3F16; Mon, 27 Jul 2020 21:32:12 +0000 (UTC) From: Paul Vixie To: add@ietf.org Cc: Stephen Farrell Date: Mon, 27 Jul 2020 21:32:10 +0000 Message-ID: <2354125.1eku6JS2IN@linux-9daj> Organization: none In-Reply-To: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <10299797.CFGZsHVd10@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 21:32:14 -0000 On Monday, 27 July 2020 21:15:38 UTC Stephen Farrell wrote: > Paul, > > On 27/07/2020 21:47, Paul Vixie wrote: > > on privately operated edge networks having only employees or family but no > > customers, network neutrality will never be an obligation. on those > > networks, DoH will be seen as, and treated as, an attack. > > I run a home network and consider DoH a fine countermeasure > against the potential I have to snoop on my family and all > of our visitors. > > I don't question your right to hold your view of DoH. I do > maintain mine is as legitimate. your network, your rules. even if i disagreed with your chosen policy i would fight for your right to make and enforce that policy. so, your local policy will always be legitimate in my eyes, no matter what policy that may be. service provider networks who usurp the prerogatives of private network operators to surveil or filter without transparency or permission are the root cause of DoH and DoT. something's got to be done about those usurpers, and encryption of DNS (with DoH or DoT or otherwise) is a move in that direction. however, on privately operated edge networks (corporate, government, military, family) we ought to expect DoH to be treated as an attack, and never welcomed, and often blocked. i think we should treat that policy as legitimate, and not make it more expensive to implement than is otherwise necessary. that's the broad spectrum of our problem statement as i see it. -- Paul From nobody Mon Jul 27 14:50:36 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 271E93A0870 for ; Mon, 27 Jul 2020 14:50:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gYZfjZI__qMh for ; Mon, 27 Jul 2020 14:50:33 -0700 (PDT) Received: from mail-qv1-xf2b.google.com (mail-qv1-xf2b.google.com [IPv6:2607:f8b0:4864:20::f2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EAEB73A086F for ; Mon, 27 Jul 2020 14:50:32 -0700 (PDT) Received: by mail-qv1-xf2b.google.com with SMTP id t6so3324213qvw.1 for ; Mon, 27 Jul 2020 14:50:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=F/1gFDnpUUn6Tjdygzj+MKlWLFqIJjDNRus8qwPCQBM=; b=fMtbn08vlZq28o83mpRxcK4khGQ2HlsWveZPA2gG1AQfb+FJKlZ+Es++uEJTB61j98 zm7jxaYCIpjdUbgum47ElSx83RJwi/+OTXXRf3iRBdYODBMWKd6Dejvr1t4ll4/i01Xx noXhUYG8F46IrN59JpybFk2wOHX8zOpu68BqwH+AOsmTPZUfVzqQtJlpEvT5+pa8ZGql DHKEmJ5lxi2yNO8eFZbrZ0BZDKAvRuZ43DX6nzDDZqoCtT/bRIePpFVN8F/DCH6KEMlb XRC2+iDU4oP17UHZDgePIgZYmH6XI+T1tuKRGx+xu1rI5AUsqg/IF7BF4yI0oxs9eBWy 42lw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=F/1gFDnpUUn6Tjdygzj+MKlWLFqIJjDNRus8qwPCQBM=; b=eR9i46OizAlKe1iw8RFH/7JzHIRJo0hGGyl7YjoROFlM+3qYQIVlrs6f/3prPFa3UX +DxCx79jjdoohGAN9WYblSG+MXmeDwCAgm0g7tzc/NHqIwZfwcb688uePVZewpLKReD9 8wIldj6FchcwFv9dfAiaqiLUNeeynRMgfMPkBbzzAi/2MHZKcDZ6h3ogzQVcyWH5cL8m L2krDmheBajE5HmT/lOGkYAmKBVcX85G41+xIlPDAqh9Q4+IlfVwlcTjdTJ6LaAzO17s uvizKv9uCq3wIZQDJIRRi9ehTQ91tX5ZwAHCUEVH3G88XmuUSDsE82u5Io6OhyYmqAZ1 Y2RA== X-Gm-Message-State: AOAM531D9WGdiTPi0K9CEBoDCK3eoOS0jnpkHEtdq7eExxEOmFraXMfl JXtUpLHB7vgbFOTo9v1rGus61Q== X-Google-Smtp-Source: ABdhPJyeTMIRcPrAXtucZjrCkMW2Cz0eeFqC9p6YQX6m6ri2gr9NkCh6rXcKNw9PA6a9gSEEx+17Yg== X-Received: by 2002:a05:6214:178c:: with SMTP id ct12mr24725943qvb.64.1595886630655; Mon, 27 Jul 2020 14:50:30 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:6006:2043:7843:2a9e? ([2601:18b:300:36ee:6006:2043:7843:2a9e]) by smtp.gmail.com with ESMTPSA id o184sm20797517qkd.41.2020.07.27.14.50.29 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Jul 2020 14:50:30 -0700 (PDT) From: Ted Lemon Message-Id: <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_56931FE3-D155-47AD-9C19-6B953C6F570D" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Mon, 27 Jul 2020 17:50:29 -0400 In-Reply-To: <2354125.1eku6JS2IN@linux-9daj> Cc: add@ietf.org, Stephen Farrell To: Paul Vixie References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <10299797.CFGZsHVd10@linux-9daj> <2354125.1eku6JS2IN@linux-9daj> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 21:50:35 -0000 --Apple-Mail=_56931FE3-D155-47AD-9C19-6B953C6F570D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 27, 2020, at 5:32 PM, Paul Vixie wrote: > however, on privately operated edge networks (corporate, government, = military,=20 > family) we ought to expect DoH to be treated as an attack, and never = welcomed,=20 > and often blocked. i think we should treat that policy as legitimate, = and not=20 > make it more expensive to implement than is otherwise necessary. I think it=E2=80=99s been generally agreed that there are networks on = which DoH should not be allowed. I=E2=80=99m puzzled that you think this = is controversial. What about it is controversial? The existence of such = a policy, or the mechanism for enforcing it? --Apple-Mail=_56931FE3-D155-47AD-9C19-6B953C6F570D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 27, 2020, at 5:32 PM, Paul Vixie <paul@redbarn.org> = wrote:
however, on = privately operated edge networks (corporate, government, military, 
family) we = ought to expect DoH to be treated as an attack, and never welcomed, 
and often = blocked. i think we should treat that policy as legitimate, and not 
make it more = expensive to implement than is otherwise = necessary.

I= think it=E2=80=99s been generally agreed that there are networks on = which DoH should not be allowed. I=E2=80=99m puzzled that you think this = is controversial. What about it is controversial? The existence of such = a policy, or the mechanism for enforcing it?

= --Apple-Mail=_56931FE3-D155-47AD-9C19-6B953C6F570D-- From nobody Mon Jul 27 14:56:14 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 322553A08BE for ; Mon, 27 Jul 2020 14:56:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S2TermFWSxcc for ; Mon, 27 Jul 2020 14:56:04 -0700 (PDT) Received: from mail-qk1-x72c.google.com (mail-qk1-x72c.google.com [IPv6:2607:f8b0:4864:20::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E18D3A091C for ; Mon, 27 Jul 2020 14:56:03 -0700 (PDT) Received: by mail-qk1-x72c.google.com with SMTP id l6so16823364qkc.6 for ; Mon, 27 Jul 2020 14:56:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language; bh=uBGZ04q0NQgdVF3/EV5kesQUwqc9o25+W9B/W6oQCbs=; b=Hi/n2fFkssU9NE36ESnoUKsyTUCW5cIXUI4slrDf2sGK6dv2sn7eF6m0ADDhgygG7S Kcg/eM07WxlrjhVbz1MjDKZc5hPgafi+5d4CkWWW5hmrFzo7r5oHQ2M5VMMFb2FHnvzs ocBbyO2i/eSxYykxNu/fBcOUMoqYSv4W1FwDwtSR3g2fPMcgVpaz44q/f2YWxqiF9yGY tm6VCRrP843180wxun66gI5B2q6E+N50zf/C9piF/Zzo5rZ9zT4/AayhmLOqW0svl/nm 8jwtN+a2n/9MnR3qI/JpAGWktza8kuZ2YFU7YslU+jIPe6Qw9sbNisB71h4vvBN1UIXI tC6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language; bh=uBGZ04q0NQgdVF3/EV5kesQUwqc9o25+W9B/W6oQCbs=; b=SavDIAizY9KzPM7Pv+1VJud7T2H7Xo3jAnH/dlRGQ4hcA32usazo0yU6DwpSAGlYpp 1Y6AtfwdFmg7l3m00WlFU+3BdvXfON5j2Vr0HvAGZr85JJlIgd5qAabpPDb5IM5LmAQb rtUBTIObiPEcDFPLeaLiXPDZ738dIURZVwU7btk1azu8/IRYWC/D5WN+wRL89o5xNN2N V8RB8B92kVYPvgmANX41HK9jyF9Eb/azWotKTOP6mMtfm73TdU57vhRvhDuabpRG8b88 O5YneJzPXBcpfIVJwsL/1QOgALUaTZHmHeUDhxWYiLdTISw6wwbqqGCOLdS8t1STOTaw BUbw== X-Gm-Message-State: AOAM5324MmNBhQbtIN2Bwxh8CYqGFVDjOu+wCEcE88tE8zAOhDRCNmSL n3fQyuOvxQXFhMxYSvfREvbIy/D6WenAJg== X-Google-Smtp-Source: ABdhPJyk1AHx1TxOjVXdv0USscGpdYQ23OfOePo87uy4OBe45l2Sr0WnkN89jtIhMyVtsrGS0MxS9A== X-Received: by 2002:a37:e110:: with SMTP id c16mr24256549qkm.243.1595886962165; Mon, 27 Jul 2020 14:56:02 -0700 (PDT) Received: from [192.168.1.249] (pool-70-106-222-98.clppva.fios.verizon.net. [70.106.222.98]) by smtp.gmail.com with ESMTPSA id a3sm19615340qkf.131.2020.07.27.14.56.01 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 27 Jul 2020 14:56:01 -0700 (PDT) To: Rob Sayre , Paul Vixie Cc: ADD Mailing list References: <159466897500.14799.423774862197475126@ietfa.amsl.com> <4563444.M2OsY2uYO4@linux-9daj> <6625707.7O0PBCkuz3@linux-9daj> From: Tony Rutkowski Message-ID: <3a09aa65-524b-aa61-5b77-c659067456cc@gmail.com> Date: Mon, 27 Jul 2020 17:56:02 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------3CE068F63BFE7281E3D69241" Content-Language: en-US Archived-At: Subject: Re: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 21:56:13 -0000 This is a multi-part message in MIME format. --------------3CE068F63BFE7281E3D69241 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Hi there, Those two RFCs are not useful anymore.  They reflect network architectures and needs of yesteryear and are restraints on the market for services.  IETF participants should not be required to swear allegiance to them, and the work should not be constrained by them. They don't serve IETF well and it is long past due to get rid of them. --tony On 27-Jul-20 5:24 PM, Rob Sayre wrote: > > > On Mon, Jul 27, 2020 at 2:18 PM Paul Vixie > wrote: > > On Monday, 27 July 2020 20:55:02 UTC Rob Sayre wrote: > > On Mon, Jul 27, 2020 at 1:51 PM Paul Vixie > wrote: > > > ... > > > > I'd suggest using management software. > > > > > > since intruders, malware, poisoned supply chains, and BYOD > will not be > > > participating in "management software", that recommendation is > off-topic. > > > a network which is only as secure as its least-secure node is > > > _not secure_. > > > > It doesn't seem like your idea of "security" aligns with IETF > consensus. > > i'm using security the way it's defined in the dictionary. it's > not "my idea". > > > The relevant RFCs are: > > https://tools.ietf.org/html/rfc1958 > https://tools.ietf.org/html/rfc7624 > > thanks, > Rob > > > --------------3CE068F63BFE7281E3D69241 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

Hi there,

Those two RFCs are not useful anymore.  They reflect network architectures and needs of yesteryear and are restraints on the market for services.  IETF participants should not be required to swear allegiance to them, and the work should not be constrained by them. 

They don't serve IETF well and it is long past due to get rid of them.

--tony


On 27-Jul-20 5:24 PM, Rob Sayre wrote:


On Mon, Jul 27, 2020 at 2:18 PM Paul Vixie <paul@redbarn.org> wrote:
On Monday, 27 July 2020 20:55:02 UTC Rob Sayre wrote:
> On Mon, Jul 27, 2020 at 1:51 PM Paul Vixie <paul@redbarn.org> wrote:
> > ...
> > > I'd suggest using management software.
> >
> > since intruders, malware, poisoned supply chains, and BYOD will not be
> > participating in "management software", that recommendation is off-topic.
> > a network which is only as secure as its least-secure node is
> > _not secure_.
>
> It doesn't seem like your idea of "security" aligns with IETF consensus.

i'm using security the way it's defined in the dictionary. it's not "my idea".

The relevant RFCs are:


thanks,
Rob


 

--------------3CE068F63BFE7281E3D69241-- From nobody Mon Jul 27 15:00:57 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B09023A08C0 for ; Mon, 27 Jul 2020 15:00:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PzCTHGaIjGSS for ; Mon, 27 Jul 2020 15:00:51 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B58293A08B9 for ; Mon, 27 Jul 2020 15:00:46 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 95E14C3F16 for ; Mon, 27 Jul 2020 22:00:44 +0000 (UTC) From: Paul Vixie To: add@ietf.org Date: Mon, 27 Jul 2020 22:00:43 +0000 Message-ID: <31921523.VjnSb2Omm3@linux-9daj> Organization: none In-Reply-To: <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 22:00:54 -0000 On Monday, 27 July 2020 21:50:29 UTC Ted Lemon wrote: > On Jul 27, 2020, at 5:32 PM, Paul Vixie wrote: > > ... >=20 > I think it=E2=80=99s been generally agreed that there are networks on whi= ch DoH > should not be allowed. I=E2=80=99m puzzled that you think this is controv= ersial. > What about it is controversial? The existence of such a policy, or the > mechanism for enforcing it? i'd like ADD to recommend a protocol which can be identified by a private=20 firewall, so that it can be reliably blocked without guesswork. this may me= an=20 DoT rather than DoH, because DoH is _designed_ to prevent on-path interfere= nce=20 in DNS operations. i'd like ADD to recommend a protocol by which policy violations can receive= =20 secure authentic unambiguous refusal signals, rather than silence. this may= =20 require explicit negotiation between a node and its gateway. i'd like ADD to be useful as a way to bootstrap secure and authenticated=20 sensitive configuration information, since DHCP has been declared unsecure.= =20 this may mean introducing some local namespace (servers and DNSSEC keys). all of this flows through our choice of DNS resolver discovery method. all of this is considered controversial by many here. =2D-=20 Paul From nobody Mon Jul 27 15:01:44 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D1B93A08C0 for ; Mon, 27 Jul 2020 15:01:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y4F7zfOAoU_X for ; Mon, 27 Jul 2020 15:01:40 -0700 (PDT) Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 627BA3A08B9 for ; Mon, 27 Jul 2020 15:01:40 -0700 (PDT) Received: by mail-io1-xd2c.google.com with SMTP id d18so18684195ion.0 for ; Mon, 27 Jul 2020 15:01:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=RQxsL0ss1R/WgKYAWMiqdzIkq/LH6wUyj8RBIYtlRoE=; b=m4ddkKeaUpoGWdwA8xULRfXeOYJs6IZkKHyGF2C1mKzaCdlUDkokHNw7zrH6DwZbRw xFSM6loKk7TidVYAvGrbIpZ5g0XfwOMhz8lGEPbtR4yPcwF++Dk057rRdQCtQPPWXVXV RtXv5FisS31QN7LGdqjVcvfhl7zxkAHVc9wQ5gL9EaN5A9Ks04FJhdyApXDS3uktj0aI k+tOO3f3NuB99CPw4KyrKbmXlOIFly2I++S0JV1AA2BDT9LxNE4tNDev/4m98xZ17QTK Cp0/0L/F0xBS1uMxlmJZ/pSYDjFCI1TerJdUCVLEIEYuFkkPsQjGBXv/jeo0pK3DHrRR Iy5g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=RQxsL0ss1R/WgKYAWMiqdzIkq/LH6wUyj8RBIYtlRoE=; b=Sq5d40RBI/AzNUtLFuyU8zrFzQUQoLsrs/PKx3uMzjyFeEkmq81Vns0avvN4Bkdkxg bqLKqBI9nCo0rw3EQjCHxT4FiFwBg44gO4Z/QAuj5o78B4Rd+2NlcFMbyasDU05jN6fX 0JKZVG5iuf+OYKWRv34+DSLXRhNxMmDd93AbBr31C8oYTbLUU5RFRUO0GWEn/w4MPhT9 xC1J1CnZvqs9cpregLLsgB9i790xxWGmEFEXMLNXjlWapZW/KNwQ8d8vKhvdg1XwiOFd 9KaezzUU3knwBhbCOthfLe5cr1TFiCgRfSy4jX6ZHDUvN0DCnIqNh8EsiepU5JLP7MCw BxJQ== X-Gm-Message-State: AOAM530p99eJGpmMXEapEe22y7zc+7+jUTeJU0iGDy7WRUYWIUq88fva w6k3gMQdgWKFEqxiLZV2XYPE+xDqaJf3Wr9Khvk= X-Google-Smtp-Source: ABdhPJxNTMduZ/LaQBpXWgarN2N+3IBfYABzqrt5t7s8Ukotypv262pO9bBjE9tqj5uUqyPROsMipyZLmtUyL+wZ8yw= X-Received: by 2002:a05:6602:2417:: with SMTP id s23mr8454436ioa.94.1595887299649; Mon, 27 Jul 2020 15:01:39 -0700 (PDT) MIME-Version: 1.0 References: <159466897500.14799.423774862197475126@ietfa.amsl.com> <4563444.M2OsY2uYO4@linux-9daj> <6625707.7O0PBCkuz3@linux-9daj> <3a09aa65-524b-aa61-5b77-c659067456cc@gmail.com> In-Reply-To: <3a09aa65-524b-aa61-5b77-c659067456cc@gmail.com> From: Rob Sayre Date: Mon, 27 Jul 2020 15:01:28 -0700 Message-ID: To: Tony Rutkowski Cc: Paul Vixie , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000098e58905ab737780" Archived-At: Subject: Re: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 22:01:42 -0000 --00000000000098e58905ab737780 Content-Type: text/plain; charset="UTF-8" On Mon, Jul 27, 2020 at 2:56 PM Tony Rutkowski wrote: > They don't serve IETF well and it is long past due to get rid of them. > I don't agree, but feel free to get consensus on a draft that obsoletes them. :) thanks, Rob --00000000000098e58905ab737780 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, Jul 27, 2020 at 2:56 PM Tony Rutk= owski <rutkowski.tony@gmail.= com> wrote:

They don't serve IETF well and it is long past due to get rid of them.


I don't agree, bu= t feel free to get consensus on a draft that obsoletes=C2=A0them. :)
<= div>
thanks,
Rob

--00000000000098e58905ab737780-- From nobody Mon Jul 27 15:05:10 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4D043A08C0 for ; Mon, 27 Jul 2020 15:05:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L71UtR09VFEs for ; Mon, 27 Jul 2020 15:05:07 -0700 (PDT) Received: from mail-il1-x131.google.com (mail-il1-x131.google.com [IPv6:2607:f8b0:4864:20::131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8BB253A0884 for ; Mon, 27 Jul 2020 15:05:07 -0700 (PDT) Received: by mail-il1-x131.google.com with SMTP id e18so14455931ilr.7 for ; Mon, 27 Jul 2020 15:05:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=lPqLVZ7E+g8JUugnGx8ksqkkKyapWmYbqGW8LRU+URY=; b=NpgXVzjys0mNBR4vkLa7xU9DXSZtqbDY6LNw+it+6n9lChsqKLGNnrLsDZRevGwY0r dki4rTjgugaV/B5KA/Xqt/C1zYU+FbPtVibLFGtK3xW5Ia5RwqKV4f+EDeyzTLjRI51G 23ON/4oC7+M2yBUJRYjqfTWaOj0uaSEus71R2tN4SLFtxmCc5HPp+JKECdODvcUL46in a1/AXQoW3WjUwNKUT4kyJFvgt4AQglo/p0pslXXEkbNqdW9Y+4r1YFzSe0IwC40BxaE5 n6QdTQ40NIyWhDy3mRNLVwaNZkXwdKss/HvbBE7w97CjV9JBAB4vCjElHKyxu/269rpU GGoQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=lPqLVZ7E+g8JUugnGx8ksqkkKyapWmYbqGW8LRU+URY=; b=ck2EmdM/eJkiAoDBk1PNjoIKLXQVhfvyqy8BoQzrtfKjJT/PhPY9ON1kOtUvP8oVop OHPS0BPktJ+7RgPPAyDgYv4F3FcWViHvprTms0/ZJT5tScTBMFVOtfNcUTyorBhbA9C2 22MTjXa52DRWA1FO+HMX4LlE6D3ozsohi7cfN/0qgww51YQtLEzoQbQQbuVgi2arCX8U jffwNZpiGdzAWQYpwV79FSEveWzbXPMrlGUa5aVdG5d+MFe3IETdqk2FJwsmaIM/dVFt X95wQAsxaMV7jIu2LvWNhxDeaDg+2KxoMdV7lpI532cCGOXwqV84tAgtdDYZAruZnFDT y0Gw== X-Gm-Message-State: AOAM532kTFRTfFl1RsGZ0YcwtXP3832qNNHOPYmdouPaxRVgfRZSHzrt 9WEkd1sbRoPBqo2hxygc2UAdRYNuFxveguc3fIusSw== X-Google-Smtp-Source: ABdhPJzEJ+EDclyvq+7qFHo3gDD9LBbkFmr7OWpK9xHJBoPSskLzJbhIeZfJBliMLiPmVtkuC2qOJLAPBwZrexIawJA= X-Received: by 2002:a92:858d:: with SMTP id f135mr9942787ilh.257.1595887506872; Mon, 27 Jul 2020 15:05:06 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> In-Reply-To: <31921523.VjnSb2Omm3@linux-9daj> From: Rob Sayre Date: Mon, 27 Jul 2020 15:04:55 -0700 Message-ID: To: Paul Vixie Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000f2e02705ab7383b8" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 22:05:09 -0000 --000000000000f2e02705ab7383b8 Content-Type: text/plain; charset="UTF-8" On Mon, Jul 27, 2020 at 3:01 PM Paul Vixie wrote: > > i'd like ADD to recommend a protocol by which policy violations... > Off-topic. thanks, Rob --000000000000f2e02705ab7383b8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, Jul 27, 2020 at 3:01 PM Paul Vixi= e <paul@redbarn.org> wrote:

i'd like ADD to recommend a protocol by which policy violations...
<= /blockquote>

Off-topic.

thanks,=
Rob=C2=A0
--000000000000f2e02705ab7383b8-- From nobody Mon Jul 27 15:09:58 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D93E3A08E4 for ; Mon, 27 Jul 2020 15:09:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wRcEfJctjaA2 for ; Mon, 27 Jul 2020 15:09:55 -0700 (PDT) Received: from mail-qt1-x836.google.com (mail-qt1-x836.google.com [IPv6:2607:f8b0:4864:20::836]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CD8673A08C0 for ; Mon, 27 Jul 2020 15:09:23 -0700 (PDT) Received: by mail-qt1-x836.google.com with SMTP id k18so13470883qtm.10 for ; Mon, 27 Jul 2020 15:09:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=53W7wCcuXjBNoNonsvCcKK5+j4GinvqiVCfLxjpqHDI=; b=Tyc3njvz7wbM4cXFzbfP6nP4byoFc2J7oBobi3msFqB8l15kRTROMH0i1nUEf8DPeT Fxp8POSJ+Zm0F+4290zCYO3ehYh5pJPJfx2qJc9H/orC0ovbbBKocAKNkXY5soaKgeIa yzy9/a1MErWlpIDFwMppv2IcBoMs4RWMwuG7LYIv607VwTqs8vcdNoG6LwXQsFFWNbJ2 Qb5pIbpJFQAnyzwh1bZ983zaTcWbl+LpuyAOAblJnjAfAVN9IRD+qGeCkoTS12OBXdmJ 8FhIWD/PyzaY/gOvC3O2h4kQBsUk3W8UpQn3E30jiX1sCpO//WhyZVHL3YojQMm7DxnG xFog== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=53W7wCcuXjBNoNonsvCcKK5+j4GinvqiVCfLxjpqHDI=; b=JB2xuFVud+3zJqdYoQKPJIaiuup7NtCOyoZMXamno83PMd0eNGxzQN/PVu1KCgs1xs /OgIVVUzw6zI0ciohf7aLoXDUI6PJdnJYvYuNl48eC9N190aKI/OTdzT/k78I83qCoNt 56k++9QL7fhdMFksV4oEnRfIr+ac70wcVgtv/WboBaMjpALz9MfUEnN5v3FcdoN4cV7T 85puD4CmU8+9VBPAM5jugTiQQ2z7Vp3WzkPl1/zCQTh02PhihxwdlWrJCnMbADlJwGcg //A0Dj2tlWsnLO0kzipYqy1Qu/Rv5EdRsmXaiNUmWkGCJxiZPAmIpKmAkHQA7uXnWK4Y vglg== X-Gm-Message-State: AOAM531jP5lKeBK7KFLoPwq9eu76t45kifzz6w3v0NeWk/sp2MyUs2L8 fazLicTCbE0rL5p026b4swy4/w== X-Google-Smtp-Source: ABdhPJxnQ5Pkx9JL8oloSS6V/WOP432+CuAsu4ZGCABAIS4voSMOh6TcuqizspH0UpVW1db5jRiALA== X-Received: by 2002:ac8:6f4a:: with SMTP id n10mr19752628qtv.363.1595887762871; Mon, 27 Jul 2020 15:09:22 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:6006:2043:7843:2a9e? ([2601:18b:300:36ee:6006:2043:7843:2a9e]) by smtp.gmail.com with ESMTPSA id g16sm23987163qko.5.2020.07.27.15.09.21 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Jul 2020 15:09:22 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_16405792-E4D3-44FD-BC57-26CCFCB0A35B" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Mon, 27 Jul 2020 18:09:21 -0400 In-Reply-To: <31921523.VjnSb2Omm3@linux-9daj> Cc: add@ietf.org To: Paul Vixie References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 22:09:57 -0000 --Apple-Mail=_16405792-E4D3-44FD-BC57-26CCFCB0A35B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 27, 2020, at 6:00 PM, Paul Vixie wrote: > all of this is considered controversial by many here. Yes, we=E2=80=99ve been around and around on this. It=E2=80=99s not that = it=E2=80=99s controversial. It=E2=80=99s that ADD telling people what to = do has to be useful to the people who are being told what to do, or they = won=E2=80=99t do it. If ADD tells people to do something that doesn=E2=80=99= t serve the interests of their customers, they aren=E2=80=99t going to = do it. So what we=E2=80=99ve been having here isn=E2=80=99t a = controversy=E2=80=94it=E2=80=99s an exchange of slogans. There=E2=80=99s = no actual controversy. You think network operators have a right to act = in the interests of their customers, which in your case is the = organization that owns the network, not the end user. I don=E2=80=99t = think anybody disagrees with you about this. You think that the way to solve this problem is for ADD to say = =E2=80=9Cdon=E2=80=99t use DoH.=E2=80=9D But many participants in ADD = are here to figure out how to do DoH, and aren=E2=80=99t interested in = your opinion that they should not do it. I suppose it=E2=80=99s = theoretically possible that you could come up with some argument that = would convince them, but I don=E2=80=99t know what it would be, and = clearly you don=E2=80=99t either, because you haven=E2=80=99t made any = such argument. You just keep repeating these slogans. That=E2=80=99s not = going to get the job done. --Apple-Mail=_16405792-E4D3-44FD-BC57-26CCFCB0A35B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 27, 2020, at 6:00 PM, Paul Vixie <paul@redbarn.org> = wrote:
all of this = is considered controversial by many here.

Yes, we=E2=80=99ve been around and around on = this. It=E2=80=99s not that it=E2=80=99s controversial. It=E2=80=99s = that ADD telling people what to do has to be useful to the people who = are being told what to do, or they won=E2=80=99t do it. If ADD tells = people to do something that doesn=E2=80=99t serve the interests of their = customers, they aren=E2=80=99t going to do it.

So what we=E2=80=99ve been having here = isn=E2=80=99t a controversy=E2=80=94it=E2=80=99s an exchange of slogans. = There=E2=80=99s no actual controversy. You think network operators have = a right to act in the interests of their customers, which in your case = is the organization that owns the network, not the end user. I don=E2=80=99= t think anybody disagrees with you about this.

You think that the way to solve this = problem is for ADD to say =E2=80=9Cdon=E2=80=99t use DoH.=E2=80=9D But = many participants in ADD are here to figure out how to do DoH, and = aren=E2=80=99t interested in your opinion that they should not do it. I = suppose it=E2=80=99s theoretically possible that you could come up with = some argument that would convince them, but I don=E2=80=99t know what it = would be, and clearly you don=E2=80=99t either, because you haven=E2=80=99= t made any such argument. You just keep repeating these slogans. = That=E2=80=99s not going to get the job done.

= --Apple-Mail=_16405792-E4D3-44FD-BC57-26CCFCB0A35B-- From nobody Mon Jul 27 15:11:30 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73D8C3A08CD for ; Mon, 27 Jul 2020 15:11:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yE4fA6XcziQ9 for ; Mon, 27 Jul 2020 15:11:26 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6496B3A08C0 for ; Mon, 27 Jul 2020 15:11:26 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 7047FBE2F; Mon, 27 Jul 2020 23:11:24 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Oc72-H5HaTri; Mon, 27 Jul 2020 23:11:22 +0100 (IST) Received: from [10.244.2.119] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 1E66EBE2E; Mon, 27 Jul 2020 23:11:22 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1595887882; bh=PSWlH6jQigmZaQdE29m845XnULeotox6KCG1uO0TcqQ=; h=Subject:To:References:From:Date:In-Reply-To:From; b=ojH3IYnGhIZTuw7NiGxV7kWG7gpZMpjcR9Yqcib5vyO8Rhg56nvVtCG43wkfqtfa0 rmEriPv70znx88H1SSHsm/zqthlbyns8iQyzzJ83BgMHc+zZiWiBG/iwS+q5XJnenc XkcavmLJJ1s/TpodgFngHd11y7pXD66NRhUspuqs= To: Paul Vixie , add@ietf.org References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <10299797.CFGZsHVd10@linux-9daj> <2354125.1eku6JS2IN@linux-9daj> From: Stephen Farrell Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Mon, 27 Jul 2020 23:11:21 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: <2354125.1eku6JS2IN@linux-9daj> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="16D8GuYtCIqn7d7wfja38ghCJzbEBtXUT" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 22:11:29 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --16D8GuYtCIqn7d7wfja38ghCJzbEBtXUT Content-Type: multipart/mixed; boundary="jD3Synwo62AqKtVIf2CMImydnpH3oQhPv"; protected-headers="v1" From: Stephen Farrell To: Paul Vixie , add@ietf.org Message-ID: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <10299797.CFGZsHVd10@linux-9daj> <2354125.1eku6JS2IN@linux-9daj> In-Reply-To: <2354125.1eku6JS2IN@linux-9daj> --jD3Synwo62AqKtVIf2CMImydnpH3oQhPv Content-Type: multipart/mixed; boundary="------------1B3CBC2F3948D793DF5C7CA6" Content-Language: en-US This is a multi-part message in MIME format. --------------1B3CBC2F3948D793DF5C7CA6 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 27/07/2020 22:32, Paul Vixie wrote: > your network, your rules. even if i disagreed with your chosen policy i= would=20 > fight for your right to make and enforce that policy. so, your local po= licy=20 > will always be legitimate in my eyes, no matter what policy that may be= =2E Cool. >=20 > service provider networks who usurp the prerogatives of private network= =20 > operators to surveil or filter without transparency or permission are t= he root=20 > cause of DoH and DoT. something's got to be done about those usurpers, = and=20 > encryption of DNS (with DoH or DoT or otherwise) is a move in that dire= ction. I wouldn't describe things in terms of a tussle between entities that want to surveil myself, though I agree that such entities do certainly exist and are numerous. I'd rather also include a description that's based around what I see as people's right to privacy. > however, on privately operated edge networks (corporate, government, mi= litary,=20 > family) we ought to expect DoH to be treated as an attack, and never we= lcomed,=20 > and often blocked. i think we should treat that policy as legitimate, a= nd not=20 > make it more expensive to implement than is otherwise necessary. That depends - it's not clear to me we can square the circle between e.g. my policy and ones representing the kind of tussle between mutually-antagonistic snooping entities you describe above. Cheers, S. PS: I'm not ignoring the fact that the (e.g. HTTP) server endpoints aren't also snooping - they clearly are, and are in many ways worse than the snoopers Paul mentions at the top. >=20 > that's the broad spectrum of our problem statement as i see it. --------------1B3CBC2F3948D793DF5C7CA6 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------1B3CBC2F3948D793DF5C7CA6-- --jD3Synwo62AqKtVIf2CMImydnpH3oQhPv-- --16D8GuYtCIqn7d7wfja38ghCJzbEBtXUT Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl8fUQkACgkQWrL68XsX K+pMKw//dKx5rXrrpCCUCA4JY4TZJsYiSrgYil+YeoyClUnM7yW9iahd/6Sqh4r3 Ic4uXCnlf/e6U3ys3hauUohQHaeQiQV/+N8vbAC7vMgExulB5w6RatDD/8/1o5Ta CPaN69N7LCo0NggsZ5hZBjrX3bJXFldfejoawA0wU5/uEttBUEp3QM1a6o53Zm8K K0pH61nx4SvyDTBqV/BB0GrrHKFluzjdIrB4kELpxAH9joX6rUsSL9OVjdkJjl3L gdy58W46KplW5l0+nxn46GArq+7BQMdK7aoUdBzrexXRhhyWX2fpNLNtCcfZhQL2 OTGxzq/hJYn5LrhY9BujsHPQ1rqdNRzkw3OTgh4ouj0f7Ko0KJyaf4fAlCMEMSAc dwqNOQBYuEDl7hzEWIdS7U/lqnTJ4gIdUKkSMVglgQ3C74r1eygSQunZcq/qDrm+ XBM0INjTkMxb9ad9M9dZhTdM2aGVtHdzzqd3SN0AtuFZhMo1tWWIqDH8ES1gqz5V tmb/xEZVjvHeHAmVyDa5OL3JUN9e2lsRB5Lm41j0fvTnWySroGP9mZxBM2BrXvna lygFBBrq8KDw/YS4s70QURrDDRZpwBHvJMJN/6P+zAUqIRrA2giKT8JL8qdwN99K Ht2QqX9nXA8koqR9dJNagHYbUI4XrfErwaeZfQcvxAkVgP874mU= =zO4q -----END PGP SIGNATURE----- --16D8GuYtCIqn7d7wfja38ghCJzbEBtXUT-- From nobody Mon Jul 27 15:15:19 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B87FC3A08DB for ; Mon, 27 Jul 2020 15:15:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9G7Vq6KhNQdA for ; Mon, 27 Jul 2020 15:15:16 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 36FEA3A08D7 for ; Mon, 27 Jul 2020 15:15:16 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 166B3C3F16 for ; Mon, 27 Jul 2020 22:15:16 +0000 (UTC) From: Paul Vixie To: add@ietf.org Date: Mon, 27 Jul 2020 22:15:14 +0000 Message-ID: <1957130.hhA8xDH1S8@linux-9daj> Organization: none In-Reply-To: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <31921523.VjnSb2Omm3@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 22:15:18 -0000 On Monday, 27 July 2020 22:04:55 UTC Rob Sayre wrote: > On Mon, Jul 27, 2020 at 3:01 PM Paul Vixie wrote: > > i'd like ADD to recommend a protocol by which policy violations... > > Off-topic. attempts at quick dismissal are unhelpful. if ADD WG ultimately decides not to address predicted, defined, known, deliberate failure modes, by adding explicit signaling for those "abuse cases", it'll be after we discuss it. -- Paul From nobody Mon Jul 27 15:18:45 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA3CB3A08C1 for ; Mon, 27 Jul 2020 15:18:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.918 X-Spam-Level: X-Spam-Status: No, score=-1.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sp2V0gRdUgkM for ; Mon, 27 Jul 2020 15:18:41 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B2063A08D7 for ; Mon, 27 Jul 2020 15:18:41 -0700 (PDT) Received: from pps.filterd (m0049297.ppops.net [127.0.0.1]) by m0049297.ppops.net-00191d01. (8.16.0.42/8.16.0.42) with SMTP id 06RMCpsc015305; Mon, 27 Jul 2020 18:18:40 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049297.ppops.net-00191d01. with ESMTP id 32h2avanu3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 27 Jul 2020 18:18:40 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id 06RMIcd4029729; Mon, 27 Jul 2020 18:18:39 -0400 Received: from zlp30488.vci.att.com (zlp30488.vci.att.com [135.47.91.93]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id 06RMIURg029574 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 27 Jul 2020 18:18:30 -0400 Received: from zlp30488.vci.att.com (zlp30488.vci.att.com [127.0.0.1]) by zlp30488.vci.att.com (Service) with ESMTP id 48CD9400A0AA; Mon, 27 Jul 2020 22:18:30 +0000 (GMT) Received: from GAALPA1MSGEX1CB.ITServices.sbc.com (unknown [135.50.89.109]) by zlp30488.vci.att.com (Service) with ESMTPS id 2A610400A0A9; Mon, 27 Jul 2020 22:18:30 +0000 (GMT) Received: from GAALPA1MSGEX1CB.ITServices.sbc.com (135.50.89.109) by GAALPA1MSGEX1CB.ITServices.sbc.com (135.50.89.109) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2044.4; Mon, 27 Jul 2020 18:18:29 -0400 Received: from GAALPA1MSGEX1CB.ITServices.sbc.com ([135.50.89.109]) by GAALPA1MSGEX1CB.ITServices.sbc.com ([135.50.89.109]) with mapi id 15.01.2044.004; Mon, 27 Jul 2020 18:18:29 -0400 From: "STARK, BARBARA H" To: "'Rob Sayre'" , "'Paul Vixie'" CC: "'ADD Mailing list'" Thread-Topic: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWYPt3OHaMDZXq/k6uxgSbk76xS6kVmW8AgAAFI4CAAQ8igIAAiSwAgASOEACAAGpqAIAAB+MAgAAEnwCAAAUegIAAAtyAgAABLID//723kA== Date: Mon, 27 Jul 2020 22:18:29 +0000 Message-ID: <43c2ce46a20b449ea4a17de5194bf16b@att.com> References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.10.89.35] x-tm-snts-smtp: E2BDD4D62C5D72EB4D3BCEF5FF49D9FCCD5B22D5C2BA59B8755149FB0D7B9F7E2 Content-Type: multipart/alternative; boundary="_000_43c2ce46a20b449ea4a17de5194bf16battcom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-27_15:2020-07-27, 2020-07-27 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 clxscore=1011 phishscore=0 mlxlogscore=999 mlxscore=0 lowpriorityscore=0 spamscore=0 impostorscore=0 malwarescore=0 adultscore=0 bulkscore=0 suspectscore=0 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007270148 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 22:18:44 -0000 --_000_43c2ce46a20b449ea4a17de5194bf16battcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQoNCkZyb206IFJvYiBTYXlyZQ0KDQpPbiBNb24sIEp1bCAyNywgMjAyMCBhdCAzOjAxIFBNIFBh dWwgVml4aWUgPHBhdWxAcmVkYmFybi5vcmc8bWFpbHRvOnBhdWxAcmVkYmFybi5vcmc+PiB3cm90 ZToNCg0KaSdkIGxpa2UgQUREIHRvIHJlY29tbWVuZCBhIHByb3RvY29sIGJ5IHdoaWNoIHBvbGlj eSB2aW9sYXRpb25zLi4uDQoNCk9mZi10b3BpYy4NCg0KPEJIUz4gRnJvbSB0aGUgQUREIGNoYXJ0 ZXI6DQotIERldmVsb3AgYW4gaW5mb3JtYXRpb25hbCBkb2N1bWVudCB0aGF0IGRlc2NyaWJlcyBt ZWNoYW5pc21zIGZvcg0KY2xpZW50cyB0byBkZXRlY3Qgc3BlY2lmaWMgbmV0d29yayBlbnZpcm9u bWVudHMgKHN1Y2ggYXMgY2FwdGl2ZSBwb3J0YWwNCmFuZCBzcGxpdCBob3Jpem9uKSBhbmQgdG8g dXNlIHRoYXQgaW5mb3JtYXRpb24gdG8gaW5mb3JtIHRoZWlyIEROUw0KY29uZmlndXJhdGlvbi4N Cg0KU2luY2UgdGhpcyBpcyBpbiB0aGUgY2hhcnRlciwgZGlzY3Vzc2lvbiBvZiBzdWNoIG1lY2hh bmlzbXMgYXBwZWFyIHRvIG1lIHRvIGJlIGZpcm1seSDigJxvbiB0b3BpY+KAnS4gQnV0IEkgZGVm ZXIgdG8gdGhlIGNoYWlycyB0byBkZWNpZGUgaWYgY29uc2lkZXJpbmcgcHJvdG9jb2wgbWVjaGFu aXNtcyB0byBjb21tdW5pY2F0ZSBpbmZvcm1hdGlvbiBhYm91dCB0aGUgc3BlY2lmaWMgbmV0d29y ayBlbnZpcm9ubWVudCBhcmUgb2ZmIHRvcGljLiBQZXIgdGhlIGNoYXJ0ZXIsIGV2ZW4gaWYgdGhl IHByb3RvY29sIG1lY2hhbmlzbXMgYXJlIG5ldywgdGhleSB3b3VsZCBoYXZlIHRvIGJlIGluIGFu IGluZm9ybWF0aW9uYWwgZG9jdW1lbnQuIEJ1dCB0aGF04oCZcyBuZXZlciBzdG9wcGVkIGFueW9u ZSBmcm9tIGltcGxlbWVudGluZyBzb21ldGhpbmcgaWYgaXTigJlzIHVzZWZ1bC48L0JIUz4NCg== --_000_43c2ce46a20b449ea4a17de5194bf16battcom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IlByb2dJZCIg Y29udGVudD0iV29yZC5Eb2N1bWVudCI+DQo8bWV0YSBuYW1lPSJHZW5lcmF0b3IiIGNvbnRlbnQ9 Ik1pY3Jvc29mdCBXb3JkIDE1Ij4NCjxtZXRhIG5hbWU9Ik9yaWdpbmF0b3IiIGNvbnRlbnQ9Ik1p Y3Jvc29mdCBXb3JkIDE1Ij4NCjxsaW5rIHJlbD0iRmlsZS1MaXN0IiBocmVmPSJjaWQ6ZmlsZWxp c3QueG1sQDAxRDY2NDM5LkVGN0IzMTcwIj48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOk9m ZmljZURvY3VtZW50U2V0dGluZ3M+DQo8bzpBbGxvd1BORy8+DQo8bzpEb05vdFJlbHlPbkNTUy8+ DQo8L286T2ZmaWNlRG9jdW1lbnRTZXR0aW5ncz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPHc6V29yZERvY3VtZW50Pg0KPHc6U3BlbGxpbmdTdGF0ZT5DbGVh bjwvdzpTcGVsbGluZ1N0YXRlPg0KPHc6RG9jdW1lbnRLaW5kPkRvY3VtZW50RW1haWw8L3c6RG9j dW1lbnRLaW5kPg0KPHc6VHJhY2tNb3Zlcy8+DQo8dzpUcmFja0Zvcm1hdHRpbmcvPg0KPHc6RW52 ZWxvcGVWaXMvPg0KPHc6VmFsaWRhdGVBZ2FpbnN0U2NoZW1hcy8+DQo8dzpTYXZlSWZYTUxJbnZh bGlkPmZhbHNlPC93OlNhdmVJZlhNTEludmFsaWQ+DQo8dzpJZ25vcmVNaXhlZENvbnRlbnQ+ZmFs c2U8L3c6SWdub3JlTWl4ZWRDb250ZW50Pg0KPHc6QWx3YXlzU2hvd1BsYWNlaG9sZGVyVGV4dD5m YWxzZTwvdzpBbHdheXNTaG93UGxhY2Vob2xkZXJUZXh0Pg0KPHc6RG9Ob3RQcm9tb3RlUUYvPg0K PHc6TGlkVGhlbWVPdGhlcj5FTi1VUzwvdzpMaWRUaGVtZU90aGVyPg0KPHc6TGlkVGhlbWVBc2lh bj5YLU5PTkU8L3c6TGlkVGhlbWVBc2lhbj4NCjx3OkxpZFRoZW1lQ29tcGxleFNjcmlwdD5YLU5P TkU8L3c6TGlkVGhlbWVDb21wbGV4U2NyaXB0Pg0KPHc6Q29tcGF0aWJpbGl0eT4NCjx3OkRvTm90 RXhwYW5kU2hpZnRSZXR1cm4vPg0KPHc6QnJlYWtXcmFwcGVkVGFibGVzLz4NCjx3OlNuYXBUb0dy aWRJbkNlbGwvPg0KPHc6V3JhcFRleHRXaXRoUHVuY3QvPg0KPHc6VXNlQXNpYW5CcmVha1J1bGVz Lz4NCjx3OkRvbnRHcm93QXV0b2ZpdC8+DQo8dzpTcGxpdFBnQnJlYWtBbmRQYXJhTWFyay8+DQo8 dzpFbmFibGVPcGVuVHlwZUtlcm5pbmcvPg0KPHc6RG9udEZsaXBNaXJyb3JJbmRlbnRzLz4NCjx3 Ok92ZXJyaWRlVGFibGVTdHlsZUhwcy8+DQo8L3c6Q29tcGF0aWJpbGl0eT4NCjxtOm1hdGhQcj4N CjxtOm1hdGhGb250IG06dmFsPSJDYW1icmlhIE1hdGgiLz4NCjxtOmJya0JpbiBtOnZhbD0iYmVm b3JlIi8+DQo8bTpicmtCaW5TdWIgbTp2YWw9IiYjNDU7LSIvPg0KPG06c21hbGxGcmFjIG06dmFs PSJvZmYiLz4NCjxtOmRpc3BEZWYvPg0KPG06bE1hcmdpbiBtOnZhbD0iMCIvPg0KPG06ck1hcmdp biBtOnZhbD0iMCIvPg0KPG06ZGVmSmMgbTp2YWw9ImNlbnRlckdyb3VwIi8+DQo8bTp3cmFwSW5k ZW50IG06dmFsPSIxNDQwIi8+DQo8bTppbnRMaW0gbTp2YWw9InN1YlN1cCIvPg0KPG06bmFyeUxp bSBtOnZhbD0idW5kT3ZyIi8+DQo8L206bWF0aFByPjwvdzpXb3JkRG9jdW1lbnQ+DQo8L3htbD48 IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjx3OkxhdGVudFN0eWxlcyBEZWZM b2NrZWRTdGF0ZT0iZmFsc2UiIERlZlVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgRGVmU2VtaUhpZGRl bj0iZmFsc2UiIERlZlFGb3JtYXQ9ImZhbHNlIiBEZWZQcmlvcml0eT0iOTkiIExhdGVudFN0eWxl Q291bnQ9IjM3NyI+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjAi IFFGb3JtYXQ9InRydWUiIE5hbWU9Ik5vcm1hbCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI5IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDEiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIgU2VtaUhpZGRlbj0idHJ1 ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFGb3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgMiIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI5IiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iaGVhZGlu ZyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjkiIFNlbWlI aWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJo ZWFkaW5nIDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFGb3JtYXQ9InRydWUiIE5h bWU9ImhlYWRpbmcgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZvcm1hdD0idHJ1 ZSIgTmFtZT0iaGVhZGluZyA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBRRm9ybWF0 PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iOSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFG b3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iaGVhZGluZyA5Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 ImluZGV4IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0 cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iaW5kZXggMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJpbmRleCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhp ZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImluZGV4IDQiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iaW5kZXggNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJpbmRleCA2Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRl V2hlblVzZWQ9InRydWUiIE5hbWU9ImluZGV4IDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iaW5k ZXggOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJpbmRleCA5Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0idG9jIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBO YW1lPSJ0b2MgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIz OSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9InRvYyAzIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9jIDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0b2MgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSIzOSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRy dWUiIE5hbWU9InRvYyA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjM5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9j IDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlI aWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0b2MgOCIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzOSIgU2VtaUhpZGRlbj0idHJ1ZSIg VW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9InRvYyA5Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 Ik5vcm1hbCBJbmRlbnQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlk ZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iZm9vdG5vdGUgdGV4dCIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdo ZW5Vc2VkPSJ0cnVlIiBOYW1lPSJhbm5vdGF0aW9uIHRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFt ZT0iaGVhZGVyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImZvb3RlciIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJpbmRleCBoZWFkaW5nIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjM1IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZv cm1hdD0idHJ1ZSIgTmFtZT0iY2FwdGlvbiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0YWJsZSBv ZiBmaWd1cmVzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImVudmVsb3BlIGFkZHJlc3MiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iZW52ZWxvcGUgcmV0dXJuIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 ImZvb3Rub3RlIHJlZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJhbm5vdGF0aW9uIHJl ZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJsaW5lIG51bWJlciIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJwYWdlIG51bWJlciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJlbmRub3RlIHJl ZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJlbmRub3RlIHRleHQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0idGFibGUgb2YgYXV0aG9yaXRpZXMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i bWFjcm8iLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9hIGhlYWRpbmciLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IEJ1bGxldCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0 IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iTGlzdCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 Ikxpc3QgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IDUiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBCdWxsZXQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IEJ1bGxldCAz Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxpc3QgQnVsbGV0IDQiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBCdWxsZXQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxpc3QgTnVtYmVyIDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBOdW1iZXIgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciA1 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjEwIiBRRm9ybWF0 PSJ0cnVlIiBOYW1lPSJUaXRsZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJDbG9zaW5nIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hl blVzZWQ9InRydWUiIE5hbWU9IlNpZ25hdHVyZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSIxIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iRGVmYXVsdCBQYXJhZ3JhcGggRm9udCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJC b2R5IFRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0 cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEluZGVudCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJMaXN0IENvbnRpbnVlIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxp c3QgQ29udGludWUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IENvbnRpbnVlIDMiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iTGlzdCBDb250aW51ZSA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9Ikxpc3QgQ29udGludWUgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJNZXNzYWdlIEhlYWRl ciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIxMSIgUUZvcm1h dD0idHJ1ZSIgTmFtZT0iU3VidGl0bGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iU2FsdXRhdGlv biIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJEYXRlIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkJv ZHkgVGV4dCBGaXJzdCBJbmRlbnQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBT ZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEZp cnN0IEluZGVudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRl bj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ik5vdGUgSGVhZGluZyIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJCb2R5IFRleHQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCb2R5 IFRleHQgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCb2R5IFRleHQgSW5kZW50IDIiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEluZGVudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9IkJsb2NrIFRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlk ZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSHlwZXJsaW5rIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVz ZWQ9InRydWUiIE5hbWU9IkZvbGxvd2VkSHlwZXJsaW5rIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjIyIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJTdHJvbmciLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMjAiIFFGb3JtYXQ9InRy dWUiIE5hbWU9IkVtcGhhc2lzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2Vt aUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkRvY3VtZW50IE1hcCIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJQbGFpbiBUZXh0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IkUtbWFpbCBTaWduYXR1cmUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1p SGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBUb3Agb2YgRm9y bSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIEJvdHRvbSBvZiBGb3JtIi8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9 InRydWUiIE5hbWU9Ik5vcm1hbCAoV2ViKSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIEFj cm9ueW0iLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBBZGRyZXNzIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRy dWUiIE5hbWU9IkhUTUwgQ2l0ZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIENvZGUiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBEZWZpbml0aW9uIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9IkhUTUwgS2V5Ym9hcmQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1p SGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBQcmVmb3JtYXR0 ZWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBTYW1wbGUiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iSFRNTCBUeXBld3JpdGVyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkhUTUwgVmFyaWFi bGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iYW5ub3RhdGlvbiBzdWJqZWN0Ii8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9 InRydWUiIE5hbWU9Ik5vIExpc3QiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBT ZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iT3V0bGluZSBMaXN0 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iT3V0bGluZSBMaXN0IDIiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iT3V0bGluZSBMaXN0IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgU2lt cGxlIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgU2ltcGxlIDIiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0iVGFibGUgU2ltcGxlIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUg Q2xhc3NpYyAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENsYXNzaWMgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDbGFzc2ljIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i VGFibGUgQ2xhc3NpYyA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhp ZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENvbG9yZnVsIDEi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhp ZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgQ29sb3JmdWwgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJUYWJsZSBDb2xvcmZ1bCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENv bHVtbnMgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDb2x1bW5zIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgQ29sdW1ucyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRh YmxlIENvbHVtbnMgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDb2x1bW5zIDUiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IlRhYmxlIEdyaWQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBHcmlkIDMiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRh YmxlIEdyaWQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49 InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBHcmlkIDYiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCA3Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxl IEdyaWQgOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDEiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0iVGFibGUgTGlzdCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIExp c3QgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iVGFibGUgTGlzdCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIExpc3Qg NiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDciLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iVGFibGUgTGlzdCA4Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2Vt aUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIDNEIGVmZmVj dHMgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSAzRCBlZmZlY3RzIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgM0QgZWZmZWN0cyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IlRhYmxlIENvbnRlbXBvcmFyeSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBFbGVnYW50 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIFByb2Zlc3Npb25hbCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJUYWJsZSBTdWJ0bGUgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBT dWJ0bGUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBXZWIgMSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJUYWJsZSBXZWIgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCYWxsb29uIFRl eHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIE5hbWU9 IlRhYmxlIEdyaWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVu PSJ0cnVlIiBOYW1lPSJQbGFjZWhvbGRlciBUZXh0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjEiIFFGb3JtYXQ9InRydWUiIE5hbWU9Ik5vIFNwYWNpbmciLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIE5hbWU9IkxpZ2h0 IFNoYWRpbmciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEi IE5hbWU9IkxpZ2h0IExpc3QiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjIiIE5hbWU9IkxpZ2h0IEdyaWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjMiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDEiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjQiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIE5hbWU9Ik1l ZGl1bSBMaXN0IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NjYiIE5hbWU9Ik1lZGl1bSBMaXN0IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1bSBHcmlkIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5hbWU9Ik1lZGl1bSBHcmlk IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9 IkRhcmsgTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGluZyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI3MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9u IExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgTmFtZT0iQ29sb3JmdWwgR3JpZCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQgU2hh ZGluZyBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2MSIgTmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgMSIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVtIFNo YWRpbmcgMSBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI2NCIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMiBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2Nl bnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IE5hbWU9IlJldmlzaW9uIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjM0IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJMaXN0IFBhcmFncmFwaCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIyOSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0i UXVvdGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzAiIFFG b3JtYXQ9InRydWUiIE5hbWU9IkludGVuc2UgUXVvdGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIE5hbWU9Ik1lZGl1bSBMaXN0IDIgQWNjZW50IDEiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1 bSBHcmlkIDEgQWNjZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNjZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5hbWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9 IkRhcmsgTGlzdCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI3MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGluZyBBY2NlbnQgMSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCBB Y2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIg TmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQgU2hhZGluZyBBY2NlbnQgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MSIgTmFtZT0iTGlnaHQgTGlz dCBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2 MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMSBBY2NlbnQgMiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NCIgTmFtZT0iTWVkaXVt IFNoYWRpbmcgMiBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIgTmFtZT0iTWVkaXVtIExpc3QgMiBBY2Nl bnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NyIgTmFt ZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI2OCIgTmFtZT0iTWVkaXVtIEdyaWQgMiBBY2NlbnQgMiIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OSIgTmFtZT0iTWVkaXVtIEdyaWQg MyBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MCIgTmFtZT0iRGFyayBMaXN0IEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjcxIiBOYW1lPSJDb2xvcmZ1bCBTaGFkaW5nIEFjY2VudCAyIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcyIiBOYW1lPSJDb2xvcmZ1 bCBMaXN0IEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjczIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYwIiBOYW1lPSJMaWdodCBTaGFkaW5nIEFjY2VudCAz Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYxIiBOYW1lPSJM aWdodCBMaXN0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjYyIiBOYW1lPSJMaWdodCBHcmlkIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAxIEFjY2Vu dCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY0IiBOYW1l PSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjY1IiBOYW1lPSJNZWRpdW0gTGlzdCAxIEFjY2VudCAzIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY2IiBOYW1lPSJNZWRpdW0gTGlz dCAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjY3IiBOYW1lPSJNZWRpdW0gR3JpZCAxIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBOYW1lPSJNZWRpdW0gR3JpZCAyIEFjY2VudCAzIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY5IiBOYW1lPSJNZWRp dW0gR3JpZCAzIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjcwIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzEiIE5hbWU9IkNvbG9yZnVsIFNoYWRpbmcgQWNjZW50 IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzIiIE5hbWU9 IkNvbG9yZnVsIExpc3QgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNzMiIE5hbWU9IkNvbG9yZnVsIEdyaWQgQWNjZW50IDMiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIE5hbWU9IkxpZ2h0IFNoYWRpbmcg QWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEi IE5hbWU9IkxpZ2h0IExpc3QgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjIiIE5hbWU9IkxpZ2h0IEdyaWQgQWNjZW50IDQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjMiIE5hbWU9Ik1lZGl1bSBTaGFkaW5n IDEgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NjQiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIE5hbWU9Ik1lZGl1bSBMaXN0IDEgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIE5hbWU9Ik1l ZGl1bSBMaXN0IDIgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1bSBHcmlkIDEgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNj ZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5h bWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9IkRhcmsgTGlzdCBBY2NlbnQgNCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGlu ZyBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgTmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgNCIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQg U2hhZGluZyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI2MSIgTmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgNSIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVt IFNoYWRpbmcgMSBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2NCIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBB Y2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIg TmFtZT0iTWVkaXVtIExpc3QgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2NyIgTmFtZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgNSIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OCIgTmFtZT0iTWVkaXVtIEdy aWQgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2OSIgTmFtZT0iTWVkaXVtIEdyaWQgMyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MCIgTmFtZT0iRGFyayBMaXN0IEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcxIiBOYW1lPSJDb2xvcmZ1 bCBTaGFkaW5nIEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjcyIiBOYW1lPSJDb2xvcmZ1bCBMaXN0IEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNlcHRp b24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjczIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2Vu dCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYwIiBOYW1l PSJMaWdodCBTaGFkaW5nIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjYxIiBOYW1lPSJMaWdodCBMaXN0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYyIiBOYW1lPSJMaWdodCBHcmlkIEFjY2Vu dCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBOYW1l PSJNZWRpdW0gU2hhZGluZyAxIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjY0IiBOYW1lPSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCA2Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY1IiBOYW1lPSJNZWRpdW0g TGlzdCAxIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjY2IiBOYW1lPSJNZWRpdW0gTGlzdCAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY3IiBOYW1lPSJNZWRpdW0gR3JpZCAxIEFjY2VudCA2 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBOYW1lPSJN ZWRpdW0gR3JpZCAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjY5IiBOYW1lPSJNZWRpdW0gR3JpZCAzIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcwIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50 IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzEiIE5hbWU9 IkNvbG9yZnVsIFNoYWRpbmcgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNzIiIE5hbWU9IkNvbG9yZnVsIExpc3QgQWNjZW50IDYiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzMiIE5hbWU9IkNvbG9yZnVsIEdy aWQgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i MTkiIFFGb3JtYXQ9InRydWUiIE5hbWU9IlN1YnRsZSBFbXBoYXNpcyIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIyMSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iSW50 ZW5zZSBFbXBoYXNpcyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSIzMSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iU3VidGxlIFJlZmVyZW5jZSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzMiIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0i SW50ZW5zZSBSZWZlcmVuY2UiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iMzMiIFFGb3JtYXQ9InRydWUiIE5hbWU9IkJvb2sgVGl0bGUiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzciIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCaWJsaW9ncmFwaHkiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJUT0MgSGVhZGluZyIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MSIgTmFtZT0iUGxhaW4gVGFibGUgMSIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MiIgTmFtZT0iUGxh aW4gVGFibGUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0 MyIgTmFtZT0iUGxhaW4gVGFibGUgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0NCIgTmFtZT0iUGxhaW4gVGFibGUgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NSIgTmFtZT0iUGxhaW4gVGFibGUgNSIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MCIgTmFtZT0iR3JpZCBUYWJsZSBM aWdodCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFt ZT0iR3JpZCBUYWJsZSAxIExpZ2h0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iR3JpZCBUYWJsZSA0Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1lPSJHcmlk IFRhYmxlIDUgRGFyayIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2IENvbG9yZnVsIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9IkdyaWQg VGFibGUgMSBMaWdodCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0NyIgTmFtZT0iR3JpZCBUYWJsZSAyIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ4IiBOYW1lPSJHcmlkIFRhYmxlIDMgQWNj ZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5h bWU9IkdyaWQgVGFibGUgNCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iR3JpZCBUYWJsZSA1IERhcmsgQWNjZW50IDEiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9IkdyaWQgVGFi bGUgNiBDb2xvcmZ1bCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI1MiIgTmFtZT0iR3JpZCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCAxIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJHcmlkIFRh YmxlIDEgTGlnaHQgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNDciIE5hbWU9IkdyaWQgVGFibGUgMiBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OCIgTmFtZT0iR3JpZCBUYWJsZSAzIEFjY2Vu dCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1l PSJHcmlkIFRhYmxlIDQgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNTAiIE5hbWU9IkdyaWQgVGFibGUgNSBEYXJrIEFjY2VudCAyIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJHcmlkIFRhYmxl IDYgQ29sb3JmdWwgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNTIiIE5hbWU9IkdyaWQgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iR3JpZCBUYWJs ZSAxIExpZ2h0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyBBY2NlbnQg MyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0i R3JpZCBUYWJsZSA0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjUwIiBOYW1lPSJHcmlkIFRhYmxlIDUgRGFyayBBY2NlbnQgMyIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2 IENvbG9yZnVsIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDMiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9IkdyaWQgVGFibGUg MSBMaWdodCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI0NyIgTmFtZT0iR3JpZCBUYWJsZSAyIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ4IiBOYW1lPSJHcmlkIFRhYmxlIDMgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikdy aWQgVGFibGUgNCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI1MCIgTmFtZT0iR3JpZCBUYWJsZSA1IERhcmsgQWNjZW50IDQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9IkdyaWQgVGFibGUgNiBD b2xvcmZ1bCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI1MiIgTmFtZT0iR3JpZCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCA0Ii8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJHcmlkIFRhYmxlIDEg TGlnaHQgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNDciIE5hbWU9IkdyaWQgVGFibGUgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OCIgTmFtZT0iR3JpZCBUYWJsZSAzIEFjY2VudCA1Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJHcmlk IFRhYmxlIDQgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNTAiIE5hbWU9IkdyaWQgVGFibGUgNSBEYXJrIEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJHcmlkIFRhYmxlIDYgQ29s b3JmdWwgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNTIiIE5hbWU9IkdyaWQgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgNSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iR3JpZCBUYWJsZSAxIExp Z2h0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyBBY2NlbnQgNiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iR3JpZCBU YWJsZSA0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjUwIiBOYW1lPSJHcmlkIFRhYmxlIDUgRGFyayBBY2NlbnQgNiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2IENvbG9y ZnVsIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdo dCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0i TGlzdCBUYWJsZSAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iTGlzdCBUYWJsZSA1IERhcmsiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFi bGUgNiBDb2xvcmZ1bCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI1MiIgTmFtZT0iTGlzdCBUYWJsZSA3IENvbG9yZnVsIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJMaXN0IFRhYmxlIDEgTGlnaHQgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDciIE5hbWU9 Ikxpc3QgVGFibGUgMiBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0OCIgTmFtZT0iTGlzdCBUYWJsZSAzIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJMaXN0IFRhYmxlIDQgQWNj ZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTAiIE5h bWU9Ikxpc3QgVGFibGUgNSBEYXJrIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJMaXN0IFRhYmxlIDYgQ29sb3JmdWwgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTIiIE5hbWU9 Ikxpc3QgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iTGlzdCBUYWJsZSAxIExpZ2h0IEFjY2VudCAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ3IiBOYW1lPSJM aXN0IFRhYmxlIDIgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNDgiIE5hbWU9Ikxpc3QgVGFibGUgMyBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iTGlzdCBUYWJsZSA0IEFjY2Vu dCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1l PSJMaXN0IFRhYmxlIDUgRGFyayBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iTGlzdCBUYWJsZSA2IENvbG9yZnVsIEFjY2VudCAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJM aXN0IFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdodCBBY2NlbnQgMyIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0iTGlz dCBUYWJsZSAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCBBY2NlbnQg MyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0i TGlzdCBUYWJsZSA1IERhcmsgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFibGUgNiBDb2xvcmZ1bCBBY2NlbnQgMyIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MiIgTmFtZT0iTGlz dCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJMaXN0IFRhYmxlIDEgTGlnaHQgQWNjZW50IDQiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDciIE5hbWU9Ikxpc3Qg VGFibGUgMiBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI0OCIgTmFtZT0iTGlzdCBUYWJsZSAzIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJMaXN0IFRhYmxlIDQgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTAiIE5hbWU9Ikxp c3QgVGFibGUgNSBEYXJrIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJMaXN0IFRhYmxlIDYgQ29sb3JmdWwgQWNjZW50IDQiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTIiIE5hbWU9Ikxpc3Qg VGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iTGlzdCBUYWJsZSAxIExpZ2h0IEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ3IiBOYW1lPSJMaXN0IFRh YmxlIDIgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNDgiIE5hbWU9Ikxpc3QgVGFibGUgMyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iTGlzdCBUYWJsZSA0IEFjY2VudCA1Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1lPSJMaXN0 IFRhYmxlIDUgRGFyayBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI1MSIgTmFtZT0iTGlzdCBUYWJsZSA2IENvbG9yZnVsIEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJMaXN0IFRh YmxlIDcgQ29sb3JmdWwgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdodCBBY2NlbnQgNiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0iTGlzdCBUYWJs ZSAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCBBY2NlbnQgNiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iTGlzdCBU YWJsZSA1IERhcmsgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFibGUgNiBDb2xvcmZ1bCBBY2NlbnQgNiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MiIgTmFtZT0iTGlzdCBUYWJs ZSA3IENvbG9yZnVsIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ik1lbnRpb24iLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iU21hcnQgSHlwZXJsaW5rIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9Ikhhc2h0YWciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVW5yZXNvbHZlZCBNZW50aW9uIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRl V2hlblVzZWQ9InRydWUiIE5hbWU9IlNtYXJ0IExpbmsiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i U21hcnQgTGluayBFcnJvciIvPg0KPC93OkxhdGVudFN0eWxlcz4NCjwveG1sPjwhW2VuZGlmXS0t PjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYgMyAyIDQ7DQoJ bXNvLWZvbnQtY2hhcnNldDowOw0KCW1zby1nZW5lcmljLWZvbnQtZmFtaWx5OnJvbWFuOw0KCW1z by1mb250LXBpdGNoOnZhcmlhYmxlOw0KCW1zby1mb250LXNpZ25hdHVyZTotNTM2ODY5MTIxIDEx MDczMDU3MjcgMzM1NTQ0MzIgMCA0MTUgMDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNh bGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7DQoJbXNvLWZvbnQtY2hhcnNl dDowOw0KCW1zby1nZW5lcmljLWZvbnQtZmFtaWx5OnN3aXNzOw0KCW1zby1mb250LXBpdGNoOnZh cmlhYmxlOw0KCW1zby1mb250LXNpZ25hdHVyZTotNTM2ODU4ODgxIC0xMDczNzMyNDg1IDkgMCA1 MTEgMDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1h bCwgZGl2Lk1zb05vcm1hbA0KCXttc28tc3R5bGUtdW5oaWRlOm5vOw0KCW1zby1zdHlsZS1xZm9y bWF0OnllczsNCgltc28tc3R5bGUtcGFyZW50OiIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJv dHRvbTouMDAwMXB0Ow0KCW1zby1wYWdpbmF0aW9uOndpZG93LW9ycGhhbjsNCglmb250LXNpemU6 MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0 LWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28t c3R5bGUtbm9zaG93OnllczsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsN Cgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lOw0KCXRleHQtdW5kZXJsaW5lOnNpbmdsZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLW5vc2hvdzp5 ZXM7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29y YXRpb246dW5kZXJsaW5lOw0KCXRleHQtdW5kZXJsaW5lOnNpbmdsZTt9DQpwLm1zb25vcm1hbDAs IGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1h bDsNCgltc28tc3R5bGUtdW5oaWRlOm5vOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1h cmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxl ZnQ6MGluOw0KCW1zby1wYWdpbmF0aW9uOndpZG93LW9ycGhhbjsNCglmb250LXNpemU6MTEuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0LWZvbnQt ZmFtaWx5OkNhbGlicmk7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVy c29uYWwtcmVwbHk7DQoJbXNvLXN0eWxlLW5vc2hvdzp5ZXM7DQoJbXNvLXN0eWxlLXVuaGlkZTpu bzsNCgltc28tYW5zaS1mb250LXNpemU6MTEuMHB0Ow0KCW1zby1iaWRpLWZvbnQtc2l6ZToxMS4w cHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWFzY2lpLWZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28t aGFuc2ktZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1z dHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCW1zby1kZWZhdWx0LXByb3BzOnllczsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgltc28tYXNjaWktZm9udC1mYW1pbHk6Q2FsaWJy aTsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1oYW5zaS1mb250LWZh bWlseTpDYWxpYnJpOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4g MS4waW4gMS4waW4gMS4waW47DQoJbXNvLWhlYWRlci1tYXJnaW46LjVpbjsNCgltc28tZm9vdGVy LW1hcmdpbjouNWluOw0KCW1zby1wYXBlci1zb3VyY2U6MDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJ e3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDEwXT48c3R5 bGU+LyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnRhYmxlLk1zb05vcm1hbFRhYmxlDQoJe21zby1z dHlsZS1uYW1lOiJUYWJsZSBOb3JtYWwiOw0KCW1zby10c3R5bGUtcm93YmFuZC1zaXplOjA7DQoJ bXNvLXRzdHlsZS1jb2xiYW5kLXNpemU6MDsNCgltc28tc3R5bGUtbm9zaG93OnllczsNCgltc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLXBhcmVudDoiIjsNCgltc28tcGFkZGluZy1h bHQ6MGluIDUuNHB0IDBpbiA1LjRwdDsNCgltc28tcGFyYS1tYXJnaW46MGluOw0KCW1zby1wYXJh LW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCgltc28tcGFnaW5hdGlvbjp3aWRvdy1vcnBoYW47DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCglt c28tYXNjaWktZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28taGFuc2ktZm9udC1mYW1pbHk6Q2Fs aWJyaTsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQo8L3N0eWxl PjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2 OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAg djpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZd LS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBs ZSIgc3R5bGU9InRhYi1pbnRlcnZhbDouNWluIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYXNjaWktZm9udC1mYW1pbHk6Q2FsaWJyaTtt c28taGFuc2ktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28tYmlkaS1mb250LWZhbWlseTomcXVvdDtU aW1lcyBOZXcgUm9tYW4mcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYXNjaWktZm9udC1mYW1pbHk6Q2FsaWJyaTtt c28taGFuc2ktZm9udC1mYW1pbHk6Q2FsaWJyaTttc28tYmlkaS1mb250LWZhbWlseTomcXVvdDtU aW1lcyBOZXcgUm9tYW4mcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvZm9udD48L3A+ DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3Bh ZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGlicmki PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1mYXJlYXN0LWZvbnQtZmFtaWx5OiZx dW90O1RpbWVzIE5ldyBSb21hbiZxdW90Oztmb250LXdlaWdodDpib2xkIj5Gcm9tOjwvc3Bhbj48 L2ZvbnQ+PC9iPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1mb250LWZhbWlseTomcXVvdDtUaW1l cyBOZXcgUm9tYW4mcXVvdDsiPiBSb2IgU2F5cmU8YnIgc3R5bGU9Im1zby1zcGVjaWFsLWNoYXJh Y3RlcjpsaW5lLWJyZWFrIj4NCjwhW2lmICFzdXBwb3J0TGluZUJyZWFrTmV3TGluZV0+PGJyIHN0 eWxlPSJtc28tc3BlY2lhbC1jaGFyYWN0ZXI6bGluZS1icmVhayI+DQo8IVtlbmRpZl0+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQiPk9uIE1vbiwgSnVsIDI3LCAyMDIwIGF0IDM6MDEgUE0gUGF1bCBWaXhp ZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBhdWxAcmVkYmFybi5vcmciPnBhdWxAcmVkYmFybi5vcmc8 L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0ND Q0MgMS4wcHQ7bXNvLWJvcmRlci1sZWZ0LWFsdDpzb2xpZCAjQ0NDQ0NDIC43NXB0O3BhZGRpbmc6 MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdCI+PGJyPg0KaSdkIGxpa2UgQUREIHRvIHJlY29tbWVuZCBh IHByb3RvY29sIGJ5IHdoaWNoIHBvbGljeSB2aW9sYXRpb25zLi4uPG86cD48L286cD48L3NwYW4+ PC9mb250PjwvcD4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 Zm9udCBzaXplPSIyIiBmYWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9mb250PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9IjIiIGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij5PZmYtdG9waWMuPG86cD48L286cD48L3NwYW4+PC9mb250 PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9IjIi IGZhY2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQiPiZsdDtCSFMmZ3Q7IEZyb20gdGhlIEFERCBjaGFydGVyOg0KPG86cD48L286cD48 L3NwYW4+PC9mb250PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxmb250IHNpemU9IjIiIGZh Y2U9IkNhbGlicmkiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij4tIERldmVsb3AgYW4g aW5mb3JtYXRpb25hbCBkb2N1bWVudCB0aGF0IGRlc2NyaWJlcyBtZWNoYW5pc21zIGZvcjxicj4N CmNsaWVudHMgdG8gZGV0ZWN0IHNwZWNpZmljIG5ldHdvcmsgZW52aXJvbm1lbnRzIChzdWNoIGFz IGNhcHRpdmUgcG9ydGFsPGJyPg0KYW5kIHNwbGl0IGhvcml6b24pIGFuZCB0byB1c2UgdGhhdCBp bmZvcm1hdGlvbiB0byBpbmZvcm0gdGhlaXIgRE5TPGJyPg0KY29uZmlndXJhdGlvbi48bzpwPjwv bzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0i MiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWFzY2lp LWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWJp ZGktZm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6ZT0i MiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWFzY2lp LWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWJp ZGktZm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij5TaW5jZSB0aGlzIGlz IGluIHRoZSBjaGFydGVyLCBkaXNjdXNzaW9uIG9mIHN1Y2ggbWVjaGFuaXNtcyBhcHBlYXIgdG8g bWUgdG8NCiBiZSBmaXJtbHkg4oCcb24gdG9waWPigJ0uIEJ1dCBJIGRlZmVyIHRvIHRoZSBjaGFp cnMgdG8gZGVjaWRlIGlmIGNvbnNpZGVyaW5nIHByb3RvY29sIG1lY2hhbmlzbXMgdG8gY29tbXVu aWNhdGUgaW5mb3JtYXRpb24gYWJvdXQgdGhlIHNwZWNpZmljIG5ldHdvcmsgZW52aXJvbm1lbnQg YXJlIG9mZiB0b3BpYy4gUGVyIHRoZSBjaGFydGVyLCBldmVuIGlmIHRoZSBwcm90b2NvbCBtZWNo YW5pc21zIGFyZSBuZXcsIHRoZXkgd291bGQgaGF2ZSB0byBiZSBpbg0KIGFuIGluZm9ybWF0aW9u YWwgZG9jdW1lbnQuIEJ1dCB0aGF04oCZcyBuZXZlciBzdG9wcGVkIGFueW9uZSBmcm9tIGltcGxl bWVudGluZyBzb21ldGhpbmcgaWYgaXTigJlzIHVzZWZ1bC4mbHQ7L0JIUyZndDs8bzpwPjwvbzpw Pjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_43c2ce46a20b449ea4a17de5194bf16battcom_-- From nobody Mon Jul 27 15:20:58 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2CAF3A08D7 for ; Mon, 27 Jul 2020 15:20:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.919 X-Spam-Level: X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XKETNnXNCUlO for ; Mon, 27 Jul 2020 15:20:50 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 70C043A0824 for ; Mon, 27 Jul 2020 15:20:50 -0700 (PDT) Received: from pps.filterd (m0049287.ppops.net [127.0.0.1]) by m0049287.ppops.net-00191d01. (8.16.0.42/8.16.0.42) with SMTP id 06RMCcSa002500; Mon, 27 Jul 2020 18:20:49 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049287.ppops.net-00191d01. with ESMTP id 32h1y5aun3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 27 Jul 2020 18:20:48 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id 06RMKkY8000514; Mon, 27 Jul 2020 18:20:47 -0400 Received: from zlp30487.vci.att.com (zlp30487.vci.att.com [135.47.91.176]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id 06RMKhbv000472 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 27 Jul 2020 18:20:44 -0400 Received: from zlp30487.vci.att.com (zlp30487.vci.att.com [127.0.0.1]) by zlp30487.vci.att.com (Service) with ESMTP id EA54F4016D82; Mon, 27 Jul 2020 22:20:43 +0000 (GMT) Received: from GAALPA1MSGEX1CB.ITServices.sbc.com (unknown [135.50.89.109]) by zlp30487.vci.att.com (Service) with ESMTPS id CBD364016D81; Mon, 27 Jul 2020 22:20:43 +0000 (GMT) Received: from GAALPA1MSGEX1CB.ITServices.sbc.com (135.50.89.109) by GAALPA1MSGEX1CB.ITServices.sbc.com (135.50.89.109) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2044.4; Mon, 27 Jul 2020 18:20:43 -0400 Received: from GAALPA1MSGEX1CB.ITServices.sbc.com ([135.50.89.109]) by GAALPA1MSGEX1CB.ITServices.sbc.com ([135.50.89.109]) with mapi id 15.01.2044.004; Mon, 27 Jul 2020 18:20:43 -0400 From: "STARK, BARBARA H" To: "'Ted Lemon'" , "'Paul Vixie'" CC: "'add@ietf.org'" Thread-Topic: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWYPt3OHaMDZXq/k6uxgSbk76xS6kVmW8AgAAFI4CAAQ8igIAAiSwAgASOEACAAGpqAIAAB+MAgAAEnwCAAAUegIAAAtyAgAACaYD//7+PMA== Date: Mon, 27 Jul 2020 22:20:43 +0000 Message-ID: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.10.89.35] x-tm-snts-smtp: 803D40889477CD769BBAFB7E08557FDCF4BE14158CFA57F1F98FA9582EDDE6AA2 Content-Type: multipart/alternative; boundary="_000_a7f7adaf83db4ddfb01d816a3e3cb3f1attcom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-27_15:2020-07-27, 2020-07-27 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 mlxscore=0 bulkscore=0 mlxlogscore=999 lowpriorityscore=0 spamscore=0 phishscore=0 malwarescore=0 adultscore=0 clxscore=1015 impostorscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007270148 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 22:20:54 -0000 --_000_a7f7adaf83db4ddfb01d816a3e3cb3f1attcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 WW91IHRoaW5rIHRoYXQgdGhlIHdheSB0byBzb2x2ZSB0aGlzIHByb2JsZW0gaXMgZm9yIEFERCB0 byBzYXkg4oCcZG9u4oCZdCB1c2UgRG9ILuKAnSBCdXQgbWFueSBwYXJ0aWNpcGFudHMgaW4gQURE IGFyZSBoZXJlIHRvIGZpZ3VyZSBvdXQgaG93IHRvIGRvIERvSCwgYW5kIGFyZW7igJl0IGludGVy ZXN0ZWQgaW4geW91ciBvcGluaW9uIHRoYXQgdGhleSBzaG91bGQgbm90IGRvIGl0LiBJIHN1cHBv c2UgaXTigJlzIHRoZW9yZXRpY2FsbHkgcG9zc2libGUgdGhhdCB5b3UgY291bGQgY29tZSB1cCB3 aXRoIHNvbWUgYXJndW1lbnQgdGhhdCB3b3VsZCBjb252aW5jZSB0aGVtLCBidXQgSSBkb27igJl0 IGtub3cgd2hhdCBpdCB3b3VsZCBiZSwgYW5kIGNsZWFybHkgeW91IGRvbuKAmXQgZWl0aGVyLCBi ZWNhdXNlIHlvdSBoYXZlbuKAmXQgbWFkZSBhbnkgc3VjaCBhcmd1bWVudC4gWW91IGp1c3Qga2Vl cCByZXBlYXRpbmcgdGhlc2Ugc2xvZ2Fucy4gVGhhdOKAmXMgbm90IGdvaW5nIHRvIGdldCB0aGUg am9iIGRvbmUuDQoNCjxCSFM+IE5vLCBJIHRoaW5rIGl04oCZcyBhYm91dCBBREQgc2F5aW5nIOKA nGhlcmUgaXMgaG93IHRoZSBuZXR3b3JrIGNhbiB0ZWxsIGhvc3RzIGFuZCBhcHBzIHRoYXQgdGhl IG5ldHdvcmsgY29uc2lkZXJzIGFueXRoaW5nIGl0IGNhdGNoZXMgZG9pbmcgRG9IIHRvIGJlIG1h bHdhcmXigJ0uPC9CSFM+DQoNCg== --_000_a7f7adaf83db4ddfb01d816a3e3cb3f1attcom_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IlByb2dJZCIg Y29udGVudD0iV29yZC5Eb2N1bWVudCI+DQo8bWV0YSBuYW1lPSJHZW5lcmF0b3IiIGNvbnRlbnQ9 Ik1pY3Jvc29mdCBXb3JkIDE1Ij4NCjxtZXRhIG5hbWU9Ik9yaWdpbmF0b3IiIGNvbnRlbnQ9Ik1p Y3Jvc29mdCBXb3JkIDE1Ij4NCjxsaW5rIHJlbD0iRmlsZS1MaXN0IiBocmVmPSJjaWQ6ZmlsZWxp c3QueG1sQDAxRDY2NDNBLjQwOTlBNDYwIj48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOk9m ZmljZURvY3VtZW50U2V0dGluZ3M+DQo8bzpBbGxvd1BORy8+DQo8bzpEb05vdFJlbHlPbkNTUy8+ DQo8L286T2ZmaWNlRG9jdW1lbnRTZXR0aW5ncz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPHc6V29yZERvY3VtZW50Pg0KPHc6U3BlbGxpbmdTdGF0ZT5DbGVh bjwvdzpTcGVsbGluZ1N0YXRlPg0KPHc6RG9jdW1lbnRLaW5kPkRvY3VtZW50RW1haWw8L3c6RG9j dW1lbnRLaW5kPg0KPHc6VHJhY2tNb3Zlcy8+DQo8dzpUcmFja0Zvcm1hdHRpbmcvPg0KPHc6RW52 ZWxvcGVWaXMvPg0KPHc6VmFsaWRhdGVBZ2FpbnN0U2NoZW1hcy8+DQo8dzpTYXZlSWZYTUxJbnZh bGlkPmZhbHNlPC93OlNhdmVJZlhNTEludmFsaWQ+DQo8dzpJZ25vcmVNaXhlZENvbnRlbnQ+ZmFs c2U8L3c6SWdub3JlTWl4ZWRDb250ZW50Pg0KPHc6QWx3YXlzU2hvd1BsYWNlaG9sZGVyVGV4dD5m YWxzZTwvdzpBbHdheXNTaG93UGxhY2Vob2xkZXJUZXh0Pg0KPHc6RG9Ob3RQcm9tb3RlUUYvPg0K PHc6TGlkVGhlbWVPdGhlcj5FTi1VUzwvdzpMaWRUaGVtZU90aGVyPg0KPHc6TGlkVGhlbWVBc2lh bj5YLU5PTkU8L3c6TGlkVGhlbWVBc2lhbj4NCjx3OkxpZFRoZW1lQ29tcGxleFNjcmlwdD5YLU5P TkU8L3c6TGlkVGhlbWVDb21wbGV4U2NyaXB0Pg0KPHc6Q29tcGF0aWJpbGl0eT4NCjx3OkRvTm90 RXhwYW5kU2hpZnRSZXR1cm4vPg0KPHc6QnJlYWtXcmFwcGVkVGFibGVzLz4NCjx3OlNuYXBUb0dy aWRJbkNlbGwvPg0KPHc6V3JhcFRleHRXaXRoUHVuY3QvPg0KPHc6VXNlQXNpYW5CcmVha1J1bGVz Lz4NCjx3OkRvbnRHcm93QXV0b2ZpdC8+DQo8dzpTcGxpdFBnQnJlYWtBbmRQYXJhTWFyay8+DQo8 dzpFbmFibGVPcGVuVHlwZUtlcm5pbmcvPg0KPHc6RG9udEZsaXBNaXJyb3JJbmRlbnRzLz4NCjx3 Ok92ZXJyaWRlVGFibGVTdHlsZUhwcy8+DQo8L3c6Q29tcGF0aWJpbGl0eT4NCjxtOm1hdGhQcj4N CjxtOm1hdGhGb250IG06dmFsPSJDYW1icmlhIE1hdGgiLz4NCjxtOmJya0JpbiBtOnZhbD0iYmVm b3JlIi8+DQo8bTpicmtCaW5TdWIgbTp2YWw9IiYjNDU7LSIvPg0KPG06c21hbGxGcmFjIG06dmFs PSJvZmYiLz4NCjxtOmRpc3BEZWYvPg0KPG06bE1hcmdpbiBtOnZhbD0iMCIvPg0KPG06ck1hcmdp biBtOnZhbD0iMCIvPg0KPG06ZGVmSmMgbTp2YWw9ImNlbnRlckdyb3VwIi8+DQo8bTp3cmFwSW5k ZW50IG06dmFsPSIxNDQwIi8+DQo8bTppbnRMaW0gbTp2YWw9InN1YlN1cCIvPg0KPG06bmFyeUxp bSBtOnZhbD0idW5kT3ZyIi8+DQo8L206bWF0aFByPjwvdzpXb3JkRG9jdW1lbnQ+DQo8L3htbD48 IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjx3OkxhdGVudFN0eWxlcyBEZWZM b2NrZWRTdGF0ZT0iZmFsc2UiIERlZlVuaGlkZVdoZW5Vc2VkPSJmYWxzZSIgRGVmU2VtaUhpZGRl bj0iZmFsc2UiIERlZlFGb3JtYXQ9ImZhbHNlIiBEZWZQcmlvcml0eT0iOTkiIExhdGVudFN0eWxl Q291bnQ9IjM3NyI+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjAi IFFGb3JtYXQ9InRydWUiIE5hbWU9Ik5vcm1hbCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI5IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDEiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIgU2VtaUhpZGRlbj0idHJ1 ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFGb3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgMiIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI5IiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iaGVhZGlu ZyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjkiIFNlbWlI aWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJo ZWFkaW5nIDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iOSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFGb3JtYXQ9InRydWUiIE5h bWU9ImhlYWRpbmcgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZvcm1hdD0idHJ1 ZSIgTmFtZT0iaGVhZGluZyA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBRRm9ybWF0 PSJ0cnVlIiBOYW1lPSJoZWFkaW5nIDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iOSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIFFG b3JtYXQ9InRydWUiIE5hbWU9ImhlYWRpbmcgOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iaGVhZGluZyA5Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 ImluZGV4IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0 cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iaW5kZXggMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJpbmRleCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhp ZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImluZGV4IDQiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iaW5kZXggNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJpbmRleCA2Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRl V2hlblVzZWQ9InRydWUiIE5hbWU9ImluZGV4IDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iaW5k ZXggOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJpbmRleCA5Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0idG9jIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBO YW1lPSJ0b2MgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIz OSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9InRvYyAzIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjM5IiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9jIDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0b2MgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSIzOSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRy dWUiIE5hbWU9InRvYyA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjM5IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9j IDciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlI aWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0b2MgOCIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzOSIgU2VtaUhpZGRlbj0idHJ1ZSIg VW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9InRvYyA5Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 Ik5vcm1hbCBJbmRlbnQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlk ZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iZm9vdG5vdGUgdGV4dCIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdo ZW5Vc2VkPSJ0cnVlIiBOYW1lPSJhbm5vdGF0aW9uIHRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFt ZT0iaGVhZGVyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImZvb3RlciIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJpbmRleCBoZWFkaW5nIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjM1IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgUUZv cm1hdD0idHJ1ZSIgTmFtZT0iY2FwdGlvbiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJ0YWJsZSBv ZiBmaWd1cmVzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9ImVudmVsb3BlIGFkZHJlc3MiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iZW52ZWxvcGUgcmV0dXJuIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 ImZvb3Rub3RlIHJlZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJhbm5vdGF0aW9uIHJl ZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJsaW5lIG51bWJlciIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJwYWdlIG51bWJlciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJlbmRub3RlIHJl ZmVyZW5jZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJlbmRub3RlIHRleHQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0idGFibGUgb2YgYXV0aG9yaXRpZXMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i bWFjcm8iLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0idG9hIGhlYWRpbmciLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IEJ1bGxldCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0 IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iTGlzdCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 Ikxpc3QgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IDUiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBCdWxsZXQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IEJ1bGxldCAz Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxpc3QgQnVsbGV0IDQiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBCdWxsZXQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxpc3QgTnVtYmVyIDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iTGlzdCBOdW1iZXIgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IE51bWJlciA1 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjEwIiBRRm9ybWF0 PSJ0cnVlIiBOYW1lPSJUaXRsZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJDbG9zaW5nIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hl blVzZWQ9InRydWUiIE5hbWU9IlNpZ25hdHVyZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSIxIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iRGVmYXVsdCBQYXJhZ3JhcGggRm9udCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJC b2R5IFRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0 cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEluZGVudCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJMaXN0IENvbnRpbnVlIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ikxp c3QgQ29udGludWUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJMaXN0IENvbnRpbnVlIDMiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iTGlzdCBDb250aW51ZSA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9Ikxpc3QgQ29udGludWUgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJNZXNzYWdlIEhlYWRl ciIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIxMSIgUUZvcm1h dD0idHJ1ZSIgTmFtZT0iU3VidGl0bGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iU2FsdXRhdGlv biIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJEYXRlIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkJv ZHkgVGV4dCBGaXJzdCBJbmRlbnQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBT ZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEZp cnN0IEluZGVudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRl bj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ik5vdGUgSGVhZGluZyIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJCb2R5IFRleHQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCb2R5 IFRleHQgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCb2R5IFRleHQgSW5kZW50IDIiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iQm9keSBUZXh0IEluZGVudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9IkJsb2NrIFRleHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlk ZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSHlwZXJsaW5rIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVz ZWQ9InRydWUiIE5hbWU9IkZvbGxvd2VkSHlwZXJsaW5rIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjIyIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJTdHJvbmciLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMjAiIFFGb3JtYXQ9InRy dWUiIE5hbWU9IkVtcGhhc2lzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2Vt aUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkRvY3VtZW50IE1hcCIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJQbGFpbiBUZXh0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IkUtbWFpbCBTaWduYXR1cmUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1p SGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBUb3Agb2YgRm9y bSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIEJvdHRvbSBvZiBGb3JtIi8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9 InRydWUiIE5hbWU9Ik5vcm1hbCAoV2ViKSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIEFj cm9ueW0iLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBBZGRyZXNzIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRy dWUiIE5hbWU9IkhUTUwgQ2l0ZSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJIVE1MIENvZGUiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBEZWZpbml0aW9uIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9IkhUTUwgS2V5Ym9hcmQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1p SGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBQcmVmb3JtYXR0 ZWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iSFRNTCBTYW1wbGUiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iSFRNTCBUeXBld3JpdGVyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IkhUTUwgVmFyaWFi bGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iYW5ub3RhdGlvbiBzdWJqZWN0Ii8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9 InRydWUiIE5hbWU9Ik5vIExpc3QiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBT ZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iT3V0bGluZSBMaXN0 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBV bmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iT3V0bGluZSBMaXN0IDIiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iT3V0bGluZSBMaXN0IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgU2lt cGxlIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVl IiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgU2ltcGxlIDIiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0iVGFibGUgU2ltcGxlIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUg Q2xhc3NpYyAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0i dHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENsYXNzaWMgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDbGFzc2ljIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i VGFibGUgQ2xhc3NpYyA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhp ZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENvbG9yZnVsIDEi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhp ZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgQ29sb3JmdWwgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVl IiBOYW1lPSJUYWJsZSBDb2xvcmZ1bCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIENv bHVtbnMgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDb2x1bW5zIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgQ29sdW1ucyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRh YmxlIENvbHVtbnMgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBDb2x1bW5zIDUiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IlRhYmxlIEdyaWQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRk ZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBHcmlkIDMiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVu VXNlZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRh YmxlIEdyaWQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49 InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBHcmlkIDYiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgR3JpZCA3Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxl IEdyaWQgOCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDEiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0i dHJ1ZSIgTmFtZT0iVGFibGUgTGlzdCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIExp c3QgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1 ZSIgTmFtZT0iVGFibGUgTGlzdCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIExpc3Qg NiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVu aGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBMaXN0IDciLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIg TmFtZT0iVGFibGUgTGlzdCA4Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2Vt aUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIDNEIGVmZmVj dHMgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSAzRCBlZmZlY3RzIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNl ZD0idHJ1ZSIgTmFtZT0iVGFibGUgM0QgZWZmZWN0cyAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9 IlRhYmxlIENvbnRlbXBvcmFyeSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNl bWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBFbGVnYW50 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5o aWRlV2hlblVzZWQ9InRydWUiIE5hbWU9IlRhYmxlIFByb2Zlc3Npb25hbCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJUYWJsZSBTdWJ0bGUgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBT dWJ0bGUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRy dWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJUYWJsZSBXZWIgMSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0 cnVlIiBOYW1lPSJUYWJsZSBXZWIgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCYWxsb29uIFRl eHQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIE5hbWU9 IlRhYmxlIEdyaWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVu PSJ0cnVlIiBOYW1lPSJQbGFjZWhvbGRlciBUZXh0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjEiIFFGb3JtYXQ9InRydWUiIE5hbWU9Ik5vIFNwYWNpbmciLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIE5hbWU9IkxpZ2h0 IFNoYWRpbmciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEi IE5hbWU9IkxpZ2h0IExpc3QiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjIiIE5hbWU9IkxpZ2h0IEdyaWQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjMiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDEiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjQiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIE5hbWU9Ik1l ZGl1bSBMaXN0IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NjYiIE5hbWU9Ik1lZGl1bSBMaXN0IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1bSBHcmlkIDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5hbWU9Ik1lZGl1bSBHcmlk IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9 IkRhcmsgTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGluZyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI3MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCIvPg0KPHc6THNkRXhjZXB0aW9u IExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgTmFtZT0iQ29sb3JmdWwgR3JpZCIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQgU2hh ZGluZyBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2MSIgTmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgMSIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVtIFNo YWRpbmcgMSBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI2NCIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMiBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2Nl bnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFNlbWlIaWRkZW49InRydWUi IE5hbWU9IlJldmlzaW9uIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjM0IiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJMaXN0IFBhcmFncmFwaCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIyOSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0i UXVvdGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzAiIFFG b3JtYXQ9InRydWUiIE5hbWU9IkludGVuc2UgUXVvdGUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIE5hbWU9Ik1lZGl1bSBMaXN0IDIgQWNjZW50IDEiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1 bSBHcmlkIDEgQWNjZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNjZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5hbWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9 IkRhcmsgTGlzdCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI3MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGluZyBBY2NlbnQgMSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCBB Y2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIg TmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQgU2hhZGluZyBBY2NlbnQgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MSIgTmFtZT0iTGlnaHQgTGlz dCBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2 MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMSBBY2NlbnQgMiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NCIgTmFtZT0iTWVkaXVt IFNoYWRpbmcgMiBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIgTmFtZT0iTWVkaXVtIExpc3QgMiBBY2Nl bnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NyIgTmFt ZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI2OCIgTmFtZT0iTWVkaXVtIEdyaWQgMiBBY2NlbnQgMiIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OSIgTmFtZT0iTWVkaXVtIEdyaWQg MyBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MCIgTmFtZT0iRGFyayBMaXN0IEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjcxIiBOYW1lPSJDb2xvcmZ1bCBTaGFkaW5nIEFjY2VudCAyIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcyIiBOYW1lPSJDb2xvcmZ1 bCBMaXN0IEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjczIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2VudCAyIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYwIiBOYW1lPSJMaWdodCBTaGFkaW5nIEFjY2VudCAz Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYxIiBOYW1lPSJM aWdodCBMaXN0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjYyIiBOYW1lPSJMaWdodCBHcmlkIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBOYW1lPSJNZWRpdW0gU2hhZGluZyAxIEFjY2Vu dCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY0IiBOYW1l PSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjY1IiBOYW1lPSJNZWRpdW0gTGlzdCAxIEFjY2VudCAzIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY2IiBOYW1lPSJNZWRpdW0gTGlz dCAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjY3IiBOYW1lPSJNZWRpdW0gR3JpZCAxIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBOYW1lPSJNZWRpdW0gR3JpZCAyIEFjY2VudCAzIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY5IiBOYW1lPSJNZWRp dW0gR3JpZCAzIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjcwIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzEiIE5hbWU9IkNvbG9yZnVsIFNoYWRpbmcgQWNjZW50 IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzIiIE5hbWU9 IkNvbG9yZnVsIExpc3QgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNzMiIE5hbWU9IkNvbG9yZnVsIEdyaWQgQWNjZW50IDMiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjAiIE5hbWU9IkxpZ2h0IFNoYWRpbmcg QWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjEi IE5hbWU9IkxpZ2h0IExpc3QgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNjIiIE5hbWU9IkxpZ2h0IEdyaWQgQWNjZW50IDQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjMiIE5hbWU9Ik1lZGl1bSBTaGFkaW5n IDEgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i NjQiIE5hbWU9Ik1lZGl1bSBTaGFkaW5nIDIgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjUiIE5hbWU9Ik1lZGl1bSBMaXN0IDEgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjYiIE5hbWU9Ik1l ZGl1bSBMaXN0IDIgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNjciIE5hbWU9Ik1lZGl1bSBHcmlkIDEgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjgiIE5hbWU9Ik1lZGl1bSBHcmlkIDIgQWNj ZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNjkiIE5h bWU9Ik1lZGl1bSBHcmlkIDMgQWNjZW50IDQiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNzAiIE5hbWU9IkRhcmsgTGlzdCBBY2NlbnQgNCIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MSIgTmFtZT0iQ29sb3JmdWwgU2hhZGlu ZyBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3 MiIgTmFtZT0iQ29sb3JmdWwgTGlzdCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI3MyIgTmFtZT0iQ29sb3JmdWwgR3JpZCBBY2NlbnQgNCIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MCIgTmFtZT0iTGlnaHQg U2hhZGluZyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI2MSIgTmFtZT0iTGlnaHQgTGlzdCBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MiIgTmFtZT0iTGlnaHQgR3JpZCBBY2NlbnQgNSIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2MyIgTmFtZT0iTWVkaXVt IFNoYWRpbmcgMSBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI2NCIgTmFtZT0iTWVkaXVtIFNoYWRpbmcgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NSIgTmFtZT0iTWVkaXVtIExpc3QgMSBB Y2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2NiIg TmFtZT0iTWVkaXVtIExpc3QgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI2NyIgTmFtZT0iTWVkaXVtIEdyaWQgMSBBY2NlbnQgNSIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI2OCIgTmFtZT0iTWVkaXVtIEdy aWQgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI2OSIgTmFtZT0iTWVkaXVtIEdyaWQgMyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI3MCIgTmFtZT0iRGFyayBMaXN0IEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcxIiBOYW1lPSJDb2xvcmZ1 bCBTaGFkaW5nIEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjcyIiBOYW1lPSJDb2xvcmZ1bCBMaXN0IEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNlcHRp b24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjczIiBOYW1lPSJDb2xvcmZ1bCBHcmlkIEFjY2Vu dCA1Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYwIiBOYW1l PSJMaWdodCBTaGFkaW5nIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjYxIiBOYW1lPSJMaWdodCBMaXN0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYyIiBOYW1lPSJMaWdodCBHcmlkIEFjY2Vu dCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjYzIiBOYW1l PSJNZWRpdW0gU2hhZGluZyAxIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjY0IiBOYW1lPSJNZWRpdW0gU2hhZGluZyAyIEFjY2VudCA2Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY1IiBOYW1lPSJNZWRpdW0g TGlzdCAxIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjY2IiBOYW1lPSJNZWRpdW0gTGlzdCAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY3IiBOYW1lPSJNZWRpdW0gR3JpZCAxIEFjY2VudCA2 Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjY4IiBOYW1lPSJN ZWRpdW0gR3JpZCAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjY5IiBOYW1lPSJNZWRpdW0gR3JpZCAzIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjcwIiBOYW1lPSJEYXJrIExpc3QgQWNjZW50 IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzEiIE5hbWU9 IkNvbG9yZnVsIFNoYWRpbmcgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNzIiIE5hbWU9IkNvbG9yZnVsIExpc3QgQWNjZW50IDYiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNzMiIE5hbWU9IkNvbG9yZnVsIEdy aWQgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0i MTkiIFFGb3JtYXQ9InRydWUiIE5hbWU9IlN1YnRsZSBFbXBoYXNpcyIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIyMSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iSW50 ZW5zZSBFbXBoYXNpcyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSIzMSIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0iU3VidGxlIFJlZmVyZW5jZSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSIzMiIgUUZvcm1hdD0idHJ1ZSIgTmFtZT0i SW50ZW5zZSBSZWZlcmVuY2UiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iMzMiIFFGb3JtYXQ9InRydWUiIE5hbWU9IkJvb2sgVGl0bGUiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzciIFNlbWlIaWRkZW49InRydWUiIFVuaGlk ZVdoZW5Vc2VkPSJ0cnVlIiBOYW1lPSJCaWJsaW9ncmFwaHkiLz4NCjx3OkxzZEV4Y2VwdGlvbiBM b2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iMzkiIFNlbWlIaWRkZW49InRydWUiIFVuaGlkZVdoZW5V c2VkPSJ0cnVlIiBRRm9ybWF0PSJ0cnVlIiBOYW1lPSJUT0MgSGVhZGluZyIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MSIgTmFtZT0iUGxhaW4gVGFibGUgMSIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MiIgTmFtZT0iUGxh aW4gVGFibGUgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0 MyIgTmFtZT0iUGxhaW4gVGFibGUgMyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0NCIgTmFtZT0iUGxhaW4gVGFibGUgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NSIgTmFtZT0iUGxhaW4gVGFibGUgNSIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0MCIgTmFtZT0iR3JpZCBUYWJsZSBM aWdodCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFt ZT0iR3JpZCBUYWJsZSAxIExpZ2h0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iR3JpZCBUYWJsZSA0Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1lPSJHcmlk IFRhYmxlIDUgRGFyayIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2IENvbG9yZnVsIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9IkdyaWQg VGFibGUgMSBMaWdodCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0NyIgTmFtZT0iR3JpZCBUYWJsZSAyIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ4IiBOYW1lPSJHcmlkIFRhYmxlIDMgQWNj ZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5h bWU9IkdyaWQgVGFibGUgNCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iR3JpZCBUYWJsZSA1IERhcmsgQWNjZW50IDEiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9IkdyaWQgVGFi bGUgNiBDb2xvcmZ1bCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI1MiIgTmFtZT0iR3JpZCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCAxIi8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJHcmlkIFRh YmxlIDEgTGlnaHQgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNDciIE5hbWU9IkdyaWQgVGFibGUgMiBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OCIgTmFtZT0iR3JpZCBUYWJsZSAzIEFjY2Vu dCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1l PSJHcmlkIFRhYmxlIDQgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNTAiIE5hbWU9IkdyaWQgVGFibGUgNSBEYXJrIEFjY2VudCAyIi8+DQo8dzpM c2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJHcmlkIFRhYmxl IDYgQ29sb3JmdWwgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNTIiIE5hbWU9IkdyaWQgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgMiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iR3JpZCBUYWJs ZSAxIExpZ2h0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyBBY2NlbnQg MyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0i R3JpZCBUYWJsZSA0IEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg UHJpb3JpdHk9IjUwIiBOYW1lPSJHcmlkIFRhYmxlIDUgRGFyayBBY2NlbnQgMyIvPg0KPHc6THNk RXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2 IENvbG9yZnVsIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDMiLz4NCjx3Okxz ZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9IkdyaWQgVGFibGUg MSBMaWdodCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI0NyIgTmFtZT0iR3JpZCBUYWJsZSAyIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ4IiBOYW1lPSJHcmlkIFRhYmxlIDMgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikdy aWQgVGFibGUgNCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFBy aW9yaXR5PSI1MCIgTmFtZT0iR3JpZCBUYWJsZSA1IERhcmsgQWNjZW50IDQiLz4NCjx3OkxzZEV4 Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9IkdyaWQgVGFibGUgNiBD b2xvcmZ1bCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI1MiIgTmFtZT0iR3JpZCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCA0Ii8+DQo8dzpMc2RF eGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJHcmlkIFRhYmxlIDEg TGlnaHQgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNDciIE5hbWU9IkdyaWQgVGFibGUgMiBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OCIgTmFtZT0iR3JpZCBUYWJsZSAzIEFjY2VudCA1Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJHcmlk IFRhYmxlIDQgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlv cml0eT0iNTAiIE5hbWU9IkdyaWQgVGFibGUgNSBEYXJrIEFjY2VudCA1Ii8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJHcmlkIFRhYmxlIDYgQ29s b3JmdWwgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNTIiIE5hbWU9IkdyaWQgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgNSIvPg0KPHc6THNkRXhj ZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iR3JpZCBUYWJsZSAxIExp Z2h0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ3IiBOYW1lPSJHcmlkIFRhYmxlIDIgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDgiIE5hbWU9IkdyaWQgVGFibGUgMyBBY2NlbnQgNiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iR3JpZCBU YWJsZSA0IEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3Jp dHk9IjUwIiBOYW1lPSJHcmlkIFRhYmxlIDUgRGFyayBBY2NlbnQgNiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iR3JpZCBUYWJsZSA2IENvbG9y ZnVsIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjUyIiBOYW1lPSJHcmlkIFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2Vw dGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdo dCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0i TGlzdCBUYWJsZSAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iTGlzdCBUYWJsZSA1IERhcmsiLz4NCjx3 OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFi bGUgNiBDb2xvcmZ1bCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5 PSI1MiIgTmFtZT0iTGlzdCBUYWJsZSA3IENvbG9yZnVsIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9j a2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJMaXN0IFRhYmxlIDEgTGlnaHQgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDciIE5hbWU9 Ikxpc3QgVGFibGUgMiBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI0OCIgTmFtZT0iTGlzdCBUYWJsZSAzIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNl cHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJMaXN0IFRhYmxlIDQgQWNj ZW50IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTAiIE5h bWU9Ikxpc3QgVGFibGUgNSBEYXJrIEFjY2VudCAxIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2Vk PSJmYWxzZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJMaXN0IFRhYmxlIDYgQ29sb3JmdWwgQWNjZW50 IDEiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTIiIE5hbWU9 Ikxpc3QgVGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgMSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tl ZD0iZmFsc2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iTGlzdCBUYWJsZSAxIExpZ2h0IEFjY2VudCAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ3IiBOYW1lPSJM aXN0IFRhYmxlIDIgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNDgiIE5hbWU9Ikxpc3QgVGFibGUgMyBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0 aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iTGlzdCBUYWJsZSA0IEFjY2Vu dCAyIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1l PSJMaXN0IFRhYmxlIDUgRGFyayBBY2NlbnQgMiIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0i ZmFsc2UiIFByaW9yaXR5PSI1MSIgTmFtZT0iTGlzdCBUYWJsZSA2IENvbG9yZnVsIEFjY2VudCAy Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJM aXN0IFRhYmxlIDcgQ29sb3JmdWwgQWNjZW50IDIiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9 ImZhbHNlIiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdodCBBY2NlbnQgMyIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0iTGlz dCBUYWJsZSAyIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJp b3JpdHk9IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlv biBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCBBY2NlbnQg MyIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0i TGlzdCBUYWJsZSA1IERhcmsgQWNjZW50IDMiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZh bHNlIiBQcmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFibGUgNiBDb2xvcmZ1bCBBY2NlbnQgMyIv Pg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MiIgTmFtZT0iTGlz dCBUYWJsZSA3IENvbG9yZnVsIEFjY2VudCAzIi8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJm YWxzZSIgUHJpb3JpdHk9IjQ2IiBOYW1lPSJMaXN0IFRhYmxlIDEgTGlnaHQgQWNjZW50IDQiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDciIE5hbWU9Ikxpc3Qg VGFibGUgMiBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9y aXR5PSI0OCIgTmFtZT0iTGlzdCBUYWJsZSAzIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ5IiBOYW1lPSJMaXN0IFRhYmxlIDQgQWNjZW50IDQi Lz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTAiIE5hbWU9Ikxp c3QgVGFibGUgNSBEYXJrIEFjY2VudCA0Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxz ZSIgUHJpb3JpdHk9IjUxIiBOYW1lPSJMaXN0IFRhYmxlIDYgQ29sb3JmdWwgQWNjZW50IDQiLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0eT0iNTIiIE5hbWU9Ikxpc3Qg VGFibGUgNyBDb2xvcmZ1bCBBY2NlbnQgNCIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFs c2UiIFByaW9yaXR5PSI0NiIgTmFtZT0iTGlzdCBUYWJsZSAxIExpZ2h0IEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjQ3IiBOYW1lPSJMaXN0IFRh YmxlIDIgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQcmlvcml0 eT0iNDgiIE5hbWU9Ikxpc3QgVGFibGUgMyBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExv Y2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0OSIgTmFtZT0iTGlzdCBUYWJsZSA0IEFjY2VudCA1Ii8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUwIiBOYW1lPSJMaXN0 IFRhYmxlIDUgRGFyayBBY2NlbnQgNSIvPg0KPHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2Ui IFByaW9yaXR5PSI1MSIgTmFtZT0iTGlzdCBUYWJsZSA2IENvbG9yZnVsIEFjY2VudCA1Ii8+DQo8 dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9IjUyIiBOYW1lPSJMaXN0IFRh YmxlIDcgQ29sb3JmdWwgQWNjZW50IDUiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNl IiBQcmlvcml0eT0iNDYiIE5hbWU9Ikxpc3QgVGFibGUgMSBMaWdodCBBY2NlbnQgNiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI0NyIgTmFtZT0iTGlzdCBUYWJs ZSAyIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgUHJpb3JpdHk9 IjQ4IiBOYW1lPSJMaXN0IFRhYmxlIDMgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBQcmlvcml0eT0iNDkiIE5hbWU9Ikxpc3QgVGFibGUgNCBBY2NlbnQgNiIvPg0K PHc6THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MCIgTmFtZT0iTGlzdCBU YWJsZSA1IERhcmsgQWNjZW50IDYiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBQ cmlvcml0eT0iNTEiIE5hbWU9Ikxpc3QgVGFibGUgNiBDb2xvcmZ1bCBBY2NlbnQgNiIvPg0KPHc6 THNkRXhjZXB0aW9uIExvY2tlZD0iZmFsc2UiIFByaW9yaXR5PSI1MiIgTmFtZT0iTGlzdCBUYWJs ZSA3IENvbG9yZnVsIEFjY2VudCA2Ii8+DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIg U2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5hbWU9Ik1lbnRpb24iLz4N Cjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVX aGVuVXNlZD0idHJ1ZSIgTmFtZT0iU21hcnQgSHlwZXJsaW5rIi8+DQo8dzpMc2RFeGNlcHRpb24g TG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRlV2hlblVzZWQ9InRydWUiIE5h bWU9Ikhhc2h0YWciLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2NrZWQ9ImZhbHNlIiBTZW1pSGlkZGVu PSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0iVW5yZXNvbHZlZCBNZW50aW9uIi8+ DQo8dzpMc2RFeGNlcHRpb24gTG9ja2VkPSJmYWxzZSIgU2VtaUhpZGRlbj0idHJ1ZSIgVW5oaWRl V2hlblVzZWQ9InRydWUiIE5hbWU9IlNtYXJ0IExpbmsiLz4NCjx3OkxzZEV4Y2VwdGlvbiBMb2Nr ZWQ9ImZhbHNlIiBTZW1pSGlkZGVuPSJ0cnVlIiBVbmhpZGVXaGVuVXNlZD0idHJ1ZSIgTmFtZT0i U21hcnQgTGluayBFcnJvciIvPg0KPC93OkxhdGVudFN0eWxlcz4NCjwveG1sPjwhW2VuZGlmXS0t PjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYgMyAyIDQ7DQoJ bXNvLWZvbnQtY2hhcnNldDowOw0KCW1zby1nZW5lcmljLWZvbnQtZmFtaWx5OnJvbWFuOw0KCW1z by1mb250LXBpdGNoOnZhcmlhYmxlOw0KCW1zby1mb250LXNpZ25hdHVyZTotNTM2ODY5MTIxIDEx MDczMDU3MjcgMzM1NTQ0MzIgMCA0MTUgMDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNh bGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7DQoJbXNvLWZvbnQtY2hhcnNl dDowOw0KCW1zby1nZW5lcmljLWZvbnQtZmFtaWx5OnN3aXNzOw0KCW1zby1mb250LXBpdGNoOnZh cmlhYmxlOw0KCW1zby1mb250LXNpZ25hdHVyZTotNTM2ODU4ODgxIC0xMDczNzMyNDg1IDkgMCA1 MTEgMDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1h bCwgZGl2Lk1zb05vcm1hbA0KCXttc28tc3R5bGUtdW5oaWRlOm5vOw0KCW1zby1zdHlsZS1xZm9y bWF0OnllczsNCgltc28tc3R5bGUtcGFyZW50OiIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJv dHRvbTouMDAwMXB0Ow0KCW1zby1wYWdpbmF0aW9uOndpZG93LW9ycGhhbjsNCglmb250LXNpemU6 MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0 LWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28t c3R5bGUtbm9zaG93OnllczsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsN Cgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lOw0KCXRleHQtdW5kZXJsaW5lOnNpbmdsZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLW5vc2hvdzp5 ZXM7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29y YXRpb246dW5kZXJsaW5lOw0KCXRleHQtdW5kZXJsaW5lOnNpbmdsZTt9DQpwLm1zb25vcm1hbDAs IGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1h bDsNCgltc28tc3R5bGUtdW5oaWRlOm5vOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1h cmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxl ZnQ6MGluOw0KCW1zby1wYWdpbmF0aW9uOndpZG93LW9ycGhhbjsNCglmb250LXNpemU6MTEuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0LWZvbnQt ZmFtaWx5OkNhbGlicmk7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVy c29uYWwtcmVwbHk7DQoJbXNvLXN0eWxlLW5vc2hvdzp5ZXM7DQoJbXNvLXN0eWxlLXVuaGlkZTpu bzsNCgltc28tYW5zaS1mb250LXNpemU6MTEuMHB0Ow0KCW1zby1iaWRpLWZvbnQtc2l6ZToxMS4w cHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWFzY2lpLWZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28t aGFuc2ktZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uU3BlbGxFDQoJe21zby1zdHls ZS1uYW1lOiIiOw0KCW1zby1zcGwtZTp5ZXM7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxl LXR5cGU6ZXhwb3J0LW9ubHk7DQoJbXNvLWRlZmF1bHQtcHJvcHM6eWVzOw0KCWZvbnQtc2l6ZTox MC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCgltc28tYmlkaS1mb250LXNpemU6 MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJn aW46MS4waW4gMS4waW4gMS4waW4gMS4waW47DQoJbXNvLWhlYWRlci1tYXJnaW46LjVpbjsNCglt c28tZm9vdGVyLW1hcmdpbjouNWluOw0KCW1zby1wYXBlci1zb3VyY2U6MDt9DQpkaXYuV29yZFNl Y3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNv IDEwXT48c3R5bGU+LyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnRhYmxlLk1zb05vcm1hbFRhYmxl DQoJe21zby1zdHlsZS1uYW1lOiJUYWJsZSBOb3JtYWwiOw0KCW1zby10c3R5bGUtcm93YmFuZC1z aXplOjA7DQoJbXNvLXRzdHlsZS1jb2xiYW5kLXNpemU6MDsNCgltc28tc3R5bGUtbm9zaG93Onll czsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLXBhcmVudDoiIjsNCgltc28t cGFkZGluZy1hbHQ6MGluIDUuNHB0IDBpbiA1LjRwdDsNCgltc28tcGFyYS1tYXJnaW46MGluOw0K CW1zby1wYXJhLW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCgltc28tcGFnaW5hdGlvbjp3aWRvdy1v cnBoYW47DQoJZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFu IixzZXJpZjt9DQo8L3N0eWxlPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwh W2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9 ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlv dXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0i Ymx1ZSIgdmxpbms9InB1cnBsZSIgc3R5bGU9InRhYi1pbnRlcnZhbDouNWluIj4NCjxkaXYgY2xh c3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBm YWNlPSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tZmFyZWFzdC1m b250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPllvdSB0aGluayB0aGF0IHRo ZSB3YXkgdG8gc29sdmUgdGhpcyBwcm9ibGVtIGlzIGZvciBBREQgdG8gc2F5IOKAnGRvbuKAmXQg dXNlIERvSC7igJ0gQnV0IG1hbnkgcGFydGljaXBhbnRzIGluIEFERCBhcmUgaGVyZSB0byBmaWd1 cmUgb3V0IGhvdw0KIHRvIGRvIERvSCwgYW5kIGFyZW7igJl0IGludGVyZXN0ZWQgaW4geW91ciBv cGluaW9uIHRoYXQgdGhleSBzaG91bGQgbm90IGRvIGl0LiBJIHN1cHBvc2UgaXTigJlzIHRoZW9y ZXRpY2FsbHkgcG9zc2libGUgdGhhdCB5b3UgY291bGQgY29tZSB1cCB3aXRoIHNvbWUgYXJndW1l bnQgdGhhdCB3b3VsZCBjb252aW5jZSB0aGVtLCBidXQgSSBkb27igJl0IGtub3cgd2hhdCBpdCB3 b3VsZCBiZSwgYW5kIGNsZWFybHkgeW91IGRvbuKAmXQgZWl0aGVyLCBiZWNhdXNlDQogeW91IGhh dmVu4oCZdCBtYWRlIGFueSBzdWNoIGFyZ3VtZW50LiBZb3UganVzdCBrZWVwIHJlcGVhdGluZyB0 aGVzZSBzbG9nYW5zLiBUaGF04oCZcyBub3QgZ29pbmcgdG8gZ2V0IHRoZSBqb2IgZG9uZS48bzpw PjwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6 ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWFz Y2lpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNv LWJpZGktZm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L2ZvbnQ+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGZvbnQgc2l6 ZT0iMiIgZmFjZT0iQ2FsaWJyaSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWFz Y2lpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNvLWhhbnNpLWZvbnQtZmFtaWx5OkNhbGlicmk7bXNv LWJpZGktZm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbHQ7QkhTJmd0 OyBObywgSSB0aGluayBpdOKAmXMgYWJvdXQgQUREIHNheWluZyDigJxoZXJlIGlzIGhvdyB0aGUg bmV0d29yayBjYW4gdGVsbCBob3N0cw0KIGFuZCBhcHBzIHRoYXQgdGhlIG5ldHdvcmsgY29uc2lk ZXJzIGFueXRoaW5nIGl0IGNhdGNoZXMgZG9pbmcgPHNwYW4gY2xhc3M9IlNwZWxsRSI+DQpEb0g8 L3NwYW4+IHRvIGJlIG1hbHdhcmXigJ0uJmx0Oy9CSFMmZ3Q7PG86cD48L286cD48L3NwYW4+PC9m b250PjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Zm9udCBzaXplPSIyIiBmYWNl PSJDYWxpYnJpIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tZmFyZWFzdC1mb250 LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvZm9udD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_a7f7adaf83db4ddfb01d816a3e3cb3f1attcom_-- From nobody Mon Jul 27 15:25:48 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 811163A09B4 for ; Mon, 27 Jul 2020 15:25:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vbH6im0nRiOY for ; Mon, 27 Jul 2020 15:25:37 -0700 (PDT) Received: from mail-qv1-xf32.google.com (mail-qv1-xf32.google.com [IPv6:2607:f8b0:4864:20::f32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 82B463A08FA for ; Mon, 27 Jul 2020 15:25:34 -0700 (PDT) Received: by mail-qv1-xf32.google.com with SMTP id dm12so8260704qvb.9 for ; Mon, 27 Jul 2020 15:25:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=GENfsPSEI7808YvYUEDqtd6J/Gei++vCx4b1ZUx781Y=; b=XLqvy1xKDa2SmyKK0aEUo2xYnFw/g7pFsRZf3Q+1OE60/r3I3BoZla/IqkENc1eigz bhYX/5nO/Q0/4RG7pXBl0UKk4v3OGf7SWUC2mmaATQlGFvss5Y835kv6cA87/u+UU28s F5WEr20hlFnHi9zQI5nulv1mq5wXU4UKn4zhIHTmPq8bUHEnaP3/Sl8r9XIg6mdP4smV IvCK+ry0YhcTkPC+7kuzYuV6fZEvzg2veRELGe5s0sb4AZSRDsbCntdgB1osUmUMHhMI +qzDcbGR3XXvVgraHSATI95+ndZLNN7vDI+gSB4zgfd+OrviVjvFTC8s/AprPKu4hUYa Rabw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=GENfsPSEI7808YvYUEDqtd6J/Gei++vCx4b1ZUx781Y=; b=IGmJgHyf/xsbViBEBd9lTWzwY3QDdtMqVvlTrFs56JpKhUI2bv09GUSN9GZeTgV+qR TGvrIfmp36YWv6FF1GggsnEayYj3purAsFEi7xim/TH3L4iuWxyw6oqi9TN1Z7b+ih6T EwnDfVyBCEwXsFY9euhBVBEtQpvGM3FxPtcKJtgENklbyav2tNCt3n84b/WRG2Rsrasc hRvgyxKRoQg2WlXu77fSzRQGma/spvAoXUqny+LM7ympKfJM3JzUY9K2FgANAhQbIlhE k43PmyhZrTNjzl1g7BIV7hlzUfIb9XJKssSKv0X6TxtIIKrPZOfKJ04NdwtvjynpyTHd YhVQ== X-Gm-Message-State: AOAM533M4r3CCmuh0s/QX5Ko5hlAD1P/tXCMPaWaKlh9n+v+QgFupv7F Iq5G9/TNQk0zKFOxERTOHAW03Q== X-Google-Smtp-Source: ABdhPJxA7N3TykgcI8VtVCQsbtcSCoUHidQQZ0z6xQ0EHm9dXRIPbXlLN14ZqgDwLLmRDA54QevJxA== X-Received: by 2002:ad4:4024:: with SMTP id q4mr7895409qvp.243.1595888733498; Mon, 27 Jul 2020 15:25:33 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:6006:2043:7843:2a9e? ([2601:18b:300:36ee:6006:2043:7843:2a9e]) by smtp.gmail.com with ESMTPSA id p186sm20191930qkf.33.2020.07.27.15.25.32 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Jul 2020 15:25:32 -0700 (PDT) From: Ted Lemon Message-Id: <3B4BDD38-4C0E-4444-A294-0E17BA5E2FA8@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_BA057D3D-3899-4662-988C-F559465144C8" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Mon, 27 Jul 2020 18:25:32 -0400 In-Reply-To: Cc: Paul Vixie , "add@ietf.org" To: "STARK, BARBARA H" References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 22:25:47 -0000 --Apple-Mail=_BA057D3D-3899-4662-988C-F559465144C8 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 27, 2020, at 6:20 PM, STARK, BARBARA H wrote: > No, I think it=E2=80=99s about ADD saying =E2=80=9Chere is how = the network can tell hosts and apps that the network considers anything = it catches doing DoH to be malware=E2=80=9D. Okay, but on the one hand if you mean that the network might intercept a = connection to a known DoH server and send a TLS alert saying = =E2=80=9Cdon=E2=80=99t,=E2=80=9D I don=E2=80=99t think that=E2=80=99s at = all controversial. I=E2=80=99d support doing that. Maybe ekr would have = some nit, but I think the idea that that might be useful isn=E2=80=99t = terribly controversial. If on the other hand you mean that we should write a document saying = =E2=80=9Cthe network should tell you with DHCP not to do DoH,=E2=80=9D = then it=E2=80=99s going to be very hard to get consensus on that, = because my code wouldn=E2=80=99t even go look to see whether the network = had said that, much less honor its request. If you think my code ought = to honor the request, then I suppose have at it, but that=E2=80=99s what = I mean when I say that we=E2=80=99re just hearing slogans. I haven=E2=80=99= t heard any convincing argument that I should write code that does that. = The slogans aren=E2=80=99t going to get it done. --Apple-Mail=_BA057D3D-3899-4662-988C-F559465144C8 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 27, 2020, at 6:20 PM, STARK, BARBARA H <bs7652@att.com> = wrote:
<BHS> = No, I think it=E2=80=99s about ADD saying =E2=80=9Chere is how the = network can tell hosts and apps that the network considers anything it = catches doing DoH to be = malware=E2=80=9D.</BHS>

Okay, but on the one hand if you mean that = the network might intercept a connection to a known DoH server and send = a TLS alert saying =E2=80=9Cdon=E2=80=99t,=E2=80=9D I don=E2=80=99t = think that=E2=80=99s at all controversial. I=E2=80=99d support doing = that. Maybe ekr would have some nit, but I think the idea that that = might be useful isn=E2=80=99t terribly controversial.

If on the other hand you = mean that we should write a document saying =E2=80=9Cthe network should = tell you with DHCP not to do DoH,=E2=80=9D then it=E2=80=99s going to be = very hard to get consensus on that, because my code wouldn=E2=80=99t = even go look to see whether the network had said that, much less honor = its request. If you think my code ought to honor the request, then I = suppose have at it, but that=E2=80=99s what I mean when I say that = we=E2=80=99re just hearing slogans. I haven=E2=80=99t heard any = convincing argument that I should write code that does that. The slogans = aren=E2=80=99t going to get it done.

= --Apple-Mail=_BA057D3D-3899-4662-988C-F559465144C8-- From nobody Mon Jul 27 15:50:27 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE3343A08FA for ; Mon, 27 Jul 2020 15:50:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mur1rHzjCbiF for ; Mon, 27 Jul 2020 15:50:23 -0700 (PDT) Received: from mail-io1-xd32.google.com (mail-io1-xd32.google.com [IPv6:2607:f8b0:4864:20::d32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A5EF3A08F8 for ; Mon, 27 Jul 2020 15:50:23 -0700 (PDT) Received: by mail-io1-xd32.google.com with SMTP id l17so18769376iok.7 for ; Mon, 27 Jul 2020 15:50:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=VTSOuROAwsy+ZmAkt/YQjPYA4Fx6amNRXSfUITcczNI=; b=RjKdQsJ5+5Uim6TFpQWh1q9d4eSRw+8nQyEIsbVRG3vvi3XBQ3zi+1FQImAWZRBtyl 9YH4CTY1h+aJbgDjDYEeG07H3aiFz4oGQ2va5zUnP7ckEbafkM4Vxirsc9TLNZHhKsWG R+umOnlKla9XMya4JPYCrohMeJNZZYgEKGF3cx1jREm2JRqoSvB04XLgxiEIO/IBjF+G 7Xk3S2NcIhB5x7m7tkUtlRZ56z49TvYOqK0Wtw3Ho2Fp9x+YsEI7M340IkfSbFl2PJ4c ziatRLLG3sUebVSw4k0h9+5N4OMJ+7TAMazW13dF2Pu6S/lKMpovN9fFRLoCmKsZzGdg 7OfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=VTSOuROAwsy+ZmAkt/YQjPYA4Fx6amNRXSfUITcczNI=; b=I8ERb0bbu+c9o6fqpZ/tAzaZrAR5XFDHUR4DWUllSV5anCHeFpm9Cv3/+48kylZNc0 zgNpcwhcECn57ZOoCJACQg33cK4eu+EwHDAamoLqKdJ/9q7uj0zWTqiSBeeldRD8cQYt Yuvo6NmHBiXA6lZmxIjexQpfC10pspaxhuiI9jJz5IobXVW9J9ej89e+gfc5fhGj0SL5 7HOFl3a3Q6qUQxHru5p48OapebHVhck6/jfS0nMYY9BmuzZWJ44BwKhEfYG1s9tyERlg H5sdj5k+MdVofryT4NUQzd2tDYrZ6Ah3Q8RXCrFd1fwoviRKXcU5wSF06G8pSZb0hLKK 9ysA== X-Gm-Message-State: AOAM533+IoiI5PQ5/9XWa/ia0bNL07rR5BmoDEy32VeXUpVeFGVMuMfJ WKRzjjnO475lbfy7VMd3tj8kVTn6SR8OGyAogok/RWlf X-Google-Smtp-Source: ABdhPJyCGNsgU4QzQMH3lsWNP+gww+XPCr92cu3+QaiyuKypKEZlV8JnjLgQB94R7C7Rq8FFX1ll5jY9gQmwLEQuqCU= X-Received: by 2002:a05:6602:2417:: with SMTP id s23mr8615002ioa.94.1595890222701; Mon, 27 Jul 2020 15:50:22 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> <3B4BDD38-4C0E-4444-A294-0E17BA5E2FA8@fugue.com> In-Reply-To: <3B4BDD38-4C0E-4444-A294-0E17BA5E2FA8@fugue.com> From: Rob Sayre Date: Mon, 27 Jul 2020 15:50:11 -0700 Message-ID: To: Ted Lemon Cc: "STARK, BARBARA H" , "add@ietf.org" , Paul Vixie Content-Type: multipart/alternative; boundary="000000000000d3209305ab7425ab" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 22:50:25 -0000 --000000000000d3209305ab7425ab Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Jul 27, 2020 at 3:26 PM Ted Lemon wrote: > > If on the other hand you mean that we should write a document saying =E2= =80=9Cthe > network should tell you with DHCP not to do DoH,=E2=80=9D then it=E2=80= =99s going to be > very hard to get consensus on that... > I agree. After all, malware will ignore this signal. thanks, Rob --000000000000d3209305ab7425ab Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, Jul 27, 2020 at 3:26 PM Ted Lemon= <mellon@fugue.com> wrote:

If= on the other hand you mean that we should write a document saying =E2=80= =9Cthe network should tell you with DHCP not to do DoH,=E2=80=9D then it=E2= =80=99s going to be very hard to get consensus on that...

I agree. After all, malware will ignore this sig= nal.

thanks,
Rob

--000000000000d3209305ab7425ab-- From nobody Mon Jul 27 16:24:31 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DEF753A0A05 for ; Mon, 27 Jul 2020 16:24:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.918 X-Spam-Level: X-Spam-Status: No, score=-1.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nbcuni.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Uu3RLpvFy9M for ; Mon, 27 Jul 2020 16:24:11 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0a-00176a04.pphosted.com [67.231.149.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CDA1C3A09FD for ; Mon, 27 Jul 2020 16:24:10 -0700 (PDT) Received: from pps.filterd (m0193509.ppops.net [127.0.0.1]) by m0193509.ppops.net-00176a04. (8.16.0.42/8.16.0.42) with SMTP id 06RNHbTl006469 for ; Mon, 27 Jul 2020 19:24:10 -0400 Received: from usecmgip001.mail.tfayd.com ([50.228.147.33]) by m0193509.ppops.net-00176a04. with ESMTP id 32gf6x88ak-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 27 Jul 2020 19:24:09 -0400 IronPort-SDR: 85cELfmFmnmDeTYSD8wgXm9hww20bsikoGwlxjh1cW1I5UEk4JLX+CHTHyLsFligmAip9sv1HG wy8Cxb9ItIKw== Received: from unknown (HELO ashemwp00006.mail.tfayd.com) ([100.126.24.30]) by USECMGIP001.mail.tfayd.com with ESMTP/TLS/ECDHE-RSA-AES128-SHA256; 27 Jul 2020 19:24:09 -0400 Received: from ashemwp00004.mail.tfayd.com (100.126.24.28) by ashemwp00007.mail.tfayd.com (100.126.24.31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1913.5; Mon, 27 Jul 2020 19:24:07 -0400 Received: from NAM11-CO1-obe.outbound.protection.outlook.com (10.56.130.76) by ashemwp00004.mail.tfayd.com (100.126.24.28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1913.5 via Frontend Transport; Mon, 27 Jul 2020 19:24:07 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=PaFYRvm4xW4sKpKZ/Irzahbo+q3UFhX2kjG7fgedei7pVdyrY9WIq3rSlWUpHBC0z7z4QYmk3KG0bflF/rlTfBjFWcDXczjQzntKYAlu9rW9f5ZLxgYU3VHCpv3XKROxgA4dUYwtNchqahXr+mq8pn2kE1YtGz1Y2heMJRAks6xr6nfpKFSDCet0Trqj6Pif6eDu5pLw8I/BLPbEb6IHy6cmvqne76ABOrXhWkRYZ6os5OSZ6gyThpJ2HorV94sZIEk3rG5J1w7cTS//H+1BK+0AYh4ilPdkccGvJN0jTW+YDcN/d+Oo3o+HDdetCJvH8s+iXw8hVTjavNoDWsEZYA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=233ML8L8xVB19TZ5aQMLr3HU+7Hv+5UczuxCsdcP7/8=; b=J/xIdaP/HTdRzKQAYXI8Tap81hjklo+s/5Phm9pH3yBFF6w9q2WjeJ8NI+ayBnEMBm4OjLdCB+dE2CnJxdFYP2viOG698h25IByLVh4xg9EM2CS1xBVXdIKWgM45ZArtvefCYAcQ2kwV99ZVSLsVkD5Q8gF4cDL6Vsu3DZL/XBXV78UytXjhLOUNM3ZR+16N1VLmYTbIP5EjupR6rd8MC6bPtUsN8IcBpH1b4ED5Khvl4QCOerIdMAm5L1CianYRGgqjpVZwZd6+QGN3tMX3WBDgSbEtoU4WszcK1qJ0tc0qGo0hC8ghZJA65ax/C1v8LTV7jKWDux1joggx/YAlvg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nbcuni.com; dmarc=pass action=none header.from=nbcuni.com; dkim=pass header.d=nbcuni.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NBCUNI.onmicrosoft.com; s=selector1-NBCUNI-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=233ML8L8xVB19TZ5aQMLr3HU+7Hv+5UczuxCsdcP7/8=; b=evOkC7Yog8iVoQs8FKVQcnyA4rCjfu8etciltyIEEXuZtDi7iVDBU1cNQKaFY8oKn+tcpEGHJ/ZnCXUe76AOtN5meLQ3YO1CXYnwrdK9UmY2Z7AKm+9eo/U9W5R3Jga1m2WZGjYF7bDq8l61KzW91jvglbLOUjZkB5QhxjNKeeI= Received: from BYAPR14MB3094.namprd14.prod.outlook.com (2603:10b6:a03:14d::30) by BYAPR14MB3238.namprd14.prod.outlook.com (2603:10b6:a03:d8::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.24; Mon, 27 Jul 2020 23:24:04 +0000 Received: from BYAPR14MB3094.namprd14.prod.outlook.com ([fe80::e074:901e:d085:be5c]) by BYAPR14MB3094.namprd14.prod.outlook.com ([fe80::e074:901e:d085:be5c%7]) with mapi id 15.20.3216.033; Mon, 27 Jul 2020 23:24:04 +0000 From: "Deen, Glenn (NBCUniversal)" To: Rob Sayre CC: ADD Mailing list Thread-Topic: [Add] "primary control over DNS routing should lie with..." Thread-Index: AQHWZG0EdZpCZ0VhyUmPjIjw/WemDA== Date: Mon, 27 Jul 2020 23:24:04 +0000 Message-ID: <2583C66A-29E9-43B1-8BF5-DDF3D976DC61@nbcuni.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=nbcuni.com; x-originating-ip: [2605:e000:141b:121:982b:d7d5:799b:4093] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 11a8950c-bbc2-444f-01ed-08d8328426fe x-ms-traffictypediagnostic: BYAPR14MB3238: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: aRtKVm5m3xgn3FrxIvZj3gZUhuMb1/01cWTg5Bvvuoz5nly32B5PHsuuT17lUglXcj+H/xWTUDkqqCbNuouisqgIJUVUbHQl8rWwVgmBaOiWywci/xlw7BT0JxOYZWo2l4F8WeBrL8m5tPME8SAR5v+Mb16DKQ7hzrF5HtO8CLuxXChnUdZhWhUOvsFKDD/7FlsvoGS6fTm/COJNerLHxbUyrs9sqJxiQWFR8hSpMvz5NBH4aAHxSjnvjVOV/nd/B1XZkuZ42EJpOqxQb3lD248d+CnsUIFfZ2YyoIkT8KjYz41+t2xasorrNMSx9zguEfaGalaLCgARg8jwr65+I4tILHWf0wZR/j1vAjsmXg2MyZeKVIorEWbXbR9lbA5y6tRLiCPx0ZCPuyXOTYnkgw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR14MB3094.namprd14.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(396003)(136003)(376002)(346002)(39860400002)(6506007)(66556008)(2906002)(66476007)(64756008)(66446008)(86362001)(76116006)(478600001)(66946007)(186003)(33656002)(8676002)(6916009)(8936002)(6512007)(5660300002)(316002)(6486002)(71200400001)(2616005)(66574015)(36756003)(4326008)(166002)(83380400001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: PP9w2D/GxxXzA4VIp2yKUS+Sx3YovlW8dya6Eu4kMDnzppx8T4Wvqqhe5yIwA+I69DTIoaRIpLEUx4Z/DrP5+JksK/jgpOY+SgSYVR5jaeFMD2Qwu7jQyGU4qcURCYat9OD39bqNOTtiDK+nWL1XWo/wmXUgGstF5LtR8XnXsnktDAywwdrDs+2ThdvY+IBv1Z3omcRlBJwoNDcqE1DhumE3/i2Be4lJMFjAROtjr04hgvXTnR2ha5qzEvP8oahLIUM40/M7MLuE/NCijeivei2kg5VX1arKWZOOlq5+oNS/aULOrp/ESsK7H8c9OJLjKW7JXKlFoWA1szqgpiGVxW8n9oiAZ+gmbfE5ojKJ+wj70I1Mjsx1ATofNVy90RdSqhnFsPWGzyNxTA41S7tpQ5dIotB0h03Z7YDtXROZs/FsA7K+Y5Cl1NW4YoG0CH3i146IttzPm49LFpK5D10DNkEGfWJGD1To3S2VzSxvSF3rNIdsRoJNkax3FC9rTpUyUOGW+2/7Z+QCdjh0GgmHN2Mt3LjpGlN089fh2bl8dV8neFKgGOOZpFf2QicTdtfl x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_2583C66A29E943B18BF5DDF3D976DC61nbcunicom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BYAPR14MB3094.namprd14.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 11a8950c-bbc2-444f-01ed-08d8328426fe X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Jul 2020 23:24:04.3518 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4f3526f9-97d6-412d-933a-4e30a73110f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: NBkhbcgwAkQkESefWR/PBc4tqU4WI4cmwDetZN0heD3BNV5E4Ofb9IehjYrQIKUB4TqKohuELrgczwjnLC6cNQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR14MB3238 X-OriginatorOrg: nbcuni.com X-EXCLAIMER-MD-CONFIG: 47edc00f-f2d6-45ef-be83-8a353bd47e45 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-27_15:2020-07-27, 2020-07-27 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 malwarescore=0 impostorscore=0 mlxlogscore=999 clxscore=1015 bulkscore=0 suspectscore=0 mlxscore=0 adultscore=0 spamscore=0 phishscore=0 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007270158 Archived-At: Subject: Re: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 23:24:27 -0000 --_000_2583C66A29E943B18BF5DDF3D976DC61nbcunicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 LVRha2luZyBvZmYgbXkgY2hhaXIgaGF0IGFuZCBwb3N0aW5nIGFzIGEgY29udHJpYnV0b3Ig4oCT DQoNClJvYiwNCg0KVGhlIFJGQ+KAmXMgeW91IGNpdGUgKFJGQzE5NTgsIFJGQzc2MjQpIGhlcmUs IGFuZCBoYXZlIGNpdGVkIGJlZm9yZSB3aGVuIHRoZSBkaXNjdXNzaW9uIG9mIHNlY3VyaXR5IG1v ZGVscyBoYXMgcG9wcGVkIHVwIGFyZSBzZWVtaW5nbHkgYmVpbmcgdGFraW5nIG91dCBvZiBjb250 ZXh0IGFuZCBhcmUgYmVpbmcgcmFpc2VkIHRvIGEgaGlnaGVyIGxldmVsIG9mIGF1dGhvcml0eSB0 aGF0IEkgYmVsaWV2ZSB0aGUgSUFCIGludGVuZGVkIHRoZW0gdG8gYmUuDQoNClRoZXkgYXJlIGJl aW5nIGNpdGVkIG91dCBvZiBjb250ZXh0IGFzIGlmIHRoZXkgYXJlIGNvbXBsZXRlIGFyY2hpdGVj dHVyZSBkZXNpZ24gZG9jdW1lbnRzIGlzc3VlZCBieSB0aGUgSUFCIGFuZCB0aGVzZSBkb2N1bWVu dHMgc3VwZXJzZWRlIGFuZCBpbnZhbGlkYXRlIGFueSBvdGhlciBhcHByb2FjaGVzLCB0ZWNobm9s b2d5IG9yIG9wZXJhdGlvbmFsIGNob2ljZXMuICBUaGV5IGFyZSBpbnN0ZWFkIEluZm9ybWF0aW9u YWwgZ3VpZGFuY2UsIGJhc2VkIG9uIHNwZWNpZmljIGlzc3VlcyB0aGF0IHRoZSBJQUIgaGFzIGV4 YW1pbmVkLiBUaGV5IGFyZSBub3QgbGVnaXNsYXRpb24gcGFzc2VkIGJ5IHRoZSBJQUIgb3IgZXZl biB0aGUgSUVURiB0byB3aGljaCBjb21wbGlhbmNlIGlzIG1hbmRhdG9yeSBhbmQgcHVuaXNoYWJs ZS4gICAgSGVuY2Ugd2h5IHRoZXkgYXJlIHB1Ymxpc2hlZCBhcyBJbmZvcm1hdGlvbmFsIFJGQ3Mg YW5kIG5vdCBTdGFuZGFyZHMgVHJhY2sgUkZDcy4gSXQgc2F5cyBzbyByaWdodCBvbiB0aGUgZmly c3QgcGFnZSBvZiBlYWNoIGRvY3VtZW50Og0KDQpTdGF0dXMgb2YgVGhpcyBNZW1vDQoNCiAgIFRo aXMgZG9jdW1lbnQgaXMgbm90IGFuIEludGVybmV0IFN0YW5kYXJkcyBUcmFjayBzcGVjaWZpY2F0 aW9uOyBpdCBpcw0KICAgcHVibGlzaGVkIGZvciBpbmZvcm1hdGlvbmFsIHB1cnBvc2VzLg0KDQog ICBUaGlzIGRvY3VtZW50IGlzIGEgcHJvZHVjdCBvZiB0aGUgSW50ZXJuZXQgQXJjaGl0ZWN0dXJl IEJvYXJkIChJQUIpDQogICBhbmQgcmVwcmVzZW50cyBpbmZvcm1hdGlvbiB0aGF0IHRoZSBJQUIg aGFzIGRlZW1lZCB2YWx1YWJsZSB0bw0KICAgcHJvdmlkZSBmb3IgcGVybWFuZW50IHJlY29yZC4g IEl0IHJlcHJlc2VudHMgdGhlIGNvbnNlbnN1cyBvZiB0aGUNCiAgIEludGVybmV0IEFyY2hpdGVj dHVyZSBCb2FyZCAoSUFCKS4gIERvY3VtZW50cyBhcHByb3ZlZCBmb3INCiAgIHB1YmxpY2F0aW9u IGJ5IHRoZSBJQUIgYXJlIG5vdCBhIGNhbmRpZGF0ZSBmb3IgYW55IGxldmVsIG9mIEludGVybmV0 DQogICBTdGFuZGFyZDsgc2VlIFNlY3Rpb24gMiBvZiBSRkMgNTc0MTxodHRwczovL3Rvb2xzLmll dGYub3JnL2h0bWwvcmZjNTc0MSNzZWN0aW9uLTI+Lg0KDQoNClRoZSBsZXZlbCB0aGV5IGhhdmUg YmVlbiByYWlzZWQgdG8gaXMgYmV5b25kIHRoZSByb2xlIG9mIHRoZSBJQUIuICBUaG9zZSBSRkPi gJlzIGFyZSBpbmZvcm1hdGlvbmFsIGd1aWRhbmNlIG9uIHNwZWNpZmljIGlzc3VlcyB0aGF0IHRo ZSBJQUIgaGFzIGxvb2tlZCBpbnRvLCBkaXNjdXNzZWQsIGFuZCBwcm9kdWNlZCBJTkZPUk1BVElP TkFMIGRvY3VtZW50cyBvbiBob3cgdG8gYWRkcmVzcyB0aGUgaXNzdWVzIGFyY2hpdGVjdHVyYWxs eS4gICBBbGwgSUFCIGRvY3VtZW50cyBhbHNvIG5lZWRzIHRvIGJlIHJlYWQgaW4gdGhlIGNvbnRl eHQgb2YgdGhlaXIgb3RoZXIgcHVibGlzaGVkIFJGQ3MgYW5kICBpbiB0aGUgY29udGV4dCBvZiB0 aGUgc3RhbmRhcmRzIGFuZCB0ZWNobm9sb2d5IGF2YWlsYWJsZSBhbmQgd2hlbiBhbGwgdGhvc2Ug b3RoZXIgZG9jdW1lbnRzIGFuZCB0aGluZ3MgYXJlIGNvbnNpZGVyZWQg4oCTIGl0IHN0aWxsIGlz IHVwIHRvIHRoZSBjaG9pY2Ugb2YgdGhlIG5ldHdvcmsgYW5kIHNlY3VyaXR5IGFyY2hpdGVjdCB0 byBjaG9vc2UgaG93IHRvIGJ1aWxkIHRoZWlyIHN5c3RlbXMuDQoNClRoZSBJQUIgaXMgbm90IHRo ZSBhcmNoaXRlY3R1cmFsIGF1dGhvcml0eSBmb3IgdGhlIEludGVybmV0LCBzbyBpdOKAmXMgbm90 IGNvcnJlY3QgdG8gY2l0ZSB0aGVpciBwdWJsaWNhdGlvbnMgYW5kIHRvIHN1Z2dlc3QgdGhhdCBh bnl0aGluZyBub3QgbGlzdGVkIGluc2lkZSB0aGVtIGlzIHRvIGJlIHRocm93biBhd2F5IGFuZCBh YmFuZG9uZWQuICBUaGUgSUFCIEluZm9ybWF0aW9uYWwgUkZDcyBhcmUgZ29vZCBndWlkYW5jZSBv biB0b3BpY3MgYW5kIG5vdCBmaW5hbCB0ZWNobmljYWwgcnVsaW5ncyBvbiBhIHN1YmplY3QgaW4g dGhlIHNhbWUgd2F5IGEgdGVjaG5pY2FsIHNwZWNpZmljYXRpb24gbGlrZSBUTFMgY2FuIGVpdGhl ciBlc3RhYmxpc2ggb3IgZGVwcmVjYXRlIEFQSeKAmXMgb3IgcGFydGljdWxhciBtZWFuaW5ncyBv ZiBiaXRzLg0KDQpUaGUgSUFC4oCZcyBkb2N1bWVudHMgYXJlIGhlbHBmdWwgYnV0IHRoZXkgYXJl buKAmXQgdGhlIGZpbmFsIHdvcmQgb24gc3ViamVjdHMsIG5vciBhcmUgdGhleSBtZWFudCB0byBi ZS4gICBVbHRpbWF0ZWx5LCB0aGUgaWRlYXMgaW4gdGhlbSBkbyBoZWxwIGd1aWRlIElFVEYgU3Rh bmRhcmRzIFRyYWNrIGRpc2N1c3Npb25zIGFuZCBkaXJlY3Rpb25zIGFuZCBpbiB0aGF0IHdheSBj b250cmlidXRlIHRvIHRoZSBzaGFwaW5nIG9mIHRoZSBJbnRlcm5ldCwgYnV0IHRoZXkgZG9u4oCZ dCBpbiB0aGUgd2F5IHlvdeKAmXZlIGFzc2VydGVkIGludmFsaWRhdGUgYW5kIGRlcHJlY2F0ZSBh bGwgb3RoZXIgYXBwcm9hY2hlcy4gIFRoZSBJbnRlcm5ldCBpc27igJl0IG9yZ2FuaXplZCB0aGF0 IHdheSDigJMgaXTigJlzIG5vdCBhIGNlbnRyYWxpemVkIElBQiBkZXNpZ25lZCBhcmNoaXRlY3R1 cmUuICAgIElmIGl0IHdoZXJlIHdlIHdvdWxkIGhhdmUgYWxsIGJlIHVzaW5nIElQdjYgMjAgeWVh cnMgYWdvIGFzIHdlbGwgYXMgZXZlcnkgYnJvd3NlciB3b3VsZCBiZSBkb2luZyBETlNTRUMuDQoN CkJhc2ljYWxseSBwdXQsIElBQiBSRkPigJlzIGFyZSBpbmZvcm1hdGlvbmFsIG5vdCBsZWdpc2xh dGl2ZSBkb2N1bWVudHMuDQoNClBhdWwgbWFrZXMgYSB2ZXJ5IHZhbGlkIHBvaW50IOKAkyB0aGVy ZSBhcmUgdmVyeSBzaWduaWZpY2FudCBudW1iZXJzIG9mIG5ldHdvcmtzIGluIEVudGVycHJpc2Vz LCBnb3Zlcm5tZW50cywgc2Nob29scywgdW5pdmVyc2l0aWVzLCBhbmQgZXZlbiBob21lcyBvZiBz b21lIGhpZ2hseSBza2lsbGVkIGVuZ2luZWVycyB0aGF0IHdpbGwgaGF2ZSBEb0ggcHJlc2VudCBv biBkZXZpY2VzLCBvcGVyYXRpbmcgc3lzdGVtcywgYW5kIGFwcGxpY2F0aW9ucyBhbmQgd2lsbCBi ZSBhdHRlbXB0aW5nIHRvIGRvIGRpc2NvdmVyeSwgYW5kIHRoZXNlIG5ldHdvcmtzIGRvIGhhdmUg c2VjdXJpdHkgcHJhY3RpY2VzIGFuZCBzZWN1cml0eSBzeXN0ZW1zIHdoaWNoIG1heSBpbnRlcmZl cmUgd2l0aCBjZXJ0YWluIGRpc2NvdmVyeSBhcHByb2FjaGVzIOKAkyBhbmQgQUREIHNob3VsZCBi ZSB0YWtpbmcgdGhvc2UgdGhpbmdzIGludG8gYWNjb3VudCB0aGUgYmVzdCB3ZSBjYW4uDQoNCklu IHByYWN0aWNhbCB0ZXJtcyDigJMgdGhlcmUgYXJlIHNldmVyYWwgdmFsaWQgdXNlcyBjYXNlcyBv ZiB3aGVyZSBhIERvSCB1c2VyIHdpbGwgYmUgYXR0ZW1wdGluZyB0byBkaXNjb3ZlciBhIHJlc29s dmVyOg0KDQooMSkgVGhlIG9wZW4gSW50ZXJuZXQ7DQooMikgaG9tZSBuZXR3b3JrcyBjb25uZWN0 ZWQgdmlhIGEgQ1BFIGRldmljZSBjb250cm9sbGVkIGJ5IHRoZSB1c2VyOw0KKDMpIGhvbWUgbmV0 d29ya3MgY29ubmVjdGVkIHZpYSBhIENQRSBkZXZpY2UgY29udHJvbGxlZCBieSB0aGUgQWNjZXNz IE5ldHdvcmsgcHJvdmlkZXIgb3IgSVNQOw0KKDQpIGd1ZXN0L3Zpc2l0b3IgbmV0d29ya3MgZnJv bSBjYWbDqeKAmXMsIGFpcnBsYW5lcywgYWlycG9ydHMsIGJ1cyBzdGF0aW9ucywgYW5kIG1heWJl IHNvb24geW91ciBvd24gY2FyIHdoZXJlIHRoZSB1c2VyIGhhcyBubyBkaXJlY3QgY29udHJvbCBv ciBhZG1pbmlzdHJhdGl2ZSBpbnNpZ2h0L2NvbnRyb2wvc2F5Lg0KKDUpIHByaXZhdGUgbmV0d29y a3Mgc3VjaCBhcyBFbnRlcnByaXNlcywgYnVzaW5lc3MsIHNjaG9vbHMsIGdvdmVybm1lbnQgb2Zm aWNlcywgZXRjLjsNCig2KSBNb2JpbGUgbmV0d29ya3Mgd2l0aCB0aGUgZWRnZSBnYXRld2F5IGJl dHdlZW4gdGhlIG1vYmlsZSBkZXZpY2UgYW5kIHRoZSBJbnRlcm5ldCBydW4gYnkgdGhlIG1vYmls ZSBvcGVyYXRvciDigJMgd2hvIG1heSAgYWxzbyBoYXZlIGNvbnNpZGVyYWJsZSBjb250cm9sIG9u IHRoZSBiZWhhdmlvciBvZiB0aGUgbW9iaWxlIGRldmljZS4NCg0KSW4gYWxsIGNhc2VzLCBleGNl cHQgIzEg4oCTIHRoZSBvcGVuIEludGVybmV0IC0gdGhlcmUgbWF5IGJlIGEgdmFyaWV0eSBvZiBz ZWN1cml0eSBzZXR0aW5ncywgdG9vbHMsIG1vbml0b3JzLCBibG9ja3MsIGR5bmFtaWMgcmVzcG9u c2VzIHRoYXQgd2lsbCBuZWVkIHRvIGJlIHN1Y2Nlc3NmdWxseSB3b3JrZWQgd2l0aCBpbiBvcmRl ciBmb3IgYSBzdWNjZXNzZnVsIERvSCByZXNvbHZlciBkaXNjb3ZlciB0byB0YWtlIHBsYWNlLiAg SWYgd2Ugb25seSBkZXNpZ24gZm9yICMxIGluIG91ciB3b3JrIGluIEFERCB3ZSB3aWxsIGJlIGNv bWluZyB1cCB2ZXJ5IHNob3J0IG9uIHdoYXQgYWN0dWFsIHVzZXJzIG5lZWQgdG8gaGF2ZSBpZiB0 aGV5IHdhbnQgdG8gZWFzaWx5IHVzZSBEb0guDQoNClRoZSB3b3JrIGJlaW5nIGRvbmUgaW4gQURE IG9uIGRpc2NvdmVyeSBkb2VzIG5lZWQgdG8sIGFzIGJlc3QgaXQgY2FuLCByZWNvZ25pemUgdGhh dCB0aGUgc2l0dWF0aW9ucyBhYm92ZSBleGlzdCBhbmQgdHJ5IHRvIHVuZGVyc3RhbmQgYW5kIHdv cmsgd2l0aGluIHRoZSBjb25zdHJhaW50cyB0aGF0IGNvbWUgd2l0aCB0aGVtIOKAkyBvdGhlcndp c2UgYSBncmVhdCBtYW55IG9mIHRob3NlIGRldmljZXMsIG9wZXJhdGluZyBzeXN0ZW1zLCBhbmQg YXBwbGljYXRpb25zIHdpbGwgYmUgdW5hYmxlIHRvIHN1Y2Nlc3NmdWxseSB1c2UgRG9ILCBhbmQg dGhhdCBpbiB0dXJuIGhhbXBlcnMgdHJ5aW5nIHRvIGFjY29tbW9kYXRlIHRoZSByZWNvbW1lbmRh dGlvbnMgaW4gUkZDIDc2MjQgb24gYWRkcmVzc2luZyBwZXJ2YXNpdmUgbW9uaXRvcmluZyBpbiB0 aGUgY2FzZSBvZiBETlMgcXVlcmllcy4NCg0KU28gdG8gcmVqZWN0IHRoZSBwb2ludCB0aGF0IFBh dWwgaXMgcmFpc2luZyBpcyBhY3R1YWxseSB3b3JraW5nIGFnYWluc3QgdGhlIGdvYWwgb2YgUkZD IDc2MjQgYmVjYXVzZSBpdCBtYXkgd2VsbCBjdXQgb2ZmIHVzZXLigJlzIGZyb20gYmVpbmcgYWJs ZSB0byB1c2UgRG9ILg0KDQoNCuKAplB1dHRpbmcgYmFjayBvbiB0aGUgQ2hhaXIgaGF04oCmLg0K DQogICAgICAgICAgICAgIERpc2N1c3NpbmcgdGhlIHRlY2huaWNhbCBtZXJpdHMgYW5kIGRldGFp bHMgb2YgZGlzY292ZXJ5IGFwcHJvYWNoZXMgaXMgZmluZSwgZXZlbiBkaXNjdXNzaW5nIGlzc3Vl cyBpbnRyb2R1Y2VkDQogICAgICAgICAgICAgIGJ5IHBhcnRpY3VsYXIgc2VjdXJpdHkgbW9kZWxz IGFuZCB0b29scyBhbmQgaG93IHRvIHdvcmsgd2l0aCB0aGVtIGlzIGluIHNjb3BlIG9mIGV2YWx1 YXRpbmcgZGlzY292ZXJ5ICBwcm9wb3NhbHMuDQogICAgICAgICAgICAgIEJ1dCB1bmxlc3MgYSBw b3N0IGNhbiBicmluZyBpdCBiYWNrIHRvIGFkdmFuY2luZyBvdXIgZGlzY292ZXJ5IGRpc2N1c3Np b24g4oCTIGl04oCZcyBwcm9iYWJseSBvdXQgb2Ygc2NvcGUgZm9yIEFERC4NCg0KDQpSZWdhcmRz DQpHbGVubg0KDQoNCg0K --_000_2583C66A29E943B18BF5DDF3D976DC61nbcunicom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OldpbmdkaW5nczsNCglwYW5vc2UtMTo1IDAg MCAwIDAgMCAwIDAgMCAwO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0 aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQt ZmFjZQ0KCXtmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIFwoQm9keSBDU1wpIjsNCglwYW5v c2UtMToyIDIgNiAzIDUgNCA1IDIgMyA0O30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1z b05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFy Z2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6 cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6SGVsdmV0aWNhOw0KCWNvbG9yOndpbmRvd3Rl eHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9u dC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47 DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7 cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7 bXNvLWxpc3QtaWQ6NTkzNTkxNjAyOw0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0 LXRlbXBsYXRlLWlkczotMTg5NDMyODc5MiAxNzExNTM4NTA0IDY3Njk4NjkxIDY3Njk4NjkzIDY3 Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzO30NCkBs aXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6NjsNCgltc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674GuOw0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5 OkNhbGlicmk7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiBcKEJvZHkg Q1NcKSI7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1m YW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZl bDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30N CkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6 V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ Zm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDEN Cgl7bXNvLWxpc3QtaWQ6NjcxNDk1NjcwOw0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1s aXN0LXRlbXBsYXRlLWlkczo2NjQzMDE4NTAgLTMwNzk5MDU5NCA2NzY5ODY5MSA2NzY5ODY5MyA2 NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpA bGlzdCBsMTpsZXZlbDENCgl7bXNvLWxldmVsLXN0YXJ0LWF0OjY7DQoJbXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Oi07DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCglmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6 Q2FsaWJyaTsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIFwoQm9keSBD U1wpIjt9DQpAbGlzdCBsMTpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZh bWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwxOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxOmxldmVsNA0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVs NQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0K QGxpc3QgbDE6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpX aW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglm b250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpu b25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1 aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTpsZXZlbDkNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMg0K CXttc28tbGlzdC1pZDoxOTY4OTMwNjE3Ow0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1s aXN0LXRlbXBsYXRlLWlkczotMTUxODQzNjQwMCA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2 NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNTt9DQpA bGlzdCBsMjpsZXZlbDENCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMjpsZXZl bDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0uMjVpbjt9DQpAbGlzdCBsMjpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDI6bGV2ZWw0 DQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDI6bGV2ZWw1DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0K QGxpc3QgbDI6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0K CW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmln aHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwyOmxldmVsNw0KCXttc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluO30NCkBsaXN0IGwyOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwyOmxldmVs OQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5k ZW50Oi05LjBwdDt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90 dG9tOjBpbjt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9 ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPi1UYWtp bmcgb2ZmIG15IGNoYWlyIGhhdCBhbmQgcG9zdGluZyBhcyBhIGNvbnRyaWJ1dG9yIOKAkw0KPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OkhlbHZldGljYSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYSI+Um9iLDxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTpIZWx2ZXRpY2EiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPlRoZSBS RkPigJlzIHlvdSBjaXRlIChSRkMxOTU4LCBSRkM3NjI0KSBoZXJlLCBhbmQgaGF2ZSBjaXRlZCBi ZWZvcmUgd2hlbiB0aGUgZGlzY3Vzc2lvbiBvZiBzZWN1cml0eSBtb2RlbHMgaGFzIHBvcHBlZCB1 cCBhcmUgc2VlbWluZ2x5IGJlaW5nIHRha2luZyBvdXQgb2YgY29udGV4dCBhbmQgYXJlIGJlaW5n IHJhaXNlZCB0byBhIGhpZ2hlciBsZXZlbA0KIG9mIGF1dGhvcml0eSB0aGF0IEkgYmVsaWV2ZSB0 aGUgSUFCIGludGVuZGVkIHRoZW0gdG8gYmUuIDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPlRoZXkgYXJlIGJlaW5nIGNpdGVkIG91dCBvZiBjb250 ZXh0IGFzIGlmIHRoZXkgYXJlIGNvbXBsZXRlIGFyY2hpdGVjdHVyZSBkZXNpZ24gZG9jdW1lbnRz IGlzc3VlZCBieSB0aGUgSUFCIGFuZCB0aGVzZSBkb2N1bWVudHMgc3VwZXJzZWRlIGFuZCBpbnZh bGlkYXRlIGFueSBvdGhlciBhcHByb2FjaGVzLCB0ZWNobm9sb2d5IG9yIG9wZXJhdGlvbmFsDQog Y2hvaWNlcy4mbmJzcDsgVGhleSBhcmUgaW5zdGVhZCBJbmZvcm1hdGlvbmFsIGd1aWRhbmNlLCBi YXNlZCBvbiBzcGVjaWZpYyBpc3N1ZXMgdGhhdCB0aGUgSUFCIGhhcyBleGFtaW5lZC4gVGhleSBh cmUgbm90IGxlZ2lzbGF0aW9uIHBhc3NlZCBieSB0aGUgSUFCIG9yIGV2ZW4gdGhlIElFVEYgdG8g d2hpY2ggY29tcGxpYW5jZSBpcyBtYW5kYXRvcnkgYW5kIHB1bmlzaGFibGUuJm5ic3A7ICZuYnNw OyZuYnNwO0hlbmNlIHdoeSB0aGV5IGFyZSBwdWJsaXNoZWQgYXMgSW5mb3JtYXRpb25hbA0KIFJG Q3MgYW5kIG5vdCBTdGFuZGFyZHMgVHJhY2sgUkZDcy4gSXQgc2F5cyBzbyByaWdodCBvbiB0aGUg Zmlyc3QgcGFnZSBvZiBlYWNoIGRvY3VtZW50OjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2Nv bG9yOmJsYWNrIj5TdGF0dXMgb2YgVGhpcyBNZW1vPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj4m bmJzcDsmbmJzcDsgVGhpcyBkb2N1bWVudCBpcyBub3QgYW4gSW50ZXJuZXQgU3RhbmRhcmRzIFRy YWNrIHNwZWNpZmljYXRpb247IGl0IGlzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBwdWJsaXNoZWQg Zm9yIGluZm9ybWF0aW9uYWwgcHVycG9zZXMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj4mbmJz cDsmbmJzcDsgVGhpcyBkb2N1bWVudCBpcyBhIHByb2R1Y3Qgb2YgdGhlIEludGVybmV0IEFyY2hp dGVjdHVyZSBCb2FyZCAoSUFCKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsgYW5kIHJlcHJlc2VudHMg aW5mb3JtYXRpb24gdGhhdCB0aGUgSUFCIGhhcyBkZWVtZWQgdmFsdWFibGUgdG88bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+ Jm5ic3A7Jm5ic3A7IHByb3ZpZGUgZm9yIHBlcm1hbmVudCByZWNvcmQuJm5ic3A7IEl0IHJlcHJl c2VudHMgdGhlIGNvbnNlbnN1cyBvZiB0aGU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7IEludGVybmV0 IEFyY2hpdGVjdHVyZSBCb2FyZCAoSUFCKS4mbmJzcDsgRG9jdW1lbnRzIGFwcHJvdmVkIGZvcjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9y OmJsYWNrIj4mbmJzcDsmbmJzcDsgcHVibGljYXRpb24gYnkgdGhlIElBQiBhcmUgbm90IGEgY2Fu ZGlkYXRlIGZvciBhbnkgbGV2ZWwgb2YgSW50ZXJuZXQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7IFN0 YW5kYXJkOyBzZWUNCjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM1NzQx I3NlY3Rpb24tMiI+U2VjdGlvbiZuYnNwOzIgb2YgUkZDIDU3NDE8L2E+LjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpI ZWx2ZXRpY2EiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTpIZWx2ZXRpY2EiPlRoZSBsZXZlbCB0aGV5IGhhdmUgYmVlbiByYWlzZWQgdG8gaXMgYmV5b25k IHRoZSByb2xlIG9mIHRoZSBJQUIuJm5ic3A7IFRob3NlIFJGQ+KAmXMgYXJlIGluZm9ybWF0aW9u YWwgZ3VpZGFuY2Ugb24gc3BlY2lmaWMgaXNzdWVzIHRoYXQgdGhlIElBQiBoYXMgbG9va2VkIGlu dG8sIGRpc2N1c3NlZCwgYW5kIHByb2R1Y2VkIElORk9STUFUSU9OQUwgZG9jdW1lbnRzDQogb24g aG93IHRvIGFkZHJlc3MgdGhlIGlzc3VlcyBhcmNoaXRlY3R1cmFsbHkuICZuYnNwOyZuYnNwO0Fs bCBJQUIgZG9jdW1lbnRzIGFsc28gbmVlZHMgdG8gYmUgcmVhZCBpbiB0aGUgY29udGV4dCBvZiB0 aGVpciBvdGhlciBwdWJsaXNoZWQgUkZDcyBhbmQgJm5ic3A7aW4gdGhlIGNvbnRleHQgb2YgdGhl IHN0YW5kYXJkcyBhbmQgdGVjaG5vbG9neSBhdmFpbGFibGUgYW5kIHdoZW4gYWxsIHRob3NlIG90 aGVyIGRvY3VtZW50cyBhbmQgdGhpbmdzIGFyZSBjb25zaWRlcmVkDQog4oCTIGl0IHN0aWxsIGlz IHVwIHRvIHRoZSBjaG9pY2Ugb2YgdGhlIG5ldHdvcmsgYW5kIHNlY3VyaXR5IGFyY2hpdGVjdCB0 byBjaG9vc2UgaG93IHRvIGJ1aWxkIHRoZWlyIHN5c3RlbXMuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGlj YSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYSI+VGhlIElBQiBpcyBub3QgdGhlIGFyY2hp dGVjdHVyYWwgYXV0aG9yaXR5IGZvciB0aGUgSW50ZXJuZXQsIHNvIGl04oCZcyBub3QgY29ycmVj dCB0byBjaXRlIHRoZWlyIHB1YmxpY2F0aW9ucyBhbmQgdG8gc3VnZ2VzdCB0aGF0IGFueXRoaW5n IG5vdCBsaXN0ZWQgaW5zaWRlIHRoZW0gaXMgdG8gYmUgdGhyb3duIGF3YXkgYW5kIGFiYW5kb25l ZC4gJm5ic3A7VGhlDQogSUFCIEluZm9ybWF0aW9uYWwgUkZDcyBhcmUgZ29vZCBndWlkYW5jZSBv biB0b3BpY3MgYW5kIG5vdCBmaW5hbCB0ZWNobmljYWwgcnVsaW5ncyBvbiBhIHN1YmplY3QgaW4g dGhlIHNhbWUgd2F5IGEgdGVjaG5pY2FsIHNwZWNpZmljYXRpb24gbGlrZSBUTFMgY2FuIGVpdGhl ciBlc3RhYmxpc2ggb3IgZGVwcmVjYXRlIEFQSeKAmXMgb3IgcGFydGljdWxhciBtZWFuaW5ncyBv ZiBiaXRzLiZuYnNwOyZuYnNwOw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYSI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OkhlbHZldGljYSI+VGhlIElBQuKAmXMgZG9jdW1lbnRzIGFyZSBoZWxwZnVsIGJ1dCB0 aGV5IGFyZW7igJl0IHRoZSBmaW5hbCB3b3JkIG9uIHN1YmplY3RzLCBub3IgYXJlIHRoZXkgbWVh bnQgdG8gYmUuJm5ic3A7Jm5ic3A7IFVsdGltYXRlbHksIHRoZSBpZGVhcyBpbiB0aGVtIGRvIGhl bHAgZ3VpZGUgSUVURiBTdGFuZGFyZHMgVHJhY2sgZGlzY3Vzc2lvbnMgYW5kIGRpcmVjdGlvbnMg YW5kDQogaW4gdGhhdCB3YXkgY29udHJpYnV0ZSB0byB0aGUgc2hhcGluZyBvZiB0aGUgSW50ZXJu ZXQsIGJ1dCB0aGV5IGRvbuKAmXQgaW4gdGhlIHdheSB5b3XigJl2ZSBhc3NlcnRlZCBpbnZhbGlk YXRlIGFuZCBkZXByZWNhdGUgYWxsIG90aGVyIGFwcHJvYWNoZXMuJm5ic3A7IFRoZSBJbnRlcm5l dCBpc27igJl0IG9yZ2FuaXplZCB0aGF0IHdheSDigJMgaXTigJlzIG5vdCBhIGNlbnRyYWxpemVk IElBQiBkZXNpZ25lZCBhcmNoaXRlY3R1cmUuJm5ic3A7Jm5ic3A7Jm5ic3A7IElmIGl0IHdoZXJl IHdlIHdvdWxkDQogaGF2ZSBhbGwgYmUgdXNpbmcgSVB2NiAyMCB5ZWFycyBhZ28gYXMgd2VsbCBh cyBldmVyeSBicm93c2VyIHdvdWxkIGJlIGRvaW5nIEROU1NFQy48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0 aWNhIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhIj5CYXNpY2FsbHkgcHV0LCBJQUIgUkZD 4oCZcyBhcmUgaW5mb3JtYXRpb25hbCBub3QgbGVnaXNsYXRpdmUgZG9jdW1lbnRzLjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTpIZWx2ZXRpY2EiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPlBhdWwgbWFrZXMg YSB2ZXJ5IHZhbGlkIHBvaW50IOKAkyB0aGVyZSBhcmUgdmVyeSBzaWduaWZpY2FudCBudW1iZXJz IG9mIG5ldHdvcmtzIGluIEVudGVycHJpc2VzLCBnb3Zlcm5tZW50cywgc2Nob29scywgdW5pdmVy c2l0aWVzLCBhbmQgZXZlbiBob21lcyBvZiBzb21lIGhpZ2hseSBza2lsbGVkIGVuZ2luZWVycyB0 aGF0IHdpbGwgaGF2ZSBEb0ggcHJlc2VudA0KIG9uIGRldmljZXMsIG9wZXJhdGluZyBzeXN0ZW1z LCBhbmQgYXBwbGljYXRpb25zIGFuZCB3aWxsIGJlIGF0dGVtcHRpbmcgdG8gZG8gZGlzY292ZXJ5 LCBhbmQgdGhlc2UgbmV0d29ya3MgZG8gaGF2ZSBzZWN1cml0eSBwcmFjdGljZXMgYW5kIHNlY3Vy aXR5IHN5c3RlbXMgd2hpY2ggbWF5IGludGVyZmVyZSB3aXRoIGNlcnRhaW4gZGlzY292ZXJ5IGFw cHJvYWNoZXMg4oCTIGFuZCBBREQgc2hvdWxkIGJlIHRha2luZyB0aG9zZSB0aGluZ3MgaW50byBh Y2NvdW50DQogdGhlIGJlc3Qgd2UgY2FuLiZuYnNwOyZuYnNwOyA8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0 aWNhIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhIj5JbiBwcmFjdGljYWwgdGVybXMg4oCT IHRoZXJlIGFyZSBzZXZlcmFsIHZhbGlkIHVzZXMgY2FzZXMgb2Ygd2hlcmUgYSBEb0ggdXNlciB3 aWxsIGJlIGF0dGVtcHRpbmcgdG8gZGlzY292ZXIgYSByZXNvbHZlcjombmJzcDsNCjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTpIZWx2ZXRpY2EiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EiPigxKSBUaGUgb3Bl biBJbnRlcm5ldDsgPG86cD4NCjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhIj4oMikgaG9tZSBuZXR3b3JrcyBj b25uZWN0ZWQgdmlhIGEgQ1BFIGRldmljZSBjb250cm9sbGVkIGJ5IHRoZSB1c2VyOw0KPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OkhlbHZldGljYSI+KDMpIGhvbWUgbmV0d29ya3MgY29ubmVjdGVkIHZpYSBhIENQRSBk ZXZpY2UgY29udHJvbGxlZCBieSB0aGUgQWNjZXNzIE5ldHdvcmsgcHJvdmlkZXIgb3IgSVNQOw0K PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OkhlbHZldGljYSI+KDQpIGd1ZXN0L3Zpc2l0b3IgbmV0d29ya3MgZnJvbSBj YWbDqeKAmXMsIGFpcnBsYW5lcywgYWlycG9ydHMsIGJ1cyBzdGF0aW9ucywgYW5kIG1heWJlIHNv b24geW91ciBvd24gY2FyIHdoZXJlIHRoZSB1c2VyIGhhcyBubyBkaXJlY3QgY29udHJvbCBvciBh ZG1pbmlzdHJhdGl2ZSBpbnNpZ2h0L2NvbnRyb2wvc2F5LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2Ei Pig1KSBwcml2YXRlIG5ldHdvcmtzIHN1Y2ggYXMgRW50ZXJwcmlzZXMsIGJ1c2luZXNzLCBzY2hv b2xzLCBnb3Zlcm5tZW50IG9mZmljZXMsIGV0Yy47Jm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0 aWNhIj4oNikgTW9iaWxlIG5ldHdvcmtzIHdpdGggdGhlIGVkZ2UgZ2F0ZXdheSBiZXR3ZWVuIHRo ZSBtb2JpbGUgZGV2aWNlIGFuZCB0aGUgSW50ZXJuZXQgcnVuIGJ5IHRoZSBtb2JpbGUgb3BlcmF0 b3Ig4oCTIHdobyBtYXkgJm5ic3A7YWxzbyBoYXZlIGNvbnNpZGVyYWJsZSBjb250cm9sIG9uIHRo ZSBiZWhhdmlvciBvZiB0aGUgbW9iaWxlIGRldmljZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhIj5JbiBhbGwgY2FzZXMsIGV4Y2VwdCAjMSDigJMg dGhlIG9wZW4gSW50ZXJuZXQgLSB0aGVyZSBtYXkgYmUgYSB2YXJpZXR5IG9mIHNlY3VyaXR5IHNl dHRpbmdzLCB0b29scywgbW9uaXRvcnMsIGJsb2NrcywgZHluYW1pYyByZXNwb25zZXMgdGhhdCB3 aWxsIG5lZWQgdG8gYmUgc3VjY2Vzc2Z1bGx5IHdvcmtlZCB3aXRoIGluIG9yZGVyIGZvciBhIHN1 Y2Nlc3NmdWwNCiBEb0ggcmVzb2x2ZXIgZGlzY292ZXIgdG8gdGFrZSBwbGFjZS4mbmJzcDsgSWYg d2Ugb25seSBkZXNpZ24gZm9yICMxIGluIG91ciB3b3JrIGluIEFERCB3ZSB3aWxsIGJlIGNvbWlu ZyB1cCB2ZXJ5IHNob3J0IG9uIHdoYXQgYWN0dWFsIHVzZXJzIG5lZWQgdG8gaGF2ZSBpZiB0aGV5 IHdhbnQgdG8gZWFzaWx5IHVzZSBEb0guDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5UaGUgd29yayBiZWluZyBkb25lIGluIEFERCBvbiBkaXNj b3ZlcnkgZG9lcyBuZWVkIHRvLCBhcyBiZXN0IGl0IGNhbiwgcmVjb2duaXplIHRoYXQgdGhlIHNp dHVhdGlvbnMgYWJvdmUgZXhpc3QgYW5kIHRyeSB0byB1bmRlcnN0YW5kIGFuZCB3b3JrIHdpdGhp biB0aGUgY29uc3RyYWludHMgdGhhdCBjb21lIHdpdGggdGhlbSDigJMgb3RoZXJ3aXNlIGENCiBn cmVhdCBtYW55IG9mIHRob3NlIGRldmljZXMsIG9wZXJhdGluZyBzeXN0ZW1zLCBhbmQgYXBwbGlj YXRpb25zIHdpbGwgYmUgdW5hYmxlIHRvIHN1Y2Nlc3NmdWxseSB1c2UgRG9ILCBhbmQgdGhhdCBp biB0dXJuIGhhbXBlcnMgdHJ5aW5nIHRvIGFjY29tbW9kYXRlIHRoZSByZWNvbW1lbmRhdGlvbnMg aW4gUkZDIDc2MjQgb24gYWRkcmVzc2luZyBwZXJ2YXNpdmUgbW9uaXRvcmluZyBpbiB0aGUgY2Fz ZSBvZiBETlMgcXVlcmllcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6SGVsdmV0aWNhIj5TbyB0byByZWplY3QgdGhlIHBvaW50IHRoYXQgUGF1bCBpcyByYWlzaW5n IGlzIGFjdHVhbGx5IHdvcmtpbmcgYWdhaW5zdCB0aGUgZ29hbCBvZiBSRkMgNzYyNCBiZWNhdXNl IGl0IG1heSB3ZWxsIGN1dCBvZmYgdXNlcuKAmXMgZnJvbSBiZWluZyBhYmxlIHRvIHVzZSBEb0gu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OkhlbHZldGljYSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYSI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYSI+4oCmUHV0dGluZyBiYWNrIG9uIHRoZSBDaGFpciBo YXTigKYuJm5ic3A7Jm5ic3A7Jm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJm5ic3A7RGlzY3Vzc2luZyB0 aGUgdGVjaG5pY2FsIG1lcml0cyBhbmQgZGV0YWlscyBvZiBkaXNjb3ZlcnkgYXBwcm9hY2hlcyBp cyBmaW5lLCBldmVuIGRpc2N1c3NpbmcgaXNzdWVzIGludHJvZHVjZWQNCjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpI ZWx2ZXRpY2EiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO2J5IHBhcnRpY3VsYXIgc2VjdXJp dHkgbW9kZWxzIGFuZCB0b29scyBhbmQgaG93IHRvIHdvcmsgd2l0aCB0aGVtIGlzIGluIHNjb3Bl IG9mIGV2YWx1YXRpbmcgZGlzY292ZXJ5ICZuYnNwO3Byb3Bvc2Fscy4NCjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpI ZWx2ZXRpY2EiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO0J1dCB1bmxlc3MgYSBwb3N0IGNh biBicmluZyBpdCBiYWNrIHRvIGFkdmFuY2luZyBvdXIgZGlzY292ZXJ5IGRpc2N1c3Npb24g4oCT IGl04oCZcyBwcm9iYWJseSBvdXQgb2Ygc2NvcGUgZm9yIEFERC48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0 aWNhIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVs dmV0aWNhIj5SZWdhcmRzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYSI+R2xlbm4gPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OkhlbHZldGljYSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYSI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_2583C66A29E943B18BF5DDF3D976DC61nbcunicom_-- From nobody Mon Jul 27 16:29:42 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 442B83A0044 for ; Mon, 27 Jul 2020 16:29:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4xGyPUPMXNu9 for ; Mon, 27 Jul 2020 16:29:39 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 194093A0039 for ; Mon, 27 Jul 2020 16:29:39 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id C0D4DC3F16; Mon, 27 Jul 2020 23:29:36 +0000 (UTC) From: Paul Vixie To: Ted Lemon , Rob Sayre Cc: "STARK, BARBARA H" , "add@ietf.org" Date: Mon, 27 Jul 2020 23:29:34 +0000 Message-ID: <1978893.SkKRCvkyLV@linux-9daj> Organization: none In-Reply-To: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <3B4BDD38-4C0E-4444-A294-0E17BA5E2FA8@fugue.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 23:29:40 -0000 On Monday, 27 July 2020 22:50:11 UTC Rob Sayre wrote: > On Mon, Jul 27, 2020 at 3:26 PM Ted Lemon wrote: > > If on the other hand you mean that we should write a document saying = =E2=80=9Cthe > > network should tell you with DHCP not to do DoH,=E2=80=9D then it=E2=80= =99s going to be > > very hard to get consensus on that... >=20 > I agree. After all, malware will ignore this signal. manageability is one aspect of security, going to its deployment costs rath= er=20 than to its nondeployment risks. reliable signaling about what's denied by= =20 policy reduces the complexity of the diagnostic flow chart when something's= =20 not working, both for the user, the help desk, and the vendor. in counterpoint, arguments in favour of the deliberate entropy of DoH have= =20 sometimes taken the form "if we make this easy to detect, then it will be=20 widely blocked", which presumes that the alternative cost of blocking DoH c= an=20 be artificially raised above the accepted risks of not blocking it. engineering and security both rely heavily on economics to determine the=20 quality of a design. i don't think ADD-WG will as a whole deliberately choose to raise the secur= ity=20 costs for operators of private edge networks, though some here may wish it = so,=20 either as a necessary tradeoff or as forced reeducation as to internet=20 virality. (also, i didn't say what ted's quote above implies i might have meant.) =2D-=20 Paul From nobody Mon Jul 27 16:51:12 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA5C53A045B for ; Mon, 27 Jul 2020 16:51:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E7K4yvGgumHS for ; Mon, 27 Jul 2020 16:51:09 -0700 (PDT) Received: from mail-qt1-x82c.google.com (mail-qt1-x82c.google.com [IPv6:2607:f8b0:4864:20::82c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43C883A044E for ; Mon, 27 Jul 2020 16:51:08 -0700 (PDT) Received: by mail-qt1-x82c.google.com with SMTP id o22so13410073qtt.13 for ; Mon, 27 Jul 2020 16:51:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=vpSCIqRNp+Y54NkgfGYFdQJJ4fixyiw9CrlVqObhb70=; b=puDhYB4l1dRvLAlMwnQ2F3l97xwGnaKVM5QztJGSGSer3MAq3Cc6Q09goBcBmMcj9l VRjGaD7Y+vrxCuiLBCc8PvfwRsJHhNdJe5chN/xsYqPcWt93UH+Sh/JbJPO0m1rl9anH +DLNS3RlVaH6TyacZXcfArCTc79qFiB9sFNzZIngxtkfXdYIihZdCSUco2cRFnmVq5MM 1D3vgM7Xw8l6UcfwMrKcfOGn8Rz3h+hehvkiOorwJM9ZEuvxO0qjP1hNVV+F2ExM5vOd 1axjvJ6g1mvZbFi6hssy6ts8mdMdqof3v2+b3hW1JXf2LUUqazb2I9diAliWV1zVekP2 E6NA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=vpSCIqRNp+Y54NkgfGYFdQJJ4fixyiw9CrlVqObhb70=; b=bOvg67Ir6nUV6cIHKr9gKGwyNZGCdH7HUPDmSkYt25RI/63wcTUgQ5keK1QnjCiRoD 0ZENPrNhCy3/T42b20xy8gTMsgSHfTrmjTzwiEiMHEHdPmUX3e65n0D5XqJOeHkcllZb BPv4G9MGtBw41jNCrg6lDWUtPFxrMNMJuBFX43PAo67SdFbuDrbjfyvaeoAfIBsHwwZV 4RkjIPeKzYBQ/9NiPSMFmt515aHlSChPV9k2WHn2VUrn7K+eftKhiMgmKSlsLtj9cfEh 8JjzEmGtZ3tikyINGq47t2GgtEYLJDKwV6yL7YRLCkbOMzVRx6S8s+n7B79aka4/xu3P lDqw== X-Gm-Message-State: AOAM530qq8EjeHM2SudLhsZWKDDUQQ2PR8ZI4VO7ZQ+QVoJ54NKAs0C1 Uhb/gypfehAt8Dukio+5LgvAzQ== X-Google-Smtp-Source: ABdhPJx1hqtzTfEYNBfWBI5+IkOdjPvx1IqyvmToDFNCO6CYF2mW7avojssPH2PNLB63sJg1vNdXEw== X-Received: by 2002:ac8:6c49:: with SMTP id z9mr5832425qtu.110.1595893867945; Mon, 27 Jul 2020 16:51:07 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:ddf1:72ea:9d69:1b4a? ([2601:18b:300:36ee:ddf1:72ea:9d69:1b4a]) by smtp.gmail.com with ESMTPSA id s128sm19758718qkd.108.2020.07.27.16.51.07 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Jul 2020 16:51:07 -0700 (PDT) From: Ted Lemon Message-Id: <9C027574-73FA-4D94-8BFF-32B7ECD2A71F@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_E6270A1D-FE6C-4172-88E9-205B47C70971" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Mon, 27 Jul 2020 19:51:04 -0400 In-Reply-To: <1978893.SkKRCvkyLV@linux-9daj> Cc: Rob Sayre , "STARK, BARBARA H" , "add@ietf.org" To: Paul Vixie References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <3B4BDD38-4C0E-4444-A294-0E17BA5E2FA8@fugue.com> <1978893.SkKRCvkyLV@linux-9daj> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 23:51:12 -0000 --Apple-Mail=_E6270A1D-FE6C-4172-88E9-205B47C70971 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 27, 2020, at 7:29 PM, Paul Vixie wrote: > manageability is one aspect of security, going to its deployment costs = rather=20 > than to its nondeployment risks. reliable signaling about what's = denied by=20 > policy reduces the complexity of the diagnostic flow chart when = something's=20 > not working, both for the user, the help desk, and the vendor. This sounds like you are just asking for the equivalent of an HTTP 451 = response. That would allow the software that is relying on a DoH server = to know that it has been blocked and why. > in counterpoint, arguments in favour of the deliberate entropy of DoH = have=20 > sometimes taken the form "if we make this easy to detect, then it will = be=20 > widely blocked", which presumes that the alternative cost of blocking = DoH can=20 > be artificially raised above the accepted risks of not blocking it. Yes, that is the argument, and it makes sense. If we make DoH easy to = detect, then there is no point in having DoH: it serves no purpose. > engineering and security both rely heavily on economics to determine = the=20 > quality of a design. Another way to put this is that the way you make something secure is by = making it more expensive to attack than the benefit you=E2=80=99d get = from attacking it, right? > i don't think ADD-WG will as a whole deliberately choose to raise the = security=20 > costs for operators of private edge networks, though some here may = wish it so,=20 > either as a necessary tradeoff or as forced reeducation as to internet=20= > virality. I think that the emergence of TLS increased some security costs = substantially, and has continued to do so as TLS security has improved = in newer versions. There was a huge controversy about this for TLS 1.3. = Once you have TLS, certain security guarantees can only be obtained by = MiTMing all TLS connections. But of course, making it easy to MiTM TLS = makes TLS not serve the purpose for which it was intended. That purpose = is to protect the information that is being transmitted over TLS = connections. E.g., credit card data, passwords, porn, whatever. There is a clear cost to society of providing this protection. There is = a clear cost to society of not providing this protection. If you think = about it, the ongoing COVID lockdown would be a lot harder if we = didn=E2=80=99t have transport layer security we could depend on. So much = of what we=E2=80=99ve been doing to cope relies on secure = communications. So in a world where we care about transport layer security, there are = some things you can legitimately ask for, and some things that, if you = ask for them, will just get you a blank, puzzled stare. If you ask to = be able to MiTM the transport layer security, you=E2=80=99re going to = get told that you=E2=80=99d better own one of the endpoints or no. = =E2=80=9CControl the endpoints=E2=80=9D can mean that you control the = network services, because you manage them, or it can mean that you = control the devices, and have installed your own root signing cert on = them. A corollary to that is that if you don=E2=80=99t own one of the = endpoints, and you want to attack the user, the only (reasonable cost) = attack you can do is a DoS attack. The effect of this will be that the = devices on either endpoint will be unable to communicate. This is a good = outcome: it would be a bad outcome if they tried to communicate through = the MiTM. Is there anything I=E2=80=99m saying here that you disagree with? I=E2=80=99= m really not understanding where the disconnect is. --Apple-Mail=_E6270A1D-FE6C-4172-88E9-205B47C70971 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 27, 2020, at 7:29 PM, Paul Vixie <paul@redbarn.org> = wrote:
manageability = is one aspect of security, going to its deployment costs rather 
than to its = nondeployment risks. reliable signaling about what's denied by 
policy = reduces the complexity of the diagnostic flow chart when = something's 
not working, = both for the user, the help desk, and the = vendor.

This= sounds like you are just asking for the equivalent of an HTTP 451 = response. That would allow the software that is relying on a DoH server = to know that it has been blocked and why.

in = counterpoint, arguments in favour of the deliberate entropy of DoH = have 
sometimes taken the form "if we make this easy to detect, = then it will be 
widely = blocked", which presumes that the alternative cost of blocking DoH = can 
be artificially raised = above the accepted risks of not blocking it.

Yes, that is the argument, and it makes = sense. If we make DoH easy to detect, then there is no point in having = DoH: it serves no purpose.

engineering and = security both rely heavily on economics to determine the 
quality of a = design.

Another = way to put this is that the way you make something secure is by making = it more expensive to attack than the benefit you=E2=80=99d get from = attacking it, right?

i don't think ADD-WG = will as a whole deliberately choose to raise the = security 
costs = for operators of private edge networks, though some here may wish it = so, 
either as a necessary = tradeoff or as forced reeducation as to internet 
virality.

I think that the emergence of TLS increased some security = costs substantially, and has continued to do so as TLS security has = improved in newer versions. There was a huge controversy about this for = TLS 1.3.  Once you have TLS, certain security guarantees can only = be obtained by MiTMing all TLS connections. But of course, making it = easy to MiTM TLS makes TLS not serve the purpose for which it was = intended. That purpose is to protect the information that is being = transmitted over TLS connections. E.g., credit card data, passwords, = porn, whatever.

There is a clear cost to society of providing this = protection. There is a clear cost to society of not providing this = protection. If you think about it, the ongoing COVID lockdown would be a = lot harder if we didn=E2=80=99t have transport layer security we could = depend on. So much of what we=E2=80=99ve been doing to cope relies on = secure communications.

So in a world where we care about transport layer security, = there are some things you can legitimately ask for, and some things = that, if you ask for them, will just get you a blank, puzzled stare. =  If you ask to be able to MiTM the transport layer security, = you=E2=80=99re going to get told that you=E2=80=99d better own one of = the endpoints or no.  =E2=80=9CControl the endpoints=E2=80=9D can = mean that you control the network services, because you manage them, or = it can mean that you control the devices, and have installed your own = root signing cert on them.

A corollary to that is that if you don=E2=80=99t own one of = the endpoints, and you want to attack the user, the only (reasonable = cost) attack you can do is a DoS attack. The effect of this will be that = the devices on either endpoint will be unable to communicate. This is a = good outcome: it would be a bad outcome if they tried to communicate = through the MiTM.

Is there anything I=E2=80=99m saying here that you disagree = with? I=E2=80=99m really not understanding where the disconnect = is.

= --Apple-Mail=_E6270A1D-FE6C-4172-88E9-205B47C70971-- From nobody Mon Jul 27 17:12:08 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C50F93A07D1 for ; Mon, 27 Jul 2020 17:12:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4F8H8qJ7egGj for ; Mon, 27 Jul 2020 17:12:05 -0700 (PDT) Received: from mail-lf1-x12b.google.com (mail-lf1-x12b.google.com [IPv6:2a00:1450:4864:20::12b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 386233A07CA for ; Mon, 27 Jul 2020 17:12:05 -0700 (PDT) Received: by mail-lf1-x12b.google.com with SMTP id 140so10000090lfi.5 for ; Mon, 27 Jul 2020 17:12:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=3h1EHbiR/ydvBnqxUzU/GkmU7QYNTZ27aalszXNcrSc=; b=vT4aQI+i7UPGsy94laathLhUOt5qYOuuerIHUzGxZ3YCRWKVMTeGW8NiU65FlgN3qu mFUDeP/eh10/VzUIYmbQn5cOofipy2zX9yi1aPcKTNVOQ07vGFM25QOzL7PEUM9PhgV6 kn2DFsE3PAcWKX66xGrZexCwd7DqOgU0RA7evJE7pXdT3tVXdJymSpjkS68t6PqU9ols FXKUXcAetD+mF2zyeHZyyeEkmffMcvrWve9vbGZRb0vbVKWF3YkyUIwZn/3L1iOz4Ga2 UoRDO0I+qfmDVHI5DRQthA4t50Uc9QgWA2u3KcENXMjZulfiuozi1GgA5dCEMh6Rqg05 6RWw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=3h1EHbiR/ydvBnqxUzU/GkmU7QYNTZ27aalszXNcrSc=; b=bk4z5hkrHfBm7aPtt/+3bOhFG58zZUx1ri7LZCPAywLs5FLSZMrTA05h2NZI0dFQJi 4USFXy4U1bD1xJpPpc3PM+3RIT9RELaw5xfnzkRabqaFxH+UQUfI4Hi/Jfmpsoz3cLqs ijhKUQtqzAQpacof2kbuIM6XYet7H/1rkmUV2GS+0uoc1i73g42xTUMpiadNA9hB95P+ I6b5CGj03bLPtlyiXgsF0F3peP3dJWiTJdi7PNru1b1OS4fuAAFKSHW8Z0TxFGBtHyCJ 7TBIwodmwAVsbZkcjFuPXS7T5fFuugPtXJbhJCFxfDKXxpzWEzl7+hLdA+qOgWKnCc0A gTcg== X-Gm-Message-State: AOAM532A4VnS7ZPOUn+yf1HOwlsOcJ56iSGaBZyapAnrA5xwWj7ZRGxJ 6m9mie3nDyseakF6/uw5eBLNk29cUhq0IWyQvBg/Qg== X-Google-Smtp-Source: ABdhPJx5AvdoZeE0kDu4n33tZL2TSWVtLusS9UqJN7aThUHHshzrtz8Ubkg9FPveQEK+uOWo6xQvJur0q/YV87YbQTo= X-Received: by 2002:a05:6512:3156:: with SMTP id s22mr12879013lfi.140.1595895123385; Mon, 27 Jul 2020 17:12:03 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <3B4BDD38-4C0E-4444-A294-0E17BA5E2FA8@fugue.com> <1978893.SkKRCvkyLV@linux-9daj> <9C027574-73FA-4D94-8BFF-32B7ECD2A71F@fugue.com> In-Reply-To: <9C027574-73FA-4D94-8BFF-32B7ECD2A71F@fugue.com> From: Eric Rescorla Date: Mon, 27 Jul 2020 17:11:26 -0700 Message-ID: To: Ted Lemon Cc: Paul Vixie , "add@ietf.org" , "STARK, BARBARA H" , Rob Sayre Content-Type: multipart/alternative; boundary="000000000000edc12e05ab7549cb" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 00:12:07 -0000 --000000000000edc12e05ab7549cb Content-Type: text/plain; charset="UTF-8" On Mon, Jul 27, 2020 at 4:51 PM Ted Lemon wrote: > On Jul 27, 2020, at 7:29 PM, Paul Vixie wrote: > > in counterpoint, arguments in favour of the deliberate entropy of DoH have > sometimes taken the form "if we make this easy to detect, then it will be > widely blocked", which presumes that the alternative cost of blocking DoH > can > be artificially raised above the accepted risks of not blocking it. > > > Yes, that is the argument, and it makes sense. If we make DoH easy to > detect, then there is no point in having DoH: it serves no purpose. > >From my perspective, this is not correct. DoH has a number of technical advantages over DoT (for instance the ability to use Alt-Svc to upgrade to DoH3). Of course, one might or might not value these benefits against having two protocols, but that's not quite the same thing. -Ekr --000000000000edc12e05ab7549cb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Jul 27, 2020 at 4:51 PM Ted L= emon <mellon@fugue.com> wrote= :
On Jul 27, 2020, at 7:29 PM, Paul Vixie <paul@redbarn.org>= wrote:
in counterpoint, arguments in favour of the deliberate entropy of DoH = have=C2=A0
sometimes taken the form "if we make this easy= to detect, then it will be=C2=A0
widely blocked", which = presumes that the alternative cost of blocking DoH can=C2=A0
b= e artificially raised above the accepted risks of not blocking it.
Yes, that is the argument, and it makes sense. If= we make DoH easy to detect, then there is no point in having DoH: it serve= s no purpose.

From my perspecti= ve, this is not correct.

DoH has a number of tech= nical advantages over DoT (for instance the ability to use Alt-Svc to upgra= de to DoH3). Of course, one might or might not value these benefits against= having two protocols, but that's not quite the same thing.

-Ekr

--000000000000edc12e05ab7549cb-- From nobody Mon Jul 27 17:28:09 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B59613A0824 for ; Mon, 27 Jul 2020 17:28:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6iI3xZfOQpHk for ; Mon, 27 Jul 2020 17:28:03 -0700 (PDT) Received: from mail-qk1-x730.google.com (mail-qk1-x730.google.com [IPv6:2607:f8b0:4864:20::730]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E67CE3A082F for ; Mon, 27 Jul 2020 17:28:02 -0700 (PDT) Received: by mail-qk1-x730.google.com with SMTP id h7so17140194qkk.7 for ; Mon, 27 Jul 2020 17:28:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=xtxFuJaM4oW3WOUyfni6W5YF21mHurM6zD3Ff+6c45s=; b=Uxz3VrRvgApWybIZlOjmjK0ChUaL/68w4ycH9pse1ZSC949euVpLOUCvpxGBez/jZg u+M9C6/bO1v5sb2qQrF9OMOFpMgTje0+BLwcMsz4Lkc4gg+2SqsaCb202HEPtO0yMhZU ZZ3ysPN+E113TnM4Ec9IuukLbP9FTBhjTQPPhPwFI8WY/Jga3KUtiScvhHguFgtfAF/A tf+BiVj6rrAexQmE0hXaBCSq5a4+1kZwMdwz/bCpAH9rcxtzpejkZCIwvEGh+mkplFee lYbfxIcjrK2/0hrXA0pVmg5M0dLlXEsrK/WJNHBwnekEkAVwc0r686OPtVuxVdTVEF+g gawQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=xtxFuJaM4oW3WOUyfni6W5YF21mHurM6zD3Ff+6c45s=; b=sBduo/IA1F9Ouk9fEue/YoRDM61FPqs7xWMpRwJvd+k/9LGimtzZ9j6MowTrG0rstY BtWVs5geb4NG0A6rzw4QuXisCNEirBG8Mb4A+22fg7ChVI3RMwIzroosbwUf9/wqoqZ0 K3zUXVF6O3ynz3wxvwIqshjLJJEXBhRSdBBJhuVuQChlmWajhpWSdD5pn0gTJ1XrOVh8 zJIGHoakHKQ4loPxBKMp0C8fdYvQFj1Go986ollg6YJFBE8prHT0oYbJh5L0Sh+KoP04 M24K+FeIBi+fouo19W8TVayA96T54V+2p7f+dvnecJ5cwzMq8qYcrbwRLThxxhvTFVy8 0PSA== X-Gm-Message-State: AOAM533OLqpkFTOfly0hy4GMrR6lXzOZtHZRR3P0vX8/z5BR2xkWf6mm 6DIvdp876LovWDFoMiuGhubj6Q== X-Google-Smtp-Source: ABdhPJwt6xT1Dwjbu2Z0CvDfxqaFDj8p0XwOWyGp1VP35zx5nFatQxCJu6fV5TKfDrN4D48xp181ow== X-Received: by 2002:a37:8905:: with SMTP id l5mr24510501qkd.302.1595896081753; Mon, 27 Jul 2020 17:28:01 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:ddf1:72ea:9d69:1b4a? ([2601:18b:300:36ee:ddf1:72ea:9d69:1b4a]) by smtp.gmail.com with ESMTPSA id r18sm15985712qtf.62.2020.07.27.17.28.00 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Jul 2020 17:28:01 -0700 (PDT) From: Ted Lemon Message-Id: <0CEEDE62-234A-455C-AD5B-C989888B3D1F@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_012F9A1B-D846-4542-A9D5-D38F7F3FBC94" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Mon, 27 Jul 2020 20:27:59 -0400 In-Reply-To: Cc: Paul Vixie , "add@ietf.org" , "STARK, BARBARA H" , Rob Sayre To: Eric Rescorla References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <3B4BDD38-4C0E-4444-A294-0E17BA5E2FA8@fugue.com> <1978893.SkKRCvkyLV@linux-9daj> <9C027574-73FA-4D94-8BFF-32B7ECD2A71F@fugue.com> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 00:28:05 -0000 --Apple-Mail=_012F9A1B-D846-4542-A9D5-D38F7F3FBC94 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 27, 2020, at 8:11 PM, Eric Rescorla wrote: >> in counterpoint, arguments in favour of the deliberate entropy of DoH = have=20 >> sometimes taken the form "if we make this easy to detect, then it = will be=20 >> widely blocked", which presumes that the alternative cost of blocking = DoH can=20 >> be artificially raised above the accepted risks of not blocking it. >=20 > Yes, that is the argument, and it makes sense. If we make DoH easy to = detect, then there is no point in having DoH: it serves no purpose. >=20 > =46rom my perspective, this is not correct. >=20 > DoH has a number of technical advantages over DoT (for instance the = ability to use Alt-Svc to upgrade to DoH3). Of course, one might or = might not value these benefits against having two protocols, but that's = not quite the same thing. Okay, fair point, DoH can just be a better protocol as well as being a = way to get privacy. A better way to have put that would be that making = DoH easy to detect blocks one of the main benefits of DoH: that it gives = the user privacy from on-path snoopers in a way that can=E2=80=99t be = easily blocked. --Apple-Mail=_012F9A1B-D846-4542-A9D5-D38F7F3FBC94 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 27, 2020, at 8:11 PM, Eric Rescorla <ekr@rtfm.com> = wrote:
in counterpoint, = arguments in favour of the deliberate entropy of DoH = have 
sometimes taken the form "if we make this easy to detect, = then it will be 
widely = blocked", which presumes that the alternative cost of blocking DoH = can 
be artificially raised = above the accepted risks of not blocking it.

Yes, that is the argument, and it makes = sense. If we make DoH easy to detect, then there is no point in having = DoH: it serves no purpose.

=46rom my perspective, this is not = correct.

DoH = has a number of technical advantages over DoT (for instance the ability = to use Alt-Svc to upgrade to DoH3). Of course, one might or might not = value these benefits against having two protocols, but that's not quite = the same thing.

Okay, fair point, DoH can just be a better = protocol as well as being a way to get privacy. A better way to have put = that would be that making DoH easy to detect blocks one of the main = benefits of DoH: that it gives the user privacy from on-path snoopers in = a way that can=E2=80=99t be easily blocked.


= --Apple-Mail=_012F9A1B-D846-4542-A9D5-D38F7F3FBC94-- From nobody Mon Jul 27 17:44:13 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 342283A08C7 for ; Mon, 27 Jul 2020 17:44:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x67ISKOl8IZC for ; Mon, 27 Jul 2020 17:44:10 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640096.outbound.protection.outlook.com [40.107.64.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1C98D3A08C6 for ; Mon, 27 Jul 2020 17:44:09 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=XIrfgfw7sdCBEFI9HtHgcfsaUG9F8blfqzBUq21/XiUJKr8DS/6lzn9/1Fs1FUMHNXAHC/RH4CiU/txTfzKiI4GUgew6QmkIaIFGUY3fzKMytko6KLAe7icbLDIKkur2YYPwpQ48/tn/yUt0BoOCCZwwljx1iXuSo4t4QV+iCQrxWhvizTX1nJ039f9blTw3rUgU7NzFOxnzrbQ6RzJovKSdlQEKJa30mw0q7DPT3kOP0AjDq4v3zG7E8IHoeq7U1/YKKHSdGlDeb0El7nMA83PqclcJ2XayP9UkjYw9eSS6+iQa+Jy7BPGHEHZRo7KciURLUij74Dt7uHNP/Y/0rg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BJk1eEnquF/Ix8lixyy14itp4HSHnmIue/02p9mVLnA=; b=Z70ZxGjsAQTMXPjN9FcOeE6N64DH4m4VbMqAMtMgBJeyIX9L+JMIzAYAzM/+uFPaD+LJe+PMmOq1cZWGhctZoUk6tLIxpoAen+Wp92IdHkBMuezSqwzvcb1ele6jcLT1L66RYonoGf9yeIUb0A08fkhFUNhzjIMtxBTRpVtqY1LuBbSas7sfgiK5Rassd7qYw9uCC1dRPvdpGxZytr4urRp5Gvg/ATqr0ZOSZX6LivV8AbBv8zJ3Lip+6epbCkSfjnaLRQ4WQPPuRaq3qhZ4asK783Xvm0NYm74pYjlYE+vyIfz/k6SnCwILvdDxlD+Fs8rtdY64MA7wyjrmd51ypw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BJk1eEnquF/Ix8lixyy14itp4HSHnmIue/02p9mVLnA=; b=N4lDmNcvzpgGrnYMPgEXfXJtpISd4CVmnjz0tbw0xmaSVZjG2kmiDfP8I4UdNPmf1WDZyis3GUTLnm9uwClEWYveuhjDbRDgwuwwX3lJr3fVJjXI3bGll9G/JelxDh/XPW9mY7436aqZo6Xr+8IzbiSsDp68TH7Y8gcckuZQnXs= Received: from DM6PR00MB0783.namprd00.prod.outlook.com (2603:10b6:5:1bd::10) by DM5PR00MB0296.namprd00.prod.outlook.com (2603:10b6:4:9e::37) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3275.0; Tue, 28 Jul 2020 00:44:08 +0000 Received: from DM6PR00MB0783.namprd00.prod.outlook.com ([fe80::193e:6048:ea0e:210c]) by DM6PR00MB0783.namprd00.prod.outlook.com ([fe80::193e:6048:ea0e:210c%8]) with mapi id 15.20.3275.000; Tue, 28 Jul 2020 00:44:08 +0000 From: Tommy Jensen To: Ted Lemon , Eric Rescorla CC: "add@ietf.org" , Paul Vixie , "STARK, BARBARA H" , Rob Sayre Thread-Topic: [EXTERNAL] Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWZGQ6/7S/QyU8cUeYvUJiSlSeVKkcAOUAgAAG44CAAAsBAIAABgIAgAAFsQCAAASfgIAAAvhX Date: Tue, 28 Jul 2020 00:44:08 +0000 Message-ID: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <3B4BDD38-4C0E-4444-A294-0E17BA5E2FA8@fugue.com> <1978893.SkKRCvkyLV@linux-9daj> <9C027574-73FA-4D94-8BFF-32B7ECD2A71F@fugue.com> , <0CEEDE62-234A-455C-AD5B-C989888B3D1F@fugue.com> In-Reply-To: <0CEEDE62-234A-455C-AD5B-C989888B3D1F@fugue.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-28T00:44:07.793Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; authentication-results: fugue.com; dkim=none (message not signed) header.d=none;fugue.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2601:600:a080:aff0:f1cd:f7ba:46d3:252f] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 741c924c-202e-45c0-c882-08d8328f5656 x-ms-traffictypediagnostic: DM5PR00MB0296: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: gr4zmw8PsbdXNBq7VSxS4BsP0Tr4EE8+HSvgkRFYOpX3iJBep16bnoz/f99HuiuynRSJalhjdx0w1Ju/3R6o7BmQil1vCdxGiaXiL8yvkS2LRQamYhY8sAcaHDZhb7WVqsuugcRmh/iaMaSohsp7bMBxTg5eZMVFpBF4m2ZLqu6834hfqAEcLQXaXI3JhpNLUot7qt3XcD/8ivKiEX5n9db+KuTLMjqhejIat8XqIRVjnfNvNQ1rbliBUkNhlXZPziIcEYDQxUl+HaKs4CGxUMUMIp7UAg+OGiptexnJyZMpPK7b3AE12O2y9gKfkY6K7AUcwqq3yEF643IyoVJoRQTNCQeoc+3gV8J4zqfeIoBS6sNf77hmJj9UpZtp8HWNEeumcppVF+5qS4SQ8CQ80A== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR00MB0783.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(366004)(376002)(396003)(136003)(39860400002)(86362001)(82960400001)(82950400001)(71200400001)(33656002)(2906002)(54906003)(110136005)(478600001)(966005)(53546011)(6506007)(186003)(83380400001)(316002)(7696005)(66574015)(8936002)(66556008)(66476007)(66946007)(66446008)(19627405001)(64756008)(8676002)(4326008)(10290500003)(8990500004)(15650500001)(5660300002)(76116006)(52536014)(55016002)(91956017)(166002)(9686003); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: miWfAaoQhmHqKCldzeJXnTzjd7ARyFN47tSPfuM3SAiZQztxFjDjhE24wLZcQvfT/eOuZs2YBtOJWGUSjDTsQzAsET2e/XA8kL5c1ofQUSjoPq8T89oMrUCM+e6Z/ReqR3S6AhreqSNXlLfX5o/XdbAjJUqUQ3yF+ZtKy7U7EA6sbNhGdMNYwLYOIk8F9cusFjcCx6L4pMy4uSbYERqaV5iLXEexlY0tcUjaJj13Zn+eMYYRtEaBa0EFhOGzL0PFzEiodt1cZ3dyegT9iivYE1wJQWTBJblEBafOXdrZaLyyv1VCs/uzA2vzOv1Wbs8b6+czteGQg5gB1iQsmEqUm3W00VRFbDIQwpndRJjG9OMvmfZyIO+IOOY919k3Lf9QnZCHLUgtDDHtSHTGdS8q3w/m+eUM48Y0PdRZkYbUZB2N4F3zh9ifPnl6ZFvfTQQIVjHpSBxQUJfqJJc/CnUcqR+r3FGbrIpm/CvnmvZWcv1nSv+PTg11wnUFiaa9c0Wt0GQetP+jQnqykPLPJl8EEzdz/2h6JfL+Ve7cF72NhmGCEYhYjXNxDD1KW5MfyMR06Ezb9bmioAevCHEP/s845PI9O7gtvT4KPTKDbBQrKO/PShsowhJcWL89hXPywKIEhILu5dhy95j9ufhOER3ot0l/AzzWkMBLpZMJlwWSQZfzfyAnmKEVKJ0dGuvqPOvFGHrr0dgo/bBjGt6aRgyMQQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR00MB078363855A28DD4137906ABFFA730DM6PR00MB0783namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR00MB0783.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 741c924c-202e-45c0-c882-08d8328f5656 X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Jul 2020 00:44:08.2040 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 0waRnHddgy6M22HXMcYsg0YnFpvfHJCDKofe76RPQpOYiDMtYTXUXl2xEcZmXuVc3hHihMw2DRjmARXxxmE41w== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR00MB0296 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 00:44:12 -0000 --_000_DM6PR00MB078363855A28DD4137906ABFFA730DM6PR00MB0783namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable (+1 to ekr's point) I agree with Ted: we shouldn't go weakening strong end-to-end encrypted pro= tocols on purpose. From an endpoint's perspective, there is no authoritativ= e way to distinguish between network administration ("good") and network at= tacks ("bad") without some prior knowledge and trust of the network, such a= s preinstalled certificates. Arguably, these networks which want to tightly= control network behavior ought to tightly control network joining capabili= ties to prevent this perceived misbehavior. Otherwise, any side door we bui= ld for MitM to more readily block/downgrade communication between intended = endpoints will be a side door attackers can use as well. If we want to allow networks to give new and arbitrary endpoints a trusted = (defined as "client can securely distinguish from an arbitrary attacker") s= ignal that a given communication mechanism is forbidden, we (not this WG) s= hould work on that on a larger scale. After all, such a mechanism could be = used to signal network opposition to VPN tunnels, Tor connections, or anyth= ing else a network find offensive. If it works for HTTPS, DoH should inheri= t the benefits gracefully. What I'm saying is: we should leave this discussion off this list because i= t isn't specific to encrypted DNS as networks opposing encrypted communicat= ion to an endpoint has existed before DoH or DoT. Per the charter quote bel= ow, we can inform about mechanisms available to detect these network intent= ions, but I would say creation of new mechanisms is beyond the scope of the= charter. Chairs can correct me if I interpreted that incorrectly. >> Develop an informational document that describes mechanisms for clients = to detect specific network environments (such as captive portal and split h= orizon) and to use that information to inform their DNS configuration. Thanks, Tommy Jensen =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The latest in Windows Internet Protocols: Native gRPC support: https://aka.ms/grpcblogpost DNS over HTTPS: https://aka.ms/dohblogpost ________________________________ From: Add on behalf of Ted Lemon Sent: Monday, July 27, 2020 5:27 PM To: Eric Rescorla Cc: add@ietf.org ; Paul Vixie ; STARK, BARB= ARA H ; Rob Sayre Subject: [EXTERNAL] Re: [Add] New Version Notification for draft-pauly-add-= resolver-discovery-01.txt On Jul 27, 2020, at 8:11 PM, Eric Rescorla > wrote: in counterpoint, arguments in favour of the deliberate entropy of DoH have sometimes taken the form "if we make this easy to detect, then it will be widely blocked", which presumes that the alternative cost of blocking DoH c= an be artificially raised above the accepted risks of not blocking it. Yes, that is the argument, and it makes sense. If we make DoH easy to detec= t, then there is no point in having DoH: it serves no purpose. >From my perspective, this is not correct. DoH has a number of technical advantages over DoT (for instance the ability= to use Alt-Svc to upgrade to DoH3). Of course, one might or might not valu= e these benefits against having two protocols, but that's not quite the sam= e thing. Okay, fair point, DoH can just be a better protocol as well as being a way = to get privacy. A better way to have put that would be that making DoH easy= to detect blocks one of the main benefits of DoH: that it gives the user p= rivacy from on-path snoopers in a way that can=92t be easily blocked. --_000_DM6PR00MB078363855A28DD4137906ABFFA730DM6PR00MB0783namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
(+1 to ekr's point) 

I agree with Ted: we shouldn't go weakening strong end-to-end encrypted pro= tocols on purpose. From an endpoint's perspective, there is no authoritativ= e way to distinguish between network administration ("good") and = network attacks ("bad") without some prior knowledge and trust of the network, such as preinstalled certificates. Arg= uably, these networks which want to tightly control network behavior ought = to tightly control network joining capabilities to prevent this perceived m= isbehavior. Otherwise, any side door we build for MitM to more readily block/downgrade communication betwe= en intended endpoints will be a side door attackers can use as well.

If we want to allow networks to give new and arbitrary endpoints a trusted = (defined as "client can securely distinguish from an arbitrary attacke= r") signal that a given communication mechanism is forbidden, we (not = this WG) should work on that on a larger scale. After all, such a mechanism could be used to signal network opposition to = VPN tunnels, Tor connections, or anything else a network find offensive. If= it works for HTTPS, DoH should inherit the benefits gracefully. 

What I'm saying is: we should leave this discussion off this list because i= t isn't specific to encrypted DNS as networks opposing encrypted communicat= ion to an endpoint has existed before DoH or DoT. Per the charter quote bel= ow, we can inform about mechanisms available to detect these network intentions, but I would say creation of = new mechanisms is beyond the scope of the charter. Chairs can correct me if= I interpreted that incorrectly.

>= ;> Develop an informational document that describes mechanisms for = clients to detect specific network environments (such as captive portal a= nd split horizon) and to use that information to inform their DNS configuration.

Thanks,=
Tommy Jensen
=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The latest in Wi= ndows Internet Protocols:
  Native gR= PC support: https://aka.ms/grpcblogpost 
  DNS over = HTTPS: https://aka.ms/dohblogpost=  
From: Add <add-bounces@i= etf.org> on behalf of Ted Lemon <mellon@fugue.com>
Sent: Monday, July 27, 2020 5:27 PM
To: Eric Rescorla <ekr@rtfm.com>
Cc: add@ietf.org <add@ietf.org>; Paul Vixie <paul@redbarn.o= rg>; STARK, BARBARA H <bs7652@att.com>; Rob Sayre <sayrer@gmail= .com>
Subject: [EXTERNAL] Re: [Add] New Version Notification for draft-pau= ly-add-resolver-discovery-01.txt
 
ekr@rtfm.com> wrote:
in counterpoint, argum= ents in favour of the deliberate entropy of DoH have 
sometimes taken the fo= rm "if we make this easy to detect, then it will be 
widely blocked", = which presumes that the alternative cost of blocking DoH can  be artificially raised= above the accepted risks of not blocking it.

Yes, that is the argument, and it makes sense. If we make D= oH easy to detect, then there is no point in having DoH: it serves no purpo= se.

From my perspective, this is not correct.

DoH has a number of technical advantages over DoT (for inst= ance the ability to use Alt-Svc to upgrade to DoH3). Of course, one might o= r might not value these benefits against having two protocols, but that's n= ot quite the same thing.

Okay, fair point, DoH can just be a better protocol as well as being a= way to get privacy. A better way to have put that would be that making DoH= easy to detect blocks one of the main benefits of DoH: that it gives the u= ser privacy from on-path snoopers in a way that can=92t be easily blocked.


--_000_DM6PR00MB078363855A28DD4137906ABFFA730DM6PR00MB0783namp_-- From nobody Mon Jul 27 19:16:33 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23C5B3A0ADE for ; Mon, 27 Jul 2020 19:16:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7GaTzWat4Jl5 for ; Mon, 27 Jul 2020 19:16:29 -0700 (PDT) Received: from mail-vs1-xe2d.google.com (mail-vs1-xe2d.google.com [IPv6:2607:f8b0:4864:20::e2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E1C173A0AD9 for ; Mon, 27 Jul 2020 19:16:28 -0700 (PDT) Received: by mail-vs1-xe2d.google.com with SMTP id j186so9356318vsd.10 for ; Mon, 27 Jul 2020 19:16:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=PynXkaKRhlnkFHv/uQ0Rgu+wBgyfZWzrG8JT4KxwkQk=; b=spy2+R9vTlEKB4P2pOA/qW7bj3CwlxbIrjf/BmGpBJE8jsVDqw7Hyl3HsYoD5+dWPL i3830qPsupsZ3BJecfljFFiRzF4OdWjGujf2BhL7P7z99KjMOXwXI00OxlIzALCiy5Ce ZDaGOxone7COu6b3KsOXBA7u48uiyBYNpfapjS7NA0MeQu65addhK6HNLJfG91xNpXmh ss9Z9enPiyIK1xRf/KRSYR3ty//ujLMOzRmRPigb8qJjw4XjXABS/nDVbpiA1gjXAp96 ja15+nSrIuN5BAN87j02qazw1RXFhtVJd53im2PxElZN+RSUbe0yRB1KVnBpArVgW8i+ plbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=PynXkaKRhlnkFHv/uQ0Rgu+wBgyfZWzrG8JT4KxwkQk=; b=p/L7eyBKApnYMWxzalNHglP0QOfAv37IE1Gdgh6uwGHK+OmHHJggKap4sqz6sVP/zq fOBQpUUYCxXGvBXRm1zw9+cfzId3RlfGu2qSY+9YJzp7sevwUkSbPGm02bhfC78HhaDA gPiEziYvsm978gWQelHQZJAEpaT81Gazrc8tZbZAtzdw5AD2tIAkqvHLJYInKO22Bb4V jsl+l0jsvxQHNbtRUbkqGBjUJxuiGxinD8lVzsvE9Y5Uy2ekxPI/iKAHSDwpEpUneBJl 04R5/03VP1S/cjYwCXM50MrrENYLveUL7NTsdZU2t5cFGOxF4r0MiJRwYtw1KENW3dS8 sHyQ== X-Gm-Message-State: AOAM530bek1PyjCjF2KmdLqqktWkeq9iUugL8EtSwD0JACV0nlfekv5C PWALI4K8gUeIZ4gnBGRb9Y6Ut296kJN+bCVmyrk= X-Google-Smtp-Source: ABdhPJyFPEv2xm/YysDA7RRWgHWNz2LgAeiG8ZfBfQ/1xcflnefpsMaRRh8Os8+l4UWgD8QPyjMJdWYqA1cpJQ1+yM0= X-Received: by 2002:a05:6102:1081:: with SMTP id s1mr17618795vsr.31.1595902587886; Mon, 27 Jul 2020 19:16:27 -0700 (PDT) MIME-Version: 1.0 References: <159078807168.11416.12425165143603046178@ietfa.amsl.com> <20200727145502.GA7147@nic.fr> In-Reply-To: From: Daniel Migault Date: Mon, 27 Jul 2020 22:16:16 -0400 Message-ID: To: Ben Schwartz Cc: Stephane Bortzmeyer , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000d8e4dd05ab7706ec" Archived-At: Subject: Re: [Add] New Version Notification for draft-mglt-add-rdp-02.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 02:16:31 -0000 --000000000000d8e4dd05ab7706ec Content-Type: text/plain; charset="UTF-8" Hi, Please find an update of the document addressing - at least partly - your comments [1]. Yours, Daniel [1] https://github.com/mglt/draft-mglt-abcd-dofoo-discovery/blob/master/draft-mglt-add-rdp.mkd On Mon, Jul 27, 2020 at 5:06 PM Daniel Migault wrote: > Hi Ben, > > Thanks for the comment. First I agree that I should clarify the text and I > am working on it. > > The intent of the list is to provide a "list of recommended resolvers". > However, the list does not provide the resolvers as well as their > characteristics. Instead it provides the resolving domain that can be seen > as an indirection to these resolvers. As a result, the final candidate > resolvers are retrieved from a SVCB query over the resolving domain. The > resolver and associated characteristics of the resolver are clearly > provided by the owner of the resolving domain and not the owner of the > "list of resolvers". > > I think I understand what you mean by the violation of the principle of > the DNS. This would typically be the case if connectivity information ( IP > addresses for example) would be provided directly by the owner of the FQDN > that represents the list of resolvers. It is a bit different here as PTR > indicates an indirection. > > The reason I am using PTR is that I would like to use DNS only and not > necessarily mandate that HTTP, FTP or email be mandatory. In addition, the > use of PTR enables some sanity checks of the resolving domains. > I agree that this might not be very convenient for very very large list. I > would envision that systems that need such very large lists of resolving > domains may have their own mechanisms to provision resolving domains. > EDNS buffer size of 1232 bytes will not cause fragmentation for an UDP > packet and that size corresponds to the first 94 most popular domain > names. Of course more could be provided over TCP. Not saying that no > other mechanisms should be considered, I believe that could be sufficient > for many use cases without requiring an additional protocol (HTTP, FTP, > email). > > Yours, > Daniel > > > [1] https://moz.com/top500 > > > > > > On Mon, Jul 27, 2020 at 3:00 PM Ben Schwartz wrote: > >> On Mon, Jul 27, 2020 at 2:45 PM Daniel Migault >> wrote: >> >>> >>> a resolving domain list (rd_list.example.net) contains a list of >>> resolving domains. You get the different resolving domains >>> _b.rd_list.example.net PTR >>> >> >> This is the part of the draft that seems strangest to me (apart from the >> odd use of PTR). It violates the usual expectation about data in the DNS: >> records published by a domain provide information about that domain. These >> lists instead appear to provide information about the wider world. The >> "owner name" just indicates whose opinion this is. >> >> If you want to present this type of information, I would encourage you to >> define a MIME type and distribute it using a general information transfer >> system like HTTP, FTP, or e-mail. The concerns about size (since these >> lists could be arbitrarily large) are a hint that you're trying to store >> the wrong sort of data in the DNS. >> >> Alternatively, if these lists are really meant to be "resolvers to use on >> this network" or something like that, the text could be clearer about that, >> with an explanation of how the user would learn the owner name. >> > > > -- > Daniel Migault > Ericsson > -- Daniel Migault Ericsson --000000000000d8e4dd05ab7706ec Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,=C2=A0

Please find an update of the = document addressing - at least partly - your comments [1].=C2=A0
=
Yours,=C2=A0
Daniel


<= /div>
O= n Mon, Jul 27, 2020 at 5:06 PM Daniel Migault <mglt.ietf@gmail.com> wrote:
Hi Ben,=C2=A0

Thanks for the comment. First I agree that I should=C2=A0clarify th= e text and I am working on it.=C2=A0
=C2=A0
The int= ent of the list is to provide a "list of recommended resolvers". = However, the list does not provide the resolvers as well as their character= istics. Instead it provides the resolving domain that can be seen as an ind= irection to these resolvers. As a result, the final candidate resolvers are= retrieved from a SVCB query over the resolving domain. The resolver and as= sociated characteristics of the resolver are clearly provided by the owner = of the resolving domain and not the owner of the "list of resolvers&qu= ot;.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0

I think I u= nderstand what you mean by the violation of the principle of the DNS. This = would typically be the case if connectivity information ( IP addresses for = example) would be provided directly by the owner of the FQDN that represent= s the list of resolvers. It is a bit different here as PTR indicates an ind= irection.=C2=A0

The reason I am using PTR is that = I would like to use DNS only and not necessarily mandate that HTTP, FTP or = email be mandatory.=C2=A0 In addition, the use of PTR enables some sanity c= hecks of the resolving domains.
I agree that this might not be ve= ry convenient=C2=A0for very very large list. I would envision that systems = that need such very large lists of resolving domains may have their own mec= hanisms to provision resolving domains.=C2=A0=C2=A0
EDNS buffer s= ize of 1232 bytes will not cause fragmentation for an UDP packet and that s= ize corresponds to the first 94 most popular domain names.=C2=A0 Of course = more could be provided over TCP. Not saying that no other=C2=A0mechanisms s= hould be considered, I believe that could be sufficient for many use cases = without requiring an additional protocol (HTTP, FTP, email).=C2=A0

Yours,=C2=A0
Daniel
=C2=A0=C2=A0=C2=A0
<= div>


=C2=A0

On Mon, Jul 27, 2020 at 3:00 PM Ben Schwartz <<= a href=3D"mailto:bemasc@google.com" target=3D"_blank">bemasc@google.com= > wrote:
On Mon, Jul 27, 2020 at 2:45 PM Daniel Migaul= t <mglt.ietf@gm= ail.com> wrote:

a resolving domain list (rd_list.example.net) contains a = list of resolving domains. You get the different resolving domains=C2=A0

This is the part of the draft that seems strang= est to me (apart from the odd use of PTR).=C2=A0 It violates the usual expe= ctation about data in the DNS: records published by a domain provide inform= ation about that domain.=C2=A0 These lists instead appear to provide inform= ation about the wider world.=C2=A0 The "owner name" just indicate= s whose opinion this is.

If you want to present th= is type of information, I would encourage you to define a MIME type and dis= tribute it using a general information transfer system like HTTP, FTP, or e= -mail.=C2=A0 The concerns about size (since these lists could be arbitraril= y large) are a hint that you're trying to store the wrong sort of data = in the DNS.

Alternatively, if these lists are real= ly meant to be "resolvers to use on this network" or something li= ke that, the text could be clearer about that, with an explanation of how t= he user would learn the owner name.


--
Daniel Migault
Ericsson


--
Daniel Migault
Ericsson
--000000000000d8e4dd05ab7706ec-- From nobody Mon Jul 27 22:33:07 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C8E43A0C87 for ; Mon, 27 Jul 2020 22:33:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KVIm_eAz0d9x for ; Mon, 27 Jul 2020 22:33:02 -0700 (PDT) Received: from mail-il1-x12e.google.com (mail-il1-x12e.google.com [IPv6:2607:f8b0:4864:20::12e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7B2FE3A0C85 for ; Mon, 27 Jul 2020 22:33:02 -0700 (PDT) Received: by mail-il1-x12e.google.com with SMTP id l17so4933052ilq.13 for ; Mon, 27 Jul 2020 22:33:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=kwkjznqDUbeovng32DDf/81/aAT1D4ImuqCcsnWxXfo=; b=lnRls4dLevVUuYpJZ3BYFfnYOTB7r4BosQuMfvqZ5h6K119MzVA73LwpoDtBIYIuq/ LiOwpL+oaYZPwH6QVGW4XVZeRCL//ofz4VgBM+lFzdkLk/c1TiSXZh56QUgInubr+3Uw PzR1Ouyb7gwuRAcfMpnXlqrwaY9A4n18tYZ8XDcvQFVzjpFI70cSvmTC49H0cdpk9FGz oESVfvcy9VqaPVj+YdLH2GZklbspLHH429Ox/+LAwbu9ShjGmWBwht0PQ9AOBH2G81yc 7LllFwS5D7c3NPBhmxhJtLtT8aao8rupsDa4M6R+aWfO9y//B22hQahHg6LwjXqz5WH6 AmQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=kwkjznqDUbeovng32DDf/81/aAT1D4ImuqCcsnWxXfo=; b=tscGWP3TlIEADiEKIPANC/JvdB3Sjaoun/Hsu7cfCGNuHVfDJnI6ysrzVfhGFK0eA0 /SJysZ7sZ7mEA++DUh0CrWGWTT9cYNy4AD7DazP3Fo/V3REnr9uJ+PiH/BWhM30ZHmkP KsQMnktGxuKfNfv4QGytK2LcksAiiP0Ee9CuAtFH4K52Ja4cO+OvViB8UsjmsGOwvIfm /zgL7rL0cclOqOe6RsbFPTBBZ2GZoBkYmUn+WJumvNCjrmSVsqwJfT/MSVkiYPplhhSB 7yYW8lPOvH9Nz0sUFwfew1+dbe5jrQxqM02fdItkTnF8BKPeDQncHPgx1+XYfsAeyY4/ SJ6A== X-Gm-Message-State: AOAM531o/2siAWe/Z4yXoi1gNewmJdoiCrd0K8zeof/IVfyYHfuOS52P Lh0FkbAWm8mbHwhJ5efwvUx9+kWkJrDWXu2oEfM= X-Google-Smtp-Source: ABdhPJwTO24qvNA/wMTzxE1P0gibDOywEyVICnruBhd7RV3aMHRmqZpjeY2yECSB93RKjf5I2CTyEfGopUAgst+KQH4= X-Received: by 2002:a92:858d:: with SMTP id f135mr11374163ilh.257.1595914381608; Mon, 27 Jul 2020 22:33:01 -0700 (PDT) MIME-Version: 1.0 References: <2583C66A-29E9-43B1-8BF5-DDF3D976DC61@nbcuni.com> In-Reply-To: <2583C66A-29E9-43B1-8BF5-DDF3D976DC61@nbcuni.com> From: Rob Sayre Date: Mon, 27 Jul 2020 22:32:50 -0700 Message-ID: To: "Deen, Glenn (NBCUniversal)" Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000cecf7e05ab79c5fb" Archived-At: Subject: Re: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 05:33:05 -0000 --000000000000cecf7e05ab79c5fb Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Jul 27, 2020 at 4:24 PM Deen, Glenn (NBCUniversal) < Glenn.Deen@nbcuni.com> wrote: > -Taking off my chair hat and posting as a contributor =E2=80=93 > > > > Rob, > > > > The RFC=E2=80=99s you cite (RFC1958, RFC7624) here, and have cited before= when the > discussion of security models has popped up are seemingly being taking ou= t > of context and are being raised to a higher level of authority that I > believe the IAB intended them to be. > > If those documents aren't convincing, you could consult RFC 7258 - Pervasive Monitoring Is an Attack (aka BCP 188). > > Paul makes a very valid point =E2=80=93 there are very significant number= s of > networks in Enterprises, governments, schools, universities, and even hom= es > of some highly skilled engineers that will have DoH present on devices, > operating systems, and applications and will be attempting to do discover= y, > and these networks do have security practices and security systems which > may interfere with certain discovery approaches =E2=80=93 and ADD should = be taking > those things into account the best we can. > It is not a valid point. If one owns the devices, then configure them. As another participant wrote: "From an endpoint's perspective, there is no authoritative way to distinguish between network administration ('good') and network attacks ('bad') without some prior knowledge and trust of the network, such as preinstalled certificate". thanks, Rob > --000000000000cecf7e05ab79c5fb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Jul 27, 2020 at 4:24 PM Deen,= Glenn (NBCUniversal) <Glenn.De= en@nbcuni.com> wrote:

-Taking off my= chair hat and posting as a contributor =E2=80=93

=C2=A0<= u>

Rob,=

=C2=A0<= u>

The RFC=E2=80= =99s you cite (RFC1958, RFC7624) here, and have cited before when the discu= ssion of security models has popped up are seemingly being taking out of co= ntext and are being raised to a higher level of authority that I believe the IAB intended them to be.

=


If those documents aren= 9;t convincing, you could consult RFC 7258 - Pervasive Monitoring Is an Att= ack (aka=C2=A0 BCP 188).

=C2=A0

Paul makes a v= ery valid point =E2=80=93 there are very significant numbers of networks in= Enterprises, governments, schools, universities, and even homes of some hi= ghly skilled engineers that will have DoH present on devices, operating systems, and applications and will be attempting to = do discovery, and these networks do have security practices and security sy= stems which may interfere with certain discovery approaches =E2=80=93 and A= DD should be taking those things into account the best we can.=C2=A0=C2=A0


<= /div>
It is not a valid point. If one owns the devices, then configure = them. As another participant wrote:=C2=A0"From an endpoint's persp= ective, there is no authoritative way to distinguish between network admini= stration ('good') and network attacks ('bad') without some = prior knowledge and trust of the network, such as preinstalled certificate&= quot;.

thanks,
Rob
--000000000000cecf7e05ab79c5fb-- From nobody Tue Jul 28 00:34:31 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDC763A0039 for ; Tue, 28 Jul 2020 00:34:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i3HxlKWw5-mJ for ; Tue, 28 Jul 2020 00:34:27 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DCEE3A002C for ; Tue, 28 Jul 2020 00:34:27 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id DF626C3F16 for ; Tue, 28 Jul 2020 07:34:22 +0000 (UTC) From: Paul Vixie To: add@ietf.org Date: Tue, 28 Jul 2020 07:34:21 +0000 Message-ID: <3954080.qUnaP1aulD@linux-9daj> Organization: none In-Reply-To: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <0CEEDE62-234A-455C-AD5B-C989888B3D1F@fugue.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 07:34:29 -0000 On Tuesday, 28 July 2020 00:44:08 UTC Tommy Jensen wrote: > (+1 to ekr's point) > > I agree with Ted: we shouldn't go weakening strong end-to-end encrypted > protocols on purpose. From an endpoint's perspective, there is no > authoritative way to distinguish between network administration ("good") > and network attacks ("bad") without some prior knowledge and trust of the > network, such as preinstalled certificates. ... since i was nearby when ted's and ekr's comments were made, let me state for the record that ted's opposition was to something i hadn't proposed, and may represent a misrestatement on his part, or perhaps a misunderstanding. as such, ekr's response was nonsequitur through no fault of his own, and i can neither confirm nor deny my position with respect to it. i don't want to get in the way of the great discussion you folks want to have, other than to remind you all, it's actually off-topic from the remarks it quotes from me. > ... Arguably, these networks which > want to tightly control network behavior ought to tightly control network > joining capabilities to prevent this perceived misbehavior. ... when DoH is going to be denied, i'd like the node to get an accurate signal about that, rather than silent failure. that's not a political goal, but a customer service level goal. since DoH is in fact going to be widely denied, and sometimes that will be by the owner/operator of the network and the node, this adds a transparency and manageability burden to ADD. if you imagine that one form of misbehaviour is sudden unexpected unauthorized DoH use as a side effect of a browser upgrade, then you might reconsider the word "tightly". > ... Otherwise, any > side door we build for MitM to more readily block/downgrade communication > between intended endpoints will be a side door attackers can use as well. consent will sometimes be withheld. bypass will be seen as an attack. defense will occur. what do you want to see happen next? i'd like reliable signaling with complete transparency: "you can't do what you're trying on this network." in my estimation, none of the agencies edward snowden warned us about in 2013 are going to be transparent about surveillance or filtering, so your fear of them using reliable denial signaling as part of negotiation seems misplaced. but to repeat, what do you want to see happen during administrative denials? right now it's unexplained silence and failure. i think that's bad customer service, and i want us to strive for better. if an on-path actor is willing to tell you what you can't do and why not, and identify themselves, we should be willing to do the work involved to make that telling possible. -- Paul From nobody Tue Jul 28 03:40:06 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 801D03A0AB6 for ; Tue, 28 Jul 2020 03:39:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XEpto7Jo8MZt for ; Tue, 28 Jul 2020 03:39:53 -0700 (PDT) Received: from mail-qk1-x735.google.com (mail-qk1-x735.google.com [IPv6:2607:f8b0:4864:20::735]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A41883A0AAF for ; Tue, 28 Jul 2020 03:39:53 -0700 (PDT) Received: by mail-qk1-x735.google.com with SMTP id l6so18122298qkc.6 for ; Tue, 28 Jul 2020 03:39:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=5xmfNxXLEvuTS8U9tGM602DHd+bSMzfbuev0TxCOC1Q=; b=RXkKFviNT9dI54p+Qhz6DNX8qlb9b2lcQg/ZKjOJBmfNomTiOdc5MfojdqM9K3L8EG nyRyeFoNZRiGOxwec0SU3AsL6LHM8YMVzazUrli8O3PqEb92RfU2h7IdSENfBVX/dVDk ShC6eOWJaq1avUcggEcf05Fn157TrRZgzCePR6BXDTyVwiQ8CkKlqVzybHKqL4WI2x7d Ni+sRV125BUTW74oeNvf8BH656P7KDHt9cAEKMIKTDu7wb++M5C5m3jkuUHkrT4W/c1h UIiFd84eRzZuB0Ijop9EDn0lwj4CyFKqRehKXBykcrq9xZjfKvM+1NuK3HazLOpYu3NV +9Hg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=5xmfNxXLEvuTS8U9tGM602DHd+bSMzfbuev0TxCOC1Q=; b=FQKLVYuPdbgEcWYC+LtI4JT+E+V0/sX8m4GxuqWb60W95FKF5dSJrIr6ZtVAw+vnaZ SSswVa2Y5tG57SfqI9kEIzXkLsiuW4gjhJZJJqgVjWOvyCWHo+l7vczEjaa5LtDEiOMr KD6BhPqxbUQ7045mhOaNmQnDTcWojvM/9l0gUhLQhu2C7PWaOdNuvyDuT2Xq/42HNTh9 TO3nMjY38OcUGh3Wl4qpaDhYNmVJNv+o1GPwISZxQMSWFSi/8laVRn9W6RXl7EvMKKrA BiCa2hQGLo1gQBwAufRw5yxv5C4d8FrHtXZf4IqcaksLRrZj6EVJGTNjWSEcUEKjkMux wxdQ== X-Gm-Message-State: AOAM531qP9zUWbMvLcs8h30JW/qrcwhlN3e5fIm+lKc+VmAlSgQhTO6p YSg2k5GH3ORbN4f+bVii9GnO19BYTvY= X-Google-Smtp-Source: ABdhPJw0D8pScCckDOCVqEOTZ/wTsJHqNUrxtm9CwHUeqUMliZXKk6SPoa5i5Oi6qIF+xrMneOV0fQ== X-Received: by 2002:ae9:c20a:: with SMTP id j10mr5977031qkg.254.1595932792401; Tue, 28 Jul 2020 03:39:52 -0700 (PDT) Received: from localhost ([2601:18b:300:36ee:646e:f8f:4b6b:c5d3]) by smtp.gmail.com with ESMTPSA id p4sm21851299qkj.135.2020.07.28.03.39.51 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 28 Jul 2020 03:39:51 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Tue, 28 Jul 2020 06:39:50 -0400 Message-Id: <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> References: <3954080.qUnaP1aulD@linux-9daj> Cc: add@ietf.org In-Reply-To: <3954080.qUnaP1aulD@linux-9daj> To: Paul Vixie X-Mailer: iPhone Mail (18A339) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 10:39:58 -0000 > On Jul 28, 2020, at 03:34, Paul Vixie wrote: > in my estimation, none of the agencies edward snowden warned us about in 2= 013=20 > are going to be transparent about surveillance or filtering, so your fear o= f=20 > them using reliable denial signaling as part of negotiation seems misplace= d. That=E2=80=99s not the concern. The concern is that if DoH traffic is labele= d specifically so that the network can identify it, it will be blocked, with= or without notification. Signaling that a particular TLS connection is DoH d= oes you no good and does the user harm.=20= From nobody Tue Jul 28 04:33:38 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66D293A0B93 for ; Tue, 28 Jul 2020 04:33:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R94d1mac8aop for ; Tue, 28 Jul 2020 04:33:27 -0700 (PDT) Received: from mx3.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 28D083A0BA1 for ; Tue, 28 Jul 2020 04:33:26 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx3.open-xchange.com (Postfix) with ESMTPS id BFEBD6A2FF; Tue, 28 Jul 2020 13:33:21 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1595936001; bh=XqOEoEueZhDWVyK0jVJ2Zp620yGCbGkPjkqNZUa9CG0=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=uduBTNzwKRXBwvgj/w9+1Wyv0JXlx8ZklLtb35JTVWg6TBAz65URVmqfU+xSdqPSH euEEXu+KJ7Vi/EbqtlT/wLHszUONj/Wnnnl5RQRlFyDWjUlVa/jm+I2XyEzJau1rfw +TL5x+BH0XtvQ2JYOj4rtNwtAXdHaAmATqDQz6yBMDvPFdzA39kAy6NoOuU98OTvsO Vyc4ebh9W9ROfn+49Wt34utjGlcG76dLLTWcKv4u9HUw7bCBb5moT1WpDScJO2AMGC U12RB97lAgR4+IDML+jqEospYxZgzUk+rhRXtvOfXKI0WoWMXCRHPwMk47D5JfbWN0 FnNnumeokw79g== Received: from appsuite-gw2.open-xchange.com (appsuite-gw2.open-xchange.com [10.20.28.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id B18EC3C0399; Tue, 28 Jul 2020 13:33:21 +0200 (CEST) Date: Tue, 28 Jul 2020 13:33:21 +0200 (CEST) From: Vittorio Bertola To: Ted Lemon , Paul Vixie Cc: add@ietf.org Message-ID: <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> In-Reply-To: <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev19 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 11:33:37 -0000 > Il 28/07/2020 12:39 Ted Lemon ha scritto: >=20 > =20 > > On Jul 28, 2020, at 03:34, Paul Vixie wrote: > > in my estimation, none of the agencies edward snowden warned us about i= n 2013=20 > > are going to be transparent about surveillance or filtering, so your fe= ar of=20 > > them using reliable denial signaling as part of negotiation seems mispl= aced. >=20 > That=E2=80=99s not the concern. The concern is that if DoH traffic is lab= eled specifically so that the network can identify it, it will be blocked, Why? There will be networks that want to block DoH, and there will be others tha= t don't, and there will be others that will say that you can have DoH but o= nly if you use the local resolver, or if you use a resolver from a specific= list, or will suggest you a local resolver but then accept a different cho= ice. Then, there will be clients (both on behalf of the user, i.e. anonymizing b= rowsers, and against the user, i.e. malware) that will want to ignore that = policy if they dislike it, and do something else - and there will be networ= ks that will then react by doing all sorts of bad things to traffic from th= ose clients. We cannot do much in the case when clients (users) and networks (network pr= oviders) disagree, and that case will always exist, but there is a number o= f use cases (hopefully most of them) in which users and network providers w= ill cooperate to find a mutually acceptable configuration. What we should d= evelop is a way for the client to discover the local DoH resolver's locatio= n and the network policy attached to it, so that the above agreement become= s possible in those cases. What the client does with that information, and = whether the client chooses to abide by or defy the local policy, will then = be a choice for the developers of each client (and for their lawyers and po= licy officers, I suspect, but that's another discussion). On the other hand, refusing to standardize such a mechanism would be quite = a strong policy stance, as it would assume that all networks will always be= adversarial and badly intentioned so there is no use in even listening to = what they would like to say. I don't think that the IETF should go down tha= t path. --=20 Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com=20 Office @ Via Treviso 12, 10144 Torino, Italy From nobody Tue Jul 28 05:23:31 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A9D793A0B9F for ; Tue, 28 Jul 2020 05:23:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DIFSKugo5T8f for ; Tue, 28 Jul 2020 05:23:24 -0700 (PDT) Received: from mail-il1-x134.google.com (mail-il1-x134.google.com [IPv6:2607:f8b0:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 049D73A0BCE for ; Tue, 28 Jul 2020 05:23:23 -0700 (PDT) Received: by mail-il1-x134.google.com with SMTP id z3so5721652ilh.3 for ; Tue, 28 Jul 2020 05:23:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=zgIUZAS/FxAH/pdgJiNN+DhHvr/kUkxarzjrLjjxItM=; b=DBDVo6UA7RY+xsHo85XImi5h1LfVSUJUUf2qIlJKrp3V8pypJPsjhoe0C1gLO2ieFh FYwgadplhUXgrRJqsi27z1/fpJeiIJsU781/PNmDz7Pk7aXFqY1FaGpylqStatji7Zg+ 2PMSKhG65Csvn97jW0kQFRqkUJrbbAk8AusZBBS1mWEd+q5Px+9DKqAwZkQUr71NlAyF zVIrK09G7QwaE+UAdEDXF/SauWazESLLI4dsNA4V31IuysY/SxTlg04e8DrKD5prvIYx +smydJ6qdxmlTZS4D3KufWjFCnTErLR8LfXyKpja+q17q3Yq9G12qXPmqAVIqENoM9OS zzgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=zgIUZAS/FxAH/pdgJiNN+DhHvr/kUkxarzjrLjjxItM=; b=pLdtgTuKo0yvyrz49jkavdLwGH0dKNPJMsdhBAilvJE1yBW++wWwHRWRZ5x6a+9PkP hjPIExn2YGRozUZtdtWXHLfCdHx3nioyeIOWVWfZOxKTf8BUkfNA7gnkvlyHAXZqL164 YzlQZYTxzRN0AFcIhE3vnmC9W34i8PO3jM/FEybAs2JRsDUSKiw3sVABVg82rBoAxPtg 91zAqQPeTF7W6xis6aL2lNxOgTrs9WYnVMeGQXGQXcSLtpK+v149y/F3XrRxySK25lvy XfYf1I6FduwYHpLisnKtfPm75ubc8fSoJlccw57ytYJDWrLe0oa/WRzwbn3XHv01++0B NtTQ== X-Gm-Message-State: AOAM532dR/RDRTVLNdtCt04OHcV8SGR9ZQXCX9qgWBFeHlgnBge7w2BW gzE8BrbtdclP5v4QxZ2HFpEKOi0EZfHT9PD8vpw= X-Google-Smtp-Source: ABdhPJwbZIuDMNyE+DRDyy7JSkzyPMSbLYD3fglSkL+YXWVM/2VRHlGrxvAG0hxX97iTglO5T8XZtB/XzRI5h8IAuzE= X-Received: by 2002:a92:bb4d:: with SMTP id w74mr15060635ili.161.1595939003141; Tue, 28 Jul 2020 05:23:23 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <3B4BDD38-4C0E-4444-A294-0E17BA5E2FA8@fugue.com> <1978893.SkKRCvkyLV@linux-9daj> <9C027574-73FA-4D94-8BFF-32B7ECD2A71F@fugue.com> <0CEEDE62-234A-455C-AD5B-C989888B3D1F@fugue.com> In-Reply-To: From: tirumal reddy Date: Tue, 28 Jul 2020 12:23:11 +0000 Message-ID: To: Tommy Jensen Cc: Ted Lemon , Eric Rescorla , "add@ietf.org" , Paul Vixie , "STARK, BARBARA H" , Rob Sayre Content-Type: multipart/alternative; boundary="0000000000005d932505ab7f8116" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 12:23:27 -0000 --0000000000005d932505ab7f8116 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 28 Jul 2020 at 00:44, Tommy Jensen wrote: > (+1 to ekr's point) > > I agree with Ted: we shouldn't go weakening strong end-to-end encrypted > protocols on purpose. From an endpoint's perspective, there is no > authoritative way to distinguish between network administration ("good") > and network attacks ("bad") without some prior knowledge and trust of the > network, such as preinstalled certificates. > Secure discovery is possible in several scenarios and the client can identify/authenticate the local DoH/DoT server, for example see https://tools.ietf.org/html/draft-reddy-add-iot-byod-bootstrap-01 and https://tools.ietf.org/html/draft-btw-add-ipsecme-ike-00. In deployments where secure discovery is not possible, client validation techniques like pre-configured TRR or cryptographic assertion of the DNS server identity would ensure the client does not connect to an attacker's DoH/DoT server. > Arguably, these networks which want to tightly control network behavior > ought to tightly control network joining capabilities to prevent this > perceived misbehavior. Otherwise, any side door we build for MitM to more > readily block/downgrade communication between intended endpoints will be = a > side door attackers can use as well. > IT-managed endpoint devices can be tightly controlled by management software but not BYOD (without MDM/configuration profile). In deployments like home networks, the network security service co-located in the home router has no way to manage or tightly control endpoint and IoT devices. -Tiru > > If we want to allow networks to give new and arbitrary endpoints a truste= d > (defined as "client can securely distinguish from an arbitrary attacker") > signal that a given communication mechanism is forbidden, we (not this WG= ) > should work on that on a larger scale. After all, such a mechanism could = be > used to signal network opposition to VPN tunnels, Tor connections, or > anything else a network find offensive. If it works for HTTPS, DoH should > inherit the benefits gracefully. > > What I'm saying is: we should leave this discussion off this list because > it isn't specific to encrypted DNS as networks opposing encrypted > communication to an endpoint has existed before DoH or DoT. Per the chart= er > quote below, we can inform about mechanisms available to detect these > network intentions, but I would say creation of new mechanisms is beyond > the scope of the charter. Chairs can correct me if I interpreted that > incorrectly. > > >> Develop an informational document that describes mechanisms for client= s > to detect specific network environments (such as captive portal and split > horizon) and to use that information to inform their DNS configuration. > > Thanks, > Tommy Jensen > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > The latest in Windows Internet Protocols: > Native gRPC support: https://aka.ms/grpcblogpost > DNS over HTTPS: https://aka.ms/dohblogpost > ------------------------------ > *From:* Add on behalf of Ted Lemon < > mellon@fugue.com> > *Sent:* Monday, July 27, 2020 5:27 PM > *To:* Eric Rescorla > *Cc:* add@ietf.org ; Paul Vixie ; STARK, > BARBARA H ; Rob Sayre > *Subject:* [EXTERNAL] Re: [Add] New Version Notification for > draft-pauly-add-resolver-discovery-01.txt > > On Jul 27, 2020, at 8:11 PM, Eric Rescorla > > wrote: > > in counterpoint, arguments in favour of the deliberate entropy of DoH hav= e > sometimes taken the form "if we make this easy to detect, then it will be > widely blocked", which presumes that the alternative cost of blocking DoH > can > be artificially raised above the accepted risks of not blocking it. > > > Yes, that is the argument, and it makes sense. If we make DoH easy to > detect, then there is no point in having DoH: it serves no purpose. > > > From my perspective, this is not correct. > > DoH has a number of technical advantages over DoT (for instance the > ability to use Alt-Svc to upgrade to DoH3). Of course, one might or might > not value these benefits against having two protocols, but that's not qui= te > the same thing. > > > Okay, fair point, DoH can just be a better protocol as well as being a wa= y > to get privacy. A better way to have put that would be that making DoH ea= sy > to detect blocks one of the main benefits of DoH: that it gives the user > privacy from on-path snoopers in a way that can=E2=80=99t be easily block= ed. > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000005d932505ab7f8116 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, 28 Jul 2020 at 00:44, Tommy Jense= n <Jensen.Thomas=3D40m= icrosoft.com@dmarc.ietf.org> wrote:
(+1 to ekr's point)=C2=A0

I agree with Ted: we shouldn't go weakening strong end-to-end encrypted= protocols on purpose. From an endpoint's perspective, there is no auth= oritative way to distinguish between network administration ("good&quo= t;) and network attacks ("bad") without some prior knowledge and trust of the network, such as preinstalled certificates.

Secure discovery is possibl= e in several scenarios and the client can identify/authenticate the local D= oH/DoT server, for example see=C2=A0https://tools.ietf.org/html/draft-re= ddy-add-iot-byod-bootstrap-01=C2=A0and=C2=A0https://tools.ietf.org/html/draft= -btw-add-ipsecme-ike-00. In deployments where secure discovery is not p= ossible, client validation techniques like pre-configured TRR or cryptograp= hic assertion of the DNS server identity would ensure the=C2=A0client does = not connect to an attacker's DoH/DoT server.
=C2=A0
Arguably, these networks which want to tightly control= network behavior ought to tightly control network joining capabilities to = prevent this perceived misbehavior. Otherwise, any side door we build for MitM to more readily block/downgrade communication betwe= en intended endpoints will be a side door attackers can use as well.
<= /div>

IT-managed endpoint devices can= be tightly controlled by management software but not BYOD (without MDM/con= figuration profile). In deployments like home networks, the network securit= y service co-located in the home router has no way to manage or tightly con= trol endpoint and IoT devices.=C2=A0

-Tiru
=C2=A0

If we want to allow networks to give new and arbitrary endpoints a trusted = (defined as "client can securely distinguish from an arbitrary attacke= r") signal that a given communication mechanism is forbidden, we (not = this WG) should work on that on a larger scale. After all, such a mechanism could be used to signal network opposition to = VPN tunnels, Tor connections, or anything else a network find offensive. If= it works for HTTPS, DoH should inherit the benefits gracefully.=C2=A0

What I'm saying is: we should leave this discussion off this list becau= se it isn't specific to encrypted DNS as networks opposing encrypted co= mmunication to an endpoint has existed before DoH or DoT. Per the charter q= uote below, we can inform about mechanisms available to detect these network intentions, but I would say creation of = new mechanisms is beyond the scope of the charter. Chairs can correct me if= I interpreted that incorrectly.

>> Develop an informat= ional document that describes mechanisms for=C2=A0clients to detect specific network environments (such as captive portal=C2=A0and split horizon) and to = use that information to inform their DNS=C2=A0configuration.

Thanks,
Tommy Jensen
=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The latest in Window= s Internet Protocols:
=C2=A0 Native gRPC s= upport: https://aka.ms/grpcblogpost=C2=A0
Fro= m: Add <ad= d-bounces@ietf.org> on behalf of Ted Lemon <mellon@fugue.com>
Sent: Monday, July 27, 2020 5:27 PM
To: Eric Rescorla <ekr@rtfm.com>
Cc: add@ietf.org <add@ietf.org&g= t;; Paul Vixie <pa= ul@redbarn.org>; STARK, BARBARA H <bs7652@att.com>; Rob Sayre <sayrer@gmail..c= om>
Subject: [EXTERNAL] Re: [Add] New Version Notification for draft-pau= ly-add-resolver-discovery-01.txt
=C2=A0
On Jul 27, 2020, at 8:11 PM, Eric= Rescorla <ekr@rtfm.c= om> wrote:
in counterpoint, arguments in fav= our of the deliberate entropy of DoH have=C2=A0
sometimes taken the form "if= we make this easy to detect, then it will be=C2=A0
widely blocked", which presu= mes that the alternative cost of blocking DoH can=C2=A0
be artificially raised above the = accepted risks of not blocking it.

Yes, that is the argument, and it makes sense. If we make DoH easy to = detect, then there is no point in having DoH: it serves no purpose.

From my perspective, this is not correct.

DoH has a number of technical advantages over DoT (for instance the ab= ility to use Alt-Svc to upgrade to DoH3). Of course, one might or might not= value these benefits against having two protocols, but that's not quit= e the same thing.

Okay, fair point, DoH can just be a better protocol as well as being a= way to get privacy. A better way to have put that would be that making DoH= easy to detect blocks one of the main benefits of DoH: that it gives the u= ser privacy from on-path snoopers in a way that can=E2=80=99t be easily blocked.


--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000005d932505ab7f8116-- From nobody Tue Jul 28 06:25:55 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDF1D3A0C45 for ; Tue, 28 Jul 2020 06:25:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8E7O4XDTMBfI for ; Tue, 28 Jul 2020 06:25:42 -0700 (PDT) Received: from smtp.guxx.net (smtp.guxx.net [IPv6:2a01:4f8:a0:322c::25:42]) by ietfa.amsl.com (Postfix) with ESMTP id 2360F3A0C1B for ; Tue, 28 Jul 2020 06:25:36 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 616E45F40B13; Tue, 28 Jul 2020 13:25:35 +0000 (UTC) Received: from [172.19.189.219] (p54b8acc8.dip0.t-ipconnect.de [84.184.172.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id C253C5F40539 for ; Tue, 28 Jul 2020 13:25:34 +0000 (UTC) From: "Ralf Weber" To: "ADD Mailing list" Date: Tue, 28 Jul 2020 15:25:34 +0200 X-Mailer: MailMate (1.13.1r5671) Message-ID: <660302C3-0EA4-44C3-9C9E-30E9697E843A@fl1ger.de> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: [Add] Current add drafts X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 13:25:46 -0000 Moin! So in preparation for the add wg meeting I read all the documents that are add related as per data tracker and some others. And while I gave some feedback to some directly I took a step back and categorised them for me and want to share that with you, maybe using this to find some common ground or a way forward. 1. The first category is “informational drafts”: These are drafts that look or describe the status quo of the problem space or at least some aspects of it. The drafts in this scenario are: - draft-campling-operator-observations - draft-deen-add-threats - draft-mglt-add-signaling-filtering-policies 2. The second category is “use existing network technologies to upgrade to a secure transport”: These drafts are using existing network technologies like DHCP or RA (and a lot more) to convey a secure transport to a client. I was amazed by the depth and width of the technologies covered in these drafts. They are: - draft-btw-add-home - draft-btw-add-ipsecme-ike - draft-btw-add-rfc8484-clarification - draft-reddy-add-enterprise - draft-reddy-add-iot-byod-bootstrap - draft-reddy-add-server-policy-selection 3. The third category is “just put it in the DNS”: These drafts use the DNS as direct as possible to get you to a secure transport. These drafts are: - draft-cook-doh-discovery-trial - draft-pp-add-resinfo - draft-pp-add-stub-upgrade - draft-rescorla-doh-cdisco 4. The fourth category is “create another layer(s) to solve the problem”: These drafts use DNS or HTTPs, or both to create one or more additional layers to discover “resolvers”. These drafts are: - draft-mglt-add-rdp - draft-pauly-add-resolver-discovery - draft-schinazi-httpbis-doh-preference-hints This of course is how I see the drafts and is a very rough categorisation and some aspects of some drafts might fall into other categories, but I am happy to discuss this. However coming from this categorisation my view on working group work is like this: Category one is needed, but is very controversial as we already seen, so it will take a long time to come with something that everybody can agree on. Category two looks like a desirable end goal for me as it is the right place for the network to do stuff, but given that it is very complex and broad and requires interactions with other groups so it might take some time to finalise it, but it should be at least our medium term goal. Also as most of category two is really in the lower levels of an operating system it might be hard for an application to get the rights from the OS to do these things. Which is were category three comes in that I see a good short term solution to get users to secure transport as the barriers for applications and providers of DNS services are very low. I’m struggling with category 4 as it creates another distributed overlay over an already distributed DNS system. I can understand the need to make a direct DNS connection from the end user to the content, but if you want to do this an IMHO better solution would be to put the recursive resolver in the end user device and work with dprive to secure the recursive to authoritative DNS connections. So long -Ralf —-- Ralf Weber From nobody Tue Jul 28 06:50:13 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 03E723A0D82 for ; Tue, 28 Jul 2020 06:50:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TPQsig6n11Ip for ; Tue, 28 Jul 2020 06:49:58 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D66BF3A0D5A for ; Tue, 28 Jul 2020 06:49:50 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 34481280553; Tue, 28 Jul 2020 15:49:49 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id 2E24B280607; Tue, 28 Jul 2020 15:49:49 +0200 (CEST) Received: from relay01.prive.nic.fr (unknown [10.1.50.11]) by mx4.nic.fr (Postfix) with ESMTP id 26C09280553; Tue, 28 Jul 2020 15:49:49 +0200 (CEST) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 19B92642C582; Tue, 28 Jul 2020 15:49:49 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id A698C40170; Tue, 28 Jul 2020 15:49:48 +0200 (CEST) Date: Tue, 28 Jul 2020 15:49:48 +0200 From: Stephane Bortzmeyer To: Paul Vixie Cc: add@ietf.org Message-ID: <20200728134948.GA24673@nic.fr> References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <31921523.VjnSb2Omm3@linux-9daj> X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.002120, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 13:50:08 -0000 On Mon, Jul 27, 2020 at 10:00:43PM +0000, Paul Vixie wrote a message of 23 lines which said: > i'd like ADD to recommend a protocol by which policy violations can > receive secure authentic unambiguous refusal signals, rather than > silence. this may require explicit negotiation between a node and > its gateway. We already have it, it seems, with draft-ietf-dnsop-extended-error, which is approved and in the RFC Editor queue (state RFC-EDITOR). From nobody Tue Jul 28 06:52:42 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 278FB3A0C5F for ; Tue, 28 Jul 2020 06:52:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7-d0kez60Lca for ; Tue, 28 Jul 2020 06:52:32 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E3093A0C78 for ; Tue, 28 Jul 2020 06:51:56 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 0C395280553; Tue, 28 Jul 2020 15:51:55 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id 049EC280631; Tue, 28 Jul 2020 15:51:55 +0200 (CEST) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id F0EA8280553; Tue, 28 Jul 2020 15:51:54 +0200 (CEST) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id E4D03642C582; Tue, 28 Jul 2020 15:51:54 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id BD5F140170; Tue, 28 Jul 2020 15:51:54 +0200 (CEST) Date: Tue, 28 Jul 2020 15:51:54 +0200 From: Stephane Bortzmeyer To: Ted Lemon Cc: Paul Vixie , "add@ietf.org" , "STARK, BARBARA H" , Rob Sayre Message-ID: <20200728135154.GB24673@nic.fr> References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <3B4BDD38-4C0E-4444-A294-0E17BA5E2FA8@fugue.com> <1978893.SkKRCvkyLV@linux-9daj> <9C027574-73FA-4D94-8BFF-32B7ECD2A71F@fugue.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <9C027574-73FA-4D94-8BFF-32B7ECD2A71F@fugue.com> X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.005949, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 13:52:40 -0000 On Mon, Jul 27, 2020 at 07:51:04PM -0400, Ted Lemon wrote a message of 234 lines which said: > This sounds like you are just asking for the equivalent of an HTTP > 451 response. And it exists, in draft-ietf-dnsop-extended-error. 4.16. Extended DNS Error Code 15 - Blocked The server is unable to respond to the request because the domain is blacklisted due to an internal security policy imposed by the operator of the server resolving or forwarding the query. 4.17. Extended DNS Error Code 16 - Censored The server is unable to respond to the request because the domain is blacklisted due to an external requirement imposed by an entity other than the operator of the server resolving or forwarding the query. Note that how the imposed policy is applied is irrelevant (in-band DNS filtering, court order, etc). 4.18. Extended DNS Error Code 17 - Filtered The server is unable to respond to the request because the domain is blacklisted as requested by the client. Functionally, this amounts to "you requested that we filter domains like this one." 4.19. Extended DNS Error Code 18 - Prohibited An authoritative server or recursive resolver that receives a query from an "unauthorized" client can annotate its REFUSED message with this code. Examples of "unauthorized" clients are recursive queries from IP addresses outside the network, blacklisted IP addresses, local policy, etc. From nobody Tue Jul 28 06:56:02 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6A3F3A0C66 for ; Tue, 28 Jul 2020 06:56:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2X3XDPgRmjwa for ; Tue, 28 Jul 2020 06:55:59 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D81F33A0C54 for ; Tue, 28 Jul 2020 06:55:49 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 179B2280553; Tue, 28 Jul 2020 15:55:48 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id 11919280631; Tue, 28 Jul 2020 15:55:48 +0200 (CEST) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id 0A152280553; Tue, 28 Jul 2020 15:55:48 +0200 (CEST) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id F315C642C582; Tue, 28 Jul 2020 15:55:47 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id CB83440170; Tue, 28 Jul 2020 15:55:47 +0200 (CEST) Date: Tue, 28 Jul 2020 15:55:47 +0200 From: Stephane Bortzmeyer To: Ralf Weber Cc: ADD Mailing list Message-ID: <20200728135547.GC24673@nic.fr> References: <660302C3-0EA4-44C3-9C9E-30E9697E843A@fl1ger.de> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <660302C3-0EA4-44C3-9C9E-30E9697E843A@fl1ger.de> X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.003936, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] Current add drafts X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 13:56:01 -0000 On Tue, Jul 28, 2020 at 03:25:34PM +0200, Ralf Weber wrote a message of 58 lines which said: > I read all the documents that are add related as per data tracker > and some others There are also documents that are not specifically ADD but partly overlaps, and sometimes make, IMHO, the ADD draft irrelevant (such as ADoT vs. DRDP). > 3. The third category is “just put it in the DNS”: Not "In the DNS" but "retrieved through the DNS". It is not the same thing since it goes through the resolver you want to know about, not in the public DNS. From nobody Tue Jul 28 07:03:03 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54DC73A0C84 for ; Tue, 28 Jul 2020 07:03:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 296YFc3ROkgQ for ; Tue, 28 Jul 2020 07:02:58 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7B8333A0C81 for ; Tue, 28 Jul 2020 07:02:57 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx4.open-xchange.com (Postfix) with ESMTPS id A32CE6A28A; Tue, 28 Jul 2020 16:02:55 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1595944975; bh=St+6RNE1dJ9r7tjaDbFQff9BZp+lSIFqK4RHMsWH358=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=chnhvU94eu0nQyit09DWnkuF5PQ4P+X/9vafnJ93BpLt0aL49cAu/7GcTCvh5rBA0 VIf1/CuFJbF4DTUKDhhEv0WWfGbcBjs5E9VS9xL+7LVAAklQyBgqv7DSgqLUOg1YNW m0bn1cZjvtGX1VXW43cFPhswgbIHRoWzVyK9lai2s1UWQvZeJKyGjMqGH4Ux/7/5JC VgumXZ3QqjyW9HfUnEDSH6pdlH5FxIf5/+BNuEm4J+6GpLur925e1pWNjNsFJx4g27 xn2PSV7jZHVNOc71iMHVhjx7TyLGkHHNuNnwFyoRNrNJ2fx9LrENgDI2ANibT+0D0F oasO2H11sPSIw== Received: from appsuite-gw2.open-xchange.com (appsuite-gw2.open-xchange.com [10.20.28.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 941233C0481; Tue, 28 Jul 2020 16:02:55 +0200 (CEST) Date: Tue, 28 Jul 2020 16:02:55 +0200 (CEST) From: Vittorio Bertola To: Stephane Bortzmeyer , Ted Lemon Cc: "add@ietf.org" Message-ID: <825608663.3472.1595944975510@appsuite-gw2.open-xchange.com> In-Reply-To: <20200728135154.GB24673@nic.fr> References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <3B4BDD38-4C0E-4444-A294-0E17BA5E2FA8@fugue.com> <1978893.SkKRCvkyLV@linux-9daj> <9C027574-73FA-4D94-8BFF-32B7ECD2A71F@fugue.com> <20200728135154.GB24673@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev19 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 14:03:02 -0000 > Il 28/07/2020 15:51 Stephane Bortzmeyer ha scritto: > > On Mon, Jul 27, 2020 at 07:51:04PM -0400, > Ted Lemon wrote > a message of 234 lines which said: > > > This sounds like you are just asking for the equivalent of an HTTP > > 451 response. > > And it exists, in draft-ietf-dnsop-extended-error. What is still missing is a standard way for the resolver to communicate a URL to the client in the response, so that the client (if it wants) can use it to retrieve and display a human-readable error message. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Tue Jul 28 07:13:27 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DC5A3A0CB5 for ; Tue, 28 Jul 2020 07:13:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AYHYTQC0zJkX for ; Tue, 28 Jul 2020 07:13:24 -0700 (PDT) Received: from mail-qv1-xf36.google.com (mail-qv1-xf36.google.com [IPv6:2607:f8b0:4864:20::f36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 57A9E3A0CB3 for ; Tue, 28 Jul 2020 07:13:24 -0700 (PDT) Received: by mail-qv1-xf36.google.com with SMTP id u8so9136340qvj.12 for ; Tue, 28 Jul 2020 07:13:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=geRKV65H2HKVk0qcCS8Dvw6a1BXzECIDQF6IJvgyAGI=; b=FKhzquOgzsNv6p62n4giINPYw2YxTU3gjpQiH+C4GInUPlq4522Gul6PCNBNSARdgS WHhFGDRsBlLDloHbZ+LoGiGcbpKdL3e+Oxp3kZ4bYacpKLnwyULduSx0Nakf9gDmwX4c jZ31+DvgGEMTZqNUiMvAnL38SQPGu3T02BmaIaHS7V35swiyViJUQ3e6QfM/1Oo2Trv/ LGVOAybsKzQAXHek2ciWwIdBlf2x3zsZZTJ1mDFxg/201sFEUy3wiJ1JUj/uxl2yE4R3 rpYFWWsJx6Z7fevnNEYOyZZauTRsBcDg14zbaBPViOSywkE/qHG2R3ZZ1euNdIio8lHI C9Gw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=geRKV65H2HKVk0qcCS8Dvw6a1BXzECIDQF6IJvgyAGI=; b=AvSqvj8/4BJhXNsTbC7e5NA6cEqlyYryXiUSiLwQsEbajtjwRIf5xNSB503jVddsCm EuFQ2qJ2KhIONNV8kLs0jnhQ3yDDGF+Jleclc79L+LSR96+Wx+Wzi+EY66xdqErKa8CK cwn3DR1heWVV+O6dXMqRelven5YOzx/1MhXfhg/CUYid+N97ACdTFaIlGG1CyAd28o4p 9TUgtSX/QH/OTVItgYv3L8F3hELUpaULZ5Dro4sf7lF52Xn6fyF7PiXMNnZJ7DcgoM+V phs4oDFHsiepWy3NbMF7WkZVfCSv9DMCA6THajWAQHLt1lX/He2HEZqSeNqUeEKa5S7j hCwA== X-Gm-Message-State: AOAM531nTh6QTjula2jpyHfXmDF4vw8BAc2X21CHb5BJd0e3jXfE9Trj MjW4/l+fUafnk1iyvp1AyRgxv1H+W6I= X-Google-Smtp-Source: ABdhPJzmM57fBy50TYsvHAE53AeUblEMl9M3QXOUAi9IuFkhN+ys8ujGmD1EtAn3yDZVQSN+2KxVLg== X-Received: by 2002:ad4:49b4:: with SMTP id u20mr24614988qvx.73.1595945603335; Tue, 28 Jul 2020 07:13:23 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:ddf1:72ea:9d69:1b4a? ([2601:18b:300:36ee:ddf1:72ea:9d69:1b4a]) by smtp.gmail.com with ESMTPSA id a3sm22213450qkf.131.2020.07.28.07.13.22 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 28 Jul 2020 07:13:22 -0700 (PDT) From: Ted Lemon Message-Id: <45F2A448-4248-4C14-AA0B-ECBB34FF3AE4@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_D9965C79-6DAA-4B63-BC0C-0EDF852BF349" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Tue, 28 Jul 2020 10:13:20 -0400 In-Reply-To: <20200728134948.GA24673@nic.fr> Cc: Paul Vixie , add@ietf.org To: Stephane Bortzmeyer References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> <20200728134948.GA24673@nic.fr> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 14:13:26 -0000 --Apple-Mail=_D9965C79-6DAA-4B63-BC0C-0EDF852BF349 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 28, 2020, at 9:49 AM, Stephane Bortzmeyer = wrote: > We already have it, it seems, with draft-ietf-dnsop-extended-error, > which is approved and in the RFC Editor queue (state RFC-EDITOR). This works if the DoH server that sends the error response is the = intended server. However, it doesn=E2=80=99t work when the network is = blocking the connection to an off-network DoH server. For that I think = you need a TLS alert. On Jul 28, 2020, at 10:02 AM, Vittorio Bertola = wrote: >=20 > What is still missing is a standard way for the resolver to = communicate a URL to the client in the response, so that the client (if = it wants) can use it to retrieve and display a human-readable error = message. That would be an attack surface=E2=80=94now I can intercept your = connection and send you to a malware URL (or snooping URL, or whatever). = And again would only work if the DoH server sending the response is the = one with which the device connecting to it intended to communicate. --Apple-Mail=_D9965C79-6DAA-4B63-BC0C-0EDF852BF349 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 28, 2020, at 9:49 AM, Stephane Bortzmeyer <bortzmeyer@nic.fr> = wrote:
We already = have it, it seems, with draft-ietf-dnsop-extended-error,
which is = approved and in the RFC Editor queue (state = RFC-EDITOR).

This works if the DoH server that sends the error response is = the intended server. However, it doesn=E2=80=99t work when the network = is blocking the connection to an off-network DoH server. For that I = think you need a TLS alert.

On Jul 28, 2020, at 10:02 AM, Vittorio Bertola <vittorio.bertola@open-xchange.com> wrote:

What = is still missing is a standard way for the resolver to communicate a URL = to the client in the response, so that the client (if it wants) can use = it to retrieve and display a human-readable error message.

That would be an attack surface=E2=80=94now I can intercept = your connection and send you to a malware URL (or snooping URL, or = whatever). And again would only work if the DoH server sending the = response is the one with which the device connecting to it intended to = communicate.

= --Apple-Mail=_D9965C79-6DAA-4B63-BC0C-0EDF852BF349-- From nobody Tue Jul 28 07:31:14 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD6B73A0CD6 for ; Tue, 28 Jul 2020 07:31:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OZP6yZlBGoSt for ; Tue, 28 Jul 2020 07:31:10 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F5433A0B9B for ; Tue, 28 Jul 2020 07:31:10 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx4.open-xchange.com (Postfix) with ESMTPS id 676B06A28A; Tue, 28 Jul 2020 16:31:08 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1595946668; bh=3avqAbBnHutb9sQ9OgdCP84nzzdtAcd8qbdQJdjSwOY=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=ADLlHZx2IGAh4kqo0v+jzZnyZ/25aQAKA2rXJ8xzlYle6xU9kugVsspuIIVMCTdZY xhUUK7QNCSmJcDKqvdgMUZu1MJ/xl1hPxNzii5utQ3rliCA3ilJML5rDByivreApv+ Zmq2XDdud/xMpthoMVBRw/w+h84ywVozlFO+8rN8owRWSCcczIWDdGNJRPwpyBJY7K lXNCn0ybOinikwQxNwxdCZoVQj8fHbpNtLNvG9cjqiryZ8YQH+OzmoQ1LXoSJWBjGZ 5d3RYd6/NB+7+jE1nu9YVk7Drl14OjnZANS6hZaYg91V5NXKa+zR5MuROZwdQw2U50 JCRY3fh5LXHhQ== Received: from appsuite-gw2.open-xchange.com (appsuite-gw2.open-xchange.com [10.20.28.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 5898F3C0481; Tue, 28 Jul 2020 16:31:08 +0200 (CEST) Date: Tue, 28 Jul 2020 16:31:07 +0200 (CEST) From: Vittorio Bertola To: Ted Lemon Cc: add@ietf.org Message-ID: <606980496.3510.1595946668260@appsuite-gw2.open-xchange.com> In-Reply-To: <45F2A448-4248-4C14-AA0B-ECBB34FF3AE4@fugue.com> References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> <20200728134948.GA24673@nic.fr> <45F2A448-4248-4C14-AA0B-ECBB34FF3AE4@fugue.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_3508_551592689.1595946668245" X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev19 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 14:31:13 -0000 ------=_Part_3508_551592689.1595946668245 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable > Il 28/07/2020 16:13 Ted Lemon ha scritto: > =20 > =20 > On Jul 28, 2020, at 10:02 AM, Vittorio Bertola wrote: >=20 > > > What is still missing is a standard way for the resol= ver to communicate a URL to the client in the response, so that the client = (if it wants) can use it to retrieve and display a human-readable error mes= sage. > >=20 > > > =20 > That would be an attack surface=E2=80=94now I can intercept your conn= ection and send you to a malware URL (or snooping URL, or whatever). And ag= ain would only work if the DoH server sending the response is the one with = which the device connecting to it intended to communicate. >=20 Of course that requires some security considerations and validation before = use, but if you assume that you cannot trust the (https) URL indicated in t= he EDNS response, then you cannot trust the response itself and its indicat= ion that the domain was blocked for whatever reason, and possibly you canno= t trust any DNS response whatsoever. In any case, it might be that clients = will only use that information if it is received over an authenticated chan= nel (e.g. via DoH). -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com mailto:vittorio.bertola@open-xchange.com= =20 Office @ Via Treviso 12, 10144 Torino, Italy ------=_Part_3508_551592689.1595946668245 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable =20 =20
 
=20
=20
Il 28/07/2020 16:13 Ted Lemon <mellon@fugue.com> ha scritto:
=20
 
=20
 
=20
On Jul 28, 2020, at 10:02 AM, Vittorio Bertola <vittorio.bertola@open-xchange= .com> wrote:
=20
=20

What is still missing is a standard way for the resolv= er to communicate a URL to the client in the response, so that the client (= if it wants) can use it to retrieve and display a human-readable error mess= age.
=20
 
=20
That would be an attack surface=E2=80=94now I can intercept your conn= ection and send you to a malware URL (or snooping URL, or whatever). And ag= ain would only work if the DoH server sending the response is the one with = which the device connecting to it intended to communicate.
=20
=20
=20
=20
Of course that requires some security considerations and validation befo= re use, but if you assume that you cannot trust the (https) URL indicated i= n the EDNS response, then you cannot trust the response itself and its indi= cation that the domain was blocked for whatever reason, and possibly you ca= nnot trust any DNS response whatsoever. In any case, it might be that clien= ts will only use that information if it is received over an authenticated c= hannel (e.g. via DoH).
=20
=20

--

=20 
Vittorio Bertola | Head of Policy & Innovation, Open=
-Xchange
vittorio.b=
ertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Ital=
y
=20
------=_Part_3508_551592689.1595946668245-- From nobody Tue Jul 28 07:42:21 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 962A33A0E00 for ; Tue, 28 Jul 2020 07:42:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 06hylz56vPyp for ; Tue, 28 Jul 2020 07:42:17 -0700 (PDT) Received: from mail-il1-x129.google.com (mail-il1-x129.google.com [IPv6:2607:f8b0:4864:20::129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D4C893A0DF8 for ; Tue, 28 Jul 2020 07:42:09 -0700 (PDT) Received: by mail-il1-x129.google.com with SMTP id z3so6135048ilh.3 for ; Tue, 28 Jul 2020 07:42:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jCw3ztBOw+8zadRmSqf1hw1+jpFAcmBxLuzwoL7zWBE=; b=r9dqYCCQyJysPeMPLRaHVZURZagCCLyAyG45UAqmjGmuPcQ/N7f9kyplwslwTF77bi q+AfSw1PSUj+eStxh8D3QeZmdipNomoX+pRsIPmoM1rA2wZa/hxfhiGCDvkqHzY63jxD KC+8C+SxuFn1+CO6Zpl3rjX7LXRQGTrY1SjRGm9DVEorly84H5pLsy6Y1L89PRuSH3LC o0pHaHraNR8juXANdWcS6qTLKczrLWb/mmiDcjhpwsxeK736oNpLz44pa96Yp5tacO52 FoIo7JG3Nk63NTICsP431MyrW0wZOnRud/1C4tURC65Dt5XYDyLi4lER9tidFw7tjuNo yNpw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jCw3ztBOw+8zadRmSqf1hw1+jpFAcmBxLuzwoL7zWBE=; b=LZYKjJTYEjKEFulzKbsDBGwKFnP83mlv7x595k7JLogtj65ptCzaTCkpWmDzTFAhHm b8r3w/b5nDNCr2pQ7JGsW3pggaT1eWyg1BtohbdfWAOJ4VVRRJgrbIQ21Gfhnl/Bii1g dv1TxVOKzfmiEQN/kN04em6iHjp6jYctcmqGIgQqlH9F+TomxxtUb4UGf46xf1wFB1Km YMgmAOWnD+ZSHUpmYO/GhLfP3tw9Kt9+DeaejL6lOqF2fizjKVInH/6nWP0vdgbwCBeh gOjxTblwKt7arnDNXWmDeMbZz2VA3CQFbJesIdac2/4GRm4c0bLxyXgW6OwMzlavoRTc lYiA== X-Gm-Message-State: AOAM531CvdKVuCdz8vyWxxM2A6q6II0D1BdoyyQFR78UQWab5kY2Xm8/ Mwu9P/Oc9++HoTMRDcA/tljrnR5ztaex1nmkvzc= X-Google-Smtp-Source: ABdhPJyaSN/WC7JNvjGRC6uH46PhIhjmPqZpChL9MVSGfIWSWoCVaguly4jouPJ4iB+twGj/3uJOMhwS6dCuKKO7xXc= X-Received: by 2002:a92:aa57:: with SMTP id j84mr24906379ili.214.1595947329168; Tue, 28 Jul 2020 07:42:09 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <3B4BDD38-4C0E-4444-A294-0E17BA5E2FA8@fugue.com> <1978893.SkKRCvkyLV@linux-9daj> <9C027574-73FA-4D94-8BFF-32B7ECD2A71F@fugue.com> <20200728135154.GB24673@nic.fr> In-Reply-To: <20200728135154.GB24673@nic.fr> From: tirumal reddy Date: Tue, 28 Jul 2020 14:41:57 +0000 Message-ID: To: Stephane Bortzmeyer Cc: Ted Lemon , "add@ietf.org" , Paul Vixie , "STARK, BARBARA H" , Rob Sayre Content-Type: multipart/alternative; boundary="000000000000a2a99c05ab817197" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 14:42:20 -0000 --000000000000a2a99c05ab817197 Content-Type: text/plain; charset="UTF-8" On Tue, 28 Jul 2020 at 13:52, Stephane Bortzmeyer wrote: > On Mon, Jul 27, 2020 at 07:51:04PM -0400, > Ted Lemon wrote > a message of 234 lines which said: > > > This sounds like you are just asking for the equivalent of an HTTP > > 451 response. > > And it exists, in draft-ietf-dnsop-extended-error. > > 4.16. Extended DNS Error Code 15 - Blocked > > The server is unable to respond to the request because the domain is > blacklisted due to an internal security policy imposed by the > operator of the server resolving or forwarding the query. > > 4.17. Extended DNS Error Code 16 - Censored > > The server is unable to respond to the request because the domain is > blacklisted due to an external requirement imposed by an entity other > than the operator of the server resolving or forwarding the query. > Note that how the imposed policy is applied is irrelevant (in-band > DNS filtering, court order, etc). > > 4.18. Extended DNS Error Code 17 - Filtered > > The server is unable to respond to the request because the domain is > blacklisted as requested by the client. Functionally, this amounts > to "you requested that we filter domains like this one." > > 4.19. Extended DNS Error Code 18 - Prohibited > > An authoritative server or recursive resolver that receives a query > from an "unauthorized" client can annotate its REFUSED message with > this code. Examples of "unauthorized" clients are recursive queries > from IP addresses outside the network, blacklisted IP addresses, > local policy, etc. > https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-04 conveys the resolver information, it includes the reasons for performs filtering: malwareblocking: The DNS server offers malware blocking service. If access to domains is blocked on threat data, the parameter value is set to 'true'. Note that some of the commonly known types of malware are viruses, worms, trojans, bots, ransomware, backdoors, spyware, and adware. phishingblocking: The DNS server offers phishing blocking service. If access to phishing domains is blocked, the parameter value is set to 'true'. policyblocking: If access to domains is blocked due to an internal policy imposed by the operator of the DNS server, the parameter value is set to 'true'. Note that the extended error code "Blocking" defined in Section 4.16 of [I-D.ietf-dnsop-extended-error ] identifies access to domains is blocked due to an policy by the operator of the DNS server. censoredblocking: If access to domains is blocked due to an external requirement imposed by an external entity, the parameter value is set to 'true'. Note that the extended error code "Censored" defined in Section 4.17 of [I-D.ietf-dnsop-extended-error ] identifies access to domains is blocked based on a requirement from an external entity. Similar to the definition of "Censored" blocking in [I-D.ietf-dnsop-extended-error ], this version of the specification does not distinguish blocking from regulatory bodies (e.g., Law Enforcement Agency) vs. arbitrary blocking. Cheers, -Tiru > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000a2a99c05ab817197 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, 28 Jul 2020 at 13:52, Stephane Bo= rtzmeyer <bortzmeyer@nic.fr>= wrote:
On Mon, Jul 27, 2020 at 07:51:04PM -0400,
=C2=A0Ted Lemon <m= ellon@fugue.com> wrote
=C2=A0a message of 234 lines which said:

> This sounds like you are just asking for the equivalent of an HTTP
> 451 response.

And it exists, in draft-ietf-dnsop-extended-error.

4.16.=C2=A0 Extended DNS Error Code 15 - Blocked

=C2=A0 =C2=A0The server is unable to respond to the request because the dom= ain is
=C2=A0 =C2=A0blacklisted due to an internal security policy imposed by the<= br> =C2=A0 =C2=A0operator of the server resolving or forwarding the query.

4.17.=C2=A0 Extended DNS Error Code 16 - Censored

=C2=A0 =C2=A0The server is unable to respond to the request because the dom= ain is
=C2=A0 =C2=A0blacklisted due to an external requirement imposed by an entit= y other
=C2=A0 =C2=A0than the operator of the server resolving or forwarding the qu= ery.
=C2=A0 =C2=A0Note that how the imposed policy is applied is irrelevant (in-= band
=C2=A0 =C2=A0DNS filtering, court order, etc).

4.18.=C2=A0 Extended DNS Error Code 17 - Filtered

=C2=A0 =C2=A0The server is unable to respond to the request because the dom= ain is
=C2=A0 =C2=A0blacklisted as requested by the client.=C2=A0 Functionally, th= is amounts
=C2=A0 =C2=A0to "you requested that we filter domains like this one.&q= uot;

4.19.=C2=A0 Extended DNS Error Code 18 - Prohibited

=C2=A0 =C2=A0An authoritative server or recursive resolver that receives a = query
=C2=A0 =C2=A0from an "unauthorized" client can annotate its REFUS= ED message with
=C2=A0 =C2=A0this code.=C2=A0 Examples of "unauthorized" clients = are recursive queries
=C2=A0 =C2=A0from IP addresses outside the network, blacklisted IP addresse= s,
=C2=A0 =C2=A0local policy, etc.

https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-04= =C2=A0conveys the resolver information, it includes the reasons for perform= s filtering:

   malwareblocking:  The DNS server offers malware blocking servi=
ce.
         If access to domains is blocked on threat data, the parameter
         value is set to 'true'.  Note that some of the commonly kn=
own
         types of malware are viruses, worms, trojans, bots, ransomware,
         backdoors, spyware, and adware.

      phishingblocking:  The DNS server offers phishing blocking
         service.  If access to phishing domains is blocked, the
         parameter value is set to 'true'.

      policyblocking:  If access to domains is blocked due to an
         internal policy imposed by the operator of the DNS server, the
         parameter value is set to 'true'.  Note that the extended =
error
         code "Blocking" defined in Section 4.16 of
         [I-D.ietf-dnsop-extended-error] identifies access to =
domains is
         blocked due to an policy by the operator of the DNS server.

      censoredblocking:  If access to domains is blocked due to an
         external requirement imposed by an external entity, the
         parameter value is set to 'true'.  Note that the extended =
error
         code "Censored" defined in Section 4.17 of
         [I-D.ietf-dnsop-extended-error] identifies access to =
domains is
         blocked based on a requirement from an external entity.
         Similar to the definition of "Censored" blocking in
         [I-D.ietf-dnsop-extended-error], this version of the
         specification does not distinguish blocking from regulatory
         bodies (e.g., Law Enforcement Agency) vs.  arbitrary blocking.=C2=
=A0

Cheers,
-Tiru
=C2=A0

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000a2a99c05ab817197-- From nobody Tue Jul 28 07:43:56 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D7573A0DF9 for ; Tue, 28 Jul 2020 07:43:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nQhOSrgJeDPc for ; Tue, 28 Jul 2020 07:43:51 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52BF53A0DF4 for ; Tue, 28 Jul 2020 07:43:51 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id j8so8631606ioe.9 for ; Tue, 28 Jul 2020 07:43:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=WBLkyOZlk766GgECCVcoZ9t2cImSQfqpa3aq46goTZQ=; b=a3dfK5r72l0Y7jP+UsmDkCdrrvzjt1jFyeBVNX2n+CDOM3+JFqsE4/7bxpYPImHM1c ccAj+/YkQy1aJ8OSpoPpLIzF9rF3iAaC+TLbDV3HsNm7z6eMGCHCLe1eCu99JucTDyPx ylly7lXVV55/b5KkxFfMnrpXa9yy9edfjBcvwk7j3+CA7Wsi6yqCXzyLZosv7hWBi2GH HaitxMZKVTLQ/vvvYBlAhX2muiZ72uu4VaENzm97nRPYFKsLo81CCclgkIfLwLz37Y3s yUhbix2V1HlmUagYx9gDFiNjakUFqLaXcYcj/QXSxfhpWNz6aejTQCMAGny87U1yoD/Y Qkhg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=WBLkyOZlk766GgECCVcoZ9t2cImSQfqpa3aq46goTZQ=; b=IIAcAZhQJlw9dPqbrCKOcSRpuez/JmvcckiIxaMY60dQEUWGO1ePYJMuLfrMVPmswq KTBt667p/WYKrwZ1l3s7te3yQcv3Q8IXuDY4xrnyRlNJdxlNDiVRwWCDYrKeSMn5wFgU LZXN7V5ZnKRWAmNZk5eEOEZ2PiBSah61i8W1JtN8RvOj5JHVj5rpsn9a5sEd4KDlByiB Ye7545BSN4rtaIjn6RNMtBHtrK17z8jHa3lHkvsWAcpbqO9EPZq5jwsZqf0dVuM+E9l7 Rc3lpcEiu9+KbA9A0buhpzovMA8MYsv/0nbwCaTlgzZ6gEVXXLPeXOI9FTyujAkrUmQZ XrfQ== X-Gm-Message-State: AOAM533q1koVx/FWAG4XkMxSbl6L5Lo6vHlvjk+/pECFkYiUu+GLGRSq o6lVuDyHbmnvkSNyxNP28Vv6e42RYIskhEblkaHPJiZz094= X-Google-Smtp-Source: ABdhPJyLuO/uFm+c4081EfAECgwKwgHsGcnq8isl7mhNRwyTlRJgJgYr8XHvbwfT2Jrfh/YRBkTxefSWXacdh8wsuIA= X-Received: by 2002:a6b:b5cd:: with SMTP id e196mr28764934iof.46.1595947430552; Tue, 28 Jul 2020 07:43:50 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <3B4BDD38-4C0E-4444-A294-0E17BA5E2FA8@fugue.com> <1978893.SkKRCvkyLV@linux-9daj> <9C027574-73FA-4D94-8BFF-32B7ECD2A71F@fugue.com> <20200728135154.GB24673@nic.fr> <825608663.3472.1595944975510@appsuite-gw2.open-xchange.com> In-Reply-To: <825608663.3472.1595944975510@appsuite-gw2.open-xchange.com> From: tirumal reddy Date: Tue, 28 Jul 2020 14:43:38 +0000 Message-ID: To: Vittorio Bertola Cc: Stephane Bortzmeyer , Ted Lemon , "add@ietf.org" Content-Type: multipart/alternative; boundary="000000000000ada72405ab81772d" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 14:43:54 -0000 --000000000000ada72405ab81772d Content-Type: text/plain; charset="UTF-8" On Tue, 28 Jul 2020 at 14:03, Vittorio Bertola wrote: > > > > Il 28/07/2020 15:51 Stephane Bortzmeyer ha scritto: > > > > On Mon, Jul 27, 2020 at 07:51:04PM -0400, > > Ted Lemon wrote > > a message of 234 lines which said: > > > > > This sounds like you are just asking for the equivalent of an HTTP > > > 451 response. > > > > And it exists, in draft-ietf-dnsop-extended-error. > > What is still missing is a standard way for the resolver to communicate a > URL to the client in the response, so that the client (if it wants) can use > it to retrieve and display a human-readable error message. > Yup, https://tools.ietf.org/html/draft-reddy-dnsop-error-page-02 explains a method to return an URL that explains the reason the DNS query was filtered. > > -- > Vittorio Bertola | Head of Policy & Innovation, Open-Xchange > vittorio.bertola@open-xchange.com > Office @ Via Treviso 12, 10144 Torino, Italy > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000ada72405ab81772d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, 28 Jul 2020 at 14:03, Vittorio Be= rtola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:


> Il 28/07/2020 15:51 Stephane Bortzmeyer <bortzmeyer@nic.fr> ha scritto:
>=C2=A0
> On Mon, Jul 27, 2020 at 07:51:04PM -0400,
>=C2=A0 Ted Lemon <mellon@fugue.com> wrote
>=C2=A0 a message of 234 lines which said:
>
> > This sounds like you are just asking for the equivalent of an HTT= P
> > 451 response.
>
> And it exists, in draft-ietf-dnsop-extended-error.

What is still missing is a standard way for the resolver to communicate a U= RL to the client in the response, so that the client (if it wants) can use = it to retrieve and display a human-readable error message.
=

Yup,=C2=A0https://tools.ietf.org/html/draft-reddy-dnsop-er= ror-page-02=C2=A0explains a method to return an URL that explains the r= eason the DNS query was filtered.=C2=A0
=C2=A0

--
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vitt= orio.bertola@open-xchange.com
Office @ Via Treviso 12, 10144 Torino, Italy

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000ada72405ab81772d-- From nobody Tue Jul 28 07:49:55 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E87E3A0D68 for ; Tue, 28 Jul 2020 07:49:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H1ist3j-2uaH for ; Tue, 28 Jul 2020 07:49:51 -0700 (PDT) Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 931C33A0D56 for ; Tue, 28 Jul 2020 07:49:47 -0700 (PDT) Received: by mail-io1-xd31.google.com with SMTP id s189so13766183iod.2 for ; Tue, 28 Jul 2020 07:49:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=VDd8aAodFJ9Kam5wmbm6SLCdN3HBKg6m+b0PSjtqCbk=; b=UWolQdbFijh+oAJsqrYqI0fcgiKjmq2nSAnop4A4vOi/ZWBezDXoYG0DC7NA/zRujo WwUU73W81vBwJdqGAwBBVo00zPyZOORHeEqW3fIQ+sAplx5invOXFcB5ogQ5K2z9nZU4 fSOAeRrTPSZ0nz0t7THmIXXwMVu9+M4lJ3mbOlhjPpyrjwK3sqHyLQANz4Lkr2a1qMg1 B4UQ07Ibi1HgESArqT++crwHQtZ5mC0/MVJt1++A/Poj7UPab9eReKE8/M5Q8XWNIRO3 MfNEn25crrkT/B5l40M71hravAeAzECshFibm+XXcKVUNfjMuMTd5hgml30bPaa3wAFn hmQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=VDd8aAodFJ9Kam5wmbm6SLCdN3HBKg6m+b0PSjtqCbk=; b=lN7JAfHT5N2lV6T+LTK+eXQhKQr0ECTMxoZrwM0upnkIICOtaJr+3u8ErT/mtLW0rg 3j9qtiAA8ha9tXyPHp79UjLtO7hSBODClyQMkEUroK+5Ok68WVW0jtunnaQ5ICxiqHmR FMQuRlXW9wSSHk59V7UI4cAdD2lHbkAii5kiYc4niqBoerY2gLdV5fxVjtzZ8FNLOfGZ WhKcTB+mXLqje+2nZ7VLYGwu6LFigdM1LDhm0y5juhTxx4MXL7jOlYNMV/1Y+L2mvkIj 5D7yb/tJpuhHL42836qGAgSRpvVZnxUSQi/aAdRnsl7u8rngMX0U5fyY8MWRg6V6sJJ1 D2Xg== X-Gm-Message-State: AOAM531dcgZZFJdjrumNeFyuZkLTtXhkd5vlid6JiA1bgBL4GSh7h6/3 q3qZP2sKiYRFlNHmhw2FbkVbIfrGQ69RkwI8r3I= X-Google-Smtp-Source: ABdhPJyV4UTFLJDZHCj+ZTb6BA1o79TXaSFpHauPuBIMxTStqFEFUUaZKBa7gMlLTMRJVETwWL1RG4pjjOCo/cpC0LQ= X-Received: by 2002:a05:6638:250f:: with SMTP id v15mr10015352jat.75.1595947786818; Tue, 28 Jul 2020 07:49:46 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> <20200728134948.GA24673@nic.fr> <45F2A448-4248-4C14-AA0B-ECBB34FF3AE4@fugue.com> <606980496.3510.1595946668260@appsuite-gw2.open-xchange.com> In-Reply-To: <606980496.3510.1595946668260@appsuite-gw2.open-xchange.com> From: tirumal reddy Date: Tue, 28 Jul 2020 14:49:35 +0000 Message-ID: To: Vittorio Bertola Cc: Ted Lemon , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000e9e0f605ab818ce7" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 14:49:53 -0000 --000000000000e9e0f605ab818ce7 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 28 Jul 2020 at 14:31, Vittorio Bertola wrote: > > > Il 28/07/2020 16:13 Ted Lemon ha scritto: > > > On Jul 28, 2020, at 10:02 AM, Vittorio Bertola < > vittorio.bertola@open-xchange..com > > wrote: > > > What is still missing is a standard way for the resolver to communicate a > URL to the client in the response, so that the client (if it wants) can u= se > it to retrieve and display a human-readable error message. > > > That would be an attack surface=E2=80=94now I can intercept your connecti= on and > send you to a malware URL (or snooping URL, or whatever). And again would > only work if the DoH server sending the response is the one with which th= e > device connecting to it intended to communicate. > > Of course that requires some security considerations and validation befor= e > use, but if you assume that you cannot trust the (https) URL indicated in > the EDNS response, then you cannot trust the response itself and its > indication that the domain was blocked for whatever reason, and possibly > you cannot trust any DNS response whatsoever. In any case, it might be th= at > clients will only use that information if it is received over an > authenticated channel (e.g. via DoH). > https://tools.ietf.org/html/draft-reddy-dnsop-error-page-02#section-6 manda= tes DoH/DoT to process the error page URL. Vittorio Bertola | Head of Policy & Innovation, Open-Xchange > vittorio.bertola@open-xchange.com > Office @ Via Treviso 12, 10144 Torino, Italy > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000e9e0f605ab818ce7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, 28 Jul 2020 at 14:31, Vittorio Be= rtola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:
=20 =20 =20
=C2=A0
=20
=20
Il 28/07/2020 16:13 Ted Lemon <mellon@fugue.com> ha scritto:
=20
=C2=A0
=20
=C2=A0
=20
On Jul 28, 2020, at 10:02 AM, Vittorio Bertola <vittorio.bertola@open-xc= hange..com> wrote:
=20
=20

What is still missing is a standard way for the resolver to commu= nicate a URL to the client in the response, so that the client (if it wants= ) can use it to retrieve and display a human-readable error message.
=20
=C2=A0
=20
That would be an attack surface=E2=80=94now I can intercept your conn= ection and send you to a malware URL (or snooping URL, or whatever). And ag= ain would only work if the DoH server sending the response is the one with = which the device connecting to it intended to communicate.
=20
=20
=20
=20
Of course that requires some security considerations and validation befo= re use, but if you assume that you cannot trust the (https) URL indicated i= n the EDNS response, then you cannot trust the response itself and its indi= cation that the domain was blocked for whatever reason, and possibly you ca= nnot trust any DNS response whatsoever. In any case, it might be that clien= ts will only use that information if it is received over an authenticated c= hannel (e.g. via DoH).

= https://tools.ietf.org/html/draft-reddy-dnsop-error-page-02#section-6= =C2=A0mandates DoH/DoT to process the error page URL.=C2=A0
<= br>
=20 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchangevit=
torio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torin=
o, Italy
=20
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000e9e0f605ab818ce7-- From nobody Tue Jul 28 08:07:20 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CBF683A0D7F for ; Tue, 28 Jul 2020 08:07:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mlGn2rkeCIhk for ; Tue, 28 Jul 2020 08:07:15 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640122.outbound.protection.outlook.com [40.107.64.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C86D3A0D7D for ; Tue, 28 Jul 2020 08:07:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=imfZKz1dkz0wx8EfQO0O3Ybzta9T+kAdanLgRMRnwK3DS9sNKwL0/wXaWfUlvK5DL5lgmzRwOUZjZPybfwGE5qbgGmHeYJH1WhIssCdeyWEV11Vvadtfd3RCiolWUkYT5JBCqIL438A8P/aJ4amvXb0SI9wprYyEC/657YcwV8TIBzC1o4dqXJILv+mlxw0+jtRW/95hmmMpcQPVj4XFFw7QQ3zlOlzNHfJDnVEdmxbRaTkUaG/6I05dm/1E/t2S88ZxLGRED+ODVqqw+w1yaGy2QT3YvpP/nr6WnSpH1MLc5O+8lK28OqhPLU5jmtUF32SPn3uFtZrI3LHnYEXr8w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Jj+WpvYsBCLSNs2reCKj/iSJ4tBcZRyjL2x5QnblYR8=; b=Nkr+ihkialLdOdfynqKohqtIxggeIBMISsgQ7+NJYcmDTrvsIMZoGa2c+pH7f1pxw336lUU+YBWCVuZeSuBiLW0kBxTag4olcXynh3THwSXazfx2M5gL8zDIAFwanX+rfinF00gwz3wE6VVoG6OsR1wrFpd0AiX5epLeUF1cIfuVF9OkckZaosdILjcXPilJznk98RC8uE1ThzOCaigZur00wGvmJtK0iUKiTl11J2fp4qoi0NIaVem4UUPXoLEJIdU+czHuRgTsVjmQZtG0lRPFVwFj66A65bWRfELc//tM1yEqiLbJevgCcGLJfNFLKYx4FWlLg1LCrchtBmXICg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Jj+WpvYsBCLSNs2reCKj/iSJ4tBcZRyjL2x5QnblYR8=; b=Cdmbu81Pv5snkSVlmoyOpkuL3bRQXfDanYQ5pV5mi/644DrQ7TGTu9TL+H2C0MbpoBd1tx4KjyRa9zJCc2gIJnwor8d/karRDstO0tI5lUJimjKSTT4SPTfaSu5/7Ysv3P3TZVqAqEIbopo5elELKS+anvYJAp7hWfVmk8bzzt8= Received: from CH2PR00MB0778.namprd00.prod.outlook.com (2603:10b6:610:6c::23) by CH2PR00MB0727.namprd00.prod.outlook.com (2603:10b6:610:ad::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3274.0; Tue, 28 Jul 2020 15:07:10 +0000 Received: from CH2PR00MB0778.namprd00.prod.outlook.com ([fe80::c66:75df:7c7:5871]) by CH2PR00MB0778.namprd00.prod.outlook.com ([fe80::c66:75df:7c7:5871%9]) with mapi id 15.20.3276.000; Tue, 28 Jul 2020 15:07:09 +0000 From: Tommy Jensen To: Paul Vixie , "add@ietf.org" Thread-Topic: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWZLGV7A1JtnrexkqDcLFH6GVWT6kdE/+H Date: Tue, 28 Jul 2020 15:07:09 +0000 Message-ID: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <0CEEDE62-234A-455C-AD5B-C989888B3D1F@fugue.com> , <3954080.qUnaP1aulD@linux-9daj> In-Reply-To: <3954080.qUnaP1aulD@linux-9daj> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-28T15:07:09.382Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; authentication-results: redbarn.org; dkim=none (message not signed) header.d=none;redbarn.org; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2601:600:a080:aff0:f1cd:f7ba:46d3:252f] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: ef3e6a20-46af-4bed-142f-08d83307e69f x-ms-traffictypediagnostic: CH2PR00MB0727: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 7Q0xQ3l5QQFCnA7xlpYrCFLo0RJe/xHKmFvs4CrE3oB+jo6UevSMUtkHIJmaO6xe8molcnbpPh8c7OTPXC/nkyXDzcinuIPP629qMVv6ONPJjHzLoBWh25vSBBR9v2Z/PJrn7lBvbPwTkDI4WBjuHtzktPpSqXQycaeujTiOTtDboUht3NSi0P3d6Sa/CD/hbKwq7Lot7wBCmXc7768sxTF4ilzDLQrFvNUOM/3EHrX+HdcB9S4DrZ3PxR8RPXy2GnsW/ZjuHS+paOdPjSsQZNDI8bPVkheWaos1SBi7bKklBtBMG3/1JwKL21B2cKvvFSv7gej3dDT05HAnVZPMugIKd1v07Oes4op8STvU5pce2OB8lXPf3xF8lrPP7koklO9tV2aekYTbuUaJcnDUAw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR00MB0778.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(396003)(346002)(39860400002)(376002)(136003)(15650500001)(9686003)(33656002)(5660300002)(166002)(966005)(186003)(8936002)(55016002)(86362001)(66476007)(66946007)(110136005)(19627405001)(64756008)(66556008)(66446008)(91956017)(8990500004)(8676002)(7696005)(2906002)(6506007)(53546011)(52536014)(71200400001)(82950400001)(82960400001)(316002)(10290500003)(76116006)(66574015)(83380400001)(478600001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: Nqq6RhpQpfF+F99RjnkEePSlWvsMqV+6M4UBnDSvBEqUrmkQThcg12gID7Ox58ER7fMfTQlPM19I5PI/2s8eW6gW/Hho8hBFs9d2MJZ+tM9Wrf+5iuxV2VytcC6Wt2LgzK2+2r1X8vTlJrK1w6KNSL4NSHOSLhdo3vfylzrb5BT59i/JkN1wpRYPAVH6V9Ede1nAJ1Ouneg/Ox3iZqeMoeWVJ7vcdZMc7WcxlQB12Wh3wHrzj7PXHMgM2yUZoom/FyB3BZp4uHq38L+oprKSLficNKw4uerDJR7tDw1MJjrkRVy8+em6ZWMVl+podh2iD/Ell3zz4oZ48KrmHLMz+ZEBRh292gbbQwbOgIi6+OY1CWr3qmQeYb1KFxsPp9z5VBnrO17FhmdYL3sExXkzGRx1tP69zdrt0HOyTNutZZDorMJ0Td+bmTLB06NZCXhQZ7vyV7z4vGBk7z9W+Q8xmrC9ivB0220A8sat+M5FzYumy6IJ1Rp8otvmVAyl57EGw9FvMRiRmHt6xsBliJfzHQFRvEG00CmSPY+OAX9kgge+pQyyOHMzAXJzffBuVyaXoY3yMwfVf+enF46QYaZtmBEmi34/SYbFFL2+WIP4E8PoZikRLMaWDmXfJjLfMwkMApX43hqT7YyUXvpqSMgdb7h4jhnd7N9fNkzXnPn4xjhLUBRQvd46Bv9/dt8pa3wo+M/Fn/LZZNRcqFCTSQdZmQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CH2PR00MB07781ECC2DE87168D4E0E0D4FA730CH2PR00MB0778namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: CH2PR00MB0778.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: ef3e6a20-46af-4bed-142f-08d83307e69f X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Jul 2020 15:07:09.9240 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 62Y34ow4piI0/o8pgdpOXhxSRi2JvE22eZiXo9nj4VInWR6AVQ1AV5/2tL3enz1kPwbgQ+i3pjfYAzFrGZczag== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR00MB0727 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 15:07:18 -0000 --_000_CH2PR00MB07781ECC2DE87168D4E0E0D4FA730CH2PR00MB0778namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable paul> let me state for the record that ted's opposition was to something i = hadn't proposed... Fair enough. paul> when DoH is going to be denied, i'd like the node to get an accurate = signal about that, rather than silent failure We agree on this point. My point from before is that this signal should be = 1) not specific to DoH as there are other pre-existing encrypted communicat= ion flows which could use this same new mechanism, and 2) authenticated suc= h that a client can strongly determine the signal came from a network admin= istrator for the network the client joined as opposed to an on-path attacke= r. Based on my point of view, such a mechanism should be designed outside t= he ADD WG. paul> but to repeat, what do you want to see happen during administrative d= enials? right now it's unexplained silence and failure. i think that's bad customer service, and i want us to strive for better. Before DoH, this was also unexplained silence and failure. The DNS packets = would be dropped and the device would see no connectivity until the DNS set= tings were changed by the user. Adding DoH to the mix doesn't change that c= ustomer support story. Users configuring public resolvers, encrypted or not= , will continue to see a lack of Internet connectivity when on a network wh= ich blocks off-network DNS flows, encrypted or not. The only difference is = when the traffic is unencrypted, the network can attack the traffic and eit= her 1) resolve the queries itself, or 2) return a false result to send brow= sers to a page explaining the situation. Allowing either of those approaches to also work for DoH or DoT would destr= oy the value of encrypted communication as they require the network to be a= ble to speak as if it were the endpoint the client was trying to reach. Ins= tead, we would need a network-originating signal referring to the prohibite= d communication channel. To my knowledge, this doesn't exist with authentic= ation to a recognized network authority. This circles back to my point abov= e about needing a larger-than-DoH-and-ADD-WG mechanism for networks to secu= rely indicate to clients when their network flows are forbidden. Thanks, Tommy Jensen =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The latest in Windows Internet Protocols: Native gRPC support: https://aka.ms/grpcblogpost DNS over HTTPS: https://aka.ms/dohblogpost ________________________________ From: Add on behalf of Paul Vixie Sent: Tuesday, July 28, 2020 12:34 AM To: add@ietf.org Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-= add-resolver-discovery-01.txt On Tuesday, 28 July 2020 00:44:08 UTC Tommy Jensen wrote: > (+1 to ekr's point) > > I agree with Ted: we shouldn't go weakening strong end-to-end encrypted > protocols on purpose. From an endpoint's perspective, there is no > authoritative way to distinguish between network administration ("good") > and network attacks ("bad") without some prior knowledge and trust of the > network, such as preinstalled certificates. ... since i was nearby when ted's and ekr's comments were made, let me state fo= r the record that ted's opposition was to something i hadn't proposed, and ma= y represent a misrestatement on his part, or perhaps a misunderstanding. as such, ekr's response was nonsequitur through no fault of his own, and i can neither confirm nor deny my position with respect to it. i don't want to ge= t in the way of the great discussion you folks want to have, other than to remind you all, it's actually off-topic from the remarks it quotes from me. > ... Arguably, these networks which > want to tightly control network behavior ought to tightly control network > joining capabilities to prevent this perceived misbehavior. ... when DoH is going to be denied, i'd like the node to get an accurate signal about that, rather than silent failure. that's not a political goal, but a customer service level goal. since DoH is in fact going to be widely denied= , and sometimes that will be by the owner/operator of the network and the nod= e, this adds a transparency and manageability burden to ADD. if you imagine th= at one form of misbehaviour is sudden unexpected unauthorized DoH use as a sid= e effect of a browser upgrade, then you might reconsider the word "tightly". > ... Otherwise, any > side door we build for MitM to more readily block/downgrade communication > between intended endpoints will be a side door attackers can use as well. consent will sometimes be withheld. bypass will be seen as an attack. defen= se will occur. what do you want to see happen next? i'd like reliable signalin= g with complete transparency: "you can't do what you're trying on this networ= k." in my estimation, none of the agencies edward snowden warned us about in 20= 13 are going to be transparent about surveillance or filtering, so your fear o= f them using reliable denial signaling as part of negotiation seems misplaced= . but to repeat, what do you want to see happen during administrative denials= ? right now it's unexplained silence and failure. i think that's bad customer service, and i want us to strive for better. if an on-path actor is willing= to tell you what you can't do and why not, and identify themselves, we should = be willing to do the work involved to make that telling possible. -- Paul -- Add mailing list Add@ietf.org https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.iet= f.org%2Fmailman%2Flistinfo%2Fadd&data=3D02%7C01%7CJensen.Thomas%40micro= soft.com%7C4b243c0abce042f2c36208d832c8b641%7C72f988bf86f141af91ab2d7cd011d= b47%7C1%7C0%7C637315184929971483&sdata=3DAXdClv1hufFXgGPdtDXaQ0zoOS%2Bo= QxdEkO5QhHn0YCc%3D&reserved=3D0 --_000_CH2PR00MB07781ECC2DE87168D4E0E0D4FA730CH2PR00MB0778namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
paul> let me state for the record that ted's opposition was to something= i hadn't proposed...

Fair enough.

paul> when DoH is going to be denied, i'd like the node to get an accurate signal
about that, rather than silent failure

<= span style=3D"font-size: 14.6667px;">We agree on this point. My point from = before is that this signal should be 1) not specific to DoH as there are ot= her pre-existing encrypted communication flows which could use this same new mechanism, and 2) authenticated such t= hat a client can strongly determine the signal came from a network administ= rator for the network the client joined as opposed to an on-path attacker. = Based on my point of view, such a mechanism should be designed outside the ADD WG.
<= span style=3D"font-size: 14.6667px;">
<= span style=3D"font-size: 14.6667px;">paul> but to repeat, what do you want to see happen during administrative denials?
right now it's unexplained silence and failure. i think that's bad customer
service, and i want us to strive for better.
<= span style=3D"font-size: 14.6667px;">
<= span style=3D"font-size: 14.6667px;">Before DoH, this was also unexplained = silence and failure. The DNS packets would be dropped and the device would = see no connectivity until the DNS settings were changed by the user. Adding DoH to the mix doesn't change that custom= er support story. Users configuring public resolvers, encrypted or not, wil= l continue to see a lack of Internet connectivity when on a network which b= locks off-network DNS flows, encrypted or not. The only difference is when the traffic is unencrypted, the networ= k can attack the traffic and either 1) resolve the queries itself, or 2) re= turn a false result to send browsers to a page explaining the situation.&nb= sp;
<= span style=3D"font-size: 14.6667px;">
<= span style=3D"font-size: 14.6667px;">Allowing either of those approaches to= also work for DoH or DoT would destroy the value of encrypted communicatio= n as they require the network to be able to speak as if it were the endpoint the client was trying to reach. I= nstead, we would need a network-originating signal referring to the prohibi= ted communication channel. To my knowledge, this doesn't exist with authent= ication to a recognized network authority. This circles back to my point above about needing a larger-than= -DoH-and-ADD-WG mechanism for networks to securely indicate to clients when= their network flows are forbidden.

Thanks,=
Tommy Jensen
=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The latest in Wi= ndows Internet Protocols:
  Native gR= PC support: https://aka.ms/grpcblogpost 
  DNS over = HTTPS: https://aka.ms/dohblogpost=  
From: Add <add-bounces@i= etf.org> on behalf of Paul Vixie <paul@redbarn.org>
Sent: Tuesday, July 28, 2020 12:34 AM
To: add@ietf.org <add@ietf.org>
Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft= -pauly-add-resolver-discovery-01.txt
 
On Tuesday, 28 July 2020 00:44:08 UTC Tommy Jensen= wrote:
> (+1 to ekr's point)
>
> I agree with Ted: we shouldn't go weakening strong end-to-end encrypte= d
> protocols on purpose. From an endpoint's perspective, there is no
> authoritative way to distinguish between network administration ("= ;good")
> and network attacks ("bad") without some prior knowledge and= trust of the
> network, such as preinstalled certificates. ...

since i was nearby when ted's and ekr's comments were made, let me state fo= r
the record that ted's opposition was to something i hadn't proposed, and ma= y
represent a misrestatement on his part, or perhaps a misunderstanding. as <= br> such, ekr's response was nonsequitur through no fault of his own, and i can=
neither confirm nor deny my position with respect to it. i don't want to ge= t
in the way of the great discussion you folks want to have, other than to remind you all, it's actually off-topic from the remarks it quotes from me.=

> ... Arguably, these networks which
> want to tightly control network behavior ought to tightly control netw= ork
> joining capabilities to prevent this perceived misbehavior. ...

when DoH is going to be denied, i'd like the node to get an accurate signal=
about that, rather than silent failure. that's not a political goal, but a =
customer service level goal. since DoH is in fact going to be widely denied= ,
and sometimes that will be by the owner/operator of the network and the nod= e,
this adds a transparency and manageability burden to ADD. if you imagine th= at 
one form of misbehaviour is sudden unexpected unauthorized DoH use as a sid= e
effect of a browser upgrade, then you might reconsider the word "tight= ly".

> ... Otherwise, any
> side door we build for MitM to more readily block/downgrade communicat= ion
> between intended endpoints will be a side door attackers can use as we= ll.

consent will sometimes be withheld. bypass will be seen as an attack. defen= se
will occur. what do you want to see happen next? i'd like reliable signalin= g
with complete transparency: "you can't do what you're trying on this n= etwork."

in my estimation, none of the agencies edward snowden warned us about in 20= 13
are going to be transparent about surveillance or filtering, so your fear o= f
them using reliable denial signaling as part of negotiation seems misplaced= .

but to repeat, what do you want to see happen during administrative denials= ?
right now it's unexplained silence and failure. i think that's bad customer=
service, and i want us to strive for better. if an on-path actor is willing= to
tell you what you can't do and why not, and identify themselves, we should = be
willing to do the work involved to make that telling possible.

--
Paul


--
Add mailing list
Add@ietf.org
https://nam06.s= afelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2Fmailman= %2Flistinfo%2Fadd&amp;data=3D02%7C01%7CJensen.Thomas%40microsoft.com%7C= 4b243c0abce042f2c36208d832c8b641%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0= %7C637315184929971483&amp;sdata=3DAXdClv1hufFXgGPdtDXaQ0zoOS%2BoQxdEkO5= QhHn0YCc%3D&amp;reserved=3D0
--_000_CH2PR00MB07781ECC2DE87168D4E0E0D4FA730CH2PR00MB0778namp_-- From nobody Tue Jul 28 08:17:10 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D470C3A0D87 for ; Tue, 28 Jul 2020 08:17:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VdjUf6Dy-3gD for ; Tue, 28 Jul 2020 08:17:06 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650103.outbound.protection.outlook.com [40.107.65.103]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DEE2E3A0D7F for ; Tue, 28 Jul 2020 08:17:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=R1JSfkLcE5QRZZ66Vi1j8vL2vaZ2SeiNzUOKzAiYSivc71wO51RvWONM0Li7qyNPiXcnRAqnk427Ukg59BeW0/H3thWyjiAFmLi/zS6wBux9r5+pHIePEmxxY6/YClhs8wfOPIXYRvDwkvKF3D5muyfwaCofui/hDHqRm3VyqfCJDpMKr08JxOMsYmfwOtDG+j07zdWW545IXHPKmeOira6ioif0pUhjdbwbbNI2fEGT1XWmx4xUnvUO9dg0p9QtbUYSGtpK4sIFAirrIrBAf4HAU1w41LHH5/RtUDQXfclCd5yQkp6wqPmMZBXHEb3PNJ/maTGKYdPniiXKHmwpEg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BTuBsRlIRBUYAwgqmwPn7X3pG6DFawxrsQPZqmgx+dU=; b=gb0EJhXfeEAITLzIp5V11LcPFkqsS5l1rvtwbGp17fNoKVlyw+yT072GnBKM5cozF+EGQ9CelfrSL+C5HF7y99z0hhR4Seve+JfltOmoJdadSGlP6Jm3oCZ0Frd1nGrGwEg1nZhbY2TgvOccX8AfTpWQn4V/HfJ0XKlkKpNeQ9zVuVz1t8XC+D8iBw+SkKFqOpaxpKt5pFMIbpSq3rLYYaXRT0EbvERH/Je5GIjJwLbIBB1HCfaucX7FXZs4ZCMSnNXidpeBzZvBaCGHoKx47CvUDUh9FKbbOR/69+N7VvuOoStjIJZ06fXk3HgwK0HRpUPX7Mn+ULD1Ufb+qkmHiw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BTuBsRlIRBUYAwgqmwPn7X3pG6DFawxrsQPZqmgx+dU=; b=VLtlZpTB31JttNmQxKaWFngYtm2QxtJ/QsjFw2CoyJ9QYGExT1GoVL4xxqR+qZMCASMf0QHm2Q2p3t8e6CT3Bj0NZrMYzZqwziJZCy22qgQPXlaYJPw6ThPSotTZO7r085VatG/78lReKZq8QmB5YcA+p0BoVk+C1mRQ0wP07NI= Received: from CH2PR00MB0778.namprd00.prod.outlook.com (2603:10b6:610:6c::23) by CH2PR00MB0761.namprd00.prod.outlook.com (2603:10b6:610:68::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3277.0; Tue, 28 Jul 2020 15:17:00 +0000 Received: from CH2PR00MB0778.namprd00.prod.outlook.com ([fe80::c66:75df:7c7:5871]) by CH2PR00MB0778.namprd00.prod.outlook.com ([fe80::c66:75df:7c7:5871%9]) with mapi id 15.20.3276.000; Tue, 28 Jul 2020 15:17:00 +0000 From: Tommy Jensen To: Vittorio Bertola , Ted Lemon , Paul Vixie CC: "add@ietf.org" Thread-Topic: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWZLGV7A1JtnrexkqDcLFH6GVWT6kczXMAgAAO9ICAADwg5A== Date: Tue, 28 Jul 2020 15:17:00 +0000 Message-ID: References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com>, <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> In-Reply-To: <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-28T15:16:59.567Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none;dmarc.ietf.org; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2601:600:a080:aff0:f1cd:f7ba:46d3:252f] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 425aa6e0-e217-451f-9442-08d833094680 x-ms-traffictypediagnostic: CH2PR00MB0761: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: GXMx73pk3rBOuijWxIEM7F92nGzx5ROKMPu6GXw7/HJZ7Yu2gf5fn3QWjLGplny/fBZLO73d0tI+NBsIFK5KdbwhUg1gODTUAvDx0/vI6zQSKquo9jVxxEQfG0oT6dvxIFFh7I1VA3y/5UcPeOlubg0ji1e/UoGkqH2UAPG3/73/UAVBpoRfu84cYEQRcyOwWGXM0Fh+HJ7wXWoSv/Gto1LxJlwN25SFpifGTgVcQCCCyjg3XG35PSX3lYkrKc2IyY3SoOZRMWkGJ9v5Rg6UYN40guStz6/t7MH5Vcg1Gbs+nF9gofLFFJFtaCWoJzEq7qxJ4chBeR9hLNgYjHfreHKYVkQV8x1vtm8CJjDWvPOMwOSUeFTRaybgxI3E2ITRiqT6l4GNnwKckGp7vr0YeQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR00MB0778.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(376002)(39860400002)(346002)(366004)(396003)(136003)(8936002)(4326008)(10290500003)(66446008)(64756008)(8990500004)(8676002)(66476007)(66556008)(71200400001)(66946007)(966005)(478600001)(66574015)(19627405001)(186003)(166002)(7696005)(52536014)(15650500001)(91956017)(316002)(6506007)(9686003)(83380400001)(76116006)(82950400001)(82960400001)(110136005)(86362001)(33656002)(5660300002)(53546011)(2906002)(55016002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: /VEKz7P8hjaeyGaAxNm91Vu78F1LvXW1FW7j2wp+Z1TBYpMk4Y/SvUT2e8fbGQUOhL2esI972F2zQEtpD9Dp294W3XQlMzDnOWj31nX0WNqIdyBg9e1GR/s5IeeVSW/8JJ0/WGOarErYZuVK5D5rj/PF/9MhpPLVYvRpUayEGpZwgUNrrodTKdG0bTA3BX/rvkc/XqJsUs9mPZ34H/jLFtPVIxLT7F3ZOOWdpWS+T4XOJRm0PAKhi2aUQHli8R71hSTRTFGkQP81n3dLgbLlIj2eAzIT6zetuzP2KGUPeuA2i18kzgyojEWhJia4mE4a8zEOkPA+JJJjwlEipKd/R0eKtnUffFrO+5L06kKGU1gxYS9HF1wdTZQ1E2ub7NjHiX+MbXBdvn6GSlNZMGkCuW//aQdkINk9WuB31PHy3vMkvtAB0pJxK4B1wbgbqXKrd5bqmWFl195aUZhauQOkPRbHRUi7pj7+jdlEk/QmSZhBNCGYuDNtSxKR/y1hy4b00DjrNb+V2L0lZTnEEIwFDwvf4dcjuy2V4k6YefZhQqIVus2fu3OOGe+koVU0Z9r5lckBwjM04y6/E8l3ECxAmIlkyCedasCnVH3DmSPnD/pVAzMkBnF+wZ0gHVFDNSuZlqCB82C75OPBLqMRJJBd3bfRxzA8xdwKdZZtu8PtvUR/JotQKv313RcBtsU+kcEBbUfnNb3erDLea5UwXdxADQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CH2PR00MB0778960CD567379A8E43B959FA730CH2PR00MB0778namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: CH2PR00MB0778.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 425aa6e0-e217-451f-9442-08d833094680 X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Jul 2020 15:17:00.2463 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: NYZjd27gBcAqABh3pZRX3zCAxrhQqJSrgBgELKToswkK+MiLDFzNwo2fISGKIDw16ciaIp0jAzE6CVVW5DRwWA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR00MB0761 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 15:17:09 -0000 --_000_CH2PR00MB0778960CD567379A8E43B959FA730CH2PR00MB0778namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable vittorio> On the other hand, refusing to standardize such a mechanism would= be quite a strong policy stance, as it would assume that all networks will= always be adversarial and badly intentioned so there is no use in even lis= tening to what they would like to say. Would it though? Before DoH and DoT, all common DNS clients (loosely define= d as OSes as browsers weren't in the game yet) ignored network recommended = browsers the moment the user provided a public resolver to use instead. Tha= t wasn't treating networks as adversarial; that was because the network rec= ommendation was just that, not a requirement. I don't think it would be a s= trong policy stance for the IETF to not standardize a change to that. To be clear, I'm in favor of providing networks a way to indicate they don'= t want clients using other DNS servers if we can do so securely such that i= t can be differentiated from an attacker. This however would be a new netwo= rk-client contract that IMO should be larger than DNS (See my response to P= aul), and not defining such a mechanism shouldn't be controversial. Clients= can still choose to use network recommended servers if they want just as b= efore. Thanks, Tommy Jensen =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The latest in Windows Internet Protocols: Native gRPC support: https://aka.ms/grpcblogpost DNS over HTTPS: https://aka.ms/dohblogpost ________________________________ From: Add on behalf of Vittorio Bertola Sent: Tuesday, July 28, 2020 4:33 AM To: Ted Lemon ; Paul Vixie Cc: add@ietf.org Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-= add-resolver-discovery-01.txt > Il 28/07/2020 12:39 Ted Lemon ha scritto: > > > > On Jul 28, 2020, at 03:34, Paul Vixie wrote: > > in my estimation, none of the agencies edward snowden warned us about i= n 2013 > > are going to be transparent about surveillance or filtering, so your fe= ar of > > them using reliable denial signaling as part of negotiation seems mispl= aced. > > That=92s not the concern. The concern is that if DoH traffic is labeled s= pecifically so that the network can identify it, it will be blocked, Why? There will be networks that want to block DoH, and there will be others tha= t don't, and there will be others that will say that you can have DoH but o= nly if you use the local resolver, or if you use a resolver from a specific= list, or will suggest you a local resolver but then accept a different cho= ice. Then, there will be clients (both on behalf of the user, i.e. anonymizing b= rowsers, and against the user, i.e. malware) that will want to ignore that = policy if they dislike it, and do something else - and there will be networ= ks that will then react by doing all sorts of bad things to traffic from th= ose clients. We cannot do much in the case when clients (users) and networks (network pr= oviders) disagree, and that case will always exist, but there is a number o= f use cases (hopefully most of them) in which users and network providers w= ill cooperate to find a mutually acceptable configuration. What we should d= evelop is a way for the client to discover the local DoH resolver's locatio= n and the network policy attached to it, so that the above agreement become= s possible in those cases. What the client does with that information, and = whether the client chooses to abide by or defy the local policy, will then = be a choice for the developers of each client (and for their lawyers and po= licy officers, I suspect, but that's another discussion). On the other hand, refusing to standardize such a mechanism would be quite = a strong policy stance, as it would assume that all networks will always be= adversarial and badly intentioned so there is no use in even listening to = what they would like to say. I don't think that the IETF should go down tha= t path. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy -- Add mailing list Add@ietf.org https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.iet= f.org%2Fmailman%2Flistinfo%2Fadd&data=3D02%7C01%7CJensen.Thomas%40micro= soft.com%7C809c524d03914d578d3608d832ea2101%7C72f988bf86f141af91ab2d7cd011d= b47%7C1%7C0%7C637315328442891611&sdata=3DI6BdZuOvjKIrHdy6WqjA0hgcu9AYjq= yLCy9yRnhqJkU%3D&reserved=3D0 --_000_CH2PR00MB0778960CD567379A8E43B959FA730CH2PR00MB0778namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
vittorio> On the other hand, refusing to standardize such a mechanism would be quite a = strong policy stance, as it would assume that all networks will always be a= dversarial and badly intentioned so there is no use in even listening to wh= at they would like to say.

<= span style=3D"font-size: 14.6667px;">Would it though? Before DoH and DoT, a= ll common DNS clients (loosely defined as OSes as browsers weren't in the g= ame yet) ignored network recommended browsers the moment the user provided a public resolver to use instead. Th= at wasn't treating networks as adversarial; that was because the network re= commendation was just that, not a requirement. I don't think it would be a = strong policy stance for the IETF to not standardize a change to that. 
<= span style=3D"font-size: 14.6667px;">
<= span style=3D"font-size: 14.6667px;">To be clear, I'm in favor of providing= networks a way to indicate they don't want clients using other DNS servers= if we can do so securely such that it can be differentiated from an attacker. This however would be a new net= work-client contract that IMO should be larger than DNS (See my response to= Paul), and not defining such a mechanism shouldn't be controversial. Clien= ts can still choose to use network recommended servers if they want just as before.

Thanks,=
Tommy Jensen
=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The latest in Wi= ndows Internet Protocols:
  Native gR= PC support: https://aka.ms/grpcblogpost 
  DNS over = HTTPS: https://aka.ms/dohblogpost=  

From: Add = <add-bounces@ietf.org> on behalf of Vittorio Bertola <vittorio.ber= tola=3D40open-xchange.com@dmarc.ietf.org>
Sent: Tuesday, July 28, 2020 4:33 AM
To: Ted Lemon <mellon@fugue.com>; Paul Vixie <paul@redbarn.= org>
Cc: add@ietf.org <add@ietf.org>
Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft= -pauly-add-resolver-discovery-01.txt
 


> Il 28/07/2020 12:39 Ted Lemon <mellon@fugue.com> ha scritto:
>
> 
> > On Jul 28, 2020, at 03:34, Paul Vixie <paul@redbarn.org> wr= ote:
> > in my estimation, none of the agencies edward snowden warned us a= bout in 2013
> > are going to be transparent about surveillance or filtering, so y= our fear of
> > them using reliable denial signaling as part of negotiation seems= misplaced.
>
> That=92s not the concern. The concern is that if DoH traffic is labele= d specifically so that the network can identify it, it will be blocked,

Why?

There will be networks that want to block DoH, and there will be others tha= t don't, and there will be others that will say that you can have DoH but o= nly if you use the local resolver, or if you use a resolver from a specific= list, or will suggest you a local resolver but then accept a different choice.

Then, there will be clients (both on behalf of the user, i.e. anonymizing b= rowsers, and against the user, i.e. malware) that will want to ignore that = policy if they dislike it, and do something else - and there will be networ= ks that will then react by doing all sorts of bad things to traffic from those clients.

We cannot do much in the case when clients (users) and networks (network pr= oviders) disagree, and that case will always exist, but there is a number o= f use cases (hopefully most of them) in which users and network providers w= ill cooperate to find a mutually acceptable configuration. What we should develop is a way for the client t= o discover the local DoH resolver's location and the network policy attache= d to it, so that the above agreement becomes possible in those cases. What = the client does with that information, and whether the client chooses to abide by or defy the local policy, will = then be a choice for the developers of each client (and for their lawyers a= nd policy officers, I suspect, but that's another discussion).

On the other hand, refusing to standardize such a mechanism would be quite = a strong policy stance, as it would assume that all networks will always be= adversarial and badly intentioned so there is no use in even listening to = what they would like to say. I don't think that the IETF should go down that path.

--
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com
Office @ Via Treviso 12, 10144 Torino, Italy

--
Add mailing list
Add@ietf.org
https://nam06.saf= elinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2Fmailman%2= Flistinfo%2Fadd&amp;data=3D02%7C01%7CJensen.Thomas%40microsoft.com%7C80= 9c524d03914d578d3608d832ea2101%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7= C637315328442891611&amp;sdata=3DI6BdZuOvjKIrHdy6WqjA0hgcu9AYjqyLCy9yRnh= qJkU%3D&amp;reserved=3D0
--_000_CH2PR00MB0778960CD567379A8E43B959FA730CH2PR00MB0778namp_-- From nobody Tue Jul 28 08:24:38 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A53353A0D4E for ; Tue, 28 Jul 2020 08:24:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q0NQ_IR7v_XU for ; Tue, 28 Jul 2020 08:24:33 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40F983A0AE3 for ; Tue, 28 Jul 2020 08:24:32 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 5842C280607; Tue, 28 Jul 2020 17:24:31 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id 50C7B2806AB; Tue, 28 Jul 2020 17:24:31 +0200 (CEST) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id 4903F280607; Tue, 28 Jul 2020 17:24:31 +0200 (CEST) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 4503F642C582; Tue, 28 Jul 2020 17:24:31 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id 32DD73FFD8; Tue, 28 Jul 2020 17:24:31 +0200 (CEST) Date: Tue, 28 Jul 2020 17:24:31 +0200 From: Stephane Bortzmeyer To: Tommy Jensen Cc: Vittorio Bertola , Ted Lemon , Paul Vixie , "add@ietf.org" Message-ID: <20200728152431.GA8117@nic.fr> References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.067530, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 15:24:37 -0000 On Tue, Jul 28, 2020 at 03:17:00PM +0000, Tommy Jensen wrote a message of 310 lines which said: > To be clear, I'm in favor of providing networks a way to indicate > they don't want clients using other DNS servers if we can do so > securely such that it can be differentiated from an attacker. This > however would be a new network-client contract that IMO should be > larger than DNS And it seems a job for PvD (draft-ietf-intarea-provisioning-domains). From nobody Tue Jul 28 08:46:58 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD4F23A0DF7 for ; Tue, 28 Jul 2020 08:46:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M9HGiuRqNbQa for ; Tue, 28 Jul 2020 08:46:55 -0700 (PDT) Received: from mail-qk1-x72f.google.com (mail-qk1-x72f.google.com [IPv6:2607:f8b0:4864:20::72f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D57E83A0DDD for ; Tue, 28 Jul 2020 08:46:54 -0700 (PDT) Received: by mail-qk1-x72f.google.com with SMTP id 2so14961605qkf.10 for ; Tue, 28 Jul 2020 08:46:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=yvnM1DFm2YxcXyL6P+172+4XErZJd0DePAsZOCZ82V0=; b=Ux/tcszW452Sh/acXoBz9GgHSwYVLwM+8CYZG7pIfmmT8EJUrfSXHfj8sr4MX1FKul +S4eoCzzsPZr/Q1dh+Z/CScCp644whmVvD6DanSRcXxBF/9SCU2W1borgl5K/roYPyX4 s0uQis3JbSNQInM5XgK50yS/XC5NmmhM28WbItdudMiOjvHHB1PsP7OB+2Upg+yC4PnA QUXaRwpqNEjwtzWFN+rnZFBFNUXI8VMI1iib9kF2IT+gYMLjJfpT2Dt+j7MiAXIUYWGM SNAZzTsVhRPACrCioSsAQtUkZJt9fXkyldKj3HByLuzvDVJLxcNztwfjGDAGqQKqsz0J 5xFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=yvnM1DFm2YxcXyL6P+172+4XErZJd0DePAsZOCZ82V0=; b=pCONOClm95lJB61gVuyKanDEkAQAHtFqkf4/+xJ1zJ58kQIxjMjTQ6w7aBCFwTRq5W P+KzGxddkgKOG/ADL1xBp68bo8zmsqkGwY2iMl9QVk4XDa/Dot3LOZek9vvNixgCVgVn nqqLwA57t8i1GGhxrI3sc8NcPJIGPvQjO+nsV53RjuznbSohy6Zqa/41wuT5jbRXcIBJ IVIdyOuJsVtkkMYo2DhzmO5ktckg03fAjH0uyeMxe9Ir0RlTvIPiEpmzFZIg1qaNZUlM kf5gQvD7lidMRsXps+40EcPooNznk2iTxEhjgrZj4nveJQqmkM/VFr9O0UknfOlFmCsP CSVg== X-Gm-Message-State: AOAM531OCxz4KklrNo7nvpckUtSZly1NEpFKWKF81352cyIiM4mQ01Mi DRlav5jpnB1m7/vPf+5QmAYXuQ== X-Google-Smtp-Source: ABdhPJyhBvWlkD877T5Gp6NtD9Yp8QkZEFsH1LU/FM3WW3KOiQJnmnFBl+2FwnNZZ0pfCom88aOUyA== X-Received: by 2002:a37:7741:: with SMTP id s62mr25743228qkc.263.1595951213798; Tue, 28 Jul 2020 08:46:53 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:ddf1:72ea:9d69:1b4a? ([2601:18b:300:36ee:ddf1:72ea:9d69:1b4a]) by smtp.gmail.com with ESMTPSA id q2sm7426392qtl.64.2020.07.28.08.46.53 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 28 Jul 2020 08:46:53 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_2291E6B6-0FE8-48BB-8C52-3F4C6760A5CE" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) From: Ted Lemon X-Priority: 3 In-Reply-To: <606980496.3510.1595946668260@appsuite-gw2.open-xchange.com> Date: Tue, 28 Jul 2020 11:46:51 -0400 Cc: add@ietf.org Message-Id: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> <20200728134948.GA24673@nic.fr> <45F2A448-4248-4C14-AA0B-ECBB34FF3AE4@fugue.com> <606980496.3510.1595946668260@appsuite-gw2.open-xchange.com> To: Vittorio Bertola X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 15:46:57 -0000 --Apple-Mail=_2291E6B6-0FE8-48BB-8C52-3F4C6760A5CE Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 28, 2020, at 10:31 AM, Vittorio Bertola = wrote: > Of course that requires some security considerations and validation = before use, but if you assume that you cannot trust the (https) URL = indicated in the EDNS response, then you cannot trust the response = itself I think that=E2=80=99s what I said, yet. > and its indication that the domain was blocked for whatever reason, = and possibly you cannot trust any DNS response whatsoever. In any case, = it might be that clients will only use that information if it is = received over an authenticated channel (e.g. via DoH). If I try to establish a TLS connection and get a TLS alert that says = =E2=80=9CTLS is blocked except when you allow me to MiTM your TLS = connection,=E2=80=9D then I know that I can=E2=80=99t use the network = without installing the TLS cert I need to successfully be MiTM=E2=80=99d. = This is perfectly fine, sort of. However, if the next thing that pops up is a web page explaining how to = install the TLS cert, with a download link, then that=E2=80=99s not = fine, because a naive end user will just follow the instructions. This = is a situation where giving you, the well-intentioned network operator, = an opportunity to explain yourself creates an attack surface that will = be exploited by malware. This is why browsers are moving toward not even telling you how to = bypass =E2=80=9Cself-signed cert=E2=80=9D warnings. It=E2=80=99s just = not safe to tell the end user how to do that. If they need to do that, = either they know how to do it, or the legitimate operator of their = network knows how. --Apple-Mail=_2291E6B6-0FE8-48BB-8C52-3F4C6760A5CE Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 28, 2020, at 10:31 AM, Vittorio Bertola <vittorio.bertola@open-xchange.com> = wrote:
Of course that requires some = security considerations and validation before use, but if you assume = that you cannot trust the (https) URL indicated in the EDNS response, = then you cannot trust the response = itself

I think = that=E2=80=99s what I said, yet.

and its indication that the domain was blocked for whatever = reason, and possibly you cannot trust any DNS response whatsoever. In = any case, it might be that clients will only use that information if it = is received over an authenticated channel (e.g. via = DoH).

If I = try to establish a TLS connection and get a TLS alert that says =E2=80=9CT= LS is blocked except when you allow me to MiTM your TLS connection,=E2=80=9D= then I know that I can=E2=80=99t use the network without installing the = TLS cert I need to successfully be MiTM=E2=80=99d. This is perfectly = fine, sort of.

However, if the next thing that pops up is a web page = explaining how to install the TLS cert, with a download link, then = that=E2=80=99s not fine, because a naive end user will just follow the = instructions. This is a situation where giving you, the well-intentioned = network operator, an opportunity to explain yourself creates an attack = surface that will be exploited by malware.

This is why browsers are moving toward = not even telling you how to bypass =E2=80=9Cself-signed cert=E2=80=9D = warnings. It=E2=80=99s just not safe to tell the end user how to do = that. If they need to do that, either they know how to do it, or the = legitimate operator of their network knows how.

= --Apple-Mail=_2291E6B6-0FE8-48BB-8C52-3F4C6760A5CE-- From nobody Tue Jul 28 09:02:08 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C52E3A0E36 for ; Tue, 28 Jul 2020 09:02:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9RYu3vbsrpXf for ; Tue, 28 Jul 2020 09:02:05 -0700 (PDT) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 29D773A0E1C for ; Tue, 28 Jul 2020 09:02:05 -0700 (PDT) Received: by mail-io1-xd2a.google.com with SMTP id l17so21283695iok.7 for ; Tue, 28 Jul 2020 09:02:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9O5AxvPWca5UrYfP8uYocDRQLYri5LlztlzXci4q5+M=; b=BJUoVfUiaLnBClKeAoa/7WApIIcufVkyh+dG13kkiGHfWhs/B3VG3U3BklDBfCyPxT JuembhkcHqS4v9YDUiUyjciqGT2NmFFreJfClgDmzqbNr9WPCJseLEJWc42wXmYirALk EeHLLHoSuYQzPsPeMiKZkdpGNTry6fUYq6q0R7pzDe18VNTU+YFJoBNDQlYwavj/O6Rz NosO7zAzrDWJI3br2yUPrqUKVnI72X8pUaDJuYO7PLynDm7NZApnxzqG/t4QuKhtiBHu 4Bf5ORslksIpEL57SCyQVh5QxHgG4sIqRJzRmmVZ7EfqBDbRJ1yndMFw0BqSIrTvYQH/ 5X3A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9O5AxvPWca5UrYfP8uYocDRQLYri5LlztlzXci4q5+M=; b=ojhi6mf/e7ASjO9Op4W5N7VCn9VzIlX6UW5Sar+6iLJLm6ihRFeHjrA1Y7Ly5SP1sd JtNSHIhhAa09WH6nhmHaz7bvB+RDIh650JmPPsw08vlz9Rzwx/ilAbalU/pdNUrEQkAq 6zNR7ubwqDHrOmM5oltoszBbkmZYMSKrMKiyh+C/VEivjG1NaUfeY1LxDCnEx/fVeBXF JJI5PKqn6Xxnu9niNDVzuxlihZwhxTHShSAcpSsWWQR/E/teNVYH/DMuYCdsjG0uTMrS ztRYFKf0AlhOMWzQ1RVYMC6aPdPpa1EkQwax39MaqHQN8QgTFa4/QYyfncak+FAmD+vm SPcA== X-Gm-Message-State: AOAM531a6LZcpa75XN+OFcyV54fM4VBuicE/ODQ8J1LYotH1okEmTQAY 83l7VgyBcikIKOLyQrj7pjfPtBqGWOMWAt3csqY= X-Google-Smtp-Source: ABdhPJxjFj5UI7d8sLgWDqJ4culcXrCsnfLcE7RUx01c+fZCh2cPF2+0qKj0iNmKWxMRh1rPN8yS6GFWy0uan3AGUXg= X-Received: by 2002:a02:5b83:: with SMTP id g125mr33513232jab.91.1595952124387; Tue, 28 Jul 2020 09:02:04 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <20200728152431.GA8117@nic.fr> In-Reply-To: <20200728152431.GA8117@nic.fr> From: tirumal reddy Date: Tue, 28 Jul 2020 16:01:52 +0000 Message-ID: To: Stephane Bortzmeyer Cc: Tommy Jensen , Paul Vixie , "add@ietf.org" , Ted Lemon , Vittorio Bertola Content-Type: multipart/alternative; boundary="00000000000073e3c505ab828fbd" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 16:02:07 -0000 --00000000000073e3c505ab828fbd Content-Type: text/plain; charset="UTF-8" On Tue, 28 Jul 2020 at 15:24, Stephane Bortzmeyer wrote: > On Tue, Jul 28, 2020 at 03:17:00PM +0000, > Tommy Jensen wrote > a message of 310 lines which said: > > > To be clear, I'm in favor of providing networks a way to indicate > > they don't want clients using other DNS servers if we can do so > > securely such that it can be differentiated from an attacker. This > > however would be a new network-client contract that IMO should be > > larger than DNS > > And it seems a job for PvD (draft-ietf-intarea-provisioning-domains). > The above draft is using RA to learn the PVD ID FQDN and cannot identify if the information is indeed provided by the network or by an attacker. You may want to look into the Security Considerations section in the draft. -Tiru --00000000000073e3c505ab828fbd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, 28 Jul 2020 at 15:24, Stephane Bo= rtzmeyer <bortzmeyer@nic.fr>= wrote:
On Tue, Jul 28, 2020 at 03:17:00PM +0000,
=C2=A0Tommy Jensen <Jensen.Thomas=3D40microsoft.com@dmarc.ietf.org> wrot= e
=C2=A0a message of 310 lines which said:

> To be clear, I'm in favor of providing networks a way to indicate<= br> > they don't want clients using other DNS servers if we can do so > securely such that it can be differentiated from an attacker. This
> however would be a new network-client contract that IMO should be
> larger than DNS

And it seems a job for PvD (draft-ietf-intarea-provisioning-domains).

The above draft is using RA to learn the PVD= ID FQDN and cannot identify if the information is indeed provided by the n= etwork or by an attacker. You may want to look into the Security Considerat= ions section in the draft.

-Tiru
--00000000000073e3c505ab828fbd-- From nobody Tue Jul 28 09:24:56 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7609B3A0C8A for ; Tue, 28 Jul 2020 09:24:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f8QreMuUUOLO for ; Tue, 28 Jul 2020 09:24:52 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id C991C3A0C3E for ; Tue, 28 Jul 2020 09:24:51 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id E16B45F408D9; Tue, 28 Jul 2020 16:24:49 +0000 (UTC) Received: from [172.19.189.219] (p54b8acc8.dip0.t-ipconnect.de [84.184.172.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 772FF5F40389; Tue, 28 Jul 2020 16:24:49 +0000 (UTC) From: "Ralf Weber" To: "Stephane Bortzmeyer" Cc: "ADD Mailing list" Date: Tue, 28 Jul 2020 18:24:48 +0200 X-Mailer: MailMate (1.13.1r5671) Message-ID: <85941A09-AD64-4E7A-8BAC-3EFFCC257481@fl1ger.de> In-Reply-To: <20200728135547.GC24673@nic.fr> References: <660302C3-0EA4-44C3-9C9E-30E9697E843A@fl1ger.de> <20200728135547.GC24673@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] Current add drafts X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 16:24:55 -0000 Moin! On 28 Jul 2020, at 15:55, Stephane Bortzmeyer wrote: >> I read all the documents that are add related as per data tracker >> and some others > > There are also documents that are not specifically ADD but partly > overlaps, and sometimes make, IMHO, the ADD draft irrelevant (such as > ADoT vs. DRDP). There are a lot of overlaps between add, dnsop and dprive at the moment. I just picked what I though was applicable. >> 3. The third category is “just put it in the DNS”: > > Not "In the DNS" but "retrieved through the DNS". It is not the same > thing since it goes through the resolver you want to know about, not > in the public DNS. Agreed retrieved through the DNS describes better what these drafts do. So long -Ralf —-- Ralf Weber From nobody Tue Jul 28 09:34:58 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D5F03A0DC4 for ; Tue, 28 Jul 2020 09:34:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.62 X-Spam-Level: X-Spam-Status: No, score=-9.62 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=AG53yTXJ; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=cisco.onmicrosoft.com header.b=YnxLUqtn Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DnnjCeCC_kf9 for ; Tue, 28 Jul 2020 09:34:33 -0700 (PDT) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E42D63A0CEC for ; Tue, 28 Jul 2020 09:34:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=13968; q=dns/txt; s=iport; t=1595954072; x=1597163672; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=KQ8ks8BqyeBSIB5MChXT2ZRxIFPSKFoD/Bty5ZF4EfM=; b=AG53yTXJJx7ST7GtUeXpapIaKqYIU4HL0LhTe7UIi3jlxH7459KE8sjy //GUIxu0xxfM1XFs0u7y/ObVKw0fIilNKfXD8I951jYH9a+Bbae8bvx+b 4/qqwvqEIfAbglYKVKynaAevFO+QxqrD1qdObpdtnlD1C0ULpYPhIWNFA 8=; X-Files: smime.p7s : 3980 IronPort-PHdr: =?us-ascii?q?9a23=3ABbCf5Rf+GBK8foMrYAbcue2WlGMj4e+mNxMJ6p?= =?us-ascii?q?chl7NFe7ii+JKnJkHE+PFxlwaTAdfX7vtegKzXvrzuH2sa7sXJvHMDdclKUB?= =?us-ascii?q?kIwYUTkhc7CcGIQUv8MLbxbiM8EcgDMT0t/3yyPUVPXsqrYVrUry6+6DcIEV?= =?us-ascii?q?P+OBZ7YOPvFd2ag8G+zevn/ZrVbk1Bjya8ZrUnKhKwoE3Ru8AajJEkJLw2z0?= =?us-ascii?q?7Co2BDfKJdwmY7KA=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CVBQCiUiBf/40NJK1gHAEBAQEBAQc?= =?us-ascii?q?BARIBAQQEAQGCCoEjL1EHbystLywKhCqDRgONVpN1hGyCUwNVBAcBAQEJAwE?= =?us-ascii?q?BLQIEAQGETAKCIAIkOBMCAwEBCwEBBQEBAQIBBgRthVwMhXEBAQEDARIRChM?= =?us-ascii?q?BATUCAQQLAgEIEC8DAgICMBQRAgQOBQgGDQeDBYF+TQMOEQ8BpDwCgTmIYXa?= =?us-ascii?q?BMoMBAQEFhS8YggcHCYE4gVOBGoNZhjcagUE/gVSCTT6CXASBXwUHLIJcM4I?= =?us-ascii?q?tkmaiDIEFCoJfhDWCWJMEn2mxMQIEAgQFAg4BAQWBaiOBV3AVgyRQFwINjh4?= =?us-ascii?q?MBRIUgzqKVnQCATQCBgEHAQEDCXyOawGBEAEB?= X-IronPort-AV: E=Sophos;i="5.75,406,1589241600"; d="p7s'?scan'208,217";a="795203262" Received: from alln-core-8.cisco.com ([173.36.13.141]) by rcdn-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 28 Jul 2020 16:34:31 +0000 Received: from XCH-ALN-004.cisco.com (xch-aln-004.cisco.com [173.36.7.14]) by alln-core-8.cisco.com (8.15.2/8.15.2) with ESMTPS id 06SGYVfT015429 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 28 Jul 2020 16:34:31 GMT Received: from xhs-rcd-002.cisco.com (173.37.227.247) by XCH-ALN-004.cisco.com (173.36.7.14) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 28 Jul 2020 11:34:31 -0500 Received: from xhs-rcd-003.cisco.com (173.37.227.248) by xhs-rcd-002.cisco.com (173.37.227.247) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 28 Jul 2020 11:34:30 -0500 Received: from NAM11-CO1-obe.outbound.protection.outlook.com (72.163.14.9) by xhs-rcd-003.cisco.com (173.37.227.248) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Tue, 28 Jul 2020 11:34:30 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=WaMX+PjlEEVy29RhQq7dDFN1d/+9Nx9eAhXaTFvDbTefBEid6trVtgsYS7jBch2mxZOjIqMuz5XXSJd4V78EGkZepIYKAmLTGTS+x8Hnu+stVInKLT9XNof9cRZKv+9aSmGXRdMtDnaUfhc/Xba88HvHs0gxlIY+btOdYNXGgeEy2j498WqLQAnzS+7st9F7izXtxBkrTzVEsZYFiY15SYK/YveVpJGMJqVQE7pS0v0KcrZv7lyciE59jc/8xiIuOkwQ4oz90wKN0Ts+iT7rDFGgY78HTK8+NqTXnJPxV9uPEF2EupCJlNkKO+DlyTI/4897AqHh3nD7jg8XH/lv4w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=byTl81dqKXEUAdNYJSfvhu9cFwcjf6yRLO0/OTkapHc=; b=oSIVdvsF78ZJG/O0Hvda5LdQnqwIYblmSQ1tg472mHsPyFDeCkMW1mrYLP/0ACc1R0Ck8p0KHHIGC++ZT/WvzpFRT+h/cFwEeAqzW6wg5h4jsiq/YNiYQqrckF5MujxGDoTFSRrlC0g7ubUvkIG2+2xSBPJim0RLlnTstyRfvWkSlpmSi83IMwq68Hibfp8DnOg+9J1Qnf5fAO1972gY0vWYo56L2LOX9XkyY3DVHNGSp4ZO/pKG2U9KwtTKk9LdZE5NB0AR4cV8l+kqxqxmJp7RtPNqfg5wrPJRBvyiB6XlBARFGwlJ8/01dq7EJX+/34rmkll6zxXJB3Pr+quK4Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=byTl81dqKXEUAdNYJSfvhu9cFwcjf6yRLO0/OTkapHc=; b=YnxLUqtnBEc4YnRFMMqqnjblf4xgXQ6UhhTXjK0YromXGe4EL+ttkHIq7wBmL2ekqJL7ZRniQEiEBHhA0g7XmwdR+GifmJfRGX1LBqvVHS1JQB8K6uF3WsnteJNvDvuJkoCvAPbnIim8bRWCSB4wicUW+yVR9lek6cUgqG8SWXE= Received: from MN2PR11MB4760.namprd11.prod.outlook.com (2603:10b6:208:266::22) by BL0PR11MB3075.namprd11.prod.outlook.com (2603:10b6:208:7a::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3239.16; Tue, 28 Jul 2020 16:34:29 +0000 Received: from MN2PR11MB4760.namprd11.prod.outlook.com ([fe80::cb0:4953:d19f:b3de]) by MN2PR11MB4760.namprd11.prod.outlook.com ([fe80::cb0:4953:d19f:b3de%2]) with mapi id 15.20.3216.033; Tue, 28 Jul 2020 16:34:29 +0000 From: "Vinny Parla (vparla)" To: Tommy Jensen CC: "add@ietf.org" Thread-Topic: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWZHgzITQgJmkjVku4nIatMD/VAqkcmhOAgAAz0wCAAA70gIAAPn0AgAACGYCAAApwAIAABYoA Date: Tue, 28 Jul 2020 16:34:29 +0000 Message-ID: References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <20200728152431.GA8117@nic.fr> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none;dmarc.ietf.org; dmarc=none action=none header.from=cisco.com; x-originating-ip: [98.217.108.128] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 7da2b152-62ce-4743-5384-08d833141968 x-ms-traffictypediagnostic: BL0PR11MB3075: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: sKV/jDJxUbz/lOrvtUVa5OnkZAPvVgkhPdICNvfOF93XIsPhTGDtOBMut/vcWrctWQoG8BdNPu8LxO42ZJadvvjrRy+1RKNdDpfNBjkSGPxMedJIYZ88QDHLNgveU3YKm77I13ETIekKCSrs6A2eNvx9LGd7qcm+/17WmH1Jw/xA5AHyuZ7VmZogbznzHBaS0ast7yMTDdPY3VBOQt+9tayAwD6KPBiPI4yS8GGx6SBmIq2cAqF0A+dbqqV17Qu/+TNVQMwLaDeaKcLpC1CLStuP7b5oi6Inh/UucVNC+u0oHTWf1dKITWrBBgScXrM+Zoah2XuMUeQkN9FUrioEXA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MN2PR11MB4760.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(136003)(396003)(39860400002)(366004)(376002)(52536014)(64756008)(33656002)(66946007)(66476007)(66556008)(66446008)(99936003)(478600001)(5660300002)(66616009)(2906002)(86362001)(71200400001)(186003)(4326008)(8676002)(8936002)(9686003)(6506007)(55016002)(26005)(83380400001)(15650500001)(316002)(76116006)(7696005); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: +AZsNsxSlEStmZzQHhl512zbXiiTz7HjV3aQOEQ5fTwSBo1djl/2zLAXu+O4a6k5QLKNFuk8y7SlGwOBUutODQtqzozgA01qOlEeFaYZhTVNQFT1x1yoFeQk0LK0lexaTpdxC6Olls2V46dh5/4/IIqNIvYPqWH9PG5njEAH6J4HoYemBnNAqefXhUlPwKylQukcBNgEqyID6vk9cGGucRs1Bvd/WoScO5EbcZouZjI9N8muXr/3GUdAa56Qpv7G5bK/J8ox0JLjV+JPi4IsEHSjBTRTLbYUqNcbHC42TBbufSREKT1FC2c8UOl6+LeEMIegkUdvU2GflkVzfnVRONNYBsMNt8tzjPHieA9IzUtC3hOoEeSJ87c6oAYdIK9FMnNocey/YJ7j2m5fQ4qiu4U5V2qtVaI20+wYj4WPX5xrZJ7WZaqXW/kIkap7L1slj8G/IfmaZs/yxx5dxo2gm7LzXQUvT4ZRirBKPn2c489QuXXP5/XFyltoHqGlIc3GXOSPiL8Y98W4RrAx4jRtnSyyCQHPyQ6/VwEwJv1O4QN8IX/2zCMRhHy87x1o+r42t11V4K2dMfOCCeb+BPBRi1sh2a7dHHjXWzAE34B9+xm8mxbW4WTIRXaKOGWEQoiiVecQdmNaKa6x+WSp7aWH3Q== x-ms-exchange-transport-forked: True Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_0137_01D664DB.6EA57180" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MN2PR11MB4760.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7da2b152-62ce-4743-5384-08d833141968 X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Jul 2020 16:34:29.0679 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Mn1jf4QTZwE5ggcFI2S0zPzyOwqcU314vqfDBzpkEzWELasyej1mJPH3xWq3LGNwp09hnUDGmWzUn5FEsVeSYA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR11MB3075 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.14, xch-aln-004.cisco.com X-Outbound-Node: alln-core-8.cisco.com Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 16:34:57 -0000 ------=_NextPart_000_0137_01D664DB.6EA57180 Content-Type: multipart/alternative; boundary="----=_NextPart_001_0138_01D664DB.6EA57180" ------=_NextPart_001_0138_01D664DB.6EA57180 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable On Tue, Jul 28, 2020 at 03:17:00PM +0000, Tommy Jensen > wrote=20 a message of 310 lines which said: > a new network-client contract that IMO should be > larger than DNS =20 +1 =20 I describe this very problem on LI in terms of your classic Enterprise = (both VPN and on-prem use cases). =20 * Enterprise Network operators are not Endpoint Device Managers. They = often have no control over a device or minimal controls. * Enterprise Network operators view Endpoints as risks. * Endpoints view Networks as risks. * Enterprise Network operators will block things at a Network layer that = they can=E2=80=99t control / manage. It is just how it is.=20 For example, It is not uncommon for an Enterprise policy to block social = networks, tor, etc. A 3rd party cloud DNS resolver would not be treated = differently imho. =20 Any solution proposed has to allow discovery to be trusted and for the = Enterprise Network operator to enforce policies. =20 If the two entities (network-client) can=E2=80=99t agree, then some way = of usefully expressing that to the user needs to be considered. =20 Maybe this is at the time a network is joined (hence advertising = capabilities via DHCP / RA might be a logical path ). =20 All of this might be outside the scope of ADD =E2=80=93 but it still = needs to be solved.=20 ------=_NextPart_001_0138_01D664DB.6EA57180 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

On Tue, = Jul 28, 2020 at 03:17:00PM +0000,
 Tommy Jensen = <Jensen.Thomas=3D40microsoft.com@dmarc.ietf.org> wrote =
 a message of 310 lines which said:

> a new network-client = contract that IMO should be
> larger than = DNS

 

+1

 

I describe = this very problem on LI in terms of your classic Enterprise (both VPN = and on-prem use cases).

 

  • Enterprise Network = operators are not Endpoint Device Managers.=C2=A0 They often have no = control over a device or minimal controls.
  • Enterprise Network operators view Endpoints as = risks.
  • Endpoints view = Networks as risks.
  • Enterprise Network = operators will block things at a Network layer that they can=E2=80=99t = control / manage.=C2=A0 It is just how it is.
    For example, It is not = uncommon for an Enterprise policy to block social networks, tor, etc. = =C2=A0A 3rd party cloud DNS resolver would not be treated = =C2=A0differently imho.

 

Any solution proposed has to allow discovery to = be trusted and for the Enterprise Network operator to enforce = policies.=C2=A0

If the two = entities (network-client) can=E2=80=99t agree, then some way of usefully = expressing that to the user needs to be considered.=C2=A0 =

Maybe this is at the time a = network is joined (hence advertising capabilities via DHCP / RA might be = a logical path ).

 

All of this might be outside the scope of ADD = =E2=80=93 but it still needs to be solved. =

------=_NextPart_001_0138_01D664DB.6EA57180-- ------=_NextPart_000_0137_01D664DB.6EA57180 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMXjCCA0Mw ggIroAMCAQICEF/4eygrVNyNQqMVtWjJrf8wDQYJKoZIhvcNAQEFBQAwNTEWMBQGA1UEChMNQ2lz Y28gU3lzdGVtczEbMBkGA1UEAxMSQ2lzY28gUm9vdCBDQSAyMDQ4MB4XDTA0MDUxNDIwMTcxMloX DTI5MDUxNDIwMjU0MlowNTEWMBQGA1UEChMNQ2lzY28gU3lzdGVtczEbMBkGA1UEAxMSQ2lzY28g Um9vdCBDQSAyMDQ4MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAsJq5q6evCnen4nG2 tGZilHiIR8ZiVYRAMr/Aqy6lHHHWvG57qKq6btIViEhFnaL8g9DMuYzgJmhwSnjfIRee9GEFyRXI zxbaNWGJlEOohKgxmHibuU5vLFMSbM0drSskuzHEK/+DRG+2PSR3Ceq/Kqgfalb2IA8RVJeBdacl zllqgmXvt+rn4o11i27y3U+mXmKczxAKZNBObc4rzFv1YKUnR41p9H/OG3DecBsg1m7NpgGoPBLS qT+ga167jiCLepHjtWjuoOfEAXSoUwsrSpoPZRIOgk2OY/3v65sa21OmE2Cvwn3Xx2wXJdRz+0dk UIGAlEzhv65LHN+S7S4F3wIBA6NRME8wCwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYD VR0OBBYEFCfzyBUebpoCCRatK6CJYF/aey+qMBAGCSsGAQQBgjcVAQQDAgEAMA0GCSqGSIb3DQEB BQUAA4IBAQCdnYSEo0GpfHcMt1PKTkRQYu9UfNN1Fxzo4MZIS7b+TDoZgVawVu4ZlmKqWqNkwfZO VDPGd/7FHLrlXSXK9fCTmoMRLubL+HRF/ucFuKvn38tL4TeE2rmLl3Ae8OKL17DYDp2xadYqkXup SU9+5o6V2IMnPNVoSQ7UnfYu66e+6zCkrB9E/JWrMwb7fWAK3rSKY7CcqfKkuVMBh9BopCd/q//p +slAOIhntDnGhG9XyVPbuo7uwEOy+AmDbv9mzz7vF7NYGCUJNF7jy9YUtuzykm905C+BKtWSkeDg lzwyaAWFS9H3V+JSHZMaVJ8FcMBKcWAeQwtgHv6jzoEZ4Qs1MIIEbjCCA1agAwIBAgIKYRCAbQAA AAAADjANBgkqhkiG9w0BAQUFADA1MRYwFAYDVQQKEw1DaXNjbyBTeXN0ZW1zMRswGQYDVQQDExJD aXNjbyBSb290IENBIDIwNDgwHhcNMTQwNDA0MjAyNDE4WhcNMjkwNTE0MjAyNTQyWjAsMQ4wDAYD VQQKEwVDaXNjbzEaMBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0EwggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQDK334WTFMV+yNWzca5ZQoEleXeTEVnjAzHBuCrH21fNyp75+2jrYB/Ecjz guvun1DZyb89oS+7PBEHNe+4pdlRTtmw91OglIAsLJJlrRBvoYZrX0AKmaVQRBqQTc/mTPtGBo1I 4wfX4a1j19XoJwAVv24HskO7ZQYvffZZXZsSxSx9vetEsFLhwvwe7Z1Z9x2Tp6sxpkJCOSfTgWLG VCwmjNs9FNCojhXqKKQb/r2sPJ5N1tVMr4zL/0ufBWwPcYEyJGHtGau+6nG0aIy7yPTkiz93U6J+ FZ5zC+NXdF6D0uiTxsw0kQwCl53XB5N1VLRfgywCF6iwkGV32VLk7iJ3AgMBAAGjggGHMIIBgzAQ BgkrBgEEAYI3FQEEAwIBADAdBgNVHQ4EFgQUn5U2tI5d1UvDCsGnKZNDUQb9iVEwGQYJKwYBBAGC NxQCBAweCgBTAHUAYgBDAEEwCwYDVR0PBAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHwYDVR0j BBgwFoAUJ/PIFR5umgIJFq0roIlgX9p7L6owQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL3d3dy5j aXNjby5jb20vc2VjdXJpdHkvcGtpL2NybC9jcmNhMjA0OC5jcmwwUAYIKwYBBQUHAQEERDBCMEAG CCsGAQUFBzAChjRodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY2VydHMvY3JjYTIw NDguY2VyMFwGA1UdIARVMFMwUQYKKwYBBAEJFQEVADBDMEEGCCsGAQUFBwIBFjVodHRwOi8vd3d3 LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvcG9saWNpZXMvaW5kZXguaHRtbDANBgkqhkiG9w0BAQUF AAOCAQEAPk6+IxpGAo1ea9uKAjQLY5vlATwmXYxwsiTrYF7sioRkLhtZFaNnGuEW4/3gTX1EmiMo 0u2296If50TN7W3qhiFUKKxsYbz7yGVQBECKKov8n24YnvXFPqWiqRwArnGmF7tJMktKWBOTTDbp 9y8N6IDrOF1UecqFUqSk4lZ30w0HIU6cJDIM4r6lw3EtTog31PAvVmhGR0VrXVCIJfc6KaTxiEGt U35XMYYq1uBnh9hTq4GjdXe+2yHIOke0aSfV7t/39NZxjbp60XMvfd3NpniUKGXDiXdeQuroB8IQ MXl2OkF2IJGPCkFQghsJKbIRIG8D6wviPyLW+j+4Rqu2sDCCBKEwggOJoAMCAQICCgGGGmG8CetC JFAwDQYJKoZIhvcNAQELBQAwLDEOMAwGA1UEChMFQ2lzY28xGjAYBgNVBAMTEUNpc2NvIEVtcGxv eWVlIENBMB4XDTIwMDYwOTE4MTEzOFoXDTIyMDYwOTE4MjEzOFowgZYxHTAbBgNVBAMTFFZpbm55 IFBhcmxhICh2cGFybGEpMRQwEgYDVQQLEwtDaXNjbyBVc2VyczESMBAGA1UECxMJRW1wbG95ZWVz MRMwEQYKCZImiZPyLGQBGRMDY29tMRUwEwYKCZImiZPyLGQBGRMFY2lzY28xHzAdBgkqhkiG9w0B CQEMEHZwYXJsYUBjaXNjby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg5zG6 WUz2eLCtkokcmka2wwjH6DXR8dfR2VqJ3szmqqmiZLHtOZQ7/3+/ztkZk0iM3yQQc2l9KsQ2jzHU rkOZpqMpYCv43rxL2uAM0gQfpIxWGoHN5L3kW7gVpXuPmgGgF6TpMI9vytRh1gl4SHJD8f9QTvTU JynVycwV0KCQfjrJ77AGHX+7+Jwt7vkY64UtJmM7gCoJj7CU7eO+PAJc2qAJMaljtK4XI6InXFPB 7meUpm8k1TBtUuOpe25WYdUcbeipNtqjTFDtYNtXSXwHn1JRWr14CMWI2iTUu69D6M5p8KxXMStS F197vWn7QrFJ1PaK366O/LgsHumVQxAHAgMBAAGjggFYMIIBVDAOBgNVHQ8BAf8EBAMCBPAwDAYD VR0TAQH/BAIwADB6BggrBgEFBQcBAQRuMGwwPAYIKwYBBQUHMAKGMGh0dHA6Ly93d3cuY2lzY28u Y29tL3NlY3VyaXR5L3BraS9jZXJ0cy9jZWNhLmNlcjAsBggrBgEFBQcwAYYgaHR0cDovL3BraWN2 cy5jaXNjby5jb20vcGtpL29jc3AwHwYDVR0jBBgwFoAUn5U2tI5d1UvDCsGnKZNDUQb9iVEwOgYD VR0fBDMwMTAvoC2gK4YpaHR0cDovL2Npc2NvY2VydHMuY2lzY28uY29tL2ZpbGUvY2VjYS5jcmww GwYDVR0RBBQwEoEQdnBhcmxhQGNpc2NvLmNvbTAdBgNVHQ4EFgQU77mvrtX1ZwgDCBrBz254abit a7kwHwYDVR0lBBgwFgYKKwYBBAGCNwoDDAYIKwYBBQUHAwQwDQYJKoZIhvcNAQELBQADggEBAJ0C qW6utEOTvSb85ZBZel2OgSpFDDjaLWIEceNr23m4NkhjweswzFPJY4nnKgD40Ryv5WVW4KdpmbZx NBZl4Ypd5XlwleoU9jHuSwp6kaYCEJ7YfOIKVBcF1rYclNL0J0nJ2/fnaxGoYylNfW99vu4UaqEl BWU66VkGfsg5hWPRg90fuge1zZhlwI2AE6xq7pV8C2302ag94ti465IhjnHswtA4Q+r39Tc+me1o b2s1g8WKyds2DPI0PAjWnNpsEvYYOXU8MeMv9p6jPbFG9uaCpt8kCGcYytt8FD285Rmq77FRMEBe ptFCTJh5yr5hIaMVoqBUydvZmQAYKnRX8zMxggLwMIIC7AIBATA6MCwxDjAMBgNVBAoTBUNpc2Nv MRowGAYDVQQDExFDaXNjbyBFbXBsb3llZSBDQQIKAYYaYbwJ60IkUDAJBgUrDgMCGgUAoIIBizAY BgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA3MjgxNjM0MjdaMCMG CSqGSIb3DQEJBDEWBBRnGpz4nqMgsbxQqW/AT4vS2Tf06zBJBgkrBgEEAYI3EAQxPDA6MCwxDjAM BgNVBAoTBUNpc2NvMRowGAYDVQQDExFDaXNjbyBFbXBsb3llZSBDQQIKAYYaYbwJ60IkUDBLBgsq hkiG9w0BCRACCzE8oDowLDEOMAwGA1UEChMFQ2lzY28xGjAYBgNVBAMTEUNpc2NvIEVtcGxveWVl IENBAgoBhhphvAnrQiRQMIGTBgkqhkiG9w0BCQ8xgYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFl AwQBFjAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMC AgFAMAcGBSsOAwIaMAsGCWCGSAFlAwQCAzALBglghkgBZQMEAgIwCwYJYIZIAWUDBAIBMA0GCSqG SIb3DQEBAQUABIIBAA3plcJ3j4oGVuCeWN+i8u3JxrA1JWwJkVwI4LfbtGCMonYugFjCLNrSs3co xrPf9jUyiVGgYqa+5WQwjTdPi/z4T/i22U15OCEidqpgDmOWyWaeANNwTRErO2TRmwfpmNNS5fFR xGZmj+Cq1nJZYxRcKXTCBIoHugJ7BNbO1JUFxu4BVcFK7fcM/QjlvVu8NapTI3PVc6ErDf1o43b4 GFBxdpSxa8ihmleuZnBLcyQbfPnYK2yrQRe9GEZpLlrEK5aCwoKeKApMDVQfRixGVBMhkcHY30Iv oZ/8CQYLvVoZn1y6lQYS6jlwHCedZR/qJEc9ofHmgcXs/ynthrhrxEwAAAAAAAA= ------=_NextPart_000_0137_01D664DB.6EA57180-- From nobody Tue Jul 28 10:32:12 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 970053A1033; Tue, 28 Jul 2020 10:32:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTML_NONELEMENT_30_40=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=scramworks.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id stvPESrK8p9E; Tue, 28 Jul 2020 10:32:00 -0700 (PDT) Received: from knid.scramworks.net (knid.scramworks.net [IPv6:2a01:4f8:c17:50eb::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 644543A1007; Tue, 28 Jul 2020 10:31:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=scramworks.net; s=bofh; h=References:In-Reply-To:Cc:To:From:Subject: Message-ID:Date:MIME-Version:Content-Type:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=YXeloO4oYGhcgXuPxhpOI3FgemCttNfQmC98Vlg0VL4=; b=p9KRF7hXsXfaRDjhBTBxMlca9 n41cFdV5kFEuRMevSluYBO++NgzjlnngVpswsTe95VxeFj8JvZhuGXpShjKj6ra0Rg/GMb+FXUzRk qhIzTy6+Xgc0c034h3+8X26vDMmUyJIGFqgjbkaZxMR9kYyUSBAVqurBqk/kBtoinUGgA=; Received: from host-92-26-30-12.as13285.net ([92.26.30.12] helo=[192.168.1.233]) by knid.scramworks.net with esmtpsa (TLS1.1:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1k0TS5-00023W-AT; Tue, 28 Jul 2020 18:31:45 +0100 Content-Type: multipart/alternative; boundary="----=_NextPart_15845399.176557942747" MIME-Version: 1.0 Date: Tue, 28 Jul 2020 18:30:44 +0100 Message-ID: From: "Robert Mortimer" To: "" Cc: "Vittorio Bertola" In-Reply-To: <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> User-Agent: Mailbird/2.8.23.0 X-Mailbird-ID: Mailbird-f5c0c75a-a605-4089-b5e4-7db89115f37c@scramworks.net X-Spam-Score-SW: -1.0 (-) X-SW-Scan: 584622d9be80350c33f99c0347ff2725 X-Clacks-Overhead: GNU Terry Pratchett Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 17:32:10 -0000 ------=_NextPart_15845399.176557942747 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable +1=C2=A0 There has to be a user-network negotiation. If they agree stuff works - if = they don't the user declines to connect to the network. How that's achieved if we assume that users can't be trusted to make decisi= on as they won't understand the question and anyway the network might be ly= ing is obviously gong to be tricky. I think if you decide the user can't be= trusted and remove their agency then we're probably on a hiding to nothing= ( and this seems to be the direction at least a few people want to head in= ). --=C2=A0 Robm 873 =C2=A0 "Ask not what I can do for the stupid,=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0but what the stupid can do for me" - Grae= me Garden On 28/07/2020 12:35:03, Vittorio Bertola wrote: > Il 28/07/2020 12:39 Ted Lemon ha scritto: > > > > On Jul 28, 2020, at 03:34, Paul Vixie wrote: > > in my estimation, none of the agencies edward snowden warned us about i= n 2013 > > are going to be transparent about surveillance or filtering, so your fe= ar of > > them using reliable denial signaling as part of negotiation seems mispl= aced. > > That=E2=80=99s not the concern. The concern is that if DoH traffic is lab= eled specifically so that the network can identify it, it will be blocked, Why? There will be networks that want to block DoH, and there will be others tha= t don't, and there will be others that will say that you can have DoH but o= nly if you use the local resolver, or if you use a resolver from a specific= list, or will suggest you a local resolver but then accept a different cho= ice. Then, there will be clients (both on behalf of the user, i.e. anonymizing b= rowsers, and against the user, i.e. malware) that will want to ignore that = policy if they dislike it, and do something else - and there will be networ= ks that will then react by doing all sorts of bad things to traffic from th= ose clients. We cannot do much in the case when clients (users) and networks (network pr= oviders) disagree, and that case will always exist, but there is a number o= f use cases (hopefully most of them) in which users and network providers w= ill cooperate to find a mutually acceptable configuration. What we should d= evelop is a way for the client to discover the local DoH resolver's locatio= n and the network policy attached to it, so that the above agreement become= s possible in those cases. What the client does with that information, and = whether the client chooses to abide by or defy the local policy, will then = be a choice for the developers of each client (and for their lawyers and po= licy officers, I suspect, but that's another discussion). On the other hand, refusing to standardize such a mechanism would be quite = a strong policy stance, as it would assume that all networks will always be= adversarial and badly intentioned so there is no use in even listening to = what they would like to say. I don't think that the IETF should go down tha= t path. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add ------=_NextPart_15845399.176557942747 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable
=0A =0A = =0A = =0A =0A = =0A +1 

<= /div>
There has to be a user-network negotiation. If they agree stuff w= orks - if they don't the user declines to connect to the network.

How that's achieved if we assume that users can't be truste= d to make decision as they won't understand the question and anyway the net= work might be lying is obviously gong to be tricky. I think if you decide t= he user can't be trusted and remove their agency then we're probably on a h= iding to nothing ( and this seems to be the direction at least a few people= want to head in ).

-- 
Robm
873
  "Ask not what I can do for the stupi= d, 
         but what the stupid ca= n do for me" - Graeme Garden
=0A =

On 28/07/2020 12:35:03= , Vittorio Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org= > wrote:


> Il 28/07/2020 12:39 Ted Lemon ha scritto:
>=
>
> > On Jul 28, 2020, at 03:34, Paul Vixie wrote:
> > in my estimation, none of the agencies edward sn= owden warned us about in 2013
> > are going to be transparent abo= ut surveillance or filtering, so your fear of
> > them using reli= able denial signaling as part of negotiation seems misplaced.
>
&= gt; That=E2=80=99s not the concern. The concern is that if DoH traffic is l= abeled specifically so that the network can identify it, it will be blocked= ,

Why?

There will be networks that want to block DoH, and the= re will be others that don't, and there will be others that will say that y= ou can have DoH but only if you use the local resolver, or if you use a res= olver from a specific list, or will suggest you a local resolver but then a= ccept a different choice.

Then, there will be clients (both on behal= f of the user, i.e. anonymizing browsers, and against the user, i.e. malwar= e) that will want to ignore that policy if they dislike it, and do somethin= g else - and there will be networks that will then react by doing all sorts= of bad things to traffic from those clients.

We cannot do much in t= he case when clients (users) and networks (network providers) disagree, and= that case will always exist, but there is a number of use cases (hopefully= most of them) in which users and network providers will cooperate to find = a mutually acceptable configuration. What we should develop is a way for th= e client to discover the local DoH resolver's location and the network poli= cy attached to it, so that the above agreement becomes possible in those ca= ses. What the client does with that information, and whether the client cho= oses to abide by or defy the local policy, will then be a choice for the de= velopers of each client (and for their lawyers and policy officers, I suspe= ct, but that's another discussion).

On the other hand, refusing to s= tandardize such a mechanism would be quite a strong policy stance, as it wo= uld assume that all networks will always be adversarial and badly intention= ed so there is no use in even listening to what they would like to say. I d= on't think that the IETF should go down that path.

--
Vittorio B= ertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@= open-xchange.com
Office @ Via Treviso 12, 10144 Torino, Italy

--=
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listi= nfo/add
=0A = =0A =
------=_NextPart_15845399.176557942747-- From nobody Tue Jul 28 19:30:57 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 05A243A0E2D for ; Tue, 28 Jul 2020 19:30:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.599 X-Spam-Level: X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id imIV7qZf5F4Z for ; Tue, 28 Jul 2020 19:30:47 -0700 (PDT) Received: from mail-ot1-x336.google.com (mail-ot1-x336.google.com [IPv6:2607:f8b0:4864:20::336]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F86E3A0DB6 for ; Tue, 28 Jul 2020 19:30:47 -0700 (PDT) Received: by mail-ot1-x336.google.com with SMTP id h1so16422117otq.12 for ; Tue, 28 Jul 2020 19:30:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=81YTDpAtcsUudYwopwiW+E1W07ye0ISOqjN6Enxw4vg=; b=DBs60UodCvs3UYG1+FAKOhQJXHEY43GqtLi8IF9mw0RrT1a+S2rdRTxNRI+S8lRoge GLPl9SRslHCn2F6livy+idPqbsYLpzhr/xxGmndw9bEyqemo5g+LGXVKgVKu0Z63M764 3vg5MEqjz1g79E4dDgyXui4QWcF7wAPw1AQ7/8tqV+R1lbkJTnPQ6mAtjAQu/Ff42OrO a79mV8o7XugV5JVz47DUvp4Jmv7DpaAMCRWwWqWg2cMq7GkM9Xd28VWbJjbWyRpxKBYz ev/BgaYUlPhN3ar5X2GCZwj5NPQvWPI16lUOKbXOeb8IAi2/CTNph3wPxYQc4Pxmtc0U kM5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=81YTDpAtcsUudYwopwiW+E1W07ye0ISOqjN6Enxw4vg=; b=cY45JWDkAT2hP1Ci8yPvuJhzGGItAhgsIHhsbQXPrbdizgkx4410S9wDdVbuUnx2Ht FHNqDz+nuayQmMmdPgmxJZjlIAUPY//XnHYDaylNEihvNUOdOw2wOMk8QqJVJYKbmtrB hY4z3sF6w8jnfSrYKeZZcDOAQ8D0MuPlP/qkoq6VBFVLKMJvrl72S0dx6UO0YN5ICNpM Qs5ORj1fGs4imF9H1dULzKk3x65DTmjLtWwKpJEKHj65LhFt5Wfo1EUoS9Kdt3pCeC/4 pkrE36x/aXMxg0x3WGh63UC76ejuOqUzDNiIkoYpIe2mPvCq4VF46ULKAfwD2h74GXuY JOLw== X-Gm-Message-State: AOAM531cHMeGY9+4zEO1IBpsel/HIWLNkNSa4tHi1zGPkMMWfvRV9+K9 tKtuvsTymP9c5edIVYL0RTXSCz+7dw9d1agC4fVwlQ== X-Google-Smtp-Source: ABdhPJyhoFzZ1CT33Qm4m952V7qyoA5mJCfV1ei33RXGkVArsUTUWEaO70eG2dFTLitf9+mmYptHHg+BF0HJeuiK9j4= X-Received: by 2002:a9d:2661:: with SMTP id a88mr27570705otb.74.1595989846110; Tue, 28 Jul 2020 19:30:46 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> <20200728134948.GA24673@nic.fr> <45F2A448-4248-4C14-AA0B-ECBB34FF3AE4@fugue.com> <606980496.3510.1595946668260@appsuite-gw2.open-xchange.com> In-Reply-To: From: Kenji Baheux Date: Wed, 29 Jul 2020 11:30:34 +0900 Message-ID: To: tirumal reddy , Vittorio Bertola , Ted Lemon Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000d82dd405ab8b5727" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 02:30:54 -0000 --000000000000d82dd405ab8b5727 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Jul 28, 2020 at 11:50 PM tirumal reddy wrote: > On Tue, 28 Jul 2020 at 14:31, Vittorio Bertola 40open-xchange.com@dmarc.ietf.org> wrote: > >> >> >> Il 28/07/2020 16:13 Ted Lemon ha scritto: >> >> >> On Jul 28, 2020, at 10:02 AM, Vittorio Bertola < >> vittorio.bertola@open-xchange..com > >> wrote: >> >> >> What is still missing is a standard way for the resolver to communicate = a >> URL to the client in the response, so that the client (if it wants) can = use >> it to retrieve and display a human-readable error message. >> >> >> That would be an attack surface=E2=80=94now I can intercept your connect= ion and >> send you to a malware URL (or snooping URL, or whatever). And again woul= d >> only work if the DoH server sending the response is the one with which t= he >> device connecting to it intended to communicate. >> >> Of course that requires some security considerations and validation >> before use, but if you assume that you cannot trust the (https) URL >> indicated in the EDNS response, then you cannot trust the response itsel= f >> and its indication that the domain was blocked for whatever reason, and >> possibly you cannot trust any DNS response whatsoever. In any case, it >> might be that clients will only use that information if it is received o= ver >> an authenticated channel (e.g. via DoH). >> > > https://tools.ietf.org/html/draft-reddy-dnsop-error-page-02#section-6 man= dates > DoH/DoT to process the error page URL. > As part of the set of considerations / validations, I've been thinking that a client would only consider surfacing a URL present in an EDNS response if it matches with / relates to the DoH service in use. Is that a useful distinction, are there other issues? > > Vittorio Bertola | Head of Policy & Innovation, Open-Xchange >> vittorio.bertola@open-xchange.com >> Office @ Via Treviso 12, 10144 Torino, Italy >> >> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --=20 Kenji BAHEUX Product Manager - Chrome Google Japan --000000000000d82dd405ab8b5727 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Jul 28, 2020 at 11:50 PM tiru= mal reddy <kondtir@gmail.com>= ; wrote:
On Tue, 28 Jul 2020 at 14:31, Vittorio Bertola &= lt;vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:
=20 =20 =20
=C2=A0
=20
=20
Il 28/07/2020 16:13 Ted Lemon <mellon@fugue.com> ha scritto:
=20
=C2=A0
=20
=C2=A0
=20
On Jul 28, 2020, at 10:02 AM, Vittorio Bertola <vittorio.bertola@open-xc= hange..com> wrote:
=20
=20

What is still missing is a standard way for the resolver to commu= nicate a URL to the client in the response, so that the client (if it wants= ) can use it to retrieve and display a human-readable error message.
=20
=C2=A0
=20
That would be an attack surface=E2=80=94now I can intercept your conn= ection and send you to a malware URL (or snooping URL, or whatever). And ag= ain would only work if the DoH server sending the response is the one with = which the device connecting to it intended to communicate.
=20
=20
=20
=20
Of course that requires some security considerations and validation befo= re use, but if you assume that you cannot trust the (https) URL indicated i= n the EDNS response, then you cannot trust the response itself and its indi= cation that the domain was blocked for whatever reason, and possibly you ca= nnot trust any DNS response whatsoever. In any case, it might be that clien= ts will only use that information if it is received over an authenticated c= hannel (e.g. via DoH).

https://tools.ietf.org/html/draft-reddy-dnsop-error-page-= 02#section-6=C2=A0mandates DoH/DoT to process the error page URL.=C2=A0=

As part of the set o= f considerations / validations, I've been thinking that a client would = only consider surfacing a URL present in an EDNS response if it matches wit= h / relates to the DoH service in use. Is that a useful distinction, are th= ere other issues?

=C2=A0
<= div>

=
=20 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchangevit=
torio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torin=
o, Italy
=20
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add


--
Kenji BAHEUX
= Product Manager - Chrome
Google Japan
--000000000000d82dd405ab8b5727-- From nobody Tue Jul 28 21:07:43 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D1D7C3A0BE9 for ; Tue, 28 Jul 2020 21:07:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JR1yzTFuv0Dc for ; Tue, 28 Jul 2020 21:07:38 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2EC8E3A0BF0 for ; Tue, 28 Jul 2020 21:07:38 -0700 (PDT) Received: from linux-9daj.localnet (dhcp-183.access.rits.tisf.net [24.104.150.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (1024 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 6A34DC3F19; Wed, 29 Jul 2020 04:07:36 +0000 (UTC) From: Paul Vixie To: tirumal reddy , Vittorio Bertola , Ted Lemon , add@ietf.org Cc: ADD Mailing list , Kenji Baheux Date: Wed, 29 Jul 2020 04:07:34 +0000 Message-ID: <5054398.vCdH2pZGMm@linux-9daj> Organization: none In-Reply-To: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 04:07:40 -0000 On Wednesday, 29 July 2020 02:30:34 UTC Kenji Baheux wrote: > On Tue, Jul 28, 2020 at 11:50 PM tirumal reddy wrote: > > ... > > > > https://tools.ietf.org/html/draft-reddy-dnsop-error-page-02#section-6 > > mandates DoH/DoT to process the error page URL. > > As part of the set of considerations / validations, I've been thinking that > a client would only consider surfacing a URL present in an EDNS response if > it matches with / relates to the DoH service in use. the normal way to do this is to make the URI error signal a separate option, and to have the client include it (empty) if it wants the server to fill it in. > Is that a useful distinction, are there other issues? by default, nothing in DNS should presume the existence of the web. options for this may be useful, but only when negotiated. -- Paul From nobody Tue Jul 28 22:21:18 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B2503A0F93 for ; Tue, 28 Jul 2020 22:21:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nhO3NWiQxkHl for ; Tue, 28 Jul 2020 22:21:15 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 18FA43A0F9A for ; Tue, 28 Jul 2020 22:21:15 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id s189so15991596iod.2 for ; Tue, 28 Jul 2020 22:21:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=mvG9n26TrGRctbFG+OW5rj7n1ryvju6Olyr9WLyuElo=; b=mwsWAJuZyPmXhLfG/yczPjEoQoiof4XQM4t9CXApfPaClZLw6WR8SkT+838KaUr2ZZ S82zv+Ovw9bLXyIAP1/79KFOJh7L1kk7qFnftvvHv96EOW8qloOJbqMTa0iX87dzZcvT caIpQaEWTK+QM80ZpmN5VJ9qCIu5VtHM4pYGnXawKt99quDVrE6F11TR43rHsljJKwAy cm9T0SZzlYAXqgScEBxLqXSouGqBfRhX4LDn0UCCMhlFeut/1RglD+w/LBWgWULyh8/3 7QZZRFSBmjmxvVILZ/TAvBcXXWXhkip5z4H2PRmXIDXmbydhzlB1dDtF4YZaAm6OkoLG chFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=mvG9n26TrGRctbFG+OW5rj7n1ryvju6Olyr9WLyuElo=; b=cymqmwEr1wVVtlj3W5f73rOjIsRSj1lZWXHbSvf/EpKFrsq+dsBz1DECZT1f6RI7Dk ErLJzRs7j2TB43XfTwswZEqXHyEqktK5qQmvlmThExj+GqOGUOzjTPDFhW/bagyue9bM uIWwGFOmp+gnuXr/izaYUbwKy356fXR1e2D61VdrRXDlkBJzcHucI6hdyzYYySBTBtSp wPv87OV/2s1KRadkhPaA3pO8NSJPvlZkPORjVq+g4Tgn7xHjTXcPBfsmhHRmnQLzXRQr vx4eh61RQk8mmOQQ+NQBwY1uYvSULpEgIuNQETBoupxi8AobsbfjZfZZkkU4yKfZx1sP KlpA== X-Gm-Message-State: AOAM530vcLn9JU8UXxicXS5ctUaPex5ocAvsx3ZFoeDaOXeSRE9BJw4l toMJVNxERg+K5aDTwTwXYdahCyZbY6klgf4vhv8= X-Google-Smtp-Source: ABdhPJxIicSEA9ahdvzuOqft0G8huNL/+QSFgL7VYb3aXK1sdVpkiir6zmXfwmjwdGiYn6lFfPSx4gclMLS0Pt5cNgk= X-Received: by 2002:a02:5b83:: with SMTP id g125mr36883419jab.91.1596000073344; Tue, 28 Jul 2020 22:21:13 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> <20200728134948.GA24673@nic.fr> <45F2A448-4248-4C14-AA0B-ECBB34FF3AE4@fugue.com> <606980496.3510.1595946668260@appsuite-gw2.open-xchange.com> In-Reply-To: From: tirumal reddy Date: Wed, 29 Jul 2020 05:21:01 +0000 Message-ID: To: Kenji Baheux Cc: Vittorio Bertola , Ted Lemon , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000006ee82a05ab8db951" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 05:21:17 -0000 --0000000000006ee82a05ab8db951 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 29 Jul 2020 at 02:30, Kenji Baheux wrote: > > > On Tue, Jul 28, 2020 at 11:50 PM tirumal reddy wrote: > >> On Tue, 28 Jul 2020 at 14:31, Vittorio Bertola > 40open-xchange.com@dmarc.ietf.org> wrote: >> >>> >>> >>> Il 28/07/2020 16:13 Ted Lemon ha scritto: >>> >>> >>> On Jul 28, 2020, at 10:02 AM, Vittorio Bertola < >>> vittorio.bertola@open-xchange..com > >>> wrote: >>> >>> >>> What is still missing is a standard way for the resolver to communicate >>> a URL to the client in the response, so that the client (if it wants) c= an >>> use it to retrieve and display a human-readable error message. >>> >>> >>> That would be an attack surface=E2=80=94now I can intercept your connec= tion and >>> send you to a malware URL (or snooping URL, or whatever). And again wou= ld >>> only work if the DoH server sending the response is the one with which = the >>> device connecting to it intended to communicate. >>> >>> Of course that requires some security considerations and validation >>> before use, but if you assume that you cannot trust the (https) URL >>> indicated in the EDNS response, then you cannot trust the response itse= lf >>> and its indication that the domain was blocked for whatever reason, and >>> possibly you cannot trust any DNS response whatsoever. In any case, it >>> might be that clients will only use that information if it is received = over >>> an authenticated channel (e.g. via DoH). >>> >> >> https://tools.ietf.org/html/draft-reddy-dnsop-error-page-02#section-6 ma= ndates >> DoH/DoT to process the error page URL. >> > > As part of the set of considerations / validations, I've been thinking > that a client would only consider surfacing a URL present in an EDNS > response if it matches with / relates to the DoH service in use. Is that = a > useful distinction, are there other issues? > Yes, it is useful. If the DoH service does not offer filtering (e.g., blocking malware), the error page URL will be rejected by the client. -Tiru > > > >> >> Vittorio Bertola | Head of Policy & Innovation, Open-Xchange >>> vittorio.bertola@open-xchange.com >>> Office @ Via Treviso 12, 10144 Torino, Italy >>> >>> -- >>> Add mailing list >>> Add@ietf.org >>> https://www.ietf.org/mailman/listinfo/add >>> >> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> > > > -- > Kenji BAHEUX > Product Manager - Chrome > Google Japan > --0000000000006ee82a05ab8db951 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, 29 Jul 2020 at 02:30, Kenji Baheu= x <kenjibaheux@google.com&= gt; wrote:


On Tue, Jul 28,= 2020 at 11:50 PM tirumal reddy <kondtir@gmail.com> wrote:
On Tue, = 28 Jul 2020 at 14:31, Vittorio Bertola <vittorio.bertola=3D40open-xchange.co= m@dmarc.ietf.org> wrote:
=20 =20 =20
=C2=A0
=20
=20
Il 28/07/2020 16:13 Ted Lemon <mellon@fugue.com> ha scritto:
=20
=C2=A0
=20
=C2=A0
=20
On Jul 28, 2020, at 10:02 AM, Vittorio Bertola <vittorio.bertola@open-xc= hange..com> wrote:
=20
=20

What is still missing is a standard way for the resolver to commu= nicate a URL to the client in the response, so that the client (if it wants= ) can use it to retrieve and display a human-readable error message.
=20
=C2=A0
=20
That would be an attack surface=E2=80=94now I can intercept your conn= ection and send you to a malware URL (or snooping URL, or whatever). And ag= ain would only work if the DoH server sending the response is the one with = which the device connecting to it intended to communicate.
=20
=20
=20
=20
Of course that requires some security considerations and validation befo= re use, but if you assume that you cannot trust the (https) URL indicated i= n the EDNS response, then you cannot trust the response itself and its indi= cation that the domain was blocked for whatever reason, and possibly you ca= nnot trust any DNS response whatsoever. In any case, it might be that clien= ts will only use that information if it is received over an authenticated c= hannel (e.g. via DoH).

https://tools.ietf.org/html/draft-reddy-dnsop-error-page-= 02#section-6=C2=A0mandates DoH/DoT to process the error page URL.=C2=A0=

As part of the set o= f considerations / validations, I've been thinking that a client would = only consider surfacing a URL present in an EDNS response if it matches wit= h / relates to the DoH service in use. Is that a useful distinction, are th= ere other issues?

Yes, it= is useful. If the DoH service does not offer filtering (e.g., blocking mal= ware), the error page URL will be rejected by the client.

-Tiru
=C2=A0

= =C2=A0

=20 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchangevit=
torio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torin=
o, Italy
=20
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add


--
Kenji BAHEUX
Pr= oduct Manager - Chrome
Google Japa= n
--0000000000006ee82a05ab8db951-- From nobody Wed Jul 29 00:21:40 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2782E3A1075 for ; Wed, 29 Jul 2020 00:21:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.102 X-Spam-Level: X-Spam-Status: No, score=-2.102 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GteXYJnJDTf4 for ; Wed, 29 Jul 2020 00:21:34 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40058.outbound.protection.outlook.com [40.107.4.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD8F33A1073 for ; Wed, 29 Jul 2020 00:21:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=j8ics8bV7qFMND9hIf/oCNVzG4fcq17LOnJ+zAxwR7+96OSzq0cAm89dw2MKkji1pLIb1qAFqumKtIQkdcGR1HJoSFbQYtdEjErHsDpAh/iAQgBHqdk2wF3QZMMg0XbKQpAlaNu8FysB+g9nsGQLZl/x59c8MCRMXWaVowa8q0+BCb0IBBkMtTKV1+vd0yNl7wDeQBIgDW8ZOaZSwb/69X7Yq0nF2OjmJB4xJK0+4lyXqoAiRBj79Ju5B2NpIaon/DOWyL2QX7emaAJBSo9XtP8CLGe88wgkqIqzTBEwAHrKZWFgGhFYC2JXvQSBw1nrnYn6Qp4dqgFfu4FJUHXeZg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1OHuSmpzilLQyxGT5iliMVNqjuWdaB/6HyVTvUCD5lU=; b=UwIfMfibfDxe0X5H4LksgfvbE2gFxqWmsFglnihl5V9JVMeTajCVb9DMyv34DD3wMb6Fw1pRW4Ipq+ABqiSvTL3sQnfPcVlClKnpz8xbnp265KG6a2S41nXhaWNpNNMS2NDKFn1iRh6TJNAsPelQ4/xL/6qnGJdFtekdGcsYtlLFWyUpEGLeR/+ejlnupqr7hK1V5uC2jx9ScGfL/o1/XwTylLr5zMf3YLDHP53KWJ3LTWpGz6N6fqltiHmxYUZkOpXZ8Ks+7bwal3shdJarfmjGcjkc1XuS79IKVCKFPvr2/dOjvCaXX83QK0Hg0fj79QVMUTHduXe4g/LaImsROg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1OHuSmpzilLQyxGT5iliMVNqjuWdaB/6HyVTvUCD5lU=; b=FCIwN9GaMC+fD6uJhyEvTSXDb3f9on6/HIHfMsgMa/HmBwBT8GHOaEcuYDP5pOnOBmr41f+Ty1sCRmagYblaQV8AlBORi8cMprPCQb8Y1z15ASsL0rg9ycq7sNEg4sPoaeLIKKmYXWIcqSQxT0Qspo7Er33m4DdHLtq6sV8mzBI= Received: from HE1PR07MB3386.eurprd07.prod.outlook.com (2603:10a6:7:2d::25) by HE1PR07MB4425.eurprd07.prod.outlook.com (2603:10a6:7:96::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3239.9; Wed, 29 Jul 2020 07:21:30 +0000 Received: from HE1PR07MB3386.eurprd07.prod.outlook.com ([fe80::e01c:9809:43db:67d3]) by HE1PR07MB3386.eurprd07.prod.outlook.com ([fe80::e01c:9809:43db:67d3%6]) with mapi id 15.20.3239.017; Wed, 29 Jul 2020 07:21:30 +0000 From: Mohit Sethi M To: tirumal reddy , Tommy Jensen CC: Eric Rescorla , Ted Lemon , Paul Vixie , Rob Sayre , "add@ietf.org" , "STARK, BARBARA H" Thread-Topic: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWZXjhadf8QPfjXkavA3YrS4mFNQ== Date: Wed, 29 Jul 2020 07:21:30 +0000 Message-ID: <2c1c2ca8-f6ba-0f78-5e6a-d86658c05453@ericsson.com> References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <3B4BDD38-4C0E-4444-A294-0E17BA5E2FA8@fugue.com> <1978893.SkKRCvkyLV@linux-9daj> <9C027574-73FA-4D94-8BFF-32B7ECD2A71F@fugue.com> <0CEEDE62-234A-455C-AD5B-C989888B3D1F@fugue.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [2001:14bb:140:23f1:7753:7ab1:5656:ea77] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 46c79b09-9f0e-4e2e-e8f0-08d833900408 x-ms-traffictypediagnostic: HE1PR07MB4425: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: un2+7bjTwaOx/INj1mtoGqIDGStSed6uLvfNofCbhbrTQInR1ar2ao4/LvFsgcl/vOlNrUmzqIVZfFWoFcPPE62FvDEmtx+jUg6eXHBs90iJMG/3zvv8Kc+l6cBcYOa42ncA0HiKPfd/Gqc778+MUBYIwIwQYb2CbZs1xHj+hE0gSIZAY1jFyZBMuLUxBoVMrNBjfsY8IkHgLIgCAJ3In5x6ZZl23Ou5CPq4HOjAAD3Ar/Et8tJ1yxB0VmxdpoNsJ43kjLNRnzCDx6sXLKaT8Hk56RNhT90Tp63+BY/qDwXAYnmUeHsrBp9hd1blxr6qz7/QRkxj/Z6lApexX/SIMQ/QzO1g2NszASm5e/RfLfBWvAuCE1oyU2X2s03L6/31xFUm/KHWHt3J5HSGJ3aL+RJKI3x/iFNk2vuaqWohxbEVxKzJ/Bk7+YU+R2/3QD+L/nuLdt4CazR1qBe6rjyP4g== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:HE1PR07MB3386.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(39860400002)(396003)(136003)(366004)(346002)(376002)(36756003)(2906002)(66574015)(966005)(478600001)(66556008)(71200400001)(66476007)(66446008)(76116006)(64756008)(66946007)(316002)(15650500001)(54906003)(6512007)(53546011)(4326008)(8676002)(110136005)(31696002)(86362001)(8936002)(5660300002)(31686004)(186003)(166002)(2616005)(6486002)(6506007)(83380400001)(43740500002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: N+OCmS9Mnq4ARXj8e8ch3GMljifUQrgAJN2Vgs22rqm1qh8SI39M5RUdmmV72rIU1QL/AFeSVfXZ92fgL87Om5jBf7vbAhhI2tjXl2kl+uMsoRNyWIRX7QquLO0PU+gkT2IlpHSq3GX7qF982bDzGlYIYGWZDjSTrpbIplq+q8LZvW6APCNn8Odg+U0W0nQiIuPIczlCkU8fiEq7IcpedMz0wSvl9Syq0IHOCJXtFnCfvalhr9JIKJr+6QSTAIGXVVjh+xYm9NYk35yNk+avOO8MzJ9t7V+AJaHCmclDVKWK6dY2Ys75nmgv6SUYX4yhvdePviCZtSyWS459a5dT1maXUq1F5NJ2Z7g8lSjoIyxQWpIG5NBB5ALBh06+KMb4EiS4ErVN8lsjU9UQ56oGFtS/7ivA6N2/WShjSJJmfDLsmca+yLOfb95oFSSdM6upHqRNTQ6oGiUOJ3fY+3nSunZwSR2V2I+PgUEXQ2yGIPmQAmxo1NvRzmjMqfrcDh8ZXHFbmL6ZtVRm/mXdURMv7JylLKNDX07nif/cXbZzyhHsuUkGhU2XSa7Fnlbjsi7pdmnGsJZltdOklndXl3G62M2YLaAAmRvMytdpRaOE5Z/aTNeUqQqpr9OoYAF5GhY/6RF6cdKXi+CRCMgRQKnx/SZknZUS1PWLkcCQzkV5JujDHRHOlr23sU8WMWcK5hShiCECO3aeqQWmH+qLDNVIyw== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_2c1c2ca8f6ba0f785e6ad86658c05453ericssoncom_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: HE1PR07MB3386.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 46c79b09-9f0e-4e2e-e8f0-08d833900408 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Jul 2020 07:21:30.7575 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 9lCsCPHTFFmMVjhHmmkuLwxTLMdPeblrx3U3NZnojH9rmA+g3amTXrlQq9mXrEaO772T7+sbIjDjFdvm+FDIrkqHgCQEKtkDsLTm0gktmNA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB4425 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 07:21:37 -0000 --_000_2c1c2ca8f6ba0f785e6ad86658c05453ericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Qm90aCB0aGUgZHJhZnRzIG9ubHkgdmFsaWRhdGUgd2hhdCBUb21teSBzYWlkICdZb3UgbmVlZCBz b21lIHByaW9yIGtub3dsZWRnZSBhbmQgdHJ1c3Qgb2YgdGhlIG5ldHdvcmsnLg0KDQpkcmFmdC1y ZWRkeS1hZGQtaW90LWJ5b2QtYm9vdHN0cmFwOiBzZWN0aW9uIDQgc2F5cyAiVGhlIGVuZHBvaW50 IGF1dGhlbnRpY2F0ZXMgdG8gdGhlIGxvY2FsIG5ldHdvcmsgYW5kIGRpc2NvdmVycyB0aGUgRW5y b2xsbWVudCBvdmVyIFNlY3VyZSBUcmFuc3BvcnQgKEVTVCkiIGFuZCBhbHNvICJ0aGUgZW5kcG9p bnQgTVVTVCBhdXRoZW50aWNhdGUgdGhlIEVTVCBzZXJ2ZXIgYmVmb3JlIGl0IGFjY2VwdHMgdGhl IEROUyBzZXJ2ZXIgY2VydGlmaWNhdGUuIi4gVGhpcyBpbXBsaWVzIHRoYXQgeW91IG5lZWQgc29t ZSBwcmlvciBrbm93bGVkZ2Ugb2YgdGhlIG5ldHdvcmsgdG8gZXN0YWJsaXNoIHRydXN0LiBTZWN0 aW9uIDUgZG9lcyBhIGNvbXBsZXggaW5kaXJlY3Rpb24gYW5kIGluc3RlYWQgb2YgZGlyZWN0bHkg YXV0aGVudGljYXRpbmcgdGhlIG5ldHdvcmssIGl0IHJlbGllcyBvbiB0aGUgbWFudWZhY3R1cmVy IHRvIGNvbmZpcm0gaWYgdGhlIG5ldHdvcmsgaXMgY29ycmVjdC4NCg0KZHJhZnQtYnR3LWFkZC1p cHNlY21lLWlrZTogeW91IG5lZWQgc29tZSBjcmVkZW50aWFscyBmb3Igc2V0dGluZyB1cCB0aGUg SVBTZWMgdHVubmVsLg0KDQotLU1vaGl0DQoNCk9uIDcvMjgvMjAgMzoyMyBQTSwgdGlydW1hbCBy ZWRkeSB3cm90ZToNCk9uIFR1ZSwgMjggSnVsIDIwMjAgYXQgMDA6NDQsIFRvbW15IEplbnNlbiA8 SmVuc2VuLlRob21hcz00MG1pY3Jvc29mdC5jb21AZG1hcmMuaWV0Zi5vcmc8bWFpbHRvOjQwbWlj cm9zb2Z0LmNvbUBkbWFyYy5pZXRmLm9yZz4+IHdyb3RlOg0KKCsxIHRvIGVrcidzIHBvaW50KQ0K DQpJIGFncmVlIHdpdGggVGVkOiB3ZSBzaG91bGRuJ3QgZ28gd2Vha2VuaW5nIHN0cm9uZyBlbmQt dG8tZW5kIGVuY3J5cHRlZCBwcm90b2NvbHMgb24gcHVycG9zZS4gRnJvbSBhbiBlbmRwb2ludCdz IHBlcnNwZWN0aXZlLCB0aGVyZSBpcyBubyBhdXRob3JpdGF0aXZlIHdheSB0byBkaXN0aW5ndWlz aCBiZXR3ZWVuIG5ldHdvcmsgYWRtaW5pc3RyYXRpb24gKCJnb29kIikgYW5kIG5ldHdvcmsgYXR0 YWNrcyAoImJhZCIpIHdpdGhvdXQgc29tZSBwcmlvciBrbm93bGVkZ2UgYW5kIHRydXN0IG9mIHRo ZSBuZXR3b3JrLCBzdWNoIGFzIHByZWluc3RhbGxlZCBjZXJ0aWZpY2F0ZXMuDQoNClNlY3VyZSBk aXNjb3ZlcnkgaXMgcG9zc2libGUgaW4gc2V2ZXJhbCBzY2VuYXJpb3MgYW5kIHRoZSBjbGllbnQg Y2FuIGlkZW50aWZ5L2F1dGhlbnRpY2F0ZSB0aGUgbG9jYWwgRG9IL0RvVCBzZXJ2ZXIsIGZvciBl eGFtcGxlIHNlZSBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtcmVkZHktYWRkLWlv dC1ieW9kLWJvb3RzdHJhcC0wMTxodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtcmVk ZHktYWRkLWlvdC1ieW9kLWJvb3RzdHJhcC0wMD4gYW5kIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcv aHRtbC9kcmFmdC1idHctYWRkLWlwc2VjbWUtaWtlLTAwLiBJbiBkZXBsb3ltZW50cyB3aGVyZSBz ZWN1cmUgZGlzY292ZXJ5IGlzIG5vdCBwb3NzaWJsZSwgY2xpZW50IHZhbGlkYXRpb24gdGVjaG5p cXVlcyBsaWtlIHByZS1jb25maWd1cmVkIFRSUiBvciBjcnlwdG9ncmFwaGljIGFzc2VydGlvbiBv ZiB0aGUgRE5TIHNlcnZlciBpZGVudGl0eSB3b3VsZCBlbnN1cmUgdGhlIGNsaWVudCBkb2VzIG5v dCBjb25uZWN0IHRvIGFuIGF0dGFja2VyJ3MgRG9IL0RvVCBzZXJ2ZXIuDQoNCkFyZ3VhYmx5LCB0 aGVzZSBuZXR3b3JrcyB3aGljaCB3YW50IHRvIHRpZ2h0bHkgY29udHJvbCBuZXR3b3JrIGJlaGF2 aW9yIG91Z2h0IHRvIHRpZ2h0bHkgY29udHJvbCBuZXR3b3JrIGpvaW5pbmcgY2FwYWJpbGl0aWVz IHRvIHByZXZlbnQgdGhpcyBwZXJjZWl2ZWQgbWlzYmVoYXZpb3IuIE90aGVyd2lzZSwgYW55IHNp ZGUgZG9vciB3ZSBidWlsZCBmb3IgTWl0TSB0byBtb3JlIHJlYWRpbHkgYmxvY2svZG93bmdyYWRl IGNvbW11bmljYXRpb24gYmV0d2VlbiBpbnRlbmRlZCBlbmRwb2ludHMgd2lsbCBiZSBhIHNpZGUg ZG9vciBhdHRhY2tlcnMgY2FuIHVzZSBhcyB3ZWxsLg0KDQpJVC1tYW5hZ2VkIGVuZHBvaW50IGRl dmljZXMgY2FuIGJlIHRpZ2h0bHkgY29udHJvbGxlZCBieSBtYW5hZ2VtZW50IHNvZnR3YXJlIGJ1 dCBub3QgQllPRCAod2l0aG91dCBNRE0vY29uZmlndXJhdGlvbiBwcm9maWxlKS4gSW4gZGVwbG95 bWVudHMgbGlrZSBob21lIG5ldHdvcmtzLCB0aGUgbmV0d29yayBzZWN1cml0eSBzZXJ2aWNlIGNv LWxvY2F0ZWQgaW4gdGhlIGhvbWUgcm91dGVyIGhhcyBubyB3YXkgdG8gbWFuYWdlIG9yIHRpZ2h0 bHkgY29udHJvbCBlbmRwb2ludCBhbmQgSW9UIGRldmljZXMuDQoNCi1UaXJ1DQoNCg0KSWYgd2Ug d2FudCB0byBhbGxvdyBuZXR3b3JrcyB0byBnaXZlIG5ldyBhbmQgYXJiaXRyYXJ5IGVuZHBvaW50 cyBhIHRydXN0ZWQgKGRlZmluZWQgYXMgImNsaWVudCBjYW4gc2VjdXJlbHkgZGlzdGluZ3Vpc2gg ZnJvbSBhbiBhcmJpdHJhcnkgYXR0YWNrZXIiKSBzaWduYWwgdGhhdCBhIGdpdmVuIGNvbW11bmlj YXRpb24gbWVjaGFuaXNtIGlzIGZvcmJpZGRlbiwgd2UgKG5vdCB0aGlzIFdHKSBzaG91bGQgd29y ayBvbiB0aGF0IG9uIGEgbGFyZ2VyIHNjYWxlLiBBZnRlciBhbGwsIHN1Y2ggYSBtZWNoYW5pc20g Y291bGQgYmUgdXNlZCB0byBzaWduYWwgbmV0d29yayBvcHBvc2l0aW9uIHRvIFZQTiB0dW5uZWxz LCBUb3IgY29ubmVjdGlvbnMsIG9yIGFueXRoaW5nIGVsc2UgYSBuZXR3b3JrIGZpbmQgb2ZmZW5z aXZlLiBJZiBpdCB3b3JrcyBmb3IgSFRUUFMsIERvSCBzaG91bGQgaW5oZXJpdCB0aGUgYmVuZWZp dHMgZ3JhY2VmdWxseS4NCg0KV2hhdCBJJ20gc2F5aW5nIGlzOiB3ZSBzaG91bGQgbGVhdmUgdGhp cyBkaXNjdXNzaW9uIG9mZiB0aGlzIGxpc3QgYmVjYXVzZSBpdCBpc24ndCBzcGVjaWZpYyB0byBl bmNyeXB0ZWQgRE5TIGFzIG5ldHdvcmtzIG9wcG9zaW5nIGVuY3J5cHRlZCBjb21tdW5pY2F0aW9u IHRvIGFuIGVuZHBvaW50IGhhcyBleGlzdGVkIGJlZm9yZSBEb0ggb3IgRG9ULiBQZXIgdGhlIGNo YXJ0ZXIgcXVvdGUgYmVsb3csIHdlIGNhbiBpbmZvcm0gYWJvdXQgbWVjaGFuaXNtcyBhdmFpbGFi bGUgdG8gZGV0ZWN0IHRoZXNlIG5ldHdvcmsgaW50ZW50aW9ucywgYnV0IEkgd291bGQgc2F5IGNy ZWF0aW9uIG9mIG5ldyBtZWNoYW5pc21zIGlzIGJleW9uZCB0aGUgc2NvcGUgb2YgdGhlIGNoYXJ0 ZXIuIENoYWlycyBjYW4gY29ycmVjdCBtZSBpZiBJIGludGVycHJldGVkIHRoYXQgaW5jb3JyZWN0 bHkuDQoNCj4+IERldmVsb3AgYW4gaW5mb3JtYXRpb25hbCBkb2N1bWVudCB0aGF0IGRlc2NyaWJl cyBtZWNoYW5pc21zIGZvciBjbGllbnRzIHRvIGRldGVjdCBzcGVjaWZpYyBuZXR3b3JrIGVudmly b25tZW50cyAoc3VjaCBhcyBjYXB0aXZlIHBvcnRhbCBhbmQgc3BsaXQgaG9yaXpvbikgYW5kIHRv IHVzZSB0aGF0IGluZm9ybWF0aW9uIHRvIGluZm9ybSB0aGVpciBETlMgY29uZmlndXJhdGlvbi4N Cg0KVGhhbmtzLA0KVG9tbXkgSmVuc2VuDQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT0NClRoZSBsYXRlc3QgaW4gV2luZG93cyBJbnRlcm5ldCBQcm90b2Nv bHM6DQogIE5hdGl2ZSBnUlBDIHN1cHBvcnQ6IGh0dHBzOi8vYWthLm1zL2dycGNibG9ncG9zdA0K ICBETlMgb3ZlciBIVFRQUzogaHR0cHM6Ly9ha2EubXMvZG9oYmxvZ3Bvc3QNCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fDQpGcm9tOiBBZGQgPGFkZC1ib3VuY2VzQGlldGYub3JnPG1h aWx0bzphZGQtYm91bmNlc0BpZXRmLm9yZz4+IG9uIGJlaGFsZiBvZiBUZWQgTGVtb24gPG1lbGxv bkBmdWd1ZS5jb208bWFpbHRvOm1lbGxvbkBmdWd1ZS5jb20+Pg0KU2VudDogTW9uZGF5LCBKdWx5 IDI3LCAyMDIwIDU6MjcgUE0NClRvOiBFcmljIFJlc2NvcmxhIDxla3JAcnRmbS5jb208bWFpbHRv OmVrckBydGZtLmNvbT4+DQpDYzogYWRkQGlldGYub3JnPG1haWx0bzphZGRAaWV0Zi5vcmc+IDxh ZGRAaWV0Zi5vcmc8bWFpbHRvOmFkZEBpZXRmLm9yZz4+OyBQYXVsIFZpeGllIDxwYXVsQHJlZGJh cm4ub3JnPG1haWx0bzpwYXVsQHJlZGJhcm4ub3JnPj47IFNUQVJLLCBCQVJCQVJBIEggPGJzNzY1 MkBhdHQuY29tPG1haWx0bzpiczc2NTJAYXR0LmNvbT4+OyBSb2IgU2F5cmUgPHNheXJlckBnbWFp bC4uY29tPjxtYWlsdG86c2F5cmVyQGdtYWlsLi5jb20+DQpTdWJqZWN0OiBbRVhURVJOQUxdIFJl OiBbQWRkXSBOZXcgVmVyc2lvbiBOb3RpZmljYXRpb24gZm9yIGRyYWZ0LXBhdWx5LWFkZC1yZXNv bHZlci1kaXNjb3ZlcnktMDEudHh0DQoNCk9uIEp1bCAyNywgMjAyMCwgYXQgODoxMSBQTSwgRXJp YyBSZXNjb3JsYSA8ZWtyQHJ0Zm0uY29tPG1haWx0bzpla3JAcnRmbS4uY29tPj4gd3JvdGU6DQpp biBjb3VudGVycG9pbnQsIGFyZ3VtZW50cyBpbiBmYXZvdXIgb2YgdGhlIGRlbGliZXJhdGUgZW50 cm9weSBvZiBEb0ggaGF2ZQ0Kc29tZXRpbWVzIHRha2VuIHRoZSBmb3JtICJpZiB3ZSBtYWtlIHRo aXMgZWFzeSB0byBkZXRlY3QsIHRoZW4gaXQgd2lsbCBiZQ0Kd2lkZWx5IGJsb2NrZWQiLCB3aGlj aCBwcmVzdW1lcyB0aGF0IHRoZSBhbHRlcm5hdGl2ZSBjb3N0IG9mIGJsb2NraW5nIERvSCBjYW4N CmJlIGFydGlmaWNpYWxseSByYWlzZWQgYWJvdmUgdGhlIGFjY2VwdGVkIHJpc2tzIG9mIG5vdCBi bG9ja2luZyBpdC4NCg0KWWVzLCB0aGF0IGlzIHRoZSBhcmd1bWVudCwgYW5kIGl0IG1ha2VzIHNl bnNlLiBJZiB3ZSBtYWtlIERvSCBlYXN5IHRvIGRldGVjdCwgdGhlbiB0aGVyZSBpcyBubyBwb2lu dCBpbiBoYXZpbmcgRG9IOiBpdCBzZXJ2ZXMgbm8gcHVycG9zZS4NCg0KRnJvbSBteSBwZXJzcGVj dGl2ZSwgdGhpcyBpcyBub3QgY29ycmVjdC4NCg0KRG9IIGhhcyBhIG51bWJlciBvZiB0ZWNobmlj YWwgYWR2YW50YWdlcyBvdmVyIERvVCAoZm9yIGluc3RhbmNlIHRoZSBhYmlsaXR5IHRvIHVzZSBB bHQtU3ZjIHRvIHVwZ3JhZGUgdG8gRG9IMykuIE9mIGNvdXJzZSwgb25lIG1pZ2h0IG9yIG1pZ2h0 IG5vdCB2YWx1ZSB0aGVzZSBiZW5lZml0cyBhZ2FpbnN0IGhhdmluZyB0d28gcHJvdG9jb2xzLCBi dXQgdGhhdCdzIG5vdCBxdWl0ZSB0aGUgc2FtZSB0aGluZy4NCg0KT2theSwgZmFpciBwb2ludCwg RG9IIGNhbiBqdXN0IGJlIGEgYmV0dGVyIHByb3RvY29sIGFzIHdlbGwgYXMgYmVpbmcgYSB3YXkg dG8gZ2V0IHByaXZhY3kuIEEgYmV0dGVyIHdheSB0byBoYXZlIHB1dCB0aGF0IHdvdWxkIGJlIHRo YXQgbWFraW5nIERvSCBlYXN5IHRvIGRldGVjdCBibG9ja3Mgb25lIG9mIHRoZSBtYWluIGJlbmVm aXRzIG9mIERvSDogdGhhdCBpdCBnaXZlcyB0aGUgdXNlciBwcml2YWN5IGZyb20gb24tcGF0aCBz bm9vcGVycyBpbiBhIHdheSB0aGF0IGNhbuKAmXQgYmUgZWFzaWx5IGJsb2NrZWQuDQoNCg0KLS0N CkFkZCBtYWlsaW5nIGxpc3QNCkFkZEBpZXRmLm9yZzxtYWlsdG86QWRkQGlldGYub3JnPg0KaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hZGQNCg0KDQo= --_000_2c1c2ca8f6ba0f785e6ad86658c05453ericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <7CFBD5FA4AEB6E4A8E3183B256776E81@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5Pg0KPHA+Qm90aCB0aGUg ZHJhZnRzIG9ubHkgdmFsaWRhdGUgd2hhdCBUb21teSBzYWlkICdZb3UgbmVlZCBzb21lIHByaW9y IGtub3dsZWRnZSBhbmQgdHJ1c3Qgb2YgdGhlIG5ldHdvcmsnLjxicj4NCjxicj4NCmRyYWZ0LXJl ZGR5LWFkZC1pb3QtYnlvZC1ib290c3RyYXA6IHNlY3Rpb24gNCBzYXlzICZxdW90O1RoZSBlbmRw b2ludCBhdXRoZW50aWNhdGVzIHRvIHRoZSBsb2NhbCBuZXR3b3JrIGFuZCBkaXNjb3ZlcnMgdGhl IEVucm9sbG1lbnQgb3ZlciBTZWN1cmUgVHJhbnNwb3J0IChFU1QpJnF1b3Q7IGFuZCBhbHNvICZx dW90O3RoZSBlbmRwb2ludCBNVVNUIGF1dGhlbnRpY2F0ZSB0aGUgRVNUIHNlcnZlciBiZWZvcmUg aXQgYWNjZXB0cyB0aGUgRE5TIHNlcnZlciBjZXJ0aWZpY2F0ZS4mcXVvdDsuDQogVGhpcyBpbXBs aWVzIHRoYXQgeW91IG5lZWQgc29tZSBwcmlvciBrbm93bGVkZ2Ugb2YgdGhlIG5ldHdvcmsgdG8g ZXN0YWJsaXNoIHRydXN0LiBTZWN0aW9uIDUgZG9lcyBhIGNvbXBsZXggaW5kaXJlY3Rpb24gYW5k IGluc3RlYWQgb2YgZGlyZWN0bHkgYXV0aGVudGljYXRpbmcgdGhlIG5ldHdvcmssIGl0IHJlbGll cyBvbiB0aGUgbWFudWZhY3R1cmVyIHRvIGNvbmZpcm0gaWYgdGhlIG5ldHdvcmsgaXMgY29ycmVj dC48YnI+DQo8YnI+DQpkcmFmdC1idHctYWRkLWlwc2VjbWUtaWtlOiB5b3UgbmVlZCBzb21lIGNy ZWRlbnRpYWxzIGZvciBzZXR0aW5nIHVwIHRoZSBJUFNlYyB0dW5uZWwuPGJyPg0KPGJyPg0KLS1N b2hpdDwvcD4NCjxkaXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+T24gNy8yOC8yMCAzOjIzIFBN LCB0aXJ1bWFsIHJlZGR5IHdyb3RlOjxicj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgdHlwZT0iY2l0 ZSIgY2l0ZT0ibWlkOkNBRnBHM2dkZm85RWcrMXBTWjFDaTA3aTlBc21iaDJxUXFDaEhBK01SND1O VGttVm54QUBtYWlsLmdtYWlsLmNvbSI+DQo8ZGl2IGRpcj0ibHRyIj4NCjxkaXYgZGlyPSJsdHIi Pk9uIFR1ZSwgMjggSnVsIDIwMjAgYXQgMDA6NDQsIFRvbW15IEplbnNlbiAmbHQ7SmVuc2VuLlRo b21hcz08YSBocmVmPSJtYWlsdG86NDBtaWNyb3NvZnQuY29tQGRtYXJjLmlldGYub3JnIiBtb3ot ZG8tbm90LXNlbmQ9InRydWUiPjQwbWljcm9zb2Z0LmNvbUBkbWFyYy5pZXRmLm9yZzwvYT4mZ3Q7 IHdyb3RlOjxicj4NCjwvZGl2Pg0KPGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPg0KPGJsb2NrcXVv dGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjBweCAwcHggMHB4DQogICAgICAg ICAgICAwLjhleDtib3JkZXItbGVmdDoxcHggc29saWQNCiAgICAgICAgICAgIHJnYigyMDQsMjA0 LDIwNCk7cGFkZGluZy1sZWZ0OjFleCI+DQo8ZGl2IGRpcj0ibHRyIj4NCjxkaXYgc3R5bGU9ImZv bnQtZmFtaWx5OkNhbGlicmksQXJpYWwsSGVsdmV0aWNhLHNhbnMtc2VyaWY7Zm9udC1zaXplOjEy cHQ7Y29sb3I6cmdiKDAsMCwwKTtiYWNrZ3JvdW5kLWNvbG9yOnJnYigyNTUsMjU1LDI1NSkiPg0K PGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaSxBcmlhbCxIZWx2ZXRpY2Esc2Fucy1zZXJp Zjtmb250LXNpemU6MTJwdDtjb2xvcjpyZ2IoMCwwLDApO2JhY2tncm91bmQtY29sb3I6cmdiKDI1 NSwyNTUsMjU1KSI+DQooKzEgdG8gZWtyJ3MgcG9pbnQpJm5ic3A7PC9kaXY+DQo8ZGl2IHN0eWxl PSJmb250LWZhbWlseTpDYWxpYnJpLEFyaWFsLEhlbHZldGljYSxzYW5zLXNlcmlmO2ZvbnQtc2l6 ZToxMnB0O2NvbG9yOnJnYigwLDAsMCk7YmFja2dyb3VuZC1jb2xvcjpyZ2IoMjU1LDI1NSwyNTUp Ij4NCjxicj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaSxBcmlhbCxI ZWx2ZXRpY2Esc2Fucy1zZXJpZjtmb250LXNpemU6MTJwdDtjb2xvcjpyZ2IoMCwwLDApO2JhY2tn cm91bmQtY29sb3I6cmdiKDI1NSwyNTUsMjU1KSI+DQpJIGFncmVlIHdpdGggVGVkOiB3ZSBzaG91 bGRuJ3QgZ28gd2Vha2VuaW5nIHN0cm9uZyBlbmQtdG8tZW5kIGVuY3J5cHRlZCBwcm90b2NvbHMg b24gcHVycG9zZS4gRnJvbSBhbiBlbmRwb2ludCdzIHBlcnNwZWN0aXZlLCB0aGVyZSBpcyBubyBh dXRob3JpdGF0aXZlIHdheSB0byBkaXN0aW5ndWlzaCBiZXR3ZWVuIG5ldHdvcmsgYWRtaW5pc3Ry YXRpb24gKCZxdW90O2dvb2QmcXVvdDspIGFuZCBuZXR3b3JrIGF0dGFja3MgKCZxdW90O2JhZCZx dW90Oykgd2l0aG91dCBzb21lIHByaW9yDQoga25vd2xlZGdlIGFuZCB0cnVzdCBvZiB0aGUgbmV0 d29yaywgc3VjaCBhcyBwcmVpbnN0YWxsZWQgY2VydGlmaWNhdGVzLiA8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pjxicj4NCjwvZGl2Pg0KPGRpdj5TZWN1cmUgZGlz Y292ZXJ5IGlzIHBvc3NpYmxlIGluIHNldmVyYWwgc2NlbmFyaW9zIGFuZCB0aGUgY2xpZW50IGNh biBpZGVudGlmeS9hdXRoZW50aWNhdGUgdGhlIGxvY2FsIERvSC9Eb1Qgc2VydmVyLCBmb3IgZXhh bXBsZSBzZWUmbmJzcDs8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQt cmVkZHktYWRkLWlvdC1ieW9kLWJvb3RzdHJhcC0wMCIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5o dHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtcmVkZHktYWRkLWlvdC1ieW9kLWJvb3Rz dHJhcC0wMTwvYT4mbmJzcDthbmQmbmJzcDs8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3Jn L2h0bWwvZHJhZnQtYnR3LWFkZC1pcHNlY21lLWlrZS0wMCIgbW96LWRvLW5vdC1zZW5kPSJ0cnVl Ij5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtYnR3LWFkZC1pcHNlY21lLWlrZS0w MDwvYT4uDQogSW4gZGVwbG95bWVudHMgd2hlcmUgc2VjdXJlIGRpc2NvdmVyeSBpcyBub3QgcG9z c2libGUsIGNsaWVudCB2YWxpZGF0aW9uIHRlY2huaXF1ZXMgbGlrZSBwcmUtY29uZmlndXJlZCBU UlIgb3IgY3J5cHRvZ3JhcGhpYyBhc3NlcnRpb24gb2YgdGhlIEROUyBzZXJ2ZXIgaWRlbnRpdHkg d291bGQgZW5zdXJlIHRoZSZuYnNwO2NsaWVudCBkb2VzIG5vdCBjb25uZWN0IHRvIGFuIGF0dGFj a2VyJ3MgRG9IL0RvVCBzZXJ2ZXIuPC9kaXY+DQo8ZGl2PiZuYnNwOzwvZGl2Pg0KPGJsb2NrcXVv dGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjBweCAwcHggMHB4DQogICAgICAg ICAgICAwLjhleDtib3JkZXItbGVmdDoxcHggc29saWQNCiAgICAgICAgICAgIHJnYigyMDQsMjA0 LDIwNCk7cGFkZGluZy1sZWZ0OjFleCI+DQo8ZGl2IGRpcj0ibHRyIj4NCjxkaXYgc3R5bGU9ImZv bnQtZmFtaWx5OkNhbGlicmksQXJpYWwsSGVsdmV0aWNhLHNhbnMtc2VyaWY7Zm9udC1zaXplOjEy cHQ7Y29sb3I6cmdiKDAsMCwwKTtiYWNrZ3JvdW5kLWNvbG9yOnJnYigyNTUsMjU1LDI1NSkiPg0K PGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaSxBcmlhbCxIZWx2ZXRpY2Esc2Fucy1zZXJp Zjtmb250LXNpemU6MTJwdDtjb2xvcjpyZ2IoMCwwLDApO2JhY2tncm91bmQtY29sb3I6cmdiKDI1 NSwyNTUsMjU1KSI+DQpBcmd1YWJseSwgdGhlc2UgbmV0d29ya3Mgd2hpY2ggd2FudCB0byB0aWdo dGx5IGNvbnRyb2wgbmV0d29yayBiZWhhdmlvciBvdWdodCB0byB0aWdodGx5IGNvbnRyb2wgbmV0 d29yayBqb2luaW5nIGNhcGFiaWxpdGllcyB0byBwcmV2ZW50IHRoaXMgcGVyY2VpdmVkIG1pc2Jl aGF2aW9yLiBPdGhlcndpc2UsIGFueSBzaWRlIGRvb3Igd2UgYnVpbGQgZm9yIE1pdE0gdG8gbW9y ZSByZWFkaWx5IGJsb2NrL2Rvd25ncmFkZSBjb21tdW5pY2F0aW9uIGJldHdlZW4NCiBpbnRlbmRl ZCBlbmRwb2ludHMgd2lsbCBiZSBhIHNpZGUgZG9vciBhdHRhY2tlcnMgY2FuIHVzZSBhcyB3ZWxs LjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+PGJyPg0KPC9kaXY+ DQo8ZGl2PklULW1hbmFnZWQgZW5kcG9pbnQgZGV2aWNlcyBjYW4gYmUgdGlnaHRseSBjb250cm9s bGVkIGJ5IG1hbmFnZW1lbnQgc29mdHdhcmUgYnV0IG5vdCBCWU9EICh3aXRob3V0IE1ETS9jb25m aWd1cmF0aW9uIHByb2ZpbGUpLiBJbiBkZXBsb3ltZW50cyBsaWtlIGhvbWUgbmV0d29ya3MsIHRo ZSBuZXR3b3JrIHNlY3VyaXR5IHNlcnZpY2UgY28tbG9jYXRlZCBpbiB0aGUgaG9tZSByb3V0ZXIg aGFzIG5vIHdheSB0byBtYW5hZ2Ugb3IgdGlnaHRseQ0KIGNvbnRyb2wgZW5kcG9pbnQgYW5kIElv VCBkZXZpY2VzLiZuYnNwOzwvZGl2Pg0KPGRpdj48YnI+DQo8L2Rpdj4NCjxkaXY+LVRpcnU8L2Rp dj4NCjxkaXY+Jm5ic3A7PC9kaXY+DQo8YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0 eWxlPSJtYXJnaW46MHB4IDBweCAwcHgNCiAgICAgICAgICAgIDAuOGV4O2JvcmRlci1sZWZ0OjFw eCBzb2xpZA0KICAgICAgICAgICAgcmdiKDIwNCwyMDQsMjA0KTtwYWRkaW5nLWxlZnQ6MWV4Ij4N CjxkaXYgZGlyPSJsdHIiPg0KPGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaSxBcmlhbCxI ZWx2ZXRpY2Esc2Fucy1zZXJpZjtmb250LXNpemU6MTJwdDtjb2xvcjpyZ2IoMCwwLDApO2JhY2tn cm91bmQtY29sb3I6cmdiKDI1NSwyNTUsMjU1KSI+DQo8ZGl2IHN0eWxlPSJmb250LWZhbWlseTpD YWxpYnJpLEFyaWFsLEhlbHZldGljYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZToxMnB0O2NvbG9yOnJn YigwLDAsMCk7YmFja2dyb3VuZC1jb2xvcjpyZ2IoMjU1LDI1NSwyNTUpIj4NCjxicj4NCjwvZGl2 Pg0KPGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaSxBcmlhbCxIZWx2ZXRpY2Esc2Fucy1z ZXJpZjtmb250LXNpemU6MTJwdDtjb2xvcjpyZ2IoMCwwLDApO2JhY2tncm91bmQtY29sb3I6cmdi KDI1NSwyNTUsMjU1KSI+DQpJZiB3ZSB3YW50IHRvIGFsbG93IG5ldHdvcmtzIHRvIGdpdmUgbmV3 IGFuZCBhcmJpdHJhcnkgZW5kcG9pbnRzIGEgdHJ1c3RlZCAoZGVmaW5lZCBhcyAmcXVvdDtjbGll bnQgY2FuIHNlY3VyZWx5IGRpc3Rpbmd1aXNoIGZyb20gYW4gYXJiaXRyYXJ5IGF0dGFja2VyJnF1 b3Q7KSBzaWduYWwgdGhhdCBhIGdpdmVuIGNvbW11bmljYXRpb24gbWVjaGFuaXNtIGlzIGZvcmJp ZGRlbiwgd2UgKG5vdCB0aGlzIFdHKSBzaG91bGQgd29yayBvbiB0aGF0IG9uIGEgbGFyZ2VyIHNj YWxlLg0KIEFmdGVyIGFsbCwgc3VjaCBhIG1lY2hhbmlzbSBjb3VsZCBiZSB1c2VkIHRvIHNpZ25h bCBuZXR3b3JrIG9wcG9zaXRpb24gdG8gVlBOIHR1bm5lbHMsIFRvciBjb25uZWN0aW9ucywgb3Ig YW55dGhpbmcgZWxzZSBhIG5ldHdvcmsgZmluZCBvZmZlbnNpdmUuIElmIGl0IHdvcmtzIGZvciBI VFRQUywgRG9IIHNob3VsZCBpbmhlcml0IHRoZSBiZW5lZml0cyBncmFjZWZ1bGx5LiZuYnNwOzwv ZGl2Pg0KPGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaSxBcmlhbCxIZWx2ZXRpY2Esc2Fu cy1zZXJpZjtmb250LXNpemU6MTJwdDtjb2xvcjpyZ2IoMCwwLDApO2JhY2tncm91bmQtY29sb3I6 cmdiKDI1NSwyNTUsMjU1KSI+DQo8YnI+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5 OkNhbGlicmksQXJpYWwsSGVsdmV0aWNhLHNhbnMtc2VyaWY7Zm9udC1zaXplOjEycHQ7Y29sb3I6 cmdiKDAsMCwwKTtiYWNrZ3JvdW5kLWNvbG9yOnJnYigyNTUsMjU1LDI1NSkiPg0KV2hhdCBJJ20g c2F5aW5nIGlzOiB3ZSBzaG91bGQgbGVhdmUgdGhpcyBkaXNjdXNzaW9uIG9mZiB0aGlzIGxpc3Qg YmVjYXVzZSBpdCBpc24ndCBzcGVjaWZpYyB0byBlbmNyeXB0ZWQgRE5TIGFzIG5ldHdvcmtzIG9w cG9zaW5nIGVuY3J5cHRlZCBjb21tdW5pY2F0aW9uIHRvIGFuIGVuZHBvaW50IGhhcyBleGlzdGVk IGJlZm9yZSBEb0ggb3IgRG9ULiBQZXIgdGhlIGNoYXJ0ZXIgcXVvdGUgYmVsb3csIHdlIGNhbiBp bmZvcm0gYWJvdXQgbWVjaGFuaXNtcw0KIGF2YWlsYWJsZSB0byBkZXRlY3QgdGhlc2UgbmV0d29y ayBpbnRlbnRpb25zLCBidXQgSSB3b3VsZCBzYXkgY3JlYXRpb24gb2YgbmV3IG1lY2hhbmlzbXMg aXMgYmV5b25kIHRoZSBzY29wZSBvZiB0aGUgY2hhcnRlci4gQ2hhaXJzIGNhbiBjb3JyZWN0IG1l IGlmIEkgaW50ZXJwcmV0ZWQgdGhhdCBpbmNvcnJlY3RseS48L2Rpdj4NCjxkaXYgc3R5bGU9ImZv bnQtZmFtaWx5OkNhbGlicmksQXJpYWwsSGVsdmV0aWNhLHNhbnMtc2VyaWY7Zm9udC1zaXplOjEy cHQ7Y29sb3I6cmdiKDAsMCwwKTtiYWNrZ3JvdW5kLWNvbG9yOnJnYigyNTUsMjU1LDI1NSkiPg0K PGJyPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJmb250LWZhbWlseTpDYWxpYnJpLEFyaWFsLEhlbHZl dGljYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZToxMnB0O2NvbG9yOnJnYigwLDAsMCk7YmFja2dyb3Vu ZC1jb2xvcjpyZ2IoMjU1LDI1NSwyNTUpIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjpyZ2IoMCwwLDAp O2ZvbnQtZmFtaWx5OkNhbGlicmk7Zm9udC1zaXplOjE0LjY2NjdweDtiYWNrZ3JvdW5kLWNvbG9y OnJnYigyNTUsMjU1LDI1NSk7ZGlzcGxheTppbmxpbmUiPiZndDsmZ3Q7IERldmVsb3AgYW4gaW5m b3JtYXRpb25hbCBkb2N1bWVudCB0aGF0IGRlc2NyaWJlcyBtZWNoYW5pc21zIGZvciZuYnNwOzwv c3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6cmdiKDAsMCwwKTtmb250LWZhbWlseTpDYWxpYnJpO2Zv bnQtc2l6ZToxNC42NjY3cHg7YmFja2dyb3VuZC1jb2xvcjpyZ2IoMjU1LDI1NSwyNTUpO2Rpc3Bs YXk6aW5saW5lIj5jbGllbnRzDQogdG8gZGV0ZWN0IHNwZWNpZmljIG5ldHdvcmsgZW52aXJvbm1l bnRzIChzdWNoIGFzIGNhcHRpdmUgcG9ydGFsJm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xv cjpyZ2IoMCwwLDApO2ZvbnQtZmFtaWx5OkNhbGlicmk7Zm9udC1zaXplOjE0LjY2NjdweDtiYWNr Z3JvdW5kLWNvbG9yOnJnYigyNTUsMjU1LDI1NSk7ZGlzcGxheTppbmxpbmUiPmFuZCBzcGxpdCBo b3Jpem9uKSBhbmQgdG8gdXNlIHRoYXQgaW5mb3JtYXRpb24gdG8gaW5mb3JtIHRoZWlyIEROUyZu YnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6cmdiKDAsMCwwKTtmb250LWZhbWlseTpDYWxp YnJpO2ZvbnQtc2l6ZToxNC42NjY3cHg7YmFja2dyb3VuZC1jb2xvcjpyZ2IoMjU1LDI1NSwyNTUp O2Rpc3BsYXk6aW5saW5lIj5jb25maWd1cmF0aW9uLjwvc3Bhbj48YnI+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OkNhbGlicmksQXJpYWwsSGVsdmV0aWNh LHNhbnMtc2VyaWY7Zm9udC1zaXplOjEycHQ7Y29sb3I6cmdiKDAsMCwwKSI+DQo8YnI+DQo8L2Rp dj4NCjxkaXYgaWQ9ImdtYWlsLW1fLTUyNzYxNzk3MTQ0MTU2MTA2MjZTaWduYXR1cmUiPg0KPGRp dj4NCjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OkNhbGlicmksQXJpYWwsSGVsdmV0aWNhLHNhbnMt c2VyaWY7Zm9udC1zaXplOjEycHQ7Y29sb3I6cmdiKDAsMCwwKSI+DQo8c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6Q2FsaWJyaSxIZWx2ZXRpY2Esc2Fucy1zZXJpZiI+VGhhbmtzLDwvc3Bhbj48L2Rp dj4NCjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OkNhbGlicmksQXJpYWwsSGVsdmV0aWNhLHNhbnMt c2VyaWY7Zm9udC1zaXplOjEycHQ7Y29sb3I6cmdiKDAsMCwwKSI+DQo8c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6Q2FsaWJyaSxIZWx2ZXRpY2Esc2Fucy1zZXJpZiI+VG9tbXkgSmVuc2VuPC9zcGFu PjwvZGl2Pg0KPGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaSxBcmlhbCxIZWx2ZXRpY2Es c2Fucy1zZXJpZjtmb250LXNpemU6MTJwdDtjb2xvcjpyZ2IoMCwwLDApIj4NCjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTpDb25zb2xhcyxDb3VyaWVyLG1vbm9zcGFjZSI+PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PC9zcGFuPjwvZGl2Pg0KPGRpdiBzdHls ZT0iZm9udC1mYW1pbHk6Q2FsaWJyaSxBcmlhbCxIZWx2ZXRpY2Esc2Fucy1zZXJpZjtmb250LXNp emU6MTJwdDtjb2xvcjpyZ2IoMCwwLDApIj4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb25z b2xhcyxDb3VyaWVyLG1vbm9zcGFjZSI+VGhlIGxhdGVzdCBpbiBXaW5kb3dzIEludGVybmV0IFBy b3RvY29sczo8L3NwYW4+PC9kaXY+DQo8ZGl2IHN0eWxlPSJmb250LWZhbWlseTpDYWxpYnJpLEFy aWFsLEhlbHZldGljYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZToxMnB0O2NvbG9yOnJnYigwLDAsMCki Pg0KPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvbnNvbGFzLENvdXJpZXIsbW9ub3NwYWNlIj4m bmJzcDsgTmF0aXZlIGdSUEMgc3VwcG9ydDogPC9zcGFuPg0KPGEgaHJlZj0iaHR0cHM6Ly9ha2Eu bXMvZ3JwY2Jsb2dwb3N0IiB0YXJnZXQ9Il9ibGFuayIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q29uc29sYXMsQ291cmllcixtb25vc3BhY2UiPmh0dHBz Oi8vYWthLm1zL2dycGNibG9ncG9zdDwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OkNvbnNvbGFzLENvdXJpZXIsbW9ub3NwYWNlIj4mbmJzcDs8L3NwYW4+PC9kaXY+DQo8ZGl2IHN0 eWxlPSJmb250LWZhbWlseTpDYWxpYnJpLEFyaWFsLEhlbHZldGljYSxzYW5zLXNlcmlmO2ZvbnQt c2l6ZToxMnB0O2NvbG9yOnJnYigwLDAsMCkiPg0KPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNv bnNvbGFzLENvdXJpZXIsbW9ub3NwYWNlIj4mbmJzcDsgRE5TIG92ZXIgSFRUUFM6Jm5ic3A7PC9z cGFuPjxhIGhyZWY9Imh0dHBzOi8vYWthLm1zL2RvaGJsb2dwb3N0IiB0YXJnZXQ9Il9ibGFuayIg bW96LWRvLW5vdC1zZW5kPSJ0cnVlIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q29uc29sYXMs Q291cmllcixtb25vc3BhY2UiPmh0dHBzOi8vYWthLm1zL2RvaGJsb2dwb3N0PC9zcGFuPjwvYT48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q29uc29sYXMsQ291cmllcixtb25vc3BhY2UiPiZuYnNw Ozwvc3Bhbj48L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxociBzdHlsZT0iZGlzcGxh eTppbmxpbmUtYmxvY2s7d2lkdGg6OTglIj4NCjxkaXYgaWQ9ImdtYWlsLW1fLTUyNzYxNzk3MTQ0 MTU2MTA2MjZkaXZScGx5RndkTXNnIiBkaXI9Imx0ciI+PGZvbnQgc3R5bGU9ImZvbnQtc2l6ZTox MXB0IiBmYWNlPSJDYWxpYnJpLA0KICAgICAgICAgICAgICAgICAgc2Fucy1zZXJpZiIgY29sb3I9 IiMwMDAwMDAiPjxiPkZyb206PC9iPiBBZGQgJmx0OzxhIGhyZWY9Im1haWx0bzphZGQtYm91bmNl c0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+YWRkLWJv dW5jZXNAaWV0Zi5vcmc8L2E+Jmd0Ow0KIG9uIGJlaGFsZiBvZiBUZWQgTGVtb24gJmx0OzxhIGhy ZWY9Im1haWx0bzptZWxsb25AZnVndWUuY29tIiB0YXJnZXQ9Il9ibGFuayIgbW96LWRvLW5vdC1z ZW5kPSJ0cnVlIj5tZWxsb25AZnVndWUuY29tPC9hPiZndDs8YnI+DQo8Yj5TZW50OjwvYj4gTW9u ZGF5LCBKdWx5IDI3LCAyMDIwIDU6MjcgUE08YnI+DQo8Yj5Ubzo8L2I+IEVyaWMgUmVzY29ybGEg Jmx0OzxhIGhyZWY9Im1haWx0bzpla3JAcnRmbS5jb20iIHRhcmdldD0iX2JsYW5rIiBtb3otZG8t bm90LXNlbmQ9InRydWUiPmVrckBydGZtLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiA8YSBo cmVmPSJtYWlsdG86YWRkQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayIgbW96LWRvLW5vdC1zZW5k PSJ0cnVlIj5hZGRAaWV0Zi5vcmc8L2E+ICZsdDs8YSBocmVmPSJtYWlsdG86YWRkQGlldGYub3Jn IiB0YXJnZXQ9Il9ibGFuayIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5hZGRAaWV0Zi5vcmc8L2E+ Jmd0OzsgUGF1bCBWaXhpZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBhdWxAcmVkYmFybi5vcmciIHRh cmdldD0iX2JsYW5rIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPnBhdWxAcmVkYmFybi5vcmc8L2E+ Jmd0OzsNCiBTVEFSSywgQkFSQkFSQSBIICZsdDs8YSBocmVmPSJtYWlsdG86YnM3NjUyQGF0dC5j b20iIHRhcmdldD0iX2JsYW5rIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPmJzNzY1MkBhdHQuY29t PC9hPiZndDs7IFJvYiBTYXlyZQ0KPGEgY2xhc3M9Im1vei10eHQtbGluay1yZmMyMzk2RSIgaHJl Zj0ibWFpbHRvOnNheXJlckBnbWFpbC4uY29tIj4mbHQ7c2F5cmVyQGdtYWlsLi5jb20mZ3Q7PC9h Pjxicj4NCjxiPlN1YmplY3Q6PC9iPiBbRVhURVJOQUxdIFJlOiBbQWRkXSBOZXcgVmVyc2lvbiBO b3RpZmljYXRpb24gZm9yIGRyYWZ0LXBhdWx5LWFkZC1yZXNvbHZlci1kaXNjb3ZlcnktMDEudHh0 PC9mb250Pg0KPGRpdj4mbmJzcDs8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ib3ZlcmZsb3ct d3JhcDogYnJlYWstd29yZDsiPk9uIEp1bCAyNywgMjAyMCwgYXQgODoxMSBQTSwgRXJpYyBSZXNj b3JsYSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmVrckBydGZtLi5jb20iIHRhcmdldD0iX2JsYW5rIiBt b3otZG8tbm90LXNlbmQ9InRydWUiPmVrckBydGZtLmNvbTwvYT4mZ3Q7IHdyb3RlOg0KPGRpdj4N CjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2IGRpcj0ibHRyIj4N CjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luOjBweCAwcHggMHB4DQogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAwLjhleDtib3JkZXItbGVmdDoxcHggc29saWQNCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHJnYigyMDQsMjA0LDIwNCk7cGFkZGluZy1sZWZ0OjFleCI+ DQo8ZGl2Pg0KPGRpdj4NCjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIHN0eWxlPSJmb250LWZhbWls eTpIZWx2ZXRpY2E7Zm9udC1zaXplOjE0cHg7Zm9udC1zdHlsZTpub3JtYWw7Zm9udC12YXJpYW50 LWNhcHM6bm9ybWFsO2ZvbnQtd2VpZ2h0Om5vcm1hbDtsZXR0ZXItc3BhY2luZzpub3JtYWw7dGV4 dC1hbGlnbjpzdGFydDt0ZXh0LWluZGVudDowcHg7dGV4dC10cmFuc2Zvcm06bm9uZTt3aGl0ZS1z cGFjZTpub3JtYWw7d29yZC1zcGFjaW5nOjBweDt0ZXh0LWRlY29yYXRpb246bm9uZSI+DQo8c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6TWVubG8tUmVndWxhciI+aW4gY291bnRlcnBvaW50LCBhcmd1 bWVudHMgaW4gZmF2b3VyIG9mIHRoZSBkZWxpYmVyYXRlIGVudHJvcHkgb2YgRG9IIGhhdmUmbmJz cDs8L3NwYW4+PGJyIHN0eWxlPSJmb250LWZhbWlseTpNZW5sby1SZWd1bGFyIj4NCjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTpNZW5sby1SZWd1bGFyIj5zb21ldGltZXMgdGFrZW4gdGhlIGZvcm0g JnF1b3Q7aWYgd2UgbWFrZSB0aGlzIGVhc3kgdG8gZGV0ZWN0LCB0aGVuIGl0IHdpbGwgYmUmbmJz cDs8L3NwYW4+PGJyIHN0eWxlPSJmb250LWZhbWlseTpNZW5sby1SZWd1bGFyIj4NCjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTpNZW5sby1SZWd1bGFyIj53aWRlbHkgYmxvY2tlZCZxdW90Oywgd2hp Y2ggcHJlc3VtZXMgdGhhdCB0aGUgYWx0ZXJuYXRpdmUgY29zdCBvZiBibG9ja2luZyBEb0ggY2Fu Jm5ic3A7PC9zcGFuPjxiciBzdHlsZT0iZm9udC1mYW1pbHk6TWVubG8tUmVndWxhciI+DQo8c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6TWVubG8tUmVndWxhciI+YmUgYXJ0aWZpY2lhbGx5IHJhaXNl ZCBhYm92ZSB0aGUgYWNjZXB0ZWQgcmlza3Mgb2Ygbm90IGJsb2NraW5nIGl0Ljwvc3Bhbj48L2Js b2NrcXVvdGU+DQo8YnIgc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYTtmb250LXNpemU6MTRw eDtmb250LXN0eWxlOm5vcm1hbDtmb250LXZhcmlhbnQtY2Fwczpub3JtYWw7Zm9udC13ZWlnaHQ6 bm9ybWFsO2xldHRlci1zcGFjaW5nOm5vcm1hbDt0ZXh0LWFsaWduOnN0YXJ0O3RleHQtaW5kZW50 OjBweDt0ZXh0LXRyYW5zZm9ybTpub25lO3doaXRlLXNwYWNlOm5vcm1hbDt3b3JkLXNwYWNpbmc6 MHB4O3RleHQtZGVjb3JhdGlvbjpub25lIj4NCjwvZGl2Pg0KPGRpdj5ZZXMsIHRoYXQgaXMgdGhl IGFyZ3VtZW50LCBhbmQgaXQgbWFrZXMgc2Vuc2UuIElmIHdlIG1ha2UgRG9IIGVhc3kgdG8gZGV0 ZWN0LCB0aGVuIHRoZXJlIGlzIG5vIHBvaW50IGluIGhhdmluZyBEb0g6IGl0IHNlcnZlcyBubyBw dXJwb3NlLjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pjxicj4NCjwvZGl2Pg0K PGRpdj5Gcm9tIG15IHBlcnNwZWN0aXZlLCB0aGlzIGlzIG5vdCBjb3JyZWN0LjwvZGl2Pg0KPGRp dj48YnI+DQo8L2Rpdj4NCjxkaXY+RG9IIGhhcyBhIG51bWJlciBvZiB0ZWNobmljYWwgYWR2YW50 YWdlcyBvdmVyIERvVCAoZm9yIGluc3RhbmNlIHRoZSBhYmlsaXR5IHRvIHVzZSBBbHQtU3ZjIHRv IHVwZ3JhZGUgdG8gRG9IMykuIE9mIGNvdXJzZSwgb25lIG1pZ2h0IG9yIG1pZ2h0IG5vdCB2YWx1 ZSB0aGVzZSBiZW5lZml0cyBhZ2FpbnN0IGhhdmluZyB0d28gcHJvdG9jb2xzLCBidXQgdGhhdCdz IG5vdCBxdWl0ZSB0aGUgc2FtZSB0aGluZy48L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGJyPg0KPC9kaXY+DQo8ZGl2Pk9rYXksIGZhaXIgcG9p bnQsIERvSCBjYW4ganVzdCBiZSBhIGJldHRlciBwcm90b2NvbCBhcyB3ZWxsIGFzIGJlaW5nIGEg d2F5IHRvIGdldCBwcml2YWN5LiBBIGJldHRlciB3YXkgdG8gaGF2ZSBwdXQgdGhhdCB3b3VsZCBi ZSB0aGF0IG1ha2luZyBEb0ggZWFzeSB0byBkZXRlY3QgYmxvY2tzIG9uZSBvZiB0aGUgbWFpbiBi ZW5lZml0cyBvZiBEb0g6IHRoYXQgaXQgZ2l2ZXMgdGhlIHVzZXIgcHJpdmFjeSBmcm9tIG9uLXBh dGggc25vb3BlcnMNCiBpbiBhIHdheSB0aGF0IGNhbuKAmXQgYmUgZWFzaWx5IGJsb2NrZWQuPC9k aXY+DQo8ZGl2Pjxicj4NCjwvZGl2Pg0KPGJyPg0KPC9kaXY+DQo8L2Rpdj4NCi0tIDxicj4NCkFk ZCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86QWRkQGlldGYub3JnIiB0YXJnZXQ9 Il9ibGFuayIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5BZGRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEg aHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hZGQiIHJlbD0ibm9y ZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+aHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hZGQ8L2E+PGJyPg0KPC9ibG9ja3F1b3RlPg0K PC9kaXY+DQo8L2Rpdj4NCjxicj4NCjxmaWVsZHNldCBjbGFzcz0ibWltZUF0dGFjaG1lbnRIZWFk ZXIiPjwvZmllbGRzZXQ+IDwvYmxvY2txdW90ZT4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_2c1c2ca8f6ba0f785e6ad86658c05453ericssoncom_-- From nobody Wed Jul 29 02:39:49 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9F2F3A0400 for ; Wed, 29 Jul 2020 02:39:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i4n94guafAlg for ; Wed, 29 Jul 2020 02:39:45 -0700 (PDT) Received: from mail-il1-x136.google.com (mail-il1-x136.google.com [IPv6:2607:f8b0:4864:20::136]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D7883A03ED for ; Wed, 29 Jul 2020 02:39:45 -0700 (PDT) Received: by mail-il1-x136.google.com with SMTP id p16so8033412ile.0 for ; Wed, 29 Jul 2020 02:39:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=IATKp7IMUIzzq5emUEoJuI0J7bEMZIOqv3tsXXfbSUU=; b=O5LZgIWnF0lnvXHqR8ZVdx2xVnV0fHlk9E82ErJxZwBJy/WsFN1EyQo5INPid3a47g 1lacaFZAKPhMzHMefGOnLzLzQrVB8gOqiakha2bbuiUP/o1Q/Is6ECfhhSpzxHxbpvdw Gd7lkyAkOWs5feJIszF8mQG6/Ah3pE7DGYZKmG3VuCe2SURhf2hbTcQ3tk+v0xOlqLnb RReBAWy5qvuBRAhNX484qsCgVM+yGIGAd0xyf3AXLUxPkRrsosEVhfw9rJU9YFiyIBTO L/PcyacycB3V1nRZQb94drVBam4Onvgxx/NhEXOpWa/3mcxrit8NdFVkhyAhOaqmlAL7 8Alg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=IATKp7IMUIzzq5emUEoJuI0J7bEMZIOqv3tsXXfbSUU=; b=Qb/+2Fcx3XeR9STqw4yvM5DGHrg2oA3J8baKMbkif6HGU3pORANfa4l2rh359f8vbG YvaXkHHpGXwU3kQPs1ymgVg3Ow7D3pT82cqtliUFsAlVxF0j0vN/6vMrotpIIzdhAANP 8bTs9Yp/Chl2e6WIgrif1JCSnGL0MtSQFhBlBr7KA7+NKPPMdMqtWju5FlRjsOEJF7d9 bOizeLi0c2V7K5iwCflozMXD2XmaPff0j1ZY6FL2Ohjc7FUh5eSbrQsgp1/L2uGlsc5I lnpG7/GXtXCc/FqQJJOE+z9p/BCfIpczKUGzUv/j03MKVcWsjSURT63luXDPIk2Zvl35 OsCg== X-Gm-Message-State: AOAM530lO2lLlx35Nc4zlL/7tFsOsh7TnN7jdsSnbGpPViqMiXoxgdua DhEG8GNFmDE4/F0LKT/nuIJOAzDkUtWT1SLo15w= X-Google-Smtp-Source: ABdhPJw747Lfckcd+CVRfARVlRvcvWHPN21SwjCSRMSZsUo632Erg9dym9F3I1FjK4Kg8veX6hux7v/Dz/oNAFTKGRM= X-Received: by 2002:a92:c530:: with SMTP id m16mr34409718ili.300.1596015584431; Wed, 29 Jul 2020 02:39:44 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <3B4BDD38-4C0E-4444-A294-0E17BA5E2FA8@fugue.com> <1978893.SkKRCvkyLV@linux-9daj> <9C027574-73FA-4D94-8BFF-32B7ECD2A71F@fugue.com> <0CEEDE62-234A-455C-AD5B-C989888B3D1F@fugue.com> <2c1c2ca8-f6ba-0f78-5e6a-d86658c05453@ericsson.com> In-Reply-To: <2c1c2ca8-f6ba-0f78-5e6a-d86658c05453@ericsson.com> From: tirumal reddy Date: Wed, 29 Jul 2020 09:39:32 +0000 Message-ID: To: Mohit Sethi M Cc: Tommy Jensen , Eric Rescorla , Ted Lemon , Paul Vixie , Rob Sayre , "add@ietf.org" , "STARK, BARBARA H" Content-Type: multipart/alternative; boundary="000000000000f752cf05ab9155ea" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 09:39:48 -0000 --000000000000f752cf05ab9155ea Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 29 Jul 2020 at 07:21, Mohit Sethi M wrote: > Both the drafts only validate what Tommy said 'You need some prior > knowledge and trust of the network'. > > draft-reddy-add-iot-byod-bootstrap: section 4 says "The endpoint > authenticates to the local network and discovers the Enrollment over Secu= re > Transport (EST)" and also "the endpoint MUST authenticate the EST server > before it accepts the DNS server certificate.". This implies that you nee= d > some prior knowledge of the network to establish trust. Section 5 does a > complex indirection and instead of directly authenticating the network, i= t > relies on the manufacturer to confirm if the network is correct. > Section 5 is specific to bootstrapping IoT devices only and steps 1 to 3 in Section 5 are part of BRSKI (see https://tools.ietf.org/html/draft-ietf-anima-bootstrapping-keyinfra-41) to complete bi-directional authentication of the IoT device and the network. Step 4 to 5 are defined in draft-reddy-add-iot-byod-bootstrap to securely discover the local DoH/DoT server using the EST server. -Tiru > > draft-btw-add-ipsecme-ike: you need some credentials for setting up the > IPSec tunnel. > > --Mohit > On 7/28/20 3:23 PM, tirumal reddy wrote: > > On Tue, 28 Jul 2020 at 00:44, Tommy Jensen 40microsoft.com@dmarc.ietf.org> wrote: > >> (+1 to ekr's point) >> >> I agree with Ted: we shouldn't go weakening strong end-to-end encrypted >> protocols on purpose. From an endpoint's perspective, there is no >> authoritative way to distinguish between network administration ("good") >> and network attacks ("bad") without some prior knowledge and trust of th= e >> network, such as preinstalled certificates. >> > > Secure discovery is possible in several scenarios and the client can > identify/authenticate the local DoH/DoT server, for example see > https://tools.ietf.org/html/draft-reddy-add-iot-byod-bootstrap-01 > and > https://tools.ietf.org/html/draft-btw-add-ipsecme-ike-00. In deployments > where secure discovery is not possible, client validation techniques like > pre-configured TRR or cryptographic assertion of the DNS server identity > would ensure the client does not connect to an attacker's DoH/DoT server. > > >> Arguably, these networks which want to tightly control network behavior >> ought to tightly control network joining capabilities to prevent this >> perceived misbehavior. Otherwise, any side door we build for MitM to mor= e >> readily block/downgrade communication between intended endpoints will be= a >> side door attackers can use as well. >> > > IT-managed endpoint devices can be tightly controlled by management > software but not BYOD (without MDM/configuration profile). In deployments > like home networks, the network security service co-located in the home > router has no way to manage or tightly control endpoint and IoT devices. > > -Tiru > > >> >> If we want to allow networks to give new and arbitrary endpoints a >> trusted (defined as "client can securely distinguish from an arbitrary >> attacker") signal that a given communication mechanism is forbidden, we >> (not this WG) should work on that on a larger scale. After all, such a >> mechanism could be used to signal network opposition to VPN tunnels, Tor >> connections, or anything else a network find offensive. If it works for >> HTTPS, DoH should inherit the benefits gracefully. >> >> What I'm saying is: we should leave this discussion off this list becaus= e >> it isn't specific to encrypted DNS as networks opposing encrypted >> communication to an endpoint has existed before DoH or DoT. Per the char= ter >> quote below, we can inform about mechanisms available to detect these >> network intentions, but I would say creation of new mechanisms is beyond >> the scope of the charter. Chairs can correct me if I interpreted that >> incorrectly. >> >> >> Develop an informational document that describes mechanisms for clien= ts >> to detect specific network environments (such as captive portal and >> split horizon) and to use that information to inform their DNS >> configuration. >> >> Thanks, >> Tommy Jensen >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >> The latest in Windows Internet Protocols: >> Native gRPC support: https://aka.ms/grpcblogpost >> DNS over HTTPS: https://aka.ms/dohblogpost >> ------------------------------ >> *From:* Add on behalf of Ted Lemon < >> mellon@fugue.com> >> *Sent:* Monday, July 27, 2020 5:27 PM >> *To:* Eric Rescorla >> *Cc:* add@ietf.org ; Paul Vixie ; STARK, >> BARBARA H ; Rob Sayre >> >> *Subject:* [EXTERNAL] Re: [Add] New Version Notification for >> draft-pauly-add-resolver-discovery-01.txt >> >> On Jul 27, 2020, at 8:11 PM, Eric Rescorla = > >> wrote: >> >> in counterpoint, arguments in favour of the deliberate entropy of DoH >> have >> sometimes taken the form "if we make this easy to detect, then it will b= e >> widely blocked", which presumes that the alternative cost of blocking Do= H >> can >> be artificially raised above the accepted risks of not blocking it. >> >> >> Yes, that is the argument, and it makes sense. If we make DoH easy to >> detect, then there is no point in having DoH: it serves no purpose. >> >> >> From my perspective, this is not correct. >> >> DoH has a number of technical advantages over DoT (for instance the >> ability to use Alt-Svc to upgrade to DoH3). Of course, one might or migh= t >> not value these benefits against having two protocols, but that's not qu= ite >> the same thing. >> >> >> Okay, fair point, DoH can just be a better protocol as well as being a >> way to get privacy. A better way to have put that would be that making D= oH >> easy to detect blocks one of the main benefits of DoH: that it gives the >> user privacy from on-path snoopers in a way that can=E2=80=99t be easily= blocked. >> >> >> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> > > --000000000000f752cf05ab9155ea Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Wed, 29 Jul 2020 at 07:21, Mohit Sethi= M <mohit.m.sethi@ericsson= .com> wrote:

Both the drafts only validate what Tommy said 'You need some prior k= nowledge and trust of the network'.

draft-reddy-add-iot-byod-bootstrap: section 4 says "The endpoint authe= nticates to the local network and discovers the Enrollment over Secure Tran= sport (EST)" and also "the endpoint MUST authenticate the EST ser= ver before it accepts the DNS server certificate.". This implies that you need some prior knowledge of the network to establis= h trust. Section 5 does a complex indirection and instead of directly authe= nticating the network, it relies on the manufacturer to confirm if the netw= ork is correct.

Section 5 is specific t= o bootstrapping IoT devices only and steps 1 to 3 in Section 5 are part of = BRSKI (see=C2=A0https://tools.ietf.org/html/draft-ietf-anima-bootst= rapping-keyinfra-41) to complete bi-directional authentication of the I= oT device and the network. Step 4 to 5 are defined in draft-reddy-add-iot-b= yod-bootstrap=C2=A0to securely discover the local DoH/DoT server using the = EST server.=C2=A0=C2=A0
=C2=A0
-Tiru


draft-btw-add-ipsecme-ike: you need some credentials for setting up the IPS= ec tunnel.

--Mohit

On 7/28/20 3:23 PM, tirumal reddy wrote:
On Tue, 28 Jul 2020 at 00:44, Tommy Jensen <Jensen.Thom= as=3D40= microsoft.com@dmarc.ietf.org> wrote:
(+1 to ekr's point)=C2=A0

I agree with Ted: we shouldn't go weakening strong end-to-end encrypted= protocols on purpose. From an endpoint's perspective, there is no auth= oritative way to distinguish between network administration ("good&quo= t;) and network attacks ("bad") without some prior knowledge and trust of the network, such as preinstalled certificates.

Secure discovery is possible in several scenarios and the client can i= dentify/authenticate the local DoH/DoT server, for example see=C2=A0https://tools.ietf.org/html/draft-reddy-add-iot-byod-bootstra= p-01=C2=A0and=C2=A0https://tools.ietf.org/html/draft-btw-ad= d-ipsecme-ike-00. In deployments where secure discovery is not possible, client validation t= echniques like pre-configured TRR or cryptographic assertion of the DNS ser= ver identity would ensure the=C2=A0client does not connect to an attacker&#= 39;s DoH/DoT server.
=C2=A0
Arguably, these networks which want to tightly control network behavior oug= ht to tightly control network joining capabilities to prevent this perceive= d misbehavior. Otherwise, any side door we build for MitM to more readily b= lock/downgrade communication between intended endpoints will be a side door attackers can use as well.

IT-managed endpoint devices can be tightly controlled by management so= ftware but not BYOD (without MDM/configuration profile). In deployments lik= e home networks, the network security service co-located in the home router= has no way to manage or tightly control endpoint and IoT devices.=C2=A0

-Tiru
=C2=A0

If we want to allow networks to give new and arbitrary endpoints a trusted = (defined as "client can securely distinguish from an arbitrary attacke= r") signal that a given communication mechanism is forbidden, we (not = this WG) should work on that on a larger scale. After all, such a mechanism could be used to signal network opposition to = VPN tunnels, Tor connections, or anything else a network find offensive. If= it works for HTTPS, DoH should inherit the benefits gracefully.=C2=A0

What I'm saying is: we should leave this discussion off this list becau= se it isn't specific to encrypted DNS as networks opposing encrypted co= mmunication to an endpoint has existed before DoH or DoT. Per the charter q= uote below, we can inform about mechanisms available to detect these network intentions, but I would say creation of = new mechanisms is beyond the scope of the charter. Chairs can correct me if= I interpreted that incorrectly.

>> Develop an informat= ional document that describes mechanisms for=C2=A0clients to detect specific network environments (such as captive portal=C2=A0and split horizon) and to = use that information to inform their DNS=C2=A0configuration.

Thanks,
Tommy Jensen
=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The latest in Window= s Internet Protocols:
=C2=A0 Native gRPC s= upport: https://aka.ms/grpcblogpost=C2=A0
From: Add <add-bounces@ietf.org> on behalf of Ted Lemon <mellon@fugue.com>
Sent: Monday, July 27, 2020 5:27 PM
To: Eric Rescorla <ekr@rtfm.com>
Cc: add@ietf.org <add@ietf.org&g= t;; Paul Vixie <pa= ul@redbarn.org>; STARK, BARBARA H <b= s7652@att.com>; Rob Sayre <sayrer@gmail..co= m>
Subject: [EXTERNAL] Re: [Add] New Version Notification for draft-pau= ly-add-resolver-discovery-01.txt
=C2=A0
On Jul 27, 2020, at 8:11 PM, Eric Rescorla <ekr@rtfm.com> wrote:
in counterpoint, arguments in fav= our of the deliberate entropy of DoH have=C2=A0
sometimes taken the form "if= we make this easy to detect, then it will be=C2=A0
widely blocked", which presu= mes that the alternative cost of blocking DoH can=C2=A0
be artificially raised above the = accepted risks of not blocking it.

Yes, that is the argument, and it makes sense. If we make DoH easy to = detect, then there is no point in having DoH: it serves no purpose.

From my perspective, this is not correct.

DoH has a number of technical advantages over DoT (for instance the ab= ility to use Alt-Svc to upgrade to DoH3). Of course, one might or might not= value these benefits against having two protocols, but that's not quit= e the same thing.

Okay, fair point, DoH can just be a better protocol as well as being a= way to get privacy. A better way to have put that would be that making DoH= easy to detect blocks one of the main benefits of DoH: that it gives the u= ser privacy from on-path snoopers in a way that can=E2=80=99t be easily blocked.


--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

--000000000000f752cf05ab9155ea-- From nobody Wed Jul 29 03:23:56 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D52D03A07E6 for ; Wed, 29 Jul 2020 03:23:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ETi9R2SrC0Ub for ; Wed, 29 Jul 2020 03:23:53 -0700 (PDT) Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 010103A07E3 for ; Wed, 29 Jul 2020 03:23:52 -0700 (PDT) Received: by mail-io1-xd2c.google.com with SMTP id l1so23919688ioh.5 for ; Wed, 29 Jul 2020 03:23:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=bIWXOVnxGq88JqX2HzNnc/lj8ty/hKVPv7gQ5oITyYo=; b=lNfI9C+6RI8Y7mXiqN/IPqp1b5rEGJ4glEa1mkxrP2iiN0/SyT/caCwyZnYEH7GNWS 4Ixt2YSyT9FZvHARCy4AGhrw99pnzeuzWSRSqq1TqM/gFlG6E+Jm/tsC9dnsSTXgS4En NMvOF9jV2ruM2ioGuTdiRH60DXNj7PJlTP87vSpKLOwxqCxvIwQD5ha5lynf9ZaLdVz8 1tbIyRvH8z/nugzdGCubXG69PYvIXuwDE9VKZ6lcXzbPOvoghu+4gRFQ5grn90TGC7iq 3ucQBPWvH0++h8IdbgQTdtCF/TdSi9maiVjoGRzdsSxGMKJCJgtGrIkjp/0AldJxRRb+ +JtA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=bIWXOVnxGq88JqX2HzNnc/lj8ty/hKVPv7gQ5oITyYo=; b=OufkO+VfpA+D5SuGUxGFSmggEWn/pGDoPcsbh0vjKQG3DWGQRW0bnOeY3KB7jrct64 xEUYMUiDfGtyb7fPiJNURmXUH3qh461QOEK5kDw1Mkom5l37jSd30z7GC7zXS8dZOezl JOxudOpPoQ3FaVNkYuWXQtZ5VhWex28uG9j7FYHKCohrb9aROJSM8baafUdpOCLODKRK 6KD6arS6QLgqYZyTv1tEvyN95BVhYBCNpblyHFhj9mXs3OBRLDtEP7aeyzeZppHMFYNY V9OCTztGRR+6t5Qq/ISAR+TuLIqledOXa9GD2+V6eC/8zaz0U/c7a24Qki5dJd9fcrHj Qszw== X-Gm-Message-State: AOAM533/ovkF9bTIZ7iMU1qloXYpT+O2xF1jVmkW2XexcQdNwiO8Cs1k OSmfBZv6+vJPPjCyqvgDm96XJio7hZJzyh8NYbs= X-Google-Smtp-Source: ABdhPJxfDdEou35KCG9rKAkpCw1Ghx153JmZMZuxqrLAJPIf8x0k1zgbOgIzmo4ssgmAQGuR/y1R2BsA0soqhp2u8JM= X-Received: by 2002:a02:5443:: with SMTP id t64mr38253475jaa.100.1596018232149; Wed, 29 Jul 2020 03:23:52 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> <20200728134948.GA24673@nic.fr> <45F2A448-4248-4C14-AA0B-ECBB34FF3AE4@fugue.com> <606980496.3510.1595946668260@appsuite-gw2.open-xchange.com> In-Reply-To: From: tirumal reddy Date: Wed, 29 Jul 2020 10:23:40 +0000 Message-ID: To: Ted Lemon Cc: Vittorio Bertola , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000c84b7105ab91f39f" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 10:23:55 -0000 --000000000000c84b7105ab91f39f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 28 Jul 2020 at 15:47, Ted Lemon wrote: > On Jul 28, 2020, at 10:31 AM, Vittorio Bertola < > vittorio.bertola@open-xchange.com> wrote: > > Of course that requires some security considerations and validation befor= e > use, but if you assume that you cannot trust the (https) URL indicated in > the EDNS response, then you cannot trust the response itself > > > I think that=E2=80=99s what I said, yet. > > and its indication that the domain was blocked for whatever reason, and > possibly you cannot trust any DNS response whatsoever. In any case, it > might be that clients will only use that information if it is received ov= er > an authenticated channel (e.g. via DoH). > > > If I try to establish a TLS connection and get a TLS alert that says =E2= =80=9CTLS > is blocked except when you allow me to MiTM your TLS connection,=E2=80=9D= then I > know that I can=E2=80=99t use the network without installing the TLS cert= I need to > successfully be MiTM=E2=80=99d. This is perfectly fine, sort of. > TLS alert is an authenticated message and cannot be generated by the network security service. Manually installing a local root certificate means the middle-box can act as a TLS proxy even if it only performs DNS filtering. The idea is not to install a local root certificate for the error page URL. > > However, if the next thing that pops up is a web page explaining how to > install the TLS cert, with a download link, then that=E2=80=99s not fine,= because a > naive end user will just follow the instructions. This is a situation whe= re > giving you, the well-intentioned network operator, an opportunity to > explain yourself creates an attack surface that will be exploited by > malware. > You may want to look into https://tools.ietf.org/html/draft-reddy-dnsop-error-page-02#section-6. The HTTPS record conveying the error page URL will only be processed along with "Forged answer" error code and DoH or DoT (in strict privacy mode) is mandatory. An attacker cannot modify the DNS response to insert a malware URL. > > This is why browsers are moving toward not even telling you how to bypass > =E2=80=9Cself-signed cert=E2=80=9D warnings. It=E2=80=99s just not safe t= o tell the end user how to > do that. If they need to do that, either they know how to do it, or the > legitimate operator of their network knows how. > "Advanced" setting is available on most browsers today to by-pass the warning and proceed. The proposed mechanism helps avoid training users to click through certificate errors. Cheers, -Tiru > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000c84b7105ab91f39f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, 28 Jul 2020 at 15:47, Ted Lemon &= lt;mellon@fugue.com> wrote:
<= /div>
On Jul 28, 2020, at 10:31 = AM, Vittorio Bertola <vittorio.bertola@open-xchange.com> wrote:
<= blockquote type=3D"cite">
Of course that requires some security considerations and validation befo= re use, but if you assume that you cannot trust the (https) URL indicated i= n the EDNS response, then you cannot trust the response itself
=

I think that=E2=80=99s what I said, yet.
<= div>
and its indication that the domain was blocked for whatever re= ason, and possibly you cannot trust any DNS response whatsoever. In any cas= e, it might be that clients will only use that information if it is receive= d over an authenticated channel (e.g. via DoH).

If I try to establish a TLS connection and get a TLS alert tha= t says =E2=80=9CTLS is blocked except when you allow me to MiTM your TLS co= nnection,=E2=80=9D then I know that I can=E2=80=99t use the network without= installing the TLS cert I need to successfully be MiTM=E2=80=99d. This is = perfectly fine, sort of.

TLS al= ert is an authenticated message and cannot be generated by the network secu= rity service. Manually installing a local root certificate means the middle= -box can act as a TLS proxy even if it only performs DNS filtering.=C2=A0

The idea is not to install a local root certificate= for the error page URL.
=C2=A0
However, if the next thing that pops up is a web page explaini= ng how to install the TLS cert, with a download link, then that=E2=80=99s n= ot fine, because a naive end user will just follow the instructions. This i= s a situation where giving you, the well-intentioned network operator, an o= pportunity to explain yourself creates an attack surface that will be explo= ited by malware.

You may want t= o look into=C2=A0https://tools.ietf.org/html/draft= -reddy-dnsop-error-page-02#section-6. The HTTPS record conveying the er= ror page URL will only be processed along with "Forged answer" er= ror code and DoH or DoT (in strict privacy mode) is mandatory. An attacker = cannot modify the DNS response to insert a malware URL.
=C2=A0

This is why browsers are moving tow= ard not even telling you how to bypass =E2=80=9Cself-signed cert=E2=80=9D w= arnings. It=E2=80=99s just not safe to tell the end user how to do that. If= they need to do that, either they know how to do it, or the legitimate ope= rator of their network knows how.

"Advanced" setting is available on most browsers today to by-p= ass the warning and proceed. The proposed mechanism helps avoid=C2=A0traini= ng users to click through certificate errors.

Chee= rs,
-Tiru=C2=A0

--000000000000c84b7105ab91f39f-- From nobody Wed Jul 29 03:38:14 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B14A23A082F for ; Wed, 29 Jul 2020 03:38:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bJwChp0q6G5s for ; Wed, 29 Jul 2020 03:38:10 -0700 (PDT) Received: from mx3.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 69BEF3A0AC4 for ; Wed, 29 Jul 2020 03:37:58 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx3.open-xchange.com (Postfix) with ESMTPS id 160D96A2FF; Wed, 29 Jul 2020 12:37:56 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1596019076; bh=OXaY0CmkXXuapgkhz5YjFtB78sTDLjSgERR5Iqly7yc=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=4FxzcZW8/+Fn6kajDTmSByt767czh1aaTr7Ew4YAh8A5K2Xik7zCdFFmUhcg8oEOf fwVqe9KRWl0DlrFkV7dSldlEGgmFGEIi9RIUgt2g1Db2KRVuP5xeWHdDRVQGx785ya 10OrveZ5ybjEKSDbzxjhhYoTShGke5dzdrUOfX5Kc9xXLwLGivBs2yrlz03y2HgDEr 8NnQxyu3zp8kNKJLoiRPsd9sgYth9SHaBH//YJ2Hf5J77f2xOOcxeY4Mrk7+ITHUgS 8h7ChaeCgq8QyElHs1WqAPOVEHn8oKbBC7fcLJYW9UAPfOhxo5f9LDzSQK90vnfrti YMMTwufZvNhng== Received: from appsuite-gw2.open-xchange.com (appsuite-gw2.open-xchange.com [10.20.28.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 077293C03D6; Wed, 29 Jul 2020 12:37:56 +0200 (CEST) Date: Wed, 29 Jul 2020 12:37:55 +0200 (CEST) From: Vittorio Bertola To: Ted Lemon Cc: add@ietf.org Message-ID: <1160737423.5244.1596019075932@appsuite-gw2.open-xchange.com> In-Reply-To: References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> <20200728134948.GA24673@nic.fr> <45F2A448-4248-4C14-AA0B-ECBB34FF3AE4@fugue.com> <606980496.3510.1595946668260@appsuite-gw2.open-xchange.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_5242_547651097.1596019075913" X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev19 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 10:38:13 -0000 ------=_Part_5242_547651097.1596019075913 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable > Il 28/07/2020 17:46 Ted Lemon ha scritto: > =20 >=20 > > > and its indication that the domain was blocked for wh= atever reason, and possibly you cannot trust any DNS response whatsoever. I= n any case, it might be that clients will only use that information if it i= s received over an authenticated channel (e.g. via DoH). > >=20 > > >=20 > If I try to establish a TLS connection and get a TLS alert that says = =E2=80=9CTLS is blocked except when you allow me to MiTM your TLS connectio= n,=E2=80=9D >=20 This is not the use case for extended DNS errors, which are sent in respons= e to a DNS query and not to the establishment of the TLS connection. The us= e case is when you have already started to use a resolver (encrypted or not= , though the security of transport may play a role in deciding whether to a= ccept the signal or not), you want to connect to a specific destination, yo= u query the resolver for the IP address and the resolver tells you "you are= not allowed to connect to that server". Today, this usually happens via a = NXDOMAIN which gives you an error and that's it; there used to be services = that would rather redirect you to a proxy with a human-readable error page = by giving you its IP address in the response, but that doesn't work with HT= TPS and doesn't work if the application is not the web. So the idea is that, rather than just breaking everything, the resolver wil= l send you a response which includes one of the three "blocked" error codes= (depending on the reason for blocking) and a proper, PKI-valid HTTPS URL o= n the local network operator's website where the client can get the human-r= eadable message from. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com mailto:vittorio.bertola@open-xchange.com= =20 Office @ Via Treviso 12, 10144 Torino, Italy ------=_Part_5242_547651097.1596019075913 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable =20 =20
 
=20
=20
Il 28/07/2020 17:46 Ted Lemon <mellon@fugue.com> ha scritto:
=20
 
=20
=20
=20
and its indication that the domain was blocked for whatever reason= , and possibly you cannot trust any DNS response whatsoever. In any case, i= t might be that clients will only use that information if it is received ov= er an authenticated channel (e.g. via DoH).
=20
=20
=20
=20
If I try to establish a TLS connection and get a TLS alert that says = =E2=80=9CTLS is blocked except when you allow me to MiTM your TLS connectio= n,=E2=80=9D
=20
=20
This is not the use case for extended DNS errors, which are sent in resp= onse to a DNS query and not to the establishment of the TLS connection. The= use case is when you have already started to use a resolver (encrypted or = not, though the security of transport may play a role in deciding whether t= o accept the signal or not), you want to connect to a specific destination,= you query the resolver for the IP address and the resolver tells you "you = are not allowed to connect to that server". Today, this usually happens via= a NXDOMAIN which gives you an error and that's it; there used to be servic= es that would rather redirect you to a proxy with a human-readable error pa= ge by giving you its IP address in the response, but that doesn't work with= HTTPS and doesn't work if the application is not the web.
=20
 
=20
So the idea is that, rather than just breaking everything, the resolver = will send you a response which includes one of the three "blocked" error co= des (depending on the reason for blocking) and a proper, PKI-valid HTTPS UR= L on the local network operator's website where the client can get the huma= n-readable message from.
=20
=20

--

=20 
Vittorio Bertola | Head of Policy & Innovation, Open=
-Xchange
vittorio.b=
ertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Ital=
y
=20
------=_Part_5242_547651097.1596019075913-- From nobody Wed Jul 29 04:40:53 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C440A3A09AD for ; Wed, 29 Jul 2020 04:40:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uALl4mRXwRn2 for ; Wed, 29 Jul 2020 04:40:48 -0700 (PDT) Received: from mail-qv1-xf33.google.com (mail-qv1-xf33.google.com [IPv6:2607:f8b0:4864:20::f33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D06DB3A09AC for ; Wed, 29 Jul 2020 04:40:47 -0700 (PDT) Received: by mail-qv1-xf33.google.com with SMTP id l13so4306950qvt.10 for ; Wed, 29 Jul 2020 04:40:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=XcIgsgbkNTMcgDRRs76ufH+UO7CGwVYE3zPDkUhmMN4=; b=w6INcWZnGwATYPH06RlcNvtsHQ/R3AQPeaD4sYKtdB1rtDhqfyKY7SQyR1vfHVGKLL Q1MvMX3VMQXCeZcWZEBW5nOmW1Nkim9pPNK9LDfRUKmNIASGxrGlLZNkAbg4J1/xWAZt EFjKk0LoN3UHGY2Ec2c20ZFQB8XJuc5TGk0MiSJ68rDxoA32a25WWzm14UQkUgO3Olgc LJjnatQsKGwq8fVGRr5qjimOPpUTXRTjSCOqJxuFr6znCJZoB5YG3LRuZJw3G2kZi9O7 wTQ8b/QKDWx+qDfYoQeUrWgkqSwm9N88nv3xzgzdcgh76l1hPUcTuhtTcsyJe8HVZdrJ d/fQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=XcIgsgbkNTMcgDRRs76ufH+UO7CGwVYE3zPDkUhmMN4=; b=hctv+nTi4KkZ3l1I/wGl4Kq7TFSF6ttvBHH+PpJnbSFoCuLP2TvKo3fJ85xyjP0GLT j6ErParMoVK5NyzFk7k/3oaL73/iXFik/SnAZu/xyRQTApHfrF+Pm1ExqtfMupcyfvc/ E5+33dx6w74YrxK5J9Mw8xuHBbBFrce0rmLHOgGuufuUXVUv0sck/EnMtwYdq1HIsy1c jWR9JadSlyFSb7pJ07aPPG6yQPEuE+28babfZqwCaUM8V+1Ha7HRDBIr8VViq/pOg7wN IFMMGIEVm9adhuWOMjuuLjJrUBXaxYSlNaMwvOsbuny1icaOh4+NWXMVF55+rqdBcXaq IpTQ== X-Gm-Message-State: AOAM531jzzOHAiqClO4cQBa4MCBnVU9G67rM0faPzsmzLOgn4apI+3aj HsnZlUhd4f7IocTNI28wTWhCKQ== X-Google-Smtp-Source: ABdhPJw069c/DWft7mMwgIoClwUgIbp+E8yzAFFX6a6TpBGvxejg4uLy52xPbaafY+G7Fe/CeOi2Fw== X-Received: by 2002:a0c:e1c6:: with SMTP id v6mr19448187qvl.45.1596022846845; Wed, 29 Jul 2020 04:40:46 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:9059:d85e:ea8c:7a91? ([2601:18b:300:36ee:9059:d85e:ea8c:7a91]) by smtp.gmail.com with ESMTPSA id l66sm1302117qkc.42.2020.07.29.04.40.46 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 Jul 2020 04:40:46 -0700 (PDT) From: Ted Lemon Message-Id: <57A88FC8-840A-42C2-9D0C-6E589B22D77B@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_98743FFE-367B-4F2F-A2C4-FCAB88422547" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Wed, 29 Jul 2020 07:40:44 -0400 In-Reply-To: Cc: Vittorio Bertola , ADD Mailing list To: tirumal reddy References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> <20200728134948.GA24673@nic.fr> <45F2A448-4248-4C14-AA0B-ECBB34FF3AE4@fugue.com> <606980496.3510.1595946668260@appsuite-gw2.open-xchange.com> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 11:40:50 -0000 --Apple-Mail=_98743FFE-367B-4F2F-A2C4-FCAB88422547 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Jul 29, 2020, at 6:23 AM, tirumal reddy wrote: > TLS alert is an authenticated message and cannot be generated by the = network security service. Manually installing a local root certificate = means the middle-box can act as a TLS proxy even if it only performs DNS = filtering.=20 Not true. A TLS alert can be sent in response to a ClientHello. --Apple-Mail=_98743FFE-367B-4F2F-A2C4-FCAB88422547 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii On = Jul 29, 2020, at 6:23 AM, tirumal reddy <kondtir@gmail.com> = wrote:
TLS = alert is an authenticated message and cannot be generated by the network = security service. Manually installing a local root certificate means the = middle-box can act as a TLS proxy even if it only performs DNS = filtering. 

Not = true. A TLS alert can be sent in response to a = ClientHello.


= --Apple-Mail=_98743FFE-367B-4F2F-A2C4-FCAB88422547-- From nobody Wed Jul 29 04:43:58 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A2A03A09B1 for ; Wed, 29 Jul 2020 04:43:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0b32PPKvmHya for ; Wed, 29 Jul 2020 04:43:55 -0700 (PDT) Received: from mail-qk1-x72c.google.com (mail-qk1-x72c.google.com [IPv6:2607:f8b0:4864:20::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F58B3A09AC for ; Wed, 29 Jul 2020 04:43:55 -0700 (PDT) Received: by mail-qk1-x72c.google.com with SMTP id h7so21803729qkk.7 for ; Wed, 29 Jul 2020 04:43:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=iXXZ8NVa51pkKlV6kHsA6iRygrlqXHqmgTDE8fbHZXs=; b=uT32xr5A3Zp1LRmwx35OjL0bejKjysUF6pULcl3NeC/5P13xPFuT6gUCiYwSlXA3ww W12WcOJTKRDgvJbeLtKTBj/8b75U6lnaoJePknG/UKIUeytssnPepbAESTCCWucaHWM3 +bL+Hs3q12/b61GoXO/uIHcHHlW77CYb61YFT2jRBTIt3FkswGkrxlYi1PtM2ssY5Yq2 0tKmyOKL6XVJi36stsJmoA9nEkQFslJBZELO1jd07pR6+GNfIZaqh643gbTIiPfKIyz4 c7otNnpU1IyAv7mcqgX+XRWKY9Af3L5YdZOX0213KL5e7bQr/nIdet4QLG5Ymu8AxsLT OPzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=iXXZ8NVa51pkKlV6kHsA6iRygrlqXHqmgTDE8fbHZXs=; b=iiwzilOeq3yLKEtr4vmaGH6RLbb9fYVnKuUu3c+fwzrqMWtuuPIml1+S0fcZVUNdc3 Tob7cybS5DdaNxLGHTd6dTwgTYYE2sOpdGvCRtSm7TocOFzPCksPVAOKN4OcBGTG8qJA YrvY8gLn31q/dsQzgGpP/DaBXQyHlT4nUXqU7+dmXR/qKGga1t95g4tdYwZFSWROKI/G QSJRSPobitUcC+YK1cpQZXKjAnAbJ8+cYiWiGdj+jfFmR503P4Te7wYZWqZWAz0MnvfU 002ia8iPgP7BjdvpzSIJiRNOvR9srNpUaE21yMvtI3fap4255coB/iss0kYHgr4wobve 2o9A== X-Gm-Message-State: AOAM533UpaP6BsPnJ0/q5Vv3gtbb2wXMBCoURed34sJdobJyqLJh487T TI/e7+fWy3UIw9mwlgwVkwOViaYwIuY= X-Google-Smtp-Source: ABdhPJz7lgyDUDPwZ35P2YKqgXrNzl9598HeOvZUpekddBNSB55P1Bfxf5OVOznDuC5N1MugvwAxpw== X-Received: by 2002:a37:9d4e:: with SMTP id g75mr517706qke.186.1596023034462; Wed, 29 Jul 2020 04:43:54 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:9059:d85e:ea8c:7a91? ([2601:18b:300:36ee:9059:d85e:ea8c:7a91]) by smtp.gmail.com with ESMTPSA id n81sm1215509qke.11.2020.07.29.04.43.53 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 Jul 2020 04:43:53 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_B0B1500A-A672-45BA-9924-D106A716292D" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) From: Ted Lemon X-Priority: 3 In-Reply-To: <1160737423.5244.1596019075932@appsuite-gw2.open-xchange.com> Date: Wed, 29 Jul 2020 07:43:52 -0400 Cc: add@ietf.org Message-Id: <6C76B878-E5D4-4046-8739-AB5136FB8839@fugue.com> References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> <20200728134948.GA24673@nic.fr> <45F2A448-4248-4C14-AA0B-ECBB34FF3AE4@fugue.com> <606980496.3510.1595946668260@appsuite-gw2.open-xchange.com> <1160737423.5244.1596019075932@appsuite-gw2.open-xchange.com> To: Vittorio Bertola X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 11:43:57 -0000 --Apple-Mail=_B0B1500A-A672-45BA-9924-D106A716292D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 29, 2020, at 6:37 AM, Vittorio Bertola = wrote: >> If I try to establish a TLS connection and get a TLS alert that says = =E2=80=9CTLS is blocked except when you allow me to MiTM your TLS = connection,=E2=80=9D > This is not the use case for extended DNS errors, which are sent in = response to a DNS query and not to the establishment of the TLS = connection. The use case is when you have already started to use a = resolver (encrypted or not, though the security of transport may play a = role in deciding whether to accept the signal or not), you want to = connect to a specific destination, you query the resolver for the IP = address and the resolver tells you "you are not allowed to connect to = that server". Today, this usually happens via a NXDOMAIN which gives you = an error and that's it; there used to be services that would rather = redirect you to a proxy with a human-readable error page by giving you = its IP address in the response, but that doesn't work with HTTPS and = doesn't work if the application is not the web. > =20 > So the idea is that, rather than just breaking everything, the = resolver will send you a response which includes one of the three = "blocked" error codes (depending on the reason for blocking) and a = proper, PKI-valid HTTPS URL on the local network operator's website = where the client can get the human-readable message from. Here you are talking about the situation where a DoH server has been = discovered and a connection to the DoH server has been made, and = authenticated, and the client trusts the DoH server. At this point the = DoH server makes an assertion about a query the user has made, and = responds with information about why the query was blocked. This is = okay, if trust has actually been established. If a non-trusted DoH = server returned this response, it would be inappropriate to display it = to the end user, because it would represent an attack surface in this = case. The big rhinoceros in the room here, of course, is what it means to = =E2=80=9Cestablish trust=E2=80=9D with a previously unknown DoH server. --Apple-Mail=_B0B1500A-A672-45BA-9924-D106A716292D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 29, 2020, at 6:37 AM, Vittorio Bertola <vittorio.bertola@open-xchange.com> = wrote:
If I try to establish a TLS connection and get a TLS alert = that says =E2=80=9CTLS is blocked except when you allow me to MiTM your = TLS connection,=E2=80=9D
This is not the use case for extended = DNS errors, which are sent in response to a DNS query and not to the = establishment of the TLS connection. The use case is when you have = already started to use a resolver (encrypted or not, though the security = of transport may play a role in deciding whether to accept the signal or = not), you want to connect to a specific destination, you query the = resolver for the IP address and the resolver tells you "you are not = allowed to connect to that server". Today, this usually happens via a = NXDOMAIN which gives you an error and that's it; there used to be = services that would rather redirect you to a proxy with a human-readable = error page by giving you its IP address in the response, but that = doesn't work with HTTPS and doesn't work if the application is not the = web.
 
So the idea is that, rather than just = breaking everything, the resolver will send you a response which = includes one of the three "blocked" error codes (depending on the reason = for blocking) and a proper, PKI-valid HTTPS URL on the local network = operator's website where the client can get the human-readable message = from.

Here you are talking about the situation where a DoH server = has been discovered and a connection to the DoH server has been made, = and authenticated, and the client trusts the DoH server. At this point = the DoH server makes an assertion about a query the user has made, and = responds with information about why the query was blocked.  This is = okay, if trust has actually been established. If a non-trusted DoH = server returned this response, it would be inappropriate to display it = to the end user, because it would represent an attack surface in this = case.

The big = rhinoceros in the room here, of course, is what it means to =E2=80=9Cestab= lish trust=E2=80=9D with a previously unknown DoH server.

= --Apple-Mail=_B0B1500A-A672-45BA-9924-D106A716292D-- From nobody Wed Jul 29 05:01:27 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5B933A09E4 for ; Wed, 29 Jul 2020 05:01:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pd0Qe2gKDvqY for ; Wed, 29 Jul 2020 05:01:21 -0700 (PDT) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9E11E3A09DC for ; Wed, 29 Jul 2020 05:01:21 -0700 (PDT) Received: by mail-io1-xd2f.google.com with SMTP id s189so16954785iod.2 for ; Wed, 29 Jul 2020 05:01:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gvgvAvj7RfjhT2Fuzd0yZA9Gdul6rvon0q1W1hpIJEY=; b=hyIIO0REjTCL+D2xLKVwuCnmDv3EqSlDPIJ+qweMMPuvnUeYjUkDJs1Jd6oDb+YSF3 DDwv6ZxI2NSBVE9u3gCMHFwU5Wy44v6UspSJHczTBoNNSz2LNfHvIXfGssKWg0WHeTUf AUzvYRL9uwfzHXp+ZEW9Fer/1Mjo9goANDPI9gutU/cTI7vhMu5QrwVjJPAMk4/5RELa ryzFuvSm37wStweHK4x+OPrjH69FrnJ3LXY6RYoudKUSzEtVOTycAQc7CUFvxfNLnDJl vbiOS+5Qu5957gIY+ETeaM97cSXR220HrbkBeYT2C4I89hq33P4iNc6mNxkE5Pf/XvU0 Wtdg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gvgvAvj7RfjhT2Fuzd0yZA9Gdul6rvon0q1W1hpIJEY=; b=Elik0qVFwzsGwLbmoBePS1tjQaFIiXjWGy7fKCCtUYM0agk2QBi7uJZOM2Oawey1fF hXeohfxlti/ybbVImoZGszfBBS4lWaz3FPmr5I2q95mSOpmy2EypwKi1UxJOSFJ0qQZl doXCmLu7EI+KkANkWhMS0Oi6bCtrEWMbKMeuxzp/lFQylrJoBj0z7ZB1GBXngbHUkP7q xIFL8+Oq3IHx+tQRkg9ccEvEwqLVnuXVYkrW+91yeb1yvpfF/3i5DsflDU/ralXbU6cT N7dpXhTARTuoNxM4pgCDg4Dp6yRVT5fFOrTfu4YtALQfgxJ2N+vXqoP9u2mtydMq2DzQ 86vA== X-Gm-Message-State: AOAM532zLIrOwzN9+ysehcMcpN+OE5aghLHH1AvAA2v4OVEgFOVyCVbA 6ycx0wVXOWKh0j6wRKlMh3ln0J7qEO1zGEPJLpc= X-Google-Smtp-Source: ABdhPJy/Ie4sC2o5amdBw7b7pFIL/3s0C1LeMqlTC79ryZg+6RRuUrZcJLk05USOQUVkfctQqNQvKVenGey98+yC/LA= X-Received: by 2002:a02:dc3:: with SMTP id 186mr943562jax.46.1596024080773; Wed, 29 Jul 2020 05:01:20 -0700 (PDT) MIME-Version: 1.0 References: <159467169252.16945.8450259386577181707@ietfa.amsl.com> <2354125.1eku6JS2IN@linux-9daj> <11B0750C-EDDE-4956-B6FF-B20BA2E81C2E@fugue.com> <31921523.VjnSb2Omm3@linux-9daj> <20200728134948.GA24673@nic.fr> <45F2A448-4248-4C14-AA0B-ECBB34FF3AE4@fugue.com> <606980496.3510.1595946668260@appsuite-gw2.open-xchange.com> <1160737423.5244.1596019075932@appsuite-gw2.open-xchange.com> <6C76B878-E5D4-4046-8739-AB5136FB8839@fugue.com> In-Reply-To: <6C76B878-E5D4-4046-8739-AB5136FB8839@fugue.com> From: tirumal reddy Date: Wed, 29 Jul 2020 12:01:09 +0000 Message-ID: To: Ted Lemon Cc: Vittorio Bertola , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000063363c05ab935039" Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 12:01:24 -0000 --00000000000063363c05ab935039 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 29 Jul 2020 at 11:44, Ted Lemon wrote: > On Jul 29, 2020, at 6:37 AM, Vittorio Bertola < > vittorio.bertola@open-xchange.com> wrote: > > If I try to establish a TLS connection and get a TLS alert that says =E2= =80=9CTLS > is blocked except when you allow me to MiTM your TLS connection,=E2=80=9D > > This is not the use case for extended DNS errors, which are sent in > response to a DNS query and not to the establishment of the TLS connectio= n. > The use case is when you have already started to use a resolver (encrypte= d > or not, though the security of transport may play a role in deciding > whether to accept the signal or not), you want to connect to a specific > destination, you query the resolver for the IP address and the resolver > tells you "you are not allowed to connect to that server". Today, this > usually happens via a NXDOMAIN which gives you an error and that's it; > there used to be services that would rather redirect you to a proxy with = a > human-readable error page by giving you its IP address in the response, b= ut > that doesn't work with HTTPS and doesn't work if the application is not t= he > web. > > So the idea is that, rather than just breaking everything, the resolver > will send you a response which includes one of the three "blocked" error > codes (depending on the reason for blocking) and a proper, PKI-valid HTTP= S > URL on the local network operator's website where the client can get the > human-readable message from. > > > Here you are talking about the situation where a DoH server has been > discovered and a connection to the DoH server has been made, and > authenticated, and the client trusts the DoH server. At this point the Do= H > server makes an assertion about a query the user has made, and responds > with information about why the query was blocked. This is okay, if trust > has actually been established. If a non-trusted DoH server returned this > response, it would be inappropriate to display it to the end user, becaus= e > it would represent an attack surface in this case. > Yes, we are on the same page :) -Tiru > > The big rhinoceros in the room here, of course, is what it means to > =E2=80=9Cestablish trust=E2=80=9D with a previously unknown DoH server. > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --00000000000063363c05ab935039 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, 29 Jul 2020 at 11:44, Ted Lemon &= lt;mellon@fugue.com> wrote:
<= /div>
On Jul 29, 2020, at 6:37 A= M, Vittorio Bertola <vittorio.bertola@open-xchange.com> wrote:
If I try to establish a TLS connection and get a TLS alert that says = =E2=80=9CTLS is blocked except when you allow me to MiTM your TLS connectio= n,=E2=80=9D
This is not the use case= for extended DNS errors, which are sent in response to a DNS query and not= to the establishment of the TLS connection. The use case is when you have = already started to use a resolver (encrypted or not, though the security of= transport may play a role in deciding whether to accept the signal or not)= , you want to connect to a specific destination, you query the resolver for= the IP address and the resolver tells you "you are not allowed to con= nect to that server". Today, this usually happens via a NXDOMAIN which= gives you an error and that's it; there used to be services that would= rather redirect you to a proxy with a human-readable error page by giving = you its IP address in the response, but that doesn't work with HTTPS an= d doesn't work if the application is not the web.
=C2=A0
So the idea is that, rather than just= breaking everything, the resolver will send you a response which includes = one of the three "blocked" error codes (depending on the reason f= or blocking) and a proper, PKI-valid HTTPS URL on the local network operato= r's website where the client can get the human-readable message from.

Here you are talking about the = situation where a DoH server has been discovered and a connection to the Do= H server has been made, and authenticated, and the client trusts the DoH se= rver. At this point the DoH server makes an assertion about a query the use= r has made, and responds with information about why the query was blocked.= =C2=A0 This is okay, if trust has actually been established. If a non-trust= ed DoH server returned this response, it would be inappropriate to display = it to the end user, because it would represent an attack surface in this ca= se.

Yes, we are on the same pag= e :)

-Tiru
=C2=A0
=

The big rhinoceros in the room here, of course, is what= it means to =E2=80=9Cestablish trust=E2=80=9D with a previously unknown Do= H server.

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--00000000000063363c05ab935039-- From nobody Wed Jul 29 05:49:56 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 37B533A0A85 for ; Wed, 29 Jul 2020 05:49:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tA-3hfLu__ts for ; Wed, 29 Jul 2020 05:49:50 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 66CC43A0A7B for ; Wed, 29 Jul 2020 05:49:50 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx4.open-xchange.com (Postfix) with ESMTPS id ED3096A28D; Wed, 29 Jul 2020 14:49:47 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1596026988; bh=zF67OmPT5TLc9mU8n1q391O3kWUU3Qo5KYNzsV9AMlI=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=oPeg9VJLTeQqPtXWL0CxplGMeUOd8NUEC0pVHBxabnKLSl08L64uTBWlaw6LnNG2x rndJBGcQhAnBC1V+/muRTYRPCPk8N96RfW95+T6bWHr7vUHWcmyFoMWvR/O4ys03bl dkOp68R337sVbNSQo22WVUvnA+5awgVTsgDCgwFIfmo1+CI8mLkZ4OwcoyElICy6yF TGkGW2VnOQMWxMKJkeGl6MTCDseBOWicRlbGl8LCXdBCcTPj1p9WgjGdN9c0ZBn8o1 K8ZeMw6VLO89Tg2NCf8PGt43v0HDVkuwykj7euY4hiPs0lR7hMEgKEFmaAOCJXHoYR 81DJjSTNQYE8w== Received: from appsuite-gw2.open-xchange.com (appsuite-gw2.open-xchange.com [10.20.28.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id DC12F3C047A; Wed, 29 Jul 2020 14:49:47 +0200 (CEST) Date: Wed, 29 Jul 2020 14:49:47 +0200 (CEST) From: Vittorio Bertola To: Tommy Jensen Cc: "add@ietf.org" Message-ID: <988930123.5470.1596026987794@appsuite-gw2.open-xchange.com> In-Reply-To: References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com>, <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_5468_1756644252.1596026987775" X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev19 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 12:49:54 -0000 ------=_Part_5468_1756644252.1596026987775 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit > Il 28/07/2020 17:17 Tommy Jensen ha scritto: > > > vittorio> On the other hand, refusing to standardize such a mechanism would be quite a strong policy stance, as it would assume that all networks will always be adversarial and badly intentioned so there is no use in even listening to what they would like to say. > > Would it though? Before DoH and DoT, all common DNS clients (loosely defined as OSes as browsers weren't in the game yet) ignored network recommended browsers the moment the user provided a public resolver to use instead. That wasn't treating networks as adversarial; that was because the network recommendation was just that, not a requirement. I don't think it would be a strong policy stance for the IETF to not standardize a change to that. > I don't have a problem with clients deciding to ignore the locally recommended resolver (or better, if I have a problem with that, it is only when doing so breaks stuff or centralizes the Internet, and it is a policy problem rather than a technical one). The problem I have is if the IETF decides not to even provide a way for the local network to recommend a DoH resolver. > To be clear, I'm in favor of providing networks a way to indicate they don't want clients using other DNS servers if we can do so securely such that it can be differentiated from an attacker. This however would be a new network-client contract that IMO should be larger than DNS (See my response to Paul), and not defining such a mechanism shouldn't be controversial. Clients can still choose to use network recommended servers if they want just as before. > That's also a useful idea (a new one, I agree), and I would be happy to contribute to it, even in other groups. However IMHO then we need something that can be deployed in the next few months as a DNS-specific stopgap measure, to allow the >60% of the world (according to the latest APNIC Labs stats) that happily uses the local resolver to migrate easily and quickly from Do53 to DoH without changing resolver. After that, we could engage in longer term work on protocols to support policy negotiations between networks and applications. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com mailto:vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy ------=_Part_5468_1756644252.1596026987775 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit
 
Il 28/07/2020 17:17 Tommy Jensen <jensen.thomas=40microsoft.com@dmarc.ietf.org> ha scritto:
 
 
vittorio> On the other hand, refusing to standardize such a mechanism would be quite a strong policy stance, as it would assume that all networks will always be adversarial and badly intentioned so there is no use in even listening to what they would like to say.
 
Would it though? Before DoH and DoT, all common DNS clients (loosely defined as OSes as browsers weren't in the game yet) ignored network recommended browsers the moment the user provided a public resolver to use instead. That wasn't treating networks as adversarial; that was because the network recommendation was just that, not a requirement. I don't think it would be a strong policy stance for the IETF to not standardize a change to that. 
I don't have a problem with clients deciding to ignore the locally recommended resolver (or better, if I have a problem with that, it is only when doing so breaks stuff or centralizes the Internet, and it is a policy problem rather than a technical one).
 
The problem I have is if the IETF decides not to even provide a way for the local network to recommend a DoH resolver.
 
To be clear, I'm in favor of providing networks a way to indicate they don't want clients using other DNS servers if we can do so securely such that it can be differentiated from an attacker. This however would be a new network-client contract that IMO should be larger than DNS (See my response to Paul), and not defining such a mechanism shouldn't be controversial. Clients can still choose to use network recommended servers if they want just as before.
That's also a useful idea (a new one, I agree), and I would be happy to contribute to it, even in other groups. However IMHO then we need something that can be deployed in the next few months as a DNS-specific stopgap measure, to allow the >60% of the world (according to the latest APNIC Labs stats) that happily uses the local resolver to migrate easily and quickly from Do53 to DoH without changing resolver. After that, we could engage in longer term work on protocols to support policy negotiations between networks and applications.
 
-- 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
------=_Part_5468_1756644252.1596026987775-- From nobody Wed Jul 29 06:33:57 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 57B2C3A0B51 for ; Wed, 29 Jul 2020 06:33:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c0_oayCEGrDC for ; Wed, 29 Jul 2020 06:33:47 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 584953A0B48 for ; Wed, 29 Jul 2020 06:33:47 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 78292280173; Wed, 29 Jul 2020 15:33:45 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id 7045028060C; Wed, 29 Jul 2020 15:33:45 +0200 (CEST) Received: from relay01.prive.nic.fr (unknown [10.1.50.11]) by mx4.nic.fr (Postfix) with ESMTP id 686FA280173; Wed, 29 Jul 2020 15:33:45 +0200 (CEST) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 6207764CA6E0; Wed, 29 Jul 2020 15:33:45 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id 591AD3FFA5; Wed, 29 Jul 2020 15:33:45 +0200 (CEST) Date: Wed, 29 Jul 2020 15:33:45 +0200 From: Stephane Bortzmeyer To: tirumal reddy Cc: Stephane Bortzmeyer , Tommy Jensen , Paul Vixie , "add@ietf.org" , Ted Lemon , Vittorio Bertola Message-ID: <20200729133345.GA25177@nic.fr> References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <20200728152431.GA8117@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 10.4 X-Kernel: Linux 4.19.0-9-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: No, tests=bogofilter, spamicity=0.000085, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.11.5.63017 Archived-At: Subject: Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 13:33:55 -0000 On Tue, Jul 28, 2020 at 04:01:52PM +0000, tirumal reddy wrote a message of 54 lines which said: > > And it seems a job for PvD > > The above draft is using RA to learn the PVD ID FQDN and cannot > identify if the information is indeed provided by the network or by > an attacker. PvD is a concept that goes beyond that. RFC 8801 provides a way to learn the PvD ID by RA but other methods may appear. My point was that this issue of discovering access network preferences should be done in the general PvD framework. From nobody Wed Jul 29 07:12:34 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDED73A0B85 for ; Wed, 29 Jul 2020 07:12:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B2Ei5epQcbb3 for ; Wed, 29 Jul 2020 07:12:25 -0700 (PDT) Received: from sdaoden.eu (sdaoden.eu [217.144.132.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AED203A0B77 for ; Wed, 29 Jul 2020 07:12:23 -0700 (PDT) Received: by sdaoden.eu (Postfix, from userid 1000) id A0B9516056; Wed, 29 Jul 2020 16:12:21 +0200 (CEST) Date: Wed, 29 Jul 2020 16:12:20 +0200 From: Steffen Nurpmeso To: "Deen, Glenn (NBCUniversal)" Cc: Rob Sayre , ADD Mailing list , Steffen Nurpmeso Message-ID: <20200729141220.2Cfiy%steffen@sdaoden.eu> In-Reply-To: <2583C66A-29E9-43B1-8BF5-DDF3D976DC61@nbcuni.com> References: <2583C66A-29E9-43B1-8BF5-DDF3D976DC61@nbcuni.com> Mail-Followup-To: "Deen, Glenn (NBCUniversal)" , Rob Sayre , ADD Mailing list , Steffen Nurpmeso User-Agent: s-nail v14.9.19-92-ga7d96581-dirty OpenPGP: id=EE19E1C1F2F7054F8D3954D8308964B51883A0DD; url=https://ftp.sdaoden.eu/steffen.asc; preference=signencrypt BlahBlahBlah: Any stupid boy can crush a beetle. But all the professors in the world can make no bugs. MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Add] "primary control over DNS routing should lie with..." X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 14:12:33 -0000 Deen, Glenn (NBCUniversal) wrote in <2583C66A-29E9-43B1-8BF5-DDF3D976DC61@nbcuni.com>: |Paul makes a very valid point =E2=80=93 there are very significant number= s \ |of networks in Enterprises, governments, schools, universities, and \ |even homes of some highly skilled engineers that will have DoH present \ |on devices, operating systems, and applications and will be attempting \ |to do discovery, and these networks do have security practices and \ |security systems which may interfere with certain discovery approaches \ |=E2=80=93 and ADD should be taking those things into account the best we = can. | |In practical terms =E2=80=93 there are several valid uses cases of where = a \ |DoH user will be attempting to discover a resolver: Please let me be the one who does not understand the dozens of occurrences of the word DoH aka DNS over HTTPS/1/2/3 (and maybe later QUIC) in your message as well as the overall overwhelming DoH flood all over this thread. I personally am happy that finally there is DNS over D?TLS, and with longer living connections or states, even more so. If there is an already open HTTPS1/2/3 connection then why not reuse it if possible to pass some binary blobs (Tony Finch could contribute existing super small working perl code for DoH123 as well as DoTLS), especially since the connection is already secured. --steffen | |Der Kragenbaer, The moon bear, |der holt sich munter he cheerfully and one by one |einen nach dem anderen runter wa.ks himself off |(By Robert Gernhardt) From simon.hicks@dcms.gov.uk Tue Jul 28 11:05:15 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 787813A0AEA for ; Tue, 28 Jul 2020 11:05:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=dcms.gov.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1e6TUQi_C-GL for ; Tue, 28 Jul 2020 11:05:13 -0700 (PDT) Received: from mail-lj1-x22c.google.com (mail-lj1-x22c.google.com [IPv6:2a00:1450:4864:20::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF5C43A0AC7 for ; Tue, 28 Jul 2020 11:05:04 -0700 (PDT) Received: by mail-lj1-x22c.google.com with SMTP id r19so22115978ljn.12 for ; Tue, 28 Jul 2020 11:05:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dcms.gov.uk; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YiuFIFmrR8t4CIrXJQIhxJnsm5vshaz5VoF3N47uQms=; b=iaSRFhOsuaB+0Dro56D/4XIt6IHblxUNhKgXWOcuVT8Wqu+mT6Ef+WDW7OI4MCNxQb gNunPUSGaVsHXzKC73qRu1vs9GH3MQCPWgwIks8aKztkk6XPzx11zV94f6udRAvVpXV9 JXB+s2Wv/XmRTsmZ75/8A0E6uGzWpxpWcmD4xP0m3nLQSsEAtsXcnQ39xF84tCtJjleZ nZFk3C+4OfOQLx5FY2ntqDHI+zCBB6kaPraFSMcbVgt8kXc+TxuhNC48m3U6Zld04x1E 8ClgJKI70L7VRRo9lMZ5LcB1XTOO4dgQWxostYNh1s+eW3qEPlA/rRa2hWFic5AFqCdv DlQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YiuFIFmrR8t4CIrXJQIhxJnsm5vshaz5VoF3N47uQms=; b=TrhbPFK3amEIm6DRuod4JFGwKvviTRZHd8aHZzopXKAG2hItbJEd/dIptNS6LSMSJf yeMNvg1QwmIGdjkQHRGIc8N9GQ50i09so1i39IfusfwVHyp4+ZTIQ9wOymL568QHrO7D Q9pky5kwqO2htPmjWgdcSQijrVq5OWmt9Y1aWAxIHs/g6fjsepcvBfFeZPPo14JYUava AgjADW2Cf9GVEn482iYy8Qk3t1Wd/06kcknXndW+suN7P3XmpDLUjhD3fKBUpsY+dO/Y gsSIRXzXctROEWTLr2+Ih9+Qfoj/95viiU+6y1qbkkGs+mQLWxIzVHFSZIzGgsC8YyCa rDpg== X-Gm-Message-State: AOAM5304RrHPZSkBTWC18+TXdAyMxdEHBqOoTcjSiRqQgHXgecwV/T97 4P2AaDL6WdOsfadDl3cDrN7LIUfWHA7bUkd6raNz6Q== X-Google-Smtp-Source: ABdhPJwiucsDJBQx9BmWAmQofOi5n1SOfTRK9ARfaAuMdxykC2kdkI4kUlU6PCv9yQmVyz5VDaRHCNgBPexypZZExdY= X-Received: by 2002:a2e:7314:: with SMTP id o20mr13411784ljc.233.1595959501654; Tue, 28 Jul 2020 11:05:01 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> In-Reply-To: From: Simon Hicks Date: Tue, 28 Jul 2020 19:04:48 +0100 Message-ID: To: Robert Mortimer Cc: ADD Mailing list , Vittorio Bertola Content-Type: multipart/alternative; boundary="0000000000002c3cfa05ab84472f" Archived-At: X-Mailman-Approved-At: Wed, 29 Jul 2020 08:27:06 -0700 Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2020 18:12:43 -0000 --0000000000002c3cfa05ab84472f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Our main aim for government is to get stable networks that work well for all society and industry. So we'd like to see the whole community talking with each other and all parts of the chain working with each other to provide chains that work well. If that doesn't happen then the next step is regulation. Open standards and open markets are a privilege as well as a way of working. If they're not working well then society reflected by governments has to try and make them work. Enough of the philosophy. But get a solution in this room, ie standards, or else others will be making decisions for you. Regards Simon On Tue, 28 Jul 2020 at 18:32, Robert Mortimer wrote: > +1 > > There has to be a user-network negotiation. If they agree stuff works - i= f > they don't the user declines to connect to the network. > > How that's achieved if we assume that users can't be trusted to make > decision as they won't understand the question and anyway the network mig= ht > be lying is obviously gong to be tricky. I think if you decide the user > can't be trusted and remove their agency then we're probably on a hiding = to > nothing ( and this seems to be the direction at least a few people want t= o > head in ). > > -- > Robm > 873 > "Ask not what I can do for the stupid, > but what the stupid can do for me" - Graeme Garden > > On 28/07/2020 12:35:03, Vittorio Bertola 40open-xchange.com@dmarc.ietf.org> wrote: > > > > Il 28/07/2020 12:39 Ted Lemon ha scritto: > > > > > > > On Jul 28, 2020, at 03:34, Paul Vixie wrote: > > > in my estimation, none of the agencies edward snowden warned us about > in 2013 > > > are going to be transparent about surveillance or filtering, so your > fear of > > > them using reliable denial signaling as part of negotiation seems > misplaced. > > > > That=E2=80=99s not the concern. The concern is that if DoH traffic is l= abeled > specifically so that the network can identify it, it will be blocked, > > Why? > > There will be networks that want to block DoH, and there will be others > that don't, and there will be others that will say that you can have DoH > but only if you use the local resolver, or if you use a resolver from a > specific list, or will suggest you a local resolver but then accept a > different choice. > > Then, there will be clients (both on behalf of the user, i.e. anonymizing > browsers, and against the user, i.e. malware) that will want to ignore th= at > policy if they dislike it, and do something else - and there will be > networks that will then react by doing all sorts of bad things to traffic > from those clients. > > We cannot do much in the case when clients (users) and networks (network > providers) disagree, and that case will always exist, but there is a numb= er > of use cases (hopefully most of them) in which users and network provider= s > will cooperate to find a mutually acceptable configuration. What we shoul= d > develop is a way for the client to discover the local DoH resolver's > location and the network policy attached to it, so that the above agreeme= nt > becomes possible in those cases. What the client does with that > information, and whether the client chooses to abide by or defy the local > policy, will then be a choice for the developers of each client (and for > their lawyers and policy officers, I suspect, but that's another > discussion). > > On the other hand, refusing to standardize such a mechanism would be quit= e > a strong policy stance, as it would assume that all networks will always = be > adversarial and badly intentioned so there is no use in even listening to > what they would like to say. I don't think that the IETF should go down > that path. > > -- > Vittorio Bertola | Head of Policy & Innovation, Open-Xchange > vittorio.bertola@open-xchange.com > Office @ Via Treviso 12, 10144 Torino, Italy > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000002c3cfa05ab84472f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Our main aim for government is to get stable networks that wo= rk well for all society and industry.=C2=A0 So we'd like to see the who= le community talking with each other and all parts of the chain working wit= h each other to provide chains that work well. If that doesn't happen t= hen the next step is regulation.=C2=A0 Open standards and open markets are = a privilege as well as a way of working.=C2=A0 If they're not working w= ell then society reflected by governments has to try and make them work.=C2= =A0

<= div class=3D"gmail_default" style=3D"font-size:large">Enough=C2=A0of the ph= ilosophy. But get a solution in this room, ie standards, or else others wil= l be making decisions=C2=A0for you.
=

Regards=C2=A0
Simon=




=


<= /p>

<= /div>


On Tue, 28 Jul 2020 at 18:32, Robert Mortimer <robm=3D40scramworks.net@dmarc.ietf.org&= gt; wrote:
=20 =20 =20 =20 =20 +1=C2=A0

There h= as to be a user-network negotiation. If they agree stuff works - if they do= n't the user declines to connect to the network.

How that's achieved if we assume that users can't be trusted to = make decision as they won't understand the question and anyway the netw= ork might be lying is obviously gong to be tricky. I think if you decide th= e user can't be trusted and remove their agency then we're probably= on a hiding to nothing ( and this seems to be the direction at least a few= people want to head in ).

--=C2=A0
Robm
873
=C2=A0 "Ask not what I can do for the stupid,=C2= =A0
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0but what the stupid can do = for me" - Graeme Garden

On 28/07/2020 12:35:03, Vittorio Bertola <vittorio.bertola=3D40open-xchange= .com@dmarc.ietf.org> wrote:



> Il 28/07/2020 12:39 Ted Lemon ha scri= tto:
>
>
> > On Jul 28, 2020, at 03:34, Paul Vixie = wrote:
> > in my estimation, none of the agencies edward s= nowden warned us about in 2013
> > are going to be transparent ab= out surveillance or filtering, so your fear of
> > them using rel= iable denial signaling as part of negotiation seems misplaced.
>
= > That=E2=80=99s not the concern. The concern is that if DoH traffic is = labeled specifically so that the network can identify it, it will be blocke= d,

Why?

There will be networks that want to block DoH, and th= ere will be others that don't, and there will be others that will say t= hat you can have DoH but only if you use the local resolver, or if you use = a resolver from a specific list, or will suggest you a local resolver but t= hen accept a different choice.

Then, there will be clients (both on = behalf of the user, i.e. anonymizing browsers, and against the user, i.e. m= alware) that will want to ignore that policy if they dislike it, and do som= ething else - and there will be networks that will then react by doing all = sorts of bad things to traffic from those clients.

We cannot do much= in the case when clients (users) and networks (network providers) disagree= , and that case will always exist, but there is a number of use cases (hope= fully most of them) in which users and network providers will cooperate to = find a mutually acceptable configuration. What we should develop is a way f= or the client to discover the local DoH resolver's location and the net= work policy attached to it, so that the above agreement becomes possible in= those cases. What the client does with that information, and whether the c= lient chooses to abide by or defy the local policy, will then be a choice f= or the developers of each client (and for their lawyers and policy officers= , I suspect, but that's another discussion).

On the other hand, = refusing to standardize such a mechanism would be quite a strong policy sta= nce, as it would assume that all networks will always be adversarial and ba= dly intentioned so there is no use in even listening to what they would lik= e to say. I don't think that the IETF should go down that path.

= --
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
= vitt= orio.bertola@open-xchange.com
Office @ Via Treviso 12, 10144 Torino= , Italy

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add=
=20
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000002c3cfa05ab84472f-- From nobody Wed Jul 29 09:04:17 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1CFBC3A0CA2 for ; Wed, 29 Jul 2020 09:04:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Omi1SUhasjfG for ; Wed, 29 Jul 2020 09:04:12 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650104.outbound.protection.outlook.com [40.107.65.104]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2FDB93A0C7B for ; Wed, 29 Jul 2020 09:04:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=CFOlVwQNKv/Aa/2M1VZi7vJyWxG6iO8yR0geqdk9pbVCikIFgZT7pwxLGHYHQqU6Gg//GA/sZtUNGrDXR7DPWClACfDb1S7gl98xzSUtavsj51R8bGYdCYBQGzLVcFg3fAUfBkM7gIVoXyX7PWyw7pIwaX30jITBXoTW+NQv+Sl1SODYSzgRY8XUoMeRQ6MJBSNKCNQvMSPC73XcAkYy8+TRqpeW1xNzW9mL4YKHIc4tiPdjd9OKNEua1T44Lqh4a2hBv9v/HmD2n7g8wbWiZ+cfx81QLkBSbyExFZgj/TjAVKUuEhRlwbHzVWSBnIQ6GGF9bZN0/Wzk4FuC2H6U3Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xPtfZ1JIG3Bigyq5Oh4d824/jEv5gDI5Zp2AfYdeni4=; b=XMLYm66LmJeNiP8g8l4mRH+EFcRMFwnF8E5svsNpCA2QTxQiYej6qhOYzir3oqqeUVs7J9aTnXVUKUAQFodN3YQo93c7eozeEYrjvJZYrgDHCoVFb9F83KjpgHge6vA2PmWw0S3p98lu8f8yR/3+idQOxX0ZjgjNtGZaP1zHLasTjlzqByPvuMgOEOOUWtgB5sIuOxq4MOHsPmpYNllUr7tHo6l4MJyWrE6SCIbhwHMQhWxJQs3XftREEA2u/u2HePGm6h/CWtGO53CqxyQ0VCGj5kMib35JlDX5rZyIxyEV3xiBrgUUr0nwi1maS3RU72lqAjdsKordKC5GUTfgzQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xPtfZ1JIG3Bigyq5Oh4d824/jEv5gDI5Zp2AfYdeni4=; b=JIgdMex5x6HWGZNcUPf6f/YP8zSpTZuNrFJ65JX/lPgVVmw8iPgTLRUcpDKeGdxMLfkwSIF9eAxXOFH4oaFdlw2obWTNRHfmVPfNBSMpErLgTaGKXlSkYhjwbB4ZpcLeu0IkQxiOdLs24gtqie3JFjxq5L3FfjR1j/s+JrotXvs= Received: from BY5PR00MB0775.namprd00.prod.outlook.com (2603:10b6:a03:1d1::12) by BY5PR00MB0849.namprd00.prod.outlook.com (2603:10b6:a03:20a::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3280.0; Wed, 29 Jul 2020 16:04:09 +0000 Received: from BY5PR00MB0775.namprd00.prod.outlook.com ([fe80::cda1:dcfa:ac82:b6af]) by BY5PR00MB0775.namprd00.prod.outlook.com ([fe80::cda1:dcfa:ac82:b6af%7]) with mapi id 15.20.3280.000; Wed, 29 Jul 2020 16:04:09 +0000 From: Tommy Jensen To: Simon Hicks , Robert Mortimer CC: ADD Mailing list , Vittorio Bertola Thread-Topic: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWZLGV7A1JtnrexkqDcLFH6GVWT6kczXMAgAAO9ICAAGPaAIAACYUAgAFsd2A= Date: Wed, 29 Jul 2020 16:04:09 +0000 Message-ID: References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-29T16:04:09.237Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; authentication-results: dcms.gov.uk; dkim=none (message not signed) header.d=none;dcms.gov.uk; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2601:600:a080:aff0:5c11:1a07:3176:f96c] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 1ed84b61-8201-47a4-b7a7-08d833d90776 x-ms-traffictypediagnostic: BY5PR00MB0849: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:1775; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 4zUb5WqEqH0lwrULzB22x6qTOAYocE9eAN25dYFwnXiDJrSZWWxSe8A8g3adADDlpG33vUrIw347Xl7+Av85iCwYyUHRGNzvq7Sbxz/KJupiq3J43Ku3Oa3dRwgzjTdke/ZodjvU/JYgniri6Gmx2NI7xk/B8Ar34JXjORpE6benMyUArpzy5j2rjMN2RhqaaRM5Ly1C6RnXq4OD9PfvLSQlrgYtEiKr5bH38CfrDSqr57GwRrmUFy3PqfpeWlVaALtO/aR5GK/BsrZjoUIxfyN+HG/WUfnxJvppzbgg6Bl4FnX9r5OT6wwD0nB+tibQfNYHL6mEjuDBJH6V1EqVuGTtgiz/J8+s8al8hjFmMk8j5dfWzYK+D3orVKzdbDz082Nw/wy5ANqIkthZgpqKiQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR00MB0775.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(366004)(376002)(136003)(396003)(346002)(39860400002)(19627405001)(66476007)(64756008)(66446008)(66946007)(86362001)(82950400001)(82960400001)(8990500004)(66556008)(8676002)(54906003)(10290500003)(53546011)(6506007)(4326008)(7696005)(316002)(71200400001)(110136005)(166002)(2906002)(55016002)(9686003)(186003)(478600001)(8936002)(33656002)(66574015)(91956017)(76116006)(5660300002)(966005)(52536014)(83380400001)(15650500001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: 27dODMPe5nrtpK7LJfw6yFwmWifjON4URRs79jWR8pzq//FleVVGAJeTRpbIezpxqv2T87zOW6wCQfQM+TLZAyPXAX/MgP/gOK/btezLCPe8FCdHinXuRSteQyS25uyeTJF6Jz8sgE+NT6gCDzvENs2of5RGAEPLeqviRvXL4S+go26OVPA+gZ8DX6mM6yteymI3xB/2e4OOc+WomNjplh1djL6PycOsNi7ljbM3pzSttRDR4ODngrIjM9ytQf9zVbc7vKtdrXn6UIFyY5MttxU71ay9MSACQDaHRpbyw0oT55lRO8oT4Pu4DEt/HRb5IBOuqQxRNooUOmV3iI8JpJ7H2y+4A5Ql0JFeeUyoAPNt00+yrfTGsfSV/AEMFTTM5xfKFPpCX5lp3MUf38Mhecl0UQiS3XowZ2CNcinQWNkZMkqOzfS06BZVgrcHR+5Z5XBBpBQkUn/BhufJbXl+k89wvOlmjjhGPD4/MaonM2MMtIt9uutfzmgUO0OKfS5gLibqy0N6pgwL4gDj+lL7oJPhdKNzFF96HdsbyE/e3BrDJg90u5zyUkZHJ93tZqMYZ1Fy89x/T7ZTlm9xz5UiVXs5Km8LqfGcyORtkJXgxFJsSRbAfvYbZWHnVXIRhzStnEFJ6UFfQg+TLU3Tg5tiq6wfkI59lK+Xi5uTpvjIZQKU2fpMaVPmmRx2xoV9BAi7RFfYIZ5i5R2WtkMsAFsPLQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_BY5PR00MB0775298184BE5D86FD4138AEFA700BY5PR00MB0775namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY5PR00MB0775.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1ed84b61-8201-47a4-b7a7-08d833d90776 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Jul 2020 16:04:09.7562 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: u1TF2h2zF8zI4NixXtdyfUsbD/83wGz1T8ju/w7piFpiDYxPa0RkU3a97/TjMTMTGjYlyEWZnWfEcH/QHQhNlw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR00MB0849 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 16:04:16 -0000 --_000_BY5PR00MB0775298184BE5D86FD4138AEFA700BY5PR00MB0775namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable simon> So we'd like to see the whole community talking with each other and = all parts of the chain working with each other to provide chains that work = well That's what is happening. Everyone here wants a well-functioning ecosystem.= Our disagreements and discussions aren't evidence that we don't; they're e= vidence that we all have different perspective that require time and delibe= ration to work through. If there are concrete features that define "chains that work well" you're n= ot seeing in our current drafts, please share. Vittorio changed my thinking= with regards to government requirements just this morning (afternoon?) in = DNSOP by providing a concrete use case for Italian DNS handling. Thanks, Tommy Jensen =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The latest in Windows Internet Protocols: Native gRPC support: https://aka.ms/grpcblogpost DNS over HTTPS: https://aka.ms/dohblogpost ________________________________ From: Add on behalf of Simon Hicks Sent: Tuesday, July 28, 2020 11:04 AM To: Robert Mortimer Cc: ADD Mailing list ; Vittorio Bertola Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-= add-resolver-discovery-01.txt Our main aim for government is to get stable networks that work well for al= l society and industry. So we'd like to see the whole community talking wi= th each other and all parts of the chain working with each other to provide= chains that work well. If that doesn't happen then the next step is regula= tion. Open standards and open markets are a privilege as well as a way of = working. If they're not working well then society reflected by governments= has to try and make them work. Enough of the philosophy. But get a solution in this room, ie standards, or= else others will be making decisions for you. Regards Simon On Tue, 28 Jul 2020 at 18:32, Robert Mortimer > wrote: +1 There has to be a user-network negotiation. If they agree stuff works - if = they don't the user declines to connect to the network. How that's achieved if we assume that users can't be trusted to make decisi= on as they won't understand the question and anyway the network might be ly= ing is obviously gong to be tricky. I think if you decide the user can't be= trusted and remove their agency then we're probably on a hiding to nothing= ( and this seems to be the direction at least a few people want to head in= ). -- Robm 873 "Ask not what I can do for the stupid, but what the stupid can do for me" - Graeme Garden On 28/07/2020 12:35:03, Vittorio Bertola > wrote: > Il 28/07/2020 12:39 Ted Lemon ha scritto: > > > > On Jul 28, 2020, at 03:34, Paul Vixie wrote: > > in my estimation, none of the agencies edward snowden warned us about i= n 2013 > > are going to be transparent about surveillance or filtering, so your fe= ar of > > them using reliable denial signaling as part of negotiation seems mispl= aced. > > That=92s not the concern. The concern is that if DoH traffic is labeled s= pecifically so that the network can identify it, it will be blocked, Why? There will be networks that want to block DoH, and there will be others tha= t don't, and there will be others that will say that you can have DoH but o= nly if you use the local resolver, or if you use a resolver from a specific= list, or will suggest you a local resolver but then accept a different cho= ice. Then, there will be clients (both on behalf of the user, i.e. anonymizing b= rowsers, and against the user, i.e. malware) that will want to ignore that = policy if they dislike it, and do something else - and there will be networ= ks that will then react by doing all sorts of bad things to traffic from th= ose clients. We cannot do much in the case when clients (users) and networks (network pr= oviders) disagree, and that case will always exist, but there is a number o= f use cases (hopefully most of them) in which users and network providers w= ill cooperate to find a mutually acceptable configuration. What we should d= evelop is a way for the client to discover the local DoH resolver's locatio= n and the network policy attached to it, so that the above agreement become= s possible in those cases. What the client does with that information, and = whether the client chooses to abide by or defy the local policy, will then = be a choice for the developers of each client (and for their lawyers and po= licy officers, I suspect, but that's another discussion). On the other hand, refusing to standardize such a mechanism would be quite = a strong policy stance, as it would assume that all networks will always be= adversarial and badly intentioned so there is no use in even listening to = what they would like to say. I don't think that the IETF should go down tha= t path. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add --_000_BY5PR00MB0775298184BE5D86FD4138AEFA700BY5PR00MB0775namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
simon> So we'd like to see the whole community talking with each other and all parts= of the chain working with each other to provide chains that work well

That's what is happening. Everyone here wants a well-= functioning ecosystem. Our disagreements and discussions aren't evidence that we don't; they're evidence that we al= l have different perspective that require time and deliberation to work thr= ough. 

If there are concrete features that define "chai= ns that work well" you're not seeing in our current drafts, please share. Vittorio changed my thinking with regard= s to government requirements just this morning (afternoon?) in DNSOP by pro= viding a concrete use case for Italian DNS handling.

Thanks,=
Tommy Jensen
=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The latest in Wi= ndows Internet Protocols:
  Native gR= PC support: https://aka.ms/grpcblogpost 
  DNS over = HTTPS: https://aka.ms/dohblogpost=  
From: Add <add-bounces@i= etf.org> on behalf of Simon Hicks <simon.hicks@dcms.gov.uk>
Sent: Tuesday, July 28, 2020 11:04 AM
To: Robert Mortimer <robm=3D40scramworks.net@dmarc.ietf.org> Cc: ADD Mailing list <add@ietf.org>; Vittorio Bertola <vitt= orio.bertola=3D40open-xchange.com@dmarc.ietf.org>
Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft= -pauly-add-resolver-discovery-01.txt
 
Our main aim for g= overnment is to get stable networks that work well for all society and indu= stry.  So we'd like to see the whole community talking with each other= and all parts of the chain working with each other to provide chains that work well. If that doesn't happen then t= he next step is regulation.  Open standards and open markets are a pri= vilege as well as a way of working.  If they're not working well then = society reflected by governments has to try and make them work. 

Enough of the= philosophy. But get a solution in this room, ie standards, or else others = will be making decisions for you.

Regards 
Simon




On Tue, 28 Jul 2020 at 18:32, Rober= t Mortimer <robm=3D40= scramworks.net@dmarc.ietf.org> wrote:
+1 

There has to be a user-network negotiation. If they agree stuff works = - if they don't the user declines to connect to the network.

How that's achieved if we assume that users can't be trusted to make d= ecision as they won't understand the question and anyway the network might = be lying is obviously gong to be tricky. I think if you decide the user can= 't be trusted and remove their agency then we're probably on a hiding to nothing ( and this seems to be the dire= ction at least a few people want to head in ).

-- 
Robm
873
  "Ask not what I can do for the stupid, 
         but what the stupid can do for me&qu= ot; - Graeme Garden

On 28/07/2020 12:35:03= , Vittorio Bertola <vittorio.bertola=3D40open-xchange..com@dmarc.ietf.org> wrote:



> Il 28/07/2020 12:39 Ted Lemon ha scritto:
>
>
> > On Jul 28, 2020, at 03:34, Paul Vixie wrote:
> > in my estimation, none of the agencies edward snowden warned us a= bout in 2013
> > are going to be transparent about surveillance or filtering, so y= our fear of
> > them using reliable denial signaling as part of negotiation seems= misplaced.
>
> That=92s not the concern. The concern is that if DoH traffic is labele= d specifically so that the network can identify it, it will be blocked,

Why?

There will be networks that want to block DoH, and there will be others tha= t don't, and there will be others that will say that you can have DoH but o= nly if you use the local resolver, or if you use a resolver from a specific= list, or will suggest you a local resolver but then accept a different choice.

Then, there will be clients (both on behalf of the user, i.e. anonymizing b= rowsers, and against the user, i.e. malware) that will want to ignore that = policy if they dislike it, and do something else - and there will be networ= ks that will then react by doing all sorts of bad things to traffic from those clients.

We cannot do much in the case when clients (users) and networks (network pr= oviders) disagree, and that case will always exist, but there is a number o= f use cases (hopefully most of them) in which users and network providers w= ill cooperate to find a mutually acceptable configuration. What we should develop is a way for the client t= o discover the local DoH resolver's location and the network policy attache= d to it, so that the above agreement becomes possible in those cases. What = the client does with that information, and whether the client chooses to abide by or defy the local policy, will = then be a choice for the developers of each client (and for their lawyers a= nd policy officers, I suspect, but that's another discussion).

On the other hand, refusing to standardize such a mechanism would be quite = a strong policy stance, as it would assume that all networks will always be= adversarial and badly intentioned so there is no use in even listening to = what they would like to say. I don't think that the IETF should go down that path.

--
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vitt= orio.bertola@open-xchange.com
Office @ Via Treviso 12, 10144 Torino, Italy

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--_000_BY5PR00MB0775298184BE5D86FD4138AEFA700BY5PR00MB0775namp_-- From nobody Wed Jul 29 09:10:47 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F20123A0C0A for ; Wed, 29 Jul 2020 09:10:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.888 X-Spam-Level: X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, T_SPF_TEMPERROR=0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zp9a46bMu6Qf for ; Wed, 29 Jul 2020 09:10:39 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110063.outbound.protection.outlook.com [40.107.11.63]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1670D3A0CD1 for ; Wed, 29 Jul 2020 09:10:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=KSlqmUj2QxRvtvsMaE6JuMyaInTRa2t4xnRdackHikCKBONAmOAEZhr/YPcznph5viEYyK59AVaLM0LXdVSpotorQqw4uwJFCCz8iBVHCeQjw3/vPU1eLdfAoC99cL4yJuCjjLUgyAX39UGJUTTd7czTyfe/OmeQSOgJ0wv8N9TQ7xZDe9rh+YYmswFnUccGJKc6Tn3Uf4+3SsD4xhvKRmiw7vi66wtHyLz4euW/RQ98t60QB20q83J+OnM7XyqRX//fwQNs4yKGy+4XuTm2+j+thPZh//dfOOXsj0q33Ux4tOp3JayKGJdauTgwT6nwXZWvn3e8i676yK5BLeGeeg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fo01hk0lKmmbbPXbUvhLaOIAjx+ywa8jUgzB8Itn2JE=; b=jIVin9yLApc+H4zV0/DNyX90Q+PUUWFj4zdG4essb6YSjaXwrM/IpW+zwFOV/UCvJ3cxMuD+a8HmPrZma5P5lQeN//pWp6WKKycQJMs3nH/dPf7ngfWK8Wq1DEMGIVNdgYdI21p6MdFWka8/twaMq0dOrYsMZjHqEATjsw0KXuivqFqSSm4HtKt+quEmymtb7RPcPvINYi0Qk7bv/AasgyM2y75SiF8XS+AptJebO25Lh6YED6GE5MsLJEskN9gZIMemPWF2CvdKXNtr7sfctHKtW4OTzpvi2jrUBXSvq1vpGA1GyiZcQtVov578Z4/GXw8Bcgp/OR9sMWxXIi0geQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fo01hk0lKmmbbPXbUvhLaOIAjx+ywa8jUgzB8Itn2JE=; b=jiGtAAyaHVnLBlHpbEf4VbPy6HMlnbQoFkgncGm3SueASF57ktqk1yMevJKmbgUGCmSxrQE8lxAxlj2nCT6SV8kKVKtYHOab+wrn4lOQRFDMFGNPhpfp6k35PPvmfQeO0DaJk1tnC3xhWi4c+UU5JadBFsAHfZP/8f7PxHtQSko= Received: from CWXP265MB0566.GBRP265.PROD.OUTLOOK.COM (2603:10a6:401:b::21) by CWLP265MB1364.GBRP265.PROD.OUTLOOK.COM (2603:10a6:401:2f::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.22; Wed, 29 Jul 2020 16:10:05 +0000 Received: from CWXP265MB0566.GBRP265.PROD.OUTLOOK.COM ([fe80::1d1a:4948:306e:f184]) by CWXP265MB0566.GBRP265.PROD.OUTLOOK.COM ([fe80::1d1a:4948:306e:f184%7]) with mapi id 15.20.3216.034; Wed, 29 Jul 2020 16:10:05 +0000 From: Andrew Campling To: Simon Hicks , Robert Mortimer , Vittorio Bertola , Ted Lemon CC: ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWZbzAFhCIoK811kGZn5p8lxrWiKketOWQ Date: Wed, 29 Jul 2020 16:10:04 +0000 Message-ID: References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dcms.gov.uk; dkim=none (message not signed) header.d=none; dcms.gov.uk; dmarc=none action=none header.from=419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:d7d:61d3:214:8fb8] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: de2d9260-6ff9-4303-637e-08d833d9db20 x-ms-traffictypediagnostic: CWLP265MB1364: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:4303; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: fReGlK0dRI+YdPz8YUEbTGDwOqUwXwTmsiL3gG0c+Hpnrmc9Ij2tJM3FNk/mYB4rFVbWds4HlN9lhWTUPFajwaJXWmqxCZkn3tqczqL+cLk9HzTNHq4IyKertr+wI1IwCQMl3gVEfQVWFIYs7elZRUmbTBzjOxjM7XMFFfcJLN7jaw4qRtLQF7/tEJpHlmZTwlOsJm2FTwffINwHqfvKZIiDeJk+nORK7pYAYQXygt2aP1ugRSZWzJUyPyEraU8DBdz3DmUXuyZry+bUPCSq5L4nBoC2OVsMGDSrG4jHslqpHer00g3sLTAmDiLkWTiejaDgRte5T3GDT4pZ7vgGmQVBc8r+AWs77m/rOhYHioWdB7eI5onJwUZrPk5RQ5r+NSbpQ/J/G1bXIGt7t5tuQY1gBMZycEwpzd+H7d592IMeGhKFm8+JiaqMxKeMRhpeHT6itvo8udjNlmZUxSrQug== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CWXP265MB0566.GBRP265.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFTY:; SFS:(376002)(39830400003)(396003)(366004)(136003)(346002)(52536014)(8676002)(8936002)(44832011)(86362001)(966005)(71200400001)(7696005)(55016002)(5660300002)(9686003)(186003)(2906002)(6506007)(53546011)(110136005)(33656002)(166002)(66476007)(15650500001)(508600001)(64756008)(66556008)(66446008)(76116006)(66574015)(4326008)(83380400001)(66946007)(316002)(46492007); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: aZi4czpGdvkxoivRZTzL/M4MFikQQSSlUGXaW3Fj5rrHI+XtqG3VAucJlt1klAKfZAm4ML/nIizcxZULvJ1vki2GWE80Q0a6AISxoYQdn0tlnFD5EY6SeN/Z1vZfg9lX+Zx5go6OjF14lynJTb+7XmwBaZDweyJV843jkOQU/xas7wh4D8ehkfKHJJXtnhpnZEPbw1Xm3eZKmg2wjfI8F2WPTB85EKljqHr+A2XdfA4qYX9w+WrIGT99SHcfYdFyK+BSJt6lGxRRmWV8AT/1wehDaZpLVQDZ7k8msDpWFQ2gM2VrUJcdn1sGShNXQ8zNc1wvSQ/vSmVmM7of6IufcGl6irRmJ1DvFLMO8OARLzY2iDVADY9/NgX2Ezvc3nO8GIPqBAqs9I7v0jUAlqPQAeMmWTPRPybFv3Iq4hiUtRqmPEd6RjP32nBW76E4zDajpr9ce6wR7FrB97EsD0/hdzs7bD+En+9aXB33YwN4pOWplCCG9PrwvTtI1xERqnKLh/x2Dn+0nTWUZp9n5QW5UIlPFpfAtJy0Sfj+urLzfkOC0UoVa1HZi14NMn3O4eYi x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CWXP265MB0566B8EE78D37F2A7C4BA655C2700CWXP265MB0566GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: CWXP265MB0566.GBRP265.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: de2d9260-6ff9-4303-637e-08d833d9db20 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Jul 2020 16:10:04.9618 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 0YPk+DHRwM/kgBhGdQv2oGyq8cYk8UfwALrZH12T4RJtHNPcZp6dkexi1vLoVummF4fhUe/OfOy5ZpPG0YFPuJIb1/cutId438WXxIHWAek= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP265MB1364 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 16:10:44 -0000 --_000_CWXP265MB0566B8EE78D37F2A7C4BA655C2700CWXP265MB0566GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Tm90aW5nIFNpbW9u4oCZcyBhbmQgUm9i4oCZcyBjb21tZW50cyBiZWxvdywgaXQgd291bGQgYmUg aGVscGZ1bCB0byBmb2N1cyBvbiB3YXlzIHRvIGltcGxlbWVudCBkaXNjb3ZlcnkgdGhhdCBtaWdo dCBiZSByZWFzb25hYmx5IGV4cGVjdGVkIHRvIHdvcmsgZm9yIHRoZSB1c2Vycyogb2YgdGhlIG5l dHdvcmsgYXJjaGl0ZWN0dXJlcyB0aGF0IGFyZSBjb21tb25seSBkZXBsb3llZCwgYW5kIGluIHBh cnRpY3VsYXIgdG8gbWFrZSBzdXJlIHRoYXQgdGhpbmdzIHdvcmsgYXMgc21vb3RobHkgYXMgcG9z c2libGUgZnJvbSB0aGUgcGVyc3BlY3RpdmUgb2YgdGhvc2UgdXNlcnMuICBJIGJlbGlldmUgdGhh dCB0aGlzIHdvdWxkIGJlIGNvbnNpc3RlbnQgd2l0aCB0aGUgcGFwZXIgZGlzY3Vzc2VkIGF0IHRo ZSBJQUIgb3BlbiBtZWV0aW5nIHllc3RlcmRheSDigJMgc2VlIGRyYWZ0LWlhYi1mb3ItdGhlLXVz ZXJzLTA0LCB3aGljaCBzdGF0ZXMg4oCcd2hlbiB0aGVyZSBpcyBhIGNvbmZsaWN0IGJldHdlZW4g dGhlIGludGVyZXN0cyBvZiBlbmQgdXNlcnMgb2YgdGhlIEludGVybmV0IGFuZCBvdGhlciBwYXJ0 aWVzLCBJRVRGIGRlY2lzaW9ucyBzaG91bGQgZmF2b3VyIGVuZCB1c2Vyc+KAnS4gIEFzIFJvYiBj b21tZW50cywgSSB0aGluayBpZiB5b3UgZGVjaWRlIHRoZSB1c2VyIGNhbid0IGJlIHRydXN0ZWQg YW5kIHJlbW92ZSB0aGVpciBhZ2VuY3kgdGhlbiB3ZSdyZSBwcm9iYWJseSBvbiBhIGhpZGluZyB0 byBub3RoaW5nLg0KDQpNeSBjb25jZXJuIGlzIHRoYXQgc29tZSBhcHByb2FjaGVzIGFwcGVhciB0 byBiZSBtYW5kYXRpbmcgdGhlIGRlbGVnYXRpb24gb2YgY29udHJvbCB0byB0aGUgY2xpZW50IHNv ZnR3YXJlIG9yIG90aGVyIG1lY2hhbmlzbXMgbm90IGludm9sdmluZyB0aGUgdXNlci4gIEkgZG9u 4oCZdCBiZWxpZXZlIHRoYXQgdGhpcyBpcyB0aGUgY29ycmVjdCBhcHByb2FjaCwgZmVhciBpdCBt YXkgc3RydWdnbGUgcmVnYXJkaW5nIEdEUFIgY29tcGxpYW5jZSBhbmQgY2VydGFpbmx5IHNlZW1z IGF0IG9kZHMgd2l0aCB0aGUgSUFCIGRvY3VtZW50LiAgSSBtYXkgb2YgY291cnNlIGJlIG1pc3Vu ZGVyc3RhbmRpbmcgd2hhdCBwZW9wbGUgYXJlIHRyeWluZyB0byBhY2hpZXZlLg0KDQoNCkFuZHJl dw0KDQoqIE5CIOKAnFVzZXJz4oCdIG1heSBvZiBjb3Vyc2UgaW5jbHVkZSBlbnRpdGllcyBvdGhl ciB0aGFuIGVuZCB1c2VycyB0aGF0IGhhdmUgYSByZWFzb25hYmxlIGV4cGVjdGF0aW9uIG9mIGNv bnRyb2wsIGluY2x1ZGluZyBlbnRlcnByaXNlcywgcGFyZW50cywgcHJpdmF0ZSBuZXR3b3JrIG9w ZXJhdG9ycyBldGMuDQoNCkZyb206IFNpbW9uIEhpY2tzIDxzaW1vbi5oaWNrc0BkY21zLmdvdi51 az4NClNlbnQ6IDI4IEp1bHkgMjAyMCAxOTowNQ0KVG86IFJvYmVydCBNb3J0aW1lciA8cm9ibT00 MHNjcmFtd29ya3MubmV0QGRtYXJjLmlldGYub3JnPg0KQ2M6IEFERCBNYWlsaW5nIGxpc3QgPGFk ZEBpZXRmLm9yZz47IFZpdHRvcmlvIEJlcnRvbGEgPHZpdHRvcmlvLmJlcnRvbGE9NDBvcGVuLXhj aGFuZ2UuY29tQGRtYXJjLmlldGYub3JnPg0KU3ViamVjdDogUmU6IFtBZGRdIFtFWFRFUk5BTF0g UmU6IE5ldyBWZXJzaW9uIE5vdGlmaWNhdGlvbiBmb3IgZHJhZnQtcGF1bHktYWRkLXJlc29sdmVy LWRpc2NvdmVyeS0wMS50eHQNCg0KT3VyIG1haW4gYWltIGZvciBnb3Zlcm5tZW50IGlzIHRvIGdl dCBzdGFibGUgbmV0d29ya3MgdGhhdCB3b3JrIHdlbGwgZm9yIGFsbCBzb2NpZXR5IGFuZCBpbmR1 c3RyeS4gIFNvIHdlJ2QgbGlrZSB0byBzZWUgdGhlIHdob2xlIGNvbW11bml0eSB0YWxraW5nIHdp dGggZWFjaCBvdGhlciBhbmQgYWxsIHBhcnRzIG9mIHRoZSBjaGFpbiB3b3JraW5nIHdpdGggZWFj aCBvdGhlciB0byBwcm92aWRlIGNoYWlucyB0aGF0IHdvcmsgd2VsbC4gSWYgdGhhdCBkb2Vzbid0 IGhhcHBlbiB0aGVuIHRoZSBuZXh0IHN0ZXAgaXMgcmVndWxhdGlvbi4gIE9wZW4gc3RhbmRhcmRz IGFuZCBvcGVuIG1hcmtldHMgYXJlIGEgcHJpdmlsZWdlIGFzIHdlbGwgYXMgYSB3YXkgb2Ygd29y a2luZy4gIElmIHRoZXkncmUgbm90IHdvcmtpbmcgd2VsbCB0aGVuIHNvY2lldHkgcmVmbGVjdGVk IGJ5IGdvdmVybm1lbnRzIGhhcyB0byB0cnkgYW5kIG1ha2UgdGhlbSB3b3JrLg0KDQpFbm91Z2gg b2YgdGhlIHBoaWxvc29waHkuIEJ1dCBnZXQgYSBzb2x1dGlvbiBpbiB0aGlzIHJvb20sIGllIHN0 YW5kYXJkcywgb3IgZWxzZSBvdGhlcnMgd2lsbCBiZSBtYWtpbmcgZGVjaXNpb25zIGZvciB5b3Uu DQoNClJlZ2FyZHMNClNpbW9uDQoNCg0KDQoNCg0KDQpPbiBUdWUsIDI4IEp1bCAyMDIwIGF0IDE4 OjMyLCBSb2JlcnQgTW9ydGltZXIgPHJvYm09NDBzY3JhbXdvcmtzLm5ldEBkbWFyYy5pZXRmLm9y ZzxtYWlsdG86NDBzY3JhbXdvcmtzLm5ldEBkbWFyYy5pZXRmLm9yZz4+IHdyb3RlOg0KKzENCg0K VGhlcmUgaGFzIHRvIGJlIGEgdXNlci1uZXR3b3JrIG5lZ290aWF0aW9uLiBJZiB0aGV5IGFncmVl IHN0dWZmIHdvcmtzIC0gaWYgdGhleSBkb24ndCB0aGUgdXNlciBkZWNsaW5lcyB0byBjb25uZWN0 IHRvIHRoZSBuZXR3b3JrLg0KDQpIb3cgdGhhdCdzIGFjaGlldmVkIGlmIHdlIGFzc3VtZSB0aGF0 IHVzZXJzIGNhbid0IGJlIHRydXN0ZWQgdG8gbWFrZSBkZWNpc2lvbiBhcyB0aGV5IHdvbid0IHVu ZGVyc3RhbmQgdGhlIHF1ZXN0aW9uIGFuZCBhbnl3YXkgdGhlIG5ldHdvcmsgbWlnaHQgYmUgbHlp bmcgaXMgb2J2aW91c2x5IGdvbmcgdG8gYmUgdHJpY2t5LiBJIHRoaW5rIGlmIHlvdSBkZWNpZGUg dGhlIHVzZXIgY2FuJ3QgYmUgdHJ1c3RlZCBhbmQgcmVtb3ZlIHRoZWlyIGFnZW5jeSB0aGVuIHdl J3JlIHByb2JhYmx5IG9uIGEgaGlkaW5nIHRvIG5vdGhpbmcgKCBhbmQgdGhpcyBzZWVtcyB0byBi ZSB0aGUgZGlyZWN0aW9uIGF0IGxlYXN0IGEgZmV3IHBlb3BsZSB3YW50IHRvIGhlYWQgaW4gKS4N Cg0KLS0NClJvYm0NCjg3Mw0KICAiQXNrIG5vdCB3aGF0IEkgY2FuIGRvIGZvciB0aGUgc3R1cGlk LA0KICAgICAgICAgYnV0IHdoYXQgdGhlIHN0dXBpZCBjYW4gZG8gZm9yIG1lIiAtIEdyYWVtZSBH YXJkZW4NCg0KT24gMjgvMDcvMjAyMCAxMjozNTowMywgVml0dG9yaW8gQmVydG9sYSA8dml0dG9y aW8uYmVydG9sYT00MG9wZW4teGNoYW5nZS4uY29tQGRtYXJjLmlldGYub3JnPG1haWx0bzo0MG9w ZW4teGNoYW5nZS5jb21AZG1hcmMuaWV0Zi5vcmc+PiB3cm90ZToNCg0KDQo+IElsIDI4LzA3LzIw MjAgMTI6MzkgVGVkIExlbW9uIGhhIHNjcml0dG86DQo+DQo+DQo+ID4gT24gSnVsIDI4LCAyMDIw LCBhdCAwMzozNCwgUGF1bCBWaXhpZSB3cm90ZToNCj4gPiBpbiBteSBlc3RpbWF0aW9uLCBub25l IG9mIHRoZSBhZ2VuY2llcyBlZHdhcmQgc25vd2RlbiB3YXJuZWQgdXMgYWJvdXQgaW4gMjAxMw0K PiA+IGFyZSBnb2luZyB0byBiZSB0cmFuc3BhcmVudCBhYm91dCBzdXJ2ZWlsbGFuY2Ugb3IgZmls dGVyaW5nLCBzbyB5b3VyIGZlYXIgb2YNCj4gPiB0aGVtIHVzaW5nIHJlbGlhYmxlIGRlbmlhbCBz aWduYWxpbmcgYXMgcGFydCBvZiBuZWdvdGlhdGlvbiBzZWVtcyBtaXNwbGFjZWQuDQo+DQo+IFRo YXTigJlzIG5vdCB0aGUgY29uY2Vybi4gVGhlIGNvbmNlcm4gaXMgdGhhdCBpZiBEb0ggdHJhZmZp YyBpcyBsYWJlbGVkIHNwZWNpZmljYWxseSBzbyB0aGF0IHRoZSBuZXR3b3JrIGNhbiBpZGVudGlm eSBpdCwgaXQgd2lsbCBiZSBibG9ja2VkLA0KDQpXaHk/DQoNClRoZXJlIHdpbGwgYmUgbmV0d29y a3MgdGhhdCB3YW50IHRvIGJsb2NrIERvSCwgYW5kIHRoZXJlIHdpbGwgYmUgb3RoZXJzIHRoYXQg ZG9uJ3QsIGFuZCB0aGVyZSB3aWxsIGJlIG90aGVycyB0aGF0IHdpbGwgc2F5IHRoYXQgeW91IGNh biBoYXZlIERvSCBidXQgb25seSBpZiB5b3UgdXNlIHRoZSBsb2NhbCByZXNvbHZlciwgb3IgaWYg eW91IHVzZSBhIHJlc29sdmVyIGZyb20gYSBzcGVjaWZpYyBsaXN0LCBvciB3aWxsIHN1Z2dlc3Qg eW91IGEgbG9jYWwgcmVzb2x2ZXIgYnV0IHRoZW4gYWNjZXB0IGEgZGlmZmVyZW50IGNob2ljZS4N Cg0KVGhlbiwgdGhlcmUgd2lsbCBiZSBjbGllbnRzIChib3RoIG9uIGJlaGFsZiBvZiB0aGUgdXNl ciwgaS5lLiBhbm9ueW1pemluZyBicm93c2VycywgYW5kIGFnYWluc3QgdGhlIHVzZXIsIGkuZS4g bWFsd2FyZSkgdGhhdCB3aWxsIHdhbnQgdG8gaWdub3JlIHRoYXQgcG9saWN5IGlmIHRoZXkgZGlz bGlrZSBpdCwgYW5kIGRvIHNvbWV0aGluZyBlbHNlIC0gYW5kIHRoZXJlIHdpbGwgYmUgbmV0d29y a3MgdGhhdCB3aWxsIHRoZW4gcmVhY3QgYnkgZG9pbmcgYWxsIHNvcnRzIG9mIGJhZCB0aGluZ3Mg dG8gdHJhZmZpYyBmcm9tIHRob3NlIGNsaWVudHMuDQoNCldlIGNhbm5vdCBkbyBtdWNoIGluIHRo ZSBjYXNlIHdoZW4gY2xpZW50cyAodXNlcnMpIGFuZCBuZXR3b3JrcyAobmV0d29yayBwcm92aWRl cnMpIGRpc2FncmVlLCBhbmQgdGhhdCBjYXNlIHdpbGwgYWx3YXlzIGV4aXN0LCBidXQgdGhlcmUg aXMgYSBudW1iZXIgb2YgdXNlIGNhc2VzIChob3BlZnVsbHkgbW9zdCBvZiB0aGVtKSBpbiB3aGlj aCB1c2VycyBhbmQgbmV0d29yayBwcm92aWRlcnMgd2lsbCBjb29wZXJhdGUgdG8gZmluZCBhIG11 dHVhbGx5IGFjY2VwdGFibGUgY29uZmlndXJhdGlvbi4gV2hhdCB3ZSBzaG91bGQgZGV2ZWxvcCBp cyBhIHdheSBmb3IgdGhlIGNsaWVudCB0byBkaXNjb3ZlciB0aGUgbG9jYWwgRG9IIHJlc29sdmVy J3MgbG9jYXRpb24gYW5kIHRoZSBuZXR3b3JrIHBvbGljeSBhdHRhY2hlZCB0byBpdCwgc28gdGhh dCB0aGUgYWJvdmUgYWdyZWVtZW50IGJlY29tZXMgcG9zc2libGUgaW4gdGhvc2UgY2FzZXMuIFdo YXQgdGhlIGNsaWVudCBkb2VzIHdpdGggdGhhdCBpbmZvcm1hdGlvbiwgYW5kIHdoZXRoZXIgdGhl IGNsaWVudCBjaG9vc2VzIHRvIGFiaWRlIGJ5IG9yIGRlZnkgdGhlIGxvY2FsIHBvbGljeSwgd2ls bCB0aGVuIGJlIGEgY2hvaWNlIGZvciB0aGUgZGV2ZWxvcGVycyBvZiBlYWNoIGNsaWVudCAoYW5k IGZvciB0aGVpciBsYXd5ZXJzIGFuZCBwb2xpY3kgb2ZmaWNlcnMsIEkgc3VzcGVjdCwgYnV0IHRo YXQncyBhbm90aGVyIGRpc2N1c3Npb24pLg0KDQpPbiB0aGUgb3RoZXIgaGFuZCwgcmVmdXNpbmcg dG8gc3RhbmRhcmRpemUgc3VjaCBhIG1lY2hhbmlzbSB3b3VsZCBiZSBxdWl0ZSBhIHN0cm9uZyBw b2xpY3kgc3RhbmNlLCBhcyBpdCB3b3VsZCBhc3N1bWUgdGhhdCBhbGwgbmV0d29ya3Mgd2lsbCBh bHdheXMgYmUgYWR2ZXJzYXJpYWwgYW5kIGJhZGx5IGludGVudGlvbmVkIHNvIHRoZXJlIGlzIG5v IHVzZSBpbiBldmVuIGxpc3RlbmluZyB0byB3aGF0IHRoZXkgd291bGQgbGlrZSB0byBzYXkuIEkg ZG9uJ3QgdGhpbmsgdGhhdCB0aGUgSUVURiBzaG91bGQgZ28gZG93biB0aGF0IHBhdGguDQoNCi0t DQpWaXR0b3JpbyBCZXJ0b2xhIHwgSGVhZCBvZiBQb2xpY3kgJiBJbm5vdmF0aW9uLCBPcGVuLVhj aGFuZ2UNCnZpdHRvcmlvLmJlcnRvbGFAb3Blbi14Y2hhbmdlLmNvbTxtYWlsdG86dml0dG9yaW8u YmVydG9sYUBvcGVuLXhjaGFuZ2UuY29tPg0KT2ZmaWNlIEAgVmlhIFRyZXZpc28gMTIsIDEwMTQ0 IFRvcmlubywgSXRhbHkNCg0KLS0NCkFkZCBtYWlsaW5nIGxpc3QNCkFkZEBpZXRmLm9yZzxtYWls dG86QWRkQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9h ZGQNCi0tDQpBZGQgbWFpbGluZyBsaXN0DQpBZGRAaWV0Zi5vcmc8bWFpbHRvOkFkZEBpZXRmLm9y Zz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWRkDQo= --_000_CWXP265MB0566B8EE78D37F2A7C4BA655C2700CWXP265MB0566GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ29taWMgU2Fu cyBNUyI7DQoJcGFub3NlLTE6MyAxNSA3IDIgMyAzIDIgMiAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5p dGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFy Z2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJs aW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3Jh dGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVy c29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6 d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25s eTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgltc28tZmFyZWFzdC1sYW5n dWFnZTpFTi1VUzt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7 DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24x DQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4 bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94 bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2 OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFw ZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLUdCIiBs aW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDttc28tZmFy ZWFzdC1sYW5ndWFnZTpFTi1VUyI+Tm90aW5nIFNpbW9u4oCZcyBhbmQgUm9i4oCZcyBjb21tZW50 cyBiZWxvdywgaXQgd291bGQgYmUgaGVscGZ1bCB0byBmb2N1cyBvbiB3YXlzIHRvIGltcGxlbWVu dCBkaXNjb3ZlcnkgdGhhdCBtaWdodCBiZSByZWFzb25hYmx5IGV4cGVjdGVkIHRvIHdvcmsgZm9y IHRoZSB1c2Vycyogb2YgdGhlIG5ldHdvcmsgYXJjaGl0ZWN0dXJlcw0KIHRoYXQgYXJlIGNvbW1v bmx5IGRlcGxveWVkLCBhbmQgaW4gcGFydGljdWxhciB0byBtYWtlIHN1cmUgdGhhdCB0aGluZ3Mg d29yayBhcyBzbW9vdGhseSBhcyBwb3NzaWJsZSBmcm9tIHRoZSBwZXJzcGVjdGl2ZSBvZiB0aG9z ZSB1c2Vycy4mbmJzcDsgSSBiZWxpZXZlIHRoYXQgdGhpcyB3b3VsZCBiZSBjb25zaXN0ZW50IHdp dGggdGhlIHBhcGVyIGRpc2N1c3NlZCBhdCB0aGUgSUFCIG9wZW4gbWVldGluZyB5ZXN0ZXJkYXkg 4oCTIHNlZQ0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5kcmFmdC1pYWIt Zm9yLTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+dGhlLXVzZXJzLTA0LCB3 aGljaCBzdGF0ZXMg4oCcd2hlbiB0aGVyZSBpcyBhIGNvbmZsaWN0IGJldHdlZW4gdGhlIGludGVy ZXN0cyBvZiBlbmQgdXNlcnMgb2YgdGhlIEludGVybmV0IGFuZCBvdGhlciBwYXJ0aWVzLCBJRVRG IGRlY2lzaW9ucyBzaG91bGQgZmF2b3VyIGVuZCB1c2Vyc+KAnS4mbmJzcDsgQXMNCiBSb2IgY29t bWVudHMsIDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+ SSB0aGluayBpZiB5b3UgZGVjaWRlIHRoZSB1c2VyIGNhbid0IGJlIHRydXN0ZWQgYW5kIHJlbW92 ZSB0aGVpciBhZ2VuY3kgdGhlbiB3ZSdyZSBwcm9iYWJseSBvbiBhIGhpZGluZyB0byBub3RoaW5n Ljwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5NeSBjb25jZXJuIGlzIHRoYXQgc29tZSBhcHByb2Fj aGVzIGFwcGVhciB0byBiZSBtYW5kYXRpbmcgdGhlIGRlbGVnYXRpb24gb2YgY29udHJvbCB0byB0 aGUgY2xpZW50IHNvZnR3YXJlIG9yIG90aGVyIG1lY2hhbmlzbXMgbm90IGludm9sdmluZyB0aGUg dXNlci4mbmJzcDsgSSBkb27igJl0IGJlbGlldmUgdGhhdCB0aGlzIGlzIHRoZSBjb3JyZWN0IGFw cHJvYWNoLCBmZWFyDQogaXQgbWF5IHN0cnVnZ2xlIHJlZ2FyZGluZyBHRFBSIGNvbXBsaWFuY2Ug YW5kIGNlcnRhaW5seSBzZWVtcyBhdCBvZGRzIHdpdGggdGhlIElBQiBkb2N1bWVudC4mbmJzcDsg SSBtYXkgb2YgY291cnNlIGJlIG1pc3VuZGVyc3RhbmRpbmcgd2hhdCBwZW9wbGUgYXJlIHRyeWlu ZyB0byBhY2hpZXZlLiZuYnNwOw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2I+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPkFuZHJldyA8L3NwYW4+ PC9iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0LWxhbmd1YWdl OkVOLVVTIj48bzpwPjwvbzpwPjwvc3Bhbj48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj4qIE5C IOKAnFVzZXJz4oCdIG1heSBvZiBjb3Vyc2UgaW5jbHVkZSBlbnRpdGllcyBvdGhlciB0aGFuIGVu ZCB1c2VycyB0aGF0IGhhdmUgYSByZWFzb25hYmxlIGV4cGVjdGF0aW9uIG9mIGNvbnRyb2wsIGlu Y2x1ZGluZyBlbnRlcnByaXNlcywgcGFyZW50cywgcHJpdmF0ZSBuZXR3b3JrIG9wZXJhdG9ycyBl dGMuJm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9y ZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tVVMiPkZyb206PC9zcGFuPjwv Yj48c3BhbiBsYW5nPSJFTi1VUyI+IFNpbW9uIEhpY2tzICZsdDtzaW1vbi5oaWNrc0BkY21zLmdv di51ayZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiAyOCBKdWx5IDIwMjAgMTk6MDU8YnI+DQo8Yj5U bzo8L2I+IFJvYmVydCBNb3J0aW1lciAmbHQ7cm9ibT00MHNjcmFtd29ya3MubmV0QGRtYXJjLmll dGYub3JnJmd0Ozxicj4NCjxiPkNjOjwvYj4gQUREIE1haWxpbmcgbGlzdCAmbHQ7YWRkQGlldGYu b3JnJmd0OzsgVml0dG9yaW8gQmVydG9sYSAmbHQ7dml0dG9yaW8uYmVydG9sYT00MG9wZW4teGNo YW5nZS5jb21AZG1hcmMuaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbQWRk XSBbRVhURVJOQUxdIFJlOiBOZXcgVmVyc2lvbiBOb3RpZmljYXRpb24gZm9yIGRyYWZ0LXBhdWx5 LWFkZC1yZXNvbHZlci1kaXNjb3ZlcnktMDEudHh0PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxOC4wcHQi Pk91ciBtYWluIGFpbSBmb3IgZ292ZXJubWVudCBpcyB0byBnZXQgc3RhYmxlIG5ldHdvcmtzIHRo YXQgd29yayB3ZWxsIGZvciBhbGwgc29jaWV0eSBhbmQgaW5kdXN0cnkuJm5ic3A7IFNvIHdlJ2Qg bGlrZSB0byBzZWUgdGhlIHdob2xlIGNvbW11bml0eSB0YWxraW5nIHdpdGggZWFjaCBvdGhlciBh bmQgYWxsIHBhcnRzIG9mIHRoZSBjaGFpbiB3b3JraW5nIHdpdGggZWFjaA0KIG90aGVyIHRvIHBy b3ZpZGUgY2hhaW5zIHRoYXQgd29yayB3ZWxsLiBJZiB0aGF0IGRvZXNuJ3QgaGFwcGVuIHRoZW4g dGhlIG5leHQgc3RlcCBpcyByZWd1bGF0aW9uLiZuYnNwOyBPcGVuIHN0YW5kYXJkcyBhbmQgb3Bl biBtYXJrZXRzIGFyZSBhIHByaXZpbGVnZSBhcyB3ZWxsIGFzIGEgd2F5IG9mIHdvcmtpbmcuJm5i c3A7IElmIHRoZXkncmUgbm90IHdvcmtpbmcgd2VsbCB0aGVuIHNvY2lldHkgcmVmbGVjdGVkIGJ5 IGdvdmVybm1lbnRzIGhhcyB0byB0cnkgYW5kDQogbWFrZSB0aGVtIHdvcmsuJm5ic3A7PG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxOC4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTguMHB0Ij5Fbm91Z2gmbmJzcDtvZiB0aGUgcGhpbG9zb3BoeS4gQnV0IGdldCBhIHNvbHV0 aW9uIGluIHRoaXMgcm9vbSwgaWUgc3RhbmRhcmRzLCBvciBlbHNlIG90aGVycyB3aWxsIGJlIG1h a2luZyBkZWNpc2lvbnMmbmJzcDtmb3IgeW91LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgc3R5bGU9ImxpbmUtaGVpZ2h0OjE2LjU1cHQiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTMuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvbWljIFNhbnMgTVMmcXVvdDs7Y29sb3I6Ymxh Y2siPlJlZ2FyZHMmbmJzcDs8YnI+DQpTaW1vbjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjx0YWJs ZSBjbGFzcz0iTXNvTm9ybWFsVGFibGUiIGJvcmRlcj0iMCIgY2VsbHNwYWNpbmc9IjMiIGNlbGxw YWRkaW5nPSIwIiB3aWR0aD0iNTg3IiBzdHlsZT0id2lkdGg6NDQwLjJwdCI+DQo8dGJvZHk+DQo8 dHIgc3R5bGU9ImhlaWdodDo1Ny4xNXB0Ij4NCjx0ZCB3aWR0aD0iMTMxIiB2YWxpZ249InRvcCIg c3R5bGU9IndpZHRoOjk4LjVwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDBjbTtoZWlnaHQ6NTcuMTVw dCI+DQo8L3RkPg0KPHRkIHZhbGlnbj0idG9wIiBzdHlsZT0icGFkZGluZzowY20gMGNtIDBjbSAw Y207aGVpZ2h0OjU3LjE1cHQiPg0KPHAgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0O3RleHQt aW5kZW50Oi43NXB0O2xpbmUtaGVpZ2h0OjEyLjk1cHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0idGV4dC1pbmRlbnQ6Ljc1cHQ7bGlu ZS1oZWlnaHQ6MTIuOTVwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS41cHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxkaXY+DQo8dGFibGUgY2xhc3M9Ik1zb05vcm1hbFRhYmxlIiBib3JkZXI9IjAi IGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMCIgc3R5bGU9ImJvcmRlci1jb2xsYXBzZTpj b2xsYXBzZSI+DQo8dGJvZHk+DQo8dHI+DQo8dGQgdmFsaWduPSJ0b3AiIHN0eWxlPSJwYWRkaW5n OjUuMHB0IDUuMHB0IDUuMHB0IDUuMHB0Ij48L3RkPg0KPC90cj4NCjwvdGJvZHk+DQo8L3RhYmxl Pg0KPC9kaXY+DQo8L3RkPg0KPC90cj4NCjwvdGJvZHk+DQo8L3RhYmxlPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFR1ZSwgMjggSnVsIDIwMjAgYXQg MTg6MzIsIFJvYmVydCBNb3J0aW1lciAmbHQ7cm9ibT08YSBocmVmPSJtYWlsdG86NDBzY3JhbXdv cmtzLm5ldEBkbWFyYy5pZXRmLm9yZyI+NDBzY3JhbXdvcmtzLm5ldEBkbWFyYy5pZXRmLm9yZzwv YT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJnbWFpbC1tXzQ2 NTI5MTE5NTY3ODYyODYwMzFfX01haWxiaXJkU3R5bGVDb250ZW50Ij4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Fy aWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPisxJm5ic3A7PG86cD48L286cD48L3Nw YW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPlRoZXJlIGhhcyB0byBi ZSBhIHVzZXItbmV0d29yayBuZWdvdGlhdGlvbi4gSWYgdGhleSBhZ3JlZSBzdHVmZiB3b3JrcyAt IGlmIHRoZXkgZG9uJ3QgdGhlIHVzZXIgZGVjbGluZXMgdG8gY29ubmVjdCB0byB0aGUgbmV0d29y ay48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlh bCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOmJsYWNrIj5Ib3cgdGhhdCdzIGFjaGlldmVkIGlmIHdlIGFzc3VtZSB0aGF0IHVzZXJzIGNh bid0IGJlIHRydXN0ZWQgdG8gbWFrZSBkZWNpc2lvbiBhcyB0aGV5IHdvbid0IHVuZGVyc3RhbmQg dGhlIHF1ZXN0aW9uIGFuZCBhbnl3YXkgdGhlIG5ldHdvcmsgbWlnaHQgYmUgbHlpbmcgaXMgb2J2 aW91c2x5DQogZ29uZyB0byBiZSB0cmlja3kuIEkgdGhpbmsgaWYgeW91IGRlY2lkZSB0aGUgdXNl ciBjYW4ndCBiZSB0cnVzdGVkIGFuZCByZW1vdmUgdGhlaXIgYWdlbmN5IHRoZW4gd2UncmUgcHJv YmFibHkgb24gYSBoaWRpbmcgdG8gbm90aGluZyAoIGFuZCB0aGlzIHNlZW1zIHRvIGJlIHRoZSBk aXJlY3Rpb24gYXQgbGVhc3QgYSBmZXcgcGVvcGxlIHdhbnQgdG8gaGVhZCBpbiApLjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250 LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj4tLSZuYnNw OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+Um9ibTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 YmxhY2siPjg3MzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPiZuYnNwOyAmcXVvdDtBc2sg bm90IHdoYXQgSSBjYW4gZG8gZm9yIHRoZSBzdHVwaWQsJm5ic3A7PG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjpibGFjayI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO2J1dCB3aGF0IHRo ZSBzdHVwaWQgY2FuIGRvIGZvciBtZSZxdW90OyAtIEdyYWVtZSBHYXJkZW48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgd2luZG93dGV4dCAxLjBwdDtwYWRkaW5nOjBjbSAw Y20gMGNtIDguMHB0O21hcmdpbi1sZWZ0OjBjbTttYXJnaW4tdG9wOjE1LjBwdDttYXJnaW4tYm90 dG9tOjUuMHB0Ij4NCjxwIHN0eWxlPSJtYXJnaW4tdG9wOjcuNXB0Ij48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiNBQUFBQUEiPk9uIDI4LzA3LzIwMjAgMTI6MzU6MDMsIFZpdHRvcmlvIEJlcnRvbGEgJmx0 O3ZpdHRvcmlvLmJlcnRvbGE9PGEgaHJlZj0ibWFpbHRvOjQwb3Blbi14Y2hhbmdlLmNvbUBkbWFy Yy5pZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjQwb3Blbi14Y2hhbmdlLi5jb21AZG1hcmMuaWV0 Zi5vcmc8L2E+Jmd0Ow0KIHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48YnI+DQo8YnI+DQom Z3Q7IElsIDI4LzA3LzIwMjAgMTI6MzkgVGVkIExlbW9uIGhhIHNjcml0dG86PGJyPg0KJmd0OyA8 YnI+DQomZ3Q7IDxicj4NCiZndDsgJmd0OyBPbiBKdWwgMjgsIDIwMjAsIGF0IDAzOjM0LCBQYXVs IFZpeGllIHdyb3RlOjxicj4NCiZndDsgJmd0OyBpbiBteSBlc3RpbWF0aW9uLCBub25lIG9mIHRo ZSBhZ2VuY2llcyBlZHdhcmQgc25vd2RlbiB3YXJuZWQgdXMgYWJvdXQgaW4gMjAxMw0KPGJyPg0K Jmd0OyAmZ3Q7IGFyZSBnb2luZyB0byBiZSB0cmFuc3BhcmVudCBhYm91dCBzdXJ2ZWlsbGFuY2Ug b3IgZmlsdGVyaW5nLCBzbyB5b3VyIGZlYXIgb2YgPGJyPg0KJmd0OyAmZ3Q7IHRoZW0gdXNpbmcg cmVsaWFibGUgZGVuaWFsIHNpZ25hbGluZyBhcyBwYXJ0IG9mIG5lZ290aWF0aW9uIHNlZW1zIG1p c3BsYWNlZC48YnI+DQomZ3Q7IDxicj4NCiZndDsgVGhhdOKAmXMgbm90IHRoZSBjb25jZXJuLiBU aGUgY29uY2VybiBpcyB0aGF0IGlmIERvSCB0cmFmZmljIGlzIGxhYmVsZWQgc3BlY2lmaWNhbGx5 IHNvIHRoYXQgdGhlIG5ldHdvcmsgY2FuIGlkZW50aWZ5IGl0LCBpdCB3aWxsIGJlIGJsb2NrZWQs PGJyPg0KPGJyPg0KV2h5Pzxicj4NCjxicj4NClRoZXJlIHdpbGwgYmUgbmV0d29ya3MgdGhhdCB3 YW50IHRvIGJsb2NrIERvSCwgYW5kIHRoZXJlIHdpbGwgYmUgb3RoZXJzIHRoYXQgZG9uJ3QsIGFu ZCB0aGVyZSB3aWxsIGJlIG90aGVycyB0aGF0IHdpbGwgc2F5IHRoYXQgeW91IGNhbiBoYXZlIERv SCBidXQgb25seSBpZiB5b3UgdXNlIHRoZSBsb2NhbCByZXNvbHZlciwgb3IgaWYgeW91IHVzZSBh IHJlc29sdmVyIGZyb20gYSBzcGVjaWZpYyBsaXN0LCBvciB3aWxsIHN1Z2dlc3QgeW91IGEgbG9j YWwNCiByZXNvbHZlciBidXQgdGhlbiBhY2NlcHQgYSBkaWZmZXJlbnQgY2hvaWNlLjxicj4NCjxi cj4NClRoZW4sIHRoZXJlIHdpbGwgYmUgY2xpZW50cyAoYm90aCBvbiBiZWhhbGYgb2YgdGhlIHVz ZXIsIGkuZS4gYW5vbnltaXppbmcgYnJvd3NlcnMsIGFuZCBhZ2FpbnN0IHRoZSB1c2VyLCBpLmUu IG1hbHdhcmUpIHRoYXQgd2lsbCB3YW50IHRvIGlnbm9yZSB0aGF0IHBvbGljeSBpZiB0aGV5IGRp c2xpa2UgaXQsIGFuZCBkbyBzb21ldGhpbmcgZWxzZSAtIGFuZCB0aGVyZSB3aWxsIGJlIG5ldHdv cmtzIHRoYXQgd2lsbCB0aGVuIHJlYWN0IGJ5IGRvaW5nDQogYWxsIHNvcnRzIG9mIGJhZCB0aGlu Z3MgdG8gdHJhZmZpYyBmcm9tIHRob3NlIGNsaWVudHMuPGJyPg0KPGJyPg0KV2UgY2Fubm90IGRv IG11Y2ggaW4gdGhlIGNhc2Ugd2hlbiBjbGllbnRzICh1c2VycykgYW5kIG5ldHdvcmtzIChuZXR3 b3JrIHByb3ZpZGVycykgZGlzYWdyZWUsIGFuZCB0aGF0IGNhc2Ugd2lsbCBhbHdheXMgZXhpc3Qs IGJ1dCB0aGVyZSBpcyBhIG51bWJlciBvZiB1c2UgY2FzZXMgKGhvcGVmdWxseSBtb3N0IG9mIHRo ZW0pIGluIHdoaWNoIHVzZXJzIGFuZCBuZXR3b3JrIHByb3ZpZGVycyB3aWxsIGNvb3BlcmF0ZSB0 byBmaW5kIGEgbXV0dWFsbHkNCiBhY2NlcHRhYmxlIGNvbmZpZ3VyYXRpb24uIFdoYXQgd2Ugc2hv dWxkIGRldmVsb3AgaXMgYSB3YXkgZm9yIHRoZSBjbGllbnQgdG8gZGlzY292ZXIgdGhlIGxvY2Fs IERvSCByZXNvbHZlcidzIGxvY2F0aW9uIGFuZCB0aGUgbmV0d29yayBwb2xpY3kgYXR0YWNoZWQg dG8gaXQsIHNvIHRoYXQgdGhlIGFib3ZlIGFncmVlbWVudCBiZWNvbWVzIHBvc3NpYmxlIGluIHRo b3NlIGNhc2VzLiBXaGF0IHRoZSBjbGllbnQgZG9lcyB3aXRoIHRoYXQgaW5mb3JtYXRpb24sDQog YW5kIHdoZXRoZXIgdGhlIGNsaWVudCBjaG9vc2VzIHRvIGFiaWRlIGJ5IG9yIGRlZnkgdGhlIGxv Y2FsIHBvbGljeSwgd2lsbCB0aGVuIGJlIGEgY2hvaWNlIGZvciB0aGUgZGV2ZWxvcGVycyBvZiBl YWNoIGNsaWVudCAoYW5kIGZvciB0aGVpciBsYXd5ZXJzIGFuZCBwb2xpY3kgb2ZmaWNlcnMsIEkg c3VzcGVjdCwgYnV0IHRoYXQncyBhbm90aGVyIGRpc2N1c3Npb24pLjxicj4NCjxicj4NCk9uIHRo ZSBvdGhlciBoYW5kLCByZWZ1c2luZyB0byBzdGFuZGFyZGl6ZSBzdWNoIGEgbWVjaGFuaXNtIHdv dWxkIGJlIHF1aXRlIGEgc3Ryb25nIHBvbGljeSBzdGFuY2UsIGFzIGl0IHdvdWxkIGFzc3VtZSB0 aGF0IGFsbCBuZXR3b3JrcyB3aWxsIGFsd2F5cyBiZSBhZHZlcnNhcmlhbCBhbmQgYmFkbHkgaW50 ZW50aW9uZWQgc28gdGhlcmUgaXMgbm8gdXNlIGluIGV2ZW4gbGlzdGVuaW5nIHRvIHdoYXQgdGhl eSB3b3VsZCBsaWtlIHRvIHNheS4gSSBkb24ndA0KIHRoaW5rIHRoYXQgdGhlIElFVEYgc2hvdWxk IGdvIGRvd24gdGhhdCBwYXRoLjxicj4NCjxicj4NCi0tIDxicj4NClZpdHRvcmlvIEJlcnRvbGEg fCBIZWFkIG9mIFBvbGljeSAmYW1wOyBJbm5vdmF0aW9uLCBPcGVuLVhjaGFuZ2U8YnI+DQo8YSBo cmVmPSJtYWlsdG86dml0dG9yaW8uYmVydG9sYUBvcGVuLXhjaGFuZ2UuY29tIiB0YXJnZXQ9Il9i bGFuayI+dml0dG9yaW8uYmVydG9sYUBvcGVuLXhjaGFuZ2UuY29tPC9hPg0KPGJyPg0KT2ZmaWNl IEAgVmlhIFRyZXZpc28gMTIsIDEwMTQ0IFRvcmlubywgSXRhbHk8YnI+DQo8YnI+DQotLSA8YnI+ DQpBZGQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOkFkZEBpZXRmLm9yZyIgdGFy Z2V0PSJfYmxhbmsiPkFkZEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FkZCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3 LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWRkPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPi0tIDxicj4NCkFkZCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86QWRkQGll dGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+QWRkQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWRkIiB0YXJnZXQ9Il9ibGFuayI+ aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hZGQ8L2E+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_CWXP265MB0566B8EE78D37F2A7C4BA655C2700CWXP265MB0566GBRP_-- From nobody Wed Jul 29 09:50:44 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 263BD3A0CA2 for ; Wed, 29 Jul 2020 09:50:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5QLV_F2mSVid for ; Wed, 29 Jul 2020 09:50:36 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650095.outbound.protection.outlook.com [40.107.65.95]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9E793A0C9F for ; Wed, 29 Jul 2020 09:50:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ODNgqKekPwTv9TmMfhBlCh32Ci8r/TagdoVr7oohqv0gRJeOoAzTMfHK5f3zLzwzJUcoTnmbXS2ukeG4jyGpAbna5MPUq6+CpJvkeqZ5T2tF24/KlwERzjUpGOspOS4hJOfj/AtMVWijW1QOiNH3XFAALBnwfcvfSd1sFkIBBMZmwyQGX6M3Iqsg97ESb85CChVmjSW7HqdQetUIC6NHc4JxCmK3pt7zNRNbbo6TlnUGDmt8ydbhD7tpF8gHX+U2Dyo+LNZZdWeVZqZd/l8Q/EzJrQMzvKo9vJ7uwWoD7Gc4DepZG0M+C3h+hNnQNCRGT1iIW23o8jP23hJMNTxlHg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hKFXCRkrjx76LJpnyxc30F2y6sFPEiSH39ElKGNsugI=; b=ON43uJ2FnS8LC0KfqG/IJIA9ERRKIUlWG2nkCDZLOfnFx018kj55EWVN87JaSpEVXAOmyWUnlbomFLzlbFZ1Bjty3x5+tiWpiMjg64c4YT9FOcdsZCcvg7L5mgyOqGWVT+448ntGpq2a9dP2TfpthwKt6OuIKJh1ezY6//SVxNX8TT1kaEQw07RqKWspc1LUO5wYBPw/mH2GZKGX4ZEKPREl7bi2qlVnqE5qg/Y6FEATm1CrtNXBJ9GYemfB22neyo3H38CXZgwatbhfsOb+3dbJ/A77HQfPr7RLP+5WaPLj6LHtQzGdSD3HJk3nUnTGOfD+5O/sY0COffHjGeFkMg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hKFXCRkrjx76LJpnyxc30F2y6sFPEiSH39ElKGNsugI=; b=frUcS+UqVJu85jlNMewJAeM3ekMVemER/En7KcvfEl/6hyNR4F7hAr0YSxLpVNeqM7R7z8SAo6pAO4f8hLDOWTUt3lFQw78BgZ/i7GFCYb15zk+QWWNVnCmPyYZJOJJ96I3Bjf0iny3nJyvV7m+4seDCZwHkeffq6CudXB+vex0= Received: from DM6PR00MB0781.namprd00.prod.outlook.com (2603:10b6:5:1b5::20) by DM6PR00MB0816.namprd00.prod.outlook.com (2603:10b6:5:208::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3280.0; Wed, 29 Jul 2020 16:50:34 +0000 Received: from DM6PR00MB0781.namprd00.prod.outlook.com ([fe80::e898:2d46:56a9:b23e]) by DM6PR00MB0781.namprd00.prod.outlook.com ([fe80::e898:2d46:56a9:b23e%4]) with mapi id 15.20.3280.000; Wed, 29 Jul 2020 16:50:33 +0000 From: Tommy Jensen To: Andrew Campling , Simon Hicks , Robert Mortimer , Vittorio Bertola , Ted Lemon CC: ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWZLGV7A1JtnrexkqDcLFH6GVWT6kczXMAgAAO9ICAAGPaAIAACYUAgAFyRgCAAAbacA== Date: Wed, 29 Jul 2020 16:50:33 +0000 Message-ID: References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-29T16:50:33.388Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; authentication-results: 419.consulting; dkim=none (message not signed) header.d=none;419.consulting; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2601:600:a080:aff0:5c11:1a07:3176:f96c] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: fc8e29cc-14a6-4de4-916c-08d833df82e8 x-ms-traffictypediagnostic: DM6PR00MB0816: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:1923; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: IPs95vv4uFU5lVAIrb6zN3Yuc736DG9eZC3TPgQ3qat8tbLRxbACNLcUdxg9E3NK5vIhJwq0lvBXXwy36ZyMWjNdWfwoM62ZQAQ5c4EerfLdiWqOTNF/3uyc2DVdHoCbVv7dR4MvYNrqP6srEdZcGHiAjLczsXPk5fqeII7frnBCXS45XuSQLTyeQ7T8gKVggzHc8MpCbPA+H1kgvDAYARH8aO5WOlOLnB9E61EBvQFba4DW5sYBBkioZ+HRCdFrHUmAHn8QLcgcJTOlR42F3TU0QD/FTuHJTOxpoqmnwgXwrquVRdyNSj+b6SgDSzOt2a6+X1Uvu1eJ1R9RI/09H4nH2sRQGR/lNhsTFlXjkVysCxCOdheaNhwgHBpj8kbve5wv4RwnTvgqdGuqmx4QkA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR00MB0781.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(136003)(366004)(376002)(346002)(396003)(39860400002)(19627405001)(66476007)(64756008)(66946007)(86362001)(82950400001)(82960400001)(8990500004)(66556008)(66446008)(8676002)(10290500003)(53546011)(19627235002)(6506007)(4326008)(110136005)(316002)(7696005)(71200400001)(166002)(2906002)(55016002)(186003)(9686003)(478600001)(8936002)(66574015)(33656002)(91956017)(76116006)(5660300002)(966005)(52536014)(83380400001)(15650500001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: mrS5Hd6j7bMAmgRm4Eua7nNM50Sez0xFx1H6/JVT634VJPfRn4OQhT7JVymXf9DWLNLJ1gk06/MXJnDUAasNdVsMsn2jpeKILf3RM0EyexqDD52KxfOENAy2XjiiRIFMfTwgLHEz5b24QFeJqSgJsjC1XopiEB3RR9jdCRCZmRC5aFHHrQa5yI2BTYbvtyGivhrNJjHbe4fK0DPRsxcpB4sHhV8DpkydLcJDyldB2h/fh7/yCm/9mmgvMa8yWx5zwGwvTptnXLKWETBN97Q6aejrbSIzl8lsEUkH7buZh+QmrcSoj8z04DUNYBGpfNADOECGCfBmCGAyEyOHQr3j4iZi8aiTnnpsryzlWxlYaVXSQOptgF/Mf819iobYhUCiqtC0oFQ4KdgJPgKqqaHIlzp8DkdsyQsu8T6oEdn2X+vtr0UzqJulHcj3LZMi+iop6CrZIR1TShj8V1UBiEjUeysBEEDOlYoTTI9H1s2yttHIJ40rOi0IP0Q2mQ1h6ASdTS+/C2+3aBCW8/h7k9z7ZpOcHR8Dc98eXpK0F78kdU3hbnLj+1gy94UtQWAWo+pobZNv8NUZXfomSZDjWXaum/sw89LUhXSwod7gU5/NUSjOupTHaMxh17edLvWrFdFa+Yyur8n/2n3y37p6PXzpSCP8jSS6sEISvB9gmN5FIgrr/yyW4LhptBiLmfZqZkz0P79EJcfFbWrqIcZGfjaEIQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR00MB0781A104B33E7B69920D4667FA700DM6PR00MB0781namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR00MB0781.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: fc8e29cc-14a6-4de4-916c-08d833df82e8 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Jul 2020 16:50:33.8863 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: fUN65aKaC3Os/8qJRlWk2zHK8bMzRUtmARpH/2CfZsLN0//EcEAeQv2Qq18chiZsgpNRm3SIIEw8wnfcPAb1gw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR00MB0816 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 16:50:42 -0000 --_000_DM6PR00MB0781A104B33E7B69920D4667FA700DM6PR00MB0781namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hey Andrew, Can you be specific about your GDPR concerns? Each time I press on what par= ts of the proposals run afoul of GDPR, here or in other DNS bodies, I'm tol= d "talk to your lawyer" which, to be fair, is a valid answer. However, if t= here are not specific technical concerns that can be shared on list, I don'= t think we should block standard design on the vague legal risk that _might= _ exist. Let's be specific about the GDPR concerns. Regarding user choice, keep in mind policy decisions are out of scope for t= his WG charter. In addition, protocols we develop here don't block policy d= ecisions. It's possible for a client to implement any or all of the proposa= ls listed here and then turn around and make them all controllable by a UX,= or a policy, or whatever else. Can you be specific about any standard proposal which _precludes_ an implem= entation from offerings user/admin/enterprise/etc. choice and control or re= gresses control from what they have today? I don't think there's a single d= raft that's trying to decide a conflict of interest "between the interests = of end users of the Internet and other parties" in favor of the latter inst= ead of the former. If I'm wrong, please help me understand which drafts are= n't favoring end users interests and how they aren't. Thanks, Tommy Jensen =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The latest in Windows Internet Protocols: Native gRPC support: https://aka.ms/grpcblogpost DNS over HTTPS: https://aka.ms/dohblogpost ________________________________ From: Add on behalf of Andrew Campling Sent: Wednesday, July 29, 2020 9:10 AM To: Simon Hicks ; Robert Mortimer ; Vittorio Bertola ; Ted Lemon Cc: ADD Mailing list Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-= add-resolver-discovery-01.txt Noting Simon=92s and Rob=92s comments below, it would be helpful to focus o= n ways to implement discovery that might be reasonably expected to work for= the users* of the network architectures that are commonly deployed, and in= particular to make sure that things work as smoothly as possible from the = perspective of those users. I believe that this would be consistent with t= he paper discussed at the IAB open meeting yesterday =96 see draft-iab-for-= the-users-04, which states =93when there is a conflict between the interest= s of end users of the Internet and other parties, IETF decisions should fav= our end users=94. As Rob comments, I think if you decide the user can't be= trusted and remove their agency then we're probably on a hiding to nothing= . My concern is that some approaches appear to be mandating the delegation of= control to the client software or other mechanisms not involving the user.= I don=92t believe that this is the correct approach, fear it may struggle= regarding GDPR compliance and certainly seems at odds with the IAB documen= t. I may of course be misunderstanding what people are trying to achieve. Andrew * NB =93Users=94 may of course include entities other than end users that h= ave a reasonable expectation of control, including enterprises, parents, pr= ivate network operators etc. From: Simon Hicks Sent: 28 July 2020 19:05 To: Robert Mortimer Cc: ADD Mailing list ; Vittorio Bertola Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-= add-resolver-discovery-01.txt Our main aim for government is to get stable networks that work well for al= l society and industry. So we'd like to see the whole community talking wi= th each other and all parts of the chain working with each other to provide= chains that work well. If that doesn't happen then the next step is regula= tion. Open standards and open markets are a privilege as well as a way of = working. If they're not working well then society reflected by governments= has to try and make them work. Enough of the philosophy. But get a solution in this room, ie standards, or= else others will be making decisions for you. Regards Simon On Tue, 28 Jul 2020 at 18:32, Robert Mortimer > wrote: +1 There has to be a user-network negotiation. If they agree stuff works - if = they don't the user declines to connect to the network. How that's achieved if we assume that users can't be trusted to make decisi= on as they won't understand the question and anyway the network might be ly= ing is obviously gong to be tricky. I think if you decide the user can't be= trusted and remove their agency then we're probably on a hiding to nothing= ( and this seems to be the direction at least a few people want to head in= ). -- Robm 873 "Ask not what I can do for the stupid, but what the stupid can do for me" - Graeme Garden On 28/07/2020 12:35:03, Vittorio Bertola > wrote: > Il 28/07/2020 12:39 Ted Lemon ha scritto: > > > > On Jul 28, 2020, at 03:34, Paul Vixie wrote: > > in my estimation, none of the agencies edward snowden warned us about i= n 2013 > > are going to be transparent about surveillance or filtering, so your fe= ar of > > them using reliable denial signaling as part of negotiation seems mispl= aced. > > That=92s not the concern. The concern is that if DoH traffic is labeled s= pecifically so that the network can identify it, it will be blocked, Why? There will be networks that want to block DoH, and there will be others tha= t don't, and there will be others that will say that you can have DoH but o= nly if you use the local resolver, or if you use a resolver from a specific= list, or will suggest you a local resolver but then accept a different cho= ice. Then, there will be clients (both on behalf of the user, i.e. anonymizing b= rowsers, and against the user, i.e. malware) that will want to ignore that = policy if they dislike it, and do something else - and there will be networ= ks that will then react by doing all sorts of bad things to traffic from th= ose clients. We cannot do much in the case when clients (users) and networks (network pr= oviders) disagree, and that case will always exist, but there is a number o= f use cases (hopefully most of them) in which users and network providers w= ill cooperate to find a mutually acceptable configuration. What we should d= evelop is a way for the client to discover the local DoH resolver's locatio= n and the network policy attached to it, so that the above agreement become= s possible in those cases. What the client does with that information, and = whether the client chooses to abide by or defy the local policy, will then = be a choice for the developers of each client (and for their lawyers and po= licy officers, I suspect, but that's another discussion). On the other hand, refusing to standardize such a mechanism would be quite = a strong policy stance, as it would assume that all networks will always be= adversarial and badly intentioned so there is no use in even listening to = what they would like to say. I don't think that the IETF should go down tha= t path. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add --_000_DM6PR00MB0781A104B33E7B69920D4667FA700DM6PR00MB0781namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
Hey Andrew,

Can you be specific about your GDPR concerns? Each time I press on what par= ts of the proposals run afoul of GDPR, here or in other DNS bodies, I'm tol= d "talk to your lawyer" which, to be fair, is a valid answer. How= ever, if there are not specific technical concerns that can be shared on list, I don't think we should block standar= d design on the vague legal risk that _might_ exist. Let's be specific abou= t the GDPR concerns.

Regarding user choice, keep in mind policy decisions are out of scope for t= his WG charter. In addition, protocols we develop here don't block policy d= ecisions. It's possible for a client to implement any or all of the proposa= ls listed here and then turn around and make them all controllable by a UX, or a policy, or whatever else.&nbs= p;

Can you be specific about any standard proposal which _precludes_ an implem= entation from offerings user/admin/enterprise/etc. choice and control or re= gresses control from what they have today? I don't think there's a single d= raft that's trying to decide a conflict of interest "between the interests of end users of the Internet and o= ther parties" in favor of the latter instead of the former. If I'm wro= ng, please help me understand which drafts aren't favoring end users intere= sts and how they aren't.

Thanks,=
Tommy Jensen
=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The latest in Wi= ndows Internet Protocols:
  Native gR= PC support: https://aka.ms/grpcblogpost 
  DNS over = HTTPS: https://aka.ms/dohblogpost=  
From: Add <add-bounces@i= etf.org> on behalf of Andrew Campling <andrew.campling@419.consulting= >
Sent: Wednesday, July 29, 2020 9:10 AM
To: Simon Hicks <simon.hicks@dcms.gov.uk>; Robert Mortimer <= ;robm=3D40scramworks.net@dmarc.ietf.org>; Vittorio Bertola <vittorio.= bertola=3D40open-xchange.com@dmarc.ietf.org>; Ted Lemon <mellon@fugue= .com>
Cc: ADD Mailing list <add@ietf.org>
Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft= -pauly-add-resolver-discovery-01.txt
 

Noting Simon=92s = and Rob=92s comments below, it would be helpful to focus on ways to impleme= nt discovery that might be reasonably expected to work for the users* of th= e network architectures that are commonly deployed, and in particular to make sure that things work as smoothly as p= ossible from the perspective of those users.  I believe that this woul= d be consistent with the paper discussed at the IAB open meeting yesterday = =96 see draft-iab-for-the-users-04, which states =93when there is a conflict b= etween the interests of end users of the Internet and other parties, IETF d= ecisions should favour end users=94.  As Rob comments, I think= if you decide the user can't be trusted and remove their agency then we're= probably on a hiding to nothing.

 

My concern is tha= t some approaches appear to be mandating the delegation of control to the c= lient software or other mechanisms not involving the user.  I don=92t = believe that this is the correct approach, fear it may struggle regarding GDPR compliance and certainly seems at odds= with the IAB document.  I may of course be misunderstanding what peop= le are trying to achieve. 

 

 <= /b>

Andrew =

 

* NB =93Users=94 = may of course include entities other than end users that have a reasonable = expectation of control, including enterprises, parents, private network ope= rators etc. 

 

From: Simon Hicks <simon.hicks@dcms.gov.uk>
Sent: 28 July 2020 19:05
To: Robert Mortimer <robm=3D40scramworks.net@dmarc.ietf.org> Cc: ADD Mailing list <add@ietf.org>; Vittorio Bertola <vitt= orio.bertola=3D40open-xchange.com@dmarc.ietf.org>
Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft= -pauly-add-resolver-discovery-01.txt

 

Our main aim for = government is to get stable networks that work well for all society and ind= ustry.  So we'd like to see the whole community talking with each othe= r and all parts of the chain working with each other to provide chains that work well. If that doesn't happen then t= he next step is regulation.  Open standards and open markets are a pri= vilege as well as a way of working.  If they're not working well then = society reflected by governments has to try and make them work. 

 

Enough of th= e philosophy. But get a solution in this room, ie standards, or else others= will be making decisions for you.

Regards 
Simon

<= span style=3D"font-size:11.5pt; font-family:"Helvetica",sans-seri= f"> 

 

 

 

On Tue, 28 Jul 2020 at 18:32, Robert Mortimer <= robm=3D40scramworks.net@= dmarc.ietf.org> wrote:

+1 

 

There has to be a user-network negoti= ation. If they agree stuff works - if they don't the user declines to conne= ct to the network.

 

How that's achieved if we assume that= users can't be trusted to make decision as they won't understand the quest= ion and anyway the network might be lying is obviously gong to be tricky. I think if you decide the user can't be trusted and rem= ove their agency then we're probably on a hiding to nothing ( and this seem= s to be the direction at least a few people want to head in ).

 

-- 

Robm

873

  "Ask not what I can do fo= r the stupid, 

         but= what the stupid can do for me" - Graeme Garden

On 28/07/2020 12:35:03, Vittor= io Bertola <vittorio.bertola=3D40open-xchange..com@dmarc.ietf.org> wrote:



> Il 28/07/2020 12:39 Ted Lemon ha scritto:
>
>
> > On Jul 28, 2020, at 03:34, Paul Vixie wrote:
> > in my estimation, none of the agencies edward snowden warned us a= bout in 2013
> > are going to be transparent about surveillance or filtering, so y= our fear of
> > them using reliable denial signaling as part of negotiation seems= misplaced.
>
> That=92s not the concern. The concern is that if DoH traffic is labele= d specifically so that the network can identify it, it will be blocked,

Why?

There will be networks that want to block DoH, and there will be others tha= t don't, and there will be others that will say that you can have DoH but o= nly if you use the local resolver, or if you use a resolver from a specific= list, or will suggest you a local resolver but then accept a different choice.

Then, there will be clients (both on behalf of the user, i.e. anonymizing b= rowsers, and against the user, i.e. malware) that will want to ignore that = policy if they dislike it, and do something else - and there will be networ= ks that will then react by doing all sorts of bad things to traffic from those clients.

We cannot do much in the case when clients (users) and networks (network pr= oviders) disagree, and that case will always exist, but there is a number o= f use cases (hopefully most of them) in which users and network providers w= ill cooperate to find a mutually acceptable configuration. What we should develop is a way for the client t= o discover the local DoH resolver's location and the network policy attache= d to it, so that the above agreement becomes possible in those cases. What = the client does with that information, and whether the client chooses to abide by or defy the local policy, will = then be a choice for the developers of each client (and for their lawyers a= nd policy officers, I suspect, but that's another discussion).

On the other hand, refusing to standardize such a mechanism would be quite = a strong policy stance, as it would assume that all networks will always be= adversarial and badly intentioned so there is no use in even listening to = what they would like to say. I don't think that the IETF should go down that path.

--
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vitt= orio.bertola@open-xchange.com
Office @ Via Treviso 12, 10144 Torino, Italy

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

--_000_DM6PR00MB0781A104B33E7B69920D4667FA700DM6PR00MB0781namp_-- From nobody Wed Jul 29 10:00:07 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 314B23A0CCF for ; Wed, 29 Jul 2020 10:00:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6FZ58bUsWmoC for ; Wed, 29 Jul 2020 09:59:59 -0700 (PDT) Received: from mail-qk1-x72f.google.com (mail-qk1-x72f.google.com [IPv6:2607:f8b0:4864:20::72f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B57503A0CCE for ; Wed, 29 Jul 2020 09:59:59 -0700 (PDT) Received: by mail-qk1-x72f.google.com with SMTP id l23so22934994qkk.0 for ; Wed, 29 Jul 2020 09:59:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=3tF0/YJHC/FT9e2zDwMqKfHsqM+3+F19BN4uOyOTaac=; b=DCP15qFpmKLxNBIDTD9nMd/jOtaSrbcnnPX1ypZ0/TsMsnfNOy1yXs0WOoARW46SA5 ZRR4lWSFH6Pr1ByaaIPN6Kq4H8pB1mF5bRzZLBOWxY7QWmhcy1D8sWPBLvtYU5xM7mkl mqjpf3TLC3LZvAjHnyRuzPPjEvzHrmZHg8GynnEFdh4XxrljmiB2KwjpUdO/mXYe7s4j GmwC6RU7gmarT0QhgKMrS+1dXfawhF9hRKRLydlscRJSHTGraUF5gnRqc55o+O8l1FCJ ACda/p6YDS2JPGFh1365gx1d1LwhDCUNcUbJNZ4q5nEFR4BehbP90jp99qOM+S6D9y65 +Dfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=3tF0/YJHC/FT9e2zDwMqKfHsqM+3+F19BN4uOyOTaac=; b=HT/Ac1yj8HIA6KPzUKtNNap8V6K4xXRh/WQkLETDPoiEg1yOCR9zRM3Uv92cpRmb6S NVnw4Lfb4zjRN/pja/0QKmoRa4NQXkNBBfj4o9NyfK3eaTw/Gy/X7U+fr0x+kwG20oT8 m3dUsVJr9r/lqhYPIRRe64chirilzfn2y8ERDvwETyIhTWSLH73ffEcFECg+zOBdW5CL vxblBZK8PsZKEfClcHYo+qygI/VtgboQUcgZUk22MTF2XEv5APOkBR5Zkg4dqxzsBDdz jb+HUsFLWBfwAfLWlXb/HQ0kmLkmwY0VuFWo7oPKuf1V+MTZGVn69xC/u5b/IlOTnqyp vYAw== X-Gm-Message-State: AOAM5326XAmZGJ8Nl/8jkkY9KIR8lixED4Ek5pw3mDFn/hJfwFWLi8RH WhBiVXmEIstcWXifaeID/rNn0ls/0S7PyjDAGts= X-Google-Smtp-Source: ABdhPJzrh+REPhfYXM9KiqjI6HkrfFsYFN1OqjfRyOYRM84LsaQkFZ435nCBH/PTeS/XEC2NSxOr2SwK7yNGKSZbpUI= X-Received: by 2002:a05:620a:142:: with SMTP id e2mr33226146qkn.418.1596041998614; Wed, 29 Jul 2020 09:59:58 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> In-Reply-To: From: "Chris Box (BT)" Date: Wed, 29 Jul 2020 17:59:45 +0100 Message-ID: To: Andrew Campling Cc: Simon Hicks , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000005fc5ed05ab977cf9" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 17:00:05 -0000 --0000000000005fc5ed05ab977cf9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable This question of who represents the "user" we aim to support is frustratingly hard to pin down. IAB-for-the-users acknowledges it includes people *not *using the client device in question, naming both parents and other people in a photograph or room. Chris On Wed, 29 Jul 2020 at 17:11, Andrew Campling wrote: > Noting Simon=E2=80=99s and Rob=E2=80=99s comments below, it would be help= ful to focus on > ways to implement discovery that might be reasonably expected to work for > the users* of the network architectures that are commonly deployed, and i= n > particular to make sure that things work as smoothly as possible from the > perspective of those users. I believe that this would be consistent with > the paper discussed at the IAB open meeting yesterday =E2=80=93 see draft= -iab-for-the-users-04, > which states =E2=80=9Cwhen there is a conflict between the interests of e= nd users > of the Internet and other parties, IETF decisions should favour end > users=E2=80=9D. As Rob comments, I think if you decide the user can't be= trusted > and remove their agency then we're probably on a hiding to nothing. > > > > My concern is that some approaches appear to be mandating the delegation > of control to the client software or other mechanisms not involving the > user. I don=E2=80=99t believe that this is the correct approach, fear it= may > struggle regarding GDPR compliance and certainly seems at odds with the I= AB > document. I may of course be misunderstanding what people are trying to > achieve. > > > > > > *Andrew * > > > > * NB =E2=80=9CUsers=E2=80=9D may of course include entities other than en= d users that have > a reasonable expectation of control, including enterprises, parents, > private network operators etc. > > > --0000000000005fc5ed05ab977cf9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
This question of who represents the "user" = we aim to support is frustratingly hard to pin down.

IAB-for-the-users acknowledges it includes people not using the c= lient device in question, naming both parents and other people in a photogr= aph or room.

Chris

On Wed, 29 Jul 20= 20 at 17:11, Andrew Campling <andrew.campling@419.consulting> wrote:<= br>

Noting Simon=E2=80=99= s and Rob=E2=80=99s comments below, it would be helpful to focus on ways to= implement discovery that might be reasonably expected to work for the user= s* of the network architectures that are commonly deployed, and in particular to make sure that things wor= k as smoothly as possible from the perspective of those users.=C2=A0 I beli= eve that this would be consistent with the paper discussed at the IAB open = meeting yesterday =E2=80=93 see draft-iab-for-the-users-04, which states =E2=80=9Cwhen there is a conflict= between the interests of end users of the Internet and other parties, IETF= decisions should favour end users=E2=80=9D.=C2=A0 As Rob comments, I think if= you decide the user can't be trusted and remove their agency then we&#= 39;re probably on a hiding to nothing.

=C2=A0<= /span>

My concern is that so= me approaches appear to be mandating the delegation of control to the clien= t software or other mechanisms not involving the user.=C2=A0 I don=E2=80=99= t believe that this is the correct approach, fear it may struggle regarding GDPR compliance and certainly seems at odds with= the IAB document.=C2=A0 I may of course be misunderstanding what people ar= e trying to achieve.=C2=A0

=C2=A0<= /span>

=C2=A0

Andrew =

=C2=A0<= /span>

* NB =E2=80=9CUsers= =E2=80=9D may of course include entities other than end users that have a r= easonable expectation of control, including enterprises, parents, private n= etwork operators etc.=C2=A0

=C2=A0

--0000000000005fc5ed05ab977cf9-- From nobody Wed Jul 29 10:44:31 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6EBA43A0D92 for ; Wed, 29 Jul 2020 10:44:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MdOgCTL5a8kW for ; Wed, 29 Jul 2020 10:44:28 -0700 (PDT) Received: from mail-qv1-xf35.google.com (mail-qv1-xf35.google.com [IPv6:2607:f8b0:4864:20::f35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F38C3A0D7F for ; Wed, 29 Jul 2020 10:44:28 -0700 (PDT) Received: by mail-qv1-xf35.google.com with SMTP id l13so4885036qvt.10 for ; Wed, 29 Jul 2020 10:44:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=q9ButqBpuMOogf4tXcsHvSYMRiskSS7zRH1dfMDwqUM=; b=KLr/NqPOjdymiuIQ+Ls2edE/tBB3pbXmuUHGLKRjHhayYKvzz1ImDgdbERDO61N7Bn 4QvDGC0BZ0rVQ9j65137z4zpKFhHkmK2rFmVqhCCLEXI/Mzpvd/wVUZ7jxAC3okxz1lK u3J52HGk6U704NGZJfDhZLdUCNwX6Gkx++LZuGSiW/C4WkymFWx8t1ylUqvJkSqBWhnQ mfabtNFK2uqE3S/X1Z8wtq4o5eoAFWZ3scV6lnYnS3FBP2DcCF9tYaOGtEpWMhFhRq8g hFo5jFETK6Uwl8DpOJZmSN4TZDv4uov6k5nqjmmenHSHlvfCvTHI+X7IAVT94e25iAjh KfbQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=q9ButqBpuMOogf4tXcsHvSYMRiskSS7zRH1dfMDwqUM=; b=t/2fCW891P3UfeHzniHs1RUIitPVtoI+f4CAn0lJHOydHHpxiKH5qTovo86KLwtq53 lfFD9k1ck6mZAFLag3tL4d3CH1LjBqoBnAIFh4LqjCEK/bJqWIEhVfpRb29Kj639Fd/x nb+Aq0yw86PKa9yGc+H2zMmRiaUVoFaTWQdAGUP4cddwItwYkKR9ZfVo6nRlqRZ/UtQi +lIq712o+toBhuZM5WEt0YObTdyv9heRdxS9fc3xDxhUwopyMs73b9DinU+FBo2L1uch /Rt5wiH1DmOL3PoHsjx+hovvKapG+tke6NmCpfLyT8BLFh0l55KGRwfN876/nWTlhHNq hAUA== X-Gm-Message-State: AOAM532E/Zhckr72uowkqGmtm0pWalp36wZdZhY3fcHyCTD9BfHO7ghl M+XvDg/UBgoD660rv3fTMwrAL+QdAljD6TLIwCc= X-Google-Smtp-Source: ABdhPJwdDlwtDGd9CU+OJQVi52K7373bquRrjlHpIlViLu9AHi473EcAqwYyqLGNQALZEgbck6AzqouFzR+5ylGLCL8= X-Received: by 2002:a0c:f14d:: with SMTP id y13mr11610690qvl.136.1596044667137; Wed, 29 Jul 2020 10:44:27 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> In-Reply-To: From: "Chris Box (BT)" Date: Wed, 29 Jul 2020 18:44:14 +0100 Message-ID: To: Tommy Jensen Cc: Andrew Campling , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000006e333005ab981b43" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 17:44:30 -0000 --0000000000006e333005ab981b43 Content-Type: text/plain; charset="UTF-8" On Wed, 29 Jul 2020 at 17:50, Tommy Jensen wrote: > Can you be specific about any standard proposal which _precludes_ an > implementation from offerings user/admin/enterprise/etc. choice and control > or regresses control from what they have today? I don't think there's a > single draft that's trying to decide a conflict of interest "between the > interests of end users of the Internet and other parties" in favor of the > latter instead of the former. If I'm wrong, please help me understand which > drafts aren't favoring end users interests and how they aren't. > > Surely Adaptive DNS's concept of learning the designated resolver for a domain will, by default, regress parent control of child devices, particularly in the widely deployed scenario where the parent asks the network provider to do this job. This is true unless there is also (a) a standardised way for the network to inform the device of policy, and (b) common client implementations honor this. I used the parent example as this is mentioned in IAB-for-the-users, but could equally apply to the area of trying to stop your IoT devices from doing things they shouldn't. This could well be a timing issue. To avoid serious regressions I think we need a coherent set of drafts that support all possible use cases before going to mainstream deployment. Deploying domain designation by itself, or many other single drafts, will inevitably break some things. --0000000000006e333005ab981b43 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Wed, 29 Jul 2020 at 17:50, Tommy Jensen <Jensen.Thomas=3D<= a href=3D"mailto:40microsoft.com@dmarc.ietf.org">40microsoft.com@dmarc.ietf= .org> wrote:
Can you be specific about any standard proposal which _precludes_ an implem= entation from offerings user/admin/enterprise/etc. choice and control or re= gresses control from what they have today? I don't think there's a = single draft that's trying to decide a conflict of interest "between the interests of end users of the Internet and o= ther parties" in favor of the latter instead of the former. If I'm= wrong, please help me understand which drafts aren't favoring end user= s interests and how they aren't.


<= /div>
Surely Adaptive DNS's concept of learning the designated reso= lver for a domain will, by default, regress parent control of child devices= , particularly in the widely deployed scenario where the parent asks the ne= twork provider to do this job. This is true unless there is also (a) a stan= dardised way for the network to inform the device of policy, and (b) common= client implementations honor this.

I used the par= ent example as this is mentioned in IAB-for-the-users, but could equally ap= ply to the area of trying to stop your IoT devices from doing things they s= houldn't.

This could well be a timing issu= e. To avoid serious regressions I think we need a coherent set of drafts th= at support all possible use cases before going to mainstream deployment. De= ploying domain designation by itself, or many other single drafts, will ine= vitably break some things.

--0000000000006e333005ab981b43-- From nobody Wed Jul 29 11:26:10 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B9B7F3A0DFE for ; Wed, 29 Jul 2020 11:26:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iZD0iR9jlrnS for ; Wed, 29 Jul 2020 11:26:06 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650125.outbound.protection.outlook.com [40.107.65.125]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2099F3A0DF6 for ; Wed, 29 Jul 2020 11:26:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=oGRD7VxZDKk0Qz43s11GxFyLp6M680ZF78DhhUS/1dBvaknjfNSYsAYOk59YPCXzxeCtarktOM9qMVD/KGi9gA/h2aR5NIpwvTxSaOmGA1h5p8AjoTFTzEDeHiDEC2SHUfej1kN2078LRyU23zYK9x8BmDRh12Inp12pq6C9V95de6/cuG+/wCbJ8EeZEe67x7DnhGcrIe1JvWY73Hp2XTXoNb4hPAt89GVDwyauqF8BRN5FkoqfZzmvQR/AFm0aYrxwbnggDFnDYgVksNx3EZ8O9Va8JKWLlgjlUG7EcEh1CuJXMw0b6qGB3FwWse/E0oirCEjKhGUUHgEoL3vvKQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=s2vUpwqBHJo5myvky6x8bvuGLRKnw2E4AFmq2DIdkcU=; b=UYZSrvq/WuGJ8RYA/1he9l5FQY+mkonyK2nWSIY4O6grciMhEBaJUXPcpk/V8bi82yU6YHSQU3vO37buNbiUqepAwjWF2bpcvcnXtKEy1g1QCMa55dmmL18PFW6PN/grYqBeLfF78qZ91nIdVmCaKMVjHF2v3nhtvHU/QysFXfoVdGGl4t5a9eqgKtE6pUKk6fBClefbqqRKYgiGEk+lFbkdO92JiJk2UrVQB/klwTB1lLeuG+Hn9pBQLlWYDx1iriofGcQhOcdwz1/aawfFntbUmY0ugG622HlZzmdnvH4ogN/iU0GcV5EZ1Xf6DVu1i+AAFqHVSajAuf97eTZ6HA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=s2vUpwqBHJo5myvky6x8bvuGLRKnw2E4AFmq2DIdkcU=; b=E1icmtGUNfnmwzqCu8cPrGKYCcQ6B2QrfP3z3ZvHo4h61qx6VrCtO9dIWyUjOuxg9z5KLCdhSLzFYvkboRdU8o1FDoJq3h2Gbd/rt5uw6sC9oBIuNKOXq8Y1fk9GtzHxsZp0RMDbvxI0B8XiOj7quE2sJu5rNTvH09EDAIiS2GU= Received: from DM6PR00MB0783.namprd00.prod.outlook.com (2603:10b6:5:1bd::10) by DM5PR00MB0439.namprd00.prod.outlook.com (2603:10b6:4:a1::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3264.0; Wed, 29 Jul 2020 18:26:03 +0000 Received: from DM6PR00MB0783.namprd00.prod.outlook.com ([fe80::193e:6048:ea0e:210c]) by DM6PR00MB0783.namprd00.prod.outlook.com ([fe80::193e:6048:ea0e:210c%8]) with mapi id 15.20.3281.000; Wed, 29 Jul 2020 18:26:03 +0000 From: Tommy Jensen To: "Chris Box (BT)" CC: Andrew Campling , ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWZLGV7A1JtnrexkqDcLFH6GVWT6kczXMAgAAO9ICAAGPaAIAACYUAgAFyRgCAAAbacIAAE3YAgAACGFc= Date: Wed, 29 Jul 2020 18:26:03 +0000 Message-ID: References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-29T18:26:03.216Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2601:600:a080:aff0:5c11:1a07:3176:f96c] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: e29df863-ad9c-4d3b-0dfa-08d833ecda11 x-ms-traffictypediagnostic: DM5PR00MB0439: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 6z6Mt6KqctgHmHZO5aBFmxgtj8nHkSwd8SYGQe0U0TNyH7P0l6FH4fuyufhwAaftQj+tb5rS+w60hsGGRlZ7zBs5BoETt0jyyPTaivAcI5Ce+K+/TLi6yVx0VZMBd4+y89y5ZrOASEu3uQoRGlaE1gCce3c/MTuSOdyLDrdAZR9c6Br0ySTBbVx3sfJkTdZ9TsIbhQ5wQnffbvfGwjf5PVwZvb6jRe+UKy0f/Zb0vpc/33/1VDhGpxSkPGCno5S8moMS5meeFp2dIArPym2cxyEfXUS3F4aBZAI9SxQjuFX61l9W7KRiJXHMD3tO2ZuNWl/0PH78VQZbh6gO46HqK07gWIVZ99piTov9pAlbm8gmd8QY5I0mcHrh2w9hP1GXIe/12Wq32bnPy4jdcAEe9Q== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR00MB0783.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(39860400002)(136003)(366004)(376002)(346002)(396003)(82950400001)(10290500003)(4326008)(82960400001)(6506007)(2906002)(6916009)(66946007)(53546011)(86362001)(55016002)(91956017)(8936002)(76116006)(64756008)(66556008)(66446008)(9686003)(66476007)(966005)(478600001)(316002)(19627405001)(8676002)(33656002)(15650500001)(8990500004)(83380400001)(66574015)(7696005)(71200400001)(5660300002)(52536014)(166002)(54906003)(186003); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: fFKTpMfzLFEi6dvvmU0XuluVwtKTwWa1Az8Kby0Hu7eOGP2L0T4poKuWCgkfqqoZ4XI7uzyl3kOxZoOUCxLXCabBr6Jjhg5mJaAs3q3IqR8ViT/q+Y9+7RxQ2cUo40K5vU5rShZOPzTenxOVMoOVwuDhJBovMLvJKUjQhh8pJymQ9QlrrdU2ANUcOEhCxOl9I3suPt/xNh8EJj83ZR/TBr+qLrA6Mj19WF6Lrg2ZAcv93Q449WRol5QjpLESv/5MJM3DDdy+iFC7Pn/PmBPDQ0FO9t6ikXSpJaXUy+t8gQQK6N61+BxyLznB9uXHiDXpba+9Rv0gXMcpKPCQY0k92BwYKJGRE7mfqBBf694h/6jF1lMggluKLW9/cZJLSFBZ0WYQW4//sdUS6YHXBoUJLqkeqiWjQpxJDLEHIiZvU8KamkvKgScVcfqzuwIlIm3x5PHRpzsa4c1JbrVYcV6Puii7NqjVD/+kobNcjZxz5CgYufqkFF0s7/+azGFZINZlNTdu7m8ci+kD94GskU0AsF2D807wWA6S8qJlNcegYMv5NYvwFjReHS+Urm/S9SWMPmF/Ot5Tn+75KdRYyQc6EGhFEO73qEtgZO5Auiv3lmpyzn4L5yDWPOZfUG/9IOkwAeKq3/+c4KY0m+f/KDAFGQMqOM2zCtmIhvIILXHDt4QenfUDrlbRyElmuMAFZRVg77dEknhKdcSpMOC9ZOAWVQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR00MB07834506BDBEF56B8224CD82FA700DM6PR00MB0783namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR00MB0783.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: e29df863-ad9c-4d3b-0dfa-08d833ecda11 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Jul 2020 18:26:03.6495 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: zs7IB1/oz4rI5r3oFnHzNgn4Vpx3+5LuJdKP15T0Vn8A+y2WvvQOufkGMRqwlqlSfmoWxnOv5yavwv3tj2WbvA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR00MB0439 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 18:26:09 -0000 --_000_DM6PR00MB07834506BDBEF56B8224CD82FA700DM6PR00MB0783namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hey Chris, Thanks for the scenario. Allow me to try and address it using our draft. For the parental control scenario, there are two scenarios I can think of. = One is the ISP is recommending a DNS server to network members with a publi= c address. By deploying DoH in accordance with the draft to that server, th= e situation self resolves. The client will follow section 5, make a DoH con= nection to the server, then the server can proceed how it sees fit. This ma= y include DNS manipulation to serve an interest such as parental controls, = including filtering SVCB record to prevent Adaptive DNS from discovering ne= w DoH designations that would take it away from the parental filtering serv= er. The other scenario is the ISP recommends an RFC1918 address, which the draf= t doesn't directly address. This is a situation where the standard shouldn'= t be confused with an implementation. Section 7 calls out that a client can= use its own discretion and policy when falling back to classic DNS though = the example context is different. Where Adaptive DNS is intended to be a st= rong privacy offering, it makes sense some users (in this case, admins who = are parents) may use device configuration to choose between privacy and con= tent filtering functionality. The same SVCB record manipulation possibilit= y exists. With this context, my view on your parental filtering concern is really a r= equest to not have Adaptive DNS be on by default, which is an implementatio= n policy concern and not a standards detail. For example, TLS 1.3 being the= minimum version required everywhere would immediately break many sites, an= d requiring DNSSEC validation at the client would break many sites. That do= esn't make either of these standards bad ideas, just that there are context= s implementors of each need to be aware of when rolling out bits. To be clear, I don't like the idea of the network attacking the SVCB record= s. However, it is possible and isn't a regression from today where DNS pack= ets are attacked to provide redirection to "censored" pages. A user seeing = this who isn't ok with the filtering can take manual action to bootstrap wi= th a trusted DoH server. A user who is ok will happily continue as they did= before Adaptive rollad out. In your scenario, the "user" is ok with it and= would experience no regressions unless they take action to configure a DoH= server other than yours, which would be a user signal that they actually d= on't want filtering. Thoughts? Thanks, Tommy Jensen =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The latest in Windows Internet Protocols: Native gRPC support: https://aka.ms/grpcblogpost DNS over HTTPS: https://aka.ms/dohblogpost ________________________________ From: Chris Box (BT) Sent: Wednesday, July 29, 2020 10:44 AM To: Tommy Jensen Cc: Andrew Campling ; ADD Mailing list Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-= add-resolver-discovery-01.txt On Wed, 29 Jul 2020 at 17:50, Tommy Jensen > wrote: Can you be specific about any standard proposal which _precludes_ an implem= entation from offerings user/admin/enterprise/etc. choice and control or re= gresses control from what they have today? I don't think there's a single d= raft that's trying to decide a conflict of interest "between the interests = of end users of the Internet and other parties" in favor of the latter inst= ead of the former. If I'm wrong, please help me understand which drafts are= n't favoring end users interests and how they aren't. Surely Adaptive DNS's concept of learning the designated resolver for a dom= ain will, by default, regress parent control of child devices, particularly= in the widely deployed scenario where the parent asks the network provider= to do this job. This is true unless there is also (a) a standardised way f= or the network to inform the device of policy, and (b) common client implem= entations honor this. I used the parent example as this is mentioned in IAB-for-the-users, but co= uld equally apply to the area of trying to stop your IoT devices from doing= things they shouldn't. This could well be a timing issue. To avoid serious regressions I think we = need a coherent set of drafts that support all possible use cases before go= ing to mainstream deployment. Deploying domain designation by itself, or ma= ny other single drafts, will inevitably break some things. --_000_DM6PR00MB07834506BDBEF56B8224CD82FA700DM6PR00MB0783namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hey Chris,

Thanks for the scenario. Allow me to try and address it using our draft.

For the parental control scenario, there are two scenarios I can think of. = One is the ISP is recommending a DNS server to network members with a publi= c address. By deploying DoH in accordance with the draft to that server, th= e situation self resolves. The client will follow section 5, make a DoH connection to the server, then the serve= r can proceed how it sees fit. This may include DNS manipulation to serve a= n interest such as parental controls, including filtering SVCB record to pr= event Adaptive DNS from discovering new DoH designations that would take it away from the parental filtering s= erver.

The other scenario is the ISP recommends an RFC1918 address, which the draf= t doesn't directly address. This is a situation where the standard shouldn'= t be confused with an implementation. Section 7 calls out that a client can= use its own discretion and policy when falling back to classic DNS though the example context is different. = Where Adaptive DNS is intended to be a strong privacy offering, it makes se= nse some users (in this case, admins who are parents) may use device config= uration to choose between privacy and content filtering functionality.  The same SVCB record manipulati= on possibility exists.

With this context, my view on your parental filtering concern is really a r= equest to not have Adaptive DNS be on by default, which is an implementatio= n policy concern and not a standards detail. For example, TLS 1.3 being the= minimum version required everywhere would immediately break many sites, and requiring DNSSEC validation at the= client would break many sites. That doesn't make either of these standards= bad ideas, just that there are contexts implementors of each need to be aw= are of when rolling out bits.

To be clear, I don't like the idea of the network attacking the SVCB record= s. However, it is possible and isn't a regression from today where DNS pack= ets are attacked to provide redirection to "censored" pages. A us= er seeing this who isn't ok with the filtering can take manual action to bootstrap with a trusted DoH server. A user who = is ok will happily continue as they did before Adaptive rollad out. In your= scenario, the "user" is ok with it and would experience no regre= ssions unless they take action to configure a DoH server other than yours, which would be a user signal that they actu= ally don't want filtering.

Thoughts?

Thanks,=
Tommy Jensen
=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The latest in Wi= ndows Internet Protocols:
  Native gR= PC support: https://aka.ms/grpcblogpost 
  DNS over = HTTPS: https://aka.ms/dohblogpost=  

From: Chri= s Box (BT) <chris.box.ietf@gmail.com>
Sent: Wednesday, July 29, 2020 10:44 AM
To: Tommy Jensen <Jensen.Thomas@microsoft.com>
Cc: Andrew Campling <andrew.campling@419.consulting>; ADD Mail= ing list <add@ietf.org>
Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft= -pauly-add-resolver-discovery-01.txt
 

On Wed, 29 Jul 2020 at 17:50, Tommy= Jensen <Jensen.Thomas=3D40microsoft.com@dmarc.ietf..org> wrote:
Can you be specific about any standard proposal which _precludes_ an implem= entation from offerings user/admin/enterprise/etc. choice and control or re= gresses control from what they have today? I don't think there's a single d= raft that's trying to decide a conflict of interest "between the interests of end users of the Internet and o= ther parties" in favor of the latter instead of the former. If I'm wro= ng, please help me understand which drafts aren't favoring end users intere= sts and how they aren't.


Surely Adaptive DNS's concept of learning the designated resolver for = a domain will, by default, regress parent control of child devices, particu= larly in the widely deployed scenario where the parent asks the network pro= vider to do this job. This is true unless there is also (a) a standardised way for the network to inform the = device of policy, and (b) common client implementations honor this.

I used the parent example as this is mentioned in IAB-for-the-users, b= ut could equally apply to the area of trying to stop your IoT devices from = doing things they shouldn't.

This could well be a timing issue. To avoid serious regressions I thin= k we need a coherent set of drafts that support all possible use cases befo= re going to mainstream deployment. Deploying domain designation by itself, = or many other single drafts, will inevitably break some things.

--_000_DM6PR00MB07834506BDBEF56B8224CD82FA700DM6PR00MB0783namp_-- From nobody Wed Jul 29 13:28:31 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3ABF03A0ECF for ; Wed, 29 Jul 2020 13:28:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ODVhnDNayNp5 for ; Wed, 29 Jul 2020 13:28:27 -0700 (PDT) Received: from mail-qk1-x735.google.com (mail-qk1-x735.google.com [IPv6:2607:f8b0:4864:20::735]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4903C3A0EC7 for ; Wed, 29 Jul 2020 13:28:09 -0700 (PDT) Received: by mail-qk1-x735.google.com with SMTP id l6so23565197qkc.6 for ; Wed, 29 Jul 2020 13:28:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Vi/wlRfy1h/Pr75Jc5CwaKgq0U365MiDQmt9FA4gqDA=; b=G9AUCp0hDHkJFLHQv/nuLjvkDtGvQiQ+yKi/Xr2JjJk+Qe47iXBRU390489lsQQTB8 N9XOGAozwFB2q4fTvWTSa83gXIENS+hKVWgeTFMOcsFDVpDt/ndYPJm8YA3DcVbPln8b 5A6tFL9Yh5BoBFrikXSQWk7rcmYivSF/mVbj8MIF2YqQKrmy967g7LkE6D1kej6RQOqp Bvz9xs7glWLE6rXu1Tk7iZXkQkk5edz/XNZVKxAS3LOI8jD0i+olC+7XnW/pihiQeyOR viFbdHBcM/dHQduBf9ScRU9tj2NQHzfD52iFNSaoAsgCN6wAGxnBtUC/5rPLJOzAAd8r MNdA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Vi/wlRfy1h/Pr75Jc5CwaKgq0U365MiDQmt9FA4gqDA=; b=iTYicr3jxCxvdd9uUiCb/qP14AnxzVfpPn4cK0A4g1MswKJQFDTuXOia6cpttOaoWG tzzaBaUOUi2xR0TF5wfdq7WnFL8hNNOE6t94Yf2TdYmmuQQXtg2cvvq7jCRpdqVGuRLa L8Md4z+crkC1uDegGACo4ZeRmCsBYq4SEB66yCn4ckjfhGErncE/pKOaiIm0+Xh3VBKp TOp3n45lFziCqBZ6jRfCqM35GBBBAuDWpXTmSsAH1mgmXMExzVmvwN6RkheaT8hpqj1/ kZ9ktTrSLbq/+rnemCyDytRx0mwdJvfrMxW0NWhhJ3vEXjPi42nxjBMC6YsexC44P8NN O4Og== X-Gm-Message-State: AOAM5321o4kC52pEkuS7rWVpjOTVgkFQlnaFTmMvDEZr8y3TMmZkfw/S WLWh+Oyw3o9fmUYwHEGplZYkBUhZrxSD3UayPOk= X-Google-Smtp-Source: ABdhPJx0sQMiAXpsCn65vU6ZgnyqHDQpGqFN59qbzLbft9KP7FF/H4gmL5VMGXw6RNhl9j8IVYjxGSGWm2SdfYrLQbk= X-Received: by 2002:a05:620a:142:: with SMTP id e2mr34145495qkn.418.1596054488330; Wed, 29 Jul 2020 13:28:08 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> In-Reply-To: From: "Chris Box (BT)" Date: Wed, 29 Jul 2020 21:27:57 +0100 Message-ID: To: Tommy Jensen Cc: ADD Mailing list , Andrew Campling Content-Type: multipart/alternative; boundary="000000000000d1b46005ab9a64c0" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 20:28:30 -0000 --000000000000d1b46005ab9a64c0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Tommy, Like you I would rather not resort to SVCB filtering; it=E2=80=99s a poor w= ay of advising the client what the network would like. I think I=E2=80=99ll reiterate the plea that implementations hold fire on m= ass deployments that break things until there is an agreed way to communicate information that allows policies, preferences etc to work. I=E2=80=99m init= ially looking at ADD to provide this, but I could equally see this could be broader than DNS. Unfortunately Apple is racing ahead of this, generating the collateral damage that probably gives rise to Simon=E2=80=99s frustrati= on. I know that=E2=80=99s not your responsibility, and Windows is deploying at a = more measured pace. Encrypted DNS is an excellent idea but challenging to deploy across all use cases. Having a coherent set of drafts will be needed. The Adaptive DNS draft still has a lot to offer, and seems pretty well designed, but we need others in the picture too. Chris On Wed, 29 Jul 2020 at 19:26, Tommy Jensen wrote: > Hey Chris, > > Thanks for the scenario. Allow me to try and address it using our draft. > > For the parental control scenario, there are two scenarios I can think of= . > One is the ISP is recommending a DNS server to network members with a > public address. By deploying DoH in accordance with the draft to that > server, the situation self resolves. The client will follow section 5, ma= ke > a DoH connection to the server, then the server can proceed how it sees > fit. This may include DNS manipulation to serve an interest such as > parental controls, including filtering SVCB record to prevent Adaptive DN= S > from discovering new DoH designations that would take it away from the > parental filtering server. > > The other scenario is the ISP recommends an RFC1918 address, which the > draft doesn't directly address. This is a situation where the standard > shouldn't be confused with an implementation. Section 7 calls out that a > client can use its own discretion and policy when falling back to classic > DNS though the example context is different. Where Adaptive DNS is intend= ed > to be a strong privacy offering, it makes sense some users (in this case, > admins who are parents) may use device configuration to choose between > privacy and content filtering functionality. The same SVCB record > manipulation possibility exists. > > With this context, my view on your parental filtering concern is really a > request to not have Adaptive DNS be on by default, which is an > implementation policy concern and not a standards detail. For example, TL= S > 1.3 being the minimum version required everywhere would immediately break > many sites, and requiring DNSSEC validation at the client would break man= y > sites. That doesn't make either of these standards bad ideas, just that > there are contexts implementors of each need to be aware of when rolling > out bits. > > To be clear, I don't like the idea of the network attacking the SVCB > records. However, it is possible and isn't a regression from today where > DNS packets are attacked to provide redirection to "censored" pages. A us= er > seeing this who isn't ok with the filtering can take manual action to > bootstrap with a trusted DoH server. A user who is ok will happily contin= ue > as they did before Adaptive rollad out. In your scenario, the "user" is o= k > with it and would experience no regressions unless they take action to > configure a DoH server other than yours, which would be a user signal tha= t > they actually don't want filtering. > > Thoughts? > > Thanks, > Tommy Jensen > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > The latest in Windows Internet Protocols: > Native gRPC support: https://aka.ms/grpcblogpost > DNS over HTTPS: https://aka.ms/dohblogpost > > ------------------------------ > *From:* Chris Box (BT) > *Sent:* Wednesday, July 29, 2020 10:44 AM > *To:* Tommy Jensen > *Cc:* Andrew Campling ; ADD Mailing list = < > add@ietf.org> > > *Subject:* Re: [Add] [EXTERNAL] Re: New Version Notification for > draft-pauly-add-resolver-discovery-01.txt > > > On Wed, 29 Jul 2020 at 17:50, Tommy Jensen 40microsoft.com@dmarc.ietf..org <40microsoft.com@dmarc.ietf.org>> wrote: > > Can you be specific about any standard proposal which _precludes_ an > implementation from offerings user/admin/enterprise/etc. choice and contr= ol > or regresses control from what they have today? I don't think there's a > single draft that's trying to decide a conflict of interest "between the > interests of end users of the Internet and other parties" in favor of the > latter instead of the former. If I'm wrong, please help me understand whi= ch > drafts aren't favoring end users interests and how they aren't. > > > Surely Adaptive DNS's concept of learning the designated resolver for a > domain will, by default, regress parent control of child devices, > particularly in the widely deployed scenario where the parent asks the > network provider to do this job. This is true unless there is also (a) a > standardised way for the network to inform the device of policy, and (b) > common client implementations honor this. > > I used the parent example as this is mentioned in IAB-for-the-users, but > could equally apply to the area of trying to stop your IoT devices from > doing things they shouldn't. > > This could well be a timing issue. To avoid serious regressions I think w= e > need a coherent set of drafts that support all possible use cases before > going to mainstream deployment. Deploying domain designation by itself, o= r > many other single drafts, will inevitably break some things. > > --000000000000d1b46005ab9a64c0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Tommy,

Like you I would rather not resort to SVCB filtering; it=E2=80=99s a = poor way of advising the client what the network would like.=C2=A0

I think I=E2=80=99ll reiterate t= he plea that implementations hold fire on mass deployments that break thing= s until there is an agreed way to communicate information that allows polic= ies, preferences etc to work. I=E2=80=99m initially looking at ADD to provi= de this, but I could equally see this could be broader than DNS. Unfortunat= ely Apple is racing ahead of this, generating the collateral damage that pr= obably gives rise to Simon=E2=80=99s frustration. I know that=E2=80=99s not= your responsibility, and Windows is deploying at a more measured pace.=C2= =A0

Encrypted DNS is an = excellent idea but challenging to deploy across all use cases. Having a coh= erent set of drafts will be needed. The Adaptive DNS draft still has a lot = to offer, and seems pretty well designed, but we need others in the picture= too.

Chris
<= div>
On= Wed, 29 Jul 2020 at 19:26, Tommy Jensen <Jensen.Thomas@microsoft.com> wrote:
Hey Chris,

Thanks for the scenario. Allow me to try and address it using our draft.

For the parental control scenario, there are two scenarios I can think of. = One is the ISP is recommending a DNS server to network members with a publi= c address. By deploying DoH in accordance with the draft to that server, th= e situation self resolves. The client will follow section 5, make a DoH connection to the server, then the serve= r can proceed how it sees fit. This may include DNS manipulation to serve a= n interest such as parental controls, including filtering SVCB record to pr= event Adaptive DNS from discovering new DoH designations that would take it away from the parental filtering s= erver.

The other scenario is the ISP recommends an RFC1918 address, which the draf= t doesn't directly address. This is a situation where the standard shou= ldn't be confused with an implementation. Section 7 calls out that a cl= ient can use its own discretion and policy when falling back to classic DNS though the example context is different. = Where Adaptive DNS is intended to be a strong privacy offering, it makes se= nse some users (in this case, admins who are parents) may use device config= uration to choose between privacy and content filtering functionality.=C2=A0 The same SVCB record manipulati= on possibility exists.

With this context, my view on your parental filtering concern is really a r= equest to not have Adaptive DNS be on by default, which is an implementatio= n policy concern and not a standards detail. For example, TLS 1.3 being the= minimum version required everywhere would immediately break many sites, and requiring DNSSEC validation at the= client would break many sites. That doesn't make either of these stand= ards bad ideas, just that there are contexts implementors of each need to b= e aware of when rolling out bits.

To be clear, I don't like the idea of the network attacking the SVCB re= cords. However, it is possible and isn't a regression from today where = DNS packets are attacked to provide redirection to "censored" pag= es. A user seeing this who isn't ok with the filtering can take manual action to bootstrap with a trusted DoH server. A user who = is ok will happily continue as they did before Adaptive rollad out. In your= scenario, the "user" is ok with it and would experience no regre= ssions unless they take action to configure a DoH server other than yours, which would be a user signal that they actu= ally don't want filtering.

Thoughts?

Thanks,
Tommy Jensen
=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The latest in Window= s Internet Protocols:
=C2=A0 Native gRPC s= upport: https://aka.ms/grpcblogpost=C2=A0
=C2=A0 DNS over HTTP= S:=C2=A0https://aka.ms/dohblogpost=C2=A0

From: Chr= is Box (BT) <chris.box.ietf@gmail.com>= ;
Sent: Wednesday, July 29, 2= 020 10:44 AM
To: Tommy Jensen <Jensen.Thomas@microsoft.com>
Cc: Andrew Campling <and= rew.campling@419.consulting>; ADD Mailing list <add@i= etf.org>

Subject: Re: [Add] [EXTERNA= L] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.t= xt
=C2=A0

On Wed, 29 Jul 2020 at 17:50, Tommy Jensen <Jensen.Thom= as=3D40= microsoft.com@dmarc.ietf..org> wrote:
Can you be specific about any standard proposal which _precludes_ an implem= entation from offerings user/admin/enterprise/etc. choice and control or re= gresses control from what they have today? I don't think there's a = single draft that's trying to decide a conflict of interest "between the interests of end users of the Internet and o= ther parties" in favor of the latter instead of the former. If I'm= wrong, please help me understand which drafts aren't favoring end user= s interests and how they aren't.


Surely Adaptive DNS's concept of learning the designated resolver = for a domain will, by default, regress parent control of child devices, par= ticularly in the widely deployed scenario where the parent asks the network= provider to do this job. This is true unless there is also (a) a standardised way for the network to inform the = device of policy, and (b) common client implementations honor this.

I used the parent example as this is mentioned in IAB-for-the-users, b= ut could equally apply to the area of trying to stop your IoT devices from = doing things they shouldn't.

This could well be a timing issue. To avoid serious regressions I thin= k we need a coherent set of drafts that support all possible use cases befo= re going to mainstream deployment. Deploying domain designation by itself, = or many other single drafts, will inevitably break some things.

--000000000000d1b46005ab9a64c0-- From nobody Wed Jul 29 13:41:20 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E4C03A0EEE for ; Wed, 29 Jul 2020 13:41:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ntlTFazQlYfy for ; Wed, 29 Jul 2020 13:41:14 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640119.outbound.protection.outlook.com [40.107.64.119]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF0AF3A0EEB for ; Wed, 29 Jul 2020 13:41:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=icgU3b/XEXbzx/OdJtu5MiT2yf7qecpRDN3hQCU5Tt5hIO720BJYZwhhlx+KYzTI7wnn5+8O7moo49fSRaDiow5QzuS7K23J63mwpXyZf5cMTkdaEa7Ta1/rCoMutHMhgCrFD23nOuV/qzq48sHItSgFIkjDGVlKOLIpF69fDSyhULueumtd2WZWSTQwW7Z6ZGRlK93ey3suZ5f1cic/HTOs77UEPLctVLAmyEa+Sy5bB2npKsVGqoazgHLEcpy2GskeBMw5HoggA5EPG/lsE35pOV0AAIPTzk9401/iA8J2jaV+O5hGHTknDIkr4HKUQBZV1dIPUQvpf9TmJqpnBA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fTR5bKcV2m5iUGICl1l7A9SleqrU4WkG0ReYfKNXs+A=; b=VhVgfPaaCYEGK3WhyEY4cJhWRrDXx1bHZpk7uojIqhvgvs0mn68j79e11yZyBEHAkreoBR9qB150XneQvaARDKEONItJAC5hT3kXW+VlKMXqJ/20A0j5y2z/62cbAO2yTsbApDpRAVZhqX0opSCsLYiUSeaxJlAMKOUOFu0xedlxPtb3OK5TvhWQKz/sS+ZpVNAJ76bcHuqt8iYqXHTFXgOVG3afF1h1DtDJUipBxoii2HghMzOnNLzWUVBi18uGv91bzScbrG5bDbMfc9twHnMGSxs65oOJ+lCXQFuiLUHtoOdnBHof22/HeWrLnnMmyEezOkhet9G1yKRyYcg1Ig== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fTR5bKcV2m5iUGICl1l7A9SleqrU4WkG0ReYfKNXs+A=; b=E+UeLT6/8BW+nEuq1lIQjPCOL8tt8cXar5AEbD/tNuYoGxz+RS242m7ss6Cq1Y9Oc+bSblXSSspQPwSH97DUsPz/UJAtqT9tFFLYA1gUP8jSXfEiDIWXlRQgg3kpXoCfzi0zUefaVZ5zh2U6mts8h2pJZHPw8cWemN5PxAaludQ= Received: from DM6PR00MB0783.namprd00.prod.outlook.com (2603:10b6:5:1bd::10) by DM6PR00MB0813.namprd00.prod.outlook.com (2603:10b6:5:1bc::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3281.0; Wed, 29 Jul 2020 20:41:12 +0000 Received: from DM6PR00MB0783.namprd00.prod.outlook.com ([fe80::193e:6048:ea0e:210c]) by DM6PR00MB0783.namprd00.prod.outlook.com ([fe80::193e:6048:ea0e:210c%8]) with mapi id 15.20.3281.000; Wed, 29 Jul 2020 20:41:12 +0000 From: Tommy Jensen To: "Chris Box (BT)" CC: ADD Mailing list , Andrew Campling Thread-Topic: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWZLGV7A1JtnrexkqDcLFH6GVWT6kczXMAgAAO9ICAAGPaAIAACYUAgAFyRgCAAAbacIAAE3YAgAACGFeAACumgIAAAwQJ Date: Wed, 29 Jul 2020 20:41:12 +0000 Message-ID: References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-29T20:41:12.022Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2601:600:a080:aff0:5c11:1a07:3176:f96c] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 6de38736-6193-44a6-3e2c-08d833ffbb75 x-ms-traffictypediagnostic: DM6PR00MB0813: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: CCLjPeN2lt8QzPj0vqmCiLZMhHHheQoFhq/zyIBzJbieDt3ekPUA2Cq8IcITkA/V7YS+1/epXkMAjInw4gSwL+01p3XUcMwU4uqPHKMSAnBqNb4BH+gzlG+i8wgyOX06iVviKNxwOBo6GTZkFQYMB0R/JFOiwm/EquTZFQ5LiRzupQIwazNx3JG/SwB+gOsOrrgBE51wNPgu5YU3JkbauBgrFkipnMoqGeSbHoW6TxOHX1jJLerIt+oRydqEX+lmSfgigdgHsOQuneBEKZsnOveIFbLP0x6ZMc+tpJPbbYdITKslyoMovjtVP7KFUtTQ4hTYYY+GRULizRL3arZbmQwnuQ7kjUJJgzYcK9vHm+cby39wzATdEWjNJhO5rf+Scg2BNF8lkQyOVGvKEU3Evg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR00MB0783.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(366004)(346002)(376002)(136003)(39860400002)(396003)(478600001)(966005)(8936002)(6916009)(15650500001)(4326008)(55016002)(52536014)(9686003)(64756008)(5660300002)(66446008)(66476007)(66946007)(7696005)(66556008)(54906003)(71200400001)(76116006)(91956017)(2906002)(186003)(8676002)(10290500003)(33656002)(316002)(82950400001)(86362001)(66574015)(8990500004)(19627405001)(83380400001)(166002)(53546011)(6506007)(82960400001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: Qfzve+ZLjqxRf/SFqlQJxpLaurICsSNDvpXcxy8GPtYbgSQbPiUjRSIGYw1WoQYscqKIHkik1EhtcQNYQWbhPlPFBgA/OpkyyJkwbRWTPkWQyEOnfsvnEvi2VzNx9iY3sGyDGECnD0P1iyn7YQBv6zQWiP5J1++HvpXwE1CAWr+d6D/v0rntVR5MJrhyjriT3FdIfPtIsMs+K1ibrzFoA+hQYGUvs+2eJjI36u/VL9XqCmUG4F2t+7j/q1IWUvX40J7j4P88Kqd4xxjADLy1iJ8MFVpyFOF1+lwJakoqt2Y/qc0BiloxNGhUwU9EkbGbayMxIHmwkYjKaWGU0abde/ISCSYFNy5S0bTSyhq9h23aiTD5xiE1X6biqN1+4mTuRcIc+7Cdht2G9Yv2K/qNj7wIep4P7q2Nv0Ny0zNlPduJyqDCRTA07RKPbPP1/GI7bvOikXFUUQCD1nEX4zFnoDm0L1nDEauxIv25yfTQTDOoThoRRbcpB3PO4RxGF4N+h9Z4h3QBxq4fSFcXqHSTLwiQaZWHNcrLIkWLtMNdvSUjJfbKhKRDD0/IptTUF++5b2Ose1pyA45a7TXg8MhP2JDadskTxkdmVGaEKGql2vc9RKBwC1PHnuqFqaFbMqXuZ3f4K27yHGci1+630NHmYF9RqatMgmBL3v5/4WugAptameu+txOvrG1zhhp+ts+KL2KKZTy8j78CjdeS6BrqFA== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR00MB0783B16590E184EA7340E42CFA700DM6PR00MB0783namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR00MB0783.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6de38736-6193-44a6-3e2c-08d833ffbb75 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Jul 2020 20:41:12.6072 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: sm5klLOpmMXAAUI8gqAwE8jej+e5Fd+0I/DPXN2zoJMUVhra+g3qanp3VwJZ3hVSvjT8MewzQH10ujBKq97Zfg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR00MB0813 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 20:41:18 -0000 --_000_DM6PR00MB0783B16590E184EA7340E42CFA700DM6PR00MB0783namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable chris> The Adaptive DNS draft still has a lot to offer, and seems pretty we= ll designed, but we need others in the picture too First, thank you on behalf of the other authors! Second, I can't think of a= better reason to support its adoption by the WG so we can collaboratively = refine it. That's how we get the whole group in the picture. Thanks, Tommy Jensen =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The latest in Windows Internet Protocols: Native gRPC support: https://aka.ms/grpcblogpost DNS over HTTPS: https://aka.ms/dohblogpost ________________________________ From: Chris Box (BT) Sent: Wednesday, July 29, 2020 1:27 PM To: Tommy Jensen Cc: ADD Mailing list ; Andrew Campling Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-= add-resolver-discovery-01.txt Tommy, Like you I would rather not resort to SVCB filtering; it=92s a poor way of = advising the client what the network would like. I think I=92ll reiterate the plea that implementations hold fire on mass de= ployments that break things until there is an agreed way to communicate inf= ormation that allows policies, preferences etc to work. I=92m initially loo= king at ADD to provide this, but I could equally see this could be broader = than DNS. Unfortunately Apple is racing ahead of this, generating the colla= teral damage that probably gives rise to Simon=92s frustration. I know that= =92s not your responsibility, and Windows is deploying at a more measured p= ace. Encrypted DNS is an excellent idea but challenging to deploy across all use= cases. Having a coherent set of drafts will be needed. The Adaptive DNS dr= aft still has a lot to offer, and seems pretty well designed, but we need o= thers in the picture too. Chris On Wed, 29 Jul 2020 at 19:26, Tommy Jensen > wrote: Hey Chris, Thanks for the scenario. Allow me to try and address it using our draft. For the parental control scenario, there are two scenarios I can think of. = One is the ISP is recommending a DNS server to network members with a publi= c address. By deploying DoH in accordance with the draft to that server, th= e situation self resolves. The client will follow section 5, make a DoH con= nection to the server, then the server can proceed how it sees fit. This ma= y include DNS manipulation to serve an interest such as parental controls, = including filtering SVCB record to prevent Adaptive DNS from discovering ne= w DoH designations that would take it away from the parental filtering serv= er. The other scenario is the ISP recommends an RFC1918 address, which the draf= t doesn't directly address. This is a situation where the standard shouldn'= t be confused with an implementation. Section 7 calls out that a client can= use its own discretion and policy when falling back to classic DNS though = the example context is different. Where Adaptive DNS is intended to be a st= rong privacy offering, it makes sense some users (in this case, admins who = are parents) may use device configuration to choose between privacy and con= tent filtering functionality. The same SVCB record manipulation possibilit= y exists. With this context, my view on your parental filtering concern is really a r= equest to not have Adaptive DNS be on by default, which is an implementatio= n policy concern and not a standards detail. For example, TLS 1.3 being the= minimum version required everywhere would immediately break many sites, an= d requiring DNSSEC validation at the client would break many sites. That do= esn't make either of these standards bad ideas, just that there are context= s implementors of each need to be aware of when rolling out bits. To be clear, I don't like the idea of the network attacking the SVCB record= s. However, it is possible and isn't a regression from today where DNS pack= ets are attacked to provide redirection to "censored" pages. A user seeing = this who isn't ok with the filtering can take manual action to bootstrap wi= th a trusted DoH server. A user who is ok will happily continue as they did= before Adaptive rollad out. In your scenario, the "user" is ok with it and= would experience no regressions unless they take action to configure a DoH= server other than yours, which would be a user signal that they actually d= on't want filtering. Thoughts? Thanks, Tommy Jensen =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The latest in Windows Internet Protocols: Native gRPC support: https://aka.ms/grpcblogpost DNS over HTTPS: https://aka.ms/dohblogpost ________________________________ From: Chris Box (BT) > Sent: Wednesday, July 29, 2020 10:44 AM To: Tommy Jensen > Cc: Andrew Campling ; ADD Mailing list > Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-= add-resolver-discovery-01.txt On Wed, 29 Jul 2020 at 17:50, Tommy Jensen > wrote: Can you be specific about any standard proposal which _precludes_ an implem= entation from offerings user/admin/enterprise/etc. choice and control or re= gresses control from what they have today? I don't think there's a single d= raft that's trying to decide a conflict of interest "between the interests = of end users of the Internet and other parties" in favor of the latter inst= ead of the former. If I'm wrong, please help me understand which drafts are= n't favoring end users interests and how they aren't. Surely Adaptive DNS's concept of learning the designated resolver for a dom= ain will, by default, regress parent control of child devices, particularly= in the widely deployed scenario where the parent asks the network provider= to do this job. This is true unless there is also (a) a standardised way f= or the network to inform the device of policy, and (b) common client implem= entations honor this. I used the parent example as this is mentioned in IAB-for-the-users, but co= uld equally apply to the area of trying to stop your IoT devices from doing= things they shouldn't. This could well be a timing issue. To avoid serious regressions I think we = need a coherent set of drafts that support all possible use cases before go= ing to mainstream deployment. Deploying domain designation by itself, or ma= ny other single drafts, will inevitably break some things. --_000_DM6PR00MB0783B16590E184EA7340E42CFA700DM6PR00MB0783namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
chris> The Adaptive DNS draft still has a lot to offer, and seems pretty well designe= d, but we need others in the picture too

Thanks,=
Tommy Jensen
=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The latest in Wi= ndows Internet Protocols:
  Native gR= PC support: https://aka.ms/grpcblogpost 
  DNS over = HTTPS: https://aka.ms/dohblogpost=  
From: Chris Box (BT) <ch= ris.box.ietf@gmail.com>
Sent: Wednesday, July 29, 2020 1:27 PM
To: Tommy Jensen <Jensen.Thomas@microsoft.com>
Cc: ADD Mailing list <add@ietf.org>; Andrew Campling <andre= w.campling@419.consulting>
Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft= -pauly-add-resolver-discovery-01.txt
 
Tommy,

Like you I would rather not resort to SVCB filtering; it= =92s a poor way of advising the client what the network would like. 

I think I=92ll reiterate the plea that implementations ho= ld fire on mass deployments that break things until there is an agreed way = to communicate information that allows policies, preferences etc to work. I= =92m initially looking at ADD to provide this, but I could equally see this could be broader than DNS. Unfortunatel= y Apple is racing ahead of this, generating the collateral damage that prob= ably gives rise to Simon=92s frustration. I know that=92s not your responsi= bility, and Windows is deploying at a more measured pace. 

Encrypted DNS is an excellent idea but challenging to dep= loy across all use cases. Having a coherent set of drafts will be needed. T= he Adaptive DNS draft still has a lot to offer, and seems pretty well desig= ned, but we need others in the picture too.

Chris

On Wed, 29 Jul 2020 at 19:26, Tommy= Jensen <Jensen.Thomas@mi= crosoft.com> wrote:
Hey Chris,

Thanks for the scenario. Allow me to try and address it using our draft.

For the parental control scenario, there are two scenarios I can think of. = One is the ISP is recommending a DNS server to network members with a publi= c address. By deploying DoH in accordance with the draft to that server, th= e situation self resolves. The client will follow section 5, make a DoH connection to the server, then the serve= r can proceed how it sees fit. This may include DNS manipulation to serve a= n interest such as parental controls, including filtering SVCB record to pr= event Adaptive DNS from discovering new DoH designations that would take it away from the parental filtering s= erver.

The other scenario is the ISP recommends an RFC1918 address, which the draf= t doesn't directly address. This is a situation where the standard shouldn'= t be confused with an implementation. Section 7 calls out that a client can= use its own discretion and policy when falling back to classic DNS though the example context is different. = Where Adaptive DNS is intended to be a strong privacy offering, it makes se= nse some users (in this case, admins who are parents) may use device config= uration to choose between privacy and content filtering functionality.  The same SVCB record manipulati= on possibility exists.

With this context, my view on your parental filtering concern is really a r= equest to not have Adaptive DNS be on by default, which is an implementatio= n policy concern and not a standards detail. For example, TLS 1.3 being the= minimum version required everywhere would immediately break many sites, and requiring DNSSEC validation at the= client would break many sites. That doesn't make either of these standards= bad ideas, just that there are contexts implementors of each need to be aw= are of when rolling out bits.

To be clear, I don't like the idea of the network attacking the SVCB record= s. However, it is possible and isn't a regression from today where DNS pack= ets are attacked to provide redirection to "censored" pages. A us= er seeing this who isn't ok with the filtering can take manual action to bootstrap with a trusted DoH server. A user who = is ok will happily continue as they did before Adaptive rollad out. In your= scenario, the "user" is ok with it and would experience no regre= ssions unless they take action to configure a DoH server other than yours, which would be a user signal that they actu= ally don't want filtering.

Thoughts?

Thanks,
Tommy Jensen
=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The latest in Window= s Internet Protocols:
  Native gRPC s= upport: https://aka.ms/grpcblogpost 
  DNS over HTTP= S: https://aka.ms/dohblogpost 

From:= Chris Box (BT) <chris.box.ietf@gmail.com>
Sent: Wednesday, July 29, 2= 020 10:44 AM
To: Tommy Jensen <Jensen.Thomas@microsoft.com>
Cc: Andrew Campling <and= rew.campling@419.consulting>; ADD Mailing list <add@i= etf.org>

Subject: Re: [Add] [EXTERNA= L] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.t= xt
 

On Wed, 29 Jul 2020 at 17:50, Tommy Jensen <Jensen.Thom= as=3D40= microsoft.com@dmarc.ietf..org> wrote:
Can you be specific about any standard proposal which _precludes_ an implem= entation from offerings user/admin/enterprise/etc. choice and control or re= gresses control from what they have today? I don't think there's a single d= raft that's trying to decide a conflict of interest "between the interests of end users of the Internet and o= ther parties" in favor of the latter instead of the former. If I'm wro= ng, please help me understand which drafts aren't favoring end users intere= sts and how they aren't.


Surely Adaptive DNS's concept of learning the designated resolver for = a domain will, by default, regress parent control of child devices, particu= larly in the widely deployed scenario where the parent asks the network pro= vider to do this job. This is true unless there is also (a) a standardised way for the network to inform the = device of policy, and (b) common client implementations honor this.

I used the parent example as this is mentioned in IAB-for-the-users, b= ut could equally apply to the area of trying to stop your IoT devices from = doing things they shouldn't.

This could well be a timing issue. To avoid serious regressions I thin= k we need a coherent set of drafts that support all possible use cases befo= re going to mainstream deployment. Deploying domain designation by itself, = or many other single drafts, will inevitably break some things.

--_000_DM6PR00MB0783B16590E184EA7340E42CFA700DM6PR00MB0783namp_-- From nobody Wed Jul 29 13:49:46 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2444A3A0EF9 for ; Wed, 29 Jul 2020 13:49:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7831SY8AYWJY for ; Wed, 29 Jul 2020 13:49:42 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B0E393A0EF6 for ; Wed, 29 Jul 2020 13:49:35 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id z6so26051057iow.6 for ; Wed, 29 Jul 2020 13:49:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Sdi+Ab1S8Sl9XqVTd/gblg+PG2M+VnrJD2uLYxLPpe4=; b=NmNRARrJKmU1/9U30WP0v2e5v7lW2qSB1Dpofh3WUFhZDomxqM8OsGmnTbG/EksBVr zx3iz+rQZwmvO5thnUIzdZFS7RfJzV9RP66DSpixvnQ6v1eyYdUsbtN118gzlb3dpXL8 KtDFA1+OOGC+rJZMt0JmxG/UXHAWwRYuUAtYNIlHMy6O39FJU9OaVS8wcypL3+2yBJWT fl9QT1m4JwgYwRL1sFMRvQ+yebLMrGT9XxqF+vTm6ag9MXLG4lXY+4gmV4MysnL2sEU8 PZnWzFcxjavPdBbAtTjEyKSOjTA7d2bjme0PsHFHkiN/s7Ovh+Jg2sT65/OU4hQrCsFQ fDaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Sdi+Ab1S8Sl9XqVTd/gblg+PG2M+VnrJD2uLYxLPpe4=; b=jj1YZkosVlGY/X5J4IAl/ectyumukQiOBOHRDkyg0B+PV/soQGMbUBAaRTGK8e2jG4 C2cky980h8tGL7r1ZCAdTRFtuCGITfL17ZBRjFogp+YUZGwd/WfQzyx54M4L2LETValj m3OvsxJXWUtkzaEr4Bs2stLzmgxGIl/Ylkxp1nGdqg4t+B+sgjE6tWPzbL4HfLkYJzk5 aSuV5yMoVXPGcuCBG1oy9TR/5xoskxZRx1/AbxEgOyvRzYPc0B7vYJwIIgM7ltDg9qgh 0zCcuw18UkKcUbK5JIhom0rqaQRLVDZ2at4dj3IFQ9V25XELjYa80zbFHFYgD+0Pvyxj PGkQ== X-Gm-Message-State: AOAM532tMRd8yXvjpe3tFldYF51m+ShcNID4PRYhijXwE0/bkOhZeuKF JeIw124/UF4Sg5M9/Y0B0NJbQyy1B/gQYQ3FfW29P3rs X-Google-Smtp-Source: ABdhPJxzqfsFFTq1Yr3H1fd92FmB0t0XlVjjhi7yu3TcVaUsu369UbJqWfdgnrjpozn+m6wrsKWKl5VlLfTSqmVLu0g= X-Received: by 2002:a05:6638:2493:: with SMTP id x19mr41992975jat.53.1596055774907; Wed, 29 Jul 2020 13:49:34 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> In-Reply-To: From: Rob Sayre Date: Wed, 29 Jul 2020 13:49:22 -0700 Message-ID: To: "Chris Box (BT)" Cc: Tommy Jensen , Andrew Campling , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000081503c05ab9ab1c5" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 20:49:45 -0000 --00000000000081503c05ab9ab1c5 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 29, 2020 at 10:44 AM Chris Box (BT) wrote: > > Surely Adaptive DNS's concept of learning the designated resolver for a > domain will, by default, regress parent control of child devices, > particularly in the widely deployed scenario where the parent asks the > network provider to do this job. This is true unless there is also (a) a > standardised way for the network to inform the device of policy, and (b) > common client implementations honor this. > I think this use case (which I agree does occur), is where the arguments get a bit circular. It doesn't seem possible for "the network to inform the device of policy" in a way that is distinguishable from an attack. thanks, Rob --00000000000081503c05ab9ab1c5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 29, 2020 at 10:44 AM Chris Bo= x (BT) <chris.box.ietf@gmail= .com> wrote:

Surely Adaptive DNS's concept of learning the des= ignated resolver for a domain will, by default, regress parent control of c= hild devices, particularly in the widely deployed scenario where the parent= asks the network provider to do this job. This is true unless there is als= o (a) a standardised way for the network to inform the device of policy, an= d (b) common client implementations honor this.

I think this use case (which I agree does occur), is= where the arguments get a bit circular. It doesn't seem possible for &= quot;the network to inform the device of policy" in a way that is dist= inguishable from an attack.

thanks,
Rob<= /div>

--00000000000081503c05ab9ab1c5-- From nobody Wed Jul 29 14:32:52 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA5C93A0F31 for ; Wed, 29 Jul 2020 14:32:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aW1dusVneKWD for ; Wed, 29 Jul 2020 14:32:44 -0700 (PDT) Received: from mail-qt1-x82f.google.com (mail-qt1-x82f.google.com [IPv6:2607:f8b0:4864:20::82f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 462D83A0F2F for ; Wed, 29 Jul 2020 14:32:44 -0700 (PDT) Received: by mail-qt1-x82f.google.com with SMTP id x12so10319150qtp.1 for ; Wed, 29 Jul 2020 14:32:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=/OBz6rdU6jh2vlqYpSmhmvL/LpgQ6pKHqpLjIIL6FCk=; b=h6b5wFADv1/G10NhpUrowms7fI6Z0uX0q8tBCTQP0sIgZx1tw+2oWCY1aHEft/wO3B klZrWbimyKtA8HTPsYL8s4p7npjA9er4vDMgA/CcMhI/bXqbAWYUhAYSbGUWlDUGtFbq c+1WBe7I39IQ0gWgkMC1M8CZc6gnmXKQzb9pnFwFqijUNB339FSPylBzPOYg1MZxLFrO piKcA/SzxsuXllTKZXDd39ohC+2Z4WGeg6GvIoZBPLGzZCFvIrk/Yip59/b0UM50F7/5 FIPT/8I4T7/R7NCnfPOXdrwlYcbPYf5zlikS2oBpgdil53WTmabeWJTqQWewyXlBQeQ8 PrUg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=/OBz6rdU6jh2vlqYpSmhmvL/LpgQ6pKHqpLjIIL6FCk=; b=P1p5YzIhhHgtJImlgZIAJasxVzBg3vT+QWm+2kvBj4fSO5P76FPI2AmwpfkBYneGZe hKW/F3C13QBG5iWz0LvggnGHQKpbar4eYMFrYE2HGb9nIEeBVnwRjnTud8KfwQzkEHLW 64DWOid7aZrVoBvBhqjcq/w33UlOsD6RsCUPewcTFRPMZg0GryrbSbpxREBYLQU/Bx/E U8VPZC5RD7ROhKkOgAjRw1ioH/4qcTA/4dRkyBpezIlorHBWSG2aB8VBjy68BaFz36kb z2rrIC9kRBt2BOIAUn/oissWhwWesH7aRT15mwSrUeiefyA7Tr5wE2hFuze3u3jUnj6B r4LQ== X-Gm-Message-State: AOAM531LtnJjXhljexp8/e4CiqNQ0imG11yei1n7n+VwxEeTTfz6MfV/ UX7Gb+CuQYAtM9K6KrbkmaUvs/Qqido= X-Google-Smtp-Source: ABdhPJzFbLIaf54LF8J/KJzOUpEHdpjHL6pH1KusMsXbd3q+sRJV7dkuuUDcOKHcvkHaTNEuEFRywQ== X-Received: by 2002:ac8:70da:: with SMTP id g26mr394675qtp.67.1596058363248; Wed, 29 Jul 2020 14:32:43 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:9059:d85e:ea8c:7a91? ([2601:18b:300:36ee:9059:d85e:ea8c:7a91]) by smtp.gmail.com with ESMTPSA id s184sm2680692qkf.50.2020.07.29.14.32.42 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 Jul 2020 14:32:42 -0700 (PDT) From: Ted Lemon Message-Id: <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_78E19AA0-BAB6-4588-8C4C-A32B46682C25" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Wed, 29 Jul 2020 17:32:40 -0400 In-Reply-To: Cc: "Chris Box (BT)" , Andrew Campling , ADD Mailing list , Tommy Jensen To: Rob Sayre References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 21:32:50 -0000 --Apple-Mail=_78E19AA0-BAB6-4588-8C4C-A32B46682C25 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 29, 2020, at 4:49 PM, Rob Sayre wrote: > I think this use case (which I agree does occur), is where the = arguments get a bit circular. It doesn't seem possible for "the network = to inform the device of policy" in a way that is distinguishable from an = attack. The usual way to do this is to install a device profile. I don=E2=80=99t = know if there=E2=80=99s an easy way for a parent to do this to a child, = though, and it=E2=80=99s questionable to what extent this isn=E2=80=99t = an inappropriate violation of the child=E2=80=99s autonomy. Think = homophobic parents, etc. --Apple-Mail=_78E19AA0-BAB6-4588-8C4C-A32B46682C25 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 29, 2020, at 4:49 PM, Rob Sayre <sayrer@gmail.com> = wrote:
I = think this use case (which I agree does occur), is where the arguments = get a bit circular. It doesn't seem possible for "the network to inform = the device of policy" in a way that is distinguishable from an = attack.

The usual way = to do this is to install a device profile. I don=E2=80=99t know if = there=E2=80=99s an easy way for a parent to do this to a child, though, = and it=E2=80=99s questionable to what extent this isn=E2=80=99t an = inappropriate violation of the child=E2=80=99s autonomy. Think = homophobic parents, etc.

= --Apple-Mail=_78E19AA0-BAB6-4588-8C4C-A32B46682C25-- From nobody Wed Jul 29 14:42:33 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2EC23A08D7 for ; Wed, 29 Jul 2020 14:42:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JI-ipeU7oiMB for ; Wed, 29 Jul 2020 14:42:23 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF9903A08FF for ; Wed, 29 Jul 2020 14:42:18 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id w12so12529909iom.4 for ; Wed, 29 Jul 2020 14:42:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hyjxbmWf5MQV0HBqwwuc2LWJJdycMO+JijXDRLrn+IU=; b=b4CIq9AS6cRVO64t9HHAhu8Akxn8r0Sgr7mBZ7l4RSZjFX7RHFtaxpNXL8qYXH3c9i gJw84nB6LiPpCSe9fsNl7aU7jnv6xcpOXGGZrNw8DEeUp6h8YxEAwFtxTCAGpvga7/L7 QVYnYJM6WxZiBGS1UCvOC3Pjn54CQfN2iWlBBD/cZel3WiVaGDfsjPujG5NfVG2m8sCK ksdOkGbLIcCdc9xczoPQRc7lyu103YePYEIAEMuNXpzS02VcDlCurHSh1ujSWhEjAtAq MrUfsZssAbMVtMOP7OxPNWc9hXFYaT8E4+EKBCn9aOlQZMv2YjVhDQ54jrusYFjEJllf uwWw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hyjxbmWf5MQV0HBqwwuc2LWJJdycMO+JijXDRLrn+IU=; b=MjdBqfHZkpz7erNhaF4mrqnGxD9YU4TclxdDq1xhToofSp93ADCrVQcvB7/1xY0G79 OZ7Hs9gljgrVflbHX7Vf4GK+tThMmtBg760ngq6HmceJQRT5vadtJg546wEJnn7fk26V GGuMBIgWNyWRrD+jhBstLtt106X9tbv7YzRvz7wBShQUJwJodMq/SnYsuYqQj5Gl4oNH ewRj12rGwfxw1t5U1OHOCa72gYKGBENQq+DfWiqbmXOSwpQmoOGyfFQdg9IZSG4Dz+BQ SknPYbLrOGKEJD34D0z6Tb+l8kjqPw9+2wtSd78cvc4KHTnnezWwOE7DEeQ2ziehdRkt 39EA== X-Gm-Message-State: AOAM530RocTsj+ofN2skMX4r+5S+yK/wChGZHlSJLyPD57deUY1ZFq9C yCDrx1ApK+QMYFfilr6Sp2xSMahOSXjNGU1qPm0= X-Google-Smtp-Source: ABdhPJzqkPcHDRD+XjwGDxeyaH4ZtXQrTMgkHc/CFySe/gBO7Wjir6UeAVN5GY7dV4EkbntVyETWBN1IGVe51MN+cr4= X-Received: by 2002:a05:6602:2417:: with SMTP id s23mr17991509ioa.94.1596058937878; Wed, 29 Jul 2020 14:42:17 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> In-Reply-To: <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> From: Rob Sayre Date: Wed, 29 Jul 2020 14:42:06 -0700 Message-ID: To: Ted Lemon Cc: "Chris Box (BT)" , Andrew Campling , ADD Mailing list , Tommy Jensen Content-Type: multipart/alternative; boundary="000000000000086e5205ab9b6e4b" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 21:42:32 -0000 --000000000000086e5205ab9b6e4b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 29, 2020 at 2:32 PM Ted Lemon wrote: > On Jul 29, 2020, at 4:49 PM, Rob Sayre wrote: > > I think this use case (which I agree does occur), is where the arguments > get a bit circular. It doesn't seem possible for "the network to inform t= he > device of policy" in a way that is distinguishable from an attack. > > > The usual way to do this is to install a device profile. I don=E2=80=99t = know if > there=E2=80=99s an easy way for a parent to do this to a child, though, a= nd it=E2=80=99s > questionable to what extent this isn=E2=80=99t an inappropriate violation= of the > child=E2=80=99s autonomy. Think homophobic parents, etc. > To be clear, I am not talking about services like < https://www.apple.com/families/>, which could include a "device profile" and far exceed capabilities that could be controlled via DNS. I don't think anyone is arguing about stuff like that, since it would be an inappropriate topic for a networking WG. The murky territory is where there is no such device control, but there are products that have used clear-text DNS to deliver some of those features. thanks, Rob --000000000000086e5205ab9b6e4b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 29, 2020 at 2:32 PM Ted Lemon= <mellon@fugue.com> wrote:
On Jul 29, 2020, at 4:= 49 PM, Rob Sayre <= sayrer@gmail.com> wrote:
I think this use case (which I agree does occur), is where the= arguments get a bit circular. It doesn't seem possible for "the n= etwork to inform the device of policy" in a way that is distinguishabl= e from an attack.

The usual way to d= o this is to install a device profile. I don=E2=80=99t know if there=E2=80= =99s an easy way for a parent to do this to a child, though, and it=E2=80= =99s questionable to what extent this isn=E2=80=99t an inappropriate violat= ion of the child=E2=80=99s autonomy. Think homophobic parents, etc.

To be clear, I am not talking about se= rvices like <https://www.app= le.com/families/>, which could include a "device profile" = and far exceed capabilities that could be controlled via DNS. I don't t= hink anyone is arguing about stuff like that, since it would be an inapprop= riate topic for a networking WG.

The murky territo= ry is where there is no such device control, but there are products that ha= ve used clear-text DNS to deliver some of those features.

thanks,
Rob
--000000000000086e5205ab9b6e4b-- From nobody Wed Jul 29 14:47:38 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82FC63A041A for ; Wed, 29 Jul 2020 14:47:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cLicZEMAq2hm for ; Wed, 29 Jul 2020 14:47:35 -0700 (PDT) Received: from mail-qv1-xf2d.google.com (mail-qv1-xf2d.google.com [IPv6:2607:f8b0:4864:20::f2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 068583A03EA for ; Wed, 29 Jul 2020 14:47:34 -0700 (PDT) Received: by mail-qv1-xf2d.google.com with SMTP id o2so11587795qvk.6 for ; Wed, 29 Jul 2020 14:47:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=enNq0zy5PWTtpPXL1Pyq5BEtRZSAtm0tm1u4XymgKpk=; b=AEf38PYZ7u8r/SJ/mK+oItyv8pVxjfGzhDd3q9ghp+U3rBn1xBhzzyRpKcmht9+SZ4 3somrK1ui4VteaP/U06Bg7sYQbc86KA4DvbS5PFpHM2JPjluBY+0MtmAgLoo7Evkna2e cgp95AWmXjtjBGTNhYsKi94wyqf6uljvJ+u4Kd7P7uJsiHH84hQtaIbVTQfQjnmZ/ndT q0bNBaSLN8LzALbjNzx7341OrJt0DUlC2CBqmBHldcvg8ZfEISC2Y5xKX0D2Uo3hBR54 ZTPEK/5ShmFHdk1hGocb7wpnDSgYyMDh9+wYugz+VuGV3ArxLqCIEfA1vDTursJAI3CA qyrQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=enNq0zy5PWTtpPXL1Pyq5BEtRZSAtm0tm1u4XymgKpk=; b=OrfQN4UxdIoL8FLoAvas9wrcrkMeTh7IFLwma20dUjwJRii30KscQSkFYqSofzGEQ9 NG2/cUCp6EsCUIUmObtVhIxtOj1eaVvTIEKDJ556RKCGjrkdch40B68jSymwhoj9T8lh 6kYOvUqws4JmHRgZjZDAj4+nVX0G7jSf+uizMtJNBY3WlZ72P+XOLg0pR2i8b6omZHjT aA2YLf9aBm0BrEYX1K4nGs93euiSYFLIl8seF3Yp1Kr+UOuSVEn56npa2qs3eVNlNLXE Gtca73Bedhij8JMeT3CEc7fo3DISTyteN55VzDVEQ5SdI8IOREkLP+Qv47nnH8S0gEw2 nEcw== X-Gm-Message-State: AOAM530xTvrP+TO+LXFJfsFSKEVBLcfd0iKe65Qg4FZWTFA1kc7bfCcJ UQGA154xHZ4hPpjs7z7wVzDqUVNbLs0= X-Google-Smtp-Source: ABdhPJx6KxpivBOxG7m88OuknJJ7JaxvbccbNPex4qtBGwl1IS+d3LwEcr3Y32DcMQtfJa285hde1g== X-Received: by 2002:ad4:4152:: with SMTP id z18mr1528qvp.42.1596059253976; Wed, 29 Jul 2020 14:47:33 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:9059:d85e:ea8c:7a91? ([2601:18b:300:36ee:9059:d85e:ea8c:7a91]) by smtp.gmail.com with ESMTPSA id r48sm3058615qtr.17.2020.07.29.14.47.33 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 Jul 2020 14:47:33 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_96734FE2-8409-4B41-8B79-D791588F4F0B" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Wed, 29 Jul 2020 17:47:32 -0400 In-Reply-To: Cc: "Chris Box (BT)" , Andrew Campling , ADD Mailing list , Tommy Jensen To: Rob Sayre References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2020 21:47:37 -0000 --Apple-Mail=_96734FE2-8409-4B41-8B79-D791588F4F0B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 29, 2020, at 5:42 PM, Rob Sayre wrote: > The murky territory is where there is no such device control, but = there are products that have used clear-text DNS to deliver some of = those features. Actually I wasn=E2=80=99t referring to the Apple Families thing. You can = just set up a profile that points your resolver somewhere. That = somewhere can be a DNS filtering resolver. But of course Apple Families would be better than that=E2=80=A6 :) --Apple-Mail=_96734FE2-8409-4B41-8B79-D791588F4F0B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 29, 2020, at 5:42 PM, Rob Sayre <sayrer@gmail.com> = wrote:
The = murky territory is where there is no such device control, but there are = products that have used clear-text DNS to deliver some of those = features.

Actually I = wasn=E2=80=99t referring to the Apple Families thing. You can just set = up a profile that points your resolver somewhere. That somewhere can be = a DNS filtering resolver.

But of = course Apple Families would be better than that=E2=80=A6 = :)


= --Apple-Mail=_96734FE2-8409-4B41-8B79-D791588F4F0B-- From nobody Wed Jul 29 20:52:47 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B09553A0DF8 for ; Wed, 29 Jul 2020 20:52:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4vTe5MuJa5BS for ; Wed, 29 Jul 2020 20:52:35 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F02E83A0D1F for ; Wed, 29 Jul 2020 20:52:32 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id w12so13251005iom.4 for ; Wed, 29 Jul 2020 20:52:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=7nbZfQyQPBYMw2bcO6o3rMmHKSeJ5urnhJ2jcvnv7zw=; b=aOiXuUs5AKc/sFUCkLOg9t51xP1C8Bg+iQHiWl45NQuRStkFomABipifYSn/Wg784P LTThyFT+h3/L75047RGkijgK5umSuO3Ik2I18pRkhCHxzbThiw5v4DVJyZf8dAOLM2OO itwjDCTxI4Vy+vzp0QmT+fkmm3VhL/4ET2xII1En/XMEpWj+yN4yIu96fyN3q1lup94n MLamy39YxGE9l6kqzRqo0nOF9mXvOr7XOImxwbcNn7h+jPi7Lpxtd6UDXAKh/Qsbslgb IO66ApXaQST9gqsbuqqVq9rxtgjvf7F/AXgh2hw1uKq2wYHiimRzyDLKpvsldFkYlW8C bPKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=7nbZfQyQPBYMw2bcO6o3rMmHKSeJ5urnhJ2jcvnv7zw=; b=N3MOM/KudhvfMIn9oJFgHkA9yksbMIShb1TAzI3zuIg7k8xPVfcabBjIExMucvBYZu VmOs7of8JWsDCCHtiDVFTa24qZm9rD099sYGZOA4foyL3BSTVcWsZksD2kuObdeGinCQ tR3/A9QuZjJl9RtR130p9/FVx5/R2Ax8/+ShSwpqW2SFDrDzXQUiz54peR7cOzgAJFR+ Pcqj/1fZdBJo2s8Lu/Iu6ET/Yk+SJOzESul+h8VJ7qNmItB15cDCxWgzLlStknS+GliM 8WUK5JYEpRXKDJIT+Sq3D7Op/UcRVRtOPf6WYitXAV7Sv+OsVzla03Bm5RN8F/hCl76g xUDw== X-Gm-Message-State: AOAM533Gxw//ffCi30DD7mBXa+QpWWB8koBFl8aw88n2wZVhPtbbomd2 vfZavzTv+i17IA4BTslQqD6SeJsdLOKOKf+8+k1mMQf5pgA= X-Google-Smtp-Source: ABdhPJy1ZiJI+ZHEvJ9iQZnpVUdqco9BiCgk9CpQLdvMx1CAKJL8Z4mpbtWTzJt71tD4Ran0hDOmErVw6HkFtfXw3Gk= X-Received: by 2002:a5e:d514:: with SMTP id e20mr22834659iom.183.1596081152145; Wed, 29 Jul 2020 20:52:32 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> In-Reply-To: From: tirumal reddy Date: Thu, 30 Jul 2020 03:52:20 +0000 Message-ID: To: Ted Lemon Cc: Rob Sayre , "Chris Box (BT)" , Andrew Campling , ADD Mailing list , Tommy Jensen Content-Type: multipart/alternative; boundary="0000000000001b3eec05aba09ab3" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 03:52:45 -0000 --0000000000001b3eec05aba09ab3 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 29 Jul 2020 at 21:47, Ted Lemon wrote: > On Jul 29, 2020, at 5:42 PM, Rob Sayre wrote: > > The murky territory is where there is no such device control, but there > are products that have used clear-text DNS to deliver some of those > features. > > > Actually I wasn=E2=80=99t referring to the Apple Families thing. You can = just set > up a profile that points your resolver somewhere. That somewhere can be a > DNS filtering resolver. > Device profiles are typically used in Enterprise networks (for example, see bullet 2 in https://tools.ietf.org/html/draft-reddy-add-enterprise-00#section-5) to bootstrap endpoints like BYOD but the on-boarding of endpoints is quite different in home networks. How do you propose on-board various types of endpoints (including smart TV, chromebook, xbox etc) with device profiles in home networks ? -Tiru > > But of course Apple Families would be better than that=E2=80=A6 :) > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000001b3eec05aba09ab3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Wed, 29 Jul 2020 at 21:47, Ted Lemon &= lt;mellon@fugue.com> wrote:
<= /div>
On Jul 29, 2020, at 5:42 PM, Rob Sayre <sayrer@gmail.com> wrote:=
The murky territor= y is where there is no such device control, but there are products that hav= e used clear-text DNS to deliver some of those features.

Actually I wasn=E2=80=99t referring to the Apple Famil= ies thing. You can just set up a profile that points your resolver somewher= e. That somewhere can be a DNS filtering resolver.
=

Device profiles are typically used in Enterprise=C2=A0n= etworks (for example, see bullet 2 in=C2=A0https://tools.ietf.org/html= /draft-reddy-add-enterprise-00#section-5)=C2=A0to bootstrap endpoints l= ike BYOD but the on-boarding of endpoints is quite different in home networ= ks.=C2=A0

How do you propose on-board various=C2= =A0types of endpoints (including smart TV, chromebook, xbox etc) with devic= e profiles in home networks=C2=A0 ?

-Tiru
=C2=A0

But of course Apple Fam= ilies would be better than that=E2=80=A6 :)


-= -
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000001b3eec05aba09ab3-- From nobody Wed Jul 29 21:09:35 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D1023A0CBB for ; Wed, 29 Jul 2020 21:09:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cx1cNddmlr_W for ; Wed, 29 Jul 2020 21:09:32 -0700 (PDT) Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E51B63A0CB9 for ; Wed, 29 Jul 2020 21:09:31 -0700 (PDT) Received: by mail-io1-xd2c.google.com with SMTP id t15so17968657iob.3 for ; Wed, 29 Jul 2020 21:09:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Sfp6LmN+fpKtS0Nl9monZHaiNRDcDHOkNgeJtBQ0rJw=; b=KM9VWMrTkTd4rWDznubaDrlzgkH5apQCL2keexqkIHlLjGC/kFzVSbIeSMxDKTobs3 VEMQ1pWwMAsLHOEawBl7uk2xAFq/PUjGpFHwJrZjZwnaxMSXnVrG/fTbq+zPXy38kkrb wx3wzSV4yu6uJQSnNCKoXRzYkabl1+oItGg9RDIFtJ1iDmu6A0A5ZS6xH6PC5y7s7ruc tCTz50av+WGhSKDgl6aU962NwzDCBP2bQHYGHQea131WOTZoRu22G+xb9Wm5En9jp17A +OijgrM9G9CXOGyhQu1CnTHJlA2b5nBqrhTFJ4IXzbxEM8gxbuof7UCTS/iQhDAhVlt6 XwqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Sfp6LmN+fpKtS0Nl9monZHaiNRDcDHOkNgeJtBQ0rJw=; b=MfWOkIJenjNDkIKsXiE+dWhNxadaKZA0ImYfVOJ9g4ieAlA0Etz4OvMj2wh7W9mkQs topvFX9uF3bjqJlaQET/h5BuOY+W/jTa76UMIp2wV/2RUkxNHoDqWbHoU8FfGZ+AQBly vPVGBUVFdTgcr03Z0HNRxoUIgOtpUd1d5kCtFV7VRX1lrtHtGpuJsDQy4Ut3bumVIbDB Wj96feXQODJElGNqXzTa9XFsu1tk1NJw+EC0JabhTKND8Y6H7IbwskxQrB/ei3Rd/aA6 bMmUZybEykjsj4G1v6npgeZYeGDHHN11lY1M8HuWWNt1grea4WAZ7id0tQV8AxKuHK9L IkFg== X-Gm-Message-State: AOAM533F0ZloQhIsRkT46XUrQLMs6HTjT89Ej2yjIOQdP2YalTizkLxN wpWFdVvB+qqzgRqjbFVesWF4rjxOsxBy/pyxCZo= X-Google-Smtp-Source: ABdhPJyVU0TxD8l5F4e5TKPhpLHr6xsIrc1LCnJX9MHmxOEdsuLTG4FKGyowRMVQCwyBnPQGOjbWabDiTB7f8skIGoI= X-Received: by 2002:a02:84c1:: with SMTP id f59mr1450481jai.106.1596082171163; Wed, 29 Jul 2020 21:09:31 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> In-Reply-To: From: Rob Sayre Date: Wed, 29 Jul 2020 21:09:18 -0700 Message-ID: To: tirumal reddy Cc: Ted Lemon , "Chris Box (BT)" , Andrew Campling , ADD Mailing list , Tommy Jensen Content-Type: multipart/alternative; boundary="000000000000d8380d05aba0d6d2" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 04:09:34 -0000 --000000000000d8380d05aba0d6d2 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 29, 2020 at 8:52 PM tirumal reddy wrote: > > How do you propose on-board various types of endpoints (including smart > TV, chromebook, xbox etc) with device profiles in home networks ? > Don't care. These are not high-security networks. thanks, Rob --000000000000d8380d05aba0d6d2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 29, 2020 at 8:52 PM tirumal r= eddy <kondtir@gmail.com> wro= te:

How do you propose on-board various=C2=A0types of endpoints= (including smart TV, chromebook, xbox etc) with device profiles in home ne= tworks=C2=A0 ?

Don't = care. These are not high-security networks.

thanks= ,
Rob
=C2=A0
--000000000000d8380d05aba0d6d2-- From nobody Wed Jul 29 21:18:47 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 58EF03A0CD1 for ; Wed, 29 Jul 2020 21:18:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1vQ3h0-1cHtQ for ; Wed, 29 Jul 2020 21:18:42 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0ABFD3A0CD0 for ; Wed, 29 Jul 2020 21:18:41 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id e64so26879084iof.12 for ; Wed, 29 Jul 2020 21:18:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vHB5iX3FcFZwXvfCb+aaikv4glDd2pnCppybRqYsW+s=; b=Fal1PrHFoiRivOJKl+qM8fIfPrYbrv3L3nXF8qxbwuZIKLAQbv1g86e/3i/YnEqiKT JGGxoSOfSWg+8fjVXdmyRn3Ta1RaGjX7V+3aJssH4vlkYNUQCuNm8s5+oVmAOcyN75BV M5NgUJZ7SPhE4lUAKLx4ehO7t1jtARZ5I5WwZ6Rv9PecqBHR2jotFKUhPC5/nse8byfN LimZSNduVh5cgvQ/6yizcuMxud0JjlkmVnWSHUIPvsdJkJ3Y/BBbvknmBPH8Li+Rkblk hdex3JDmNA45klkUGXoto0MzlMTPxB8n7GLTMeVWjqCqDIzyV7rd8zIhCf5j/4TDeH6o mfeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vHB5iX3FcFZwXvfCb+aaikv4glDd2pnCppybRqYsW+s=; b=Z/tiDdnDyztFZx3b/FjpSeNjOr2BBUbKns3eIAnCwRenhTGmUKfhvsBlFbrQyW2RZ3 /jNdWQcP6FjW1JpkStSQ8TuPFkT9TjSR6IBt6EQdV19q9mbvDAD7lFdG7BCLeZCymAtk lnp2zhmUJ/tgxcwiLSJth/nwxUA5j8aKkPFj8uwYDc4TDGgRbjqem3dmVuOlhZLkxmRb xJnlDT5SXmT8xxWB81F3+Mzl/3Dz/03tqzttFZj1j4rf2XnnSdAYCZ3ZlgMdyQhE71LA 7jFvepnbN4xoRWRHZ/cGtpSYHS7vI8qeFgW8HHtkhc38JuMG2d+2xISOW6OqDUrV7yNY Klhg== X-Gm-Message-State: AOAM530yspP+csrgwOZTg4X2fd1FVN/6OYsgH/Yz6wQij36IUoGiN5Zs 8irNDYKYDFABLmk/ETiM+6Dqah0TugskI6UP5J6/giOJ X-Google-Smtp-Source: ABdhPJxM1P9srnHWkeVzeHuxqilxpReDNLRxlNGymoLVQPdk7xwrwlLVeIlLXpl9wiTmhQj/HCmpDzBRRN4E6gsyxPg= X-Received: by 2002:a6b:b5cd:: with SMTP id e196mr36261628iof.46.1596082721167; Wed, 29 Jul 2020 21:18:41 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> In-Reply-To: From: tirumal reddy Date: Thu, 30 Jul 2020 04:18:29 +0000 Message-ID: To: "Chris Box (BT)" Cc: Tommy Jensen , Andrew Campling , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000a09dce05aba0f716" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 04:18:45 -0000 --000000000000a09dce05aba0f716 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I am not sure how SVCB filtering would solve the problem. We may want to take a step back to understand how home network security works today (I work for McAfee and we offer network security services on home routers to protect from both external and internal attacks (see https://securehomeplatform.mcafee.com/). Several other security vendors offer similar network security services. DNS message are processed to provide the following security features: a) Blocking domains based on threat data (e.g., malware, phishing). The threat data keeps frequently updated and a domain reputation may change from a good to a bad site. The DNS response is only modified for blocked domains. b) Inspect the DNS messages to filter communication with Malware Command & Control server (e.g., TXT records are typically used to receive instructions from C&C server, leak personal data). c) IoT MUD https://tools.ietf.org/html/rfc8520 to permit IoT devices to only reach intended domains d) Anomaly detection (using ML) leveraging network telemetry (including DNS) to identify malware on the endpoints. e) Identifying phishing sites, DGA using Natural Language Processing kind of techniques. This discussion is out of scope of this WG but will help understand the problems network security services will face with designated resolvers. Cheers, -Tiru On Wed, 29 Jul 2020 at 20:28, Chris Box (BT) wrote: > Tommy, > > Like you I would rather not resort to SVCB filtering; it=E2=80=99s a poor= way of > advising the client what the network would like. > > I think I=E2=80=99ll reiterate the plea that implementations hold fire on= mass > deployments that break things until there is an agreed way to communicate > information that allows policies, preferences etc to work. I=E2=80=99m in= itially > looking at ADD to provide this, but I could equally see this could be > broader than DNS. Unfortunately Apple is racing ahead of this, generating > the collateral damage that probably gives rise to Simon=E2=80=99s frustra= tion. I > know that=E2=80=99s not your responsibility, and Windows is deploying at = a more > measured pace. > > Encrypted DNS is an excellent idea but challenging to deploy across all > use cases. Having a coherent set of drafts will be needed. The Adaptive D= NS > draft still has a lot to offer, and seems pretty well designed, but we ne= ed > others in the picture too. > > Chris > > On Wed, 29 Jul 2020 at 19:26, Tommy Jensen > wrote: > >> Hey Chris, >> >> Thanks for the scenario. Allow me to try and address it using our draft. >> >> For the parental control scenario, there are two scenarios I can think >> of. One is the ISP is recommending a DNS server to network members with = a >> public address. By deploying DoH in accordance with the draft to that >> server, the situation self resolves. The client will follow section 5, m= ake >> a DoH connection to the server, then the server can proceed how it sees >> fit. This may include DNS manipulation to serve an interest such as >> parental controls, including filtering SVCB record to prevent Adaptive D= NS >> from discovering new DoH designations that would take it away from the >> parental filtering server. >> >> The other scenario is the ISP recommends an RFC1918 address, which the >> draft doesn't directly address. This is a situation where the standard >> shouldn't be confused with an implementation. Section 7 calls out that a >> client can use its own discretion and policy when falling back to classi= c >> DNS though the example context is different. Where Adaptive DNS is inten= ded >> to be a strong privacy offering, it makes sense some users (in this case= , >> admins who are parents) may use device configuration to choose between >> privacy and content filtering functionality. The same SVCB record >> manipulation possibility exists. >> >> With this context, my view on your parental filtering concern is really = a >> request to not have Adaptive DNS be on by default, which is an >> implementation policy concern and not a standards detail. For example, T= LS >> 1.3 being the minimum version required everywhere would immediately brea= k >> many sites, and requiring DNSSEC validation at the client would break ma= ny >> sites. That doesn't make either of these standards bad ideas, just that >> there are contexts implementors of each need to be aware of when rolling >> out bits. >> >> To be clear, I don't like the idea of the network attacking the SVCB >> records. However, it is possible and isn't a regression from today where >> DNS packets are attacked to provide redirection to "censored" pages. A u= ser >> seeing this who isn't ok with the filtering can take manual action to >> bootstrap with a trusted DoH server. A user who is ok will happily conti= nue >> as they did before Adaptive rollad out. In your scenario, the "user" is = ok >> with it and would experience no regressions unless they take action to >> configure a DoH server other than yours, which would be a user signal th= at >> they actually don't want filtering. >> >> Thoughts? >> >> Thanks, >> Tommy Jensen >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >> The latest in Windows Internet Protocols: >> Native gRPC support: https://aka.ms/grpcblogpost >> DNS over HTTPS: https://aka.ms/dohblogpost >> >> ------------------------------ >> *From:* Chris Box (BT) >> *Sent:* Wednesday, July 29, 2020 10:44 AM >> *To:* Tommy Jensen >> *Cc:* Andrew Campling ; ADD Mailing list >> >> >> *Subject:* Re: [Add] [EXTERNAL] Re: New Version Notification for >> draft-pauly-add-resolver-discovery-01.txt >> >> >> On Wed, 29 Jul 2020 at 17:50, Tommy Jensen > 40microsoft.com@dmarc.ietf..org <40microsoft.com@dmarc.ietf.org>> wrote: >> >> Can you be specific about any standard proposal which _precludes_ an >> implementation from offerings user/admin/enterprise/etc. choice and cont= rol >> or regresses control from what they have today? I don't think there's a >> single draft that's trying to decide a conflict of interest "between the >> interests of end users of the Internet and other parties" in favor of th= e >> latter instead of the former. If I'm wrong, please help me understand wh= ich >> drafts aren't favoring end users interests and how they aren't. >> >> >> Surely Adaptive DNS's concept of learning the designated resolver for a >> domain will, by default, regress parent control of child devices, >> particularly in the widely deployed scenario where the parent asks the >> network provider to do this job. This is true unless there is also (a) a >> standardised way for the network to inform the device of policy, and (b) >> common client implementations honor this. >> >> I used the parent example as this is mentioned in IAB-for-the-users, but >> could equally apply to the area of trying to stop your IoT devices from >> doing things they shouldn't. >> >> This could well be a timing issue. To avoid serious regressions I think >> we need a coherent set of drafts that support all possible use cases bef= ore >> going to mainstream deployment. Deploying domain designation by itself, = or >> many other single drafts, will inevitably break some things. >> >> -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000a09dce05aba0f716 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I am not sure how SVCB filtering would solve the prob= lem. We may want to take a step back to understand how home network securit= y works today (I work for McAfee and we offer=C2=A0network security service= s on home routers to protect from both external and internal attacks (see= =C2=A0= https://securehomeplatform.mcafee.com/). Several other security vendors= offer similar network security services.=C2=A0
=C2=A0
DNS mes= sage are processed to provide the following security features:
a) Blocking domains based on threat data (e.g., malware, phish= ing). The threat data keeps frequently updated and a domain reputation may = change from a good to a bad site. The DNS response is only modified for blo= cked domains.
b) Inspect the DNS messages to filter communication= with Malware Command & Control server (e.g., TXT records are typically= used to receive instructions from C&C server, leak personal data).
c) IoT MUD=C2=A0https://tools.ietf.org/html/rfc8520=C2=A0to permit IoT de= vices to only reach intended domains
d) Anomaly detection (using = ML) leveraging network telemetry (including DNS) to identify malware on the= endpoints.
e) Identifying phishing sites, DGA using=C2=A0Natural= Language Processing kind of techniques.

This disc= ussion is out of scope of this WG but will help understand the problems net= work security services will face with designated resolvers.

<= /div>
Cheers,
-Tiru

On Wed, 29 Jul 2020 at 20:28, Chris Box (B= T) <chris.= box.ietf@gmail.com> wrote:
Tommy,

=
Like you I would rather not resort to SVCB filterin= g; it=E2=80=99s a poor way of advising the client what the network would li= ke.=C2=A0

I think I=E2= =80=99ll reiterate the plea that implementations hold fire on mass deployme= nts that break things until there is an agreed way to communicate informati= on that allows policies, preferences etc to work. I=E2=80=99m initially loo= king at ADD to provide this, but I could equally see this could be broader = than DNS. Unfortunately Apple is racing ahead of this, generating the colla= teral damage that probably gives rise to Simon=E2=80=99s frustration. I kno= w that=E2=80=99s not your responsibility, and Windows is deploying at a mor= e measured pace.=C2=A0

E= ncrypted DNS is an excellent idea but challenging to deploy across all use = cases. Having a coherent set of drafts will be needed. The Adaptive DNS dra= ft still has a lot to offer, and seems pretty well designed, but we need ot= hers in the picture too.

Chris

On Wed, 29 Jul 2020 at 19:26, Tommy Jensen <Jensen.Thomas@microso= ft.com> wrote:
Hey Chris,

Thanks for the scenario. Allow me to try and address it using our draft.

For the parental control scenario, there are two scenarios I can think of. = One is the ISP is recommending a DNS server to network members with a publi= c address. By deploying DoH in accordance with the draft to that server, th= e situation self resolves. The client will follow section 5, make a DoH connection to the server, then the serve= r can proceed how it sees fit. This may include DNS manipulation to serve a= n interest such as parental controls, including filtering SVCB record to pr= event Adaptive DNS from discovering new DoH designations that would take it away from the parental filtering s= erver.

The other scenario is the ISP recommends an RFC1918 address, which the draf= t doesn't directly address. This is a situation where the standard shou= ldn't be confused with an implementation. Section 7 calls out that a cl= ient can use its own discretion and policy when falling back to classic DNS though the example context is different. = Where Adaptive DNS is intended to be a strong privacy offering, it makes se= nse some users (in this case, admins who are parents) may use device config= uration to choose between privacy and content filtering functionality.=C2=A0 The same SVCB record manipulati= on possibility exists.

With this context, my view on your parental filtering concern is really a r= equest to not have Adaptive DNS be on by default, which is an implementatio= n policy concern and not a standards detail. For example, TLS 1.3 being the= minimum version required everywhere would immediately break many sites, and requiring DNSSEC validation at the= client would break many sites. That doesn't make either of these stand= ards bad ideas, just that there are contexts implementors of each need to b= e aware of when rolling out bits.

To be clear, I don't like the idea of the network attacking the SVCB re= cords. However, it is possible and isn't a regression from today where = DNS packets are attacked to provide redirection to "censored" pag= es. A user seeing this who isn't ok with the filtering can take manual action to bootstrap with a trusted DoH server. A user who = is ok will happily continue as they did before Adaptive rollad out. In your= scenario, the "user" is ok with it and would experience no regre= ssions unless they take action to configure a DoH server other than yours, which would be a user signal that they actu= ally don't want filtering.

Thoughts?

Thanks,
Tommy Jensen
=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The latest in Window= s Internet Protocols:
=C2=A0 Native gRPC s= upport: https://aka.ms/grpcblogpost=C2=A0
=C2=A0 DNS over HTTP= S:=C2=A0https://aka.ms/dohblogpost=C2=A0

From: Chris Box (BT) <chris.box.ietf@gmail.com>
Sent: Wednesday, July 29, 2= 020 10:44 AM
To: Tommy Jensen <Jensen.Thomas@microsoft.com>
Cc: Andrew Campling <and= rew.campling@419.consulting>; ADD Mailing list <add@i= etf.org>

Subject: Re: [Add] [EXTERNA= L] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.t= xt
=C2=A0

On Wed, 29 Jul 2020 at 17:50, Tommy Jensen <Jensen.Thom= as=3D40= microsoft.com@dmarc.ietf..org> wrote:
Can you be specific about any standard proposal which _precludes_ an implem= entation from offerings user/admin/enterprise/etc. choice and control or re= gresses control from what they have today? I don't think there's a = single draft that's trying to decide a conflict of interest "between the interests of end users of the Internet and o= ther parties" in favor of the latter instead of the former. If I'm= wrong, please help me understand which drafts aren't favoring end user= s interests and how they aren't.


Surely Adaptive DNS's concept of learning the designated resolver = for a domain will, by default, regress parent control of child devices, par= ticularly in the widely deployed scenario where the parent asks the network= provider to do this job. This is true unless there is also (a) a standardised way for the network to inform the = device of policy, and (b) common client implementations honor this.

I used the parent example as this is mentioned in IAB-for-the-users, b= ut could equally apply to the area of trying to stop your IoT devices from = doing things they shouldn't.

This could well be a timing issue. To avoid serious regressions I thin= k we need a coherent set of drafts that support all possible use cases befo= re going to mainstream deployment. Deploying domain designation by itself, = or many other single drafts, will inevitably break some things.

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000a09dce05aba0f716-- From nobody Wed Jul 29 21:21:37 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16F8F3A0CD5 for ; Wed, 29 Jul 2020 21:21:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tpjxe5j5B5dG for ; Wed, 29 Jul 2020 21:21:34 -0700 (PDT) Received: from mail-il1-x134.google.com (mail-il1-x134.google.com [IPv6:2607:f8b0:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A174B3A0CD6 for ; Wed, 29 Jul 2020 21:21:34 -0700 (PDT) Received: by mail-il1-x134.google.com with SMTP id t18so21416818ilh.2 for ; Wed, 29 Jul 2020 21:21:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=5lxvHgAY38gs6J2x1bsrr6tGwt1uRvKDxMooiputR3Q=; b=IcIlCmpz/r57OpM3ixUUzIky10UjI2o2TCiLhBLrA7wIsu101gswGPjMP5QYe/JAbV yhsNgQepdAzoMGKLkZf2FoE6uK6U/Nh/Z06IMSZOyXke4N2ZiwXEGm+FWV6f1PcgdaxW TDJ1lPl4Mvuuf4TllRWP66d+W3UlkW65YbVzmZvuV1IDZ0NG/V7vh8nbOp1PWfnw4TXK ++Ed6TdHIOoFoIqvUd8z1H1jQ4iHPBVzIEA5+QQTeucnFfH3qeeTKolodhLR62hHnYiH 9nw99sr1LOZYbNv957GM8DO69S5dOWOLhEnnvH/GuMVPNPKDjt/LGmLLKhD0zfiWpCMv iHXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=5lxvHgAY38gs6J2x1bsrr6tGwt1uRvKDxMooiputR3Q=; b=Pc/F7/2nBm9HBqTmC/MERY2GpG9IvGbKc6JSnQrAv0Hl+h+8A2dN8DIJIDIMOx/20b 9RKEyhfUgkJzpGAmmOMRza+/nX7r5tdqP7MjNWrAcN+95zOL2gExcmksU6NHRAciJy3x rF+yQins9l2qt2uaO4xCns56P6ErIYlWJVCFkOdmBcwSpuazIHIKT+4Z/3+mslL2+puJ RzE/irxVZnzUhiAz/b7xkM+/zrwyhAHoracVizHnwxAl0sml8MN0ymPy/GyCVVr2AncU 9SlTry1NZl7Im2wPKidvOPcnls6DlDW9EgQP/+sPB759GToxu4F6HedFL3Cwel8X2arU 4G7g== X-Gm-Message-State: AOAM532cdCU3PXY+/HCLz5s4CLZzUREzN2lfFVdapr0PyG+wTos0uivB 2PZZrAXZUHZNxj677SF2oKmMyh1TgV3HLhFmRdY= X-Google-Smtp-Source: ABdhPJwdogK9ilqz7EhmrmPNEX1Ohg8V0U6e2PJFxml7G0vmmjN0ACXZYx2pi3B4VFwdIaQ+qmqAQgotP8Xw2wmKYRM= X-Received: by 2002:a92:89ce:: with SMTP id w75mr24239596ilk.123.1596082893931; Wed, 29 Jul 2020 21:21:33 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> In-Reply-To: From: tirumal reddy Date: Thu, 30 Jul 2020 04:21:22 +0000 Message-ID: To: Rob Sayre Cc: Ted Lemon , "Chris Box (BT)" , Andrew Campling , ADD Mailing list , Tommy Jensen Content-Type: multipart/alternative; boundary="000000000000ecca4a05aba101b6" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 04:21:36 -0000 --000000000000ecca4a05aba101b6 Content-Type: text/plain; charset="UTF-8" On Thu, 30 Jul 2020 at 04:09, Rob Sayre wrote: > On Wed, Jul 29, 2020 at 8:52 PM tirumal reddy wrote: > >> >> How do you propose on-board various types of endpoints (including smart >> TV, chromebook, xbox etc) with device profiles in home networks ? >> > > Don't care. These are not high-security networks. > My point is parental control is not restricted to Apple devices and your proposal of device profile is not solving the problem for home network deployments. -Tiru > > thanks, > Rob > > --000000000000ecca4a05aba101b6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, 30 Jul 2020 at 04:09, Rob Sayre &= lt;sayrer@gmail.com> wrote:
<= /div>
On Wed, Jul 29, 2020 at 8:52 PM ti= rumal reddy <kond= tir@gmail.com> wrote:
<= br>
How do you propose on-board variou= s=C2=A0types of endpoints (including smart TV, chromebook, xbox etc) with d= evice profiles in home networks=C2=A0 ?
=
Don't care. These are not high-security networks.
<= /div>

My point is parental control is= not restricted=C2=A0to Apple devices and your proposal of device profile i= s not solving the problem for home network deployments.

-Tiru
=C2=A0

= thanks,
Rob
=C2=A0
--000000000000ecca4a05aba101b6-- From nobody Wed Jul 29 21:23:30 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 662D83A0CE0 for ; Wed, 29 Jul 2020 21:23:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JlFQTIwVyZTJ for ; Wed, 29 Jul 2020 21:23:25 -0700 (PDT) Received: from mail-io1-xd29.google.com (mail-io1-xd29.google.com [IPv6:2607:f8b0:4864:20::d29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A1D463A0CDA for ; Wed, 29 Jul 2020 21:23:25 -0700 (PDT) Received: by mail-io1-xd29.google.com with SMTP id q75so18765344iod.1 for ; Wed, 29 Jul 2020 21:23:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=fNSYEMt9eOqDPMZfeZ34yGCH30h7AtEsu4eL3LtUrJ4=; b=Bav3xZEFGVVtg+p0mJKhdGyeD43MtD7lF22eq3BtAv+j0joHL4q3GLAMAdmWnnRlpB nIZLUXn/KBiZDI+fjsYGS0t3EiQMRYeMYPCz3Yu+AmMHBF7THR4vDouLQc3a8HuCF9JY 25HjWja03IuOooHHcOJFOnPvfA5QUq/REfHZ0GNlG2N7YGQ0sO/Jg8g2N9kZPHDiAPn7 wUUCSwe3wIayYcPLZCBil8zFDcj4jh6vQ5A6UD6UqsYCOT7G6fHW/Ii/OPPleATfDebb hJFm3v7KpaF1XgXanfuEzKWisQPaZZ86ArdCiIFOaVgx4HIj2neeUSllcRs7vxcFpw29 oIRA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=fNSYEMt9eOqDPMZfeZ34yGCH30h7AtEsu4eL3LtUrJ4=; b=CROabhdoD+R1k8/TV6+UxoTZP76X6OCd9jeP6pN1m/V/gzYOrQAhSHK00vJj9iseed 4FnxWSAhpE3biTC945lTMuzcuv8aLwVSITBWPrToUAaHdHy5HxglD5cEJ+yobAde9sVn tY0ZM8uM37BHLL3dmXz+SZQMXlw8UuE/ZuQ+ALCzf1TtGuyhtGmnHi3K958ouImLvlSi 2RCtNnKfxE72Jp/SsWTClH8L3W4VlhRw98T8HOWMqKGS151uNbGk8rwptSdvclUMHWh0 duibKjQF1Sbm0y4zvB8RISH1B0pzEaufJEynionhQ58Rd2wDAUPY7BLaV4g92qAFILdD SduQ== X-Gm-Message-State: AOAM530jni12I/KqFOOHdp1v79JWJY6/hb0hHcvbN9u+d+oNVjsR3KoU dNjJnif5VHOA5oWN0/Rc9FsIuWaBHD2c2StRFSDBiIzQO3U= X-Google-Smtp-Source: ABdhPJzYYCpaUVXSXcqqdaH2AbUPzNzKsHiXmVe7QJcQ98u4zMUe+kM+biryXWiVjY2BOs5Y+Vt0qaZK/KieiAKUpVs= X-Received: by 2002:a02:108a:: with SMTP id 132mr1486109jay.131.1596083004857; Wed, 29 Jul 2020 21:23:24 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> In-Reply-To: From: Rob Sayre Date: Wed, 29 Jul 2020 21:23:12 -0700 Message-ID: To: tirumal reddy Cc: Ted Lemon , "Chris Box (BT)" , Andrew Campling , ADD Mailing list , Tommy Jensen Content-Type: multipart/alternative; boundary="0000000000008962cb05aba10833" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 04:23:28 -0000 --0000000000008962cb05aba10833 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 29, 2020 at 9:21 PM tirumal reddy wrote: > On Thu, 30 Jul 2020 at 04:09, Rob Sayre wrote: > >> On Wed, Jul 29, 2020 at 8:52 PM tirumal reddy wrote: >> >>> >>> How do you propose on-board various types of endpoints (including smart >>> TV, chromebook, xbox etc) with device profiles in home networks ? >>> >> >> Don't care. These are not high-security networks. >> > > My point is parental control is not restricted to Apple devices and your > proposal of device profile is not solving the problem for home network > deployments. > Other vendors have similar features, and the IETF is not here to design a landscape for any product. But feel free to carry on. :) thanks, Rob --0000000000008962cb05aba10833 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 29, 2020 at 9:21 PM tirumal r= eddy <kondtir@gmail.com> wro= te:
On Thu, 30 Jul 2020 at 04:= 09, Rob Sayre <say= rer@gmail.com> wrote:
O= n Wed, Jul 29, 2020 at 8:52 PM tirumal reddy <kondtir@gmail.com> wrote:

H= ow do you propose on-board various=C2=A0types of endpoints (including smart= TV, chromebook, xbox etc) with device profiles in home networks=C2=A0 ?

Don't care. These are n= ot high-security networks.

My point is parental control is not restricted=C2=A0to Apple devices and = your proposal of device profile is not solving the problem for home network= deployments.

Other vendo= rs have similar features, and the IETF is not here to design a landscape fo= r any product. But feel free to carry on. :)

thank= s,
Rob
=C2=A0
--0000000000008962cb05aba10833-- From nobody Wed Jul 29 21:55:30 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B6723A0D29 for ; Wed, 29 Jul 2020 21:55:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0A3YR2YkPSb0 for ; Wed, 29 Jul 2020 21:55:15 -0700 (PDT) Received: from mail-il1-x12c.google.com (mail-il1-x12c.google.com [IPv6:2607:f8b0:4864:20::12c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2CD13A0D23 for ; Wed, 29 Jul 2020 21:55:14 -0700 (PDT) Received: by mail-il1-x12c.google.com with SMTP id l17so11205915ilq.13 for ; Wed, 29 Jul 2020 21:55:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=kK7Fsp2ofRMXGDcReBy+rBseYEYEkZ9m5u/BJ+AtEPg=; b=TLqLSxWKVylo09P11ls23g43fEQ7NNCAdZFwAjhkLg/JciAF6hy1WMSBbXhvqBEJCZ KWO5cT2LTBbhl2+myCIgrt990dwVH60zqfKI5pYjNkn/qeObAxAPBm5p6Pig32nda+Dl 1R3lwO4dU9JWjBdkFRt/ur2LKe+QOZelO1RNynwwQD8ZoxcTGCa97qG05HzDdVRDjh6q KjUA7uwYObrKUSSM62ZCshEoDO2oqhTHK/KWGXWnLMrcNJYqIgVzcWtmbcZMdQneLObk KgG1rosxHjy7iRxkSDWdVSzrCNfLXwTpq0r12RAaFjxOultcryebsMiVHjhf5mW8uffK 92WA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=kK7Fsp2ofRMXGDcReBy+rBseYEYEkZ9m5u/BJ+AtEPg=; b=YZhG3kSgqy2Wt86w8G7WzOiOBCSye0fo9wF6s3kPRoT+QC63v5jmYtwQda0cWgOsXR J74g+5pqQqfXXBnc6w7jsAjUGnHbb7V2HBSxCuS3oBDaQHNLx8EDVsmR7OPdDVMzwU7m 1II1BmZ8ibXrd5nLa6ulE5hrUNwwGK+NYh+lUUYCZCkhA36OOTzg/6UPbXhq4GxPWBD5 AOen++LFSEQ/PDJ6sdhomU28+3sgRiIBZ6HWSl+YebIcA076DquoNAhzG5HCwfCc4osQ pF8Hw7a7EO+AT7XbNyPwUNSvOVIzPIJpVNG54by+tswie8F+ic7IlcyPkdF1E44b2/zi lEeQ== X-Gm-Message-State: AOAM532jeJ0VoAIt7RwBVTM/2SD1C4FPfH6EokvlHsKC4qioteOmFerX xKeNCOFpqSlG57j8Zowtiwkf1SvYW6Uscfcx7mk= X-Google-Smtp-Source: ABdhPJxgBtcBS5JEI9BYt8lH14RhS40bCmWl/URYAZtPsVUrWnwYUkoy2IWTfsf+giCqQOc9ybj2SNoTgxPhbC9eric= X-Received: by 2002:a92:60d:: with SMTP id x13mr623843ilg.214.1596084914074; Wed, 29 Jul 2020 21:55:14 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> In-Reply-To: From: tirumal reddy Date: Thu, 30 Jul 2020 04:55:02 +0000 Message-ID: To: Rob Sayre Cc: Ted Lemon , "Chris Box (BT)" , Andrew Campling , ADD Mailing list , Tommy Jensen Content-Type: multipart/alternative; boundary="00000000000055b7cd05aba17ac5" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 04:55:27 -0000 --00000000000055b7cd05aba17ac5 Content-Type: text/plain; charset="UTF-8" On Thu, 30 Jul 2020 at 04:23, Rob Sayre wrote: > On Wed, Jul 29, 2020 at 9:21 PM tirumal reddy wrote: > >> On Thu, 30 Jul 2020 at 04:09, Rob Sayre wrote: >> >>> On Wed, Jul 29, 2020 at 8:52 PM tirumal reddy wrote: >>> >>>> >>>> How do you propose on-board various types of endpoints (including smart >>>> TV, chromebook, xbox etc) with device profiles in home networks ? >>>> >>> >>> Don't care. These are not high-security networks. >>> >> >> My point is parental control is not restricted to Apple devices and your >> proposal of device profile is not solving the problem for home network >> deployments. >> > > Other vendors have similar features, and the IETF is not here to design a > landscape for any product. But feel free to carry on. :) > I don't get your reply. You may want to look into https://tools.ietf.org/html/draft-grover-add-policy-detection-00 to understand the reasons for introducing canary domain as a stop-gap mechanism. Cheers, -Tiru > > thanks, > Rob > > --00000000000055b7cd05aba17ac5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, 30 Jul 2020 at 04:23, Rob Sayre &= lt;sayrer@gmail.com> wrote:
=
On Thu, 30 Jul 2020 at 04:09, Rob Sayre <sayrer@gmail.com> wrote:
=
On Wed, Jul 29, 2020 at 8:52 PM t= irumal reddy <kon= dtir@gmail.com> wrote:
=
How do you propose on-board vario= us=C2=A0types of endpoints (including smart TV, chromebook, xbox etc) with = device profiles in home networks=C2=A0 ?

Don't care. These are not high-security networks.
=

My point is parental control i= s not restricted=C2=A0to Apple devices and your proposal of device profile = is not solving the problem for home network deployments.
<= /blockquote>

Other vendors have similar features, and th= e IETF is not here to design a landscape for any product. But feel free to = carry on. :)

I don't = get your reply. You may want to look into=C2=A0https://= tools.ietf.org/html/draft-grover-add-policy-detection-00=C2=A0to unders= tand the reasons for introducing canary domain as a stop-gap mechanism.

Cheers,
-Tiru
=C2=A0

thanks,
Rob
=C2=A0
--00000000000055b7cd05aba17ac5-- From nobody Wed Jul 29 23:01:01 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 413DB3A0E49 for ; Wed, 29 Jul 2020 23:00:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rI9RM7XmEq4i for ; Wed, 29 Jul 2020 23:00:46 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A1E4E3A0E3E for ; Wed, 29 Jul 2020 23:00:46 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id l1so27050810ioh.5 for ; Wed, 29 Jul 2020 23:00:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=p/J1TpEuoW6388xT7JoSjhdl1n70hjrwv83XIUa5Sz0=; b=GDi8k2VJD0GTuzEsEyg4OeabzGfOq3WpYbyoZj3ewlDJ14ZobcDWOpF3LFjUGu17PT t/A1wdR8/z7sML4eGdcYioEtgswzADtNsRSYypVRAxNgNFZcVXrmruQrTrz7RSMXoqLL dNmNal10D262D1Bj+RmLROrD2Yp3N+9NL3LFZTWq/SSAuNmi0F5vIZE24+DnPvdVo91G 0w8Vf+ShFtkJxmEcoXJvZnWOOuBH0U/ZscgrAOQpKpeF3N5dupyh1g0dovgPCIiYLZRX TNwXxHEW6QT8OQjIwzE7XHJz9tTPPhQsXxCxn4f2Hm9Fa7Kn2hns9Em6OKwihLPPZpW2 zbvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=p/J1TpEuoW6388xT7JoSjhdl1n70hjrwv83XIUa5Sz0=; b=nDD2eT2f5IagjKnZ/M5gzrkFOsik7dODH5Y3MwlOZnmtKSVPV2+DGSShYPTqjOzQoL zx5g2yLofZw6RBlttuJRDddKKHNyDRWby/f3cr2i9EJrhl9bWY/a3iTV+Yu1NYZVXw5t 1Y2NpzSY8H+RbXBA3ejCqUhpW+7+qkucRYXJ7li7Y2NSXHnBgddaWGV9UIvMG3jVGN7g dbkHgBmAugFNehUj5dzR+21EMKdNxIWuIpj+E/B9Ff9Qm4yAnvoXdFn6RifS1gL+B7Vt RNEhDmnJyKnAEc+WYOCaYm9RzlheIe24Ja4dCy/1q20lSj28JxaerlqiTN4nNs4ug8F/ N0ZA== X-Gm-Message-State: AOAM531X0zawZxnOFZWQ5V2sKObB8VoH0H4p3Zyqr/slGVMXley3jY4M +lZgZwhHT+hhRBjVDuWYjrDFLrtq0cYLN9YqUZM= X-Google-Smtp-Source: ABdhPJzWgqk1Wh5Wm439LlTNhxb+E/ObdPWrCHcQuyLoZ9nrv3aMBnYpxzIJOqplQTBS+ri3CmjV1XgIKn4w5JyLmgs= X-Received: by 2002:a05:6602:482:: with SMTP id y2mr7790233iov.188.1596088845701; Wed, 29 Jul 2020 23:00:45 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> In-Reply-To: From: Rob Sayre Date: Wed, 29 Jul 2020 23:00:32 -0700 Message-ID: To: tirumal reddy Cc: Ted Lemon , "Chris Box (BT)" , Andrew Campling , ADD Mailing list , Tommy Jensen Content-Type: multipart/alternative; boundary="000000000000ad958c05aba26417" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 06:00:55 -0000 --000000000000ad958c05aba26417 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 29, 2020 at 9:55 PM tirumal reddy wrote: > > I don't get your reply. > I agree that you don't get it. thanks, Rob --000000000000ad958c05aba26417 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 29, 2020 at 9:55 PM tirumal r= eddy <kondtir@gmail.com> wro= te:

I don't get your reply.
<= div>
I agree that you don't get it.

<= div>thanks,
Rob
=C2=A0
--000000000000ad958c05aba26417-- From nobody Wed Jul 29 23:02:38 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8389A3A0E51 for ; Wed, 29 Jul 2020 23:01:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1dn-4LSRJjEi for ; Wed, 29 Jul 2020 23:00:55 -0700 (PDT) Received: from mail-qv1-xf36.google.com (mail-qv1-xf36.google.com [IPv6:2607:f8b0:4864:20::f36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CD72F3A0E4C for ; Wed, 29 Jul 2020 23:00:54 -0700 (PDT) Received: by mail-qv1-xf36.google.com with SMTP id a19so6017338qvy.3 for ; Wed, 29 Jul 2020 23:00:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=r6tgNh+K5tBHx4ALkWtOGMQYzPpmp9pMwIT3gIJMYLQ=; b=phZUpT9Pzzbeqnfm+Wh2QViaqEh0tW2z6b0fN4j5RCMVWH41g1SwKSHMGVStkPioz6 6Zd8C/jl6k+e1vvfUBcZzGtOLB+C6PSzjQn5EyAvDIclSkLC9whVfqUNhqhqsMAWv4VZ pYETa4U3l9LeqRi+zbiVADFBvPIIA1AnrZZuxm2V4BPH1S2bVztO5DT7/ON1LeJDkXh3 Ks75hvtaNWUAt0SAy0Fd1NmDpvLrKY0vNlgNLM030+dtXrdDyFLTr65raD409q7Y7BKr LGd3zXyE8XLVNPOyoLG9ZwHfEOOLhPLImdQO6vnCfQGx8qgTrJy+j8vQXBoklLflQfxh au+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=r6tgNh+K5tBHx4ALkWtOGMQYzPpmp9pMwIT3gIJMYLQ=; b=jb1qrvUiLbr6ma+REN8R823Z3RvGFySB4/uVKSCXqHRmNR6JEX66WrS2fM1eLM5rTW t6FUX/o+ElE+QM3MlcU45K2IY2L6tjOLAjtSMMmvs9hBSgUupOIq3NbQvTO+cbpBOfsZ qWXn5dkj5XCcDtChXx8bekKfUBvoehsqEJoHAy+lgqp25RHsze/LD9fopTrGdPpQvSx0 XXzb4H0tMhRHSgzZQxg477G0OTZaJYANPKdX57zIVg0IEdJ3sQLsdTKLZjv64hGj8ad9 3+LbAnkoQlo+a8EywLPqn4W/n283joWEyEFlM2+WXpBr0CPawYEwaAQAUur2YoB2vjsn CD9g== X-Gm-Message-State: AOAM530gfRzWANQbxp1vNBMPh1Ae1UDaTkgLUsXBoUCOcmvg1iHMlZvR MdebcpfYN44hOvGASM89HC2oDxse6Ioggzxt7RQ= X-Google-Smtp-Source: ABdhPJylv1o38SS4uO1KvXOIQl4WVWgWgon6LVc1Bb8Z4Fcd5S6kjs/EVnufISFD+scFNd2nGGx1fhu2In7ze9t0g1A= X-Received: by 2002:ad4:46f4:: with SMTP id h20mr1394935qvw.85.1596088853703; Wed, 29 Jul 2020 23:00:53 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> In-Reply-To: From: "Chris Box (BT)" Date: Thu, 30 Jul 2020 07:00:42 +0100 Message-ID: To: tirumal reddy Cc: ADD Mailing list , Andrew Campling , Rob Sayre , Ted Lemon , Tommy Jensen Content-Type: multipart/alternative; boundary="00000000000027af3105aba26548" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 06:01:04 -0000 --00000000000027af3105aba26548 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Rob you appear to be saying you don=E2=80=99t need such features to secure = a home network, but I would certainly appreciate having Tiru=E2=80=99s (a) to (e) = deployed in my house. I don=E2=80=99t want the smart TV equipped with microphone and= webcam to be remotely compromised, nor any other device. Without such network-level control, enabled by standards, my only defence is to physically unplug the TV from the network when not in use. Following Eva=E2=80=99s talk in HRPC, I=E2=80=99ll put myself in the shoes = of a dissident in a hostile regime. In such a case I would feel even greater need for such security. Of course I would choose my security supplier carefully, and not one aligned to the regime. I then need one or two devices that route through Tor. I fully agree the challenge is to distinguish legitimate network signals from those of an attacker. Robustly identifying who they came from is non-trivial, but hopefully not impossible? Chris --00000000000027af3105aba26548 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Rob you appear to be saying you don=E2=80=99t need such f= eatures to secure a home network, but I would certainly appreciate having T= iru=E2=80=99s (a) to (e) deployed in my house. I don=E2=80=99t want the sma= rt TV equipped with microphone and webcam to be remotely compromised, nor a= ny other device. Without such network-level control, enabled by standards, = my only defence is to physically unplug the TV from the network when not in= use.=C2=A0

Following Ev= a=E2=80=99s talk in HRPC, I=E2=80=99ll put myself in the shoes of a disside= nt in a hostile regime. In such a case I would feel even greater need for s= uch security. Of course I would choose my security supplier carefully, and = not one aligned to the regime. I then need one or two devices that route th= rough Tor.=C2=A0

I fully= agree the challenge is to distinguish legitimate network signals from thos= e of an attacker. Robustly identifying who they came from is non-trivial, b= ut hopefully not impossible?

Chris



--00000000000027af3105aba26548-- From nobody Wed Jul 29 23:06:10 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB9243A0E4F for ; Wed, 29 Jul 2020 23:06:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CK9-zHBwauO0 for ; Wed, 29 Jul 2020 23:06:06 -0700 (PDT) Received: from mail-il1-x131.google.com (mail-il1-x131.google.com [IPv6:2607:f8b0:4864:20::131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EAB2F3A0E49 for ; Wed, 29 Jul 2020 23:06:05 -0700 (PDT) Received: by mail-il1-x131.google.com with SMTP id i138so15588004ild.9 for ; Wed, 29 Jul 2020 23:06:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Q/pd/AgOt/yVG1FGwJ8sK8uIf+OXh3ZcOrIegTW9538=; b=WfIT3H5b+qs6bziPdqCmMxyKkG0nKu27snIl/ER3MvRdwYqBVM5ts+jJHL/BP+uO02 NY/jegDhEhqdoWtSB9uMk9Ccrh+gFmgsLTzj1mtLpdBejgAkTb6OS08XH/31n+uraW4M 75+Avr9SpqTwdEsjObC/GD7lq+XJpnHhEWabscUtV0/UTQ3allQlB21LkGgFr+zT6yKO CCE3Yb2AIVhgHRRecDQ/21oZ1wcq+QYJNSMLtOESOPE/Z2Ck542WLxGI1lmZiHyZKcwy IMoCtaJT+nTX4/ZxaQQpMLjlwCMQ8w75yUrzFO9c6JMEjiaJnw7z4/nx3X+pLoTXtvIe R5WQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Q/pd/AgOt/yVG1FGwJ8sK8uIf+OXh3ZcOrIegTW9538=; b=NLlqfitUTb0RmGcNXduOxP9OezU6Zd2mGKptD21HrLCIceXxTjIx18IS8FIbc5slyo zcwKPCJMOmA9puJnWV9fyriE6qS8B7KawZPUGb7zjPegFD7lpRdn0w0XxGzxW7mE/G+M 5NbH+sWnTHKyMTvmLYQn6nA53ixMyoA5EUxObZynTtWbO5cDFnPO+jDdgpavndJ+lqza 0rXGw8GS6YtX3WLJKpN9GVR/NAufXiBmkU9sRxo0P7Lo43xCEj4uFQgAzMm5b3jNo2M0 HnH+hk8xS+GlxJKMK21+k6Op9VBVv4YWx9m/f9WAy6yASNJ0zoV+ephJJRM40YJMj8X0 8FCQ== X-Gm-Message-State: AOAM533lV+Fp7bIDE64o91maaHfwxjJBnCKjjzZtY7taspotkO5qNYH/ EmktayyB8mshFxfMU7/Hrmifx0UVAdnM3T2pzi0= X-Google-Smtp-Source: ABdhPJx6sBjtmdvaHnZMjIxK73TQvyVo9zdEq1UfQToq9trftn8CNBsyWNJNSvcew+SO5Ns1jmzeaNIzhZo/Fdr3+OI= X-Received: by 2002:a05:6e02:8b4:: with SMTP id a20mr31279891ilt.254.1596089165282; Wed, 29 Jul 2020 23:06:05 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> In-Reply-To: From: Rob Sayre Date: Wed, 29 Jul 2020 23:05:51 -0700 Message-ID: To: "Chris Box (BT)" Cc: tirumal reddy , ADD Mailing list , Andrew Campling , Ted Lemon , Tommy Jensen Content-Type: multipart/alternative; boundary="000000000000ba028d05aba27737" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 06:06:08 -0000 --000000000000ba028d05aba27737 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 29, 2020 at 11:00 PM Chris Box (BT) wrote: > I fully agree the challenge is to distinguish legitimate network signals > from those of an attacker. Robustly identifying who they came from is > non-trivial, but hopefully not impossible > I wish you well :) thanks, Rob --000000000000ba028d05aba27737 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 29, 2020 at 11:00 PM Chris Bo= x (BT) <chris.box.ietf@gmail= .com> wrote:
I fully agree the challe= nge is to distinguish legitimate network signals from those of an attacker.= Robustly identifying who they came from is non-trivial, but hopefully not = impossible

I wish you well :)

thanks,
Rob
=C2=A0
--000000000000ba028d05aba27737-- From nobody Wed Jul 29 23:31:37 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B34D93A0E91 for ; Wed, 29 Jul 2020 23:31:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BG9H-tFoYT9g for ; Wed, 29 Jul 2020 23:31:32 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110066.outbound.protection.outlook.com [40.107.11.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2CB8C3A0E8F for ; Wed, 29 Jul 2020 23:31:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=mpQzQQ09D/edxjJJ/8QxEHle1vNLlF45O32/9gi287fCVGbDa1/+NxSMy0//xQ97h3YW3a3Fcw7Pj46SKKSLCnKs8tlNkkAi4AK3fPvmK99RPzZc7YoYWYGG31duNW2KOEaQHUY7ynRI8WcmCTpmQlzc4W1qTzav6CWOzjoAn49c8qKkA5gt/ko/R/0Q7ly/Z5zxfPegccj1/pQYm0vAy4kwifacHAOFGAZPcOUpqvhB2EnTdCbUpId5m2ImmXEVrBcN1rDz7BFwL+gmo4sYpSAsDRuj/n+RVRgLFqGh/MhV6946mnnxVKw1pA+m32uJf2J6gCeoSmVjDxhCh/NolA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1UtuzTxx+hLbt6RItfI38dphsy9/0uloBMnWJxWg70g=; b=obgbmxjPIlhhQc5nBsjhxiH72Y5/tReyc07LWylz3h1rzyKkzoIbYSGsXFaeRwFD/z8wUHUJ2/91pFrY7uWs9+rMOoQt18gIG6T2sAfJMq6Lv6yy7tnUUaOqkf+jCno7hOsSrAPJQNQMCq5+sR39bslGxRymmJYUk6flUIRPxcZDmaZfUF9jmWPx3Hx3HMFP1jG28yBYUk7n4sSQSPriPgQ+G3XJdyiZ3uacBEEUzr4j4BVD/Vinbr1pTlfxctO5964GHAF2YxJSa/QYBKgpkKn0YTjIzo/l826bm45viy3mdsz4doCy4mtE9WyCKom/22eZx7KN9X5xC20bVH2zXQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1UtuzTxx+hLbt6RItfI38dphsy9/0uloBMnWJxWg70g=; b=jgTcROrCB3tz5so7927iXE4wptR9fGAEqfXqSc6hr1edo0yjh48o6gr4KVEs5ZGzJeVQbXupDnLorkQsAO2ZBXbjYn0SZ0xAKe6nw1z+ALKqHpggX5SbKmrNve663Nis6ZqJjxdWiwy8iwwbsEuHET69RonpPtjUDhpv+DO2NLU= Received: from CWXSPR01MB06.GBRP265.PROD.OUTLOOK.COM (2603:10a6:400:2f::21) by CWXP265MB2551.GBRP265.PROD.OUTLOOK.COM (2603:10a6:400:9e::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3239.17; Thu, 30 Jul 2020 06:31:23 +0000 Received: from CWXSPR01MB06.GBRP265.PROD.OUTLOOK.COM ([fe80::a4de:e45d:c695:e061]) by CWXSPR01MB06.GBRP265.PROD.OUTLOOK.COM ([fe80::a4de:e45d:c695:e061%7]) with mapi id 15.20.3239.016; Thu, 30 Jul 2020 06:31:23 +0000 From: Andrew Campling To: Rob Sayre , tirumal reddy CC: Ted Lemon , "Chris Box (BT)" , ADD Mailing list , Tommy Jensen Thread-Topic: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWZbzAFhCIoK811kGZn5p8lxrWiKketOWQgAAQYYCAAA7/AIAAM7oAgAAMGQCAAAKjAIAAAYUAgABl7ACAAAS+AIAAJsUA Date: Thu, 30 Jul 2020 06:31:23 +0000 Message-ID: References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=419.consulting; x-originating-ip: [86.136.81.12] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d121dd38-5192-4ed6-edf1-08d834522e0f x-ms-traffictypediagnostic: CWXP265MB2551: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:1443; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: vSrWPchO21xbOKa1UFB5Dq0DXFB8vOt7Z7iGeGdDYEalviyC6AucJIOwqSg7ABSOT6d/eMxUXlDqY+EDIB1Tb4Lw79R3vI1EVBsbKD3opHkY0musC6NBnt2M7f2lJwsAjyH17Meek9eu7wDqoZO6H5pLruoCZXZiCmzIT5DUdKsT/IdApVZTWNMINDYugHeLnQX/yCiqAF45IBjAF7ORz9oeowh16d+5t64vFHoAHkrNoyabBs9+TvSyOUZ02QkTcLU9sSlK3UUApkqpGNXQfn9PjudhHJJ5gdu91M7QbBpG9IP2oFwD/xcLGZSMEPgaWhFdG8tUczmPkxMBju1I6Wr5EzOgS/C5nnr4+zHRlGPyD3XZUFhOoYS9RK7ZaYi2 x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CWXSPR01MB06.GBRP265.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFTY:; SFS:(39830400003)(376002)(136003)(366004)(346002)(396003)(66556008)(64756008)(8936002)(66946007)(76116006)(55016002)(66476007)(26005)(66446008)(110136005)(9686003)(54906003)(44832011)(8676002)(83380400001)(53546011)(86362001)(6506007)(15650500001)(186003)(7696005)(2906002)(71200400001)(316002)(4744005)(5660300002)(52536014)(4326008)(33656002)(508600001)(46492007); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: hu9S2OBCiL6QgW/BFMR36ztLuAViyxDqBOqx8z096fUR1KI7NVvAPjf0CqqFfv7ZsQ9EtXQcPqPLo7gvEa6vYjOG4f2bfOQw2FQsnFUZ3H5+k8pP8x5E4yluQkBA2//lA8BjeNs2Qt8Tzr9AqP7AfhojfTJ4skWvHfM0AmWK2GDnexpItjIbzdYOkM7EM/Hr7xMOFTyDZGnrjmbaeOtWgsNXGTdg5nA+YP2p7JPVPiznubwKEpbxyZJs7qcsW+Sdkxaq883lb/bDNjsV96MUM6uIWJqBeBmYabsbkmZz1CgVXnA3Z8K5Yc+A89+ydln0PLfskQvEAhOXEpzeQuXR50/lKa1GoD+Azz4MTcc8p+HSPmbsn0UMZS1CrKinG6xGB+Uxw0BNrFpqIzd4ANIZ4Sm1JGL5g2aBTKgc+DSkvyASXp3rshka2M0QczMlqD8UOXYhRkTljVmYwhevaHXZunlxYTQ2+VnxhYln+dJA4WlblGsNPBD6iSVCOl7jMVpYwohJYGtUio0oaBXKvNL7zFLAE+oo9oVbXbIzmSCifANuoL/cARo/Ud7BTYzrYw+05xJS8356eB6NX/WVfr+r2/jw7HougRwWC6HhBjL6iMb5MeFuphVvfGvpWABSgf3JEad7xWWiCPTKMJxhkqv+/w== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CWXSPR01MB06BD5D80BF9616C709942DC2710CWXSPR01MB06GBRP26_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: CWXSPR01MB06.GBRP265.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: d121dd38-5192-4ed6-edf1-08d834522e0f X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jul 2020 06:31:23.6354 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: bZjeyCJV4fSp/EUqGOsDfJHtUpeZZQVQWzXuS6XTUjiKoLOoD7BrqDg7DGnSb6MB83HQTTfv0IU2hnqLHcXu+MhIT/iahtwK9nzevVOJfzI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWXP265MB2551 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 06:31:34 -0000 --_000_CWXSPR01MB06BD5D80BF9616C709942DC2710CWXSPR01MB06GBRP26_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T24gVGh1cnMsIEp1bCAzMCwgMjAyMCBhdCAwNTowOSBSb2IgU2F5cmUgPHNheXJlckBnbWFpbC5j b20+IHdyb3RlOg0KPg0KPj4gT24gV2VkLCBKdWwgMjksIDIwMjAgYXQgODo1MiBQTSB0aXJ1bWFs IHJlZGR5IDxrb25kdGlyQGdtYWlsLmNvbTxtYWlsdG86a29uZHRpckBnbWFpbC5jb20+PiB3cm90 ZToNCg0KSG93IGRvIHlvdSBwcm9wb3NlIG9uLWJvYXJkIHZhcmlvdXMgdHlwZXMgb2YgZW5kcG9p bnRzIChpbmNsdWRpbmcgc21hcnQgVFYsIGNocm9tZWJvb2ssIHhib3ggZXRjKSB3aXRoIGRldmlj ZSBwcm9maWxlcyBpbiBob21lIG5ldHdvcmtzICA/DQo+DQo+IERvbid0IGNhcmUuIFRoZXNlIGFy ZSBub3QgaGlnaC1zZWN1cml0eSBuZXR3b3Jrcy4NCg0KVGhleSBhcmUgbm90IG5vLXNlY3VyaXR5 IG5ldHdvcmtzIGVpdGhlciwgb3RoZXJ3aXNlIHdoeSBib3RoZXIsIGZvciBleGFtcGxlLCB3aXRo IGVuY3J5cHRlZCBETlM/DQoNCg0KQW5kcmV3DQoNCg0K --_000_CWXSPR01MB06BD5D80BF9616C709942DC2710CWXSPR01MB06GBRP26_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28t c3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgltc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUzt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7 c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBw dDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+ PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBz cGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4 bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIg ZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4N Cjxib2R5IGxhbmc9IkVOLUdCIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xh c3M9IldvcmRTZWN0aW9uMSI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9u IFRodXJzLCBKdWwgMzAsIDIwMjAgYXQgMDU6MDkgPHNwYW4gbGFuZz0iRU4tVVMiPlJvYiBTYXly ZSAmbHQ7c2F5cmVyQGdtYWlsLmNvbSZndDsNCjwvc3Bhbj53cm90ZTo8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mZ3Q7 PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jmd0OyZn dDsgT24gV2VkLCBKdWwgMjksIDIwMjAgYXQgODo1MiBQTSB0aXJ1bWFsIHJlZGR5ICZsdDs8YSBo cmVmPSJtYWlsdG86a29uZHRpckBnbWFpbC5jb20iPmtvbmR0aXJAZ21haWwuY29tPC9hPiZndDsg d3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBjbSAw Y20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowY20iPg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Ib3cgZG8geW91IHByb3Bvc2Ug b24tYm9hcmQgdmFyaW91cyZuYnNwO3R5cGVzIG9mIGVuZHBvaW50cyAoaW5jbHVkaW5nIHNtYXJ0 IFRWLCBjaHJvbWVib29rLCB4Ym94IGV0Yykgd2l0aCBkZXZpY2UgcHJvZmlsZXMgaW4gaG9tZSBu ZXR3b3JrcyZuYnNwOyA/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jmd0OyA8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZndDsgRG9uJ3QgY2Fy ZS4gVGhlc2UgYXJlIG5vdCBoaWdoLXNlY3VyaXR5IG5ldHdvcmtzLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGV5IGFyZSBub3Qgbm8tc2Vj dXJpdHkgbmV0d29ya3MgZWl0aGVyLCBvdGhlcndpc2Ugd2h5IGJvdGhlciwgZm9yIGV4YW1wbGUs IHdpdGggZW5jcnlwdGVkIEROUz8mbmJzcDsNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+PG86cD4mbmJzcDs8L286cD48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+PG86cD4mbmJzcDs8L286cD48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+ QW5kcmV3IDxvOnA+PC9vOnA+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_CWXSPR01MB06BD5D80BF9616C709942DC2710CWXSPR01MB06GBRP26_-- From nobody Wed Jul 29 23:45:24 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C1073A0EA8 for ; Wed, 29 Jul 2020 23:45:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DWTrlwJOsBWh for ; Wed, 29 Jul 2020 23:45:17 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100077.outbound.protection.outlook.com [40.107.10.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF2343A0EA6 for ; Wed, 29 Jul 2020 23:45:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=QE2cy4P2Gm2VzeUoaGTonfKFEig9/nXEpyl9JGC6SC5VG1RDJGv3qKdWdrMhsVkSW4VRYkNbPcdkKkNO4qefKxQsbcT+aDL4mG5iQ8iZUe+XVbWDXT3gXMQbPe+HbHkgU6ZL8EtUVm6eBxVUpsbb7XCjLoLvtX0HY2mw4paCTcEGpNHiD2ZJvBfPMiE9YGOQSc0qG24wJlRUUa84HbhHMmpwy/9iHfIgSdCoGnq4Dtrhe2sVgzRTze2qJVZDtZqySc3Sx/6Gi7ihTLUO1ijTn/E6iHACuyZ2+ikPLefTdiGTMEo4UgQSaCRcLpWrpJ5SpTgpxbomPmfuMrOeJtrqrQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ycSaYpovjgol365kxn/tIwTHCd/YL/SsjMy6sF5BlgU=; b=nQ96ZsGZgBJQDOuHsjIoxfw/KbLd6XplSYxUV1T2nhZ0NpC486DM3BNx7ewtPeKN2h9kfhS0Bvqo4kcyo5FPVmOWWfy3mifwq12mchx0G2FCWtJxVeUnhOSXai2+B8Eh32AAiZhyRYwm6z7sUtiD8bfxl1BZDqKbarT+dowSQj8MDjU57h0WpmtMch3HpePpS2H2W6hMQs68/xbKTyu5xOdhdY973PI/QssMwvNoIuMojYy5/Pd2ld+ehAm2kXOx20+yBSu+Mc24eqAVvoGE69HSHHJ4zhjmL1JeynP545FJ9vxGnaCCSVePM+6JFNre7EV85HIqlTA5GMFwLI7CXQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ycSaYpovjgol365kxn/tIwTHCd/YL/SsjMy6sF5BlgU=; b=jQHBx00v3s/mhsgWbgUuOMeWc6SYKL2gQO/dwMGZzFCmcrAgQQ5TiaVQH1buqr7IzvVScmGukXUzN5PvPmv+ynA+w7OLgkd/uS0xcb/urjVOFDZLB+wceNTF6PHTNCClwcX7SQxPKW9gUL+LKskSP5WHIjHhZfUXwWkHAkigNU8= Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:71::15) by LO3P265MB2089.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:101::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3239.16; Thu, 30 Jul 2020 06:45:14 +0000 Received: from LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6]) by LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM ([fe80::dd:2104:c700:9ad6%6]) with mapi id 15.20.3239.019; Thu, 30 Jul 2020 06:45:14 +0000 From: Andrew Campling To: Tommy Jensen , "Chris Box (BT)" CC: ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWZbzAFhCIoK811kGZn5p8lxrWiKketOWQgAAQYYCAAA7/AIAAC6+AgADLGoA= Date: Thu, 30 Jul 2020 06:45:14 +0000 Message-ID: References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> , In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-29T18:26:03.216Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; authentication-results: microsoft.com; dkim=none (message not signed) header.d=none;microsoft.com; dmarc=none action=none header.from=419.consulting; x-originating-ip: [86.136.81.12] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 962c2b7e-616f-4729-8c10-08d834541d03 x-ms-traffictypediagnostic: LO3P265MB2089: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: aotZQ5h++9udpc+sQoKUas8lpTtM/ghbsj5qWfsrJciGI8M1sD7cCWyZctg5DPkqjEg7aYt+VBvkEpQj82KHRZownQuK5OFPgZQiqpVy5mC59qqS2jYXH5RRhpjdMRuJRJVxxYYsgjqJv3v4n9ajDaKOZyPRkKn6PF71SRIzLpvxEwEAOGQlXy0jGipbENIzOCGWCxBawrTooK6RjZNkaiBjTlG9KmLPoYAimZFjgJDC08hIN//IJctjP91xAEZJKEX+JgZnGcyeEjFO6s8eae+sqaRUmD9rZ5smmMyYZBYoPW+s956TRsgbGnCbC04Q7Hwm53jtjQuPO+uqCGfOxa/iWtFnaKZ9FhzRXFAt8A2uRagZaCVLxMBek9WMZFWxSyOpVEnYIwyvC1fFj0vkGhJ+Rklc6AhJvQUJ/l8h/F9g30Lpk+U1RvU/CUHlMcqMk/0bbz1jQmg5cdZiAQKUgQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFTY:; SFS:(346002)(366004)(39830400003)(396003)(376002)(136003)(83380400001)(71200400001)(33656002)(53546011)(6506007)(66446008)(186003)(66556008)(26005)(76116006)(66946007)(64756008)(66476007)(5660300002)(52536014)(166002)(316002)(110136005)(44832011)(66574015)(7696005)(15650500001)(2906002)(4326008)(55016002)(8676002)(9686003)(86362001)(45080400002)(508600001)(8936002)(966005)(46492007); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: WUJ1eeD7rP8QgPnGGxGIh2+Hw8jmtUZqfYIS1SErkPcIcGOOEgU9/durlE7inf90FptHNp+EQZ6hTFzz55A/FjGPpg/bDXDQ1r+JrUIPZsHmgBJthyhOTp6b2r65v9uhcorqvIYMTkDBEbHuan5d3yHp6yFq0iIhXX2o4fBem7i+a+ir7O3BhjhZRPYwIF8tLCDBqczwON0Q5HC74uM5ngWmOmslNovJ3l5Fzm85Pg0AeAWCzyk0UUVyzYTtugALPaGsJsWrNyrN7YhuQqbf5UbWSbC7pKPYV7y9qGDBjn+SyPNcVKACGmKzWgqAPuxQX5vxua+mKDJ6SgXX2hn8yZxT6aGwcu7ICN9rbFxJoifp6DU5fpT4jXmEwho9mFfhL2+kLQx6EQsS3WChTJiv6DE7+IO0XYQISeQfbN0O9Nea120wdCUdM52VUl5Ou9ew1LDxo/fZbzt7xWscUKHYuZUD9IaP82Rsu3Z0HFtP9gdmODC0qsikdTMHkexTQ7UNMXQS3Cosk4pGxHv5gEGPUlNbWcFCWbXY/WgfDS/Z6FAxV+tPb0mqSMlxq3Cuu6CFdZFzmj1EyUx1VQr4CiA2HN0eqvs2sUlhjOq83+U4GWFwzkcc0goe0AHbatKmYV0VYq1BnJE05fbSklgs7kRclg== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_LO2P265MB05735D1EB07118B94B1625C2C2710LO2P265MB0573GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: LO2P265MB0573.GBRP265.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 962c2b7e-616f-4729-8c10-08d834541d03 X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jul 2020 06:45:14.0964 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Nt7aQxmAHVZtsYMRnJnboANsu0YYrqMDHbpsWMU7eQoT/9KCdv3aksc2f8s8JLyrZ5MrNDEl+TwcIhMM1pm4zeK+s+GlFTy4GCrFPFU+EdM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO3P265MB2089 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 06:45:21 -0000 --_000_LO2P265MB05735D1EB07118B94B1625C2C2710LO2P265MB0573GBRP_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Tommy Picking up the thread and also answering your earlier question about GDPR (= noting that I am also not a lawyer!), I think that it would be highly probl= ematic to have adaptive DNS on by default. To expand, a user has expressed= a preference for a DNS service, either through the acceptance of the ISP's= service in signing their contract or by subsequently, Google or Cloudflare= or Quad9 etc deliberately. Adaptive DNS *appears* (I may have misundersto= od) to make on-the-fly decisions about the DNS resolver based on recommenda= tions received, which in turn appears to be at odds with the choice made by= the user if it is on by default. This could of course be dealt with by gaining user consent first, however i= t does seem that personal data is being shared and processed widely without= any indication of the privacy policies in operation by the recipients. (I= could of course suggest a suitable, GDPR-compliant privacy policy but that= 's off-topic for this group. :-) ) Andrew From: Tommy Jensen Sent: 29 July 2020 19:26 To: Chris Box (BT) Cc: Andrew Campling ; ADD Mailing list Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-= add-resolver-discovery-01.txt Hey Chris, Thanks for the scenario. Allow me to try and address it using our draft. For the parental control scenario, there are two scenarios I can think of. = One is the ISP is recommending a DNS server to network members with a publi= c address. By deploying DoH in accordance with the draft to that server, th= e situation self resolves. The client will follow section 5, make a DoH con= nection to the server, then the server can proceed how it sees fit. This ma= y include DNS manipulation to serve an interest such as parental controls, = including filtering SVCB record to prevent Adaptive DNS from discovering ne= w DoH designations that would take it away from the parental filtering serv= er. The other scenario is the ISP recommends an RFC1918 address, which the draf= t doesn't directly address. This is a situation where the standard shouldn'= t be confused with an implementation. Section 7 calls out that a client can= use its own discretion and policy when falling back to classic DNS though = the example context is different. Where Adaptive DNS is intended to be a st= rong privacy offering, it makes sense some users (in this case, admins who = are parents) may use device configuration to choose between privacy and con= tent filtering functionality. The same SVCB record manipulation possibilit= y exists. With this context, my view on your parental filtering concern is really a r= equest to not have Adaptive DNS be on by default, which is an implementatio= n policy concern and not a standards detail. For example, TLS 1.3 being the= minimum version required everywhere would immediately break many sites, an= d requiring DNSSEC validation at the client would break many sites. That do= esn't make either of these standards bad ideas, just that there are context= s implementors of each need to be aware of when rolling out bits. To be clear, I don't like the idea of the network attacking the SVCB record= s. However, it is possible and isn't a regression from today where DNS pack= ets are attacked to provide redirection to "censored" pages. A user seeing = this who isn't ok with the filtering can take manual action to bootstrap wi= th a trusted DoH server. A user who is ok will happily continue as they did= before Adaptive rollad out. In your scenario, the "user" is ok with it and= would experience no regressions unless they take action to configure a DoH= server other than yours, which would be a user signal that they actually d= on't want filtering. Thoughts? Thanks, Tommy Jensen =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The latest in Windows Internet Protocols: Native gRPC support: https://aka.ms/grpcblogpost DNS over HTTPS: https://aka.ms/dohblogpost ________________________________ From: Chris Box (BT) > Sent: Wednesday, July 29, 2020 10:44 AM To: Tommy Jensen > Cc: Andrew Campling >; ADD Mailing list > Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-= add-resolver-discovery-01.txt On Wed, 29 Jul 2020 at 17:50, Tommy Jensen > wrote: Can you be specific about any standard proposal which _precludes_ an implem= entation from offerings user/admin/enterprise/etc. choice and control or re= gresses control from what they have today? I don't think there's a single d= raft that's trying to decide a conflict of interest "between the interests = of end users of the Internet and other parties" in favor of the latter inst= ead of the former. If I'm wrong, please help me understand which drafts are= n't favoring end users interests and how they aren't. Surely Adaptive DNS's concept of learning the designated resolver for a dom= ain will, by default, regress parent control of child devices, particularly= in the widely deployed scenario where the parent asks the network provider= to do this job. This is true unless there is also (a) a standardised way f= or the network to inform the device of policy, and (b) common client implem= entations honor this. I used the parent example as this is mentioned in IAB-for-the-users, but co= uld equally apply to the area of trying to stop your IoT devices from doing= things they shouldn't. This could well be a timing issue. To avoid serious regressions I think we = need a coherent set of drafts that support all possible use cases before go= ing to mainstream deployment. Deploying domain designation by itself, or ma= ny other single drafts, will inevitably break some things. --_000_LO2P265MB05735D1EB07118B94B1625C2C2710LO2P265MB0573GBRP_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Tommy

Picking up the thread and also answering your earlier question abou= t GDPR (noting that I am also not a lawyer!), I think that it would be high= ly problematic to have adaptive DNS on by default.  To expand, a user has expressed a preference for a DN= S service, either through the acceptance of the ISP’s service in sign= ing their contract or by subsequently, Google or Cloudflare or Quad9 etc de= liberately.  Adaptive DNS *appears* (I may have misunderstood) to make on-the-fly decisions about the DNS reso= lver based on recommendations received, which in turn appears to be at odds= with the choice made by the user if it is on by default.   =

 

This could of course be dealt with by gaining user consent first, h= owever it does seem that personal data is being shared and processed widely= without any indication of the privacy policies in operation by the recipients.  (I could of course suggest = a suitable, GDPR-compliant privacy policy but that’s off-topic for th= is group. :-) )

 

Andrew

 

From: Tommy Jensen <Jensen.Thomas@microsoft.com>
Sent: 29 July 2020 19:26
To: Chris Box (BT) <chris.box.ietf@gmail.com>
Cc: Andrew Campling <andrew.campling@419.consulting>; ADD Mail= ing list <add@ietf.org>
Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft= -pauly-add-resolver-discovery-01.txt

 

Hey Chris,

 

Thanks for the scenario. Allow me to try and address it= using our draft.

 

For the parental control scenario, there are two scenar= ios I can think of. One is the ISP is recommending a DNS server to network = members with a public address. By deploying DoH in accordance with the draft to that server, the situation self resolv= es. The client will follow section 5, make a DoH connection to the server, = then the server can proceed how it sees fit. This may include DNS manipulat= ion to serve an interest such as parental controls, including filtering SVCB record to prevent Adaptive DNS= from discovering new DoH designations that would take it away from the par= ental filtering server.

 

The other scenario is the ISP recommends an RFC1918 add= ress, which the draft doesn't directly address. This is a situation where t= he standard shouldn't be confused with an implementation. Section 7 calls out that a client can use its own discr= etion and policy when falling back to classic DNS though the example contex= t is different. Where Adaptive DNS is intended to be a strong privacy offer= ing, it makes sense some users (in this case, admins who are parents) may use device configuration to choose = between privacy and content filtering functionality.  The same SVCB re= cord manipulation possibility exists.

 

With this context, my view on your parental filtering c= oncern is really a request to not have Adaptive DNS be on by default, which= is an implementation policy concern and not a standards detail. For example, TLS 1.3 being the minimum version req= uired everywhere would immediately break many sites, and requiring DNSSEC v= alidation at the client would break many sites. That doesn't make either of= these standards bad ideas, just that there are contexts implementors of each need to be aware of when roll= ing out bits.

 

To be clear, I don't like the idea of the network attac= king the SVCB records. However, it is possible and isn't a regression from = today where DNS packets are attacked to provide redirection to "censored" pages. A user seeing this who = isn't ok with the filtering can take manual action to bootstrap with a trus= ted DoH server. A user who is ok will happily continue as they did before A= daptive rollad out. In your scenario, the "user" is ok with it and would experience no regressions unless = they take action to configure a DoH server other than yours, which would be= a user signal that they actually don't want filtering.

 

Thoughts?

&n= bsp;

Thanks,=

Tommy J= ensen

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D

The latest in Windows Internet Protocols:

  Native gRPC support: https://aka.ms/grpcbl= ogpost 

  DNS over HTTPS: https://aka.ms/dohblogpost 

&n= bsp;

From: Chris Box (BT) <chris.box.ietf@gmail.com>
Sent: Wednesday, July 29, 2020 10:44 AM
To: Tommy Jensen <= Jensen.Thomas@microsoft.com>
Cc: Andrew Campling <andrew.campling@419.consulting>; ADD Mailing list <add@ietf.org>
Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft= -pauly-add-resolver-discovery-01.txt

 

 

On Wed, 29 Jul 2020 at 17:50, Tommy Jensen <Jense= n.Thomas=3D40microsoft.co= m@dmarc.ietf..org> wrote:

Can you be specific about any standard proposal which _= precludes_ an implementation from offerings user/admin/enterprise/etc. choi= ce and control or regresses control from what they have today? I don't think there's a single draft that's trying t= o decide a conflict of interest "between the interests of end users of= the Internet and other parties" in favor of the latter instead of the= former. If I'm wrong, please help me understand which drafts aren't favoring end users interests and how they aren't.=

 

 

Surely Adaptive DNS's concept of learning the design= ated resolver for a domain will, by default, regress parent control of chil= d devices, particularly in the widely deployed scenario where the parent as= ks the network provider to do this job. This is true unless there is also (a) a standardised way for the netw= ork to inform the device of policy, and (b) common client implementations h= onor this.

 

I used the parent example as this is mentioned in IA= B-for-the-users, but could equally apply to the area of trying to stop your= IoT devices from doing things they shouldn't.

 

This could well be a timing issue. To avoid serious = regressions I think we need a coherent set of drafts that support all possi= ble use cases before going to mainstream deployment. Deploying domain desig= nation by itself, or many other single drafts, will inevitably break some things.

 

--_000_LO2P265MB05735D1EB07118B94B1625C2C2710LO2P265MB0573GBRP_-- From nobody Wed Jul 29 23:48:39 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 58D1A3A0EAC for ; Wed, 29 Jul 2020 23:48:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k3H_iCnlFk76 for ; Wed, 29 Jul 2020 23:48:35 -0700 (PDT) Received: from mail-il1-x133.google.com (mail-il1-x133.google.com [IPv6:2607:f8b0:4864:20::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B9443A0EAB for ; Wed, 29 Jul 2020 23:48:35 -0700 (PDT) Received: by mail-il1-x133.google.com with SMTP id b18so16388093ilo.12 for ; Wed, 29 Jul 2020 23:48:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=AAYa1psNbYDGOq7Z3bq/NpkG2Ywh6tic6E9j3nC/8co=; b=mqHw5XDuGcRkCf99uaq7UtdFA+JTYjkg7tbxSKCdyTblwVBRY9BBCiLrMy3ssL9r0+ JQyi8LjQXFP6JfE1ffCFbWkAJfNLwLhdbZlROkWQi44/+ICzrzY2DQVw0q7QCDt4NoB8 oXMBr5/DOv5KmRc7RtD9KzfaKMyA5hmKvMWq2TmBV+Aa9L41jAmk6dKkwC04eaOf2gpY +ri1iazdXVOreCv5Ng00N/96YiehGG1v6lGpPDfrXl7b1dmaZd2puZdXdvrIbe46jDCT NdqLd3416ayRc82F8zjV6GwTKCBOq7tMBgM7Zh9HuSdj3gnqY99VuO/p+3YjeU05FbEK HDNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=AAYa1psNbYDGOq7Z3bq/NpkG2Ywh6tic6E9j3nC/8co=; b=Ay+FQwZ5zx6d+77qWVTIMj/7e3AtGP9XnARftqFH378sv1gEsuaS/mkxOOgMnCSIFu z9uw3noHYrI3dqM8a6TluFZirrwP5zh32ccgwtltXALTv4vRH7NFDY7B4i1S5CSFkiEf nHmbEiUdpIA8osjm2gZ7lN+qfcgnwQ4U+rxtZdd5lF99Shtp5eysxTxW0YyxdcKcwpzS z4mIE2ZNNri6niG8h4W2SsD0VlDMbbkVc/FkI5xvTboXNNmHpY9X27U/ff/erNShbpa7 SgbIAK9odQ5anbJno43dYXE5OmIONYb9Pqf8+Wa8PpTJv/S9DL2TghpOiQIBRvzT5a71 otaw== X-Gm-Message-State: AOAM532a5hukbn0dsGY8hnJmB6MUCNF5eLzYDp772ZqvacUcWVzW6oYx rzA3cn+uWEWnxwolpIPDo2CnGzUJnPixzwgK1zw1EWA60Zw= X-Google-Smtp-Source: ABdhPJwsMnfUfPZZoyn+WKcBnFYeVJL4QhHJwNlQ4Q2Y3h1lqjDbWdtVN+6JBr7c2OXGpGOeu0pVw7pwqI3sDbG59Vc= X-Received: by 2002:a92:cf06:: with SMTP id c6mr38048153ilo.73.1596091714557; Wed, 29 Jul 2020 23:48:34 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> In-Reply-To: From: Rob Sayre Date: Wed, 29 Jul 2020 23:48:21 -0700 Message-ID: To: Andrew Campling Cc: Tommy Jensen , "Chris Box (BT)" , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000acdd6a05aba30f40" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 06:48:37 -0000 --000000000000acdd6a05aba30f40 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 29, 2020 at 11:45 PM Andrew Campling wrote: > *Tommy* > > Picking up the thread and also answering your earlier question about GDPR > (noting that I am also not a lawyer!) > Agree that you are not a lawyer. thanks, Rob --000000000000acdd6a05aba30f40 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 29, 2020 at 11:45 PM Andrew C= ampling <andrew.campling@419.consulting> wrote:

Tommy

Picking up the thread= and also answering your earlier question about GDPR (noting that I am also= not a lawyer!)

=C2=A0
Ag= ree that you are not a lawyer.

thanks,
R= ob

--000000000000acdd6a05aba30f40-- From nobody Thu Jul 30 05:12:33 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 779B83A1214 for ; Thu, 30 Jul 2020 05:12:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1qFdX5eBQPBL for ; Thu, 30 Jul 2020 05:12:23 -0700 (PDT) Received: from mail-io1-xd32.google.com (mail-io1-xd32.google.com [IPv6:2607:f8b0:4864:20::d32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 06BEE3A10D0 for ; Thu, 30 Jul 2020 05:11:59 -0700 (PDT) Received: by mail-io1-xd32.google.com with SMTP id z6so27996841iow.6 for ; Thu, 30 Jul 2020 05:11:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=TtjbQkSsf7zSZ/RRLQvswTDBkFgjTGO85/BFeGF3rvA=; b=hIlZU3cXJulc3cVqntKSyxdT4UxsjNm1HlFK3tOpRsFWl+ujWjv/slp7oLt36K/KsV ZX75K2rYwTsnT56an334x3xdRTXvaCeVam2GDJylVSerwMwatNm/3779zWaLWuZtNftE ji+oENWNTVpmFMjilafOeeeBPoyUnn5Pzle69T7qw8X6PCa5P/FmyeBqFvSBUFx8IK1e HPs0KwXWD6hW0PDs8t7PmkTKSjVtQb6B9Vta7Ia6/+SXuoxUeoK8hQWvfw6gzb/GAHZg zWB+uEm5RgtnIE9yQrMcYcVHqd/1P3OEMIRPPW88qduQGdaxSniF6VBi0OMRCEDQh2JU fZzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=TtjbQkSsf7zSZ/RRLQvswTDBkFgjTGO85/BFeGF3rvA=; b=FcgiKadHazSg/r+pw4oZzwaNMLsom8pbz4ze+ukgGk7Rv5xOUm0l18ULkvc43YbETa dMCOQvIm0F8p+I6RpvrQ2IkwnjSKCbfBPiy+tkrx7AR5kDC5FdQcN5dTu6HAC10Boz2V +oXyPDGayEqoJsAkkRtPoZ8LTiXThvYNnjKjwzVbp2bY30iTC5T9gTju7AWrvjCtD0eo ATfUTG3iSltwdSt2Gx0r3Bz+Wxzv7iRVjXPoGDm2rBiG0TJ6yqu4CnP81YlqDeurV/wu 5egqAV60q+i9agatGT7pB59B+rBTyKJbRKIPKWjS/JoS7DIMzDTq+cTDAJxaU7Gcbk5F RLTw== X-Gm-Message-State: AOAM532LXBwWJK/yc3EhN65LQoN91dPV79m/hZ5FpjU26YGWrT+7d6nI 3/nM6ZVe6NwchSHSAY+MPJwOuv0o21Zp8E3TagM= X-Google-Smtp-Source: ABdhPJwi1EciTAfEDBCwCl1Ag3tYuSoGcsFxVQAnwyxP0bs6sWL9G6MkUhek8zrpFgenDCZ6EgPmP0zjrq4o3HODnd4= X-Received: by 2002:a02:dc3:: with SMTP id 186mr2964257jax.46.1596111119283; Thu, 30 Jul 2020 05:11:59 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> In-Reply-To: From: tirumal reddy Date: Thu, 30 Jul 2020 12:11:47 +0000 Message-ID: To: "Chris Box (BT)" Cc: ADD Mailing list , Andrew Campling , Rob Sayre , Ted Lemon , Tommy Jensen Content-Type: multipart/alternative; boundary="000000000000497a2505aba79481" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 12:12:32 -0000 --000000000000497a2505aba79481 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Chris, Good points, please see inline On Thu, 30 Jul 2020 at 06:00, Chris Box (BT) wrote: > Rob you appear to be saying you don=E2=80=99t need such features to secur= e a home > network, but I would certainly appreciate having Tiru=E2=80=99s (a) to (e= ) deployed > in my house. I don=E2=80=99t want the smart TV equipped with microphone a= nd webcam > to be remotely compromised, nor any other device. Without such > network-level control, enabled by standards, my only defence is to > physically unplug the TV from the network when not in use. > > Following Eva=E2=80=99s talk in HRPC, I=E2=80=99ll put myself in the shoe= s of a dissident > in a hostile regime. In such a case I would feel even greater need for su= ch > security. Of course I would choose my security supplier carefully, and no= t > one aligned to the regime. I then need one or two devices that route > through Tor. > > I fully agree the challenge is to distinguish legitimate network signals > from those of an attacker. Robustly identifying who they came from is > non-trivial, but hopefully not impossible? > Yes, identifying the trustworthiness of the peer is discussed in RATS WG (see https://datatracker.ietf.org/wg/rats/about/). Remote attestation procedures (RATS) enable relying parties to establish a level of confidence in the trustworthiness of remote system components through the creation of attestation evidence by remote system components and a processing chain towards the relying party. A relying party can then decide whether to consider a remote system component trustworthy or not. The claims used as evidence and attestation for DNS server is discussed in https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-04. Cheers, -Tiru > Chris > > > > --000000000000497a2505aba79481 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Chris,

Good points, please see inlin= e

On Thu, 30 Jul 2020 at 06:00, Chris Box (BT) <chris.box.ietf@gmail.com> wrote:
Rob you appear= to be saying you don=E2=80=99t need such features to secure a home network= , but I would certainly appreciate having Tiru=E2=80=99s (a) to (e) deploye= d in my house. I don=E2=80=99t want the smart TV equipped with microphone a= nd webcam to be remotely compromised, nor any other device. Without such ne= twork-level control, enabled by standards, my only defence is to physically= unplug the TV from the network when not in use.=C2=A0=C2=A0
Following Eva=E2=80=99s talk in HRPC, I=E2=80=99ll= put myself in the shoes of a dissident in a hostile regime. In such a case= I would feel even greater need for such security. Of course I would choose= my security supplier carefully, and not one aligned to the regime. I then = need one or two devices that route through Tor.=C2=A0

I fully agree the challenge is to distinguish= legitimate network signals from those of an attacker. Robustly identifying= who they came from is non-trivial, but hopefully not impossible?

Yes, identifying the trustworthiness of the pe= er is discussed in RATS WG (see=C2=A0https://datatracker.ietf.org/wg/rats/about/). Remote = attestation procedures (RATS) enable relying parties to establish a level o= f confidence in the trustworthiness of remote system components through the= creation of attestation evidence by remote system components and a process= ing
chain towards the relying party. A relying party can then decide w= hether to=C2=A0consider a remote system component trustworthy or not.
<= br>
The claims used as evidence and attestation for DNS server is= discussed in=C2=A0https://tools.ietf.org/html/draft-reddy-add-serv= er-policy-selection-04.=C2=A0=C2=A0

Cheers,
-Tiru


Chris



--000000000000497a2505aba79481-- From nobody Thu Jul 30 05:23:37 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39E633A10CB for ; Thu, 30 Jul 2020 05:23:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id URdTPdmO9sCH for ; Thu, 30 Jul 2020 05:23:33 -0700 (PDT) Received: from mail-qk1-x732.google.com (mail-qk1-x732.google.com [IPv6:2607:f8b0:4864:20::732]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03FD23A10C4 for ; Thu, 30 Jul 2020 05:23:32 -0700 (PDT) Received: by mail-qk1-x732.google.com with SMTP id j187so25286161qke.11 for ; Thu, 30 Jul 2020 05:23:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=mhGxNaANCaZKOZL5i7CVJGRwFEeL3xCyq8zKP68lqNI=; b=kAeDK1UpFUG7SLhf/am8YSYZu3FpjM/NzjtaVBRnSNCYfx4yFPMedgoF6F8ktgXdPI 63OLfX6daOFl4Xfc5/LGYDtoPZwSPtzeYSy55+rpCbvR3btHPYPdKgxVdU4g0OY93LAn tL/RDG7l0InNfgISKmE8Ag3mHoPo+YVSohsEk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=mhGxNaANCaZKOZL5i7CVJGRwFEeL3xCyq8zKP68lqNI=; b=e6u7cQzyGSuB3fDiJsSpGFJfBsAuv1QtxxS1ztxSv3YV3m1SiHTS7HxGE9xrpmvRbP aAibc21S6786+PQxvGOybgmviMXAnJqjmeNuxnmseXpLcfdNBo1PdWWd184u/YHSPVSq d8AWIOK0d0/4ffuEhYe1ijFSRi9BUjuNl5T5B7AhXpYeo4/x+eq1Zcz3lpc3bLs17OhI 51+wOZjGNtdVcpvhIFgptEJ2eXiThB2jKXLzyuuEGpW5TvYbHsWB7V69oYRIr02uRBJ8 EKYMfsOeKKdJly5SpE7jzTb2KHs/U/KOaeKsr0WFhBx3ZQM+fY2dzGGfG/HYw9b+PbER 9PZQ== X-Gm-Message-State: AOAM5327cTaEIJGWOa+hsbjjdwx2I/l5vTdquWa5vO8/ag7Q7WvYGdJI lupPeydrR51mwNoQG/6oiDE09Q== X-Google-Smtp-Source: ABdhPJxFhkkl/NdJz4ULWTJCCpQti/hNFIF4JzT6nlkOynQpf+oXYGN5zgKGexuPNxe7eGBwbx3Ruw== X-Received: by 2002:ae9:ebd0:: with SMTP id b199mr35587011qkg.294.1596111811824; Thu, 30 Jul 2020 05:23:31 -0700 (PDT) Received: from ?IPv6:2607:f2c0:e784:c7:cc64:e39d:b3f2:81cb? ([2607:f2c0:e784:c7:cc64:e39d:b3f2:81cb]) by smtp.gmail.com with ESMTPSA id f189sm3803939qke.15.2020.07.30.05.23.30 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 30 Jul 2020 05:23:30 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) From: Joe Abley In-Reply-To: Date: Thu, 30 Jul 2020 08:23:29 -0400 Cc: tirumal reddy , Tommy Jensen , "Chris Box (BT)" , Andrew Campling , ADD Mailing list , Ted Lemon Content-Transfer-Encoding: quoted-printable Message-Id: <3E2B4D29-3985-451A-A157-F5BAA0CF9A5E@hopcount.ca> References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> To: Rob Sayre X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 12:23:35 -0000 On 30 Jul 2020, at 00:09, Rob Sayre wrote: > On Wed, Jul 29, 2020 at 8:52 PM tirumal reddy = wrote: >=20 >> How do you propose on-board various types of endpoints (including = smart TV, chromebook, xbox etc) with device profiles in home networks ? >=20 > Don't care. These are not high-security networks. Haven't you heard? Home networks are the new office networks. Joe From nobody Thu Jul 30 05:51:32 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7BA3B3A10DB for ; Thu, 30 Jul 2020 05:51:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QzfMEibj7tp3 for ; Thu, 30 Jul 2020 05:51:24 -0700 (PDT) Received: from mx3.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2C4C93A10E7 for ; Thu, 30 Jul 2020 05:51:24 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx3.open-xchange.com (Postfix) with ESMTPS id 557D76A303; Thu, 30 Jul 2020 14:51:22 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1596113482; bh=+FnCwj9UtLXJXwZkvHLF1/EjF97r0wPLenCmnnm9PP8=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=pVDyRx8/UAl09CbtjM0f4qxUxEOf6J2PHC/vwJYS3CkCmuyNuLGdn3oWV7cgBeXBy IenvqvWmfllu76HYs7zlWOmAiAcIcmq14kK2V8wP3osn1DYZyO4kZD7IB6/8aT9En4 J1vbKPfzZPz44pdmj3LdxzfwhZY8FPB6F0mM6fqtQ4taAV5Rn2+xoSDKfXY5XVshe7 JABjgejlE+gJidW8sOAlhDf+Yxac+q0aHn/tDmBhVS95EJsYKrZ8cqEaxdpg7c4i8E TBiSpbFhoWxBzN7MxOo+0Nqx11/gm1k+V0hbIgiM7X+mCsh5yhtg6R56aBTJhYfWFI RJlYE2hRmC18w== Received: from appsuite-gw2.open-xchange.com (appsuite-gw2.open-xchange.com [10.20.28.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 452323C0399; Thu, 30 Jul 2020 14:51:22 +0200 (CEST) Date: Thu, 30 Jul 2020 14:51:22 +0200 (CEST) From: Vittorio Bertola To: Tommy Jensen Cc: ADD Mailing list Message-ID: <1058866258.602.1596113482164@appsuite-gw2.open-xchange.com> In-Reply-To: References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> , MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_600_11329719.1596113482147" X-Priority: 3 Importance: Normal X-Mailer: Open-Xchange Mailer v7.10.3-Rev19 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 12:51:27 -0000 ------=_Part_600_11329719.1596113482147 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit > Il 29/07/2020 18:50 Tommy Jensen ha scritto: > > > Hey Andrew, > > Can you be specific about your GDPR concerns? Each time I press on what parts of the proposals run afoul of GDPR, here or in other DNS bodies, I'm told "talk to your lawyer" which, to be fair, is a valid answer. However, if there are not specific technical concerns that can be shared on list, I don't think we should block standard design on the vague legal risk that _might_ exist. Let's be specific about the GDPR concerns. > I'm not Andrew nor a lawyer, but for what regards myself, the GDPR concerns about the adaptive DNS model are that it creates a way for an extremely high number of third parties to ask the browser for DNS data that they would not currently get, countering the principles of privacy by design and data minimization that are mandated by the GDPR whenever data processing activities are conceived. I understand the point that these parties would generally be the ones that would later be contacted through an application-layer protocol to get the actual service, but it still need to be assessed whether the DNS query can be considered as part of the actual service, whether it does not disclose additional information, and so on; and more importantly, I see no guarantees that this mechanism cannot rather be used to bring additional parties into the loop, by designating them as DNS providers, and broaden the set of entities that get the user's information. It's true that the burden of finding good, legal and privacy-protecting policies for using the specs could be left to implementations, but this could be said of pretty much anything. Even the dreaded "eTLS" architecture could have been implemented legally and positively under an appropriate choice of policies, yet the IETF rightfully decided to reject it, as the architecture itself was too prone to privacy damage. In fact, RFC 6973 gives data minimization and user control as guidelines for protocol design, and the adaptive DNS model IMHO counters both of those principles. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com mailto:vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy ------=_Part_600_11329719.1596113482147 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit
 
Il 29/07/2020 18:50 Tommy Jensen <jensen.thomas=40microsoft.com@dmarc.ietf.org> ha scritto:
 
 
Hey Andrew,
 
Can you be specific about your GDPR concerns? Each time I press on what parts of the proposals run afoul of GDPR, here or in other DNS bodies, I'm told "talk to your lawyer" which, to be fair, is a valid answer. However, if there are not specific technical concerns that can be shared on list, I don't think we should block standard design on the vague legal risk that _might_ exist. Let's be specific about the GDPR concerns.
I'm not Andrew nor a lawyer, but for what regards myself, the GDPR concerns about the adaptive DNS model are that it creates a way for an extremely high number of third parties to ask the browser for DNS data that they would not currently get, countering the principles of privacy by design and data minimization that are mandated by the GDPR whenever data processing activities are conceived.
 
I understand the point that these parties would generally be the ones that would later be contacted through an application-layer protocol to get the actual service, but it still need to be assessed whether the DNS query can be considered as part of the actual service, whether it does not disclose additional information, and so on; and more importantly, I see no guarantees that this mechanism cannot rather be used to bring additional parties into the loop, by designating them as DNS providers, and broaden the set of entities that get the user's information.
 
It's true that the burden of finding good, legal and privacy-protecting policies for using the specs could be left to implementations, but this could be said of pretty much anything. Even the dreaded "eTLS" architecture could have been implemented legally and positively under an appropriate choice of policies, yet the IETF rightfully decided to reject it, as the architecture itself was too prone to privacy damage. In fact, RFC 6973 gives data minimization and user control as guidelines for protocol design, and the adaptive DNS model IMHO counters both of those principles.

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
------=_Part_600_11329719.1596113482147-- From nobody Thu Jul 30 06:00:39 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95BE43A1103 for ; Thu, 30 Jul 2020 06:00:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kr1IbfiMBc4y for ; Thu, 30 Jul 2020 06:00:37 -0700 (PDT) Received: from mail-qt1-x82d.google.com (mail-qt1-x82d.google.com [IPv6:2607:f8b0:4864:20::82d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 436603A1102 for ; Thu, 30 Jul 2020 06:00:37 -0700 (PDT) Received: by mail-qt1-x82d.google.com with SMTP id d27so20200975qtg.4 for ; Thu, 30 Jul 2020 06:00:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=NW60UVo6EJWqUR5Duj0BpHrGJGmp5UAFd8Pj3L5OnIY=; b=ocEqaGXZ8reegi3MX0ayiLffQMBiRni3gFnVxwuDohtnEb191WPkhscY8X+1iRJjws SeT8GMCdjeQ6fo6XKFyi6xond4Esmnd26jiMFQQarvkXhamQI1QrIF7Myl8l/2avxKxh GJvWn48SXlv2cT3v6msvnfYUv/JgQRkVkYkWx0HFo/1zUHDVh00dN/ifsnNdBG5+A2VE rgZBKYPjYMPTcMTSIwMDS0Ctqfis9FN6mmkCjxFil4CzkOPOl1ZKMKooRbJYPa8Jr3+L iYIaR8MA/jYVYT7RHWSNz9NOwV5pWoXotNCL2sohhJlLGQNif1zk7W8sVIoV/em1w53a GsEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=NW60UVo6EJWqUR5Duj0BpHrGJGmp5UAFd8Pj3L5OnIY=; b=bzCrKs+hlNgKlWLRCvCIaidmChBtfpd7U8ZaQy1hQWrk58V/tbq0uU1JCBwl77jzrr eTE+LOoPFoMSkBzCyVNnGOQlSB+07mJsBg5W1HdOuCxGsn6uaVtk3dduk0x5p7nFa9rv h2uV3XOMAUQwiEl48RQw/eMehdad/4v5fmfKElXFmvlUy9OgT+73qYH8BuXlN6cyJUx0 k3YNsleVlr1gMXnFZobI4naWcKJfGVEaTbU3ZdbT5vtkM+Gx5dVN+mn89NQ0+miohc/o 3uipCAE3Yph1NWHT4XJ8CULSnWHqwDLBAbzZw6gFr8oeAA7Z6LbxfgKL7jJRKFbTXQTb OIkA== X-Gm-Message-State: AOAM5300UxCeVcSRqhocWeDJPWAYeT9kNW0R5P+cVIpiQCKfrs604c3Y HoLOlw2DUE7tXXFqs0RbU4SXGtOpVsKylSwXpv4= X-Google-Smtp-Source: ABdhPJyJCL+/F6hFjSjWhsF3ugX/LjNcrVQz30bPmtP5DNfdvSerydy4/E1shx+YSEqQdQ8DTnv3aHwiIlZCZnh2Olk= X-Received: by 2002:ac8:6114:: with SMTP id a20mr2671644qtm.169.1596114036294; Thu, 30 Jul 2020 06:00:36 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> In-Reply-To: From: "Chris Box (BT)" Date: Thu, 30 Jul 2020 14:00:23 +0100 Message-ID: To: tirumal reddy Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000002787d805aba84275" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 13:00:39 -0000 --0000000000002787d805aba84275 Content-Type: text/plain; charset="UTF-8" On Thu, 30 Jul 2020 at 13:11, tirumal reddy wrote: > Yes, identifying the trustworthiness of the peer is discussed in RATS WG > (see https://datatracker.ietf.org/wg/rats/about/). Remote attestation > procedures (RATS) enable relying parties to establish a level of confidence > in the trustworthiness of remote system components through the creation of > attestation evidence by remote system components and a processing > chain towards the relying party. A relying party can then decide whether > to consider a remote system component trustworthy or not. > > The claims used as evidence and attestation for DNS server is discussed in > https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-04. > > Thanks Tiru. I hadn't looked into RATS, and I have to confess that crypto is not my domain so I look to others to do that and tell me what it all means. But on the surface it looks positive. --0000000000002787d805aba84275 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, 30 Jul 2020 = at 13:11, tirumal reddy <kondtir@gm= ail.com> wrote:
Yes, identifying the trustworthiness of the peer is discussed in RA= TS WG (see=C2=A0https://datatracker.ietf.org/wg/rats/about/). Remote att= estation procedures (RATS) enable relying parties to establish a level of c= onfidence in the trustworthiness of remote system components through the cr= eation of attestation evidence by remote system components and a processing=
chain towards the relying party. A relying party can then decide whet= her to=C2=A0consider a remote system component trustworthy or not.

=
The claims used as evidence and attestation for DNS server is di= scussed in=C2=A0https://tools.ietf.org/html/draft= -reddy-add-server-policy-selection-04.=C2=A0=C2=A0

=C2=A0
Thanks Tiru. I hadn't looked into R= ATS, and I have to confess that crypto is not my domain so I look to others= to do that and tell me what it all means. But on the surface it looks posi= tive.

--0000000000002787d805aba84275-- From nobody Thu Jul 30 06:15:48 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E9B33A112B for ; Thu, 30 Jul 2020 06:15:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5b2WcVnctyUU for ; Thu, 30 Jul 2020 06:15:43 -0700 (PDT) Received: from mail-qk1-x72c.google.com (mail-qk1-x72c.google.com [IPv6:2607:f8b0:4864:20::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AEE833A1219 for ; Thu, 30 Jul 2020 06:15:28 -0700 (PDT) Received: by mail-qk1-x72c.google.com with SMTP id l23so25528939qkk.0 for ; Thu, 30 Jul 2020 06:15:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=jIDEst1EXKgvdXGXESrnXN/65l6BOsMauK6AR5uz1xc=; b=vZ6odV+C4jAui+eo41lBL7V/NOuDuEfFsAGj7ep9uXLZ9mtDR1WMj6reeN5dX54ieE 48INWgTyBKJ2jp7fm1z38wtROsFn45ehfWGSxZ9pbJRz5c9b0mrIIVXO4mOBwLYDr4g/ ypBZRePcHG+Akl0BmUUeHbj6aRLSGrDhw0mwIr2h8AysIzTFPh2va9YoB1qIC6ijL8+B X3s359cQk+ZDSSh87BZwldY64bGNTiMvRsttw8k7mk+wpp5CzZ1OMQrzWpU0g1pBmW9X Y5H/UJ5rT75qUs1L02msoYO9qat/kIk5sK2uLb2lvCrmIxW8EouN63q0Gm/VNQSug8mo aTIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=jIDEst1EXKgvdXGXESrnXN/65l6BOsMauK6AR5uz1xc=; b=OHs18qVVfcSkrfUMo1dBV6fkYAUjGaWE63xQXeZN1CyhAtEcHp5274nsqULBWcDnAX NrLT4U8q6ZZJkvlP70+Yclod09aihkvRwUKVH3W4Xlk4BCEKayoOkcJ00wsCaEl7Nh/l P8hnm9YXZhMuqkLgrPCZ2QO9ZP5/oLY398ABsnVxKe/tZ4EboUCzJ7kDM51Cp2bMskK9 e4itjZdkVssU3ymdoh7ymoey0OcIL1gMpQqWh60RFp2UxOiG2EDM+Y0yHqPQDtHcsbPc R8ZJfFs52GeISwFjwtnb/DEms+cmI7WQspwNdl+eMvTWfnGZFsTiVAyTC/pHFZDf7XeC S7NA== X-Gm-Message-State: AOAM530BxfkHKm0QLaJHeLTRT3AT+LtNOWXV6mip0Nf/yU90d/+KaO58 r1opPhcYGtFo7FRXlZuaHqljMw== X-Google-Smtp-Source: ABdhPJwuEwMmjpXFix40nCbSx/mGTMmc666c+2BqLhWJsuHn4g7h/ncs6e70/oEW876J+8PCIrHOFw== X-Received: by 2002:a05:620a:122c:: with SMTP id v12mr39504822qkj.113.1596114927519; Thu, 30 Jul 2020 06:15:27 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:bdbc:e9b9:682c:f4f1? ([2601:18b:300:36ee:bdbc:e9b9:682c:f4f1]) by smtp.gmail.com with ESMTPSA id c9sm3956057qkm.44.2020.07.30.06.15.26 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 30 Jul 2020 06:15:27 -0700 (PDT) From: Ted Lemon Message-Id: <8C3D7B23-FBB4-4444-80C5-A89F26C1A3E2@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_7C74A88C-401C-4E6F-9960-6DC58700E1F4" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Thu, 30 Jul 2020 09:15:25 -0400 In-Reply-To: Cc: Rob Sayre , "Chris Box (BT)" , Andrew Campling , ADD Mailing list , Tommy Jensen To: tirumal reddy References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 13:15:46 -0000 --Apple-Mail=_7C74A88C-401C-4E6F-9960-6DC58700E1F4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 30, 2020, at 12:21 AM, tirumal reddy wrote: > On Thu, 30 Jul 2020 at 04:09, Rob Sayre > wrote: > On Wed, Jul 29, 2020 at 8:52 PM tirumal reddy > wrote: > How do you propose on-board various types of endpoints (including = smart TV, chromebook, xbox etc) with device profiles in home networks ? > Don't care. These are not high-security networks. > My point is parental control is not restricted to Apple devices and = your proposal of device profile is not solving the problem for home = network deployments. I get the sense that you=E2=80=99re suggesting that somehow the network = should be offering to the device that it install a device profile. This = can=E2=80=99t work because it=E2=80=99s not safe to trust the network. = There has to be an explicit trust decision. I don=E2=80=99t know about = other ecosystems, but on the iPhone you have to explicitly choose to = install a profile=E2=80=94it doesn=E2=80=99t just happen when you join a = network. I don=E2=80=99t think there=E2=80=99s a way for the IETF to = standardize this process=E2=80=94it=E2=80=99s going to be specific to = the operating system or ecosystem. We /could/ standardize what the = profile looks like, I guess. --Apple-Mail=_7C74A88C-401C-4E6F-9960-6DC58700E1F4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 30, 2020, at 12:21 AM, tirumal reddy <kondtir@gmail.com> = wrote:
On Thu, 30 Jul 2020 at 04:09, Rob Sayre <sayrer@gmail.com> = wrote:
On Wed, Jul 29, 2020 at 8:52 PM tirumal reddy = <kondtir@gmail.com> wrote:
How do = you propose on-board various types of endpoints (including smart = TV, chromebook, xbox etc) with device profiles in home networks  = ?
Don't care. These are = not high-security networks.
My point is parental control is not restricted to Apple = devices and your proposal of device profile is not solving the problem = for home network deployments.

I get the sense that you=E2=80=99re = suggesting that somehow the network should be offering to the device = that it install a device profile. This can=E2=80=99t work because it=E2=80= =99s not safe to trust the network. There has to be an explicit trust = decision. I don=E2=80=99t know about other ecosystems, but on the iPhone = you have to explicitly choose to install a profile=E2=80=94it doesn=E2=80=99= t just happen when you join a network. I don=E2=80=99t think there=E2=80=99= s a way for the IETF to standardize this process=E2=80=94it=E2=80=99s = going to be specific to the operating system or ecosystem. We /could/ = standardize what the profile looks like, I guess.
= --Apple-Mail=_7C74A88C-401C-4E6F-9960-6DC58700E1F4-- From nobody Thu Jul 30 06:29:11 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E25163A1137 for ; Thu, 30 Jul 2020 06:29:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7glJ3CC7mpYF for ; Thu, 30 Jul 2020 06:29:01 -0700 (PDT) Received: from sdaoden.eu (sdaoden.eu [217.144.132.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A98D23A1138 for ; Thu, 30 Jul 2020 06:29:00 -0700 (PDT) Received: by sdaoden.eu (Postfix, from userid 1000) id A55ED16056; Thu, 30 Jul 2020 15:28:58 +0200 (CEST) Date: Thu, 30 Jul 2020 15:28:57 +0200 From: Steffen Nurpmeso To: tirumal reddy Cc: "Chris Box (BT)" , Tommy Jensen , Andrew Campling , ADD Mailing list , Ted Lemon , Rob Sayre , Steffen Nurpmeso Message-ID: <20200730132857.6MGkL%steffen@sdaoden.eu> In-Reply-To: References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> Mail-Followup-To: tirumal reddy , "Chris Box (BT)" , Tommy Jensen , Andrew Campling , ADD Mailing list , Ted Lemon , Rob Sayre , Steffen Nurpmeso User-Agent: s-nail v14.9.19-92-ga7d96581-dirty OpenPGP: id=EE19E1C1F2F7054F8D3954D8308964B51883A0DD; url=https://ftp.sdaoden.eu/steffen.asc; preference=signencrypt BlahBlahBlah: Any stupid boy can crush a beetle. But all the professors in the world can make no bugs. MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 13:29:04 -0000 tirumal reddy wrote in : |Hi Chris, | |Good points, please see inline | |On Thu, 30 Jul 2020 at 06:00, Chris Box (BT) |wrote: | |> Rob you appear to be saying you don=E2=80=99t need such features to sec= ure a home |> network, but I would certainly appreciate having Tiru=E2=80=99s (a) to = (e) \ |> deployed |> in my house. I don=E2=80=99t want the smart TV equipped with microphone= and \ |> webcam |> to be remotely compromised, nor any other device. Without such |> network-level control, enabled by standards, my only defence is to |> physically unplug the TV from the network when not in use. |> | |> Following Eva=E2=80=99s talk in HRPC, I=E2=80=99ll put myself in the sh= oes of a dissident |> in a hostile regime. In such a case I would feel even greater need \ |> for such |> security. Of course I would choose my security supplier carefully, \ |> and not |> one aligned to the regime. I then need one or two devices that route |> through Tor. |> |> I fully agree the challenge is to distinguish legitimate network signals |> from those of an attacker. Robustly identifying who they came from is |> non-trivial, but hopefully not impossible? |> | |Yes, identifying the trustworthiness of the peer is discussed in RATS WG |(see https://datatracker.ietf.org/wg/rats/about/). Remote attestation |procedures (RATS) enable relying parties to establish a level of confiden= ce |in the trustworthiness of remote system components through the creation of |attestation evidence by remote system components and a processing |chain towards the relying party. A relying party can then decide whether |to consider a remote system component trustworthy or not. | |The claims used as evidence and attestation for DNS server is discussed in |https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-04. I personally do not get what yet another line of authorities transported via JSON encoded structures fetched via another DNS record that just exposes that JSON structure gives the world anew. Indirection may make everything possible, but, i mean, to me the key point of RFC 8572 for example is the 3.3 Ownership Voucher [this] artifact is used to securely identify a device's owner, as it is known to the manufacturer. The ownership voucher is signed by the device's manufacturer. _If_ i can find my way home i can securely update myself, where securely means manufacturer here. Great that standard CMS is used. Even if DNSSEC [RFC6698] is used to authenticate the various DNS resource records [.] the device cannot be sure that the domain returned to it, e.g., from a DHCP server, belongs to its rightful owner. It then refers back to RFC 6763, DNS-based service discovery. Which has really nice, easy to parse content, and does not use JSON only to represent key/value pairs. (Why not a fixed CBOR thing instead, they are talking maps at the moment, for example. And can easily be converted back and forth to JSON while still being parsed directly, as it is binary.) What is so wrong with this service discovery thing, i think it could very well serve additional things. But especially so if another registry is introduced for the concept. RFC 8572 also says Using a DHCP server may be a compelling option for deployments having existing DHCP infrastructure, as it enables a touchless bootstrapping option that does not entail utilizing an Internet-based resource hosted by a third party. A DHCP server is an untrusted source of bootstrapping data. Thus, the information stored on the DHCP server either MUST be signed or MUST be information that can be processed provisionally (e.g., unsigned redirect information). I do not know (people can agree here), but if that could improve. Also being x-rayed yesterday (untreated bike accident last November) my pictures are now at healthdataspace.org even without me agreeing with that, they have a German data security seal of approval, but then it is just a QR-code and/or an access code (alphanumeric and length of 10 or 12, iirc). It is not an option for a light bulb, but that thing surely belongs behind a household router, and easy usable routers with why not ample-style use cases would be great, imho. With a short fingerprint printed on a device that shows up on that router, just like for Bluetooth pairing. I could imagine people could get used to that. (Especially with some kind of those terrible apps on their smart phones which are linked to the "router" of the household, then, so they get informed of that event. I think DHCP even allows ident strings to be emitted from DHCP client to server.) Sorry, i do not seem to understand. --steffen | |Der Kragenbaer, The moon bear, |der holt sich munter he cheerfully and one by one |einen nach dem anderen runter wa.ks himself off |(By Robert Gernhardt) From nobody Thu Jul 30 06:34:17 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CAAA53A1143 for ; Thu, 30 Jul 2020 06:34:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eybmS62UwiY5 for ; Thu, 30 Jul 2020 06:34:10 -0700 (PDT) Received: from sdaoden.eu (sdaoden.eu [217.144.132.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 078473A114C for ; Thu, 30 Jul 2020 06:34:09 -0700 (PDT) Received: by sdaoden.eu (Postfix, from userid 1000) id 870C216056; Thu, 30 Jul 2020 15:34:07 +0200 (CEST) Date: Thu, 30 Jul 2020 15:34:06 +0200 From: Steffen Nurpmeso To: tirumal reddy Cc: "Chris Box (BT)" , Tommy Jensen , Andrew Campling , ADD Mailing list , Ted Lemon , Rob Sayre , Steffen Nurpmeso Message-ID: <20200730133406.eCDKZ%steffen@sdaoden.eu> In-Reply-To: <20200730132857.6MGkL%steffen@sdaoden.eu> References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> <20200730132857.6MGkL%steffen@sdaoden.eu> Mail-Followup-To: tirumal reddy , "Chris Box (BT)" , Tommy Jensen , Andrew Campling , ADD Mailing list , Ted Lemon , Rob Sayre , Steffen Nurpmeso User-Agent: s-nail v14.9.19-92-ga7d96581-dirty OpenPGP: id=EE19E1C1F2F7054F8D3954D8308964B51883A0DD; url=https://ftp.sdaoden.eu/steffen.asc; preference=signencrypt BlahBlahBlah: Any stupid boy can crush a beetle. But all the professors in the world can make no bugs. Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 13:34:15 -0000 Steffen Nurpmeso wrote in <20200730132857.6MGkL%steffen@sdaoden.eu>: ... |It is not an option for a light bulb, but that thing surely |belongs behind a household router, and easy usable routers with |why not ample-style use cases would be great, imho. With a short |fingerprint printed on a device that shows up on that router, just Of a standard CMS / X509 client certificate that is to say. --steffen | |Der Kragenbaer, The moon bear, |der holt sich munter he cheerfully and one by one |einen nach dem anderen runter wa.ks himself off |(By Robert Gernhardt) From nobody Thu Jul 30 06:49:37 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F1373A1167 for ; Thu, 30 Jul 2020 06:49:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.101 X-Spam-Level: X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=apple.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c-8xNh2fW2I9 for ; Thu, 30 Jul 2020 06:49:32 -0700 (PDT) Received: from ma1-aaemail-dr-lapp02.apple.com (ma1-aaemail-dr-lapp02.apple.com [17.171.2.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D859C3A114A for ; Thu, 30 Jul 2020 06:49:30 -0700 (PDT) Received: from pps.filterd (ma1-aaemail-dr-lapp02.apple.com [127.0.0.1]) by ma1-aaemail-dr-lapp02.apple.com (8.16.0.42/8.16.0.42) with SMTP id 06UDlm1a025431; Thu, 30 Jul 2020 06:49:27 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apple.com; h=from : message-id : content-type : mime-version : subject : date : in-reply-to : cc : to : references; s=20180706; bh=8Pn44IXDSs3U878fMW5gk7zFWtSUgD4tlyfh/OyG4fU=; b=nYv590MMhSIQnem7un1J2ex79t1d59xZQq9Y1DSR+3AhzC19cMqmtqz/8q6O/lQ/XP6b +fFneKVp7ZmnmEcqWE8EtCvlkcEVa6rFm5uOBivzTDsyKyPfrdFZAaoeyBrYxgl0tXi/ aVEc8R77YGkrFU5XfQ93T+6q+OGodSBumeBkctJsK6iuH9Qy3rscC/20X1/wxdvlCVFC urKf9Cf1NW43JzTiVV68NnDQ5hoFk792Nzogol8QpXaZhQEplt/Hr+FApAVtlSSxpXZE DMqNSSqzOkm5KiRrZVa1hI55yZDPFF1dODjMAIFK0EB3vn3LjUdoftikFwvGLwEC0pCe mA== Received: from rn-mailsvcp-mta-lapp01.rno.apple.com (rn-mailsvcp-mta-lapp01.rno.apple.com [10.225.203.149]) by ma1-aaemail-dr-lapp02.apple.com with ESMTP id 32ghdtmhw8-7 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 30 Jul 2020 06:49:27 -0700 Received: from rn-mailsvcp-mmp-lapp01.rno.apple.com (rn-mailsvcp-mmp-lapp01.rno.apple.com [17.179.253.14]) by rn-mailsvcp-mta-lapp01.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPS id <0QEA002LABQCRHC0@rn-mailsvcp-mta-lapp01.rno.apple.com>; Thu, 30 Jul 2020 06:49:24 -0700 (PDT) Received: from process_milters-daemon.rn-mailsvcp-mmp-lapp01.rno.apple.com by rn-mailsvcp-mmp-lapp01.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) id <0QEA00E00BH50M00@rn-mailsvcp-mmp-lapp01.rno.apple.com>; Thu, 30 Jul 2020 06:49:24 -0700 (PDT) X-Va-A: X-Va-T-CD: ad184c3815094ce8e051fb224dae675d X-Va-E-CD: c416c09a33951e65e3c3e2d803b8317a X-Va-R-CD: 95758e8a33ba4516ce14c097188767b3 X-Va-CD: 0 X-Va-ID: cd9c8a7e-7d60-4d5c-92fc-988f4c9d8bd0 X-V-A: X-V-T-CD: ad184c3815094ce8e051fb224dae675d X-V-E-CD: c416c09a33951e65e3c3e2d803b8317a X-V-R-CD: 95758e8a33ba4516ce14c097188767b3 X-V-CD: 0 X-V-ID: 63be3ae4-00e4-4daf-8531-fc39c7d77c0b X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-30_10:2020-07-30, 2020-07-30 signatures=0 Received: from [17.232.208.180] (unknown [17.232.208.180]) by rn-mailsvcp-mmp-lapp01.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPSA id <0QEA011UDBQA1T00@rn-mailsvcp-mmp-lapp01.rno.apple.com>; Thu, 30 Jul 2020 06:49:24 -0700 (PDT) From: Tommy Pauly Message-id: Content-type: multipart/alternative; boundary="Apple-Mail=_1295D268-F31A-4165-ADDB-04F5F321193C" MIME-version: 1.0 (Mac OS X Mail 13.4 \(3608.80.7.2.3\)) Date: Thu, 30 Jul 2020 06:49:22 -0700 In-reply-to: Cc: Tommy Jensen , "Chris Box (BT)" , ADD Mailing list To: Andrew Campling References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> X-Mailer: Apple Mail (2.3608.80.7.2.3) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-30_10:2020-07-30, 2020-07-30 signatures=0 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 13:49:36 -0000 --Apple-Mail=_1295D268-F31A-4165-ADDB-04F5F321193C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Andrew, First, I want to separate out the mechanism for discovery from the usage = and interaction with user preferences. The focus of the draft currently = being proposed is to define the mechanism to inform client devices about = designated resolvers. The client may choose to have a specific list of = resolvers it allows designation to. And, if a user has chosen a specific = DNS provider to trust for all traffic, or have a VPN, that ought to take = precedence over a more dynamic system with multiple resolvers. I think it=E2=80=99s also worth digging in on the idea that =E2=80=9Cperso= nal data is being shared and processed widely=E2=80=9D. The goal of = using a designated resolver is to *limit* the amount of connection = metadata that is being shared to various parties, and to reduce the data = sharing to an entity that is already involved in helping clients = established connections (both by being an entity that can run the = authoritative DNS and by running the actual origin server endpoints). It = is also important to note that there is no client identifier sent other = than the IP address (assuming that a client connects directly to the DoH = server and not with a proxy, in which case even IP addresses are not = visible). Thanks, Tommy Pauly > On Jul 29, 2020, at 11:45 PM, Andrew Campling = wrote: >=20 > Tommy > Picking up the thread and also answering your earlier question about = GDPR (noting that I am also not a lawyer!), I think that it would be = highly problematic to have adaptive DNS on by default. To expand, a = user has expressed a preference for a DNS service, either through the = acceptance of the ISP=E2=80=99s service in signing their contract or by = subsequently, Google or Cloudflare or Quad9 etc deliberately. Adaptive = DNS *appears* (I may have misunderstood) to make on-the-fly decisions = about the DNS resolver based on recommendations received, which in turn = appears to be at odds with the choice made by the user if it is on by = default. =20 > =20 > This could of course be dealt with by gaining user consent first, = however it does seem that personal data is being shared and processed = widely without any indication of the privacy policies in operation by = the recipients. (I could of course suggest a suitable, GDPR-compliant = privacy policy but that=E2=80=99s off-topic for this group. :-) ) > =20 > Andrew > =20 > From: Tommy Jensen =20 > Sent: 29 July 2020 19:26 > To: Chris Box (BT) > Cc: Andrew Campling ; ADD Mailing list = > Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for = draft-pauly-add-resolver-discovery-01.txt > =20 > Hey Chris, > =20 > Thanks for the scenario. Allow me to try and address it using our = draft. > =20 > For the parental control scenario, there are two scenarios I can think = of. One is the ISP is recommending a DNS server to network members with = a public address. By deploying DoH in accordance with the draft to that = server, the situation self resolves. The client will follow section 5, = make a DoH connection to the server, then the server can proceed how it = sees fit. This may include DNS manipulation to serve an interest such as = parental controls, including filtering SVCB record to prevent Adaptive = DNS from discovering new DoH designations that would take it away from = the parental filtering server. > =20 > The other scenario is the ISP recommends an RFC1918 address, which the = draft doesn't directly address. This is a situation where the standard = shouldn't be confused with an implementation. Section 7 calls out that a = client can use its own discretion and policy when falling back to = classic DNS though the example context is different. Where Adaptive DNS = is intended to be a strong privacy offering, it makes sense some users = (in this case, admins who are parents) may use device configuration to = choose between privacy and content filtering functionality. The same = SVCB record manipulation possibility exists. > =20 > With this context, my view on your parental filtering concern is = really a request to not have Adaptive DNS be on by default, which is an = implementation policy concern and not a standards detail. For example, = TLS 1.3 being the minimum version required everywhere would immediately = break many sites, and requiring DNSSEC validation at the client would = break many sites. That doesn't make either of these standards bad ideas, = just that there are contexts implementors of each need to be aware of = when rolling out bits. > =20 > To be clear, I don't like the idea of the network attacking the SVCB = records. However, it is possible and isn't a regression from today where = DNS packets are attacked to provide redirection to "censored" pages. A = user seeing this who isn't ok with the filtering can take manual action = to bootstrap with a trusted DoH server. A user who is ok will happily = continue as they did before Adaptive rollad out. In your scenario, the = "user" is ok with it and would experience no regressions unless they = take action to configure a DoH server other than yours, which would be a = user signal that they actually don't want filtering. > =20 > Thoughts? > =20 > Thanks, > Tommy Jensen > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > The latest in Windows Internet Protocols: > Native gRPC support: https://aka.ms/grpcblogpost = =20 > DNS over HTTPS: https://aka.ms/dohblogpost = =20 > =20 > From: Chris Box (BT) > > Sent: Wednesday, July 29, 2020 10:44 AM > To: Tommy Jensen > > Cc: Andrew Campling >; ADD Mailing list > > Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for = draft-pauly-add-resolver-discovery-01.txt > =20 > =20 > On Wed, 29 Jul 2020 at 17:50, Tommy Jensen = > wrote: > Can you be specific about any standard proposal which _precludes_ an = implementation from offerings user/admin/enterprise/etc. choice and = control or regresses control from what they have today? I don't think = there's a single draft that's trying to decide a conflict of interest = "between the interests of end users of the Internet and other parties" = in favor of the latter instead of the former. If I'm wrong, please help = me understand which drafts aren't favoring end users interests and how = they aren't. > =20 > =20 > Surely Adaptive DNS's concept of learning the designated resolver for = a domain will, by default, regress parent control of child devices, = particularly in the widely deployed scenario where the parent asks the = network provider to do this job. This is true unless there is also (a) a = standardised way for the network to inform the device of policy, and (b) = common client implementations honor this. > =20 > I used the parent example as this is mentioned in IAB-for-the-users, = but could equally apply to the area of trying to stop your IoT devices = from doing things they shouldn't. > =20 > This could well be a timing issue. To avoid serious regressions I = think we need a coherent set of drafts that support all possible use = cases before going to mainstream deployment. Deploying domain = designation by itself, or many other single drafts, will inevitably = break some things. > =20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_1295D268-F31A-4165-ADDB-04F5F321193C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Andrew,

First, I = want to separate out the mechanism for discovery from the usage and = interaction with user preferences. The focus of the draft currently = being proposed is to define the mechanism to inform client devices about = designated resolvers. The client may choose to have a specific list of = resolvers it allows designation to. And, if a user has chosen a specific = DNS provider to trust for all traffic, or have a VPN, that ought to take = precedence over a more dynamic system with multiple resolvers.

I think it=E2=80=99s = also worth digging in on the idea that =E2=80=9Cpersonal data is being = shared and processed widely=E2=80=9D. The goal of using a designated = resolver is to *limit* the amount of connection metadata that is being = shared to various parties, and to reduce the data sharing to an entity = that is already involved in helping clients established connections = (both by being an entity that can run the authoritative DNS and by = running the actual origin server endpoints). It is also important to = note that there is no client identifier sent other than the IP address = (assuming that a client connects directly to the DoH server and not with = a proxy, in which case even IP addresses are not visible).

Thanks,
Tommy Pauly

On Jul 29, 2020, at 11:45 PM, = Andrew Campling <andrew.campling@419.consulting> wrote:

Tommy
Picking up the = thread and also answering your earlier question about GDPR (noting that = I am also not a lawyer!), I think that it would be highly problematic to = have adaptive DNS on by default.  To expand, a user has expressed a = preference for a DNS service, either through the acceptance of the = ISP=E2=80=99s service in signing their contract or by subsequently, = Google or Cloudflare or Quad9 etc deliberately.  Adaptive DNS *appears* (I may have misunderstood) to make on-the-fly = decisions about the DNS resolver based on recommendations received, = which in turn appears to be at odds with the choice made by the user if = it is on by default.   
 
This could of = course be dealt with by gaining user consent first, however it does seem = that personal data is being shared and processed widely without any = indication of the privacy policies in operation by the recipients.  = (I could of course suggest a suitable, GDPR-compliant privacy policy but = that=E2=80=99s off-topic for this group. :-) )
 
Andrew
 
From: Tommy = Jensen <Jensen.Thomas@microsoft.com> 
Sent: 29 = July 2020 19:26
To: Chris Box (BT) <chris.box.ietf@gmail.com>
Cc: Andrew Campling <andrew.campling@419.consulting>; ADD Mailing list = <add@ietf.org>
Subject: Re: [Add] [EXTERNAL] Re: = New Version Notification for = draft-pauly-add-resolver-discovery-01.txt
 
Hey Chris,
 
Thanks for the = scenario. Allow me to try and address it using our draft.
 
For the parental = control scenario, there are two scenarios I can think of. One is the ISP = is recommending a DNS server to network members with a public address. = By deploying DoH in accordance with the draft to that server, the = situation self resolves. The client will follow section 5, make a DoH = connection to the server, then the server can proceed how it sees fit. = This may include DNS manipulation to serve an interest such as parental = controls, including filtering SVCB record to prevent Adaptive DNS from = discovering new DoH designations that would take it away from the = parental filtering server.
 
The other scenario is the ISP = recommends an RFC1918 address, which the draft doesn't directly address. = This is a situation where the standard shouldn't be confused with an = implementation. Section 7 calls out that a client can use its own = discretion and policy when falling back to classic DNS though the = example context is different. Where Adaptive DNS is intended to be a = strong privacy offering, it makes sense some users (in this case, admins = who are parents) may use device configuration to choose between privacy = and content filtering functionality.  The same SVCB record = manipulation possibility exists.
 
With this = context, my view on your parental filtering concern is really a request = to not have Adaptive DNS be on by default, which is an implementation = policy concern and not a standards detail. For example, TLS 1.3 being = the minimum version required everywhere would immediately break many = sites, and requiring DNSSEC validation at the client would break many = sites. That doesn't make either of these standards bad ideas, just that = there are contexts implementors of each need to be aware of when rolling = out bits.
 
To be clear, I don't like the idea = of the network attacking the SVCB records. However, it is possible and = isn't a regression from today where DNS packets are attacked to provide = redirection to "censored" pages. A user seeing this who isn't ok with = the filtering can take manual action to bootstrap with a trusted DoH = server. A user who is ok will happily continue as they did before = Adaptive rollad out. In your scenario, the "user" is ok with it and = would experience no regressions unless they take action to configure a = DoH server other than yours, which would be a user signal that they = actually don't want filtering.
 
Thoughts?
 
Thanks,
Tommy Jensen
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D
The latest in Windows Internet Protocols:
  Native gRPC support: https://aka.ms/grpcblogpost 
  DNS over HTTPS: https://aka.ms/dohblogpost 
 
From: Chris Box (BT) <chris.box.ietf@gmail.com>
Sent: Wednesday, July 29, 2020 = 10:44 AM
To: Tommy Jensen <Jensen.Thomas@microsoft.com>
Cc: Andrew Campling <andrew.campling@419.consulting>; ADD Mailing list = <add@ietf.org>
Subject: Re: [Add] [EXTERNAL] Re: = New Version Notification for = draft-pauly-add-resolver-discovery-01.txt
 
 
On Wed, 29 Jul 2020 at 17:50, Tommy = Jensen <Jensen.Thomas=3D40microsoft.com@dmarc.ietf..org> wrote:
Can you be specific about any standard proposal which = _precludes_ an implementation from offerings user/admin/enterprise/etc. = choice and control or regresses control from what they have today? I = don't think there's a single draft that's trying to decide a conflict of = interest "between the interests of end users of the Internet and other = parties" in favor of the latter instead of the former. If I'm wrong, = please help me understand which drafts aren't favoring end users = interests and how they aren't.
 
 
Surely Adaptive DNS's concept of learning the designated = resolver for a domain will, by default, regress parent control of child = devices, particularly in the widely deployed scenario where the parent = asks the network provider to do this job. This is true unless there is = also (a) a standardised way for the network to inform the device of = policy, and (b) common client implementations honor this.
 
I used the parent example as this is = mentioned in IAB-for-the-users, but could equally apply to the area of = trying to stop your IoT devices from doing things they shouldn't.
 
This could well be a timing issue. To = avoid serious regressions I think we need a coherent set of drafts that = support all possible use cases before going to mainstream deployment. = Deploying domain designation by itself, or many other single drafts, = will inevitably break some things.
 
-- 
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_1295D268-F31A-4165-ADDB-04F5F321193C-- From nobody Thu Jul 30 06:58:21 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A9E63A1190 for ; Thu, 30 Jul 2020 06:58:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gEpAURU21Hq4 for ; Thu, 30 Jul 2020 06:58:08 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C29C43A1199 for ; Thu, 30 Jul 2020 06:58:07 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id w12so14663853iom.4 for ; Thu, 30 Jul 2020 06:58:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=0491VLsO6WWRiGdwdWgoXAb/u4Wb+6nlQwqdWjMFUlA=; b=VX69EKTAUga3Mz7z9b0E3MKHoLVwAB4+gnjQgWKuTo3VpG6UrUizdL60R5pYX9XsMt CRkFDtJRU9Bzg4OU6ig1wUC65fVMeT3LJ6QQidvdCO0Em9B6zF84HZe20BkIr8QsY42P ZbyU88f0VfFJjSIuidvSrHTJXq6/x4NhHHkuaLdsy0sYuCY4r8vzmre5l/fbXsWNPNNf LEV7RxcAYt8bUr32ib3unx5aMCUlneIeLYSz+MgegxMkCg8bJuNn8psIUX6u7FyDFx2J fuz4Giwo1jxDgy/DjKbFc/tbN3wUfGlmqBMJP9m86i++Gu35uHNULLhTtkUv3yJYD6eb +0Gg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=0491VLsO6WWRiGdwdWgoXAb/u4Wb+6nlQwqdWjMFUlA=; b=QEGkJ/owpFL4W8TIkmo6HINwj9K/K7UcekUgJVfcDLno3eqwmQPWfJW1v/MhvHiNJQ RsaJsnLyVWqqEJjKlWfsK8JUvfXxcaYpOp6Z421TPCqDmbpo9DPGeoy53b8m5ijqXBkI UZ5jExrh7zElNtp1Oy8s84x5v1mWhhQA6/DIMSYrP1pXhOTMmxCxUC3xKu28X01K+OEc GyEbryVrb9aOhx2bMS8FrE6HTqn8KTZe+7eD/I5Y9CQaHc1od6E1j+QtOVadewT47Br0 NCEe/m2FRVagQXikv8yr+3QqRkYOlFrvdm7JXgQDBEoJt+DRPEa7tMm9GFcAWVT07AR3 at5Q== X-Gm-Message-State: AOAM530bqm10ASiMuI8F24+B/IKPgUVlnsrq567feb03kb5AfGWSjMKq IqhX3cSfzyTmLnTMtHpR07Sh1uQxummSzMCOrT0= X-Google-Smtp-Source: ABdhPJzddwd3aoxH3s/SJJVYsaJlqS2Ixe5tKeUrLH5oo+ZM4CnB5GqVAIwbXqtoiM8bsi8kFztGn7V1UAdClAG2VIU= X-Received: by 2002:a05:6638:250f:: with SMTP id v15mr3526002jat.75.1596117486853; Thu, 30 Jul 2020 06:58:06 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> <8C3D7B23-FBB4-4444-80C5-A89F26C1A3E2@fugue.com> In-Reply-To: <8C3D7B23-FBB4-4444-80C5-A89F26C1A3E2@fugue.com> From: tirumal reddy Date: Thu, 30 Jul 2020 13:57:55 +0000 Message-ID: To: Ted Lemon Cc: Rob Sayre , "Chris Box (BT)" , Andrew Campling , ADD Mailing list , Tommy Jensen Content-Type: multipart/alternative; boundary="000000000000d2e27205aba90f12" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 13:58:17 -0000 --000000000000d2e27205aba90f12 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, 30 Jul 2020 at 13:15, Ted Lemon wrote: > On Jul 30, 2020, at 12:21 AM, tirumal reddy wrote: > > On Thu, 30 Jul 2020 at 04:09, Rob Sayre wrote: > >> On Wed, Jul 29, 2020 at 8:52 PM tirumal reddy wrote: >> >>> How do you propose on-board various types of endpoints (including smart >>> TV, chromebook, xbox etc) with device profiles in home networks ? >>> >> Don't care. These are not high-security networks. >> > My point is parental control is not restricted to Apple devices and your > proposal of device profile is not solving the problem for home network > deployments. > > > I get the sense that you=E2=80=99re suggesting that somehow the network s= hould be > offering to the device that it install a device profile. This can=E2=80= =99t work > because it=E2=80=99s not safe to trust the network. There has to be an ex= plicit > trust decision. I don=E2=80=99t know about other ecosystems, but on the i= Phone you > have to explicitly choose to install a profile=E2=80=94it doesn=E2=80=99t= just happen when > you join a network. > Yes, the on-boarding process of BYOD in Enterprise networks allows the user to authenticate to the directory service and vice-versa, and then the configuration profile is installed on the endpoint, see https://developer.apple.com/library/archive/documentation/NetworkingInterne= t/Conceptual/iPhoneOTAConfiguration/OTASecurity/OTASecurity.html for more details. > I don=E2=80=99t think there=E2=80=99s a way for the IETF to standardize t= his process=E2=80=94it=E2=80=99s > going to be specific to the operating system or ecosystem. > Agreed, my question is how do we get this delivery mechanism to work in a home network ? > We /could/ standardize what the profile looks like, I guess. > Yes, it will help solve the problem in certain scenarios like Enterprise networks for Apple devices. I have not looked into OTA for other operating systems. Cheers, -Tiru --000000000000d2e27205aba90f12 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, 30 Jul 2020 at 13:15, Ted Lemon &= lt;mellon@fugue.com> wrote:
<= /div>
On Jul 30, 2020, at 12:21 = AM, tirumal reddy <kondtir@gmail.com> wrote:
On Thu, 30 Jul 2020 at 04:09, Rob Sayre <sayrer@gmail.com>= wrote:
On Wed= , Jul 29, 2020 at 8:52 PM tirumal reddy <kondtir@gmail.com> wrote:
How do you propose on-board various= =C2=A0types of endpoints (including smart TV, chromebook, xbox etc) with de= vice profiles in home networks=C2=A0 ?
D= on't care. These are not high-security networks.
My point is parental control is not restricted=C2=A0to Apple d= evices and your proposal of device profile is not solving the problem for h= ome network deployments.

I get= the sense that you=E2=80=99re suggesting that somehow the network should b= e offering to the device that it install a device profile. This can=E2=80= =99t work because it=E2=80=99s not safe to trust the network. There has to = be an explicit trust decision. I don=E2=80=99t know about other ecosystems,= but on the iPhone you have to explicitly choose to install a profile=E2=80= =94it doesn=E2=80=99t just happen when you join a network.

Yes, the on-boarding process of BYOD in Enterp= rise networks allows the user to authenticate to the directory service and = vice-versa, and then the configuration profile is installed on the endpoint= , see=C2=A0https://developer.apple.com/library/archive/documentation/Netw= orkingInternet/Conceptual/iPhoneOTAConfiguration/OTASecurity/OTASecurity.ht= ml=C2=A0for more details.
=C2=A0
I= don=E2=80=99t think there=E2=80=99s a way for the IETF to standardize this= process=E2=80=94it=E2=80=99s going to be specific to the operating system = or ecosystem.

Agreed, my quest= ion is how do we get this delivery mechanism to work in a home network ?
=C2=A0
We /could/ standardize what the p= rofile looks like, I guess.

Yes= , it will help solve the problem in certain scenarios like Enterprise netwo= rks for Apple devices. I have not looked into OTA for other=20 operating systems.

Cheers,
-Tiru
--000000000000d2e27205aba90f12-- From nobody Thu Jul 30 07:08:34 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 17FE03A1180 for ; Thu, 30 Jul 2020 07:08:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K0yYtVF8oCqV for ; Thu, 30 Jul 2020 07:08:30 -0700 (PDT) Received: from mail-qt1-x833.google.com (mail-qt1-x833.google.com [IPv6:2607:f8b0:4864:20::833]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F40953A11F1 for ; Thu, 30 Jul 2020 07:08:15 -0700 (PDT) Received: by mail-qt1-x833.google.com with SMTP id d27so20381600qtg.4 for ; Thu, 30 Jul 2020 07:08:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=lO8cF3Zdw/y8hnxqXInAXU2ScSeKWfpkImWRLuSbbtI=; b=Ady99dMuHaKykM8RnXLDNmzHMjvkXuCJJV7sACekMBBx32fxbBBSAxaAjKgKoMTuRE mFsB68FxNlCAcAzpbpgwuQPSDX/fPxW/802hikGv1ocR82aHRQSiu/SJSAfRIDmrc+ez 5HwoDiwDaqaFfOhAHz5+/HAYuuNmai7JLGz/qNGBxMl9pu/VeQjvJcAv9lWAItZHFNBu GIbDvYneTCzubUb12MBITtaBL+yhhHR7RjCfeAWLGRQAgJsYK+n83uvu8x3RamRFmXpk 00otBQb/h0KhdLRYEmgjU8qRIeKsvkScuSU+/Jn/UtluOJJFRjcgjJq5ykMXmhuBg0eU Dj0w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=lO8cF3Zdw/y8hnxqXInAXU2ScSeKWfpkImWRLuSbbtI=; b=t7OxCpC9dnlYOKlS7+SGqQTHQxnjD3KkAPJNBOrIt7J+CV221KvNfIsKjf6J4B4lXx ZL+DHV5mfYpY8uz83BzoCuTfisvfOAe+4Ujfx3CI+lYlIZSBNo+Qz2e91MOOLH4D4OxH tj5DSMHzQAdE7H08RESwIDenBdlUZxh+n1iIIIap8NG/NhH4AZzjqUhsMDp41lRJYyqn mG15z+je582vPaP6hf/2qm3INU4o9JBTb5dLtGsW+dtrAfrnCtfNtZu65OOeXRQcMbic S0gndK3A8/ybIGeLJyrw21jQNZlHs1tDszrl2kVuqVRNxnUcQt3y/YjZgXjTxTdiaU3V w1CA== X-Gm-Message-State: AOAM531OnnHn32nif/pz4RtCQORImnezXAMAlwMc2+ZeVJ6+AuBmU0bT xCYPaCswY6/LMujaZbrTY8PRZQ== X-Google-Smtp-Source: ABdhPJyF696GBub4CgtClfv3v+SEwnYY7kPJ8q6PLItdYRFJyzXJ/+7FgHK2Qp0Cxc01V2k6pBZl2Q== X-Received: by 2002:ac8:7650:: with SMTP id i16mr2933154qtr.215.1596118094841; Thu, 30 Jul 2020 07:08:14 -0700 (PDT) Received: from ?IPv6:2601:18b:300:36ee:bdbc:e9b9:682c:f4f1? ([2601:18b:300:36ee:bdbc:e9b9:682c:f4f1]) by smtp.gmail.com with ESMTPSA id 3sm4448462qkm.117.2020.07.30.07.08.12 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 30 Jul 2020 07:08:12 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_C178D80E-1D52-4BD0-95FE-9C15A62340BB" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Thu, 30 Jul 2020 10:08:11 -0400 In-Reply-To: Cc: Rob Sayre , "Chris Box (BT)" , Andrew Campling , ADD Mailing list , Tommy Jensen To: tirumal reddy References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> <8C3D7B23-FBB4-4444-80C5-A89F26C1A3E2@fugue.com> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 14:08:33 -0000 --Apple-Mail=_C178D80E-1D52-4BD0-95FE-9C15A62340BB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Jul 30, 2020, at 9:57 AM, tirumal reddy wrote: > Yes, the on-boarding process of BYOD in Enterprise networks allows the = user to authenticate to the directory service and vice-versa, and then = the configuration profile is installed on the endpoint, see = https://developer.apple.com/library/archive/documentation/NetworkingIntern= et/Conceptual/iPhoneOTAConfiguration/OTASecurity/OTASecurity.html = for = more details. > =20 > I don=E2=80=99t think there=E2=80=99s a way for the IETF to = standardize this process=E2=80=94it=E2=80=99s going to be specific to = the operating system or ecosystem. >=20 > Agreed, my question is how do we get this delivery mechanism to work = in a home network ? As I said, it=E2=80=99s going to be specific to the operating system, so = we can=E2=80=99t do it=E2=80=94it=E2=80=99s not our job. That doesn=E2=80=99= t mean it can=E2=80=99t be done. The Apple solution is an example of it = being done, although a bit more all-singing, all-dancing than we are = talking about here. =20 > We /could/ standardize what the profile looks like, I guess. >=20 > Yes, it will help solve the problem in certain scenarios like = Enterprise networks for Apple devices. I have not looked into OTA for = other operating systems. If the device ecosystem provides some sort of parental control model, = then this should work for any user of such a device, not just enterprise = users. The DoH server in this case would be the solution provider=E2=80=99= s DoH server, not the local network DoH server. --Apple-Mail=_C178D80E-1D52-4BD0-95FE-9C15A62340BB Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Jul 30, 2020, at 9:57 AM, tirumal reddy <kondtir@gmail.com> = wrote:
Yes, the = on-boarding process of BYOD in Enterprise networks allows the user to = authenticate to the directory service and vice-versa, and then the = configuration profile is installed on the endpoint, see https://developer.apple.com/library/archive/documentation/Netwo= rkingInternet/Conceptual/iPhoneOTAConfiguration/OTASecurity/OTASecurity.ht= ml for more details.
 
I don=E2=80=99t think there=E2=80=99= s a way for the IETF to standardize this process=E2=80=94it=E2=80=99s = going to be specific to the operating system or ecosystem. =

Agreed, my question is how do we get this delivery mechanism = to work in a home network ?

As I said, it=E2=80=99s going to be specific to the = operating system, so we can=E2=80=99t do it=E2=80=94it=E2=80=99s not our = job. That doesn=E2=80=99t mean it can=E2=80=99t be done. The Apple = solution is an example of it being done, although a bit more = all-singing, all-dancing than we are talking about = here.
 
We /could/ standardize what the = profile looks like, I guess.

Yes, it will help solve the problem in = certain scenarios like Enterprise networks for Apple devices. I have not = looked into OTA for other=20 operating systems.

If the device ecosystem provides some sort of = parental control model, then this should work for any user of such a = device, not just enterprise users. The DoH server in this case would be = the solution provider=E2=80=99s DoH server, not the local network DoH = server.


= --Apple-Mail=_C178D80E-1D52-4BD0-95FE-9C15A62340BB-- From nobody Thu Jul 30 08:49:13 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C8DA53A0B26 for ; Thu, 30 Jul 2020 08:49:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com header.b=P1mugOa+; dkim=pass (2048-bit key) header.d=comcast.com header.b=ZT6xMopS; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=comcastcorp.onmicrosoft.com header.b=F8gJRf+9 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ez2EPARtdqhR for ; Thu, 30 Jul 2020 08:49:08 -0700 (PDT) Received: from mx0a-00143702.pphosted.com (mx0a-00143702.pphosted.com [148.163.145.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A35D3A0B1B for ; Thu, 30 Jul 2020 08:49:08 -0700 (PDT) Received: from pps.filterd (m0156892.ppops.net [127.0.0.1]) by mx0a-00143702.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06UFXxu8018075 for ; Thu, 30 Jul 2020 11:49:08 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.com; h=from : to : subject : date : message-id : content-type : mime-version; s=20190412; bh=QZONbwZnsZPni94Y1T/UejYMqFikxrmpTX92006EQ3g=; b=P1mugOa+F5MOcdG0+ugRQ96KMtDaMNYSa7jA+fS07sN+EFR7aj5KeOua3ZZmgTdRMMxP sOUo5n1rwbaxuOzd0VrSTh435+bC34GYX7u4ZWAwnBZutwTD+yLucajDobWVkiOUqGc3 gtWx4Df68BOZYDw3dPhalXitcAvTqSjftGZTzHEgj6Z3UIWsmMuOQs0LvG1mHbcOP7eF 4JkOGN86ock3xgWl23tX7I83zAeny1EVz1kNlKQmzvm3zy9DYaww+FgaJgyvzAFsyEUC chwgoBXMueqyx5IweJZLyP+OtbiVCihJF2m7x0gM9jzTr8yG5EU6EO3kUQFmZ5s5XDEj tA== Received: from pacdcmhout01.cable.comcast.com (PACDCMHOUT01.cable.comcast.com [68.87.31.167]) by mx0a-00143702.pphosted.com with ESMTP id 32gg2j4x1w-16 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 30 Jul 2020 11:49:07 -0400 DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1596124147; x=2460037747; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=QZONbwZnsZPni94Y1T/UejYMqFikxrmpTX92006EQ3g=; b=ZT6xMopSiqxYnf4sCGwm7YD9h3wMdvhZt1TUdw4hMT5w5rbrecNB+MR17Taze7Cp iihdCkSJCMVwDFcsq4vckys4WoUQc5ZufSWk3t4C0mlJ6Sjs2ZcuzPx34S0z0l9l KWiQAPZCz3mhnMGJ2TOtyQxCnn8Byw4oqoFWCCfIEJbW8hk+NdUxAAJW1hfzSJRW r5TIYd1UXApyqaf0MFT+bWR2YJ3iGBkPVfJoXQsqHLyKJ60gWQdE1qHOeHS8nI0p fob/x7j+FKAMlYh39y5OcLXOGTSm93cend8k+LlP882amAmRDTn0FbjhIbKOflgG Uc3eeyCFJzDCFWYIwJ19zA==; X-AuditID: 44571fa7-3fdff70000018e96-95-5f22ebf3a56c Received: from PACDCEX40.cable.comcast.com (cas-umc02.ndceast.pa.bo.comcast.net [68.87.34.28]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by pacdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 85.C6.36502.3FBE22F5; Thu, 30 Jul 2020 11:49:07 -0400 (EDT) Received: from PACDCEX10.cable.comcast.com (24.40.1.133) by PACDCEX40.cable.comcast.com (24.40.2.139) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 30 Jul 2020 11:49:07 -0400 Received: from PACDCEXEDGE01.cable.comcast.com (76.96.78.71) by PACDCEX10.cable.comcast.com (24.40.1.133) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Thu, 30 Jul 2020 11:49:07 -0400 Received: from NAM10-BN7-obe.outbound.protection.outlook.com (104.47.70.109) by webmail.comcast.com (76.96.78.71) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 30 Jul 2020 11:48:46 -0400 Received: from BYAPR11MB3111.namprd11.prod.outlook.com (2603:10b6:a03:90::25) by BYAPR11MB2599.namprd11.prod.outlook.com (2603:10b6:a02:c6::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.21; Thu, 30 Jul 2020 15:48:45 +0000 Received: from BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0]) by BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0%4]) with mapi id 15.20.3239.017; Thu, 30 Jul 2020 15:48:45 +0000 From: "Deen, Glenn" To: ADD Mailing list Thread-Topic: September Interim doodle poll Thread-Index: AQHWZojoX+ySP3m2mkiKhzVn4Ogl3w== Date: Thu, 30 Jul 2020 15:48:45 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=comcast.com; x-originating-ip: [2605:e000:141b:121:58c7:9025:415e:f5fb] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: bee83ce5-d365-4ab5-befd-08d834a00b18 x-ms-traffictypediagnostic: BYAPR11MB2599: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: OD8YrMcdMS/FgXwxLjOOY0BNVhP51rRDQQ/ARK/LBNX4oCZnEQCrw0qayKTRR2fJOFqod/hX/se/TwL7K7KOZeMawQSP9AKR1kYvhtSpKXdf+cjHD9fuIxFmE/BbnY8CS4wZmJiuygznOqXwm14ERu0OL7ZNK2oL4cS05SVKAOBf8AnM5n/LjmeVgz/P7MvTebnNm7EcJG+vU9W/aT6dF5BGuXTgIHbSZPDNsz8BnukByGzDluwyk1sQukzk1gV5SlT6RSYzdfC2NMQxRLR/DFRLxxgfTbRNdvEKzYr/eB4TR/XmpNqx4T96H5VNv8RSN3b7u+yH7ls2IlMhWI0t8b8Qgbeu7GFxmuY9Qf6WV+TPmUUIQDuqK6ELI/LEpwtzgJow3EOUUx66UA6XiT3fRw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3111.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(396003)(39860400002)(366004)(376002)(346002)(136003)(2906002)(66556008)(186003)(36756003)(6916009)(64756008)(66946007)(316002)(6512007)(66446008)(76116006)(8676002)(66476007)(71200400001)(6486002)(4744005)(2616005)(5660300002)(3480700007)(33656002)(6506007)(8936002)(166002)(86362001)(478600001)(966005); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: l9xQL+TzrAAGjUn7uYz5wr/lUyL4XpZF+Vf5eXSXCRmtXmsG0CoTY/9NmWUkk6jDl7xF1vGZKoMoBtIe8IimzoLINMwy0q3djNNYF+8NYkhuTWfRhaUNWE3CedEddhR4afhDAwAsVFQ54GCm97DakPYSwymTVHoxV5nryioyUoAFeahkMvN0qTf1DLTggQNKyHQdheT2u14Nhry6r8Sl3MPAATJwd+ZNAvvOKKH6nIM3lgnDbVCvpNUUF3eOfGiOslHhWHi3Q8YyEx/oDf2JxVZjt4PmtUt+R0A52wHfqpLnPJFdWoP48isAWdG5Uyz9ac6968lqriIvG+DM7VEhsrH5GpzFSbY9eVDP2MUdWTlapc8yIxl7xoCBq5TT/X1U2ArrhtEWBeyBS72zWjWqo8xe+HS379X1tQ/s4c/VSPZKS3+3nFKOcZaqIDaCSoR3rfz9a9oEVFLv07pp/bo++QV1zMz5ir9agxHjKktlv3qEHKN0X8ut7rtAd5Gzhg8/IpJPmoF++xu+rwsO9j6RBwj503uRzEc+3u0c6s9UWL9aHlxp0PiiIhTVlhTbAyt8 x-ms-exchange-transport-forked: True arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=LYtRm5H67UGR+soFrDB494ngPO7oNIqrAIJoJFv6hEhyO5iFwAGGlPgCNJvLWg3hb04oG8n07HLsiwX5fyzOBYn0gJJh8+4QEXQkGtR3J+BXXy075lei7IBhu9g0hTA22UTzLf6+VNGNBsuNAKpkbyVWLN6ouzm6xro0IUmF4YMSikiC9595OLSb8ADWmROABLZx6Vkv2lx9oQFVU67pdSZ18OdIa/65mXqFb5FWMQkIqvokX/7kCnat4oRpKBiwF1k4abCRLnCpUPYiMseEyCcIS8+0YSmUFGrCjSmCtSxurWOGedLkKHKa4Tqw7PmNMVlicYSzBJULeYzHHmIEyQ== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=34U7Wh0Y+dqWdZB5x2Bq/rzAtNnTQrMEfW2ljK3QsfI=; b=k1+O8CyRd7jBZVuZgLoLpHOzYYQsWGawYhLHIolETk/0PsQJ6J3YUbhe21cHx4dOuyyo8M8fjr887Hs+eoqNQV3S0jB7FjOJ2mPai9EIGgOcVasSR1SMin4xBSnK2maUlFp0IDIH7uOC/pfsvyPT+S5QNelDJv6dsB4vK3juxYgsBNkafdzi82prnSv5B0Vz7ey2xaXNAnejyGbBMx1SrRbQShEHiVSNnDprH1EN5U/qWCkZpLNR9T1nEDIqRC5HI6tZGa433KOiEmdkDh/NJugC5wP4hPY+afOtsCvl9EWFcLo/ljcivBz5ulnwDsO/r0kZPPKBg4rlmBhz79p1fg== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=comcast.com; dmarc=pass action=none header.from=comcast.com; dkim=pass header.d=comcast.com; arc=none dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastcorp.onmicrosoft.com; s=selector1-comcastcorp-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=34U7Wh0Y+dqWdZB5x2Bq/rzAtNnTQrMEfW2ljK3QsfI=; b=F8gJRf+9cfB6KdVntL0sBocuLaPlU34Nb7HxiDCZGD6NedWV7SZEAaYbj7gBToPrGuHs4RlMurLG0W6OtUWspq5ap+FuZkE4HrmhqVo/q5zmLIE0irMdDvGqL0j2JkBDaUqMaSs2PApmIl9zpRCIBYNe41gH9EASIf8geBsso9o= x-ms-exchange-crosstenant-authas: Internal x-ms-exchange-crosstenant-authsource: BYAPR11MB3111.namprd11.prod.outlook.com x-ms-exchange-crosstenant-network-message-id: bee83ce5-d365-4ab5-befd-08d834a00b18 x-ms-exchange-crosstenant-originalarrivaltime: 30 Jul 2020 15:48:45.7488 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 906aefe9-76a7-4f65-b82d-5ec20775d5aa x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: 6nFPekC14UGwl4uFqNgQWyhp0wVM1oNU+Pfk2gQQ6tZfLpQEEUackN4toyYp2MV/GrJdUAAs1MTOOLSU0wJcDUM0QGHDg/Zgf/+HXXsXsjs= x-ms-exchange-transport-crosstenantheadersstamped: BYAPR11MB2599 x-originatororg: comcast.com Content-Type: multipart/alternative; boundary="_000_FD2643C3C94F49A08FD712DCB9E3E9B2comcastcom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA02Se0hTYRjG+XbO5tlw8TWnvpnWPF4wK80Ub4hFRfmHSUF0o5oLTylekuOF JkEKSrSVGSXR8IZOomEJmi41ccmwsoupeYus1DWveGmBaKR1dhb43+/53ud5X96XjyJkVUIP KiUjm2EzVGm0SEIeOkV77rbN0so9swXeketvn4r2ozi9fkVwDJ2VxCQxaSm5DBscmyhJnptv csrs9736paWeyEdmHw2iKMBh0Gjy0yAJJcNmAXSsawW8aEXQbLpJ8mIAQdFiBcGLLgSjP+8i XtQIoL+sVsiLcQSF5mUh11iEd0Fz4z4NElNy7AO1o0YBxy7YHxbnChFnkeOdsDCRwVuCoPjJ qIhjEvvBp/4ekmMpjoWyj0uIY4TdYLm7zt6GwO7w2VJpZ8AY9C96CJ5dYXpiTcixKw6Gr/U2 +wYIaxDMaEyIN0WD7U6NI+AFfZVax/tRmGixingOhJreX0KeU2Hl8TeH3x+Mgz2OwdvAcHuM 5NkTvg8bHdk2AiyVedxgwFMErPV9cOKFhYTusXIBf3lfWOtUl6AQ3YaFeL4I2pbXIp39AJvh zUMLqfuXIPAOqG8N5i3ecF875sRzABSVlTs4DnQN1YKNnipEGZBzeGRQZERQaEhQSHhEA7L/ m+2PniOjLrkTYQrRztIDw7RSJlTlZqnTOxFQBC2X3pAolDJpkkqdx7BXlGxOGpPVibZSJO0u LRmYuiDDl1XZTCrDZDLs/6qAEnvkowLTsEuX8eDM4jWDXK94FXBalyAu3qLutTaVNkwclngN TeoGa0tD94putd17YG44d8Y04hdmfS8+WRH/p5pdOHEkURFjw/Htg+nn51ejIlzXry9YDT+S ln67JURFl77ruDTyzG9muk7zkigel7cPTa9O6qdSj+coNhlGh1jCvYgms5JVIYEEm6X6C1NR GY8zAwAA X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-30_12:2020-07-30, 2020-07-30 signatures=0 X-Proofpoint-Spam-Reason: safe Archived-At: Subject: [Add] September Interim doodle poll X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 15:49:10 -0000 --_000_FD2643C3C94F49A08FD712DCB9E3E9B2comcastcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QXMgbWVudGlvbmVkIGR1cmluZyB0b2RheeKAmXMgQUREIHNlc3Npb24gd2UgaGF2ZSBhbiBvcGVu IGRvb2RsZSBwb2xsIGZvciBwaWNraW5nIGEgZGF5IHRvIG1lZXQgaW4gU2VwdGVtYmVyLg0KDQpM aWtlbHkgdGltZSBvZiBkYXkgd2lsbCBiZSBzdGFydGluZyBhdCBhcm91bmQgMTQ6MDAtMTU6MDAg VVRDLg0KDQpIZXJl4oCZcyBpcyB0aGUgbGluayDigJMgUGxlYXNlIHRyeSB0byByZXNwb25kIGJ5 IHRoZSBlbmQgb2YgdGhpcyB3ZWVrLg0KDQpodHRwczovL2Rvb2RsZS5jb20vcG9sbC96eXBweHF0 ZThwY3dleDNwDQoNClRoYW5rcywNCkdsZW5uICBEZWVuICYgRGF2aWQgTGF3cmVuY2Ug4oCTIEFE RCBDaGFpcnMgKGZyaWVuZGx5IEFERCBjaGFpcnMgdGhhdCBpcykNCg0K --_000_FD2643C3C94F49A08FD712DCB9E3E9B2comcastcom_ Content-Type: text/html; charset="utf-8" Content-ID: <2A71B79E4305644B8DF0FD25B04DC5EA@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6IlRpbWVzIE5ldyBSb21hbiBcKEJvZHkgQ1NcKSI7DQoJcGFub3NlLTE6MiAyIDYgMyA1 IDQgNSAyIDMgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1z b05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAw MDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLkVt YWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZvbnQtZmFt aWx5OkhlbHZldGljYTsNCgljb2xvcjp3aW5kb3d0ZXh0Ow0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsN Cglmb250LXN0eWxlOm5vcm1hbDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpl eHBvcnQtb25seTsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCglt YXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdl OldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMi IGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9u MSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTpIZWx2ZXRpY2EiPkFzIG1lbnRpb25lZCBkdXJpbmcgdG9kYXnigJlzIEFERCBz ZXNzaW9uIHdlIGhhdmUgYW4gb3BlbiBkb29kbGUgcG9sbCBmb3IgcGlja2luZyBhIGRheSB0byBt ZWV0IGluIFNlcHRlbWJlci48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2Ei PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+TGlrZWx5IHRp bWUgb2YgZGF5IHdpbGwgYmUgc3RhcnRpbmcgYXQgYXJvdW5kIDE0OjAwLTE1OjAwIFVUQy4NCjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5IZXJl4oCZcyBpcyB0aGUgbGluayDigJMgUGxl YXNlIHRyeSB0byByZXNwb25kIGJ5IHRoZSBlbmQgb2YgdGhpcyB3ZWVrLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgaHJlZj0iaHR0cHM6Ly9kb29kbGUuY29tL3BvbGwvenlw cHhxdGU4cGN3ZXgzcCI+aHR0cHM6Ly9kb29kbGUuY29tL3BvbGwvenlwcHhxdGU4cGN3ZXgzcDwv YT48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhhbmtzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+R2xlbm4gJm5ic3A7RGVlbiAmYW1wOyBEYXZpZCBMYXdyZW5jZSDigJMg QUREIENoYWlycyAoZnJpZW5kbHkgQUREIGNoYWlycyB0aGF0IGlzKTxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6SGVsdmV0aWNhIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwv Ym9keT4NCjwvaHRtbD4NCg== --_000_FD2643C3C94F49A08FD712DCB9E3E9B2comcastcom_-- From nobody Thu Jul 30 09:10:51 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82B793A0BEF for ; Thu, 30 Jul 2020 09:10:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com header.b=ORXnA5ec; dkim=pass (2048-bit key) header.d=comcast.com header.b=WfiR+JZA; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=comcastcorp.onmicrosoft.com header.b=oBh0rJiA Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MG6k2RVBBHUA for ; Thu, 30 Jul 2020 09:10:46 -0700 (PDT) Received: from mx0a-00143702.pphosted.com (mx0a-00143702.pphosted.com [148.163.145.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7FC1E3A0BC8 for ; Thu, 30 Jul 2020 09:10:43 -0700 (PDT) Received: from pps.filterd (m0156891.ppops.net [127.0.0.1]) by mx0a-00143702.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06UG8wbf027518 for ; Thu, 30 Jul 2020 12:10:43 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.com; h=from : to : subject : date : message-id : content-type : mime-version; s=20190412; bh=sZvSdeJ/0F0/20YJXz6pKxsFMrPPUczeg8kvj5QXOjM=; b=ORXnA5ecBQngX95SCgfA5VZTKuFlQLjmKAQh/Ol216m5PGV/bodMKC9J5WLZ5qeJYKET aKcPoHudHxMZS5gPOndOmENMu7MQJK/R2O6QRAVwMHtlKELcjVbnmnphD7CI+scXIP0b npa2707MR0PgKXo/eOyH+7HjWMcvlbWh1BxveMKVrDi/3eQ7W2ypFjUb9phPfaIsU3sK iYFo+XTigNCv2lRXI6U90Grc9fVlyJDV5iJioB0UbmqctHeEal8Uw7TdfsQr68YaJyDK xKq0diyIu4h2KXLFp+PoALIVxDdAW8SMpTkiM/FKtaHBwTiP5X4D1rLszXbzim0MiNlc Dw== Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) by mx0a-00143702.pphosted.com with ESMTP id 32ghjtvtrm-13 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 30 Jul 2020 12:10:43 -0400 DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1596125442; x=2460039042; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=sZvSdeJ/0F0/20YJXz6pKxsFMrPPUczeg8kvj5QXOjM=; b=WfiR+JZAyTKCdsmguNRu7nL3jhlCgaZiYbi4XDohdy1mPGGEJUwbUjnGFb/le1TF S/z9WTyz8jCXkc/K1SwFzRxBYezpu3WPeLnMTLJ45/xo4p1Hyl61R70FCfK9IIlo gzgpLMbKy8PMUT/McJdDevcnHjmI/oHnLMSSkf/p8ZA0QOSxQ+K4rd47+TNK4+3w F4Sbza27+HyVWiTdlE1pm4gtgWSRt7YfHAPseek4v8GG+4giB3hhl2bCHdUlyX7x sN8jWAUa7ppGeZXzAHyDQEcMPf1K5tpm3Vqcca2jmhjuLAKsJh1N/XpMEskQj4cX jAD+ylS49+E90FkSv9vQCg==; X-AuditID: a2962c47-549ff7000001f819-a7-5f22f1023893 Received: from copdcexc33.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 3A.3D.63513.201F22F5; Thu, 30 Jul 2020 10:10:42 -0600 (MDT) Received: from COPDCEX10.cable.comcast.com (147.191.124.141) by copdcexc33.cable.comcast.com (147.191.125.132) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Thu, 30 Jul 2020 10:10:41 -0600 Received: from COPDCEXEDGE01.cable.comcast.com (96.114.158.213) by COPDCEX10.cable.comcast.com (147.191.124.141) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Thu, 30 Jul 2020 10:10:41 -0600 Received: from NAM10-BN7-obe.outbound.protection.outlook.com (104.47.70.100) by webmail.comcast.com (96.114.158.213) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 30 Jul 2020 12:10:20 -0400 Received: from BYAPR11MB3111.namprd11.prod.outlook.com (2603:10b6:a03:90::25) by BYAPR11MB3720.namprd11.prod.outlook.com (2603:10b6:a03:fc::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.21; Thu, 30 Jul 2020 16:10:12 +0000 Received: from BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0]) by BYAPR11MB3111.namprd11.prod.outlook.com ([fe80::e91c:5c07:a6ce:5da0%4]) with mapi id 15.20.3239.017; Thu, 30 Jul 2020 16:10:12 +0000 From: "Deen, Glenn" To: ADD Mailing list Thread-Topic: [Add] September Interim doodle poll Thread-Index: AQHWZovnTz7Px1ixbEOCXIqsVKBCRg== Date: Thu, 30 Jul 2020 16:10:11 +0000 Message-ID: <53499B08-5074-4354-B829-EC478BB03000@nbcuni.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.36.20041300 authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=comcast.com; x-originating-ip: [2605:e000:141b:121:58c7:9025:415e:f5fb] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ebed3e43-bdb9-4734-b915-08d834a309bf x-ms-traffictypediagnostic: BYAPR11MB3720: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: CzUYra33IXi59GUoV86E7vGF//6cI78Os9SZfsCkb9Fn/tMg+kTaH8kSbrzSa72vT8wkutifFgLMrM70Qj1hwIn1jt3o9MlLXFqtYfLkWnhRBaUloPakcKsCRmcd/NoyzO5eY3jqIdEEQi3e9C+bFlErDYV7KV3NsKf52ZcJJwSBkUKy1pZdxs8g9D4GzwckuTkBghzAxRUuwl69H0qaJQpDl+jo46I4n5wCAhS3UUPscu0av0B6c6LQof2zC4bSTcMgFDsw+hTSONKmLo3hvAgXge0erj6ZowP9+FDyX15SMV7eIflF7/WyLehWfWZif/0QINYy4HUV4ZwTIthZJtnzderngBqUGwtKKs8/Tj8/v9eIV0PO737tf05T2TSduNt0hOuzuXkoWXcfFWFgyA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR11MB3111.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(396003)(136003)(376002)(39860400002)(366004)(346002)(83380400001)(6486002)(478600001)(8676002)(5660300002)(166002)(186003)(6916009)(6506007)(4744005)(53546011)(86362001)(8936002)(76116006)(33656002)(9686003)(66476007)(2906002)(36756003)(316002)(66556008)(64756008)(71200400001)(66946007)(966005)(66446008)(6512007); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: SnP8QdWYNI0h8BpDNpbXaUvi71U49HMNvBSb+X4/dNoYwWhY8jd5V035ewbqkjKTY3nm4/g8HFZLJN2mlPINYuDSR3fw19iekIzeU9FUlPSKOuG4mdzlu4o2IxsBxtxPhp4IhkZiKrpg1eENWFCsaOqllQdE/YQGzW7edG5TgRrJEm49tRNGRP2/JZZlG9gxZ8udjxPywLe+b5vt+SgQmxG3ev4u5ByseZhBZ0I13SefQREQeMSE4I9SEa2a3qZmqioMaLy9a311Kzxm9f8DD5OFjCxkD9t02UhheVQTuR0D+XnXuChCBAjTIjQOS09MIB5Ec03gOuEdXkGB+DIeK/fyJMDFXLfEn4fWTUXEbcVQeUcCZoEPBiq/bx+pneeTSE0edYw9/ADCkWeya73oTny4jR+tTKwUUFZ8Kv+L66d64VNB7Qiu7qv8omK+FcFZaBqVFqsvqFYwk9Q5XkiweaTi55I+XqYyrgSZq72DDE7bGcnLcqVOdoYE4hgskbO3A9kIHKBbR41V3MzZbgLl7yvJMJ/iuVv6A/Y1sOivVtWoduNFYUXqCVR3GlvLnB2r x-ms-exchange-transport-forked: True arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Hx42Rms1H7l+bfD3lM15AeTr5TRs+ynqShubchpB7GGWBT8iEvWFgBEPJzdR0UDQGhazi3Khadtxp403NVBj35acE/pahKHnPEV0FzDM1bj2djWth/tVKWf5l7vlB91Qk0ADU3fFnN9vxlS3zhmG2uDpeUY7v8TdkI2atAOv/GJKiTKlu8/GGkM4Xka9rsktmKoAt3F1CL/uxyWPieiz5dALyWLrH6Lm99H4nlz6bzhuVNrR5oadpRVlpDkNQariyaHKNWEJpK2RWcGLxY1oFMiI6xcwLVdn2nh1BR+O59441e3LI7snNWqK1WbsyJ9YlVQ65sCJfU57sLUzE6KDlg== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UwRIs013VKqMiSwaclU0djL27mZHFQhipEsqsm1YWlk=; b=M/k37lQtqTgOse2wM7UTBPNDNMH0EqkmseqbYCa9micYgPiIu2fMzLKpCZI1XdP98wLkX17lBKuHommoMpUeWmgwIA+3+5L4TgBZ4hDRvLY3PPmCkI6AM7Yol7zeT+RJPs302M5fEif36B3bLcJ0SqoaT44ec6tDfCgmPL9cOhvjcGu1C4ophK2I762EpgMbDsGVYnK4u85iGlZ4oTAoPV57fLsJ3gacnR8rtA9VmCuIa1Vl52CbcbY0B66B4+k4RJUgii8ubML7cDJREm0Dnymg+58XhJmE/Mr/E2yr5+j5j3wmbC0S5fJHCNdprIJt160zfvOa69eTPBxEJ60PQA== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=comcast.com; dmarc=pass action=none header.from=comcast.com; dkim=pass header.d=comcast.com; arc=none dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastcorp.onmicrosoft.com; s=selector1-comcastcorp-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UwRIs013VKqMiSwaclU0djL27mZHFQhipEsqsm1YWlk=; b=oBh0rJiAyHMoMKcO2h/CJYyS9LSJLjbIR3L4FXrOH3ctiWR576LrgN/TsfpS1NK+40JorqiY6pgRjTifKgYtrztPP+xbeq5fOpqnuSL4LTelUVTTv8Dc2U4JWVjWciUFCS6nz4xqypStNZtSFfp28j33+M8BK5NVU3PZhO5LuFs= x-ms-exchange-crosstenant-authas: Internal x-ms-exchange-crosstenant-authsource: BYAPR11MB3111.namprd11.prod.outlook.com x-ms-exchange-crosstenant-network-message-id: ebed3e43-bdb9-4734-b915-08d834a309bf x-ms-exchange-crosstenant-originalarrivaltime: 30 Jul 2020 16:10:11.9789 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 906aefe9-76a7-4f65-b82d-5ec20775d5aa x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: mMVtUlfI3tEsraMrS5c35oMUKJIGxkG478LFmS+lw4j02gB6rIyVR9GMN5/FUvtrN44WFexWwAXjiBxE17+fQSaVHs8Azf9f96z0eiEDeNg= x-ms-exchange-transport-crosstenantheadersstamped: BYAPR11MB3720 x-originatororg: comcast.com Content-Type: multipart/alternative; boundary="_000_53499B0850744354B829EC478BB03000nbcunicom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA02Sa0iTYRTHe953l9fR5GlpO2haLrMUm1toRWhqBF5AiD5loHOxFxXNxqam fQhFpZpdbFmgrEydRJoNK2alkAxvW4aQmRVqTRem4a2hKeXK7THw2+9/zv8858LD0KJ6rh+T nZfPavKUuRKegJOhMdw+QC1KFLKxkV1H/r55wotDiUbjKnUSnRFEq9jc7EJWE3EsQ5A1vjjP V5vji74M3OKWIGusDnkxgCPhUesPng4JGBHupqBtZohPRBkFS/VrG5lRBI1LQxvCikB/Z5RL RCMFLR3TNBETCGwzlesZhuHhcDA/8zTxwXugaaydcvN2LIM51wKPxOXwutzEJyyFG8ZOD3Pw Xuj+VMV1sxDHwFzHmieO8A74ZXvseYfGYvjsqKPIEhiMnYM0YV+YnnR5an1xBIybnBz3bAjr EMzouhAxHQXnzcaNggB4V1eJ3DMDToEpvZhgGNjXMHHkgOX+II9wCAz/7OEQDoTm6/YN3glf P7Z7DgS4gwaL7S0iwknDRKmeT4SDA+29IxTpEAwuS3EVktdu2oewEmaXK+haz/7bwFrj4NSu V9A4FEyvIoglCKor7XzC+6HCcI9PLInQ4PDfbHmAmGYklB86KJVHyaSRkdLD8qdo/eM03A1P eIEWBtMsCDNIslUI8xKFiKss1BafsyBgaImP8LJgt0IkVCmLL7Ka8wpNQS6rtSB/hiMRC68N f08X4UxlPpvDsmpW8z9LMV5+JcivK4nVpMgYg7FnxaQrK3quP+W6YtmXfnxS5btmcL4MHi3Y crW0/8Tph/2GtBBbZkuUuU4aQuUNtJVfalLMJ+j7RgbBfKE/VfwtKTlUnayK8w6IiQpe/hMk W/X7HRNffVYc+6EuMNX+vsGU2Nsn8W4TtTZWi6ZW1MHW2egal4SjzVLKw2iNVvkP+oVGxzQD AAA= X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-30_12:2020-07-30, 2020-07-30 signatures=0 X-Proofpoint-Spam-Reason: safe Archived-At: Subject: Re: [Add] September Interim doodle poll X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jul 2020 16:10:49 -0000 --_000_53499B0850744354B829EC478BB03000nbcunicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T25lIGNsYXJpZmljYXRpb24gb24gdGhlIG1lZXRpbmcgZHVyYXRpb24gdGltZS4gICBIb3cgbG9u ZyB0aGUgc2Vzc2lvbiB3aWxsIHJ1biB3aWxsIGRlcGVuZGluZyBvbiB0aGUgYW1vdW50IG9mIG1h dGVyaWFsIHdlIG5lZWQgdG8gZGlzY3VzcywgZXhwZWN0IHRoYXQgaXQgd2lsbCBydW4gYXQgbGVh c3QgMi0yOjMwIGhvdXJzLg0KDQpJZiB3ZSBoYXZlIHNvIG11Y2ggbWF0ZXJpYWwgdGhhdCB3ZSBu ZWVkIG1vcmUgdGhhbiB0aGF0LCB0aGVuIHdlIG1heSBuZWVkIHRvIGNvbnNpZGVyIGEgc2Vjb25k IHNlc3Npb24uIEnigJl2ZSBub3RpY2VkIGZyb20gb3RoZXIgZ3JvdXBzIHRoYXQgSSB3b3JrIHdp dGggdGhhdCBwYXJ0aWNpcGFudHMgcnVuIG91dCBvZiBlbmVyZ3kgaWYgYW4gaW50ZXJhY3RpdmUg dmlkZW8gc2Vzc2lvbiBnb2VzIGJleW9uZCB0aGF0Lg0KDQpSZWdhcmRzDQpHbGVubg0KDQpPbiA3 LzMwLzIwLCA4OjQ5IEFNLCAiQWRkIG9uIGJlaGFsZiBvZiBnbGVubl9kZWVuIiA8YWRkLWJvdW5j ZXNAaWV0Zi5vcmc8bWFpbHRvOmFkZC1ib3VuY2VzQGlldGYub3JnPiBvbiBiZWhhbGYgb2YgZ2xl bm5fZGVlbkBjb21jYXN0LmNvbTxtYWlsdG86Z2xlbm5fZGVlbkBjb21jYXN0LmNvbT4+IHdyb3Rl Og0KDQpBcyBtZW50aW9uZWQgZHVyaW5nIHRvZGF54oCZcyBBREQgc2Vzc2lvbiB3ZSBoYXZlIGFu IG9wZW4gZG9vZGxlIHBvbGwgZm9yIHBpY2tpbmcgYSBkYXkgdG8gbWVldCBpbiBTZXB0ZW1iZXIu DQoNCkxpa2VseSB0aW1lIG9mIGRheSB3aWxsIGJlIHN0YXJ0aW5nIGF0IGFyb3VuZCAxNDowMC0x NTowMCBVVEMuDQoNCkhlcmXigJlzIGlzIHRoZSBsaW5rIOKAkyBQbGVhc2UgdHJ5IHRvIHJlc3Bv bmQgYnkgdGhlIGVuZCBvZiB0aGlzIHdlZWsuDQoNCmh0dHBzOi8vZG9vZGxlLmNvbS9wb2xsL3p5 cHB4cXRlOHBjd2V4M3A8aHR0cHM6Ly91cmxkZWZlbnNlLmNvbS92My9fX2h0dHBzOi9kb29kbGUu Y29tL3BvbGwvenlwcHhxdGU4cGN3ZXgzcF9fOyEhUElaZWVXNXdzY3luUlEhNEZEWlhZQkloelBP Z3Yta2ZlYnZzREpTZmJjM0E2bUJSWE84TTF0LXU3LVkzTzZhZEFGaV9USkdDbkpUR1RDbSQ+DQoN ClRoYW5rcywNCkdsZW5uICBEZWVuICYgRGF2aWQgTGF3cmVuY2Ug4oCTIEFERCBDaGFpcnMgKGZy aWVuZGx5IEFERCBjaGFpcnMgdGhhdCBpcykNCg0K --_000_53499B0850744354B829EC478BB03000nbcunicom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6IlRpbWVzIE5ldyBSb21hbiBcKEJvZHkgQ1NcKSI7DQoJcGFub3NlLTE6MiAyIDYgMyA1 IDQgNSAyIDMgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1z b05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAw MDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLkVt YWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWls eTpIZWx2ZXRpY2E7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28t c3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRT ZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4g MS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0 eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSJw dXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+T25l IGNsYXJpZmljYXRpb24gb24gdGhlIG1lZXRpbmcgZHVyYXRpb24gdGltZS4mbmJzcDsmbmJzcDsg SG93IGxvbmcgdGhlIHNlc3Npb24gd2lsbCBydW4gd2lsbCBkZXBlbmRpbmcgb24gdGhlIGFtb3Vu dCBvZiBtYXRlcmlhbCB3ZSBuZWVkIHRvIGRpc2N1c3MsIGV4cGVjdCB0aGF0IGl0IHdpbGwgcnVu IGF0IGxlYXN0IDItMjozMCBob3Vycy4mbmJzcDsNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkhlbHZldGljYSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0 aWNhIj5JZiB3ZSBoYXZlIHNvIG11Y2ggbWF0ZXJpYWwgdGhhdCB3ZSBuZWVkIG1vcmUgdGhhbiB0 aGF0LCB0aGVuIHdlIG1heSBuZWVkIHRvIGNvbnNpZGVyIGEgc2Vjb25kIHNlc3Npb24uIEnigJl2 ZSBub3RpY2VkIGZyb20gb3RoZXIgZ3JvdXBzIHRoYXQgSSB3b3JrIHdpdGggdGhhdCBwYXJ0aWNp cGFudHMgcnVuIG91dCBvZiBlbmVyZ3kNCiBpZiBhbiBpbnRlcmFjdGl2ZSB2aWRlbyBzZXNzaW9u IGdvZXMgYmV5b25kIHRoYXQuICZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5Okhl bHZldGljYSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5S ZWdhcmRzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5HbGVubjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+T24gNy8zMC8yMCwgODo0OSBBTSwgJnF1b3Q7QWRkIG9uIGJlaGFsZiBvZiBn bGVubl9kZWVuJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86YWRkLWJvdW5jZXNAaWV0Zi5vcmci PmFkZC1ib3VuY2VzQGlldGYub3JnPC9hPiBvbiBiZWhhbGYgb2YNCjxhIGhyZWY9Im1haWx0bzpn bGVubl9kZWVuQGNvbWNhc3QuY29tIj5nbGVubl9kZWVuQGNvbWNhc3QuY29tPC9hPiZndDsgd3Jv dGU6PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5BcyBtZW50aW9uZWQgZHVyaW5nIHRvZGF54oCZ cyBBREQgc2Vzc2lvbiB3ZSBoYXZlIGFuIG9wZW4gZG9vZGxlIHBvbGwgZm9yIHBpY2tpbmcgYSBk YXkgdG8gbWVldCBpbiBTZXB0ZW1iZXIuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+TGlrZWx5IHRp bWUgb2YgZGF5IHdpbGwgYmUgc3RhcnRpbmcgYXQgYXJvdW5kIDE0OjAwLTE1OjAwIFVUQy4NCjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpIZWx2 ZXRpY2EiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTpIZWx2ZXRpY2EiPkhlcmXigJlzIGlzIHRoZSBsaW5rIOKAkyBQbGVhc2UgdHJ5 IHRvIHJlc3BvbmQgYnkgdGhlIGVuZCBvZiB0aGlzIHdlZWsuPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5jb20vdjMvX19odHRwczovZG9vZGxl LmNvbS9wb2xsL3p5cHB4cXRlOHBjd2V4M3BfXzshIVBJWmVlVzV3c2N5blJRITRGRFpYWUJJaHpQ T2d2LWtmZWJ2c0RKU2ZiYzNBNm1CUlhPOE0xdC11Ny1ZM082YWRBRmlfVEpHQ25KVEdUQ20kIj5o dHRwczovL2Rvb2RsZS5jb20vcG9sbC96eXBweHF0ZThwY3dleDNwPC9hPjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPlRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj5HbGVubiAmbmJzcDtEZWVuICZhbXA7IERhdmlkIExhd3JlbmNlIOKA kyBBREQgQ2hhaXJzIChmcmllbmRseSBBREQgY2hhaXJzIHRoYXQgaXMpPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_53499B0850744354B829EC478BB03000nbcunicom_-- From nobody Thu Jul 30 22:46:22 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 714503A0E2F for ; Thu, 30 Jul 2020 22:46:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DZsW3KeLBWUw for ; Thu, 30 Jul 2020 22:46:17 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B61903A0E2E for ; Thu, 30 Jul 2020 22:46:17 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id v6so15361901iow.11 for ; Thu, 30 Jul 2020 22:46:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6Xt+idea8PfaaYkcUgzS9JuxF97V3b4GN6RL31bFZOw=; b=E/0tZ3cL8OeF68Ae8ppRTLqq+9mlji2G0UW/Yh5RcVbfmFK7MemkVJEs4kFtXM7pgG pc5QS9gePYSHF5wbwq71ej/92oqY77cw3oJ3M8CUxyFFvLAanR8gNLFwIcnKzmCNfA3X 0bFSwmKtPbzAHtl/Bi/azQYM5Dcg37MBnra3JRG9ivz4T7RCGOGBm3d2HSmPHYLxaZMx UwpvxsONXN8VGhHx1v6AUuaOGs7x7tHQJxqCdt6Sm1/UL0Z64JYDCR5FlAQYsPuIWXvD 96RuB7P830GE1QHi5W6Sx44AhwkcvmyQ4/6H1EEq1OsNMy848MBcQpQ+GAh/ygMc7gkq krRw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6Xt+idea8PfaaYkcUgzS9JuxF97V3b4GN6RL31bFZOw=; b=JH0m41M4gXrguR9ocwkia5T9VGMDZRQgiZUVJhVlmaTCfnoKMy1E2Yde8LN7aqhLSm w6nwZyE8pFux+XOduC09ULoajVQZOdexPhAvM1MCyQFZdWIzftYTeDLvZzFIKxopmghk HollOX7HeVRPRvMKinodIJzTEYXVV3pMoqB91572D8jdqBFwKYqTg0NdnMaox3A9/LIi lammE1JbNA1mT6wCB6sdnB3ZRJQ08JwZn40rnk3DMF5tkUY+c61wxC9n/7YDXdlzQ/cu AKup3GXRjH0GayWrZY5nhlvjC6+cuRINskd+ifmHscJiicBF9T1nQC9Viid6TPga6BtX u87g== X-Gm-Message-State: AOAM531ndeC4ipn2nZQpkPN+kz6JHSJskQnvgqI/4e/+rDrBPbJncsn4 OIZKJk4nMm7mES/T536WMHt6j1aGms98efjibIA= X-Google-Smtp-Source: ABdhPJyHKv3J5w45eWJSpZVsoQNTINgqsmUGde70t8FvTaZoAALrkriM253Roh4Kml0p6P/0twtkW/qfb8RoY3Hh3MQ= X-Received: by 2002:a02:5b83:: with SMTP id g125mr3156559jab.91.1596174376845; Thu, 30 Jul 2020 22:46:16 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> <8C3D7B23-FBB4-4444-80C5-A89F26C1A3E2@fugue.com> In-Reply-To: From: tirumal reddy Date: Fri, 31 Jul 2020 05:46:05 +0000 Message-ID: To: Ted Lemon Cc: Rob Sayre , "Chris Box (BT)" , Andrew Campling , ADD Mailing list , Tommy Jensen Content-Type: multipart/alternative; boundary="000000000000bb459805abb64e10" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jul 2020 05:46:21 -0000 --000000000000bb459805abb64e10 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, 30 Jul 2020 at 14:08, Ted Lemon wrote: > On Jul 30, 2020, at 9:57 AM, tirumal reddy wrote: > > Yes, the on-boarding process of BYOD in Enterprise networks allows the > user to authenticate to the directory service and vice-versa, and then th= e > configuration profile is installed on the endpoint, see > https://developer.apple.com/library/archive/documentation/NetworkingInter= net/Conceptual/iPhoneOTAConfiguration/OTASecurity/OTASecurity.html for > more details. > > >> I don=E2=80=99t think there=E2=80=99s a way for the IETF to standardize = this process=E2=80=94it=E2=80=99s >> going to be specific to the operating system or ecosystem. >> > > Agreed, my question is how do we get this delivery mechanism to work in a > home network ? > > > As I said, it=E2=80=99s going to be specific to the operating system, so = we can=E2=80=99t > do it=E2=80=94it=E2=80=99s not our job. That doesn=E2=80=99t mean it can= =E2=80=99t be done. The Apple > solution is an example of it being done, although a bit more all-singing, > all-dancing than we are talking about here. > The problem is not with operating systems but the procedure to on-board/bootstrap devices, it is different in a Home network compared to an Enterprise network. The bootstrapping process in https://developer.apple.com/library/archive/documentation/NetworkingInterne= t/Conceptual/iPhoneOTAConfiguration/OTASecurity/OTASecurity.html is assuming the endpoint has unique credentials assigned by the network admin to authenticate to the network and vice-versa to install the profile. The network admin has also provided the enroll URL to the user and requires local CA installation. The delivery process uses SCEP and does not seem to support EST. If we complicate the on-boarding in home deployments and increase human interaction, I am afraid it will not fly. > > > We /could/ standardize what the profile looks like, I guess. >> > > Yes, it will help solve the problem in certain scenarios like Enterprise > networks for Apple devices. I have not looked into OTA for other operatin= g > systems. > > > If the device ecosystem provides some sort of parental control model, the= n > this should work for any user of such a device, not just enterprise users= . > The DoH server in this case would be the solution provider=E2=80=99s DoH = server, > not the local network DoH server. > Two types of parent controls are widely deployed today (1) DNS firewall in the home router or ISP filtering domains (2) setting parental control on the device itself. What solution provider are you referring to ? -Tiru > > --000000000000bb459805abb64e10 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, 30 Jul 2020 at 14:08, Ted Lemon &= lt;mellon@fugue.com> wrote:
<= /div>
On Jul 30, 2020, at 9:57 A= M, tirumal reddy <kondtir@gmail.com> wrote:
Yes, th= e on-boarding process of BYOD in Enterprise networks allows the user to aut= henticate to the directory service and vice-versa, and then the configurati= on profile is installed on the endpoint, see=C2=A0https= ://developer.apple.com/library/archive/documentation/NetworkingInternet/Con= ceptual/iPhoneOTAConfiguration/OTASecurity/OTASecurity.html=C2=A0for mo= re details.
=C2=A0=
I don=E2= =80=99t think there=E2=80=99s a way for the IETF to standardize this proces= s=E2=80=94it=E2=80=99s going to be specific to the operating system or ecos= ystem.

Agreed, my question is = how do we get this delivery mechanism to work in a home network ?

As I said, it=E2=80=99s going to = be specific to the operating system, so we can=E2=80=99t do it=E2=80=94it= =E2=80=99s not our job. That doesn=E2=80=99t mean it can=E2=80=99t be done.= The Apple solution is an example of it being done, although a bit more all= -singing, all-dancing than we are talking about here.

The problem is not with operating systems but the pr= ocedure to on-board/bootstrap devices, it is different in a Home network co= mpared to an Enterprise network.=C2=A0

The bootstr= apping process in https://developer.apple.com/library/archive/documentati= on/NetworkingInternet/Conceptual/iPhoneOTAConfiguration/OTASecurity/OTASecu= rity.html is assuming the endpoint has unique credentials assigned by t= he network admin to authenticate to the network and vice-versa to install t= he profile. The network admin has also provided the enroll URL to the user = and requires local CA installation. The delivery process uses SCEP and does= not seem to support EST.=C2=A0

If we complicate t= he on-boarding in home deployments and increase human interaction, I am afr= aid it will not fly.
=C2=A0
=C2=A0
=
We /could/ standardi= ze what the profile looks like, I guess.

<= /div>
Yes, it will help solve the problem in certain scenarios like Ent= erprise networks for Apple devices. I have not looked into OTA for other=20 operating systems.

If the devi= ce ecosystem provides some sort of parental control model, then this should= work for any user of such a device, not just enterprise users. The DoH ser= ver in this case would be the solution provider=E2=80=99s DoH server, not t= he local network DoH server.

Tw= o types of parent controls are widely deployed today (1) DNS firewall in th= e home router or ISP filtering domains (2) setting parental control on the = device itself.

What solution provider are you refe= rring to ?

-Tiru=C2=A0
= =C2=A0
--000000000000bb459805abb64e10-- From nobody Thu Jul 30 23:21:04 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B65B3A0F18 for ; Thu, 30 Jul 2020 23:21:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c_eCVY8rj67u for ; Thu, 30 Jul 2020 23:21:00 -0700 (PDT) Received: from mail-io1-xd36.google.com (mail-io1-xd36.google.com [IPv6:2607:f8b0:4864:20::d36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D01703A0F1B for ; Thu, 30 Jul 2020 23:20:59 -0700 (PDT) Received: by mail-io1-xd36.google.com with SMTP id k23so30621747iom.10 for ; Thu, 30 Jul 2020 23:20:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=/S/KLgUp6z3rm6jBV9Qin+gK2Ib+1GmgLPgbtG6YEU0=; b=PWRzzA/KR0j73mUw6UVq1B9yFl0f6dDLAYuWE+kTVpsquS1C7+4Rx+jZCgTtv0Sprs +9vkCgbriOUtxb3EkJfP1Kp4xUntRu+n4BFv69NBmpgurLkyIYyIaX0H4GksNzftyBSx 1EKlViISLfnfbnDxD9NCINq0Dd2nBn39EeJNbLJRXrsIDVegEktAPLC4pJHW3madVgwO MAwXrvAyCDkKTTifQ8MzAoPOr1mPa/ay1A5GeqE4nJ8oEWejKyhFyNGK9Q6cL2EnP8/s nNlPaIQXI4YYta0ziLpD6U/tTcfE531a2sMqrFaf6rcKeafbrVj07erSMeEEdCmy+zJn LRnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=/S/KLgUp6z3rm6jBV9Qin+gK2Ib+1GmgLPgbtG6YEU0=; b=Ppi/x2d3T8PjqFrbJnLso1h0wXF78H4mQ0LSuc2Kg2lJSrYqpMxk8I8RKJQtA3vAI+ 8GbBGwfgQrGHueaa76aTVyv118e3gFbcvpzsd8EciMTVPQZCpByPqupSpJXxCaCJhmF/ NSNvItaHmZGv+dTNBkpB597LZQzRoX/GVRxAdRnBQtr3HA3gbfd3mxg1zTydBCjqhllh Pcma1hhqfzk9KQM/BoH3FDHjKMTBEajGSfzeLvTFv2fxC3vwrgwIJTaI25IjiTK39gPt a2XWikaiUD2x0Jpws6eI8/GdpHk7kKc1LbgAT++ary3+2FZDWs9yHDOWFzQV30Slga4K gM+g== X-Gm-Message-State: AOAM530ETdgkzCBJYTZ0lUW9mkEppbn7R8uaRi4FI7V3LoKL2KLSju9k kBX35WWD+g7HTvnUAAdto9whZ0cYeECoyQr5maQ= X-Google-Smtp-Source: ABdhPJxwzW1UqnzuYTMQ4kbhqMYKwLc8L+0YptiN/TAlP0x3TeOuYIabI5Sw5JuudCuaFbFw7fgDhZsNtBu0NMfwPsU= X-Received: by 2002:a6b:f014:: with SMTP id w20mr2195378ioc.21.1596176458204; Thu, 30 Jul 2020 23:20:58 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> <20200730132857.6MGkL%steffen@sdaoden.eu> In-Reply-To: <20200730132857.6MGkL%steffen@sdaoden.eu> From: tirumal reddy Date: Fri, 31 Jul 2020 06:20:46 +0000 Message-ID: To: tirumal reddy , "Chris Box (BT)" , Tommy Jensen , Andrew Campling , ADD Mailing list , Ted Lemon , Rob Sayre , Steffen Nurpmeso Content-Type: multipart/alternative; boundary="000000000000ca4c8c05abb6ca9e" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jul 2020 06:21:03 -0000 --000000000000ca4c8c05abb6ca9e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, 30 Jul 2020 at 13:28, Steffen Nurpmeso wrote: > tirumal reddy wrote in > : > |Hi Chris, > | > |Good points, please see inline > | > |On Thu, 30 Jul 2020 at 06:00, Chris Box (BT) > |wrote: > | > |> Rob you appear to be saying you don=E2=80=99t need such features to s= ecure a > home > |> network, but I would certainly appreciate having Tiru=E2=80=99s (a) t= o (e) \ > |> deployed > |> in my house. I don=E2=80=99t want the smart TV equipped with micropho= ne and \ > |> webcam > |> to be remotely compromised, nor any other device. Without such > |> network-level control, enabled by standards, my only defence is to > |> physically unplug the TV from the network when not in use. > |> > | > |> Following Eva=E2=80=99s talk in HRPC, I=E2=80=99ll put myself in the = shoes of a > dissident > |> in a hostile regime. In such a case I would feel even greater need \ > |> for such > |> security. Of course I would choose my security supplier carefully, \ > |> and not > |> one aligned to the regime. I then need one or two devices that route > |> through Tor. > |> > |> I fully agree the challenge is to distinguish legitimate network > signals > |> from those of an attacker. Robustly identifying who they came from is > |> non-trivial, but hopefully not impossible? > |> > | > |Yes, identifying the trustworthiness of the peer is discussed in RATS W= G > |(see https://datatracker.ietf.org/wg/rats/about/). Remote attestation > |procedures (RATS) enable relying parties to establish a level of > confidence > |in the trustworthiness of remote system components through the creation > of > |attestation evidence by remote system components and a processing > |chain towards the relying party. A relying party can then decide whethe= r > |to consider a remote system component trustworthy or not. > | > |The claims used as evidence and attestation for DNS server is discussed > in > |https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-04. > > I personally do not get what yet another line of authorities > transported via JSON encoded structures fetched via another DNS > record that just exposes that JSON structure gives the world anew. > RATS allows the attestation to be represented in JSON or CBOR (see https://tools.ietf.org/html/draft-ietf-rats-eat-03#section-1.1). The PAT object is retrieved using RESINFO RRtype ( https://tools.ietf.org/html/draft-pp-add-resinfo-01) and it uses JSON to return the resolver information. > > Indirection may make everything possible, but, i mean, to me the > key point of RFC 8572 for example is the > > 3.3 Ownership Voucher > [this] artifact is used to securely identify a device's owner, > as it is known to the manufacturer. The ownership voucher is > signed by the device's manufacturer. > > _If_ i can find my way home i can securely update myself, where > securely means manufacturer here. Great that standard CMS is > used. > https://tools.ietf.org/html/rfc8572 is specific to zero-touch provisioning of networking devices and IoT devices in Enterprise networks. The owner certificate can be used to validate the PAT signature (see the last paragraph https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-04#sect= ion-10 ). > > Even if DNSSEC [RFC6698] is used to authenticate the various DNS > resource records [.] the device cannot be sure that the domain > returned to it, e.g., from a DHCP server, belongs to its > rightful owner. > > It then refers back to RFC 6763, DNS-based service discovery. > Which has really nice, easy to parse content, and does not use > JSON only to represent key/value pairs. (Why not a fixed CBOR > thing instead, they are talking maps at the moment, for example. > And can easily be converted back and forth to JSON while still > being parsed directly, as it is binary.) What is so wrong with > this service discovery thing, i think it could very well serve > additional things. But especially so if another registry is > introduced for the concept. RFC 8572 also says > > Using a DHCP server may be a compelling option for deployments > having existing DHCP infrastructure, as it enables a touchless > bootstrapping option that does not entail utilizing an > Internet-based resource hosted by a third party. > > A DHCP server is an untrusted source of bootstrapping data. > Thus, the information stored on the DHCP server either MUST be > signed or MUST be information that can be processed > provisionally (e.g., unsigned redirect information). > > I do not know (people can agree here), but if that could improve. > Also being x-rayed yesterday (untreated bike accident last > November) my pictures are now at healthdataspace.org even without > me agreeing with that, they have a German data security seal of > approval, but then it is just a QR-code and/or an access code > (alphanumeric and length of 10 or 12, iirc). > > It is not an option for a light bulb, but that thing surely > belongs behind a household router, and easy usable routers with > why not ample-style use cases would be great, imho. With a short > fingerprint printed on a device that shows up on that router, just > like for Bluetooth pairing. I could imagine people could get used > to that. (Especially with some kind of those terrible apps on > their smart phones which are linked to the "router" of the > household, then, so they get informed of that event. I think DHCP > even allows ident strings to be emitted from DHCP client to > server.) > There are several mechanisms to securely bootstrap IoT devices, you may want to look into the recently adopted draft https://tools.ietf.org/html/draft-sarikaya-t2trg-sbootstrapping-08 by T2TRG and within the scope of IETF is BRSKI and SZTP. Cheers, -Tiru > > Sorry, i do not seem to understand. > > --steffen > | > |Der Kragenbaer, The moon bear, > |der holt sich munter he cheerfully and one by one > |einen nach dem anderen runter wa.ks himself off > |(By Robert Gernhardt) > --000000000000ca4c8c05abb6ca9e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, 30 Jul 2020 at 13:28, Steffen Nur= pmeso <steffen@sdaoden.eu> = wrote:
tirumal reddy wrote in
=C2=A0<CAFpG3gftnqAFtBpqZuNddEKJdB1EDCEPANL= KqDex9yZ2ZM0EcQ@mail.gmail.com>:
=C2=A0|Hi Chris,
=C2=A0|
=C2=A0|Good points, please see inline
=C2=A0|
=C2=A0|On Thu, 30 Jul 2020 at 06:00, Chris Box (BT) <chris.box.ietf@gmail.com>=
=C2=A0|wrote:
=C2=A0|
=C2=A0|> Rob you appear to be saying you don=E2=80=99t need such feature= s to secure a home
=C2=A0|> network, but I would certainly appreciate having Tiru=E2=80=99s= (a) to (e) \
=C2=A0|> deployed
=C2=A0|> in my house. I don=E2=80=99t want the smart TV equipped with mi= crophone and \
=C2=A0|> webcam
=C2=A0|> to be remotely compromised, nor any other device. Without such<= br> =C2=A0|> network-level control, enabled by standards, my only defence is= to
=C2=A0|> physically unplug the TV from the network when not in use.
=C2=A0|>
=C2=A0|
=C2=A0|> Following Eva=E2=80=99s talk in HRPC, I=E2=80=99ll put myself i= n the shoes of a dissident
=C2=A0|> in a hostile regime. In such a case I would feel even greater n= eed \
=C2=A0|> for such
=C2=A0|> security. Of course I would choose my security supplier careful= ly, \
=C2=A0|> and not
=C2=A0|> one aligned to the regime. I then need one or two devices that = route
=C2=A0|> through Tor.
=C2=A0|>
=C2=A0|> I fully agree the challenge is to distinguish legitimate networ= k signals
=C2=A0|> from those of an attacker. Robustly identifying who they came f= rom is
=C2=A0|> non-trivial, but hopefully not impossible?
=C2=A0|>
=C2=A0|
=C2=A0|Yes, identifying the trustworthiness of the peer is discussed in RAT= S WG
=C2=A0|(see https://datatracker.ietf.org/wg/rats/about/). Remote attestation
=C2=A0|procedures (RATS) enable relying parties to establish a level of con= fidence
=C2=A0|in the trustworthiness of remote system components through the creat= ion of
=C2=A0|attestation evidence by remote system components and a processing =C2=A0|chain towards the relying party. A relying party can then decide whe= ther
=C2=A0|to consider a remote system component trustworthy or not.
=C2=A0|
=C2=A0|The claims used as evidence and attestation for DNS server is discus= sed in
=C2=A0|https://tools.ietf.org/= html/draft-reddy-add-server-policy-selection-04.

I personally do not get what yet another line of authorities
transported via JSON encoded structures fetched via another DNS
record that just exposes that JSON structure gives the world anew.

RATS allows the attestation to be represented i= n JSON or CBOR (see=C2=A0https://tools.ietf.org/html/draft-ietf-rats-eat-03= #section-1.1).=C2=A0 The PAT object is retrieved using=C2=A0RESINFO RRtype (https://tools.ietf.or= g/html/draft-pp-add-resinfo-01)=C2=A0and it uses JSON to return the resolver information.
=C2=A0

Indirection may make everything possible, but, i mean, to me the
key point of RFC 8572 for example is the

=C2=A0 3.3 Ownership Voucher
=C2=A0 [this] artifact is used to securely identify a device's owner, =C2=A0 as it is known to the manufacturer.=C2=A0 The ownership voucher is =C2=A0 signed by the device's manufacturer.

_If_ i can find my way home i can securely update myself, where
securely means manufacturer here.=C2=A0 Great that standard CMS is
used.

https://tools.ietf.org/html/rfc8572=C2=A0is specific to = zero-touch provisioning of networking devices and IoT devices in Enterprise= networks. The owner certificate can be used to validate the PAT signature = (see the last paragraph https://tools.ietf.org/html/draf= t-reddy-add-server-policy-selection-04#section-10).=C2=A0
=C2=A0

=C2=A0 Even if DNSSEC [RFC6698] is used to authenticate the various DNS
=C2=A0 resource records [.] the device cannot be sure that the domain
=C2=A0 returned to it, e.g., from a DHCP server, belongs to its
=C2=A0 rightful owner.

It then refers back to RFC 6763, DNS-based service discovery.
Which has really nice, easy to parse content, and does not use
JSON only to represent key/value pairs.=C2=A0 (Why not a fixed CBOR
thing instead, they are talking maps at the moment, for example.
And can easily be converted back and forth to JSON while still
being parsed directly, as it is binary.)=C2=A0 What is so wrong with
this service discovery thing, i think it could very well serve
additional things.=C2=A0 But especially so if another registry is
introduced for the concept.=C2=A0 RFC 8572 also says

=C2=A0 Using a DHCP server may be a compelling option for deployments
=C2=A0 having existing DHCP infrastructure, as it enables a touchless
=C2=A0 bootstrapping option that does not entail utilizing an
=C2=A0 Internet-based resource hosted by a third party.

=C2=A0 A DHCP server is an untrusted source of bootstrapping data.
=C2=A0 Thus, the information stored on the DHCP server either MUST be
=C2=A0 signed or MUST be information that can be processed
=C2=A0 provisionally (e.g., unsigned redirect information).

I do not know (people can agree here), but if that could improve.
Also being x-rayed yesterday (untreated bike accident last
November) my pictures are now at healthdataspace.org even without
me agreeing with that, they have a German data security seal of
approval, but then it is just a QR-code and/or an access code
(alphanumeric and length of 10 or 12, iirc).

It is not an option for a light bulb, but that thing surely
belongs behind a household router, and easy usable routers with
why not ample-style use cases would be great, imho.=C2=A0 With a short
fingerprint printed on a device that shows up on that router, just
like for Bluetooth pairing.=C2=A0 I could imagine people could get used
to that.=C2=A0 (Especially with some kind of those terrible apps on
their smart phones which are linked to the "router" of the
household, then, so they get informed of that event.=C2=A0 I think DHCP
even allows ident strings to be emitted from DHCP client to
server.)

There are several mechanisms t= o securely bootstrap IoT devices, you may want to look into the recently ad= opted draft=C2=A0https://tools.ietf.org/html/draft-sarikaya-t2trg-sboot= strapping-08=C2=A0by T2TRG and=C2=A0
within the scope of IETF= is BRSKI and SZTP.

Cheers,
-Tiru=C2=A0<= /div>

Sorry, i do not seem to understand.

--steffen
|
|Der Kragenbaer,=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 The= moon bear,
|der holt sich munter=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0he cheerfully= and one by one
|einen nach dem anderen runter=C2=A0 wa.ks himself off
|(By Robert Gernhardt)
--000000000000ca4c8c05abb6ca9e-- From nobody Fri Jul 31 01:13:25 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85DA13A1085 for ; Fri, 31 Jul 2020 01:13:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.103 X-Spam-Level: X-Spam-Status: No, score=-2.103 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TuWaaM_wnWQ4 for ; Fri, 31 Jul 2020 01:13:22 -0700 (PDT) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-eopbgr140058.outbound.protection.outlook.com [40.107.14.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7EB623A1082 for ; Fri, 31 Jul 2020 01:13:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=g+UhwChATVzJXBrM+vFtmPS+WTlYyy7lo+ZB0dY1G/TLlRIa3U0MZKoL0O6nnqlq+CNozMHTmPWgbQ+Yl9WXfvkN5PjlNEJrFt5PeHnC8npENotmwCGNMuwkhQDBiKZQjUtUifwdkKaHheYUDlSsjsg1s4qQqL171MIhQ+nis+6yCBSY7gf2xmYLtLVY8545SflvD31uFiFKIyjHhZfdnnXLsOWbg1R8+IwIDKSVbJBbRHUQ2GMHXa8jSUc+e4fnUKHjQN5R0JZBbFT9cK+WyovdXXkVCAWBZO6psfldmRPR43Ir3J0lVfr5aZ1cbEROWA5k9BxDIt2c8eBqPj1hdQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6dN+5yZSRA5M6CGpGY1mDFDp56yYYqDZXmQZoHHrgIY=; b=P2FVYVAJpfJYPBLjWmuY3fQJxmxsftUdVBavehyzRIZIXQklVy2bU3IBFfeJzvuNszqTMv+OolzVBDUev9TtiwyOYMrypDeBOXbhMU9YVmuMnLO6j4sVO3APkt9h5QNti7LQDNsumzYjMl00e7xIpuymfF4E0DOZGeIQ+EU/MGkZ8MCPk7wwC5axKAqL+1NCYAgSLIgcXlvvppZxkVGnrDLKIwkhpnCHtT6qAPG2UAk9LGjY+16KDXgWIk02i4mzAMhBbpqhkEn0IuddWJf8DAy//joviY3vgnPMU+4mOKTtPULxunM0YaTzwoQx75pyXXyOB4SKpQzX7qcVLh8Zxw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6dN+5yZSRA5M6CGpGY1mDFDp56yYYqDZXmQZoHHrgIY=; b=oJrkAXYZm3r6pE5KQ27ZybHYJSohOFJv2OPiUd8zAuMOKoMOO4EZ/ti2WbjNizlSxSNs4pHipVwBt8b7a9vDGiHnMDqxIyeiEG3FwbtBdJ0yrpDElZqAbbIu+4w4TcInoo6E/XM4jQcLn8flDYrC1Phr2QePXeLZgiDrqfHPFws= Received: from HE1PR07MB3386.eurprd07.prod.outlook.com (2603:10a6:7:2d::25) by HE1PR07MB4155.eurprd07.prod.outlook.com (2603:10a6:7:98::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3239.9; Fri, 31 Jul 2020 08:13:11 +0000 Received: from HE1PR07MB3386.eurprd07.prod.outlook.com ([fe80::e01c:9809:43db:67d3]) by HE1PR07MB3386.eurprd07.prod.outlook.com ([fe80::e01c:9809:43db:67d3%6]) with mapi id 15.20.3239.020; Fri, 31 Jul 2020 08:13:11 +0000 From: Mohit Sethi M To: tirumal reddy , "Chris Box (BT)" , Tommy Jensen , Andrew Campling , ADD Mailing list , Ted Lemon , Rob Sayre , Steffen Nurpmeso Thread-Topic: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWZxJtSVhzWvLyv0ioNm43LMOPEg== Date: Fri, 31 Jul 2020 08:13:11 +0000 Message-ID: <73f8a8a4-7ab9-48b0-da53-ca5c271b3fff@ericsson.com> References: <3954080.qUnaP1aulD@linux-9daj> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> <20200730132857.6MGkL%steffen@sdaoden.eu> In-Reply-To: <20200730132857.6MGkL%steffen@sdaoden.eu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [2001:14bb:150:b8c:83de:5051:e943:c8b1] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 81fd898a-1a45-426b-64b2-08d83529910f x-ms-traffictypediagnostic: HE1PR07MB4155: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: Kl6wxGGi0D8HNwdUfytA7YmiLtzOrbtVFqcylKNgBwwvW37jPDucy/dryIvUI1Hahy4EadfyF9+niGVg6YFFHVBLcUXTbvw+hTK3hXILHH7x+fnEWeBE5XcUcafyEazb59m9ZyZjSjhFkChuFOGYrqWLMlmH5JIj856I2NrDcPbUJzdDvKkVXC1Jqosjjis9VM6gRhNB0ElmUjU+cPU12z7VIrOYegLdD1/lJ1ZIybl1GtOPCExcB8VM4jQDNU+o06B5J2tpHnXQ8lXSSi4OJpaUhChy5R5gfA32oP6y7lcTyzg2h8ZDDZ9odQ0bC7DkOK005LKMywJqPdlsVDpm0A4u3skV7fGZcsuSy985oLrVfT8D0Yh1zaqSij4W897jCFOiDsXCqHg1Ig3M7oa2Cl9wf5qmYDsR1WZKjbUdQLR0WI582tqMST+F/HXROfK1ZtxPVqH46LwNauvVkfnU6w== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:HE1PR07MB3386.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(376002)(39860400002)(396003)(346002)(366004)(136003)(15650500001)(316002)(2906002)(110136005)(36756003)(6486002)(6512007)(8936002)(8676002)(53546011)(6506007)(31686004)(186003)(966005)(66946007)(5660300002)(64756008)(76116006)(478600001)(66476007)(66556008)(66574015)(2616005)(66446008)(83380400001)(71200400001)(31696002)(86362001)(43740500002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: AZyN8UQ8cIjvi1ivGLeRcSW+6tgk8BS9SHVRPIslE1f5W4RlAb4wBBb8usgNMsDxqXWbKFWjwtOTeCYf8uBj7L0HfhTZHx/YKru2pxEI1hm+BmtY0CXi1unIPCnn1Hpm99zXSE3NF032lQTMc3scapwIRkuDQL9PIf6QTDUvpTxv1Q9x95NgKYxwdYqhV76ie4TPuwXyLtWf9JDzrQWnDz0cjTxV3BVRoIJTIyJeAkdJuxl4gP5Vq8jWHoCirJDyGYywcjHxsjqX3+CLpXAbeOI7NGOX8fCc0I8uJqEhjM/3XCiA0Fi33vtJJzCcnVv77e1XrFXghIf3rQLUtmmTGTq4+eF2+btz/wubsFXSkNchB7y51ozlIixKPBSq06dbT8A0miJm1fXOjoEreK64+bcYJAdXxBXYu/VltbhcQHMR5r4YK4pXlAqIt/WJO/MF3bXRayTrGAwdAgXAktcQ7I5DCgsgsvh7e91/3eUyeyd9ksM5Tj+utocJCyx8Qw48y1Tbc8ubm2mSjHFT3y4BYezArwMXdF2j8ftB7b7D7xdbEsUEaJc15enK0G34L9CDbhHkHTzbnX3IOWB/Ze/16uhus2iCJFD8VmORQIWkyvhxli1FAEgbeTQTdVLjHp6Nq6tq+5HD8jykbTtz10YmztR7A8zcxLU0E6vnHHMx1v7AJWsE/4xgMnfnO+4xJfwQDlgDY3w0/C4JXX5YpEnw/Q== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: HE1PR07MB3386.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 81fd898a-1a45-426b-64b2-08d83529910f X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Jul 2020 08:13:11.4722 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 8XPK0ssYJvTAH4249+gDW3b4xmhx721jMn1G88XVviTEjdRVg44eoQF8eQzF+H4OB+hmahQj38tOeD4C+NjIVfjkUTOs48nMAvpmfXiHkd8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB4155 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jul 2020 08:13:24 -0000 SGkgU3RlZmZlbiwNCg0KSW4tbGluZS4NCg0KT24gNy8zMC8yMCA0OjI4IFBNLCBTdGVmZmVuIE51 cnBtZXNvIHdyb3RlOg0KPiB0aXJ1bWFsIHJlZGR5IHdyb3RlIGluDQo+ICAgPENBRnBHM2dmdG5x QUZ0QnBxWnVOZGRFS0pkQjFFRENFUEFOTEtxRGV4OXlaMlpNMEVjUUBtYWlsLmdtYWlsLmNvbT46 DQo+ICAgfEhpIENocmlzLA0KPiAgIHwNCj4gICB8R29vZCBwb2ludHMsIHBsZWFzZSBzZWUgaW5s aW5lDQo+ICAgfA0KPiAgIHxPbiBUaHUsIDMwIEp1bCAyMDIwIGF0IDA2OjAwLCBDaHJpcyBCb3gg KEJUKSA8Y2hyaXMuYm94LmlldGZAZ21haWwuY29tPg0KPiAgIHx3cm90ZToNCj4gICB8DQo+ICAg fD4gUm9iIHlvdSBhcHBlYXIgdG8gYmUgc2F5aW5nIHlvdSBkb27igJl0IG5lZWQgc3VjaCBmZWF0 dXJlcyB0byBzZWN1cmUgYSBob21lDQo+ICAgfD4gbmV0d29yaywgYnV0IEkgd291bGQgY2VydGFp bmx5IGFwcHJlY2lhdGUgaGF2aW5nIFRpcnXigJlzIChhKSB0byAoZSkgXA0KPiAgIHw+IGRlcGxv eWVkDQo+ICAgfD4gaW4gbXkgaG91c2UuIEkgZG9u4oCZdCB3YW50IHRoZSBzbWFydCBUViBlcXVp cHBlZCB3aXRoIG1pY3JvcGhvbmUgYW5kIFwNCj4gICB8PiB3ZWJjYW0NCj4gICB8PiB0byBiZSBy ZW1vdGVseSBjb21wcm9taXNlZCwgbm9yIGFueSBvdGhlciBkZXZpY2UuIFdpdGhvdXQgc3VjaA0K PiAgIHw+IG5ldHdvcmstbGV2ZWwgY29udHJvbCwgZW5hYmxlZCBieSBzdGFuZGFyZHMsIG15IG9u bHkgZGVmZW5jZSBpcyB0bw0KPiAgIHw+IHBoeXNpY2FsbHkgdW5wbHVnIHRoZSBUViBmcm9tIHRo ZSBuZXR3b3JrIHdoZW4gbm90IGluIHVzZS4NCj4gICB8Pg0KPiAgIHwNCj4gICB8PiBGb2xsb3dp bmcgRXZh4oCZcyB0YWxrIGluIEhSUEMsIEnigJlsbCBwdXQgbXlzZWxmIGluIHRoZSBzaG9lcyBv ZiBhIGRpc3NpZGVudA0KPiAgIHw+IGluIGEgaG9zdGlsZSByZWdpbWUuIEluIHN1Y2ggYSBjYXNl IEkgd291bGQgZmVlbCBldmVuIGdyZWF0ZXIgbmVlZCBcDQo+ICAgfD4gZm9yIHN1Y2gNCj4gICB8 PiBzZWN1cml0eS4gT2YgY291cnNlIEkgd291bGQgY2hvb3NlIG15IHNlY3VyaXR5IHN1cHBsaWVy IGNhcmVmdWxseSwgXA0KPiAgIHw+IGFuZCBub3QNCj4gICB8PiBvbmUgYWxpZ25lZCB0byB0aGUg cmVnaW1lLiBJIHRoZW4gbmVlZCBvbmUgb3IgdHdvIGRldmljZXMgdGhhdCByb3V0ZQ0KPiAgIHw+ IHRocm91Z2ggVG9yLg0KPiAgIHw+DQo+ICAgfD4gSSBmdWxseSBhZ3JlZSB0aGUgY2hhbGxlbmdl IGlzIHRvIGRpc3Rpbmd1aXNoIGxlZ2l0aW1hdGUgbmV0d29yayBzaWduYWxzDQo+ICAgfD4gZnJv bSB0aG9zZSBvZiBhbiBhdHRhY2tlci4gUm9idXN0bHkgaWRlbnRpZnlpbmcgd2hvIHRoZXkgY2Ft ZSBmcm9tIGlzDQo+ICAgfD4gbm9uLXRyaXZpYWwsIGJ1dCBob3BlZnVsbHkgbm90IGltcG9zc2li bGU/DQo+ICAgfD4NCj4gICB8DQo+ICAgfFllcywgaWRlbnRpZnlpbmcgdGhlIHRydXN0d29ydGhp bmVzcyBvZiB0aGUgcGVlciBpcyBkaXNjdXNzZWQgaW4gUkFUUyBXRw0KPiAgIHwoc2VlIGh0dHBz Oi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvd2cvcmF0cy9hYm91dC8pLiBSZW1vdGUgYXR0ZXN0YXRp b24NCj4gICB8cHJvY2VkdXJlcyAoUkFUUykgZW5hYmxlIHJlbHlpbmcgcGFydGllcyB0byBlc3Rh Ymxpc2ggYSBsZXZlbCBvZiBjb25maWRlbmNlDQo+ICAgfGluIHRoZSB0cnVzdHdvcnRoaW5lc3Mg b2YgcmVtb3RlIHN5c3RlbSBjb21wb25lbnRzIHRocm91Z2ggdGhlIGNyZWF0aW9uIG9mDQo+ICAg fGF0dGVzdGF0aW9uIGV2aWRlbmNlIGJ5IHJlbW90ZSBzeXN0ZW0gY29tcG9uZW50cyBhbmQgYSBw cm9jZXNzaW5nDQo+ICAgfGNoYWluIHRvd2FyZHMgdGhlIHJlbHlpbmcgcGFydHkuIEEgcmVseWlu ZyBwYXJ0eSBjYW4gdGhlbiBkZWNpZGUgd2hldGhlcg0KPiAgIHx0byBjb25zaWRlciBhIHJlbW90 ZSBzeXN0ZW0gY29tcG9uZW50IHRydXN0d29ydGh5IG9yIG5vdC4NCj4gICB8DQo+ICAgfFRoZSBj bGFpbXMgdXNlZCBhcyBldmlkZW5jZSBhbmQgYXR0ZXN0YXRpb24gZm9yIEROUyBzZXJ2ZXIgaXMg ZGlzY3Vzc2VkIGluDQo+ICAgfGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1yZWRk eS1hZGQtc2VydmVyLXBvbGljeS1zZWxlY3Rpb24tMDQuDQo+DQo+IEkgcGVyc29uYWxseSBkbyBu b3QgZ2V0IHdoYXQgeWV0IGFub3RoZXIgbGluZSBvZiBhdXRob3JpdGllcw0KPiB0cmFuc3BvcnRl ZCB2aWEgSlNPTiBlbmNvZGVkIHN0cnVjdHVyZXMgZmV0Y2hlZCB2aWEgYW5vdGhlciBETlMNCj4g cmVjb3JkIHRoYXQganVzdCBleHBvc2VzIHRoYXQgSlNPTiBzdHJ1Y3R1cmUgZ2l2ZXMgdGhlIHdv cmxkIGFuZXcuDQo+DQo+IEluZGlyZWN0aW9uIG1heSBtYWtlIGV2ZXJ5dGhpbmcgcG9zc2libGUs IGJ1dCwgaSBtZWFuLCB0byBtZSB0aGUNCj4ga2V5IHBvaW50IG9mIFJGQyA4NTcyIGZvciBleGFt cGxlIGlzIHRoZQ0KPg0KPiAgICAzLjMgT3duZXJzaGlwIFZvdWNoZXINCj4gICAgW3RoaXNdIGFy dGlmYWN0IGlzIHVzZWQgdG8gc2VjdXJlbHkgaWRlbnRpZnkgYSBkZXZpY2UncyBvd25lciwNCj4g ICAgYXMgaXQgaXMga25vd24gdG8gdGhlIG1hbnVmYWN0dXJlci4gIFRoZSBvd25lcnNoaXAgdm91 Y2hlciBpcw0KPiAgICBzaWduZWQgYnkgdGhlIGRldmljZSdzIG1hbnVmYWN0dXJlci4NCj4NCj4g X0lmXyBpIGNhbiBmaW5kIG15IHdheSBob21lIGkgY2FuIHNlY3VyZWx5IHVwZGF0ZSBteXNlbGYs IHdoZXJlDQo+IHNlY3VyZWx5IG1lYW5zIG1hbnVmYWN0dXJlciBoZXJlLiAgR3JlYXQgdGhhdCBz dGFuZGFyZCBDTVMgaXMNCj4gdXNlZC4NCj4NCj4gICAgRXZlbiBpZiBETlNTRUMgW1JGQzY2OThd IGlzIHVzZWQgdG8gYXV0aGVudGljYXRlIHRoZSB2YXJpb3VzIEROUw0KPiAgICByZXNvdXJjZSBy ZWNvcmRzIFsuXSB0aGUgZGV2aWNlIGNhbm5vdCBiZSBzdXJlIHRoYXQgdGhlIGRvbWFpbg0KPiAg ICByZXR1cm5lZCB0byBpdCwgZS5nLiwgZnJvbSBhIERIQ1Agc2VydmVyLCBiZWxvbmdzIHRvIGl0 cw0KPiAgICByaWdodGZ1bCBvd25lci4NCj4NCj4gSXQgdGhlbiByZWZlcnMgYmFjayB0byBSRkMg Njc2MywgRE5TLWJhc2VkIHNlcnZpY2UgZGlzY292ZXJ5Lg0KPiBXaGljaCBoYXMgcmVhbGx5IG5p Y2UsIGVhc3kgdG8gcGFyc2UgY29udGVudCwgYW5kIGRvZXMgbm90IHVzZQ0KPiBKU09OIG9ubHkg dG8gcmVwcmVzZW50IGtleS92YWx1ZSBwYWlycy4gIChXaHkgbm90IGEgZml4ZWQgQ0JPUg0KPiB0 aGluZyBpbnN0ZWFkLCB0aGV5IGFyZSB0YWxraW5nIG1hcHMgYXQgdGhlIG1vbWVudCwgZm9yIGV4 YW1wbGUuDQo+IEFuZCBjYW4gZWFzaWx5IGJlIGNvbnZlcnRlZCBiYWNrIGFuZCBmb3J0aCB0byBK U09OIHdoaWxlIHN0aWxsDQo+IGJlaW5nIHBhcnNlZCBkaXJlY3RseSwgYXMgaXQgaXMgYmluYXJ5 LikgIFdoYXQgaXMgc28gd3Jvbmcgd2l0aA0KPiB0aGlzIHNlcnZpY2UgZGlzY292ZXJ5IHRoaW5n LCBpIHRoaW5rIGl0IGNvdWxkIHZlcnkgd2VsbCBzZXJ2ZQ0KPiBhZGRpdGlvbmFsIHRoaW5ncy4g IEJ1dCBlc3BlY2lhbGx5IHNvIGlmIGFub3RoZXIgcmVnaXN0cnkgaXMNCj4gaW50cm9kdWNlZCBm b3IgdGhlIGNvbmNlcHQuICBSRkMgODU3MiBhbHNvIHNheXMNCj4NCj4gICAgVXNpbmcgYSBESENQ IHNlcnZlciBtYXkgYmUgYSBjb21wZWxsaW5nIG9wdGlvbiBmb3IgZGVwbG95bWVudHMNCj4gICAg aGF2aW5nIGV4aXN0aW5nIERIQ1AgaW5mcmFzdHJ1Y3R1cmUsIGFzIGl0IGVuYWJsZXMgYSB0b3Vj aGxlc3MNCj4gICAgYm9vdHN0cmFwcGluZyBvcHRpb24gdGhhdCBkb2VzIG5vdCBlbnRhaWwgdXRp bGl6aW5nIGFuDQo+ICAgIEludGVybmV0LWJhc2VkIHJlc291cmNlIGhvc3RlZCBieSBhIHRoaXJk IHBhcnR5Lg0KPg0KPiAgICBBIERIQ1Agc2VydmVyIGlzIGFuIHVudHJ1c3RlZCBzb3VyY2Ugb2Yg Ym9vdHN0cmFwcGluZyBkYXRhLg0KPiAgICBUaHVzLCB0aGUgaW5mb3JtYXRpb24gc3RvcmVkIG9u IHRoZSBESENQIHNlcnZlciBlaXRoZXIgTVVTVCBiZQ0KPiAgICBzaWduZWQgb3IgTVVTVCBiZSBp bmZvcm1hdGlvbiB0aGF0IGNhbiBiZSBwcm9jZXNzZWQNCj4gICAgcHJvdmlzaW9uYWxseSAoZS5n LiwgdW5zaWduZWQgcmVkaXJlY3QgaW5mb3JtYXRpb24pLg0KPg0KPiBJIGRvIG5vdCBrbm93IChw ZW9wbGUgY2FuIGFncmVlIGhlcmUpLCBidXQgaWYgdGhhdCBjb3VsZCBpbXByb3ZlLg0KPiBBbHNv IGJlaW5nIHgtcmF5ZWQgeWVzdGVyZGF5ICh1bnRyZWF0ZWQgYmlrZSBhY2NpZGVudCBsYXN0DQo+ IE5vdmVtYmVyKSBteSBwaWN0dXJlcyBhcmUgbm93IGF0IGhlYWx0aGRhdGFzcGFjZS5vcmcgZXZl biB3aXRob3V0DQo+IG1lIGFncmVlaW5nIHdpdGggdGhhdCwgdGhleSBoYXZlIGEgR2VybWFuIGRh dGEgc2VjdXJpdHkgc2VhbCBvZg0KPiBhcHByb3ZhbCwgYnV0IHRoZW4gaXQgaXMganVzdCBhIFFS LWNvZGUgYW5kL29yIGFuIGFjY2VzcyBjb2RlDQo+IChhbHBoYW51bWVyaWMgYW5kIGxlbmd0aCBv ZiAxMCBvciAxMiwgaWlyYykuDQo+DQo+IEl0IGlzIG5vdCBhbiBvcHRpb24gZm9yIGEgbGlnaHQg YnVsYiwgYnV0IHRoYXQgdGhpbmcgc3VyZWx5DQo+IGJlbG9uZ3MgYmVoaW5kIGEgaG91c2Vob2xk IHJvdXRlciwgYW5kIGVhc3kgdXNhYmxlIHJvdXRlcnMgd2l0aA0KPiB3aHkgbm90IGFtcGxlLXN0 eWxlIHVzZSBjYXNlcyB3b3VsZCBiZSBncmVhdCwgaW1oby4gIFdpdGggYSBzaG9ydA0KPiBmaW5n ZXJwcmludCBwcmludGVkIG9uIGEgZGV2aWNlIHRoYXQgc2hvd3MgdXAgb24gdGhhdCByb3V0ZXIs IGp1c3QNCj4gbGlrZSBmb3IgQmx1ZXRvb3RoIHBhaXJpbmcuICBJIGNvdWxkIGltYWdpbmUgcGVv cGxlIGNvdWxkIGdldCB1c2VkDQo+IHRvIHRoYXQuICAoRXNwZWNpYWxseSB3aXRoIHNvbWUga2lu ZCBvZiB0aG9zZSB0ZXJyaWJsZSBhcHBzIG9uDQo+IHRoZWlyIHNtYXJ0IHBob25lcyB3aGljaCBh cmUgbGlua2VkIHRvIHRoZSAicm91dGVyIiBvZiB0aGUNCj4gaG91c2Vob2xkLCB0aGVuLCBzbyB0 aGV5IGdldCBpbmZvcm1lZCBvZiB0aGF0IGV2ZW50LiAgSSB0aGluayBESENQDQo+IGV2ZW4gYWxs b3dzIGlkZW50IHN0cmluZ3MgdG8gYmUgZW1pdHRlZCBmcm9tIERIQ1AgY2xpZW50IHRvDQo+IHNl cnZlci4pDQoNCllvdSBtaWdodCBmaW5kIHRoaXMgdXNlZnVsOiANCmh0dHBzOi8vdG9vbHMuaWV0 Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLWVtdS1lYXAtbm9vYi0wMS4gU3VyZSBpdCB1c2VzIA0KRUFQ LCBidXQgaXQgaXMgYWJvdXQgdGltZSB3ZSBtb3ZlIHRvIGJldHRlciBzZWN1cml0eSBwcm90b2Nv bHMgKHJhdGhlciANCnRoYW4gcmVseWluZyBvbiBuZXR3b3JrLXdpZGUgc2hhcmVkIHNlY3JldHMp LiBFQVAgbmF0dXJhbGx5IGFsc28gYWxsb3dzIA0KeW91IHRvIHJ1biB0aGUgc2VydmVyIGluIHRo ZSBob21lIHJvdXRlciBvciBpbiB0aGUgY2xvdWQgYW5kIGRvIGFsbCANCnNvcnRzIG9mIGZlZGVy YXRpb24vcm9hbWluZyAoc3VjaCBhcyBlZHVyb2FtKS4NCg0KSSB3b3VsZCBhbHNvIGFkZCB0aGF0 IHRoZSBtb3N0IGxpZ2h0IGJ1bGJzIGRvbid0IHNwZWFrIGRpcmVjdGx5IHRvIHRoZSANCmhvbWUg cm91dGVyIGFuZCBvZnRlbiBoYXZlIHRoZWlyIG93biBnYXRld2F5IChvciB3aGF0IFBoaWxpcHMg Y2FsbHMgYSANCmJyaWRnZSkgdG8gdHJhbnNsYXRlIHppZ2JlZSB0byBXaS1GaS9ldGhlcm5ldCBl dGMuDQoNCi0tTW9oaXQNCg0KPiBTb3JyeSwgaSBkbyBub3Qgc2VlbSB0byB1bmRlcnN0YW5kLg0K Pg0KPiAtLXN0ZWZmZW4NCj4gfA0KPiB8RGVyIEtyYWdlbmJhZXIsICAgICAgICAgICAgICAgIFRo ZSBtb29uIGJlYXIsDQo+IHxkZXIgaG9sdCBzaWNoIG11bnRlciAgICAgICAgICAgaGUgY2hlZXJm dWxseSBhbmQgb25lIGJ5IG9uZQ0KPiB8ZWluZW4gbmFjaCBkZW0gYW5kZXJlbiBydW50ZXIgIHdh LmtzIGhpbXNlbGYgb2ZmDQo+IHwoQnkgUm9iZXJ0IEdlcm5oYXJkdCkNCj4NCg== From nobody Fri Jul 31 01:13:51 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFD833A108E for ; Fri, 31 Jul 2020 01:13:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.102 X-Spam-Level: X-Spam-Status: No, score=-2.102 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jDN-mfSqnlIB for ; Fri, 31 Jul 2020 01:13:46 -0700 (PDT) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-eopbgr140051.outbound.protection.outlook.com [40.107.14.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E3BFF3A1087 for ; Fri, 31 Jul 2020 01:13:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=gKEbMDGNfHcFhtWyYAnsH46BnzSswHQi35XcZqn8zWByXR1GSDWfZ8zvtvs925UUFngjKCrtwXof30i9X3MHq7bBAgtDsG8kFt3rVt3XhxbwUnvO6txSy2HBXZ7/EB4uUKPZd+fOvPF46j44WkfQ0+kdlwfNiNxEozg7lMIcRtwdo5zaWvYv7rlC/ToUB3IglP4hMKC4eTEHFZFrdW9xvdRoGhhGD+sydGsJ/0meFxOqjFO8uZd/a6xIyw1R14WE4SSZtrc3ic9Yjih1yZOLe/sjsz4zOpI6AtRFRFf4QWSzBR7hXoVeh6Cxl6SqlMDob65SVz5VsYrLaOij/6t/lw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1z3hSWvTnJLQJp4M7YlNMraueXW4fAGh7wS2lAbGhSc=; b=PBn/aQVrzJmXAaHwXpbPgUsOmLlLdSeU1sF3pc7efeeZF3k1lRmwki/V7jNE50lnMW/YlQlwav9Z0mHptGdC4Q1X+f3HDK3G6/yltOzPusvuEKruhUgxZd0liXCA3+UMkUl3x8GACvAlz1fEqGqRnzwTgmCh0P0OaIglceCn0mcY+PYBUwz53L0mCKGFeHp90FO6kja2ZxA1LEFQ3ABp+irY7BIprBxu68FvfvG4Q5nkumiQM/mc/4BpnoqHjvqXB7fQc7ef/qfc9y2Cfpay/E8cKgUHdAuG6mhgjK1Nh25SPiVsI52HLhSQJBADfv0a5SPpoShu/nh4h2OsPnxoVw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1z3hSWvTnJLQJp4M7YlNMraueXW4fAGh7wS2lAbGhSc=; b=jSzZ9LCQOEm7pmgEaF6jH5qhLIIbvg5fWXKvFMePZ1S0NFLgLmrGjlKty7v2H+M94Rvr7W4zgZv4tp2WcOvbTMS3SR9weyRgrTO+SWWQgr08ZMcQGt5QK4bl3E34HbWAkVoSgMKcYt97YjQliCJybyOIKc8czDadHIu56yHHgGM= Received: from HE1PR07MB3386.eurprd07.prod.outlook.com (2603:10a6:7:2d::25) by HE1PR07MB4155.eurprd07.prod.outlook.com (2603:10a6:7:98::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3239.9; Fri, 31 Jul 2020 08:13:35 +0000 Received: from HE1PR07MB3386.eurprd07.prod.outlook.com ([fe80::e01c:9809:43db:67d3]) by HE1PR07MB3386.eurprd07.prod.outlook.com ([fe80::e01c:9809:43db:67d3%6]) with mapi id 15.20.3239.020; Fri, 31 Jul 2020 08:13:35 +0000 From: Mohit Sethi M To: tirumal reddy , "Chris Box (BT)" , Tommy Jensen , Andrew Campling , ADD Mailing list , Ted Lemon , Rob Sayre , Steffen Nurpmeso Thread-Topic: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt Thread-Index: AQHWZxJ8SVhzWvLyv0ioNm43LMOPEg== Date: Fri, 31 Jul 2020 08:13:35 +0000 Message-ID: <0587c41a-2b3d-b453-387a-abb8e867875e@ericsson.com> References: <3954080.qUnaP1aulD@linux-9daj> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> <20200730132857.6MGkL%steffen@sdaoden.eu> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [2001:14bb:150:b8c:83de:5051:e943:c8b1] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: bc73e879-c8f3-43d6-bb79-08d835299f86 x-ms-traffictypediagnostic: HE1PR07MB4155: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6430; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: aegsvi3RxXP/9JfiWAXapQY7hNPxLZhTYujhuq9RZcp0j/GeOH1yYjRku9OQnRqp7+LUxTKpSgXs5lKPQK4jHeMWCD+Y+HYFhxhWmoz/nDNsyogzhav5138AmeqHu+Tg7rwjF39GWwPyjP75z2Tyw5ol/l6+rpSHNwaifJ38GftWwEqrac0i8zyUnx/C6HqM42CXvV+IeQvBQDB/Tc6hIuqG57cV4rl0PPTBuD6RmNs0sgvY3KrMLzUk55n6qTaR82QZk/JZwJoPCh7kckwhesvwFd+g+KZASDyIFs4QgimDD9oHodqCi3qu4ly2vER7q8gFUquPn0mN00k4AScwTZSBuZEcqwNroHho/c9GJP1o2V+GzG58bAome6vQ213wQyU+52VgQrOV6QF9Fjq2A7OpN9iyyiHe+kA9XLDGwTBUWjg+vnljSQeNnGooRjhYQsZ5BNsWcFDNjO7yt82XNg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:HE1PR07MB3386.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(376002)(39860400002)(396003)(346002)(366004)(136003)(15650500001)(316002)(2906002)(110136005)(36756003)(6486002)(6512007)(8936002)(8676002)(53546011)(6506007)(31686004)(186003)(966005)(66946007)(5660300002)(64756008)(76116006)(478600001)(66476007)(66556008)(66574015)(2616005)(66446008)(83380400001)(166002)(71200400001)(31696002)(86362001)(43740500002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: YDC3WeKAFAOLYf99FhQDifoyB9rAbAZWr0h43WeVf8mlWZSv0SuTvUXwL3oc15geZuGpfZPCOox6vUPy5W7WwwewRv+5EAptn/fHuVl7IsymmDDm7qnpWgPQQC6b7ecNolNR5gKtYWPG9VbigrzUVAwOW+UUNXrSk9XrlOG2Zx/s91jZW6DfBQg1PfJXbuGl9TGZ2t7MMiqkE1xrdm9xqQartE1usxGTB6HsaU4u9d2NawscjJNjAArI5TaktMFb77NYlQD+DMXzAJUkk6c2VcniNUkz8680MhfHtPLBBqU/p1sg8gz33mojrWUWojoBxaCCmfkDsfItX/9L6clXKW8dvHk6s7QryHeGxupWxABkHU72ybgIW/Unw3eLbk+6rwxrEecY4Aa3Y9wE0/stX/G9+ql5ig2OPxDnHXZbFW07nXy2bdd4YBHTT0tVWpb+I5I8G6SPATYkAfqQSZyePvFvlv696PK1sqFo2C86i9uMQ0z8KhEVlqbdHAVwh6h4IoOxx8fnLlMuMsMsoJHaTITzcbdm+/Sw40lGNe8lE1ijIGwdpFu2Dssmy3HwmY9QWto8QBWdDJuTZzKuYUmxtN3/qpeyqIQJvZBm1os0dehFi5Y4JWe+jHotd1TarJlixG1L8ifiMONj+oIDofB4XmnTEJf30YJyRW9VOFd33QaFFZw3CwqQk3voAs3oxtYlKo4t9iJBo+yFnVlfVHNUxA== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_0587c41a2b3db453387aabb8e867875eericssoncom_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: HE1PR07MB3386.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: bc73e879-c8f3-43d6-bb79-08d835299f86 X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Jul 2020 08:13:35.8074 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: sgW8MwD9HdDqMV7vHIlGvrIkFbGYHYEtX3FHC5Pguv8MTHH49c37xODK2bd6VP1KlFAKG/jNUrN5v3w9Rxk3hTefztpNPoEhKuIy6QmrF1A= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB4155 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jul 2020 08:13:49 -0000 --_000_0587c41a2b3db453387aabb8e867875eericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgVGlydSwNCg0KaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXNhcmlrYXlhLXQy dHJnLXNib290c3RyYXBwaW5nLTA4IGlzbid0IGFkb3B0ZWQgYnkgVDJUUkcgeWV0LiBPZiBjb3Vy c2UgKGFzIGFuIGF1dGhvcikgaXQgd291bGQgYmUgbmljZS4gSXQgcHJvYmFibHkgcmVxdWlyZXMg YSBjb3VwbGUgb2YgaXRlcmF0aW9ucyBhbmQgcmV2aWV3cyBiZWZvcmUgaXQgY2FuIGJlIGNvbnNp ZGVyZWQgZm9yIGFkb3B0aW9uLg0KDQpJIHdvdWxkIGFsc28gYWRkIEVBUC1OT09CIHRvIHRoZSBs aXN0IChodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1lbXUtZWFwLW5vb2It MDEpLg0KDQotLU1vaGl0DQoNCk9uIDcvMzEvMjAgOToyMCBBTSwgdGlydW1hbCByZWRkeSB3cm90 ZToNCk9uIFRodSwgMzAgSnVsIDIwMjAgYXQgMTM6MjgsIFN0ZWZmZW4gTnVycG1lc28gPHN0ZWZm ZW5Ac2Rhb2Rlbi5ldTxtYWlsdG86c3RlZmZlbkBzZGFvZGVuLmV1Pj4gd3JvdGU6DQp0aXJ1bWFs IHJlZGR5IHdyb3RlIGluDQogPENBRnBHM2dmdG5xQUZ0QnBxWnVOZGRFS0pkQjFFRENFUEFOTEtx RGV4OXlaMlpNMEVjUUBtYWlsLmdtYWlsLmNvbTxtYWlsdG86Q0FGcEczZ2Z0bnFBRnRCcHFadU5k ZEVLSmRCMUVEQ0VQQU5MS3FEZXg5eVoyWk0wRWNRQG1haWwuZ21haWwuY29tPj46DQogfEhpIENo cmlzLA0KIHwNCiB8R29vZCBwb2ludHMsIHBsZWFzZSBzZWUgaW5saW5lDQogfA0KIHxPbiBUaHUs IDMwIEp1bCAyMDIwIGF0IDA2OjAwLCBDaHJpcyBCb3ggKEJUKSA8Y2hyaXMuYm94LmlldGZAZ21h aWwuY29tPG1haWx0bzpjaHJpcy5ib3guaWV0ZkBnbWFpbC5jb20+Pg0KIHx3cm90ZToNCiB8DQog fD4gUm9iIHlvdSBhcHBlYXIgdG8gYmUgc2F5aW5nIHlvdSBkb27igJl0IG5lZWQgc3VjaCBmZWF0 dXJlcyB0byBzZWN1cmUgYSBob21lDQogfD4gbmV0d29yaywgYnV0IEkgd291bGQgY2VydGFpbmx5 IGFwcHJlY2lhdGUgaGF2aW5nIFRpcnXigJlzIChhKSB0byAoZSkgXA0KIHw+IGRlcGxveWVkDQog fD4gaW4gbXkgaG91c2UuIEkgZG9u4oCZdCB3YW50IHRoZSBzbWFydCBUViBlcXVpcHBlZCB3aXRo IG1pY3JvcGhvbmUgYW5kIFwNCiB8PiB3ZWJjYW0NCiB8PiB0byBiZSByZW1vdGVseSBjb21wcm9t aXNlZCwgbm9yIGFueSBvdGhlciBkZXZpY2UuIFdpdGhvdXQgc3VjaA0KIHw+IG5ldHdvcmstbGV2 ZWwgY29udHJvbCwgZW5hYmxlZCBieSBzdGFuZGFyZHMsIG15IG9ubHkgZGVmZW5jZSBpcyB0bw0K IHw+IHBoeXNpY2FsbHkgdW5wbHVnIHRoZSBUViBmcm9tIHRoZSBuZXR3b3JrIHdoZW4gbm90IGlu IHVzZS4NCiB8Pg0KIHwNCiB8PiBGb2xsb3dpbmcgRXZh4oCZcyB0YWxrIGluIEhSUEMsIEnigJls bCBwdXQgbXlzZWxmIGluIHRoZSBzaG9lcyBvZiBhIGRpc3NpZGVudA0KIHw+IGluIGEgaG9zdGls ZSByZWdpbWUuIEluIHN1Y2ggYSBjYXNlIEkgd291bGQgZmVlbCBldmVuIGdyZWF0ZXIgbmVlZCBc DQogfD4gZm9yIHN1Y2gNCiB8PiBzZWN1cml0eS4gT2YgY291cnNlIEkgd291bGQgY2hvb3NlIG15 IHNlY3VyaXR5IHN1cHBsaWVyIGNhcmVmdWxseSwgXA0KIHw+IGFuZCBub3QNCiB8PiBvbmUgYWxp Z25lZCB0byB0aGUgcmVnaW1lLiBJIHRoZW4gbmVlZCBvbmUgb3IgdHdvIGRldmljZXMgdGhhdCBy b3V0ZQ0KIHw+IHRocm91Z2ggVG9yLg0KIHw+DQogfD4gSSBmdWxseSBhZ3JlZSB0aGUgY2hhbGxl bmdlIGlzIHRvIGRpc3Rpbmd1aXNoIGxlZ2l0aW1hdGUgbmV0d29yayBzaWduYWxzDQogfD4gZnJv bSB0aG9zZSBvZiBhbiBhdHRhY2tlci4gUm9idXN0bHkgaWRlbnRpZnlpbmcgd2hvIHRoZXkgY2Ft ZSBmcm9tIGlzDQogfD4gbm9uLXRyaXZpYWwsIGJ1dCBob3BlZnVsbHkgbm90IGltcG9zc2libGU/ DQogfD4NCiB8DQogfFllcywgaWRlbnRpZnlpbmcgdGhlIHRydXN0d29ydGhpbmVzcyBvZiB0aGUg cGVlciBpcyBkaXNjdXNzZWQgaW4gUkFUUyBXRw0KIHwoc2VlIGh0dHBzOi8vZGF0YXRyYWNrZXIu aWV0Zi5vcmcvd2cvcmF0cy9hYm91dC8pLiBSZW1vdGUgYXR0ZXN0YXRpb24NCiB8cHJvY2VkdXJl cyAoUkFUUykgZW5hYmxlIHJlbHlpbmcgcGFydGllcyB0byBlc3RhYmxpc2ggYSBsZXZlbCBvZiBj b25maWRlbmNlDQogfGluIHRoZSB0cnVzdHdvcnRoaW5lc3Mgb2YgcmVtb3RlIHN5c3RlbSBjb21w b25lbnRzIHRocm91Z2ggdGhlIGNyZWF0aW9uIG9mDQogfGF0dGVzdGF0aW9uIGV2aWRlbmNlIGJ5 IHJlbW90ZSBzeXN0ZW0gY29tcG9uZW50cyBhbmQgYSBwcm9jZXNzaW5nDQogfGNoYWluIHRvd2Fy ZHMgdGhlIHJlbHlpbmcgcGFydHkuIEEgcmVseWluZyBwYXJ0eSBjYW4gdGhlbiBkZWNpZGUgd2hl dGhlcg0KIHx0byBjb25zaWRlciBhIHJlbW90ZSBzeXN0ZW0gY29tcG9uZW50IHRydXN0d29ydGh5 IG9yIG5vdC4NCiB8DQogfFRoZSBjbGFpbXMgdXNlZCBhcyBldmlkZW5jZSBhbmQgYXR0ZXN0YXRp b24gZm9yIEROUyBzZXJ2ZXIgaXMgZGlzY3Vzc2VkIGluDQogfGh0dHBzOi8vdG9vbHMuaWV0Zi5v cmcvaHRtbC9kcmFmdC1yZWRkeS1hZGQtc2VydmVyLXBvbGljeS1zZWxlY3Rpb24tMDQuDQoNCkkg cGVyc29uYWxseSBkbyBub3QgZ2V0IHdoYXQgeWV0IGFub3RoZXIgbGluZSBvZiBhdXRob3JpdGll cw0KdHJhbnNwb3J0ZWQgdmlhIEpTT04gZW5jb2RlZCBzdHJ1Y3R1cmVzIGZldGNoZWQgdmlhIGFu b3RoZXIgRE5TDQpyZWNvcmQgdGhhdCBqdXN0IGV4cG9zZXMgdGhhdCBKU09OIHN0cnVjdHVyZSBn aXZlcyB0aGUgd29ybGQgYW5ldy4NCg0KUkFUUyBhbGxvd3MgdGhlIGF0dGVzdGF0aW9uIHRvIGJl IHJlcHJlc2VudGVkIGluIEpTT04gb3IgQ0JPUiAoc2VlIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcv aHRtbC9kcmFmdC1pZXRmLXJhdHMtZWF0LTAzI3NlY3Rpb24tMS4xKS4gIFRoZSBQQVQgb2JqZWN0 IGlzIHJldHJpZXZlZCB1c2luZyBSRVNJTkZPIFJSdHlwZSAoaHR0cHM6Ly90b29scy5pZXRmLm9y Zy9odG1sL2RyYWZ0LXBwLWFkZC1yZXNpbmZvLTAxKSBhbmQgaXQgdXNlcyBKU09OIHRvIHJldHVy biB0aGUgcmVzb2x2ZXIgaW5mb3JtYXRpb24uDQoNCg0KSW5kaXJlY3Rpb24gbWF5IG1ha2UgZXZl cnl0aGluZyBwb3NzaWJsZSwgYnV0LCBpIG1lYW4sIHRvIG1lIHRoZQ0Ka2V5IHBvaW50IG9mIFJG QyA4NTcyIGZvciBleGFtcGxlIGlzIHRoZQ0KDQogIDMuMyBPd25lcnNoaXAgVm91Y2hlcg0KICBb dGhpc10gYXJ0aWZhY3QgaXMgdXNlZCB0byBzZWN1cmVseSBpZGVudGlmeSBhIGRldmljZSdzIG93 bmVyLA0KICBhcyBpdCBpcyBrbm93biB0byB0aGUgbWFudWZhY3R1cmVyLiAgVGhlIG93bmVyc2hp cCB2b3VjaGVyIGlzDQogIHNpZ25lZCBieSB0aGUgZGV2aWNlJ3MgbWFudWZhY3R1cmVyLg0KDQpf SWZfIGkgY2FuIGZpbmQgbXkgd2F5IGhvbWUgaSBjYW4gc2VjdXJlbHkgdXBkYXRlIG15c2VsZiwg d2hlcmUNCnNlY3VyZWx5IG1lYW5zIG1hbnVmYWN0dXJlciBoZXJlLiAgR3JlYXQgdGhhdCBzdGFu ZGFyZCBDTVMgaXMNCnVzZWQuDQoNCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM4NTcy IGlzIHNwZWNpZmljIHRvIHplcm8tdG91Y2ggcHJvdmlzaW9uaW5nIG9mIG5ldHdvcmtpbmcgZGV2 aWNlcyBhbmQgSW9UIGRldmljZXMgaW4gRW50ZXJwcmlzZSBuZXR3b3Jrcy4gVGhlIG93bmVyIGNl cnRpZmljYXRlIGNhbiBiZSB1c2VkIHRvIHZhbGlkYXRlIHRoZSBQQVQgc2lnbmF0dXJlIChzZWUg dGhlIGxhc3QgcGFyYWdyYXBoIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1yZWRk eS1hZGQtc2VydmVyLXBvbGljeS1zZWxlY3Rpb24tMDQjc2VjdGlvbi0xMCkuDQoNCg0KDQogIEV2 ZW4gaWYgRE5TU0VDIFtSRkM2Njk4XSBpcyB1c2VkIHRvIGF1dGhlbnRpY2F0ZSB0aGUgdmFyaW91 cyBETlMNCiAgcmVzb3VyY2UgcmVjb3JkcyBbLl0gdGhlIGRldmljZSBjYW5ub3QgYmUgc3VyZSB0 aGF0IHRoZSBkb21haW4NCiAgcmV0dXJuZWQgdG8gaXQsIGUuZy4sIGZyb20gYSBESENQIHNlcnZl ciwgYmVsb25ncyB0byBpdHMNCiAgcmlnaHRmdWwgb3duZXIuDQoNCkl0IHRoZW4gcmVmZXJzIGJh Y2sgdG8gUkZDIDY3NjMsIEROUy1iYXNlZCBzZXJ2aWNlIGRpc2NvdmVyeS4NCldoaWNoIGhhcyBy ZWFsbHkgbmljZSwgZWFzeSB0byBwYXJzZSBjb250ZW50LCBhbmQgZG9lcyBub3QgdXNlDQpKU09O IG9ubHkgdG8gcmVwcmVzZW50IGtleS92YWx1ZSBwYWlycy4gIChXaHkgbm90IGEgZml4ZWQgQ0JP Ug0KdGhpbmcgaW5zdGVhZCwgdGhleSBhcmUgdGFsa2luZyBtYXBzIGF0IHRoZSBtb21lbnQsIGZv ciBleGFtcGxlLg0KQW5kIGNhbiBlYXNpbHkgYmUgY29udmVydGVkIGJhY2sgYW5kIGZvcnRoIHRv IEpTT04gd2hpbGUgc3RpbGwNCmJlaW5nIHBhcnNlZCBkaXJlY3RseSwgYXMgaXQgaXMgYmluYXJ5 LikgIFdoYXQgaXMgc28gd3Jvbmcgd2l0aA0KdGhpcyBzZXJ2aWNlIGRpc2NvdmVyeSB0aGluZywg aSB0aGluayBpdCBjb3VsZCB2ZXJ5IHdlbGwgc2VydmUNCmFkZGl0aW9uYWwgdGhpbmdzLiAgQnV0 IGVzcGVjaWFsbHkgc28gaWYgYW5vdGhlciByZWdpc3RyeSBpcw0KaW50cm9kdWNlZCBmb3IgdGhl IGNvbmNlcHQuICBSRkMgODU3MiBhbHNvIHNheXMNCg0KICBVc2luZyBhIERIQ1Agc2VydmVyIG1h eSBiZSBhIGNvbXBlbGxpbmcgb3B0aW9uIGZvciBkZXBsb3ltZW50cw0KICBoYXZpbmcgZXhpc3Rp bmcgREhDUCBpbmZyYXN0cnVjdHVyZSwgYXMgaXQgZW5hYmxlcyBhIHRvdWNobGVzcw0KICBib290 c3RyYXBwaW5nIG9wdGlvbiB0aGF0IGRvZXMgbm90IGVudGFpbCB1dGlsaXppbmcgYW4NCiAgSW50 ZXJuZXQtYmFzZWQgcmVzb3VyY2UgaG9zdGVkIGJ5IGEgdGhpcmQgcGFydHkuDQoNCiAgQSBESENQ IHNlcnZlciBpcyBhbiB1bnRydXN0ZWQgc291cmNlIG9mIGJvb3RzdHJhcHBpbmcgZGF0YS4NCiAg VGh1cywgdGhlIGluZm9ybWF0aW9uIHN0b3JlZCBvbiB0aGUgREhDUCBzZXJ2ZXIgZWl0aGVyIE1V U1QgYmUNCiAgc2lnbmVkIG9yIE1VU1QgYmUgaW5mb3JtYXRpb24gdGhhdCBjYW4gYmUgcHJvY2Vz c2VkDQogIHByb3Zpc2lvbmFsbHkgKGUuZy4sIHVuc2lnbmVkIHJlZGlyZWN0IGluZm9ybWF0aW9u KS4NCg0KSSBkbyBub3Qga25vdyAocGVvcGxlIGNhbiBhZ3JlZSBoZXJlKSwgYnV0IGlmIHRoYXQg Y291bGQgaW1wcm92ZS4NCkFsc28gYmVpbmcgeC1yYXllZCB5ZXN0ZXJkYXkgKHVudHJlYXRlZCBi aWtlIGFjY2lkZW50IGxhc3QNCk5vdmVtYmVyKSBteSBwaWN0dXJlcyBhcmUgbm93IGF0IGhlYWx0 aGRhdGFzcGFjZS5vcmc8aHR0cDovL2hlYWx0aGRhdGFzcGFjZS5vcmc+IGV2ZW4gd2l0aG91dA0K bWUgYWdyZWVpbmcgd2l0aCB0aGF0LCB0aGV5IGhhdmUgYSBHZXJtYW4gZGF0YSBzZWN1cml0eSBz ZWFsIG9mDQphcHByb3ZhbCwgYnV0IHRoZW4gaXQgaXMganVzdCBhIFFSLWNvZGUgYW5kL29yIGFu IGFjY2VzcyBjb2RlDQooYWxwaGFudW1lcmljIGFuZCBsZW5ndGggb2YgMTAgb3IgMTIsIGlpcmMp Lg0KDQpJdCBpcyBub3QgYW4gb3B0aW9uIGZvciBhIGxpZ2h0IGJ1bGIsIGJ1dCB0aGF0IHRoaW5n IHN1cmVseQ0KYmVsb25ncyBiZWhpbmQgYSBob3VzZWhvbGQgcm91dGVyLCBhbmQgZWFzeSB1c2Fi bGUgcm91dGVycyB3aXRoDQp3aHkgbm90IGFtcGxlLXN0eWxlIHVzZSBjYXNlcyB3b3VsZCBiZSBn cmVhdCwgaW1oby4gIFdpdGggYSBzaG9ydA0KZmluZ2VycHJpbnQgcHJpbnRlZCBvbiBhIGRldmlj ZSB0aGF0IHNob3dzIHVwIG9uIHRoYXQgcm91dGVyLCBqdXN0DQpsaWtlIGZvciBCbHVldG9vdGgg cGFpcmluZy4gIEkgY291bGQgaW1hZ2luZSBwZW9wbGUgY291bGQgZ2V0IHVzZWQNCnRvIHRoYXQu ICAoRXNwZWNpYWxseSB3aXRoIHNvbWUga2luZCBvZiB0aG9zZSB0ZXJyaWJsZSBhcHBzIG9uDQp0 aGVpciBzbWFydCBwaG9uZXMgd2hpY2ggYXJlIGxpbmtlZCB0byB0aGUgInJvdXRlciIgb2YgdGhl DQpob3VzZWhvbGQsIHRoZW4sIHNvIHRoZXkgZ2V0IGluZm9ybWVkIG9mIHRoYXQgZXZlbnQuICBJ IHRoaW5rIERIQ1ANCmV2ZW4gYWxsb3dzIGlkZW50IHN0cmluZ3MgdG8gYmUgZW1pdHRlZCBmcm9t IERIQ1AgY2xpZW50IHRvDQpzZXJ2ZXIuKQ0KDQpUaGVyZSBhcmUgc2V2ZXJhbCBtZWNoYW5pc21z IHRvIHNlY3VyZWx5IGJvb3RzdHJhcCBJb1QgZGV2aWNlcywgeW91IG1heSB3YW50IHRvIGxvb2sg aW50byB0aGUgcmVjZW50bHkgYWRvcHRlZCBkcmFmdCBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0 bWwvZHJhZnQtc2FyaWtheWEtdDJ0cmctc2Jvb3RzdHJhcHBpbmctMDggYnkgVDJUUkcgYW5kDQp3 aXRoaW4gdGhlIHNjb3BlIG9mIElFVEYgaXMgQlJTS0kgYW5kIFNaVFAuDQoNCkNoZWVycywNCi1U aXJ1DQoNClNvcnJ5LCBpIGRvIG5vdCBzZWVtIHRvIHVuZGVyc3RhbmQuDQoNCi0tc3RlZmZlbg0K fA0KfERlciBLcmFnZW5iYWVyLCAgICAgICAgICAgICAgICBUaGUgbW9vbiBiZWFyLA0KfGRlciBo b2x0IHNpY2ggbXVudGVyICAgICAgICAgICBoZSBjaGVlcmZ1bGx5IGFuZCBvbmUgYnkgb25lDQp8 ZWluZW4gbmFjaCBkZW0gYW5kZXJlbiBydW50ZXIgIHdhLmtzIGhpbXNlbGYgb2ZmDQp8KEJ5IFJv YmVydCBHZXJuaGFyZHQpDQoNCg0K --_000_0587c41a2b3db453387aabb8e867875eericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <7E23AD660251384C92974A534D01F3C6@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5Pg0KPHA+SGkgVGlydSw8 L3A+DQo8cD48YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtc2FyaWth eWEtdDJ0cmctc2Jvb3RzdHJhcHBpbmctMDgiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9k cmFmdC1zYXJpa2F5YS10MnRyZy1zYm9vdHN0cmFwcGluZy0wODwvYT4gaXNuJ3QgYWRvcHRlZCBi eSBUMlRSRyB5ZXQuIE9mIGNvdXJzZSAoYXMgYW4gYXV0aG9yKSBpdCB3b3VsZCBiZSBuaWNlLiBJ dCBwcm9iYWJseSByZXF1aXJlcyBhIGNvdXBsZSBvZiBpdGVyYXRpb25zDQogYW5kIHJldmlld3Mg YmVmb3JlIGl0IGNhbiBiZSBjb25zaWRlcmVkIGZvciBhZG9wdGlvbi4gPGJyPg0KPC9wPg0KPHA+ SSB3b3VsZCBhbHNvIGFkZCBFQVAtTk9PQiB0byB0aGUgbGlzdCAoPGEgbW96LWRvLW5vdC1zZW5k PSJ0cnVlIiBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1lbXUt ZWFwLW5vb2ItMDEiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLWVtdS1l YXAtbm9vYi0wMTwvYT4pLjwvcD4NCjxwPi0tTW9oaXQ8YnI+DQo8L3A+DQo8ZGl2IGNsYXNzPSJt b3otY2l0ZS1wcmVmaXgiPk9uIDcvMzEvMjAgOToyMCBBTSwgdGlydW1hbCByZWRkeSB3cm90ZTo8 YnI+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDpDQUZwRzNnZWhG SjhtdVpPRnA3UnJXQV85dE52NDMrOXpXakFfUDhPbjNjX01fbzVTTWdAbWFpbC5nbWFpbC5jb20i Pg0KPGRpdiBkaXI9Imx0ciI+DQo8ZGl2IGRpcj0ibHRyIj5PbiBUaHUsIDMwIEp1bCAyMDIwIGF0 IDEzOjI4LCBTdGVmZmVuIE51cnBtZXNvICZsdDs8YSBocmVmPSJtYWlsdG86c3RlZmZlbkBzZGFv ZGVuLmV1IiBtb3otZG8tbm90LXNlbmQ9InRydWUiPnN0ZWZmZW5Ac2Rhb2Rlbi5ldTwvYT4mZ3Q7 IHdyb3RlOjxicj4NCjwvZGl2Pg0KPGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPg0KPGJsb2NrcXVv dGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjBweCAwcHggMHB4DQogICAgICAg ICAgICAwLjhleDtib3JkZXItbGVmdDoxcHggc29saWQNCiAgICAgICAgICAgIHJnYigyMDQsMjA0 LDIwNCk7cGFkZGluZy1sZWZ0OjFleCI+DQp0aXJ1bWFsIHJlZGR5IHdyb3RlIGluPGJyPg0KJm5i c3A7Jmx0OzxhIGhyZWY9Im1haWx0bzpDQUZwRzNnZnRucUFGdEJwcVp1TmRkRUtKZEIxRURDRVBB TkxLcURleDl5WjJaTTBFY1FAbWFpbC5nbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIiBtb3otZG8t bm90LXNlbmQ9InRydWUiPkNBRnBHM2dmdG5xQUZ0QnBxWnVOZGRFS0pkQjFFRENFUEFOTEtxRGV4 OXlaMlpNMEVjUUBtYWlsLmdtYWlsLmNvbTwvYT4mZ3Q7Ojxicj4NCiZuYnNwO3xIaSBDaHJpcyw8 YnI+DQombmJzcDt8PGJyPg0KJm5ic3A7fEdvb2QgcG9pbnRzLCBwbGVhc2Ugc2VlIGlubGluZTxi cj4NCiZuYnNwO3w8YnI+DQombmJzcDt8T24gVGh1LCAzMCBKdWwgMjAyMCBhdCAwNjowMCwgQ2hy aXMgQm94IChCVCkgJmx0OzxhIGhyZWY9Im1haWx0bzpjaHJpcy5ib3guaWV0ZkBnbWFpbC5jb20i IHRhcmdldD0iX2JsYW5rIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPmNocmlzLmJveC5pZXRmQGdt YWlsLmNvbTwvYT4mZ3Q7PGJyPg0KJm5ic3A7fHdyb3RlOjxicj4NCiZuYnNwO3w8YnI+DQombmJz cDt8Jmd0OyBSb2IgeW91IGFwcGVhciB0byBiZSBzYXlpbmcgeW91IGRvbuKAmXQgbmVlZCBzdWNo IGZlYXR1cmVzIHRvIHNlY3VyZSBhIGhvbWU8YnI+DQombmJzcDt8Jmd0OyBuZXR3b3JrLCBidXQg SSB3b3VsZCBjZXJ0YWlubHkgYXBwcmVjaWF0ZSBoYXZpbmcgVGlydeKAmXMgKGEpIHRvIChlKSBc PGJyPg0KJm5ic3A7fCZndDsgZGVwbG95ZWQ8YnI+DQombmJzcDt8Jmd0OyBpbiBteSBob3VzZS4g SSBkb27igJl0IHdhbnQgdGhlIHNtYXJ0IFRWIGVxdWlwcGVkIHdpdGggbWljcm9waG9uZSBhbmQg XDxicj4NCiZuYnNwO3wmZ3Q7IHdlYmNhbTxicj4NCiZuYnNwO3wmZ3Q7IHRvIGJlIHJlbW90ZWx5 IGNvbXByb21pc2VkLCBub3IgYW55IG90aGVyIGRldmljZS4gV2l0aG91dCBzdWNoPGJyPg0KJm5i c3A7fCZndDsgbmV0d29yay1sZXZlbCBjb250cm9sLCBlbmFibGVkIGJ5IHN0YW5kYXJkcywgbXkg b25seSBkZWZlbmNlIGlzIHRvPGJyPg0KJm5ic3A7fCZndDsgcGh5c2ljYWxseSB1bnBsdWcgdGhl IFRWIGZyb20gdGhlIG5ldHdvcmsgd2hlbiBub3QgaW4gdXNlLjxicj4NCiZuYnNwO3wmZ3Q7PGJy Pg0KJm5ic3A7fDxicj4NCiZuYnNwO3wmZ3Q7IEZvbGxvd2luZyBFdmHigJlzIHRhbGsgaW4gSFJQ QywgSeKAmWxsIHB1dCBteXNlbGYgaW4gdGhlIHNob2VzIG9mIGEgZGlzc2lkZW50PGJyPg0KJm5i c3A7fCZndDsgaW4gYSBob3N0aWxlIHJlZ2ltZS4gSW4gc3VjaCBhIGNhc2UgSSB3b3VsZCBmZWVs IGV2ZW4gZ3JlYXRlciBuZWVkIFw8YnI+DQombmJzcDt8Jmd0OyBmb3Igc3VjaDxicj4NCiZuYnNw O3wmZ3Q7IHNlY3VyaXR5LiBPZiBjb3Vyc2UgSSB3b3VsZCBjaG9vc2UgbXkgc2VjdXJpdHkgc3Vw cGxpZXIgY2FyZWZ1bGx5LCBcPGJyPg0KJm5ic3A7fCZndDsgYW5kIG5vdDxicj4NCiZuYnNwO3wm Z3Q7IG9uZSBhbGlnbmVkIHRvIHRoZSByZWdpbWUuIEkgdGhlbiBuZWVkIG9uZSBvciB0d28gZGV2 aWNlcyB0aGF0IHJvdXRlPGJyPg0KJm5ic3A7fCZndDsgdGhyb3VnaCBUb3IuPGJyPg0KJm5ic3A7 fCZndDs8YnI+DQombmJzcDt8Jmd0OyBJIGZ1bGx5IGFncmVlIHRoZSBjaGFsbGVuZ2UgaXMgdG8g ZGlzdGluZ3Vpc2ggbGVnaXRpbWF0ZSBuZXR3b3JrIHNpZ25hbHM8YnI+DQombmJzcDt8Jmd0OyBm cm9tIHRob3NlIG9mIGFuIGF0dGFja2VyLiBSb2J1c3RseSBpZGVudGlmeWluZyB3aG8gdGhleSBj YW1lIGZyb20gaXM8YnI+DQombmJzcDt8Jmd0OyBub24tdHJpdmlhbCwgYnV0IGhvcGVmdWxseSBu b3QgaW1wb3NzaWJsZT88YnI+DQombmJzcDt8Jmd0Ozxicj4NCiZuYnNwO3w8YnI+DQombmJzcDt8 WWVzLCBpZGVudGlmeWluZyB0aGUgdHJ1c3R3b3J0aGluZXNzIG9mIHRoZSBwZWVyIGlzIGRpc2N1 c3NlZCBpbiBSQVRTIFdHPGJyPg0KJm5ic3A7fChzZWUgPGEgaHJlZj0iaHR0cHM6Ly9kYXRhdHJh Y2tlci5pZXRmLm9yZy93Zy9yYXRzL2Fib3V0LyIgcmVsPSJub3JlZmVycmVyIiB0YXJnZXQ9Il9i bGFuayIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj4NCmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5v cmcvd2cvcmF0cy9hYm91dC88L2E+KS4gUmVtb3RlIGF0dGVzdGF0aW9uPGJyPg0KJm5ic3A7fHBy b2NlZHVyZXMgKFJBVFMpIGVuYWJsZSByZWx5aW5nIHBhcnRpZXMgdG8gZXN0YWJsaXNoIGEgbGV2 ZWwgb2YgY29uZmlkZW5jZTxicj4NCiZuYnNwO3xpbiB0aGUgdHJ1c3R3b3J0aGluZXNzIG9mIHJl bW90ZSBzeXN0ZW0gY29tcG9uZW50cyB0aHJvdWdoIHRoZSBjcmVhdGlvbiBvZjxicj4NCiZuYnNw O3xhdHRlc3RhdGlvbiBldmlkZW5jZSBieSByZW1vdGUgc3lzdGVtIGNvbXBvbmVudHMgYW5kIGEg cHJvY2Vzc2luZzxicj4NCiZuYnNwO3xjaGFpbiB0b3dhcmRzIHRoZSByZWx5aW5nIHBhcnR5LiBB IHJlbHlpbmcgcGFydHkgY2FuIHRoZW4gZGVjaWRlIHdoZXRoZXI8YnI+DQombmJzcDt8dG8gY29u c2lkZXIgYSByZW1vdGUgc3lzdGVtIGNvbXBvbmVudCB0cnVzdHdvcnRoeSBvciBub3QuPGJyPg0K Jm5ic3A7fDxicj4NCiZuYnNwO3xUaGUgY2xhaW1zIHVzZWQgYXMgZXZpZGVuY2UgYW5kIGF0dGVz dGF0aW9uIGZvciBETlMgc2VydmVyIGlzIGRpc2N1c3NlZCBpbjxicj4NCiZuYnNwO3w8YSBocmVm PSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtcmVkZHktYWRkLXNlcnZlci1wb2xp Y3ktc2VsZWN0aW9uLTA0IiByZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0iX2JsYW5rIiBtb3otZG8t bm90LXNlbmQ9InRydWUiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1yZWRkeS1h ZGQtc2VydmVyLXBvbGljeS1zZWxlY3Rpb24tMDQ8L2E+Ljxicj4NCjxicj4NCkkgcGVyc29uYWxs eSBkbyBub3QgZ2V0IHdoYXQgeWV0IGFub3RoZXIgbGluZSBvZiBhdXRob3JpdGllczxicj4NCnRy YW5zcG9ydGVkIHZpYSBKU09OIGVuY29kZWQgc3RydWN0dXJlcyBmZXRjaGVkIHZpYSBhbm90aGVy IEROUzxicj4NCnJlY29yZCB0aGF0IGp1c3QgZXhwb3NlcyB0aGF0IEpTT04gc3RydWN0dXJlIGdp dmVzIHRoZSB3b3JsZCBhbmV3Ljxicj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+PGJyPg0KPC9kaXY+ DQo8ZGl2PlJBVFMgYWxsb3dzIHRoZSBhdHRlc3RhdGlvbiB0byBiZSByZXByZXNlbnRlZCBpbiBK U09OIG9yIENCT1IgKHNlZSZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRt bC9kcmFmdC1pZXRmLXJhdHMtZWF0LTAzI3NlY3Rpb24tMS4xIiBtb3otZG8tbm90LXNlbmQ9InRy dWUiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXJhdHMtZWF0LTAzI3Nl Y3Rpb24tMS4xPC9hPikuJm5ic3A7IFRoZSBQQVQgb2JqZWN0IGlzIHJldHJpZXZlZA0KIHVzaW5n Jm5ic3A7PHNwYW4gc3R5bGU9ImNvbG9yOnJnYigwLDAsMCk7Zm9udC1zaXplOjEzLjMzMzNweCI+ UkVTSU5GTyBSUnR5cGUgKDwvc3Bhbj48YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0 bWwvZHJhZnQtcHAtYWRkLXJlc2luZm8tMDEiIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+aHR0cHM6 Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXBwLWFkZC1yZXNpbmZvLTAxPC9hPik8c3BhbiBz dHlsZT0iY29sb3I6cmdiKDAsMCwwKTtmb250LXNpemU6MTMuMzMzM3B4Ij4mbmJzcDthbmQNCiBp dCB1c2VzIEpTT04gdG8gcmV0dXJuIHRoZSByZXNvbHZlciBpbmZvcm1hdGlvbi48L3NwYW4+PC9k aXY+DQo8ZGl2PiZuYnNwOzwvZGl2Pg0KPGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBz dHlsZT0ibWFyZ2luOjBweCAwcHggMHB4DQogICAgICAgICAgICAwLjhleDtib3JkZXItbGVmdDox cHggc29saWQNCiAgICAgICAgICAgIHJnYigyMDQsMjA0LDIwNCk7cGFkZGluZy1sZWZ0OjFleCI+ DQo8YnI+DQpJbmRpcmVjdGlvbiBtYXkgbWFrZSBldmVyeXRoaW5nIHBvc3NpYmxlLCBidXQsIGkg bWVhbiwgdG8gbWUgdGhlPGJyPg0Ka2V5IHBvaW50IG9mIFJGQyA4NTcyIGZvciBleGFtcGxlIGlz IHRoZTxicj4NCjxicj4NCiZuYnNwOyAzLjMgT3duZXJzaGlwIFZvdWNoZXI8YnI+DQombmJzcDsg W3RoaXNdIGFydGlmYWN0IGlzIHVzZWQgdG8gc2VjdXJlbHkgaWRlbnRpZnkgYSBkZXZpY2UncyBv d25lciw8YnI+DQombmJzcDsgYXMgaXQgaXMga25vd24gdG8gdGhlIG1hbnVmYWN0dXJlci4mbmJz cDsgVGhlIG93bmVyc2hpcCB2b3VjaGVyIGlzPGJyPg0KJm5ic3A7IHNpZ25lZCBieSB0aGUgZGV2 aWNlJ3MgbWFudWZhY3R1cmVyLjxicj4NCjxicj4NCl9JZl8gaSBjYW4gZmluZCBteSB3YXkgaG9t ZSBpIGNhbiBzZWN1cmVseSB1cGRhdGUgbXlzZWxmLCB3aGVyZTxicj4NCnNlY3VyZWx5IG1lYW5z IG1hbnVmYWN0dXJlciBoZXJlLiZuYnNwOyBHcmVhdCB0aGF0IHN0YW5kYXJkIENNUyBpczxicj4N CnVzZWQuPGJyPg0KPC9ibG9ja3F1b3RlPg0KPGRpdj48YnI+DQo8L2Rpdj4NCjxkaXY+PGEgaHJl Zj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzg1NzIiIG1vei1kby1ub3Qtc2VuZD0i dHJ1ZSI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzg1NzI8L2E+Jm5ic3A7aXMgc3Bl Y2lmaWMgdG8gemVyby10b3VjaCBwcm92aXNpb25pbmcgb2YgbmV0d29ya2luZyBkZXZpY2VzIGFu ZCBJb1QgZGV2aWNlcyBpbiBFbnRlcnByaXNlIG5ldHdvcmtzLiBUaGUgb3duZXIgY2VydGlmaWNh dGUgY2FuIGJlIHVzZWQgdG8gdmFsaWRhdGUNCiB0aGUgUEFUIHNpZ25hdHVyZSAoc2VlIHRoZSBs YXN0IHBhcmFncmFwaCA8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQt cmVkZHktYWRkLXNlcnZlci1wb2xpY3ktc2VsZWN0aW9uLTA0I3NlY3Rpb24tMTAiIG1vei1kby1u b3Qtc2VuZD0idHJ1ZSI+DQpodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtcmVkZHkt YWRkLXNlcnZlci1wb2xpY3ktc2VsZWN0aW9uLTA0I3NlY3Rpb24tMTA8L2E+KS4mbmJzcDs8L2Rp dj4NCjxkaXY+PGJyPg0KPC9kaXY+DQo8ZGl2PiZuYnNwOzwvZGl2Pg0KPGJsb2NrcXVvdGUgY2xh c3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjBweCAwcHggMHB4DQogICAgICAgICAgICAw LjhleDtib3JkZXItbGVmdDoxcHggc29saWQNCiAgICAgICAgICAgIHJnYigyMDQsMjA0LDIwNCk7 cGFkZGluZy1sZWZ0OjFleCI+DQo8YnI+DQombmJzcDsgRXZlbiBpZiBETlNTRUMgW1JGQzY2OThd IGlzIHVzZWQgdG8gYXV0aGVudGljYXRlIHRoZSB2YXJpb3VzIEROUzxicj4NCiZuYnNwOyByZXNv dXJjZSByZWNvcmRzIFsuXSB0aGUgZGV2aWNlIGNhbm5vdCBiZSBzdXJlIHRoYXQgdGhlIGRvbWFp bjxicj4NCiZuYnNwOyByZXR1cm5lZCB0byBpdCwgZS5nLiwgZnJvbSBhIERIQ1Agc2VydmVyLCBi ZWxvbmdzIHRvIGl0czxicj4NCiZuYnNwOyByaWdodGZ1bCBvd25lci48YnI+DQo8YnI+DQpJdCB0 aGVuIHJlZmVycyBiYWNrIHRvIFJGQyA2NzYzLCBETlMtYmFzZWQgc2VydmljZSBkaXNjb3Zlcnku PGJyPg0KV2hpY2ggaGFzIHJlYWxseSBuaWNlLCBlYXN5IHRvIHBhcnNlIGNvbnRlbnQsIGFuZCBk b2VzIG5vdCB1c2U8YnI+DQpKU09OIG9ubHkgdG8gcmVwcmVzZW50IGtleS92YWx1ZSBwYWlycy4m bmJzcDsgKFdoeSBub3QgYSBmaXhlZCBDQk9SPGJyPg0KdGhpbmcgaW5zdGVhZCwgdGhleSBhcmUg dGFsa2luZyBtYXBzIGF0IHRoZSBtb21lbnQsIGZvciBleGFtcGxlLjxicj4NCkFuZCBjYW4gZWFz aWx5IGJlIGNvbnZlcnRlZCBiYWNrIGFuZCBmb3J0aCB0byBKU09OIHdoaWxlIHN0aWxsPGJyPg0K YmVpbmcgcGFyc2VkIGRpcmVjdGx5LCBhcyBpdCBpcyBiaW5hcnkuKSZuYnNwOyBXaGF0IGlzIHNv IHdyb25nIHdpdGg8YnI+DQp0aGlzIHNlcnZpY2UgZGlzY292ZXJ5IHRoaW5nLCBpIHRoaW5rIGl0 IGNvdWxkIHZlcnkgd2VsbCBzZXJ2ZTxicj4NCmFkZGl0aW9uYWwgdGhpbmdzLiZuYnNwOyBCdXQg ZXNwZWNpYWxseSBzbyBpZiBhbm90aGVyIHJlZ2lzdHJ5IGlzPGJyPg0KaW50cm9kdWNlZCBmb3Ig dGhlIGNvbmNlcHQuJm5ic3A7IFJGQyA4NTcyIGFsc28gc2F5czxicj4NCjxicj4NCiZuYnNwOyBV c2luZyBhIERIQ1Agc2VydmVyIG1heSBiZSBhIGNvbXBlbGxpbmcgb3B0aW9uIGZvciBkZXBsb3lt ZW50czxicj4NCiZuYnNwOyBoYXZpbmcgZXhpc3RpbmcgREhDUCBpbmZyYXN0cnVjdHVyZSwgYXMg aXQgZW5hYmxlcyBhIHRvdWNobGVzczxicj4NCiZuYnNwOyBib290c3RyYXBwaW5nIG9wdGlvbiB0 aGF0IGRvZXMgbm90IGVudGFpbCB1dGlsaXppbmcgYW48YnI+DQombmJzcDsgSW50ZXJuZXQtYmFz ZWQgcmVzb3VyY2UgaG9zdGVkIGJ5IGEgdGhpcmQgcGFydHkuPGJyPg0KPGJyPg0KJm5ic3A7IEEg REhDUCBzZXJ2ZXIgaXMgYW4gdW50cnVzdGVkIHNvdXJjZSBvZiBib290c3RyYXBwaW5nIGRhdGEu PGJyPg0KJm5ic3A7IFRodXMsIHRoZSBpbmZvcm1hdGlvbiBzdG9yZWQgb24gdGhlIERIQ1Agc2Vy dmVyIGVpdGhlciBNVVNUIGJlPGJyPg0KJm5ic3A7IHNpZ25lZCBvciBNVVNUIGJlIGluZm9ybWF0 aW9uIHRoYXQgY2FuIGJlIHByb2Nlc3NlZDxicj4NCiZuYnNwOyBwcm92aXNpb25hbGx5IChlLmcu LCB1bnNpZ25lZCByZWRpcmVjdCBpbmZvcm1hdGlvbikuPGJyPg0KPGJyPg0KSSBkbyBub3Qga25v dyAocGVvcGxlIGNhbiBhZ3JlZSBoZXJlKSwgYnV0IGlmIHRoYXQgY291bGQgaW1wcm92ZS48YnI+ DQpBbHNvIGJlaW5nIHgtcmF5ZWQgeWVzdGVyZGF5ICh1bnRyZWF0ZWQgYmlrZSBhY2NpZGVudCBs YXN0PGJyPg0KTm92ZW1iZXIpIG15IHBpY3R1cmVzIGFyZSBub3cgYXQgPGEgaHJlZj0iaHR0cDov L2hlYWx0aGRhdGFzcGFjZS5vcmciIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiIG1v ei1kby1ub3Qtc2VuZD0idHJ1ZSI+DQpoZWFsdGhkYXRhc3BhY2Uub3JnPC9hPiBldmVuIHdpdGhv dXQ8YnI+DQptZSBhZ3JlZWluZyB3aXRoIHRoYXQsIHRoZXkgaGF2ZSBhIEdlcm1hbiBkYXRhIHNl Y3VyaXR5IHNlYWwgb2Y8YnI+DQphcHByb3ZhbCwgYnV0IHRoZW4gaXQgaXMganVzdCBhIFFSLWNv ZGUgYW5kL29yIGFuIGFjY2VzcyBjb2RlPGJyPg0KKGFscGhhbnVtZXJpYyBhbmQgbGVuZ3RoIG9m IDEwIG9yIDEyLCBpaXJjKS48YnI+DQo8YnI+DQpJdCBpcyBub3QgYW4gb3B0aW9uIGZvciBhIGxp Z2h0IGJ1bGIsIGJ1dCB0aGF0IHRoaW5nIHN1cmVseTxicj4NCmJlbG9uZ3MgYmVoaW5kIGEgaG91 c2Vob2xkIHJvdXRlciwgYW5kIGVhc3kgdXNhYmxlIHJvdXRlcnMgd2l0aDxicj4NCndoeSBub3Qg YW1wbGUtc3R5bGUgdXNlIGNhc2VzIHdvdWxkIGJlIGdyZWF0LCBpbWhvLiZuYnNwOyBXaXRoIGEg c2hvcnQ8YnI+DQpmaW5nZXJwcmludCBwcmludGVkIG9uIGEgZGV2aWNlIHRoYXQgc2hvd3MgdXAg b24gdGhhdCByb3V0ZXIsIGp1c3Q8YnI+DQpsaWtlIGZvciBCbHVldG9vdGggcGFpcmluZy4mbmJz cDsgSSBjb3VsZCBpbWFnaW5lIHBlb3BsZSBjb3VsZCBnZXQgdXNlZDxicj4NCnRvIHRoYXQuJm5i c3A7IChFc3BlY2lhbGx5IHdpdGggc29tZSBraW5kIG9mIHRob3NlIHRlcnJpYmxlIGFwcHMgb248 YnI+DQp0aGVpciBzbWFydCBwaG9uZXMgd2hpY2ggYXJlIGxpbmtlZCB0byB0aGUgJnF1b3Q7cm91 dGVyJnF1b3Q7IG9mIHRoZTxicj4NCmhvdXNlaG9sZCwgdGhlbiwgc28gdGhleSBnZXQgaW5mb3Jt ZWQgb2YgdGhhdCBldmVudC4mbmJzcDsgSSB0aGluayBESENQPGJyPg0KZXZlbiBhbGxvd3MgaWRl bnQgc3RyaW5ncyB0byBiZSBlbWl0dGVkIGZyb20gREhDUCBjbGllbnQgdG88YnI+DQpzZXJ2ZXIu KTxicj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+PGJyPg0KPC9kaXY+DQo8ZGl2PlRoZXJlIGFyZSBz ZXZlcmFsIG1lY2hhbmlzbXMgdG8gc2VjdXJlbHkgYm9vdHN0cmFwIElvVCBkZXZpY2VzLCB5b3Ug bWF5IHdhbnQgdG8gbG9vayBpbnRvIHRoZSByZWNlbnRseSBhZG9wdGVkIGRyYWZ0Jm5ic3A7PGEg aHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXNhcmlrYXlhLXQydHJnLXNi b290c3RyYXBwaW5nLTA4IiBtb3otZG8tbm90LXNlbmQ9InRydWUiPmh0dHBzOi8vdG9vbHMuaWV0 Zi5vcmcvaHRtbC9kcmFmdC1zYXJpa2F5YS10MnRyZy1zYm9vdHN0cmFwcGluZy0wODwvYT4mbmJz cDtieQ0KIFQyVFJHIGFuZCZuYnNwOzwvZGl2Pg0KPGRpdj53aXRoaW4gdGhlIHNjb3BlIG9mIElF VEYgaXMgQlJTS0kgYW5kIFNaVFAuPC9kaXY+DQo8ZGl2Pjxicj4NCjwvZGl2Pg0KPGRpdj5DaGVl cnMsPC9kaXY+DQo8ZGl2Pi1UaXJ1Jm5ic3A7PC9kaXY+DQo8YmxvY2txdW90ZSBjbGFzcz0iZ21h aWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46MHB4IDBweCAwcHgNCiAgICAgICAgICAgIDAuOGV4O2Jv cmRlci1sZWZ0OjFweCBzb2xpZA0KICAgICAgICAgICAgcmdiKDIwNCwyMDQsMjA0KTtwYWRkaW5n LWxlZnQ6MWV4Ij4NCjxicj4NClNvcnJ5LCBpIGRvIG5vdCBzZWVtIHRvIHVuZGVyc3RhbmQuPGJy Pg0KPGJyPg0KLS1zdGVmZmVuPGJyPg0KfDxicj4NCnxEZXIgS3JhZ2VuYmFlciwmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFRoZSBtb29uIGJl YXIsPGJyPg0KfGRlciBob2x0IHNpY2ggbXVudGVyJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDtoZSBjaGVlcmZ1bGx5IGFuZCBvbmUgYnkgb25lPGJyPg0KfGVpbmVuIG5h Y2ggZGVtIGFuZGVyZW4gcnVudGVyJm5ic3A7IHdhLmtzIGhpbXNlbGYgb2ZmPGJyPg0KfChCeSBS b2JlcnQgR2VybmhhcmR0KTxicj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8YnI+ DQo8ZmllbGRzZXQgY2xhc3M9Im1pbWVBdHRhY2htZW50SGVhZGVyIj48L2ZpZWxkc2V0PiA8L2Js b2NrcXVvdGU+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_0587c41a2b3db453387aabb8e867875eericssoncom_-- From nobody Fri Jul 31 01:51:26 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 31FF53A1151 for ; Fri, 31 Jul 2020 01:51:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kO00_m18Paug for ; Fri, 31 Jul 2020 01:51:08 -0700 (PDT) Received: from mail-il1-x134.google.com (mail-il1-x134.google.com [IPv6:2607:f8b0:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 182C43A112F for ; Fri, 31 Jul 2020 01:51:08 -0700 (PDT) Received: by mail-il1-x134.google.com with SMTP id t18so24772794ilh.2 for ; Fri, 31 Jul 2020 01:51:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=szZ3cMtiyTU2hE/KdwB9gLdAYbtm9JcgafBHG0rifLY=; b=qeLl/WKRKMhYiOQuzfZWVdeclzVhGz77P07TdMQkXV+hE85sY55N30PvZToYItrAv0 dMfrPMIIHxo/++g3I1gdepwejD5aM7sHMTgKim/3go2mcVkeSPW293FLMmLXR0VZ+EuM f3MxSEWrqrXYuwJDMW3yq+ue9TqK9d7eNb5EhHOLilo6z7f/O8t+GCMolwBLdMI1tkF9 HT7TNPHV1Ale4QlvIPTWQnR3aSUtmCpVt++0Gv4Fvts7JzJJu9XWlVteco2DTzT5+PKq KvSR8Ins7dbO3ZJ0m2q7PDiyC3b9Xp7Lx8LpuoOaOVCE6Bf9WyjbeTUZyg5+a3nr9yWn g5cw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=szZ3cMtiyTU2hE/KdwB9gLdAYbtm9JcgafBHG0rifLY=; b=OzIOFcoYRkvpQ+D8nmjwiO1xIg3AIkShanG8pW1S8dKXPbAsUCmS3gn5mV3ij013c1 KKE7IkQGu2v0LAcTEdW5bZgmeN20+2fA+EPyZYSP6gC6AoClh29KQI6QO0l7EnYWBQFZ e0ESOtSQnPXbi+DFaP6+Nln0DdfFggRDd1qAR6/GDvg7EXT3cYC5Ua8g2garS/NuaQDz /Gu4xeNKitRKYDU9Y+l+RXyo7Gw6O7/cWrL5cbe4IOS3zA7vANdPIhqHjGss3Bv7Knfb qjdgmNG9AbYDYhG7yA6tKB+Agb9yu0DEw+9XcWRLYiBJG9SHc+dlq7fJnyeHVZx+kbU0 3ykA== X-Gm-Message-State: AOAM5327/H4aENJDw0NwiHKNR5z/sObstMe/ArhWPqOOv5lHS818Ivog 58D++oOdqN8Ddp59ZwTtqjzA1Jlbocord3b46J8= X-Google-Smtp-Source: ABdhPJwOaZpmVYXE7qj2tDsU5+jrVAfRK3ClciUjlU/oWNSNROXUefzYWhaHmlyIOpCml4k50tdQ0L41YV/S7CMYcJU= X-Received: by 2002:a92:89ce:: with SMTP id w75mr2481217ilk.123.1596185467189; Fri, 31 Jul 2020 01:51:07 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> <20200730132857.6MGkL%steffen@sdaoden.eu> <73f8a8a4-7ab9-48b0-da53-ca5c271b3fff@ericsson.com> In-Reply-To: <73f8a8a4-7ab9-48b0-da53-ca5c271b3fff@ericsson.com> From: tirumal reddy Date: Fri, 31 Jul 2020 08:50:55 +0000 Message-ID: To: Mohit Sethi M Cc: "Chris Box (BT)" , Tommy Jensen , Andrew Campling , ADD Mailing list , Ted Lemon , Rob Sayre , Steffen Nurpmeso Content-Type: multipart/alternative; boundary="000000000000c47f3905abb8e359" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jul 2020 08:51:17 -0000 --000000000000c47f3905abb8e359 Content-Type: text/plain; charset="UTF-8" On Fri, 31 Jul 2020 at 08:13, Mohit Sethi M wrote: > You might find this useful: > https://tools.ietf.org/html/draft-ietf-emu-eap-noob-01. Sure it uses > EAP, but it is about time we move to better security protocols (rather > than relying on network-wide shared secrets). EAP naturally also allows > you to run the server in the home router or in the cloud and do all > sorts of federation/roaming (such as eduroam). > +1. EAP will solve several attacks like Evil twin and weaknesses in WPA2/WPA3. It also helps to uniquely identify devices without having to rely on MAC addresses and the network security service can enforce device isolation to quarantine infected devices (and can deal with MAC spoofing). -Tiru > > I would also add that the most light bulbs don't speak directly to the > home router and often have their own gateway (or what Philips calls a > bridge) to translate zigbee to Wi-Fi/ethernet etc. > > --Mohit > > > Sorry, i do not seem to understand. > > > > --steffen > > | > > |Der Kragenbaer, The moon bear, > > |der holt sich munter he cheerfully and one by one > > |einen nach dem anderen runter wa.ks himself off > > |(By Robert Gernhardt) > > > --000000000000c47f3905abb8e359 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, 31 Jul 2020 at 08:13, Mohit Sethi M <mohit.m.sethi@ericsson.com>= wrote:
You might find this useful:
https://tools.ietf.org/html/draft-ietf-emu-eap= -noob-01. Sure it uses
EAP, but it is about time we move to better security protocols (rather
than relying on network-wide shared secrets). EAP naturally also allows you to run the server in the home router or in the cloud and do all
sorts of federation/roaming (such as eduroam).

+1. EAP will solve several attacks like Evil twin and weakness= es in WPA2/WPA3. It also helps to uniquely identify devices without having = to rely on MAC addresses and the network security service=C2=A0can enforce = device isolation to quarantine infected devices (and can deal with MAC spoo= fing).=C2=A0

-Tiru
=C2=A0

I would also add that the most light bulbs don't speak directly to the =
home router and often have their own gateway (or what Philips calls a
bridge) to translate zigbee to Wi-Fi/ethernet etc.

--Mohit

> Sorry, i do not seem to understand.
>
> --steffen
> |
> |Der Kragenbaer,=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 The moon bear,
> |der holt sich munter=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0he cheer= fully and one by one
> |einen nach dem anderen runter=C2=A0 wa.ks himself off
> |(By Robert Gernhardt)
>
--000000000000c47f3905abb8e359-- From nobody Fri Jul 31 05:44:10 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D25843A100A for ; Fri, 31 Jul 2020 05:44:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F4gLcs5VbEbP for ; Fri, 31 Jul 2020 05:44:05 -0700 (PDT) Received: from sdaoden.eu (sdaoden.eu [217.144.132.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 991C83A09A5 for ; Fri, 31 Jul 2020 05:44:05 -0700 (PDT) Received: by sdaoden.eu (Postfix, from userid 1000) id 546B016056; Fri, 31 Jul 2020 14:44:03 +0200 (CEST) Date: Fri, 31 Jul 2020 14:44:02 +0200 From: Steffen Nurpmeso To: Mohit Sethi M Cc: tirumal reddy , "Chris Box (BT)" , Tommy Jensen , Andrew Campling , ADD Mailing list , Ted Lemon , Rob Sayre , Steffen Nurpmeso Message-ID: <20200731124402.5D-gP%steffen@sdaoden.eu> In-Reply-To: <73f8a8a4-7ab9-48b0-da53-ca5c271b3fff@ericsson.com> References: <3954080.qUnaP1aulD@linux-9daj> <6CDFB1BB-9AEB-411B-B338-CCBC1BA54C03@fugue.com> <20200730132857.6MGkL%steffen@sdaoden.eu> <73f8a8a4-7ab9-48b0-da53-ca5c271b3fff@ericsson.com> Mail-Followup-To: Mohit Sethi M , tirumal reddy , "Chris Box (BT)" , Tommy Jensen , Andrew Campling , ADD Mailing list , Ted Lemon , Rob Sayre , Steffen Nurpmeso User-Agent: s-nail v14.9.19-92-ga7d96581-dirty OpenPGP: id=EE19E1C1F2F7054F8D3954D8308964B51883A0DD; url=https://ftp.sdaoden.eu/steffen.asc; preference=signencrypt BlahBlahBlah: Any stupid boy can crush a beetle. But all the professors in the world can make no bugs. Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jul 2020 12:44:09 -0000 Mohit Sethi M wrote in <73f8a8a4-7ab9-48b0-da53-ca5c271b3fff@ericsson.com>: |Hi Steffen, | |In-line. Well. |You might find this useful: |https://tools.ietf.org/html/draft-ietf-emu-eap-noob-01. Sure it uses No, not me, sorry. |I would also add that the most light bulbs don't speak directly to the |home router and often have their own gateway (or what Philips calls a |bridge) to translate zigbee to Wi-Fi/ethernet etc. I was reiterating an example that had been used in the thread. I could have used refrigerator instead. But i did not. --steffen | |Der Kragenbaer, The moon bear, |der holt sich munter he cheerfully and one by one |einen nach dem anderen runter wa.ks himself off |(By Robert Gernhardt) From nobody Fri Jul 31 06:41:33 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F1E513A0A4A for ; Fri, 31 Jul 2020 06:41:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nLS6JWll3XNZ for ; Fri, 31 Jul 2020 06:41:30 -0700 (PDT) Received: from mail-qk1-x733.google.com (mail-qk1-x733.google.com [IPv6:2607:f8b0:4864:20::733]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D2523A0A9F for ; Fri, 31 Jul 2020 06:41:30 -0700 (PDT) Received: by mail-qk1-x733.google.com with SMTP id j187so28709135qke.11 for ; Fri, 31 Jul 2020 06:41:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language; bh=ECoVqk3aUjZdotsvLjebYfgCz4GqdQLEWjZAStEZpPQ=; b=XdHveif/WcHIeSMP33mfVVQMp8bghongiLQOwKIcwthlGklCMpcQSb9i7BxHGd8olF UNvok+tr3enwrtwAdczPKK/GQdQNOfF++OmNA3fnhoL2Fnxeh5Cr3JYMmMGkq4rw1VVX Mp9NT33dq15DSZvSAtz6KK3KlKlO6uJ6/8CIksCOIeewJCgTfpzQhKmN6dE7nqIvEpA1 eKfwc0YcSsMva4XyNk2jGsgzsK1a5Xs7bpbAhEd8AJZgsPBJ5SISmFwBTxwEOqP7oW5P d+S/tY+X/RymIIjhvpClrIhTcq2x/i/m9eVXTXzLK6DXGOAAUwVOlwueSx9HJTskWgvK evGQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language; bh=ECoVqk3aUjZdotsvLjebYfgCz4GqdQLEWjZAStEZpPQ=; b=gkKjl1uLONw21t7z6ZUx8/gy/VurvM0EsY+oKEU1AEdwoCEpCtwDkDq3uifSTeyyGq 7UL773xIvd81dnd9eZOxjO3S7c+/LYGukFz/OwHOwizJmut5zg5dD3SL1PPJzGvNldin m5HpyN93WAjaVzGLpTmBiF3lGRBL4WdEWG4I69jqRtonQ41j7/JqB+0EtGZuznNPUKBo bozypAf+5wSObfRTqdcFfh6eIt0E+l5j7h+1vMkpi/qFz1w22F/v6vzeEfzyPOAX/91N Uz5AF9L/MtErHtNH78Zzux/PVSps/d/p4U9J+5iVKEHe6qJjv5pOSvKHeu+qhT2OOb8G 0yNg== X-Gm-Message-State: AOAM5329Zh0vlxKfh6Pc3f49Xjf90EHGKQW0A5Gemu477OvNNQRxwikr qiP0WuETOc1Fm4I228fiErCq+tfL5RM= X-Google-Smtp-Source: ABdhPJxLY6fIWriYpHFgbFBNEXjhXSEBSnzo4TiFBS8SI9WCdKjs5La+a3bCMqH1a2v95mUXPna6ug== X-Received: by 2002:a37:ba82:: with SMTP id k124mr4051800qkf.112.1596202889071; Fri, 31 Jul 2020 06:41:29 -0700 (PDT) Received: from [192.168.1.249] (pool-70-106-222-98.clppva.fios.verizon.net. [70.106.222.98]) by smtp.gmail.com with ESMTPSA id p4sm7865463qkj.135.2020.07.31.06.41.27 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 31 Jul 2020 06:41:27 -0700 (PDT) To: Vittorio Bertola Cc: ADD Mailing list References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <1058866258.602.1596113482164@appsuite-gw2.open-xchange.com> From: Tony Rutkowski Message-ID: <5ff36b54-cc1a-ab54-3a92-04f86b850421@gmail.com> Date: Fri, 31 Jul 2020 09:41:26 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 MIME-Version: 1.0 In-Reply-To: <1058866258.602.1596113482164@appsuite-gw2.open-xchange.com> Content-Type: multipart/alternative; boundary="------------123FF87844549800F7D3D23F" Content-Language: en-US Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jul 2020 13:41:32 -0000 This is a multi-part message in MIME format. --------------123FF87844549800F7D3D23F Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Hi Vittorio, Fortunately, eTLS was shifted to ETSI TC CYBER by the industry, significantly improved, adopted as ETS, rolled out with running code by providers in the marketplace, and now being widely used worldwide by enterprise network providers.  The persistent URI of the current version is https://www.etsi.org/deliver/etsi_ts/103500_103599/10352303/01.03.01_60/ts_10352303v010301p.pdf The marketplace ultimately prevails in deciding what capabilities are needed and "routes around" difficult venues. :-) --tony On 30-Jul-20 8:51 AM, Vittorio Bertola wrote: >> Il 29/07/2020 18:50 Tommy Jensen >> ha scritto: >> Hey Andrew, >> Can you be specific about your GDPR concerns? Each time I press on >> what parts of the proposals run afoul of GDPR, here or in other DNS >> bodies, I'm told "talk to your lawyer" which, to be fair, is a valid >> answer. However, if there are not specific technical concerns that >> can be shared on list, I don't think we should block standard design >> on the vague legal risk that _might_ exist. Let's be specific about >> the GDPR concerns. > I'm not Andrew nor a lawyer, but for what regards myself, the GDPR > concerns about the adaptive DNS model are that it creates a way for an > extremely high number of third parties to ask the browser for DNS data > that they would not currently get, countering the principles of > privacy by design and data minimization that are mandated by the GDPR > whenever data processing activities are conceived. > I understand the point that these parties would generally be the ones > that would later be contacted through an application-layer protocol to > get the actual service, but it still need to be assessed whether the > DNS query can be considered as part of the actual service, whether it > does not disclose additional information, and so on; and more > importantly, I see no guarantees that this mechanism cannot rather be > used to bring additional parties into the loop, by designating them as > DNS providers, and broaden the set of entities that get the user's > information. > It's true that the burden of finding good, legal and > privacy-protecting policies for using the specs could be left to > implementations, but this could be said of pretty much anything. Even > the dreaded "eTLS" architecture could have been implemented legally > and positively under an appropriate choice of policies, yet the IETF > rightfully decided to reject it, as the architecture itself was too > prone to privacy damage. In fact, RFC 6973 gives data minimization and > user control as guidelines for protocol design, and the adaptive DNS > model IMHO counters both of those principles. > > -- > > Vittorio Bertola | Head of Policy & Innovation, Open-Xchange > vittorio.bertola@open-xchange.com > Office @ Via Treviso 12, 10144 Torino, Italy > --------------123FF87844549800F7D3D23F Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

Hi Vittorio,

Fortunately, eTLS was shifted to ETSI TC CYBER by the industry, significantly improved, adopted as ETS, rolled out with running code by providers in the marketplace, and now being widely used worldwide by enterprise network providers.  The persistent URI of the current version is https://www.etsi.org/deliver/etsi_ts/103500_103599/10352303/01.03.01_60/ts_10352303v010301p.pdf

The marketplace ultimately prevails in deciding what capabilities are needed and "routes around" difficult venues. :-)

--tony

On 30-Jul-20 8:51 AM, Vittorio Bertola wrote:
 
Il 29/07/2020 18:50 Tommy Jensen <jensen.thomas=40microsoft.com@dmarc.ietf.org> ha scritto:
 
 
Hey Andrew,
 
Can you be specific about your GDPR concerns? Each time I press on what parts of the proposals run afoul of GDPR, here or in other DNS bodies, I'm told "talk to your lawyer" which, to be fair, is a valid answer. However, if there are not specific technical concerns that can be shared on list, I don't think we should block standard design on the vague legal risk that _might_ exist. Let's be specific about the GDPR concerns.
I'm not Andrew nor a lawyer, but for what regards myself, the GDPR concerns about the adaptive DNS model are that it creates a way for an extremely high number of third parties to ask the browser for DNS data that they would not currently get, countering the principles of privacy by design and data minimization that are mandated by the GDPR whenever data processing activities are conceived.
 
I understand the point that these parties would generally be the ones that would later be contacted through an application-layer protocol to get the actual service, but it still need to be assessed whether the DNS query can be considered as part of the actual service, whether it does not disclose additional information, and so on; and more importantly, I see no guarantees that this mechanism cannot rather be used to bring additional parties into the loop, by designating them as DNS providers, and broaden the set of entities that get the user's information.
 
It's true that the burden of finding good, legal and privacy-protecting policies for using the specs could be left to implementations, but this could be said of pretty much anything. Even the dreaded "eTLS" architecture could have been implemented legally and positively under an appropriate choice of policies, yet the IETF rightfully decided to reject it, as the architecture itself was too prone to privacy damage. In fact, RFC 6973 gives data minimization and user control as guidelines for protocol design, and the adaptive DNS model IMHO counters both of those principles.

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy

--------------123FF87844549800F7D3D23F-- From nobody Fri Jul 31 07:05:24 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D7693A0B09 for ; Fri, 31 Jul 2020 07:05:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uBkPM0OsD3yb for ; Fri, 31 Jul 2020 07:05:18 -0700 (PDT) Received: from mail-lf1-x136.google.com (mail-lf1-x136.google.com [IPv6:2a00:1450:4864:20::136]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8EA983A09BD for ; Fri, 31 Jul 2020 07:05:18 -0700 (PDT) Received: by mail-lf1-x136.google.com with SMTP id b30so16910151lfj.12 for ; Fri, 31 Jul 2020 07:05:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=PSoiNPlvnBy2mBwU40jdCc74yFnrHGF/Bza+nR66hVQ=; b=c2k/hQJWor200dZclakUBMLZ+RPbVvhdpBiUWrFOs8NVoLHE8pIkiUFtQdKXZaLTAd NnZ4b7WzU73KNOCo2hh1RvtjbnRZHbhA02NfB01diqLWlY9xorgXLq/5v7qwZEarkw4d FCzNeHODAlU8kuv7XlBQ3luPnDCoNyD1jIArsuRFKvlc7s06n4TN+xQOF5HK5jcROfTw C5JJuEabct9UPQlH0ahJoHMuVLTI6fM+02YIWF0tsgEbgoK5yGMEXTwc1IWAraCnTwY8 pQZsC5RroYm8HnrdHmMs4vw6XCZCUbNIUl4meKXJ2LZ4OFR1R48rPgZe9Nf3tmGIbLhN K7VQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=PSoiNPlvnBy2mBwU40jdCc74yFnrHGF/Bza+nR66hVQ=; b=NwoDJxZoPatjVdE+MjQk4C/i9vpOJJ0TfqcvxqmOjA5FaYA549qHS4MzMG4OIvyeiQ bGIVGu0M1pTJp+wcntim41zHv9rkZt/aFi5PEOXXyRTsTqUdvgqO60rTmzdRkAQdpjed UyxBMafgFaCcCfZtqRaq1D+aZczibeyuQG+ywEBQTSOMIXW3LVkkuTCfETYqDJqfbRRd 3uwkUGodAWqm6vcIvQGXLAE/v9vpwp9AVPnkww1I/C7tnTZOIslm6umhJZmD9NMjE0tR kFdwxXun8bx7m3lctFpNom+43vyQeF1SMnic8o1XTlD0PeIYRwkfPiDjbHfi3qjnysmg ytiw== X-Gm-Message-State: AOAM532/ivDftSBfWNAkfgmSWHrQXMJfcMYG/xa04UGuaEy2ZyIBrJaJ lbT/YOrDCxSuvEDUj7dhepKBXZzqgMAn06WezoTV6Q== X-Google-Smtp-Source: ABdhPJyiJ6f4AVKZCNkLcP1ScSI+LaYJhY1Vye2UIGANOSn7fu98hv9NAZfhhrXBsXdJtk6ZMzFwCzEVLJMk+qgmiIc= X-Received: by 2002:ac2:46d4:: with SMTP id p20mr2137804lfo.109.1596204316742; Fri, 31 Jul 2020 07:05:16 -0700 (PDT) MIME-Version: 1.0 References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <1058866258.602.1596113482164@appsuite-gw2.open-xchange.com> <5ff36b54-cc1a-ab54-3a92-04f86b850421@gmail.com> In-Reply-To: <5ff36b54-cc1a-ab54-3a92-04f86b850421@gmail.com> From: Eric Rescorla Date: Fri, 31 Jul 2020 07:04:40 -0700 Message-ID: To: Tony Rutkowski Cc: Vittorio Bertola , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000049f28605abbd474c" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jul 2020 14:05:21 -0000 --00000000000049f28605abbd474c Content-Type: text/plain; charset="UTF-8" On Fri, Jul 31, 2020 at 6:41 AM Tony Rutkowski wrote: > Hi Vittorio, > > Fortunately, eTLS was shifted to ETSI TC CYBER by the industry, > significantly improved, adopted as ETS, rolled out with running code by > providers in the marketplace, and now being widely used worldwide by > enterprise network providers. > Interesting. Can you expand on this? Which vendors provide ETS implementations? Are there any open source ones? -Ekr --00000000000049f28605abbd474c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Jul 31, 2020 at 6:41 AM Tony = Rutkowski <rutkowski.tony@gm= ail.com> wrote:
=20 =20 =20

Hi Vittorio,

Fortunately, eTLS was shifted to ETSI TC CYBER by the industry, significantly improved, adopted as ETS, rolled out with running code by providers in the marketplace, and now being widely used worldwide by enterprise network providers.=C2=A0

Interesting. Can you expand on this? Which vendors provide ETS imple= mentations? Are there any open source ones?

-E= kr

--00000000000049f28605abbd474c-- From nobody Fri Jul 31 08:11:14 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA9653A0407 for ; Fri, 31 Jul 2020 08:11:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jWpqBh3HjqfV for ; Fri, 31 Jul 2020 08:11:09 -0700 (PDT) Received: from mail-qt1-x829.google.com (mail-qt1-x829.google.com [IPv6:2607:f8b0:4864:20::829]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 88E1B3A09B3 for ; Fri, 31 Jul 2020 08:11:09 -0700 (PDT) Received: by mail-qt1-x829.google.com with SMTP id o22so22912997qtt.13 for ; Fri, 31 Jul 2020 08:11:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language; bh=2NMkIfI+NvSgIqpFkqreXH4LPba2y/7WCXiv91GEUsE=; b=TnpXvL2r7rMQu1CQwmMNUwc8+NnKcm9+Pmbf15YnO/N2dBpL6itTdV2lpYqOi+O3C6 5zWtRbH6mzW31s75jPeZoo9SdAW3pYmlxS6VFDbptpztlS0Axid7WXRgEPEUJzcTm3nK 0xdLwdvjUkDmviMgLWX8t0s5F+aX1r8izCFnqAc4ymVLsrsqixRJsBJ9cPJbmexh4mQa HHUToQPP6aZbN2KJGCt089P6zhTggGRIdmwbQUmTYx5kdT3xmLzlK7aAjWbZj0/rcnnW k8ryBuastEUCtXYvvIeXAfbErkwWUDr3aYEm1fiULX8NzGNt7RSEkPKAZ2fvIIE2V4c/ l39g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language; bh=2NMkIfI+NvSgIqpFkqreXH4LPba2y/7WCXiv91GEUsE=; b=Ny6nUUjerTFFcL7WC6c4muWTa09eJiVSQtOrzVUtfh7OADzwYAjHuzOGYjdS4QLcXs 2Rog3RGExcnoopBFrVLDNAMuorpbzGw26AV38jyqzWeNy3W4UtBqT4H0ejeWnu47K/3E Q3p+iqCiDhj3kkkVikn6Swvh61VZZrc1CVMS1/qXMVojIfpmQyumzFqRAyhGIEpDjiJc dFYyXX9kCQwsThK6igaOHN0rrl8M8Bcy7Akj1oS1HXsyEPrGfSencev4Mi9IGfyhAAXF 2umxbIy90btr9ZXiB1WsA0l/3RJR6EzO+tuHNBCY44phOP6ba2kIJk0f3G15GQRk0whX mkNA== X-Gm-Message-State: AOAM533fbUF8P7PoVte7psqEt+akqWNGUMyBxMr07H//BC9FS9sAU6rJ CiV70ru8oWFjbN91Cv8+ECD3gOqdkZE= X-Google-Smtp-Source: ABdhPJyUuJ3/auaPLIdiHbNfI4bmgn4Yjxtulmh0GffzeDl48Vb1ATlp+Hslu+gF5hOT3zV1ZaK46A== X-Received: by 2002:ac8:2a91:: with SMTP id b17mr4045225qta.202.1596208268295; Fri, 31 Jul 2020 08:11:08 -0700 (PDT) Received: from [192.168.1.249] (pool-70-106-222-98.clppva.fios.verizon.net. [70.106.222.98]) by smtp.gmail.com with ESMTPSA id i20sm8020413qka.17.2020.07.31.08.11.07 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 31 Jul 2020 08:11:07 -0700 (PDT) To: Eric Rescorla Cc: Vittorio Bertola , ADD Mailing list References: <3954080.qUnaP1aulD@linux-9daj> <8E7D3BAE-13C2-4DC8-9D23-3138DC2F4DE4@fugue.com> <1054325087.2835.1595936001612@appsuite-gw2.open-xchange.com> <1058866258.602.1596113482164@appsuite-gw2.open-xchange.com> <5ff36b54-cc1a-ab54-3a92-04f86b850421@gmail.com> From: Tony Rutkowski Message-ID: <5a1968be-2825-a451-b259-9c78403291f2@gmail.com> Date: Fri, 31 Jul 2020 11:11:07 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------902CAFD12842C40924B87011" Content-Language: en-US Archived-At: Subject: Re: [Add] [EXTERNAL] Re: New Version Notification for draft-pauly-add-resolver-discovery-01.txt X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jul 2020 15:11:12 -0000 This is a multi-part message in MIME format. --------------902CAFD12842C40924B87011 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Hi Eric, Might I suggest you join the ETSI TC CYBER MSP group and you can find out - even participate in the hackathons! cheers, tony On 31-Jul-20 10:04 AM, Eric Rescorla wrote: > > > On Fri, Jul 31, 2020 at 6:41 AM Tony Rutkowski > > wrote: > > Hi Vittorio, > > Fortunately, eTLS was shifted to ETSI TC CYBER by the industry, > significantly improved, adopted as ETS, rolled out with running > code by providers in the marketplace, and now being widely used > worldwide by enterprise network providers. > > Interesting. Can you expand on this? Which vendors provide ETS > implementations? Are there any open source ones? > > -Ekr > --------------902CAFD12842C40924B87011 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

Hi Eric,

Might I suggest you join the ETSI TC CYBER MSP group and you can find out - even participate in the hackathons!

cheers,
tony


On 31-Jul-20 10:04 AM, Eric Rescorla wrote:


On Fri, Jul 31, 2020 at 6:41 AM Tony Rutkowski <rutkowski.tony@gmail.com> wrote:

Hi Vittorio,

Fortunately, eTLS was shifted to ETSI TC CYBER by the industry, significantly improved, adopted as ETS, rolled out with running code by providers in the marketplace, and now being widely used worldwide by enterprise network providers. 

Interesting. Can you expand on this? Which vendors provide ETS implementations? Are there any open source ones?

-Ekr

--------------902CAFD12842C40924B87011-- From nobody Fri Jul 31 10:35:42 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E94203A0BD7 for ; Fri, 31 Jul 2020 10:35:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8FmI3_keTyWX for ; Fri, 31 Jul 2020 10:35:38 -0700 (PDT) Received: from mail-qt1-x82a.google.com (mail-qt1-x82a.google.com [IPv6:2607:f8b0:4864:20::82a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0368B3A0BD9 for ; Fri, 31 Jul 2020 10:35:37 -0700 (PDT) Received: by mail-qt1-x82a.google.com with SMTP id e5so9507639qth.5 for ; Fri, 31 Jul 2020 10:35:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=Nrzfnbnv3WaQBlRbBJGEiMeRPCjIjIBzHOlCWk48X3M=; b=P7CQeizcRbGaeI6xKXT5qtloFb6+tUdc8UfggOZ3+5cQ/PnbBSxv9PLkkD25KRSUXm OMjTI5fwW99nDmVpFTnhVNsJtJ7N4AoOE+C9xg0fIjkEM0uGCI+28GCAr3UxGqRcYkmC ahefW7Wias5FkqiSqPWUOM7HxTycqTrJoa8yVRqqlruuemDRMe5atoT4qNJ9PgdhY0KC b+LpSWIahpd7wAjJv2urUtUSVshtSLjM6AG6UED5XukaSwUwFd8fFEBejG2hWVGB5CSa +xayb0x+ar+wqTkER1RKG5OID9TmIImmB/tqcbGNbM7uSaBVa3Pqvwa7C6PR68vTIx1S wQgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=Nrzfnbnv3WaQBlRbBJGEiMeRPCjIjIBzHOlCWk48X3M=; b=AgZGEU33zCjg5YFn1FfnuXK7bzQT7qlXaKx+o34NPfDS9UorZtWsckixk7uhvlGL4n VPEwBGAMXZTXQu3xoJTxfpfdCXHwI+WQi7DkZ4GvaCyO6q8xPCbAQhX5fu8T1itHUa6o uhbEIrZjATOvPWPIXeSV6TCTR8dYB2Z7Vi4bKHjK//4+L2Cjiz4dPn82sQlSxM+mQMel Vmf+ltcF6ordaihHGKzKtcGMldDDCsI9U8vrjwCoLcrPaEdCkA3+zx62CdsvH9XPoDk3 mHLrJ9T5B25GtiM5ZWMTf8slQpsASEsAwygI2XXdghUROBs8rzknB3lAFvRGuEI+jcyk klHg== X-Gm-Message-State: AOAM533U/u2I3y6SeMhFnMTROp+P63CuYnAHXKKlN4W/g7fcNO/++xN2 UP++F/ldThUqZD0ukH6c88AjKITisIxzlJKDA13hovXY X-Google-Smtp-Source: ABdhPJym7rwwdP5hFPQFfogImYcKiIeXCcJcxck3BnhCwPNmeE+SEwgZLuqU8BuBjY4MsbrJPTBbXRqUFZ33aJGlWDc= X-Received: by 2002:ac8:4c86:: with SMTP id j6mr4846137qtv.65.1596216936865; Fri, 31 Jul 2020 10:35:36 -0700 (PDT) MIME-Version: 1.0 From: "Chris Box (BT)" Date: Fri, 31 Jul 2020 18:35:25 +0100 Message-ID: To: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000081a2b305abc0375d" Archived-At: Subject: [Add] Requirements drafts X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jul 2020 17:35:40 -0000 --00000000000081a2b305abc0375d Content-Type: text/plain; charset="UTF-8" All, My take on the conclusion of this week's meeting (notes at https://codimd.ietf.org/notes-ietf-108-add?view) was that the next step should be to step back and write some new drafts that clearly define the problem statement and requirements to be met. Assuming there is more than one of these drafts, how would you define the subject area for each one? Martin and Eric (Orth) both suggested Same Provider Auto Upgrade, aka "discovering potential upgrade information for the current resolver". Eric also suggested "networks communicating what their preferred resolver is". If the current resolver is the one automatically learned from the network, this is identical to the above. If it is not, because there's manual configuration, presumably we always/nearly-always honor the manual config? But are there cases where it's still helpful to know the network's preference? Within SPAU, I think a useful distinction is Ekr's "steering which generic resolver will be used". This allows for the current provider to have multiple possible resolvers (e.g. edge vs core), and communicating the nature of the differences between those options. Finally we have Domain Designated Resolvers, where domains tell you what their preferred resolver is. Any thoughts on the scope of each draft, and how many should be created in time for the September interim? Chris P.S. In terms of content, one idea I've had is that each should also mention performance considerations, particularly as I'm now thinking that the larger the set of resolvers a client talks to, the fewer requests it sends to each, and the more likely it is that a query will require a new TLS setup. Jim also mentioned another, that they'll need to report on GDPR-type issues --00000000000081a2b305abc0375d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
All,

My take on the conclusi= on of this week's meeting (notes at https://codimd.ietf.org/notes-ietf-108-add?view) was that the next step should be to step back and write some new drafts = that clearly define the problem statement and requirements to be met.

Assuming there is more than one of these drafts, ho= w would you define the subject area for each one?

= Martin and Eric (Orth) both suggested Same Provider Auto Upgrade, aka "= ;discovering potential upgrade information for the current resolver".<= br>

Eric also suggested "networks communicati= ng what their preferred resolver is". If the current resolver is the o= ne automatically learned from the network, this is identical to the above. = If it is not, because there's manual configuration, presumably we alway= s/nearly-always honor the manual config? But are there cases where it's= still helpful to know the network's preference?

Within SPAU, I think a useful distinction is Ekr's "steering wh= ich generic resolver will be used". This allows for the current provid= er to have multiple possible resolvers (e.g. edge vs core), and communicati= ng the nature of the differences between those options.


--00000000000081a2b305abc0375d-- From nobody Fri Jul 31 17:06:06 2020 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D4AA3A0D98 for ; Fri, 31 Jul 2020 17:06:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.101 X-Spam-Level: X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=apple.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VFsHGDINA-cg for ; Fri, 31 Jul 2020 17:06:00 -0700 (PDT) Received: from nwk-aaemail-lapp01.apple.com (nwk-aaemail-lapp01.apple.com [17.151.62.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D68223A0D96 for ; Fri, 31 Jul 2020 17:06:00 -0700 (PDT) Received: from pps.filterd (nwk-aaemail-lapp01.apple.com [127.0.0.1]) by nwk-aaemail-lapp01.apple.com (8.16.0.43/8.16.0.42) with SMTP id 07105W6V035702; Fri, 31 Jul 2020 17:05:58 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apple.com; h=from : message-id : content-type : mime-version : subject : date : in-reply-to : cc : to : references; s=20180706; bh=kcvxHTuoAKOEpJcU++ZSQctsjd6H6UbPbsCzP2ZH4VY=; b=Wum90UoMytgdsUtsz8pbDHV59kLUIgsw4rzw4k/ZWmtAWsiOLtbY5HLEt//+VccdKsSH wyXhXcTSqDuzNJ/kx0XRJdLGAtrhqrnC/YIRdfPE/s19l0lpIbNHoL55ffM6XmozIuAh 8Q+hCsGGO0jrl6f8Sef9mJUJrNZTLuntOgODH7oXUDm4AcHjnzhOdUnY0I28T6JAWwop gAtqpRAZ07/tDIoP1rAC3LOhsi8tfiLwQZBD4aZo02Q6fBGAevIl4NowzP9cdqY5HsDQ 9EZVaizzh7QzX741OThfwdyYCh3hUIQanJ3CVCy1EGCieof4LkxnQIUAQpa3Q/jNIPy8 +Q== Received: from rn-mailsvcp-mta-lapp04.rno.apple.com (rn-mailsvcp-mta-lapp04.rno.apple.com [10.225.203.152]) by nwk-aaemail-lapp01.apple.com with ESMTP id 32gkp1sx59-5 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Fri, 31 Jul 2020 17:05:57 -0700 Received: from rn-mailsvcp-mmp-lapp02.rno.apple.com (rn-mailsvcp-mmp-lapp02.rno.apple.com [17.179.253.15]) by rn-mailsvcp-mta-lapp04.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPS id <0QEC00LLWYXU55B0@rn-mailsvcp-mta-lapp04.rno.apple.com>; Fri, 31 Jul 2020 17:05:54 -0700 (PDT) Received: from process_milters-daemon.rn-mailsvcp-mmp-lapp02.rno.apple.com by rn-mailsvcp-mmp-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) id <0QEC00N00YOA2000@rn-mailsvcp-mmp-lapp02.rno.apple.com>; Fri, 31 Jul 2020 17:05:54 -0700 (PDT) X-Va-A: X-Va-T-CD: e518722f2d8d086b585720e594e79183 X-Va-E-CD: 20ace9065fad8be9c17658e63203d390 X-Va-R-CD: 188b8587c38c40904378f159d8ab1ce7 X-Va-CD: 0 X-Va-ID: 4f9e8293-e565-4665-90f5-b5291395ae44 X-V-A: X-V-T-CD: e518722f2d8d086b585720e594e79183 X-V-E-CD: 20ace9065fad8be9c17658e63203d390 X-V-R-CD: 188b8587c38c40904378f159d8ab1ce7 X-V-CD: 0 X-V-ID: 56a97cff-a42c-4a2a-9cc9-24b6d97ee779 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-31_09:2020-07-31, 2020-07-31 signatures=0 Received: from [17.232.211.20] (unknown [17.232.211.20]) by rn-mailsvcp-mmp-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPSA id <0QEC0111HYXSWG00@rn-mailsvcp-mmp-lapp02.rno.apple.com>; Fri, 31 Jul 2020 17:05:53 -0700 (PDT) From: Tommy Pauly Message-id: <08FF1483-D954-46A1-8231-D4C0C7078966@apple.com> Content-type: multipart/alternative; boundary="Apple-Mail=_B8D41589-A4F9-4FB7-844A-FE2B8E5539A9" MIME-version: 1.0 (Mac OS X Mail 13.4 \(3608.80.7.2.3\)) Date: Fri, 31 Jul 2020 17:05:52 -0700 In-reply-to: Cc: ADD Mailing list To: "Chris Box (BT)" References: X-Mailer: Apple Mail (2.3608.80.7.2.3) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-31_09:2020-07-31, 2020-07-31 signatures=0 Archived-At: Subject: Re: [Add] Requirements drafts X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Aug 2020 00:06:04 -0000 --Apple-Mail=_B8D41589-A4F9-4FB7-844A-FE2B8E5539A9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Chris, Thanks for starting this thread. I think focusing the interim meeting on = clarifying these use cases is a good idea. As I mentioned in my presentation, I think there are two clear = categories we see repeated across the proposals for discovery. In the = most abstract terms, these are: 1. Given a known resolver, discover one or more associated/equivalent = encrypted resolvers 2. Discover an encrypted resolver that is applicable to a limited domain Each of these has several specific use cases for *both* local network = resolvers and Internet-accessible resolvers. Under (1), we have: 1a: Discover encrypted resolvers that are equivalent to the resolver = given out by DHCP/RA 1b: Discover encrypted resolvers that are equivalent to a = manually-configured resolver, which may be a public Internet resolver 1c: Discover encrypted resolvers that are equivalent to a VPN-configured = DNS servers ... Under (2), we have: 2a: Discover a mapping between a locally-hosted domain and an encrypted = resolver - Walled-garden content - Locally-cached content - Private enterprise names 2b: Discover a mapping between a public domain and an encrypted resolver - Name hosted by CDN foo can use CDN foo=E2=80=99s resolver =E2=80=A6 I don=E2=80=99t think we need to cover the manual configuration case, = other than to indicate that user preference should always take = precedence. I don=E2=80=99t think there is a viable use for having a = network claim a preference that should override manual user = configuration. I think these two use cases could share one document, or be separate. = They probably shouldn=E2=80=99t be broken down any further than that. Beyond use cases, I think any requirements document needs to primarily = address the privacy, security, and authentication requirements of the = architecture. I suggest using some of the conversation from Martin = Thomson=E2=80=99s email thread titled =E2=80=9CMy principles for = discovery=E2=80=9D. We should have baseline standards for how trusted a = given signal must be before a client should use it. Thanks, Tommy > On Jul 31, 2020, at 10:35 AM, Chris Box (BT) = wrote: >=20 > All, >=20 > My take on the conclusion of this week's meeting (notes at = https://codimd.ietf.org/notes-ietf-108-add?view = ) was that the next = step should be to step back and write some new drafts that clearly = define the problem statement and requirements to be met. >=20 > Assuming there is more than one of these drafts, how would you define = the subject area for each one? >=20 > Martin and Eric (Orth) both suggested Same Provider Auto Upgrade, aka = "discovering potential upgrade information for the current resolver". >=20 > Eric also suggested "networks communicating what their preferred = resolver is". If the current resolver is the one automatically learned = from the network, this is identical to the above. If it is not, because = there's manual configuration, presumably we always/nearly-always honor = the manual config? But are there cases where it's still helpful to know = the network's preference? >=20 > Within SPAU, I think a useful distinction is Ekr's "steering which = generic resolver will be used". This allows for the current provider to = have multiple possible resolvers (e.g. edge vs core), and communicating = the nature of the differences between those options. >=20 > Finally we have Domain Designated Resolvers, where domains tell you = what their preferred resolver is. >=20 > Any thoughts on the scope of each draft, and how many should be = created in time for the September interim? >=20 > Chris >=20 > P.S. In terms of content, one idea I've had is that each should also = mention performance considerations, particularly as I'm now thinking = that the larger the set of resolvers a client talks to, the fewer = requests it sends to each, and the more likely it is that a query will = require a new TLS setup. Jim also mentioned another, that they'll need = to report on GDPR-type issues >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_B8D41589-A4F9-4FB7-844A-FE2B8E5539A9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Chris,

Thanks for = starting this thread. I think focusing the interim meeting on clarifying = these use cases is a good idea.

As I mentioned in my presentation, I = think there are two clear categories we see repeated across the = proposals for discovery. In the most abstract terms, these = are:

1. Given = a known resolver, discover one or more associated/equivalent encrypted = resolvers
2. Discover an encrypted resolver that is = applicable to a limited domain

Each of these has several specific use = cases for *both* local network resolvers and Internet-accessible = resolvers.

Under= (1), we have:
1a: Discover encrypted resolvers = that are equivalent to the resolver given out by DHCP/RA
1b: Discover encrypted resolvers that are equivalent to a = manually-configured resolver, which may be a public Internet = resolver
1c: Discover encrypted resolvers that are = equivalent to a VPN-configured DNS servers
...

Under (2), we have:
2a: Discover a = mapping between a locally-hosted domain and an encrypted = resolver
- Walled-garden content
- Locally-cached content
- Private = enterprise names
2b: Discover a mapping between a = public domain and an encrypted resolver
- Name = hosted by CDN foo can use CDN foo=E2=80=99s resolver
=E2=80=A6

I don=E2=80=99t think we need to cover the manual = configuration case, other than to indicate that user preference should = always take precedence. I don=E2=80=99t think there is a viable use for = having a network claim a preference that should override manual user = configuration.

I= think these two use cases could share one document, or be separate. = They probably shouldn=E2=80=99t be broken down any further than = that.

Beyond = use cases, I think any requirements document needs to primarily address = the privacy, security, and authentication requirements of the = architecture. I suggest using some of the conversation from Martin = Thomson=E2=80=99s email thread titled =E2=80=9CMy principles for = discovery=E2=80=9D. We should have baseline standards for how trusted a = given signal must be before a client should use it.

Thanks,
Tommy

On Jul 31, 2020, at 10:35 AM, = Chris Box (BT) <chris.box.ietf@GMAIL.COM> wrote:

All,

My take on the conclusion of this = week's meeting (notes at https://codimd.ietf.org/notes-ietf-108-add?view) was that = the next step should be to step back and write some new drafts that = clearly define the problem statement and requirements to be met.

Assuming there is more than one of these drafts, how would = you define the subject area for each one?

Martin and Eric (Orth) both suggested = Same Provider Auto Upgrade, aka "discovering potential upgrade = information for the current resolver".

Eric also suggested = "networks communicating what their preferred resolver is". If the = current resolver is the one automatically learned from the network, this = is identical to the above. If it is not, because there's manual = configuration, presumably we always/nearly-always honor the manual = config? But are there cases where it's still helpful to know the = network's preference?

Within SPAU, I think a useful distinction is Ekr's "steering = which generic resolver will be used". This allows for the current = provider to have multiple possible resolvers (e.g. edge vs core), and = communicating the nature of the differences between those options.

Finally we have=20 Domain Designated Resolvers, where domains tell you what their preferred = resolver is.

Any= thoughts on the scope of each draft, and how many should be created in = time for the September interim?

Chris

P.S. In terms of content, one idea I've had is that each should also = mention performance considerations, particularly as I'm now thinking = that the larger the set of resolvers a client talks to, the fewer = requests it sends to each, and the more likely it is that a query will = require a new TLS setup. Jim also mentioned another, that they'll need = to report on GDPR-type issues

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_B8D41589-A4F9-4FB7-844A-FE2B8E5539A9--